brightspace-mcp-server 3.8.14 → 3.9.1

package/README.md

@@ -129,6 +129,27 @@ npx -y brightspace-mcp-server@latest auth
 
 Run it from your home folder — macOS blocks `npx` from Documents, Desktop, or Downloads without Files and Folders permission (`EPERM`). Grant access in System Settings → Privacy & Security → Files and Folders, or run elsewhere.
 
+## No browser? Paste a session cookie or token
+
+The normal setup drives a real (usually hidden) browser through sign-in, which doesn't work in Docker, headless Linux, WSL without a display, or on a tenant whose MFA requires a hardware security key. Two environment variables skip the browser entirely; set one and leave the normal setup untouched:
+
+- **`D2L_SESSION_COOKIE`** — the `d2lSessionVal` and `d2lSecureSessionVal` cookies from a browser tab where you're already signed in to Brightspace. In Chrome DevTools: open your Brightspace site, **F12 → Application → Cookies**, find `d2lSessionVal` and `d2lSecureSessionVal`, and set the variable to either form:
+  ```bash
+  export D2L_SESSION_COOKIE="d2lSessionVal=<value>; d2lSecureSessionVal=<value>"
+  # or just the two values, in that order:
+  export D2L_SESSION_COOKIE="<d2lSessionVal>;<d2lSecureSessionVal>"
+  ```
+- **`D2L_ACCESS_TOKEN`** — a pre-issued Bearer token (an admin-issued Valence token, or one minted by a TA script):
+  ```bash
+  export D2L_ACCESS_TOKEN="<token>"
+  ```
+
+Set either in your MCP client's `env` config instead of a shell export if you're not running the server from a terminal. If both are set, `D2L_ACCESS_TOKEN` wins.
+
+If this is a Docker or other headless setup with no `~/.brightspace-mcp/config.json` on disk, also set **`D2L_BASE_URL`** to your school's Brightspace URL — with no config file to read it from, the server otherwise defaults to Purdue's.
+
+**The catch:** neither one renews itself. A pasted session cookie dies at D2L's own idle timeout (the same timeout that would eventually log you out in a browser), and a pre-issued token dies whenever it expires or is revoked. When that happens the server does **not** fall back to a browser login — it answers with an error telling you to paste a fresh value. There's no in-between: this is a deliberate escape hatch for environments that can't run a browser at all, not a way to skip typing your password once.
+
 ## What You Can Ask About
 
 | Topic | Examples |
@@ -143,7 +164,7 @@ Run it from your home folder — macOS blocks `npx` from Documents, Desktop, or
 | Roster | "Who are the TAs for ECE 264?" · "Get me my instructor's email" |
 | Discussions | "What are people saying in the final project thread?" · "Summarize the latest discussion posts" |
 | Video transcripts | "What did the professor say about pinch-off in Tuesday's lecture recording?" · "Summarize last week's BoilerCast video" — works for Kaltura and YouTube embeds; other platforms report that they aren't supported yet |
-| Troubleshooting | "Which version of the Brightspace server am I running?" · "Where is my Brightspace config file?" — `get_server_info` reports the version, Node runtime, platform, config and session paths, school URL, whether a credential is stored, and what Microsoft remembered (`microsoftSession`: stay-signed-in and its expiry, plus whether "Don't ask again" was ticked, already on, not offered, or left off because `D2L_REMEMBER_MFA` isn't set), without contacting Brightspace or revealing secrets |
+| Troubleshooting | "Which version of the Brightspace server am I running?" · "Where is my Brightspace config file?" — `get_server_info` reports the version, Node runtime, platform, config and session paths, school URL, whether a credential is stored, what Microsoft remembered (`microsoftSession`: stay-signed-in and its expiry, plus whether "Don't ask again" was ticked, already on, not offered, or left off because `D2L_REMEMBER_MFA` isn't set), and `requests` (lightweight counters: responses by status class, network errors, cache hits/misses, coalesced in-flight joins, and token refreshes), without contacting Brightspace or revealing secrets |
 | Calendar | "When is my midterm?" · "What's on my calendar this week?" · "Is lab cancelled on Thursday?" — reads exams, labs, review sessions, and deadlines instructors put only on the course calendar |
 | Planning | "Build me a study schedule based on my upcoming due dates" · "Which class needs the most attention right now?" — pulls from assignments, quizzes, graded discussion topics (any topic with a due date), and course calendar events such as exams and labs |
 

