brightspace-mcp-server 3.9.20 → 3.9.21

package/build/tools/get-announcements.js

@@ -6,7 +6,7 @@
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { fetchAllItems } from "../api/paginate.js";
 import { GetAnnouncementsSchema, } from "./schemas.js";
-import { toolResponse, sanitizeError } from "./tool-helpers.js";
+import { toolResponse, toolResponseWithNotice, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { applyCourseFilter } from "../utils/course-filter.js";
 import { matchesModifiedSince } from "../utils/modified-since.js";
@@ -97,22 +97,53 @@ export function registerGetAnnouncements(server, apiClient, config) {
             const cutoff = modifiedSince ? new Date(modifiedSince) : null;
             // Single course case
             if (courseId) {
-                const newsItems = await fetchCourseNews(apiClient, courseId);
-                // Drop drafts, then map to clean objects
-                const published = newsItems.filter(isPublishedNewsItem).map(mapNewsItem);
-                const matched = cutoff
-                    ? published.filter((a) => matchesModifiedSince(a.lastModified, cutoff))
-                    : published;
-                const announcements = matched.sort(newestFirst).slice(0, count);
-                log("INFO", `get_announcements: Retrieved ${announcements.length} announcements for course ${courseId}`);
-                return toolResponse(modifiedSince
-                    ? {
-                        announcements,
-                        modifiedSince,
-                        returned: announcements.length,
-                        filteredOut: published.length - matched.length,
+                try {
+                    const newsItems = await fetchCourseNews(apiClient, courseId);
+                    // Drop drafts, then map to clean objects
+                    const published = newsItems.filter(isPublishedNewsItem).map(mapNewsItem);
+                    const matched = cutoff
+                        ? published.filter((a) => matchesModifiedSince(a.lastModified, cutoff))
+                        : published;
+                    const announcements = matched.sort(newestFirst).slice(0, count);
+                    log("INFO", `get_announcements: Retrieved ${announcements.length} announcements for course ${courseId}`);
+                    return toolResponse(modifiedSince
+                        ? {
+                            announcements,
+                            modifiedSince,
+                            returned: announcements.length,
+                            filteredOut: published.length - matched.length,
+                        }
+                        : announcements);
+                }
+                catch (error) {
+                    // A pending sign-in is not an empty course: the route never
+                    // answered, so the result says so instead of reporting zero
+                    // announcements as if that were a real measurement.
+                    if (isAuthUnavailable(error)) {
+                        log("DEBUG", `get_announcements: sign-in pending for course ${courseId}`, error);
+                        const notice = "Sign-in to Brightspace is still in progress, so announcements for this course " +
+                            `could not be fetched yet. ${authPendingNotice(error)} Call get_announcements again ` +
+                            "once sign-in finishes.";
+                        // With modifiedSince the response is already an object (that is
+                        // the shape those callers already get), so authPending/notice
+                        // join the rest of the JSON there. Without it the response is
+                        // always a bare array — a shape change would break every
+                        // existing caller — so the empty array stays content[0] and the
+                        // notice becomes a second content block instead.
+                        if (modifiedSince) {
+                            return toolResponse({
+                                announcements: [],
+                                modifiedSince,
+                                returned: 0,
+                                filteredOut: 0,
+                                authPending: true,
+                                notice,
+                            });
+                        }
+                        return toolResponseWithNotice([], notice);
                     }
-                    : announcements);
+                    throw error;
+                }
             }
             // All courses case
             // First, fetch enrolled courses. isActive=true is the configured
@@ -152,13 +183,24 @@ export function registerGetAnnouncements(server, apiClient, config) {
                         log("DEBUG", `get_announcements: 403 Forbidden for course ${item.OrgUnit.Id} (${item.OrgUnit.Name}) - skipping`);
                         return [];
                     }
+                    // A pending sign-in only means this course's route never
+                    // answered — it says nothing about the other courses, whose
+                    // requests may already have gone out independently. Mark this
+                    // one rather than failing the whole call and losing every
+                    // course that *did* answer.
