brightspace-mcp-server 5.0.4 → 5.0.6

package/build/update.js

@@ -15,7 +15,6 @@ dotenv.config({ quiet: true });
 // ANSI color helpers
 const bold = (s) => `\x1b[1m${s}\x1b[0m`;
 const green = (s) => `\x1b[32m${s}\x1b[0m`;
-const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
 const red = (s) => `\x1b[31m${s}\x1b[0m`;
 const dim = (s) => `\x1b[2m${s}\x1b[0m`;
 const projectRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
@@ -50,6 +49,80 @@ export function samePath(a, b) {
     };
     return canonical(a) === canonical(b);
 }
+/** Stop before anything is modified, saying why and what to do. */
+function refuse(reason, remedy) {
+    console.error(red(`  Error: ${reason}`));
+    console.error(`  ${remedy}`);
+    process.exit(1);
+}
+const STABLE_VERSION = /^(\d+)\.(\d+)\.(\d+)$/;
+const COMMIT_SHA = /^[0-9a-f]{40}$/;
+function versionTriple(version) {
+    const m = STABLE_VERSION.exec(version.trim().replace(/^v/, ""));
+    return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+function compareTriples(a, b) {
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] - b[i];
+    }
+    return 0;
+}
+/**
+ * Whether `nodeVersion` meets an `engines.node` range. Only plain
+ * comparator sets (">=20.0.0", ">=20 <23") are understood; anything else
+ * yields null so the caller refuses instead of guessing.
+ */
+function satisfiesNodeRange(range, nodeVersion) {
+    const have = versionTriple(nodeVersion);
+    const comparators = range.trim().split(/\s+/);
+    if (!have || comparators.length === 0)
+        return null;
+    for (const comparator of comparators) {
+        const m = /^(>=|<=|>|<|=)?v?(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(comparator);
+        if (!m)
+            return null;
+        const want = [Number(m[2]), Number(m[3] ?? 0), Number(m[4] ?? 0)];
+        const cmp = compareTriples(have, want);
+        const ok = { ">=": cmp >= 0, "<=": cmp <= 0, ">": cmp > 0, "<": cmp < 0, "=": cmp === 0 }[m[1] ?? "="];
+        if (!ok)
+            return false;
+    }
+    return true;
+}
+/**
+ * Decide which commit a checkout should move to, from what npm reports as the
+ * `latest` release. Only a stable version, published from a known commit, whose
+ * Node.js requirement this runtime meets, is a target; anything else is refused
+ * so the update fails closed.
+ */
+export function chooseRelease(registry, nodeVersion) {
+    const info = (registry ?? {});
+    const { version, gitHead } = info;
+    if (typeof version !== "string" || !versionTriple(version)) {
+        return { ok: false, reason: "npm did not report a stable release version." };
+    }
+    if (typeof gitHead !== "string" || !COMMIT_SHA.test(gitHead)) {
+        return { ok: false, reason: `npm does not record which commit ${version} was published from.` };
+    }
+    const nodeRange = info.engines?.node;
+    if (nodeRange !== undefined) {
+        const satisfied = typeof nodeRange === "string" ? satisfiesNodeRange(nodeRange, nodeVersion) : null;
+        if (satisfied === null) {
+            return { ok: false, reason: `Cannot check ${version}'s Node.js requirement (${String(nodeRange)}).` };
+        }
+        if (!satisfied) {
+            return { ok: false, reason: `${version} requires Node.js ${nodeRange}; this is Node.js ${nodeVersion}.` };
+        }
+    }
+    return { ok: true, version, commit: gitHead };
+}
+function fail(...lines) {
+    console.error(red(`  Error: ${lines[0]}`));
+    for (const line of lines.slice(1))
+        console.error(`  ${line}`);
+    process.exit(1);
+}
 export function main() {
     console.log("");
     console.log(bold("=== Brightspace MCP Server — Update ==="));
@@ -81,25 +154,59 @@ export function main() {
     const currentVersion = getVersion();
     console.log(`  Current version: ${bold(currentVersion)}`);
     console.log("");
-    // Check for uncommitted changes
+    // The update fast-forwards the checked-out branch to origin/main, so it only
+    // runs where that cannot touch local work: a clean working tree on main.
