brightspace-mcp-server 3.7.11 → 3.7.12

package/README.md

@@ -99,7 +99,7 @@ There is nothing to log into first. Ask for your grades and the sign-in happens
 
 Returning the next day normally requires no action. The server renews short-lived API tokens over HTTPS using the saved Brightspace session. If that session ends, a browser restores your saved Microsoft session and tries silent SSO. Approval and code-based modes stay headless; when an automatic run needs a code, run the auth command below to enter it securely in the terminal.
 
-If visible-browser mode is configured, the window stays open for up to five minutes so you can finish credentials and MFA manually when automatic sign-in cannot continue. Rerunning setup preserves your previous hidden or visible choice as the prompt default.
+If visible-browser mode is configured, the auth command opens a window that stays open for up to five minutes so you can finish credentials and MFA manually when automatic sign-in cannot continue. Background recovery during a tool call always runs headless so it never opens a browser over your work; set `D2L_HEADLESS=false` in the server's environment to let it open one too. Rerunning setup preserves your previous hidden or visible choice as the prompt default.
 
 Your school's policy controls when MFA is required. There is no local 24-hour cutoff, and the server no longer discards browser state after one hour. A network outage preserves the saved session and returns a temporary error.
 

package/build/auth/auth-runner.js

@@ -111,7 +111,8 @@ function forwardLines(stream, emit) {
  * re-authenticate when the current session has expired.
  *
  * The child inherits the parent's resolved environment and working directory,
- * so both processes read the same account configuration and .env file.
+ * so both processes read the same account configuration and .env file. It
+ * runs headless unless D2L_HEADLESS is set explicitly.
  *
  * run() settles as soon as the child reports an MFA challenge (with or
  * without a number to display) rather than waiting for the child to exit —
@@ -241,9 +242,13 @@ export class AuthRunner {
             const child = spawn(process.execPath, // use the same Node binary
             [this.scriptPath, "--automatic"], {
                 cwd: process.cwd(),
-                env: { ...process.env },
+                // Background recovery never opens a browser over the user's work
+                // unless D2L_HEADLESS explicitly asks for one; the saved
+                // visible-browser preference applies to manual sign-in only.
+                env: { D2L_HEADLESS: "true", ...process.env },
                 stdio: ["ignore", "pipe", "pipe"],
                 detached: process.platform !== "win32",
+                windowsHide: true,
             });
             let timedOut = false;
             // Whether the caller-facing promise above (resolve/reject) has

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.7.11",
+  "version": "3.7.12",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",