+                    if (isAuthUnavailable(error)) {
+                        log("DEBUG", `get_announcements: sign-in pending for course ${item.OrgUnit.Id} (${item.OrgUnit.Name})`);
+                        return { authPending: true, courseId: item.OrgUnit.Id, authError: error };
+                    }
                     throw error; // Re-throw other errors
                 }
             });
             const results = await Promise.allSettled(announcementPromises);
-            const allAnnouncements = results
+            const settled = results
                 .filter((r) => r.status === "fulfilled")
-                .flatMap((r) => r.value);
+                .map((r) => r.value);
+            const pending = settled.filter((v) => !Array.isArray(v) && v?.authPending === true);
+            const allAnnouncements = settled.filter((v) => Array.isArray(v)).flat();
             const allMatched = cutoff
                 ? allAnnouncements.filter((a) => matchesModifiedSince(a.lastModified, cutoff))
                 : allAnnouncements;
@@ -166,15 +208,38 @@ export function registerGetAnnouncements(server, apiClient, config) {
             const announcements = allMatched
                 .sort(newestFirst)
                 .slice(0, count);
-            log("INFO", `get_announcements: Retrieved ${announcements.length} announcements (out of ${allAnnouncements.length} total across ${enrollmentItems.length} courses)`);
-            return toolResponse(modifiedSince
-                ? {
-                    announcements,
-                    modifiedSince,
-                    returned: announcements.length,
-                    filteredOut: allAnnouncements.length - allMatched.length,
-                }
-                : announcements);
+            log("INFO", `get_announcements: Retrieved ${announcements.length} announcements (out of ${allAnnouncements.length} total ` +
+                `across ${enrollmentItems.length} courses${pending.length > 0 ? `, ${pending.length} pending sign-in` : ""})`);
+            // With modifiedSince the response is already an object (the shape
+            // those callers already get), so authPending/unavailableCourseIds/
+            // notice join the rest of the JSON there. Without it the response is
+            // always a bare array — a shape change would break every existing
+            // caller — so a pending course adds a second content block carrying
+            // the notice instead of changing content[0].
+            if (!modifiedSince) {
+                if (pending.length === 0)
+                    return toolResponse(announcements);
+                return toolResponseWithNotice(announcements, "Sign-in to Brightspace is still in progress, so announcements for " +
+                    `${pending.length} course(s) (${pending.map((c) => c.courseId).join(", ")}) could not be ` +
+                    `fetched yet. ${authPendingNotice(pending[0].authError)} Call get_announcements again once ` +
+                    "sign-in finishes.");
+            }
+            const response = {
+                announcements,
+                modifiedSince,
+                returned: announcements.length,
+                filteredOut: allAnnouncements.length - allMatched.length,
+            };
+            if (pending.length > 0) {
+                response.authPending = true;
+                response.unavailableCourseIds = pending.map((c) => c.courseId);
+                response.notice =
+                    "Sign-in to Brightspace is still in progress, so announcements for " +
+                        `${pending.length} course(s) (${pending.map((c) => c.courseId).join(", ")}) could not be ` +
+                        `fetched yet. ${authPendingNotice(pending[0].authError)} Call get_announcements again once ` +
+                        "sign-in finishes.";
+            }
+            return toolResponse(response);
         }
         catch (error) {
             return sanitizeError(error);

package/build/tools/get-calendar-events.js

@@ -4,7 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { GetCalendarEventsSchema } from "./schemas.js";
-import { toolResponse, errorResponse, sanitizeError } from "./tool-helpers.js";
+import { toolResponse, toolResponseWithNotice, errorResponse, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { resolveCourses } from "./resolve-courses.js";
 import { fetchCourseCalendarEvents } from "./calendar-events.js";
@@ -31,17 +31,39 @@ export function registerGetCalendarEvents(server, apiClient, config) {
             }
             const courses = await resolveCourses(apiClient, config, courseId);
             const results = await Promise.allSettled(courses.map((course) => fetchCourseCalendarEvents(apiClient, config.baseUrl, course, windowStart, windowEnd)));
+            // A pending sign-in only means that course's route never answered —
+            // it says nothing about the other courses, whose requests may already
+            // have gone out independently. Collect it rather than failing the
+            // whole call and losing every course that *did* answer.
