brightspace-mcp-server 5.0.8 → 5.0.10

package/README.md

@@ -129,7 +129,7 @@ Normally every chat starts its own copy of the server. With many Codex chats ope
    url = "http://127.0.0.1:18765/mcp"
    bearer_token_env_var = "D2L_HTTP_TOKEN"
    ```
-   (`env_http_headers = { "Authorization" = "D2L_HTTP_AUTHORIZATION" }` also works, if that variable holds `Bearer <token>`.) A project's own `.codex/config.toml` overrides this one, so remove any `brightspace` entry there or change it the same way. If you rerun `setup` later, say no when it offers to replace the Codex entry.
+   (`env_http_headers = { "Authorization" = "D2L_HTTP_AUTHORIZATION" }` also works, if that variable holds `Bearer <token>`.) A project's own `.codex/config.toml` overrides this one, so remove any `brightspace` entry there or change it the same way. Rerunning `setup` recognizes this entry and keeps it, token settings included.
 4. **Restart Codex.** Chats that were already open keep the old per-chat server until Codex restarts. If you stop or restart the shared server, calls fail until it is back; if they still fail after that, start a new chat or restart Codex.
 
 Things that change:
@@ -138,7 +138,7 @@ Things that change:
 - **Stopping it:** press Ctrl+C. Questions already running finish first; press Ctrl+C again to stop at once.
 - **Updating it:** restart the server, not Codex. Restarting a client only reconnects it to the server that is already running the old version. Stop the server and start the same `http` command again with the same `D2L_HTTP_TOKEN`, port, and settings; from a source checkout, run `npm run update` first. Update notices from a shared server say this too.
 
-Any other MCP client that can connect to a Streamable HTTP URL with a bearer token can share the same server. To go back to one copy per chat, put the `command`/`args` entry back (rerunning `setup` does it) and stop the shared server.
+Any other MCP client that can connect to a Streamable HTTP URL with a bearer token can share the same server. To go back to one copy per chat, put the `command`/`args` entry back (rerun `setup` and say yes when it offers to switch Codex back to its own copy per chat) and stop the shared server.
 
 ## When it asks you to sign in
 

package/build/setup/clients.js

@@ -163,7 +163,8 @@ export function detectMcpClients(overrides = {}) {
 }
 /**
  * Register the server in every given app without asking. An entry that runs
- * something else is left alone unless `replace` is set, and a write that
+ * something else, or connects to the shared server by URL, is left alone
+ * unless `replace` is set, and a write that
  * fails (an agent's sandbox may block another app's settings folder) is
  * reported for that app instead of stopping the rest.
  */
@@ -174,13 +175,16 @@ export function registerAll(targets, { replace }) {
             const existing = target.inspect();
             if (existing.state === "current")
                 return { ...base, outcome: "current" };
+            if (existing.state === "shared_http" && !replace)
+                return { ...base, outcome: "shared_http", url: existing.url };
             if (existing.state === "different" && !replace) {
                 return { ...base, outcome: "different_left", current: existing.current };
             }
-            if (!target.write(existing.state === "different")) {
+            const replacing = existing.state !== "missing";
+            if (!target.write(replacing)) {
                 return { ...base, outcome: "failed", message: `${target.name} did not accept the registration.` };
             }
-            return { ...base, outcome: existing.state === "different" ? "replaced" : "added" };
+            return { ...base, outcome: replacing ? "replaced" : "added" };
         }
         catch (error) {
             return { ...base, outcome: "failed", message: error instanceof Error ? error.message : String(error) };

package/build/setup/prepare.js

@@ -87,6 +87,8 @@ function appLine(outcome) {
             return ok("app", `${outcome.name}: old "brightspace" entry replaced`, false);
         case "current":
             return ok("app", `${outcome.name}: already set up`, false);
+        case "shared_http":
+            return ok("app", `${outcome.name}: already set up to use the shared server at ${outcome.url}`, false);
         case "different_left":
             return fail("app", `${outcome.name}: "brightspace" already runs ${outcome.current} — left as is (pass --replace to change it)`, false);
         case "failed":