package/build/api/client.js

@@ -76,10 +76,32 @@ export class D2LApiClient {
     cacheTTLs;
     timeoutMs;
     onAuthExpired;
+    authExpiredMessage;
     retryConfig;
     versions = null;
     /** Single in-flight discovery, so concurrent first requests share one fetch. */
     versionsInFlight = null;
+    /**
+     * GETs keyed by the unresolved template path + query (the same string
+     * get() caches under), so a second caller asking for the same resource
+     * while the first is still in flight joins that promise instead of
+     * issuing its own request. Claude Desktop fans out tool calls in
+     * parallel and our tools fan out per course, so identical paths are
+     * often requested within milliseconds of each other. One client, one
+     * token manager, so every GET it issues already shares one auth
+     * identity — nothing further to key on.
+     *
+     * Adapted from JhostinAleck/brightspace-mcp (MIT) — RequestCoalescer.ts.
+     */
+    pendingGets = new Map();
+    statsData = {
+        statusClasses: { "2xx": 0, "401": 0, "403": 0, "404": 0, "429": 0, "5xx": 0, other: 0 },
+        networkErrors: 0,
+        cacheHits: 0,
+        cacheMisses: 0,
+        coalescedJoins: 0,
+        tokenRefreshes: 0,
+    };
     constructor(options) {
         // HTTPS-only enforcement, on a parsed URL rather than a string prefix so
         // a malformed base cannot slip through as "not http".
@@ -98,6 +120,7 @@ export class D2LApiClient {
         this.tokenManager = options.tokenManager;
         this.timeoutMs = options.timeoutMs ?? 30_000;
         this.onAuthExpired = options.onAuthExpired;
+        this.authExpiredMessage = options.authExpiredMessage;
         this.retryConfig = options.retry ?? {};
         // Merge user-provided TTLs with defaults
         this.cacheTTLs = { ...DEFAULT_CACHE_TTLS, ...options.cacheTTLs };
@@ -196,16 +219,34 @@ export class D2LApiClient {
             const age = this.cache.ageOf(path);
             if (age !== undefined && age <= options.ttl) {
                 log("DEBUG", `Cache hit: ${path}`);
+                this.statsData.cacheHits++;
                 return this.cache.get(path);
             }
+            this.statsData.cacheMisses++;
         }
-        const resolved = await this.resolvePath(path);
-        const data = await this.withAuthentication(resolved, token => this.makeRequest(resolved, token));
-        if (options?.ttl) {
-            this.cache.set(path, data, options.ttl);
-            log("DEBUG", `Cached response for ${path} (TTL: ${options.ttl}ms)`);
+        // Join an identical GET already in flight rather than issuing a second
+        // one. Keyed on the same unresolved path the cache above uses, so the
+        // join happens before version discovery or a token is even touched.
+        const pending = this.pendingGets.get(path);
+        if (pending) {
+            this.statsData.coalescedJoins++;
+            log("DEBUG", `Coalescing GET onto an in-flight request: ${path}`);
+            return pending;
         }
-        return data;
+        const inFlight = (async () => {
+            const resolved = await this.resolvePath(path);
+            const data = await this.withAuthentication(resolved, token => this.makeRequest(resolved, token));
+            if (options?.ttl) {
+                this.cache.set(path, data, options.ttl);
+                log("DEBUG", `Cached response for ${path} (TTL: ${options.ttl}ms)`);
+            }
+            return data;
+        })().finally(() => {
+            if (this.pendingGets.get(path) === inFlight)
+                this.pendingGets.delete(path);
+        });
+        this.pendingGets.set(path, inFlight);
+        return inFlight;
     }
     /**
      * Make a GET request to the D2L API and return raw Response object.
@@ -242,8 +283,15 @@ export class D2LApiClient {
         // A rejected JWT does not prove its underlying cookie is expired. Read a
         // token written by another process or mint over HTTP before opening login.
         // TokenRefreshError propagates here, so a temporary outage never starts MFA.
+        // One 401-recovery cascade counts as one refresh even when it takes both a
+        // mint attempt and a browser login to land a token the server accepts --
+        // `refreshed` tracks whether this cascade has already been counted so the