+            const pendingCourseIds = [];
+            let firstAuthError = null;
             const events = results
                 .flatMap((result, i) => {
                 if (result.status === "fulfilled")
                     return result.value;
+                if (isAuthUnavailable(result.reason)) {
+                    pendingCourseIds.push(courses[i].id);
+                    firstAuthError ??= result.reason;
+                    log("DEBUG", `get_calendar_events: sign-in pending for course ${courses[i].id}`, result.reason);
+                    return [];
+                }
                 log("DEBUG", `get_calendar_events: skipping course ${courses[i].id} after fetch failure`, result.reason);
                 return [];
             })
                 .filter((event) => includeGenerated || !event.generatedFrom)
                 .sort((a, b) => new Date(a.start).getTime() - new Date(b.start).getTime());
-            log("INFO", `get_calendar_events: Retrieved ${events.length} events across ${courses.length} courses`);
-            return toolResponse(events);
+            log("INFO", `get_calendar_events: Retrieved ${events.length} events across ${courses.length} courses` +
+                (pendingCourseIds.length > 0 ? ` (${pendingCourseIds.length} pending sign-in)` : ""));
+            // The response is always a bare array, pending sign-in or not — a
+            // shape change would break every existing caller. A pending course
+            // instead adds a second content block carrying the notice, which
+            // names which course ids are unavailable.
+            if (pendingCourseIds.length === 0) {
+                return toolResponse(events);
+            }
+            return toolResponseWithNotice(events, "Sign-in to Brightspace is still in progress, so calendar events for " +
+                `${pendingCourseIds.length} course(s) (${pendingCourseIds.join(", ")}) could not be fetched ` +
+                `yet. ${authPendingNotice(firstAuthError)} Call get_calendar_events again once sign-in finishes.`);
         }
         catch (error) {
             return sanitizeError(error);

package/build/tools/get-my-grades.js

@@ -6,7 +6,7 @@
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { fetchAllItems } from "../api/paginate.js";
 import { GetMyGradesSchema, } from "./schemas.js";
-import { toolResponse, sanitizeError, errorResponse } from "./tool-helpers.js";
+import { toolResponse, sanitizeError, errorResponse, isAuthUnavailable, authPendingNotice, } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { applyCourseFilter } from "../utils/course-filter.js";
 import { gradebookUrl } from "../utils/deep-links.js";
@@ -45,6 +45,23 @@ export function registerGetMyGrades(server, apiClient, config) {
                         return errorResponse("Your institution restricts grade API access for this course. " +
                             `View your grades directly in Brightspace: ${url}`);
                     }
+                    // A pending sign-in is not an empty gradebook: the route never
+                    // answered, so the result says so instead of reporting zero grades
+                    // as if that were a real measurement. The envelope stays a
+                    // success — existing callers that only read `grades` keep
+                    // working — with authPending/notice added for callers that want
+                    // to tell "no grades" apart from "couldn't check".
+                    if (isAuthUnavailable(error)) {
+                        log("DEBUG", `get_my_grades: sign-in pending for course ${courseId}`, error);
+                        return toolResponse({
+                            courseId,
+                            grades: [],
+                            authPending: true,
+                            notice: "Sign-in to Brightspace is still in progress, so grades for this course " +
+                                `could not be fetched yet. ${authPendingNotice(error)} Call get_my_grades again ` +
+                                "once sign-in finishes.",
+                        });
+                    }
                     throw error;
                 }
                 // Map to clean objects
@@ -120,6 +137,20 @@ export function registerGetMyGrades(server, apiClient, config) {
                             gradeUrl: gradebookUrl(config.baseUrl, item.OrgUnit.Id),
                         };
                     }
+                    // A pending sign-in only means this course's route never
+                    // answered — it says nothing about the other courses, whose
+                    // requests may already have gone out independently. Mark this one
+                    // rather than failing the whole call and losing every course that
+                    // *did* answer.