     const status = run("git status --porcelain", { silent: true });
     if (status) {
-        console.log(yellow("  Warning: You have uncommitted changes."));
-        console.log(dim("  The update will proceed, but your local changes may conflict."));
-        console.log("");
+        refuse("You have uncommitted changes.", "Commit or stash them, then run the update again.");
     }
-    // Fetch latest from remote
-    console.log(dim("  Fetching latest changes..."));
+    const branch = run("git branch --show-current", { silent: true });
+    if (branch !== "main") {
+        refuse(branch ? `You are on branch '${branch}', not main.` : "HEAD is detached, not on main.", "Run 'git switch main', then run the update again.");
+    }
+    // Resolve the latest published release: the checkout follows what npm
+    // ships, never the unreleased tip of main.
+    console.log(dim("  Checking the latest release on npm..."));
+    let registry;
+    try {
+        registry = JSON.parse(run("npm view brightspace-mcp-server@latest version gitHead engines --json", { silent: true }));
+    }
+    catch {
+        fail("Could not read the latest release from npm.", "Check your network connection and try again.");
+        return;
+    }
+    const release = chooseRelease(registry, process.version);
+    if (!release.ok) {
+        fail("No release this checkout can safely update to.", release.reason);
+        return;
+    }
+    const { version: targetVersion, commit } = release;
+    // Fetch, then confirm the published commit really is that release on main.
+    console.log(dim(`  Fetching release ${targetVersion}...`));
     try {
         run("git fetch origin main", { silent: true });
     }
     catch {
-        console.error(red("  Error: Failed to fetch from remote."));
-        console.error("  Check your network connection and try again.");
-        process.exit(1);
+        fail("Failed to fetch from remote.", "Check your network connection and try again.");
+        return;
+    }
+    try {
+        run(`git merge-base --is-ancestor ${commit} origin/main`, { silent: true });
+        const released = JSON.parse(run(`git show ${commit}:package.json`, { silent: true }));
+        if (released.version !== targetVersion)
+            throw new Error("version mismatch");
+    }
+    catch {
+        fail(`Could not verify release ${targetVersion} (commit ${commit.slice(0, 7)}) on origin/main.`, "Nothing was changed.");
+        return;
+    }
+    // Local commits on main that origin/main lacks would need a merge or rebase.
+    const aheadCount = run("git rev-list --count origin/main..HEAD", { silent: true });
+    if (aheadCount !== "0") {
+        refuse(`Your main has ${aheadCount} commit${aheadCount === "1" ? "" : "s"} that origin/main does not.`, "Move them to another branch or reconcile main with origin/main yourself, then run the update again.");
     }
     // Check if we're behind
-    const behindCount = run("git rev-list --count HEAD..origin/main", { silent: true });
+    const behindCount = run(`git rev-list --count HEAD..${commit}`, { silent: true });
     if (behindCount === "0") {
         console.log("");
         console.log(green("  Already up to date!"));
@@ -108,22 +215,22 @@ export function main() {
     }
     // Show what's new
     console.log("");
-    console.log(bold(`  ${behindCount} new commit${behindCount === "1" ? "" : "s"}:`));
+    console.log(bold(`  ${behindCount} new commit${behindCount === "1" ? "" : "s"} in ${targetVersion}:`));
     console.log("");
-    const log = run("git log HEAD..origin/main --oneline", { silent: true });
+    const log = run(`git log HEAD..${commit} --oneline`, { silent: true });
     for (const line of log.split("\n")) {
         console.log(`    ${dim("•")} ${line}`);
     }
     console.log("");
-    // Pull changes
-    console.log(dim("  Pulling changes..."));
+    // Fast-forward only, to the verified release: never a merge or rebase,
+    // whatever git's pull settings say, and no pull fallback if it fails.
+    console.log(dim(`  Updating to ${targetVersion}...`));
     try {
-        run("git pull origin main", { silent: true });
+        run(`git merge --ff-only ${commit}`, { silent: true });
     }
     catch {
-        console.error(red("  Error: Failed to pull changes."));
-        console.error("  You may have merge conflicts. Resolve them manually and try again.");
-        process.exit(1);
+        fail(`Could not fast-forward to ${targetVersion}.`, "Nothing was changed. Check 'git status' and try again.");
+        return;
     }
     // Install dependencies
     console.log(dim("  Installing dependencies..."));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.0.4",
+  "version": "5.0.6",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",