brightspace-mcp-server 3.13.18 → 3.13.20

package/build/auth/auth-runner.js

@@ -282,6 +282,17 @@ export class AuthRunner {
     pendingChallenge = null;
     /** Resolves on the next marker from the current child; null between children. */
     challengeSignal = null;
+    /**
+     * Callers polling the current child (awaitBackgroundChild), woken whenever
+     * it reports a challenge, so a changed number reaches them at once.
+     */
+    challengeWatchers = new Set();
+    /**
+     * The current child's last number-match challenge (relayKey) handed back
+     * to a caller here; null until one is. A retry joining the child waits
+     * only while the number is still this one (issue #229).
+     */
+    challengeToldKey = null;
     /** Callers inside run() right now. */
     waiting = 0;
     /** When the last caller left run(). */
@@ -365,9 +376,12 @@ export class AuthRunner {
         catch (error) {
             this.noteRelayReported(error);
             const answer = dedupeChallenge(error, wave);
-            if (answer instanceof AuthProcessError && answer.kind === "mfaPending" && !answer.duplicate && !answer.relayed) {
-                const now = Date.now();
-                this.challengeTold = { anchor: now, last: now };
+            if (answer instanceof AuthProcessError && answer.kind === "mfaPending" && !answer.relayed) {
+                this.challengeToldKey = relayKey(answer.kind, answer.numberMatch);
+                if (!answer.duplicate) {
+                    const now = Date.now();
+                    this.challengeTold = { anchor: now, last: now };
+                }
             }
             throw answer;
         }
@@ -387,6 +401,7 @@ export class AuthRunner {
         if (!this.childDone || pending?.kind !== "mfaPending" || !told || !isQueuedSibling(told, arrivedAt))
             return null;
         told.last = arrivedAt;
+        this.challengeToldKey = relayKey(pending.kind, pending.numberMatch);
         // In full, not the short sibling line: if the answer before it was lost,
         // this one still carries the digits (#201). It never reaches catch in
         // run(), so it extends the chain without restarting it.
@@ -444,7 +459,8 @@ export class AuthRunner {
             // shows them: Claude Desktop sends one and displays nothing, so holding
             // the call open after announcing kept the number from the user for up
             // to 45 seconds. The retry is what joins and waits for the approval.
-            // An automaticPending asks nothing of anyone, so keep waiting on it.
+            // An automaticPending asks nothing of anyone, so keep waiting on it,
+            // until it turns into a number: this caller was told none yet.
             if (error.kind === "mfaPending") {
                 try {
                     onChallenge?.(error.numberMatch);
@@ -457,7 +473,7 @@ export class AuthRunner {
             const windowMs = pollWindowMs(Date.now() - startedAt);
             if (windowMs <= 0)
                 throw error;
-            return this.awaitBackgroundChild(childDone, windowMs);
+            return this.awaitBackgroundChild(childDone, windowMs, null);
         }
     }
     /**
@@ -540,8 +556,9 @@ export class AuthRunner {
                     ? { phase: "automatic" }
                     : { phase: "approval", numberMatch: relayed.numberMatch ?? (latest.phase === "approval" ? latest.numberMatch : undefined) };
                 // A challenge appearing while this caller waited on a sign-in that had
-                // none yet is what the user needs right now: answer with it at once.
-                if (next.phase === "approval" && latest.phase !== "approval") {
+                // none yet, or a changed number (Entra's expired and the owner asked
+                // for a new one), is what the user needs right now: answer at once.
+                if (next.phase === "approval" && (latest.phase !== "approval" || next.numberMatch !== latest.numberMatch)) {
                     throw new AuthProcessError(...mfaPendingFailure(next.numberMatch), next.numberMatch, false, true);
                 }
                 latest = next;
@@ -603,6 +620,8 @@ export class AuthRunner {
      * read the number from the previous answer and is approving right now, so
      * this is the call that should carry the result. A still-unapproved
      * sign-in re-answers with the latest challenge and the caller tries again.
+     * A number no caller here was told yet (it changed since, or the call that
+     * would have carried it gave up first) is answered at once instead.
      */
     async joinBackgroundChild(childDone, startedAt) {
         if (!this.pendingChallenge && this.challengeSignal) {
@@ -610,21 +629,35 @@ export class AuthRunner {
         }
         if (!this.pendingChallenge)
             return childDone;
-        return this.awaitBackgroundChild(childDone, Math.max(0, pollWindowMs(Date.now() - startedAt)));
+        return this.awaitBackgroundChild(childDone, Math.max(0, pollWindowMs(Date.now() - startedAt)), this.challengeToldKey);