+                    if (isAuthUnavailable(error)) {
+                        log("DEBUG", `get_my_grades: sign-in pending for course ${item.OrgUnit.Id} (${item.OrgUnit.Name})`);
+                        return {
+                            courseId: item.OrgUnit.Id,
+                            courseName: item.OrgUnit.Name,
+                            authPending: true,
+                            authError: error,
+                        };
+                    }
                     throw error; // Re-throw other errors
                 }
             });
@@ -127,15 +158,42 @@ export function registerGetMyGrades(server, apiClient, config) {
             const settled = results
                 .filter((r) => r.status === "fulfilled")
                 .map((r) => r.value);
-            const courses = settled
-                .filter((r) => !r.restricted)
-                .map(({ restricted: _restricted, ...rest }) => rest);
+            const pending = settled.filter((c) => c.authPending);
             const restrictedCourses = settled
-                .filter((r) => r.restricted)
+                .filter((c) => c.restricted)
                 .map(({ restricted: _restricted, ...rest }) => rest);
+            const courses = settled
+                .filter((c) => !c.authPending && !c.restricted)
+                .map(({ courseId, courseName, grades }) => ({ courseId, courseName, grades }));
             log("INFO", `get_my_grades: Retrieved grades for ${courses.length} courses, ` +
-                `${restrictedCourses.length} restricted (out of ${enrollmentItems.length} enrolled)`);
-            return toolResponse({ courses, restrictedCourses });
+                `${restrictedCourses.length} restricted (out of ${enrollmentItems.length} enrolled` +
+                `${pending.length > 0 ? `, ${pending.length} pending sign-in` : ""})`);
+            // Pending courses keep `grades: []` so callers that read
+            // `courses[i].grades` still get an array; authPending marks it as
+            // unchecked rather than empty. `restrictedCourses` is always present
+            // (even empty) so callers can rely on the field existing.
+            const response = {
+                courses: [
+                    ...courses,
+                    ...pending.map(({ courseId, courseName }) => ({
+                        courseId,
+                        courseName,
+                        grades: [],
+                        authPending: true,
+                    })),
+                ],
+                restrictedCourses,
+            };
+            if (pending.length > 0) {
+                response.authPending = true;
+                response.unavailableCourseIds = pending.map((c) => c.courseId);
+                response.notice =
+                    "Sign-in to Brightspace is still in progress, so grades for " +
+                        `${pending.length} course(s) (${pending.map((c) => c.courseId).join(", ")}) could not be ` +
+                        `fetched yet. ${authPendingNotice(pending[0].authError)} Call get_my_grades again once ` +
+                        "sign-in finishes.";
+            }
+            return toolResponse(response);
         }
         catch (error) {
             return sanitizeError(error);

package/build/tools/get-roster.js

@@ -6,7 +6,7 @@
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { fetchAllObjects } from "../api/paginate.js";
 import { GetRosterSchema, } from "./schemas.js";
-import { toolResponse, sanitizeError } from "./tool-helpers.js";
+import { toolResponse, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 // Purdue-specific role IDs. These are institution-specific values.
 // If using at another institution, you may need to adjust these.
@@ -55,91 +55,134 @@ export function registerGetRoster(server, apiClient) {
             log("DEBUG", "get_roster tool called", { args });
             // Parse and validate input
             const { courseId, includeStudents, searchTerm, limit } = GetRosterSchema.parse(args);
-            const allUsers = [];
-            let roleFallbackUsed = false;
-            if (!includeStudents) {
-                // Fetch instructors and TAs in parallel
-                const [instructorResult, taResult] = await Promise.allSettled([
-                    fetchClasslistUsers(apiClient, courseId, {
-                        roleId: INSTRUCTOR_ROLE_ID,
-                        searchTerm,
-                    }),
-                    fetchClasslistUsers(apiClient, courseId, {
-                        roleId: TA_ROLE_ID,
-                        searchTerm,
-                    }),
-                ]);
-                // Merge results
-                if (instructorResult.status === "fulfilled") {
-                    allUsers.push(...instructorResult.value);
-                }
-                else {
-                    log("WARN", "get_roster: Failed to fetch instructors", {
-                        error: instructorResult.reason,
-                    });
-                }
-                if (taResult.status === "fulfilled") {
-                    allUsers.push(...taResult.value);
+            try {
+                const allUsers = [];
+                let authFailure;
+                let roleFallbackUsed = false;
+                if (!includeStudents) {
+                    // Fetch instructors and TAs in parallel
+                    const [instructorResult, taResult] = await Promise.allSettled([
+                        fetchClasslistUsers(apiClient, courseId, {
+                            roleId: INSTRUCTOR_ROLE_ID,
+                            searchTerm,
+                        }),
+                        fetchClasslistUsers(apiClient, courseId, {
+                            roleId: TA_ROLE_ID,
+                            searchTerm,
+                        }),
+                    ]);
+                    // A pending sign-in means that route can't be trusted to have
+                    // actually asked Brightspace anything — unlike a role group that
+                    // is genuinely empty, which is a real measurement. Note it rather
+                    // than quietly reporting half the roster as the whole answer, but
+                    // keep whichever route *did* answer instead of discarding it: a
+                    // roster that lost its TAs to a pending sign-in should still show
+                    // the instructor it already has.
