brightspace-mcp-server 3.4.0 → 3.5.0

package/build/auth/duo-mfa.js

@@ -1,6 +1,42 @@
 import { log } from "../utils/logger.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
 import { UnsupportedAuthenticationError } from "./sso-flow.js";
+/** Duo's verified-push digits: three to six, per Duo's push-verification policy. */
+const VERIFICATION_CODE_PATTERN = /^\d{3,6}$/;
+/**
+ * Duo renders the verified-push digits in an element of its own. Read that
+ * element rather than the document at large: an unscoped
+ * page.getByText(/^\d{3,6}$/) matches ANY standalone three-to-six digit text on
+ * the page — a masked phone number's last four, a countdown, a "remembered for
+ * 30 days" line — and .first() then announces whichever one the DOM happened to
+ * render first. A headless run has no screen to check that against, so the
+ * wrong number is simply typed into Duo Mobile and the push is denied.
+ */
+const VERIFICATION_CODE_SELECTORS = [
+    ".verification-code",
+    "#verification-code",
+    "[class*='verification-code']",
+];
+/**
+ * Duo's prompt surface, innermost first, bounding the fallback text scan for
+ * the day Duo renames the element above. The first one on screen decides:
+ * numbers rendered outside Duo's own prompt are not the code.
+ */
+const PROMPT_SCOPE_SELECTORS = [
+    "#auth-view",
+    ".base-wrapper",
+    "#root",
+    "#app",
+    "main",
+    "body",
+];
+/** The digits on a visible element, or null when it is absent or not digits. */
+async function readCodeFrom(target) {
+    if (!await target.isVisible().catch(() => false))
+        return null;
+    const code = (await target.textContent().catch(() => null))?.trim();
+    return code && VERIFICATION_CODE_PATTERN.test(code) ? code : null;
+}
 /** Duo Universal Prompt redirects to a Duo-hosted page after primary sign-in. */
 export function isDuoPrompt(page) {
     try {
@@ -17,6 +53,8 @@ export class DuoMfaHandler {
     approvalAnnounced = false;
     verificationCodeAnnounced = null;
     passcodeSubmitted = false;
+    /** True once onMfaChallenge has been told about this login, code or not. */
+    announcedToCaller = false;
     constructor(options) {
         this.options = options;
     }
@@ -27,24 +65,63 @@ export class DuoMfaHandler {
     async handle(page) {
         if (!this.isChallenge(page))
             return false;
+        const verificationCode = await this.readVerificationCode(page);
         if (!this.approvalAnnounced) {
             this.approvalAnnounced = true;
             log("WARN", "Waiting up to 5 minutes for Duo MFA approval on your device.");
+            this.options.onMfaChallenge?.(verificationCode);
+            if (verificationCode)
+                this.announcedToCaller = true;
         }
-        const verificationCode = await this.readVerificationCode(page);
         if (verificationCode && verificationCode !== this.verificationCodeAnnounced) {
             this.verificationCodeAnnounced = verificationCode;
             log("WARN", `Duo verification code: ${verificationCode}. Enter it in Duo Mobile.`);
+            if (!this.announcedToCaller) {
+                this.announcedToCaller = true;
+                this.options.onMfaChallenge?.(verificationCode);
+            }
         }
         await this.submitPasscode(page);
         return true;
     }
     async readVerificationCode(page) {
-        const target = page.getByText(/^\d{3,6}$/).first();
-        if (!await target.isVisible().catch(() => false))
-            return null;
-        const code = (await target.textContent().catch(() => null))?.trim();
-        return code && /^\d{3,6}$/.test(code) ? code : null;
+        return await this.readCodeElement(page) ?? await this.readScopedCode(page);
+    }
+    /** Duo's own verification-code element, when the prompt exposes one. */
+    async readCodeElement(page) {
+        for (const selector of VERIFICATION_CODE_SELECTORS) {
+            const code = await readCodeFrom(page.locator(selector).first());
+            if (code)
+                return code;
+        }
+        return null;
+    }
+    /**
+     * Fallback for a prompt that does not label its digits: the standalone
+     * numbers inside Duo's prompt container. Announce one only when they all
+     * agree — two different numbers mean this is not a screen this can read, and
+     * naming the wrong one costs the user the push.
+     */
+    async readScopedCode(page) {
+        for (const selector of PROMPT_SCOPE_SELECTORS) {
+            const scope = page.locator(selector).first();
+            if (!await scope.isVisible().catch(() => false))
+                continue;
+            const found = [];
+            const candidates = await scope.getByText(VERIFICATION_CODE_PATTERN).all().catch(() => []);
+            for (const candidate of candidates) {
+                // Nested elements repeat the same text; only distinct values compete.
+                const code = await readCodeFrom(candidate);
+                if (code && !found.includes(code))
+                    found.push(code);
+            }
+            if (found.length > 1) {
+                log("DEBUG", `Duo prompt showed ${found.length} standalone numbers; announcing none of them.`);
+                return null;
+            }
+            return found[0] ?? null;
+        }
+        return null;
     }
     async submitPasscode(page) {
         if (this.options.headless === false || this.passcodeSubmitted)
@@ -59,6 +136,13 @@ export class DuoMfaHandler {
         const code = await this.options.requestMfaCode();
         if (!/^\d{6,8}$/.test(code))
             throw new UnsupportedAuthenticationError("The MFA code must contain 6-8 digits.");
+        // That prompt blocks on a person for as long as they take to find the
+        // code, and Duo expires its prompt and redirects on its own schedule. A
+        // passcode is a credential: confirm it is still Duo's page receiving it
+        // rather than whatever the browser moved on to.
+        if (!this.isChallenge(page)) {
+            throw new UnsupportedAuthenticationError(`The Duo prompt closed before the passcode was entered. Run \`${AUTH_COMMAND}\` to retry.`);
+        }
         await input.fill(code);
         const verify = page.getByRole("button", { name: /verify/i }).first();
         if (await verify.isVisible().catch(() => false))