+        // fallback to tryAutoReauth below doesn't count it a second time.
         const fresh = await this.tokenManager.getToken(token.accessToken);
+        let refreshed = false;
         if (fresh && fresh.accessToken !== token.accessToken) {
+            this.statsData.tokenRefreshes++;
+            refreshed = true;
             try {
                 return await send(fresh);
             }
@@ -253,8 +301,28 @@ export class D2LApiClient {
             }
         }
         const loggedIn = await this.tryAutoReauth(path, fresh?.accessToken ?? token.accessToken);
+        if (!refreshed)
+            this.statsData.tokenRefreshes++;
         return send(loggedIn);
     }
+    /** Buckets one observed HTTP status into statsData.statusClasses. */
+    recordStatus(status) {
+        const classes = this.statsData.statusClasses;
+        if (status >= 200 && status < 300)
+            classes["2xx"]++;
+        else if (status === 401)
+            classes["401"]++;
+        else if (status === 403)
+            classes["403"]++;
+        else if (status === 404)
+            classes["404"]++;
+        else if (status === 429)
+            classes["429"]++;
+        else if (status >= 500)
+            classes["5xx"]++;
+        else
+            classes.other++;
+    }
     /** One rate limiter token per attempt. */
     async throttled(fn) {
         await this.rateLimiter.consume();
@@ -285,7 +353,7 @@ export class D2LApiClient {
             }
             log("WARN", "Auto-reauthentication did not produce a valid token");
         }
-        throw new ApiError(401, path, `Session expired. Please re-authenticate via ${AUTH_COMMAND}.`);
+        throw new ApiError(401, path, this.authExpiredMessage ?? `Session expired. Please re-authenticate via ${AUTH_COMMAND}.`);
     }
     /**
      * Make one HTTP request. Authentication recovery is shared with raw downloads.
@@ -300,6 +368,7 @@ export class D2LApiClient {
                 headers,
                 signal: AbortSignal.timeout(this.timeoutMs),
             });
+            this.recordStatus(response.status);
             // Preserve cookie material: a 401 only rejects this access token.
             if (response.status === 401) {
                 throw new ApiError(401, path, "Brightspace rejected the access token.");
@@ -346,6 +415,7 @@ export class D2LApiClient {
                 throw error;
             }
             // Wrap network/fetch errors
+            this.statsData.networkErrors++;
             const message = error instanceof Error ? error.message : String(error);
             throw new NetworkError(`Request to ${path} failed: ${message}`, error instanceof Error ? error : undefined);
         }
@@ -363,6 +433,7 @@ export class D2LApiClient {
                 headers,
                 signal: AbortSignal.timeout(this.timeoutMs),
             });
+            this.recordStatus(response.status);
             // Preserve cookie material for the shared HTTP refresh path.
             if (response.status === 401) {
                 throw new ApiError(401, path, "Brightspace rejected the access token.");
@@ -416,6 +487,7 @@ export class D2LApiClient {
                 throw error;
             }
             // Wrap network/fetch errors
+            this.statsData.networkErrors++;
             const message = error instanceof Error ? error.message : String(error);
             throw new NetworkError(`Request to ${path} failed: ${message}`, error instanceof Error ? error : undefined);
         }
@@ -483,4 +555,20 @@ export class D2LApiClient {
     get cacheSize() {
         return this.cache.size;
     }
+    /**
+     * Read-only snapshot of this client's lightweight request counters. A
+     * fresh object every call, so a caller holding onto it never sees later
+     * updates and can't mutate the client's own counts. Never carries a URL,
+     * username, or token.
+     */
+    stats() {
+        return {
+            statusClasses: { ...this.statsData.statusClasses },
+            networkErrors: this.statsData.networkErrors,
+            cacheHits: this.statsData.cacheHits,
+            cacheMisses: this.statsData.cacheMisses,
+            coalescedJoins: this.statsData.coalescedJoins,
+            tokenRefreshes: this.statsData.tokenRefreshes,
+        };
+    }
 }