package/build/setup.js

@@ -151,34 +151,43 @@ export function planQuestions(mode, known) {
 // ── Registering with one app ───────────────────────────────────────
 /**
  * Registers Brightspace in one app, never silently replacing an entry
- * that points somewhere else: a matching entry is left alone, and a different
- * one is printed (so it can be restored) and replaced only on a yes.
- * Resolves true when the app ends up running the expected entry.
+ * that points somewhere else: a matching entry is left alone, an entry using
+ * the shared server by URL is kept unless the person asks to switch back, and
+ * a different one is printed (so it can be restored) and replaced only on a yes.
+ * Resolves true when the app ends up set up.
  */
-async function registerWithClient(rl, target) {
+export async function registerWithClient(target, askLine, log = console.log) {
     const existing = target.inspect();
     if (existing.state === "current") {
-        console.log(green(`  ${target.name} already has Brightspace configured.`));
+        log(green(`  ${target.name} already has Brightspace configured.`));
         return true;
     }
+    if (existing.state === "shared_http") {
+        log(green(`  ${target.name} uses the shared Brightspace server at ${existing.url}.`));
+        const switchBack = await askLine(`  Switch it back to its own copy per chat (${serverCommand().join(" ")})? (yes/no): `);
+        if (!/^y(es)?$/i.test(switchBack)) {
+            log(dim(`  Kept ${target.name} on the shared server.`));
+            return true;
+        }
+    }
     if (existing.state === "different") {
-        console.log(yellow(`  ${target.name} has "brightspace" pointing at:`));
-        console.log(`    ${existing.current}`);
-        const replace = await ask(rl, `  Replace it with ${serverCommand().join(" ")}? (yes/no): `);
+        log(yellow(`  ${target.name} has "brightspace" pointing at:`));
+        log(`    ${existing.current}`);
+        const replace = await askLine(`  Replace it with ${serverCommand().join(" ")}? (yes/no): `);
         if (!/^y(es)?$/i.test(replace)) {
-            console.log(dim(`  Left ${target.name} unchanged.`));
+            log(dim(`  Left ${target.name} unchanged.`));
             return false;
         }
     }
     try {
-        if (target.write(existing.state === "different")) {
-            console.log(green(`  ${target.name} configured!`));
+        if (target.write(existing.state !== "missing")) {
+            log(green(`  ${target.name} configured!`));
             return true;
         }
-        console.log(yellow(`  Could not configure ${target.name}. See README.md for the manual command.`));
+        log(yellow(`  Could not configure ${target.name}. See README.md for the manual command.`));
     }
     catch (err) {
-        console.log(yellow(`  Could not configure ${target.name}: ${err instanceof Error ? err.message : String(err)}`));
+        log(yellow(`  Could not configure ${target.name}: ${err instanceof Error ? err.message : String(err)}`));
     }
     return false;
 }
@@ -474,7 +483,7 @@ async function interactive(args) {
     if (plan.registerApps) {
         for (const target of detectMcpClients()) {
             const answer = await ask(rl2, target.question);
-            if (/^y(es)?$/i.test(answer) && await registerWithClient(rl2, target)) {
+            if (/^y(es)?$/i.test(answer) && await registerWithClient(target, (question) => ask(rl2, question))) {
                 configuredClients.push(target.name);
             }
             console.log("");

package/build/utils/mcp-client-cli.js

@@ -31,15 +31,41 @@ export function serverCommand(platform = process.platform) {
         ? ["cmd", "/c", "npx", "-y", `${PACKAGE_NAME}@latest`]
         : ["npx", "-y", `${PACKAGE_NAME}@latest`];
 }
+/**
+ * Whether a URL is where the shared server listens: plain http on this
+ * computer, at the MCP path (see HTTP_HOST and MCP_PATH in http-server.ts,
+ * which also accepts "localhost"). Any other URL is some other server.
+ */
+function isSharedServerUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === "http:"
+        && (parsed.hostname === "127.0.0.1" || parsed.hostname === "localhost")
+        && parsed.pathname === "/mcp";
+}
 export function classifyRegistration(entry, platform = process.platform) {
     if (entry === undefined)
         return { state: "missing" };
-    if (entry === null || typeof entry !== "object") {
-        return { state: "different", current: "(an entry setup could not read)" };
+    const unreadable = { state: "different", current: "(an entry setup could not read)" };
+    if (entry === null || typeof entry !== "object")
+        return unreadable;
+    const { command, args, url } = entry;
+    if (typeof command !== "string" && typeof url === "string") {
+        // Shown without user-info, query or fragment: a token in the URL must not
+        // reach the setup message or the prepare JSON (#295).
+        const shown = displayUrl(url);
+        if (shown === null)
+            return unreadable;
+        return isSharedServerUrl(url) ? { state: "shared_http", url: shown } : { state: "different", current: shown };
     }
-    const { command, args } = entry;
     if (typeof command !== "string") {
-        return { state: "different", current: JSON.stringify(entry) };
+        const transport = describeTransport(entry);
+        return transport === null ? unreadable : { state: "different", current: transport };
     }
     const argv = [command, ...(Array.isArray(args) ? args.map(String) : [])];
     const expected = serverCommand(platform);
@@ -48,6 +74,35 @@ export function classifyRegistration(entry, platform = process.platform) {
     }
     return { state: "different", current: argv.join(" ") };
 }
+/**
+ * A URL with its user-info, query and fragment removed, which is where a
+ * token in a URL rides. Null when it doesn't parse.
+ */
+function displayUrl(url) {
+    if (!URL.canParse(url))
+        return null;
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.href;
+}
+/**
+ * A commandless entry with no string `url` (Windsurf's `serverUrl`, Gemini's
+ * `httpUrl`), reduced to its transport label and its cleaned URL. Everything
+ * else (headers, env, credential helpers, unknown fields) can carry secrets,
+ * so it never prints.
+ */
+function describeTransport(entry) {
+    const { type, serverUrl, httpUrl } = entry;
+    const raw = typeof serverUrl === "string" ? serverUrl : typeof httpUrl === "string" ? httpUrl : null;
+    const shown = raw === null ? null : displayUrl(raw);
+    if (shown === null)
+        return null;
+    const label = typeof type === "string" && /^[\w-]+$/.test(type) ? { type } : {};
+    return JSON.stringify({ ...label, url: shown });
+}
 function readJsonFile(filePath) {
     try {
         return JSON.parse(fs.readFileSync(filePath, "utf-8"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.0.8",
+  "version": "5.0.10",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",