package/build/auth/purdue-sso.js

@@ -113,7 +113,16 @@ export class PurdueSSOFlow {
         if (!this.config.password)
             throw new BrowserAuthError("Password is required for SSO login", "credentials");
         log("INFO", "Entering credentials");
-        if (!this.accountHintSubmitted) {
+        // A submitted account hint only counts once Microsoft has actually left the
+        // email step. It keeps that field on screen whenever it rejects the hint,
+        // and clickWhenReady swallows a click that never landed on purpose (Entra
+        // normally detaches the button after navigating), so identifyAccount can
+        // report a success the page never granted. Skipping the email step there
+        // spends the whole password timeout on a page still asking for a username
+        // and then blames a missing password field.
+        const hintAccepted = this.accountHintSubmitted && !await this.anyVisible(page, EMAIL_SELECTORS);
+        this.accountHintSubmitted = false;
+        if (!hintAccepted) {
             const email = signInName(this.config.username, this.config.baseUrl);
             if (!await this.fillWhenReady(page, EMAIL_SELECTORS, email)) {
                 throw new UnsupportedAuthenticationError("The Microsoft email field did not appear. Automatic sign-in cannot continue.");
@@ -122,7 +131,6 @@ export class PurdueSSOFlow {
                 throw new UnsupportedAuthenticationError("The Microsoft email submit button did not appear. Automatic sign-in cannot continue.");
             }
         }
-        this.accountHintSubmitted = false;
         if (!await this.fillWhenReady(page, PASSWORD_SELECTORS, this.config.password)) {
             throw new UnsupportedAuthenticationError("The Microsoft password field did not appear. Automatic sign-in cannot continue.");
         }
@@ -176,6 +184,8 @@ export class PurdueSSOFlow {
         const deadline = Date.now() + MFA_TIMEOUT_MS;
         let challenged = false;
         let announced = null;
+        /** True once onMfaChallenge has been told about this login, number or not. */
+        let announcedToCaller = false;
         try {
             while (Date.now() < deadline) {
                 if (await this.duoMfa.handle(page))
@@ -189,10 +199,17 @@ export class PurdueSSOFlow {
                 if (challengeVisible && !challenged) {
                     challenged = true;
                     log("WARN", "Waiting up to 5 minutes for Microsoft MFA approval on your device.");
+                    this.config.onMfaChallenge?.(number);
+                    if (number)
+                        announcedToCaller = true;
                 }
                 if (number && number !== announced) {
                     announced = number;
                     log("WARN", `Number match: ${number}. Enter it in Microsoft Authenticator.`);
+                    if (!announcedToCaller) {
+                        announcedToCaller = true;
+                        this.config.onMfaChallenge?.(number);
+                    }
                 }
                 if (await this.isAuthenticated(page)) {
                     log("INFO", "Login successful - verified Brightspace home");