package/build/auth/token-manager.js

@@ -24,6 +24,8 @@ export class TokenManager {
     baseUrl;
     tokenTtl;
     mint;
+    envAccessToken;
+    envSessionCookie;
     /** Single in-flight mint, so concurrent callers share one request. */
     mintInFlight = null;
     rejectedAccessToken = null;
@@ -35,6 +37,8 @@ export class TokenManager {
         this.baseUrl = options.baseUrl ? new URL(options.baseUrl).origin : undefined;
         this.tokenTtl = options.tokenTtl ?? DEFAULT_TOKEN_TTL_SECONDS;
         this.mint = options.mint ?? mintAccessToken;
+        this.envAccessToken = options.envAccessToken;
+        this.envSessionCookie = options.envSessionCookie;
     }
     /**
      * Get the current token if valid, otherwise null.
@@ -44,6 +48,21 @@ export class TokenManager {
     async getToken(rejectedAccessToken) {
         if (rejectedAccessToken)
             this.rejectedAccessToken = rejectedAccessToken;
+        // D2L_ACCESS_TOKEN / D2L_SESSION_COOKIE bypass disk, mint, and the browser
+        // entirely: every call hands back the same env-derived token. The only
+        // way this "expires" is Brightspace rejecting it, which the caller
+        // reports back as rejectedAccessToken — at that point there is nothing
+        // fresher to offer, so this returns null rather than the same rejected
+        // value again. (See D2LApiClient.tryAutoReauth / authExpiredMessage for
+        // the user-facing "paste a fresh one" error this produces.)
+        if (this.envAccessToken || this.envSessionCookie) {
+            const token = this.buildEnvToken();
+            if (rejectedAccessToken && token.accessToken === rejectedAccessToken) {
+                log("DEBUG", "The env-provided credential was rejected; no replacement is available");
+                return null;
+            }
+            return token;
+        }
         // Check memory cache first
         if (this.cachedToken && this.isUsable(this.cachedToken)) {
             log("DEBUG", "Returning cached token");
@@ -69,6 +88,36 @@ export class TokenManager {
         log("DEBUG", "No valid token available");
         return null;
     }
+    /**
+     * Build the token for D2L_ACCESS_TOKEN or D2L_SESSION_COOKIE;
+     * D2L_ACCESS_TOKEN wins when both are set. expiresAt is pushed far into the
+     * future: a pasted credential has no known lifetime, and isValid()'s
+     * refresh-buffer check must never be the thing that discards it — only
+     * Brightspace actually rejecting it (a 401) should.
+     */
+    buildEnvToken() {
+        const now = Date.now();
+        const FAR_FUTURE_MS = 10 * 365 * 24 * 60 * 60 * 1000; // 10 years
+        if (this.envAccessToken) {
+            return {
+                accessToken: this.envAccessToken,
+                tenantOrigin: this.baseUrl,
+                capturedAt: now,
+                expiresAt: now + FAR_FUTURE_MS,
+                source: "env",
+            };
+        }
+        return {
+            // Reuses the client's existing "cookie:" passthrough (see
+            // D2LApiClient.buildAuthHeaders) instead of minting a Bearer JWT.
+            accessToken: `cookie:${this.envSessionCookie}`,
+            tenantOrigin: this.baseUrl,
+            capturedAt: now,
+            expiresAt: now + FAR_FUTURE_MS,
+            source: "env",
+            cookieHeader: this.envSessionCookie,
+        };
+    }
     /**
      * Only use persisted session material, including updates from other processes.
      */

package/build/index.js

@@ -67,18 +67,33 @@ else {
                 sessionDir: config.sessionDir,
                 baseUrl: config.baseUrl,
                 tokenTtl: config.tokenTtl,
+                envAccessToken: config.envAccessToken,
+                envSessionCookie: config.envSessionCookie,
             });
-            // Create AuthRunner for auto-reauthentication
-            const authRunner = new AuthRunner({
-                onProgress: (message) => {
-                    void server.sendLoggingMessage({ level: "info", logger: "brightspace-auth", data: message }).catch(() => { });
-                },
-            });
+            // D2L_ACCESS_TOKEN / D2L_SESSION_COOKIE are opt-in browser-free sign-in
+            // escape hatches (Docker, headless Linux, WSL, hardware-key MFA
+            // tenants). When either is set, AuthRunner is never created: there is
+            // no stored credential to drive a browser login from, and a rejected
+            // pasted credential should fail with a clear "paste a fresh one"
+            // message rather than spawning auth-cli.
+            const envAuthActive = Boolean(config.envAccessToken || config.envSessionCookie);
+            const authRunner = envAuthActive
+                ? undefined
+                : new AuthRunner({
+                    onProgress: (message) => {
+                        void server.sendLoggingMessage({ level: "info", logger: "brightspace-auth", data: message }).catch(() => { });
+                    },
+                });
             // Create D2L API Client with auto-reauth support
             const apiClient = new D2LApiClient({
                 baseUrl: config.baseUrl,
                 tokenManager,
-                onAuthExpired: () => authRunner.run(),
+                onAuthExpired: authRunner ? () => authRunner.run() : undefined,
+                authExpiredMessage: config.envAccessToken
+                    ? "D2L_ACCESS_TOKEN was rejected by Brightspace (expired or invalid). Issue a fresh token and update the environment variable; this server does not fall back to a browser login while D2L_ACCESS_TOKEN is set."
+                    : config.envSessionCookie
+                        ? "The pasted D2L_SESSION_COOKIE has expired. Copy a fresh d2lSessionVal/d2lSecureSessionVal pair from a logged-in browser and update the environment variable; this server does not fall back to a browser login while D2L_SESSION_COOKIE is set."
+                        : undefined,
             });
             // Nothing here reaches Brightspace. API versions are discovered by the
             // first request that needs them, and the first request with no saved
@@ -115,7 +130,7 @@ else {
             registerGetSyllabus(server, apiClient);
             registerGetDiscussions(server, apiClient);
             registerGetVideoTranscript(server, apiClient);
-            registerGetServerInfo(server, config, PKG_VERSION);
+            registerGetServerInfo(server, config, PKG_VERSION, apiClient);
             log("DEBUG", "MCP tools registered (16 tools)");
             // Connect stdio transport
             const transport = new StdioServerTransport();