+                    authFailure = [instructorResult, taResult].find((r) => r.status === "rejected" && isAuthUnavailable(r.reason));
+                    // Merge results
+                    if (instructorResult.status === "fulfilled") {
+                        allUsers.push(...instructorResult.value);
+                    }
+                    else {
+                        log("WARN", "get_roster: Failed to fetch instructors", {
+                            error: instructorResult.reason,
+                        });
+                    }
+                    if (taResult.status === "fulfilled") {
+                        allUsers.push(...taResult.value);
+                    }
+                    else {
+                        log("WARN", "get_roster: Failed to fetch TAs", {
+                            error: taResult.reason,
+                        });
+                    }
+                    // Purdue's role IDs found nobody — on a non-Purdue tenant they
+                    // likely mean a different role, or none. Fall back to one
+                    // unfiltered classlist fetch and match on the role display name
+                    // the tenant itself reports instead of an institution-specific ID.
+                    // A genuine failure of this fetch is intentionally not caught
+                    // here: it should surface as a tool error rather than silently
+                    // producing an empty staff list.
+                    if (allUsers.length === 0) {
+                        const everyone = await fetchClasslistUsers(apiClient, courseId, {
+                            searchTerm,
+                        });
+                        allUsers.push(...everyone.filter(isTeachingRoleByName));
+                        roleFallbackUsed = true;
+                    }
                 }
                 else {
-                    log("WARN", "get_roster: Failed to fetch TAs", {
-                        error: taResult.reason,
-                    });
+                    // Fetch all users
+                    allUsers.push(...(await fetchClasslistUsers(apiClient, courseId, { searchTerm })));
                 }
-                // Purdue's role IDs found nobody — on a non-Purdue tenant they
-                // likely mean a different role, or none. Fall back to one
-                // unfiltered classlist fetch and match on the role display name
-                // the tenant itself reports instead of an institution-specific ID.
-                // A genuine failure of this fetch is intentionally not caught
-                // here: it should surface as a tool error rather than silently
-                // producing an empty staff list.
-                if (allUsers.length === 0) {
-                    const everyone = await fetchClasslistUsers(apiClient, courseId, {
-                        searchTerm,
+                // A very large roster would swamp the response, so it is capped. The
+                // cap is reported in the payload rather than only in a log line the
+                // model never sees: a 340 person lecture used to look like a 100
+                // person one, with nothing to say otherwise.
+                const total = allUsers.length;
+                const truncated = total > limit;
+                const kept = truncated ? allUsers.slice(0, limit) : allUsers;
+                if (truncated) {
+                    log("WARN", "get_roster: Result set exceeds the limit, truncating", {
+                        total,
+                        returned: kept.length,
                     });
-                    allUsers.push(...everyone.filter(isTeachingRoleByName));
-                    roleFallbackUsed = true;
                 }
-            }
-            else {
-                // Fetch all users
-                allUsers.push(...(await fetchClasslistUsers(apiClient, courseId, { searchTerm })));
-            }
-            // A very large roster would swamp the response, so it is capped. The
-            // cap is reported in the payload rather than only in a log line the
-            // model never sees: a 340 person lecture used to look like a 100
-            // person one, with nothing to say otherwise.