package/build/auth/session-store.js

@@ -9,7 +9,7 @@ import * as path from "node:path";
 import * as os from "node:os";
 import { SessionStoreError } from "../utils/errors.js";
 import { acquireProcessLock, AuthenticationInProgressError } from "./auth-lock.js";
-import { NativeCredentialStoreError } from "./credential-store.js";
+import { hasSessionEncryptionKey, NativeCredentialStoreError } from "./credential-store.js";
 import { decrypt, readEncryptedRecord, saveEncryptedRecord, trashFile } from "./encrypted-store.js";
 const DEFAULT_SESSION_DIR = path.join(os.homedir(), ".d2l-session");
 function validTenantOrigin(origin) {
@@ -107,10 +107,27 @@ export class SessionStore {
             throw new Error("Invalid saved session contents.");
         return token;
     }
+    /**
+     * A version 1 record is sealed with scrypt over the local account name and
+     * an on-disk salt: material every local process already has, so the record
+     * proves nothing about who wrote it. It is worth trusting only during the
+     * one-time upgrade, which by definition happens before this directory owns
+     * a native key. Once the key exists the upgrade has already run, and a
+     * version 1 file can only have been planted by something that could write
+     * the session directory but could not reach the credential store. Refuse it
+     * rather than let it replace the authenticated session.
+     */
+    async assertLegacyUpgradePending() {
+        if (!await hasSessionEncryptionKey(this.sessionDir, this.options.backend))
+            return;
+        throw new SessionStoreError("An old unauthenticated session file appeared after this installation was already using native key storage. It was not trusted and was left in place. Sign in again to replace it.");
+    }
     async loadUnlocked() {
         const record = await this.readFile();
         if (!record)
             return null;
+        if (record.version === 1)
+            await this.assertLegacyUpgradePending();
         const token = await this.decode(record);
         if (record.version === 1)
             await this.saveUnlocked(token);
@@ -122,6 +139,10 @@ export class SessionStore {
         await saveEncryptedRecord(this.sessionDir, this.sessionFilePath, "session", token, this.options);
     }
     storeError(action, error) {
+        // A store error already carries the specific reason and the way out of it;
+        // wrapping it again would bury both behind the generic sentence below.
+        if (error instanceof SessionStoreError)
+            throw error;
         if (error instanceof NativeCredentialStoreError || error instanceof AuthenticationInProgressError)
             throw error;
         throw new SessionStoreError(`Failed to ${action} session. Existing session data was preserved.`, error instanceof Error ? error : new Error(String(error)));

package/build/auth/sso-flow.js

@@ -35,13 +35,14 @@ export class MfaApprovalError extends BrowserAuthError {
  * else uses the default flow, which already covers the common Shibboleth,
  * CAS, and Microsoft Entra forms.
  */
-export function createSSOFlow(config, requestMfaCode) {
+export function createSSOFlow(config, requestMfaCode, onMfaChallenge) {
     const credentials = {
         username: config.username,
         password: config.password,
         baseUrl: config.baseUrl,
         headless: config.headless,
         requestMfaCode,
+        onMfaChallenge,
     };
     if (isSunyBrightspace(config.baseUrl)) {
         return new SunySSOFlow({ ...credentials, campus: config.campus });