package/build/tools/get-server-info.js

@@ -14,13 +14,15 @@ import { toolResponse } from "./tool-helpers.js";
  * trigger a sign-in. hasStoredCredential reflects the keychain lookup made at
  * startup, which is the credential this process actually holds.
  * microsoftSession comes from the plain summary saved beside the browser
- * state and is omitted when there is no saved state. Nothing secret —
- * password, username, token, cookie — is ever included.
+ * state and is omitted when there is no saved state. requests is the
+ * client's own lightweight counters (apiClient.stats()) — a snapshot of
+ * what has happened so far this process, not a network call of its own.
+ * Nothing secret — password, username, token, cookie — is ever included.
  */
-export function registerGetServerInfo(server, config, version) {
+export function registerGetServerInfo(server, config, version, apiClient) {
     server.registerTool("get_server_info", {
         title: "Get Server Info",
-        description: "Report which version of the Brightspace MCP server is running, the Node.js runtime, platform, config file path, session state directory, configured school URL, whether a credential is stored, and (once a browser sign-in has been saved) what Microsoft remembered: stay-signed-in and the Don't ask again MFA checkbox. Use this for troubleshooting or when the user asks which version they have. Never contacts Brightspace and never returns secrets.",
+        description: "Report which version of the Brightspace MCP server is running, the Node.js runtime, platform, config file path, session state directory, configured school URL, whether a credential is stored, (once a browser sign-in has been saved) what Microsoft remembered: stay-signed-in and the Don't ask again MFA checkbox, and this process's request counters (requests: responses by status class, network errors, cache hits/misses, coalesced joins, and token refreshes). Use this for troubleshooting or when the user asks which version they have. Never contacts Brightspace and never returns secrets.",
         inputSchema: GetServerInfoSchema,
     }, async () => {
         const microsoftSession = await readMicrosoftSession(config.sessionDir);
@@ -34,6 +36,7 @@ export function registerGetServerInfo(server, config, version) {
             schoolUrl: config.baseUrl,
             hasStoredCredential: config.password !== undefined,
             ...(microsoftSession && { microsoftSession }),
+            requests: apiClient.stats(),
         });
     });
 }