     }
     /**
      * Race a background child already past its MFA challenge against a wait
      * of graceMs. The child's own outcome wins if it lands in time; otherwise
      * the caller is re-answered with the latest challenge the child reported.
+     * A number-match challenge other than toldKey (the one this caller already
+     * knows; null for none) answers at once, whether it is already there or
+     * arrives during the wait (issue #229): the user is looking at a number
+     * that no longer works.
      */
-    awaitBackgroundChild(childDone, graceMs) {
+    awaitBackgroundChild(childDone, graceMs, toldKey) {
         const challenge = this.pendingChallenge;
         return new Promise((resolve, reject) => {
             let settled = false;
+            const watchNumber = () => {
+                const pending = this.pendingChallenge;
+                if (settled || pending?.kind !== "mfaPending" || relayKey(pending.kind, pending.numberMatch) === toldKey)
+                    return;
+                settled = true;
+                clearTimeout(graceTimer);
+                this.challengeWatchers.delete(watchNumber);
+                reject(new AuthProcessError(...mfaPendingFailure(pending.numberMatch), pending.numberMatch));
+            };
             const graceTimer = setTimeout(() => {
                 if (settled)
                     return;
                 settled = true;
+                this.challengeWatchers.delete(watchNumber);
                 const pending = this.pendingChallenge ?? challenge;
                 if (pending?.kind === "automaticPending") {
                     reject(automaticPendingFailure());
@@ -634,17 +667,21 @@ export class AuthRunner {
                 reject(new AuthProcessError(...mfaPendingFailure(numberMatch), numberMatch));
             }, graceMs);
             graceTimer.unref?.();
+            this.challengeWatchers.add(watchNumber);
+            watchNumber();
             childDone.then((value) => {
                 if (settled)
                     return;
                 settled = true;
                 clearTimeout(graceTimer);
+                this.challengeWatchers.delete(watchNumber);
                 resolve(value);
             }, (error) => {
                 if (settled)
                     return;
                 settled = true;
                 clearTimeout(graceTimer);
+                this.challengeWatchers.delete(watchNumber);
                 reject(error);
             });
         });
@@ -746,12 +783,14 @@ export class AuthRunner {
                     this.challengeSignal = null;
                     this.wave = null;
                     this.challengeTold = null;
+                    this.challengeToldKey = null;
                     this.relayProbe = null;
                 }
             });
             trackedCompletion.catch(() => { });
             this.childDone = trackedCompletion;
             this.pendingChallenge = null;
+            this.challengeToldKey = null;
             this.relayProbe = null;
             let resolveChallengeSignal;
             this.challengeSignal = new Promise((res) => { resolveChallengeSignal = res; });
@@ -798,6 +837,10 @@ export class AuthRunner {
                 }
                 if (firstChallenge)
                     resolveChallengeSignal();
+                // A caller already polling is answered with a number it was not told
+                // (issue #229); the rest keep waiting.
+                for (const watch of [...this.challengeWatchers])
+                    watch();
                 const answer = new AuthProcessError(...mfaPendingFailure(this.pendingChallenge?.numberMatch), this.pendingChallenge?.numberMatch, false, relayed);
                 if (relayed)
                     this.relayProbe = answer;
@@ -929,7 +972,10 @@ export class AuthRunner {
                         4: ["unsupported", "This identity provider cannot complete headless authentication. See the authentication logs."],
                         5: ["secureStorage", "The native credential store is unavailable or locked. Unlock it and retry."],
                         6: ["transport", "Brightspace authentication is temporarily unavailable because of a network or server failure. Your saved session was preserved. Try again later."],
-                        7: mfaPendingFailure(numberMatch),
+                        // The MFA loop gave up (MfaApprovalError) and recorded the
+                        // cooldown: the number it showed no longer works, so a caller
+                        // still polling hears what the next call would, not "enter 42".
+                        7: ["cooldown", `The MFA approval was not completed in time. Automatic MFA is paused; run ${AUTH_COMMAND} to retry immediately.`],
                     };
                     // Busy, but the owning sign-in's challenge came through: the caller
                     // was told what to approve, so answer with that, not "busy".