package/build/auth/suny-sso.js

@@ -6,6 +6,7 @@
 import { PurdueSSOFlow } from "./purdue-sso.js";
 import { log } from "../utils/logger.js";
 import { UnsupportedAuthenticationError } from "./sso-flow.js";
+import { BrowserAuthError } from "../utils/errors.js";
 /** SUNY campuses share one Brightspace tenant behind one Shibboleth IdP. */
 const SUNY_BRIGHTSPACE_HOST = "mylearning.suny.edu";
 const SUNY_IDP_ENTITY_ID = "https://idm.suny.edu/shibboleth/idp/";
@@ -55,6 +56,7 @@ export class SunySSOFlow {
             baseUrl: `https://${SUNY_BRIGHTSPACE_HOST}`,
             headless: config.headless,
             requestMfaCode: config.requestMfaCode,
+            onMfaChallenge: config.onMfaChallenge,
         });
     }
     hasCredentials() {
@@ -73,6 +75,12 @@ export class SunySSOFlow {
             await this.selectCampus(page);
         }
         catch (error) {
+            // selectCampus already names the cause and, for a mismatch, lists the
+            // campuses SUNY itself is offering. Re-wrapping those threw away the
+            // only list a user can act on, so pass an already-typed failure through
+            // and describe only the ones that arrive untyped.
+            if (error instanceof BrowserAuthError)
+                throw error;
             throw new UnsupportedAuthenticationError("SUNY campus selection could not complete automatically. Run brightspace-mcp-server setup --suny and select a campus.", error);
         }
         return this.defaultFlow.login(page);

package/build/auth-cli.js

@@ -56,7 +56,14 @@ async function main() {
             tokenTtl: config.tokenTtl,
         });
         const codePrompt = config.headless && !automatic && process.stdin.isTTY ? requestMfaCode : undefined;
-        await new BrowserAuth(config, codePrompt).authenticate({
+        // In automatic mode, tell the parent (AuthRunner) about an MFA challenge
+        // the moment it appears, so a blocked tool call can answer within
+        // seconds instead of waiting out the whole approval window. Stdout only
+        // — the parent parses stdout for structured markers, never stderr.
+        const onMfaChallenge = automatic
+            ? (number) => console.log(number ? `MFA_NUMBER:${number}` : "MFA_PENDING")
+            : undefined;
+        await new BrowserAuth(config, { requestMfaCode: codePrompt, onMfaChallenge }).authenticate({
             automatic,
             onAuthenticated: async (token) => {
                 await tokenManager.setToken(token);