package/build/utils/config.js

@@ -49,6 +49,12 @@ export async function loadConfig() {
     const activeOnly = envBoolean(process.env.D2L_ACTIVE_ONLY, "D2L_ACTIVE_ONLY")
         ?? store?.activeOnly
         ?? true;
+    // D2L_ACCESS_TOKEN beats D2L_SESSION_COOKIE beats the normal stored-credential
+    // browser flow; both are validated whenever present regardless of which one
+    // wins, so a typo in the losing variable still fails loudly at startup.
+    const envAccessToken = readEnvSecret(process.env.D2L_ACCESS_TOKEN, "D2L_ACCESS_TOKEN");
+    const rawSessionCookie = readEnvSecret(process.env.D2L_SESSION_COOKIE, "D2L_SESSION_COOKIE");
+    const envSessionCookie = rawSessionCookie ? parseSessionCookieEnv(rawSessionCookie) : undefined;
     const configuredUrl = new URL(process.env.D2L_BASE_URL || store?.baseUrl || "https://purdue.brightspace.com");
     if (configuredUrl.protocol !== "https:" || configuredUrl.username || configuredUrl.password) {
         throw new Error("The Brightspace URL must be an HTTPS school URL without embedded credentials.");
@@ -70,6 +76,8 @@ export async function loadConfig() {
         username,
         password,
         campus: process.env.D2L_CAMPUS || store?.campus,
+        envAccessToken,
+        envSessionCookie,
         courseFilter: {
             includeCourseIds,
             excludeCourseIds,
@@ -115,6 +123,76 @@ function envBoolean(value, source) {
     console.error(`[config] Ignoring ${source}=${JSON.stringify(value)}: expected true or false`);
     return undefined;
 }
+/** CR, LF, or NUL in a header value enables request smuggling / header injection. */
+const CONTROL_CHAR_PATTERN = /[\r\n\0]/;
+/**
+ * Validate a pasted auth secret (D2L_SESSION_COOKIE or D2L_ACCESS_TOKEN).
+ * Unlike positiveSeconds/envBoolean above, a bad value here is never silently
+ * ignored: both env vars exist specifically to skip the browser, so a typo
+ * must fail loudly at startup rather than fall back to a sign-in flow the
+ * user deliberately avoided. Returns undefined only when the variable is
+ * genuinely unset (absent or empty), matching the other env helpers' treatment
+ * of "".
+ *
+ * The CR/LF/NUL check is adapted from the injection guard in
+ * JhostinAleck/brightspace-mcp (MIT), AccessToken.ts:10-19. Surrounding
+ * whitespace is rejected rather than trimmed: a trailing newline or space is
+ * exactly the kind of thing a terminal paste or `export FOO=$(cat file)`
+ * leaves behind, and silently stripping it would hide the mistake instead of
+ * surfacing it.
+ */
+export function readEnvSecret(value, varName) {
+    if (value === undefined || value === "")
+        return undefined;
+    if (CONTROL_CHAR_PATTERN.test(value)) {
+        throw new Error(`${varName} contains a carriage return, line feed, or NUL character. Paste the value as a single line with no embedded newlines.`);
+    }
+    if (value !== value.trim()) {
+        throw new Error(`${varName} has leading or trailing whitespace. Remove it and try again.`);
+    }
+    return value;
+}
+const D2L_SESSION_VAL = "d2lSessionVal";
+const D2L_SECURE_SESSION_VAL = "d2lSecureSessionVal";
+const SESSION_COOKIE_FORMAT_ERROR = 'D2L_SESSION_COOKIE must be either "d2lSessionVal=...; d2lSecureSessionVal=..." ' +
+    "(the cookie header copied from a logged-in browser) or the two cookie values " +
+    "separated by a semicolon, in that order (d2lSessionVal;d2lSecureSessionVal).";
+/**
+ * Normalize D2L_SESSION_COOKIE into the "d2lSessionVal=...; d2lSecureSessionVal=..."
+ * header D2L's API expects. Accepts a full cookie-header fragment (extra
+ * cookies alongside the two named ones are ignored, order doesn't matter) or
+ * the two raw values separated by a semicolon with no cookie names, in which
+ * case the first is d2lSessionVal and the second d2lSecureSessionVal.
+ */
+export function parseSessionCookieEnv(raw) {
+    const segments = raw.split(";").map((part) => part.trim()).filter((part) => part.length > 0);
+    const named = {};
+    // The form is decided by whether a segment is NAMED d2lSessionVal/
+    // d2lSecureSessionVal (its name before the first "="), not by whether any
+    // "=" appears at all -- the two-raw-values form's second value can itself
+    // contain "=" (base64 padding), which must not be mistaken for a name.
+    let anyNamed = false;
+    for (const segment of segments) {
+        const eq = segment.indexOf("=");
+        if (eq === -1)
+            continue;
+        const name = segment.slice(0, eq).trim();
+        if (name === D2L_SESSION_VAL || name === D2L_SECURE_SESSION_VAL) {
+            anyNamed = true;
+            named[name] = segment.slice(eq + 1).trim();
+        }
+    }
+    if (anyNamed) {
+        if (named[D2L_SESSION_VAL] && named[D2L_SECURE_SESSION_VAL]) {
+            return `${D2L_SESSION_VAL}=${named[D2L_SESSION_VAL]}; ${D2L_SECURE_SESSION_VAL}=${named[D2L_SECURE_SESSION_VAL]}`;
+        }
+    }
+    else if (segments.length === 2) {
+        const [sessionVal, secureSessionVal] = segments;
+        return `${D2L_SESSION_VAL}=${sessionVal}; ${D2L_SECURE_SESSION_VAL}=${secureSessionVal}`;
+    }
+    throw new Error(SESSION_COOKIE_FORMAT_ERROR);
+}
 function expandTilde(filePath) {
     if (filePath.startsWith("~")) {
         return path.join(os.homedir(), filePath.slice(1));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.8.14",
+  "version": "3.9.1",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",