-            const total = allUsers.length;
-            const truncated = total > limit;
-            const kept = truncated ? allUsers.slice(0, limit) : allUsers;
-            if (truncated) {
-                log("WARN", "get_roster: Result set exceeds the limit, truncating", {
+                // Map to clean output
+                const users = kept.map((user) => ({
+                    name: user.DisplayName,
+                    email: user.Email || null,
+                    role: user.ClasslistRoleDisplayName,
+                }));
+                log("INFO", `get_roster: Retrieved ${users.length} users for course ${courseId}` +
+                    (authFailure ? " (sign-in pending for one route)" : ""));
+                return toolResponse({
+                    courseId,
                     total,
-                    returned: kept.length,
+                    returned: users.length,
+                    truncated,
+                    ...(truncated
+                        ? { note: `Showing ${users.length} of ${total}. Raise the limit argument to see more.` }
+                        : {}),
+                    ...(roleFallbackUsed
+                        ? {
+                            roleFilter: "No users matched the default instructor/TA role IDs, so staff were found by matching role display names (instructor, professor, lecturer, teaching assistant, coordinator, grader, TA) instead.",
+                        }
+                        : {}),
+                    users,
+                    ...(authFailure
+                        ? {
+                            authPending: true,
+                            notice: "Sign-in to Brightspace is still in progress, so part of the roster for this " +
+                                `course could not be fetched yet. ${authPendingNotice(authFailure.reason)} Call ` +
+                                "get_roster again once sign-in finishes.",
+                        }
+                        : {}),
                 });
             }
-            // Map to clean output
-            const users = kept.map((user) => ({
-                name: user.DisplayName,
-                email: user.Email || null,
-                role: user.ClasslistRoleDisplayName,
-            }));
-            log("INFO", `get_roster: Retrieved ${users.length} users for course ${courseId}`);
-            return toolResponse({
-                courseId,
-                total,
-                returned: users.length,
-                truncated,
-                ...(truncated
-                    ? { note: `Showing ${users.length} of ${total}. Raise the limit argument to see more.` }
-                    : {}),
-                ...(roleFallbackUsed
-                    ? {
-                        roleFilter: "No users matched the default instructor/TA role IDs, so staff were found by matching role display names (instructor, professor, lecturer, teaching assistant, coordinator, grader, TA) instead.",
-                    }
-                    : {}),
-                users,
-            });
+            catch (error) {
+                // A pending sign-in is not an empty roster: the route never
+                // answered, so the result says so instead of reporting zero users
+                // as if that were a real measurement. The envelope stays a success
+                // — existing callers that only read `users` keep working — with
+                // authPending/notice added for callers that want to tell "empty
+                // roster" apart from "couldn't check".
+                if (isAuthUnavailable(error)) {
+                    log("DEBUG", `get_roster: sign-in pending for course ${courseId}`, error);
+                    return toolResponse({
+                        courseId,
+                        total: 0,
+                        returned: 0,
+                        truncated: false,
+                        users: [],
+                        authPending: true,
+                        notice: "Sign-in to Brightspace is still in progress, so the roster for this course " +
+                            `could not be fetched yet. ${authPendingNotice(error)} Call get_roster again once ` +
+                            "sign-in finishes.",
+                    });
+                }
+                throw error;
+            }
         }
         catch (error) {
             return sanitizeError(error);

package/build/tools/get-upcoming-due-dates.js

@@ -5,7 +5,7 @@
  */
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { GetUpcomingDueDatesSchema, } from "./schemas.js";
-import { toolResponse, sanitizeError } from "./tool-helpers.js";
+import { toolResponse, toolResponseWithNotice, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { assignmentUrl, quizUrl, discussionUrl } from "../utils/deep-links.js";
 import { dueIn } from "../utils/due-in.js";
@@ -35,6 +35,8 @@ async function fetchDiscussionDueTopics(apiClient, courseId) {
             topics.push(...unwrapList(forumTopics));
         }
         catch (error) {
+            if (isAuthUnavailable(error))
+                throw error;
             log("DEBUG", `get_upcoming_due_dates: failed to fetch topics for forum ${forum.ForumId} in course ${courseId}`, error);
         }
     }
@@ -79,6 +81,12 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
         fetchDiscussionDueTopics(apiClient, course.id),
         fetchCourseCalendarEvents(apiClient, baseUrl, course, from, to),
     ]);
+    // Each route may fail on its own without costing the others, but a failed
+    // sign-in means none of them answered: report that, not an empty course.