package/build/setup.js

@@ -14,6 +14,7 @@ import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { configStoreExists, getConfigStorePath, loadConfigStore, } from "./utils/config-store.js";
 import { saveSecureConfig } from "./utils/secure-config.js";
+import { writeFileAtomicSync } from "./utils/atomic-write.js";
 import { AUTH_COMMAND } from "./utils/commands.js";
 import { cliMcpClients, configureCliMcpClient, isCliAvailable, } from "./utils/mcp-client-cli.js";
 // ANSI helpers
@@ -22,7 +23,7 @@ const green = (s) => `\x1b[32m${s}\x1b[0m`;
 const dim = (s) => `\x1b[2m${s}\x1b[0m`;
 const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
 const thisDir = path.dirname(fileURLToPath(import.meta.url));
-const SCHOOL_PRESETS = {
+export const SCHOOL_PRESETS = {
     purdue: {
         name: "Purdue University",
         baseUrl: "https://purdue.brightspace.com",
@@ -45,9 +46,20 @@ const SCHOOL_PRESETS = {
         usernameHint: "Use your full sign-in address if your Western account requires it.",
     },
 };
-// Parse --purdue, --osu, etc. from argv
-const schoolFlag = process.argv.find((a) => a.startsWith("--"))?.replace(/^--/, "").toLowerCase();
-const preset = schoolFlag ? SCHOOL_PRESETS[schoolFlag] : undefined;
+/**
+ * Pick the school preset named by `--purdue`, `--suny`, `--western`, etc.
+ *
+ * Own properties only: a bare index would make `--constructor` or
+ * `--__proto__` resolve to something off `Object.prototype` and hand the
+ * wizard an object with no `baseUrl`.
+ */
+export function presetForArgv(argv = process.argv) {
+    const flag = argv.find((a) => a.startsWith("--"))?.replace(/^--/, "").toLowerCase();
+    if (!flag || !Object.prototype.hasOwnProperty.call(SCHOOL_PRESETS, flag))
+        return undefined;
+    return SCHOOL_PRESETS[flag];
+}
+const preset = presetForArgv();
 // ── Readline helpers ───────────────────────────────────────────────
 function ask(rl, question) {
     return new Promise((resolve) => {
@@ -174,27 +186,45 @@ function isChatGPTInstalled() {
 function getCursorConfigPath() {
     return path.join(os.homedir(), ".cursor", "mcp.json");
 }
-function configureMcpClient(configPath) {
-    let config = { mcpServers: {} };
+/**
+ * A JSON value we can safely merge a server entry into. An array passes
+ * `typeof x === "object"` but drops every added key when it is stringified
+ * again, so it has to be rejected alongside `null`.
+ */
+function isJsonObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function configureMcpClient(configPath) {
+    let config = {};
     // Read existing config if present
     if (fs.existsSync(configPath)) {
+        let parsed;
+        let readable = true;
         try {
-            const raw = fs.readFileSync(configPath, "utf-8");
-            config = JSON.parse(raw);
+            parsed = JSON.parse(fs.readFileSync(configPath, "utf-8"));
         }
         catch {
-            // If we can't parse, start fresh but warn
-            console.log(yellow("  Warning: existing config was invalid, creating new one."));
-            config = { mcpServers: {} };
+            readable = false;
+        }
+        if (isJsonObject(parsed)) {
+            config = parsed;
+        }
+        else {
+            // Unparseable, or valid JSON that is not an object (null, an array, a
+            // bare string). Merging into it would either throw or silently discard
+            // the entry we just reported as written, so start fresh and say so.
+            console.log(yellow(`  Warning: existing config was ${readable ? "not a JSON object" : "invalid"}, creating new one.`));
+            config = {};
         }
     }
-    if (!config.mcpServers) {
-        config.mcpServers = {};
-    }
+    // Same reasoning for the servers map itself, which is hand-edited far more
+    // often than the file around it.
+    const servers = isJsonObject(config.mcpServers) ? config.mcpServers : {};
+    config.mcpServers = servers;
     // Add/update brightspace entry
     // On Windows, npx is a .cmd shim that must be invoked through cmd.exe
     const isWindows = process.platform === "win32";
-    config.mcpServers["brightspace"] = isWindows
+    servers["brightspace"] = isWindows
         ? {
             command: "cmd",
             args: ["/c", "npx", "-y", "brightspace-mcp-server@latest"],
@@ -208,9 +238,73 @@ function configureMcpClient(configPath) {
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
     }
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    // This file holds every MCP server the user has configured, not just ours.
+    // A plain write truncates it first, so a write that fails part way through
+    // (a full disk, an I/O error) would leave the user with no MCP servers at
+    // all. Staging and renaming leaves either the old file or the new one.
+    // The existing permissions are carried over, since the rename would
+    // otherwise replace them with the umask default.
+    let mode;
+    try {
+        if (fs.existsSync(configPath))
+            mode = fs.statSync(configPath).mode & 0o777;
+    }
+    catch {
+        // Unreadable metadata is not a reason to skip the write.
+    }
+    writeFileAtomicSync(configPath, JSON.stringify(config, null, 2) + "\n", mode === undefined ? {} : { mode });
     return true;
 }
+/** The settings already on disk, or null when there are none to read. */
+export function readExistingConfig() {
+    try {
+        return configStoreExists() ? loadConfigStore() : null;
+    }
+    catch {
+        // An unreadable config is replaced by the setup values.
+        return null;
+    }
+}
+function sameSchool(stored, chosen) {
+    // A config that never recorded a school (environment-driven installs) is
+    // not a *different* school, so its settings are still ours to keep.
+    if (!stored)
+        return true;
+    try {
+        return new URL(stored).origin === new URL(chosen).origin;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Merge the wizard's answers over the settings already saved.
+ *
+ * `saveConfigStore` replaces the whole file, and setup is the documented way
+ * to update a saved password — so it runs again on configurations that carry
+ * settings it never prompts for: the SUNY campus, course filters, a custom
+ * session directory or token TTL. Writing only the answers deleted all of
+ * them; most visibly, a SUNY user who reran plain `setup` lost the campus
+ * that lets sign-in skip the shared campus picker.
+ *
+ * Settings are carried only within one school, since course ids and the
+ * campus belong to a single tenant.
+ */
+export function buildConfigToSave(existing, answers) {
+    const carried = existing && sameSchool(existing.baseUrl, answers.baseUrl) ? existing : null;
+    const config = {
+        ...carried,
+        baseUrl: answers.baseUrl,
+        username: answers.username,
+        // Always the freshly typed one: a carried v1 plaintext password would
+        // otherwise be the value written to the native store.
+        password: answers.password,
+        headless: answers.headless,
+    };
+    if (answers.campus)
+        config.campus = answers.campus;
+    return config;
+}
 // ── Auth spawn ─────────────────────────────────────────────────────
 function runAuth() {
     const scriptPath = path.resolve(thisDir, "auth-cli.js");
@@ -349,15 +443,13 @@ async function main() {
         : "  A browser window will open when authentication is needed."));
     console.log("");
     // ── Step 5: Save config ──────────────────────────────────────────
-    const config = {
+    const config = buildConfigToSave(readExistingConfig(), {
         baseUrl,
         username,
         password,
         headless,
-    };
-    if (campus) {
-        config.campus = campus;
-    }
+        campus: campus || undefined,
+    });
     await saveSecureConfig(config);
     console.log(green("  Password saved in your operating system credential store."));
     console.log(green("  Config saved to: " + getConfigStorePath()));
@@ -467,7 +559,13 @@ async function main() {
     }
     console.log("");
 }
-main().catch((err) => {
-    console.error("Setup failed:", err instanceof Error ? err.message : String(err));
-    process.exit(1);
-});
+// Both entry points — the `brightspace-setup` bin and `brightspace-mcp-server
+// setup`, which imports this module — start the wizard here. VITEST is set
+// only by the test runner, which imports the module for the helpers above and
+// must not open prompts on stdin; no user environment sets it.
+if (!process.env.VITEST) {
+    main().catch((err) => {
+        console.error("Setup failed:", err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    });
+}

