brightspace-mcp-server 3.3.0 → 3.4.1

package/build/utils/html-converter.js

@@ -15,9 +15,75 @@ function getTurndownService() {
             headingStyle: "atx",
             codeBlockStyle: "fenced",
         });
+        // Turndown has no rule for <script>, <style> or <noscript>, so it falls
+        // back to emitting their text: a D2L description carrying an inline
+        // stylesheet or an analytics snippet put raw CSS and JavaScript source
+        // into the markdown the model reads. None of it is content.
+        turndownService.remove(["script", "style", "noscript"]);
+        // Turndown has no table rules either, and its fallback treats every cell
+        // as a standalone block -- a syllabus grading table came out as a flat
+        // run of paragraphs ("Homework", "30%", "Exams", "70%") with nothing
+        // left to say which weight belonged to which item. Emit GFM pipe tables
+        // so the pairing survives into the markdown a model is asked to read.
+        // Rules are registered once here (not at module scope) because the
+        // service itself is now lazily constructed on first use.
+        turndownService.addRule("tableCell", {
+            filter: ["th", "td"],
+            replacement: (content) => ` ${cellText(content)} |`,
+        });
+        turndownService.addRule("tableRow", {
+            filter: "tr",
+            replacement: (content, node) => {
+                const row = `|${content}`;
+                const table = closestTable(node);
+                const rows = table
+                    ? Array.from(table.querySelectorAll("tr")).filter((candidate) => closestTable(candidate) === table)
+                    : [];
+                // GFM needs a delimiter line after the first row, header row or not:
+                // without one the whole block renders as a paragraph and the
+                // columns are lost again.
+                if (rows.length > 0 && rows[0] === node) {
+                    const columns = cellsOf(node).length || 1;
+                    return `\n${row}\n|${" --- |".repeat(columns)}`;
+                }
+                return `\n${row}`;
+            },
+        });
+        turndownService.addRule("tableSection", {
+            filter: ["thead", "tbody", "tfoot"],
+            replacement: (content) => content,
+        });
+        turndownService.addRule("table", {
+            filter: "table",
+            replacement: (content) => {
+                const body = content.trim();
+                return body ? `\n\n${body}\n\n` : "";
+            },
+        });
     }
     return turndownService;
 }
+/** A cell's text, flattened so one table cell stays one table cell. */
+function cellText(content) {
+    return content
+        .replace(/\|/g, "\\|")
+        .replace(/\s*\n+\s*/g, " ")
+        .trim();
+}
+/** The nearest enclosing <table>, so a nested table is scoped to itself. */
+function closestTable(node) {
+    let current = node.parentNode;
+    while (current) {
+        if (current.nodeName === "TABLE")
+            return current;
+        current = current.parentNode;
+    }
+    return null;
+}
+/** Direct <th>/<td> children of a row. */
+function cellsOf(row) {
+    return Array.from(row.childNodes).filter((child) => child.nodeName === "TH" || child.nodeName === "TD");
+}
 /**
  * Convert D2L HTML content to clean markdown.
  * Returns both markdown (for LLM readability) and raw HTML (for fallback).

package/build/utils/logger.js

@@ -19,16 +19,32 @@ export function setLogLevel(level) {
  *
  * Deliberately no blanket uppercase or base32 rule: it would eat course codes
  * like ECE264, which are exactly what a useful log line contains.
+ *
+ * Order matters: the JSON-shaped rules run before the free-text ones, so a
+ * serialized object is redacted by key and the looser rules never see the
+ * value they would otherwise re-match across the quoting.
  */
 function redact(value) {
     // JSON web tokens, wherever they appear
     value = value.replace(/eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]*)?/g, "eyJ...REDACTED");
     // Redact Bearer tokens
     value = value.replace(/Bearer\s+([A-Za-z0-9._~+/=-]{8})[A-Za-z0-9._~+/=-]*/g, "Bearer $1...REDACTED");
-    // Redact cookie: prefixed tokens
-    value = value.replace(/cookie:([^\s]{8})[^\s]*/g, "cookie:$1...REDACTED");
-    // JSON-serialized header fields: {"Authorization":"..."}, {"Cookie":"..."}
+    // JSON-serialized header fields: {"Authorization":"..."}, {"Cookie":"..."}.
+    // Runs before the raw-header rule below so a serialized object is redacted
+    // as JSON and the raw-header rule cannot then chew through the quoting.
     value = value.replace(/("(?:authorization|cookie|set-cookie)"\s*:\s*")[^"]*(")/gi, "$1...REDACTED$2");
+    // JSON-serialized secret fields: {"password":"..."}, {"accessToken":"..."},
+    // {"refresh_token":"..."}, {"xsrfToken":"..."}. Only string values match, so
+    // a numeric field like "tokenExpiry": 1750000000 is left readable.
+    value = value.replace(/("[^"]*(?:password|passwd|secret|token|credential|api[_-]?key)[^"]*"\s*:\s*")[^"]*(")/gi, "$1...REDACTED$2");
+    // Raw header lines: "Cookie: d2lSessionVal=..." / "Set-Cookie: ...".
+    // The whole remainder of the line goes, because a cookie header carries
+    // every cookie for the host, not just the first pair. Case-insensitive and
+    // tolerant of the space HTTP actually puts after the colon -- without both,
+    // this rule only ever fired on a form no real header takes.
+    value = value.replace(/(^|[\s{[(,;])((?:set-)?cookie)\s*:[ \t]*([^\r\n]+)/gi, (_match, prefix, name, secret) => `${prefix}${name}: ${secret.slice(0, 8)}...REDACTED`);
+    // password=... / secret=... in a query string, form body, or free text.
+    value = value.replace(/\b(password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token)\b(\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s&;,"']+)/gi, (_match, key, separator) => `${key}${separator}...REDACTED`);
     // Credentials embedded in a URL: scheme://user:pass@host
     value = value.replace(/(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/:@]+:[^\s/@]+@/gi, "$1***:***@");
     // Redact anything that looks like a long token (40+ chars of base64-like)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.3.0",
+  "version": "3.4.1",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",