+    for (const result of [dropboxResult, quizResult, discussionResult, calendarResult]) {
+        if (result.status === "rejected" && isAuthUnavailable(result.reason))
+            throw result.reason;
+    }
     const items = [];
     if (dropboxResult.status === "fulfilled") {
         for (const folder of unwrapList(dropboxResult.value)) {
@@ -180,9 +188,21 @@ export function registerGetUpcomingDueDates(server, apiClient, config) {
             log("DEBUG", `get_upcoming_due_dates: querying ${courses.length} course(s), window=${daysAhead} days`);
             // Fetch every course in parallel; the API client rate limits itself
             const results = await Promise.allSettled(courses.map((course) => fetchCourseDueItems(apiClient, config.baseUrl, course, now, windowEnd)));
-            const items = results.flatMap((result) => {
+            // A pending sign-in only means that course's routes never answered —
+            // it says nothing about the other courses, whose requests may already
+            // have gone out independently. Collect it rather than failing the
+            // whole call and losing every course that *did* answer.
+            const pendingCourseIds = [];
+            let firstAuthError = null;
+            const items = results.flatMap((result, i) => {
                 if (result.status === "fulfilled")
                     return result.value;
+                if (isAuthUnavailable(result.reason)) {
+                    pendingCourseIds.push(courses[i].id);
+                    firstAuthError ??= result.reason;
+                    log("DEBUG", `get_upcoming_due_dates: sign-in pending for course ${courses[i].id}`, result.reason);
+                    return [];
+                }
                 log("DEBUG", "get_upcoming_due_dates: skipping course after fetch failure", result.reason);
                 return [];
             });
@@ -193,8 +213,18 @@ export function registerGetUpcomingDueDates(server, apiClient, config) {
                 return Number.isFinite(due) && due >= now && due <= windowEnd;
             })
                 .sort((a, b) => new Date(a.dueDate).getTime() - new Date(b.dueDate).getTime());
-            log("INFO", `get_upcoming_due_dates: Retrieved ${upcoming.length} items across ${courses.length} courses`);
-            return toolResponse(upcoming);
+            log("INFO", `get_upcoming_due_dates: Retrieved ${upcoming.length} items across ${courses.length} courses` +
+                (pendingCourseIds.length > 0 ? ` (${pendingCourseIds.length} pending sign-in)` : ""));
+            // The response is always a bare array, pending sign-in or not — a
+            // shape change would break every existing caller. A pending course
+            // instead adds a second content block carrying the notice, which
+            // names which course ids are unavailable.
+            if (pendingCourseIds.length === 0) {
+                return toolResponse(upcoming);
+            }
+            return toolResponseWithNotice(upcoming, "Sign-in to Brightspace is still in progress, so upcoming due dates for " +
+                `${pendingCourseIds.length} course(s) (${pendingCourseIds.join(", ")}) could not be fetched ` +
+                `yet. ${authPendingNotice(firstAuthError)} Call get_upcoming_due_dates again once sign-in finishes.`);
         }
         catch (error) {
             return sanitizeError(error);

package/build/tools/tool-helpers.js

@@ -42,6 +42,22 @@ export function toolResponse(data) {
         },
     ]);
 }
+/**
+ * Wrap data as an MCP-compatible tool result, with a notice appended as a
+ * second content block.
+ *
+ * Some callers already depend on content[0] being a specific shape (a bare
+ * array, for instance) and must not see that shape change just because there
+ * is something to tell the user — a pending sign-in, say. This keeps
+ * content[0] exactly what toolResponse(data) alone would have produced and
+ * puts `notice` in content[1], ahead of (and separate from) any update notice
+ * toolResponse would itself append.
+ */
+export function toolResponseWithNotice(data, notice) {
+    const result = toolResponse(data);
+    result.content.push({ type: "text", text: notice });
+    return result;
+}
 /**
  * Wrap error message as MCP-compatible tool result
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.9.20",
+  "version": "3.9.21",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",