package/build/tools/download-file.js

@@ -6,7 +6,10 @@
 import { DownloadFileSchema } from "./schemas.js";
 import { toolResponse, sanitizeError, errorResponse } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
-import { validateContentId, MAX_FILE_SIZE, } from "../utils/file-validator.js";
+// Path containment and magic-byte checks belong to secureDownload, which both
+// download paths below go through; importing them here only made it look as
+// though this file validated anything itself.
+import { validateContentId, MAX_FILE_SIZE } from "../utils/file-validator.js";
 import { secureDownload } from "../utils/download-helpers.js";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -144,11 +147,26 @@ async function downloadSubmissionFile(apiClient, courseId, folderId, fileId, dow
     if (!submissions || submissions.length === 0) {
         return errorResponse("No submissions found for this assignment. Upload a submission first.");
     }
-    // Find the file in the submission
-    const submission = submissions[0];
-    const file = submission.Files.find((f) => f.FileId === fileId);
-    if (!file) {
-        return errorResponse(`File ID ${fileId} not found in submission. Available files: ${submission.Files.map((f) => `${f.FileName} (ID: ${f.FileId})`).join(", ")}`);
+    // Find the file across every submission.
+    //
+    // A resubmitted assignment answers with one entry per submission, each with
+    // its own Files. Reading submissions[0] alone reported "not found" for a file
+    // the same response had just returned, and the download URL below needs the
+    // id of the submission the file actually belongs to, not the first one's.
+    // Files is absent on a submission with no attachments, so it is not assumed.
+    let submission;
+    let file;
+    for (const candidate of submissions) {
+        const match = (candidate.Files ?? []).find((f) => f.FileId === fileId);
+        if (match) {
+            submission = candidate;
+            file = match;
+            break;
+        }
+    }
+    if (!submission || !file) {
+        const available = submissions.flatMap((s) => s.Files ?? []);
+        return errorResponse(`File ID ${fileId} not found in submission. Available files: ${available.map((f) => `${f.FileName} (ID: ${f.FileId})`).join(", ")}`);
     }
     // Check file size before downloading
     if (file.Size > MAX_FILE_SIZE) {

