brightspace-mcp-server 3.7.11 → 3.7.13

package/README.md

@@ -99,7 +99,7 @@ There is nothing to log into first. Ask for your grades and the sign-in happens
 
 Returning the next day normally requires no action. The server renews short-lived API tokens over HTTPS using the saved Brightspace session. If that session ends, a browser restores your saved Microsoft session and tries silent SSO. Approval and code-based modes stay headless; when an automatic run needs a code, run the auth command below to enter it securely in the terminal.
 
-If visible-browser mode is configured, the window stays open for up to five minutes so you can finish credentials and MFA manually when automatic sign-in cannot continue. Rerunning setup preserves your previous hidden or visible choice as the prompt default.
+If visible-browser mode is configured, the auth command opens a window that stays open for up to five minutes so you can finish credentials and MFA manually when automatic sign-in cannot continue. Background recovery during a tool call always runs headless so it never opens a browser over your work; set `D2L_HEADLESS=false` in the server's environment to let it open one too. Rerunning setup preserves your previous hidden or visible choice as the prompt default.
 
 Your school's policy controls when MFA is required. There is no local 24-hour cutoff, and the server no longer discards browser state after one hour. A network outage preserves the saved session and returns a temporary error.
 

package/build/auth/auth-runner.js

@@ -111,7 +111,8 @@ function forwardLines(stream, emit) {
  * re-authenticate when the current session has expired.
  *
  * The child inherits the parent's resolved environment and working directory,
- * so both processes read the same account configuration and .env file.
+ * so both processes read the same account configuration and .env file. It
+ * runs headless unless D2L_HEADLESS is set explicitly.
  *
  * run() settles as soon as the child reports an MFA challenge (with or
  * without a number to display) rather than waiting for the child to exit —
@@ -241,9 +242,13 @@ export class AuthRunner {
             const child = spawn(process.execPath, // use the same Node binary
             [this.scriptPath, "--automatic"], {
                 cwd: process.cwd(),
-                env: { ...process.env },
+                // Background recovery never opens a browser over the user's work
+                // unless D2L_HEADLESS explicitly asks for one; the saved
+                // visible-browser preference applies to manual sign-in only.
+                env: { D2L_HEADLESS: "true", ...process.env },
                 stdio: ["ignore", "pipe", "pipe"],
                 detached: process.platform !== "win32",
+                windowsHide: true,
             });
             let timedOut = false;
             // Whether the caller-facing promise above (resolve/reject) has

package/build/auth/browser-auth.js

@@ -30,6 +30,11 @@ const SILENT_SSO = {
     kmsiCheckbox: "#KmsiCheckboxField",
     kmsiTitle: "Stay signed in?",
     kmsiSubmit: "#idSIButton9",
+    // Microsoft's passwordless approval view ("Approve sign in request", or
+    // "Request wasn't sent" once a push fails) offers the password instead. The
+    // text fallback covers a tenant that renames the id.
+    passwordSwitch: "#idA_PWD_SwitchToPassword",
+    passwordSwitchText: "Use your password instead",
 };
 export class BrowserAuthTransportError extends Error {
     code = "AUTH_TRANSPORT";
@@ -338,6 +343,7 @@ export class BrowserAuth {
         const deadline = Date.now() + SILENT_SSO_TIMEOUT_MS;
         let accountHintAttempted = false;
         let passwordPromptPolls = 0;
+        let passwordSwitchAttempted = false;
         do {
             if (await this.hasLiveSession(page))
                 return true;
@@ -359,6 +365,22 @@ export class BrowserAuth {
                 log("INFO", "The identity provider requires a login challenge");
                 return false;
             }
+            const passwordSwitch = await this.passwordSignInOption(page);
+            if (passwordSwitch) {
+                // The approval view has no field or MFA title this poll recognizes, so
+                // without leaving it the poll would wait out its whole budget. Switch
+                // once when a password is saved; the password page then settles the
+                // poll like any other credential prompt.
+                if (!passwordSwitchAttempted && this.ssoFlow.hasCredentials()) {
+                    passwordSwitchAttempted = true;
+                    await passwordSwitch.click().catch(() => { });
+                    log("DEBUG", "Chose the password sign-in option over passwordless approval");
+                    await page.waitForTimeout(SILENT_SSO_POLL_MS);
+                    continue;
+                }
+                log("INFO", "The identity provider requires a password sign-in");
+                return false;
+            }
             if (await this.isAnyOnScreen(page, SILENT_SSO.credentialFields)) {
                 passwordPromptPolls += 1;
                 // Entra can briefly expose a password-shaped control while its email
@@ -390,6 +412,13 @@ export class BrowserAuth {
         return await this.isAnyOnScreen(page, SILENT_SSO.emailFields) ||
             await this.isAnyOnScreen(page, SILENT_SSO.credentialFields);
     }
+    /** The visible "Use your password instead" control, when Microsoft offers one. */
+    async passwordSignInOption(page) {
+        if (await this.isOnScreen(page, SILENT_SSO.passwordSwitch))
+            return page.locator(SILENT_SSO.passwordSwitch).first();
+        const byText = page.getByText(SILENT_SSO.passwordSwitchText).first();
+        return await byText.isVisible().catch(() => false) ? byText : null;
+    }
     /** One definition of the MFA pages the shared authentication loop supports. */
     async hasMfaChallenge(page) {
         return isDuoPrompt(page) || await this.isAnyOnScreen(page, SILENT_SSO.mfaChallenges);

package/build/auth/purdue-sso.js

@@ -174,7 +174,11 @@ export class PurdueSSOFlow {
         // and then blames a missing password field.
         const hintAccepted = this.accountHintSubmitted && !await this.anyVisible(page, EMAIL_SELECTORS);
         this.accountHintSubmitted = false;
-        if (!hintAccepted) {
+        // Microsoft can also know the account without a hint from this login: a
+        // remembered account's passwordless approval view, once awaitSilentSSO
+        // takes "Use your password instead", leads to a password page with no
+        // username field at all.
+        if (!hintAccepted && !await this.isPasswordOnlyPage(page)) {
             const email = signInName(this.config.username, this.config.baseUrl);
             if (!await this.fillWhenReady(page, EMAIL_SELECTORS, email)) {
                 throw new UnsupportedAuthenticationError("The identity provider's username field did not appear. Automatic sign-in cannot continue.");
@@ -253,6 +257,10 @@ export class PurdueSSOFlow {
         await page.waitForTimeout(FIELD_POLL_MS);
         return await this.anyVisible(page, PASSWORD_SELECTORS);
     }
+    /** A stable password field with no username field beside it. */
+    async isPasswordOnlyPage(page) {
+        return await this.hasCoVisiblePassword(page) && !await this.anyVisible(page, EMAIL_SELECTORS);
+    }
     async hasPostCredentialChallenge(page) {
         return this.duoMfa.isChallenge(page) || await this.anyVisible(page, [
             NUMBER_MATCH_SELECTOR,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.7.11",
+  "version": "3.7.13",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",