package/build/tools/get-my-grades.js

@@ -191,7 +191,16 @@ export function registerGetMyGrades(server, apiClient, config) {
                             authError: error,
                         };
                     }
-                    throw error; // Re-throw other errors
+                    // Anything else (a 404, a 5xx, a dropped connection) still must
+                    // not make the course vanish: the caller would read the result
+                    // as every course's grades, with one silently missing (#245).
+                    log("DEBUG", `get_my_grades: grades unavailable for course ${item.OrgUnit.Id} (${item.OrgUnit.Name})`, error);
+                    return {
+                        failed: true,
+                        courseId: item.OrgUnit.Id,
+                        courseName: item.OrgUnit.Name,
+                        gradeUrl: gradebookUrl(config.baseUrl, item.OrgUnit.Id),
+                    };
                 }
             });
             const results = await Promise.allSettled(gradePromises);
@@ -202,12 +211,16 @@ export function registerGetMyGrades(server, apiClient, config) {
             const restrictedCourses = settled
                 .filter((c) => c.restricted)
                 .map(({ restricted: _restricted, ...rest }) => rest);
+            const failedCourses = settled
+                .filter((c) => c.failed)
+                .map(({ failed: _failed, ...rest }) => rest);
             const courses = settled
-                .filter((c) => !c.authPending && !c.restricted)
+                .filter((c) => !c.authPending && !c.restricted && !c.failed)
                 .map(({ courseId, courseName, grades }) => ({ courseId, courseName, grades }));
             log("INFO", `get_my_grades: Retrieved grades for ${courses.length} courses, ` +
                 `${restrictedCourses.length} restricted (out of ${enrollmentItems.length} enrolled` +
-                `${pending.length > 0 ? `, ${pending.length} pending sign-in` : ""})`);
+                `${pending.length > 0 ? `, ${pending.length} pending sign-in` : ""}` +
+                `${failedCourses.length > 0 ? `, ${failedCourses.length} failed` : ""})`);
             // Pending courses keep `grades: []` so callers that read
             // `courses[i].grades` still get an array; authPending marks it as
             // unchecked rather than empty. `restrictedCourses` is always present
@@ -224,15 +237,26 @@ export function registerGetMyGrades(server, apiClient, config) {
                 ],
                 restrictedCourses,
             };
+            const notices = [];
             if (pending.length > 0) {
                 response.authPending = true;
                 response.unavailableCourseIds = pending.map((c) => c.courseId);
-                response.notice =
-                    "Sign-in to Brightspace is still in progress, so grades for " +
-                        `${pending.length} course(s) (${pending.map((c) => c.courseId).join(", ")}) could not be ` +
-                        `fetched yet. ${authPendingNotice(pending[0].authError)} Call get_my_grades again once ` +
-                        "sign-in finishes.";
+                notices.push("Sign-in to Brightspace is still in progress, so grades for " +
+                    `${pending.length} course(s) (${pending.map((c) => c.courseId).join(", ")}) could not be ` +
+                    `fetched yet. ${authPendingNotice(pending[0].authError)} Call get_my_grades again once ` +
+                    "sign-in finishes.");
+            }
+            // Only present when something failed, so the usual response shape
+            // is unchanged; `courses` never includes these.
+            if (failedCourses.length > 0) {
+                response.failedCourses = failedCourses;
+                notices.push(`Grades for ${failedCourses.length} course(s) ` +
+                    `(${failedCourses.map((c) => c.courseId).join(", ")}) could not be read from Brightspace, ` +
+                    "so they are listed in failedCourses instead of courses. Do not report these courses as " +
+                    "having no grades: open each gradeUrl, or call get_my_grades again for that courseId.");
             }
+            if (notices.length > 0)
+                response.notice = notices.join(" ");
             return toolResponse(response);
         }
         catch (error) {

package/build/tools/get-syllabus.js

@@ -12,6 +12,7 @@ import { secureDownload, readBodyCapped } from "../utils/download-helpers.js";
 import { DownloadError } from "../utils/download-errors.js";
 import { MAX_FILE_SIZE } from "../utils/file-validator.js";
 import { extractPdfText } from "../utils/pdf-extractor.js";
+import { parseContentDispositionFilename } from "./download-file.js";
 import { log } from "../utils/logger.js";
 import path from "node:path";
 import fs from "node:fs/promises";
@@ -172,10 +173,8 @@ export function registerGetSyllabus(server, apiClient) {
                     }
                     // Get filename from Content-Disposition header
                     const disposition = response.headers.get("Content-Disposition") ?? "";
-                    const match = disposition.match(/filename[^;=\n]*=((['"]).*?\2|[^;\n]*)/);
-                    if (match?.[1]) {
-                        attachmentFilename = match[1].replace(/['"]/g, "");
-                    }
+                    attachmentFilename =
+                        parseContentDispositionFilename(disposition) || attachmentFilename;
                     // Download body as buffer
                     // Capped read: Content-Length can be missing or understated.
                     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.13.18",
+  "version": "3.13.20",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",