package/build/tools/get-announcements.js

@@ -4,6 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
+import { fetchAllItems } from "../api/paginate.js";
 import { GetAnnouncementsSchema, } from "./schemas.js";
 import { toolResponse, sanitizeError } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
@@ -102,11 +103,16 @@ export function registerGetAnnouncements(server, apiClient, config) {
                     : announcements);
             }
             // All courses case
-            // First, fetch enrolled courses
-            const enrollmentPath = apiClient.lp("/enrollments/myenrollments/?orgUnitTypeId=3&isActive=true");
-            const enrollmentResponse = await apiClient.get(enrollmentPath, { ttl: DEFAULT_CACHE_TTLS.enrollments });
+            // First, fetch enrolled courses. isActive=true is the configured
+            // policy, not a constant: with activeOnly off the user asked to see
+            // past courses, and the server would otherwise drop them before
+            // applyCourseFilter ever saw them.
+            const enrollmentPath = apiClient.lp(`/enrollments/myenrollments/?orgUnitTypeId=3${config.courseFilter.activeOnly ? "&isActive=true" : ""}`);
+            // myenrollments is bookmark-paged; reading only the first page hides
+            // every course past it, and with it every announcement they carry.
+            const enrollmentItems = await fetchAllItems(apiClient, enrollmentPath, { ttl: DEFAULT_CACHE_TTLS.enrollments });
             // Apply course filter
-            const filteredEnrollments = applyCourseFilter(enrollmentResponse.Items.map(item => ({
+            const filteredEnrollments = applyCourseFilter(enrollmentItems.map(item => ({
                 id: item.OrgUnit.Id,
                 name: item.OrgUnit.Name,
                 code: item.OrgUnit.Code,
@@ -149,7 +155,7 @@ export function registerGetAnnouncements(server, apiClient, config) {
             const announcements = allMatched
                 .sort(newestFirst)
                 .slice(0, count);
-            log("INFO", `get_announcements: Retrieved ${announcements.length} announcements (out of ${allAnnouncements.length} total across ${enrollmentResponse.Items.length} courses)`);
+            log("INFO", `get_announcements: Retrieved ${announcements.length} announcements (out of ${allAnnouncements.length} total across ${enrollmentItems.length} courses)`);
             return toolResponse(modifiedSince
                 ? {
                     announcements,

package/build/tools/get-assignments.js

@@ -4,6 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
+import { fetchAllItems } from "../api/paginate.js";
 import { GetAssignmentsSchema } from "./schemas.js";
 import { toolResponse, sanitizeError } from "./tool-helpers.js";
 import { convertHtmlToMarkdown } from "../utils/html-converter.js";
@@ -357,11 +358,16 @@ export function registerGetAssignments(server, apiClient, config) {
                 return toolResponse({ courseId, assignments });
             }
             // All courses case
-            // First, fetch enrolled courses
-            const enrollmentPath = apiClient.lp("/enrollments/myenrollments/?orgUnitTypeId=3&isActive=true");
-            const enrollmentResponse = await apiClient.get(enrollmentPath, { ttl: DEFAULT_CACHE_TTLS.enrollments });
+            // First, fetch enrolled courses. isActive=true is the configured
+            // policy, not a constant: with activeOnly off the user asked to see
+            // past courses, and the server would otherwise drop them before
+            // applyCourseFilter ever saw them.
+            const enrollmentPath = apiClient.lp(`/enrollments/myenrollments/?orgUnitTypeId=3${config.courseFilter.activeOnly ? "&isActive=true" : ""}`);
+            // myenrollments is bookmark-paged; reading only the first page hides
+            // every course past it, and with it every assignment they carry.
+            const enrollmentItems = await fetchAllItems(apiClient, enrollmentPath, { ttl: DEFAULT_CACHE_TTLS.enrollments });
             // Apply course filter
-            const filteredEnrollments = applyCourseFilter(enrollmentResponse.Items.map(item => ({
+            const filteredEnrollments = applyCourseFilter(enrollmentItems.map(item => ({
                 id: item.OrgUnit.Id,
                 name: item.OrgUnit.Name,
                 code: item.OrgUnit.Code,
@@ -392,7 +398,7 @@ export function registerGetAssignments(server, apiClient, config) {
             const courses = results
                 .filter((r) => r.status === "fulfilled" && r.value !== null)
                 .map((r) => r.value);
-            log("INFO", `get_assignments: Retrieved assignments for ${courses.length} courses (out of ${enrollmentResponse.Items.length} enrolled)`);
+            log("INFO", `get_assignments: Retrieved assignments for ${courses.length} courses (out of ${enrollmentItems.length} enrolled)`);
             return toolResponse({ courses });
         }
         catch (error) {