brightspace-mcp-server 5.1.14 → 5.1.16

package/build/auth/auth-lock.js

@@ -196,12 +196,13 @@ async function waitForTakeover(lockPath, stale) {
 export async function acquireProcessLock(lockPath, options = {}) {
     await fs.mkdir(path.dirname(lockPath), { recursive: true, mode: 0o700 });
     const mode = options.mode ?? "explicit";
-    const lease = await acquireLease(lockPath, 0, mode);
+    const lease = await acquireLease(lockPath, 0, mode, options.abandoned);
     return () => lease.release();
 }
-async function acquireLease(lockPath, depth, mode) {
+async function acquireLease(lockPath, depth, mode, abandoned) {
     if (depth > 16)
         throw new AuthenticationInProgressError();
+    const gone = (candidate) => lockOps.isDead(candidate) || abandoned?.(candidate.pid) === true;
     const owner = { pid: process.pid, host: hostname(), nonce: randomUUID(), mode };
     for (let attempt = 0; attempt < 3; attempt += 1) {
         try {
@@ -224,7 +225,7 @@ async function acquireLease(lockPath, depth, mode) {
         const stale = await readOwner(lockPath);
         if (!stale)
             throw new AuthenticationInProgressError();
-        if (!lockOps.isDead(stale)) {
+        if (!gone(stale)) {
             // A live owner is not stale — the existing behavior for two contending
             // explicit runs, or an automatic run finding anything alive at all.
             // The one exception: an explicit run may take over a live *automatic*
@@ -244,7 +245,7 @@ async function acquireLease(lockPath, depth, mode) {
         const claim = await acquireLease(path.join(lockPath, "reclaim.lock"), depth + 1, mode);
         try {
             const current = await readOwner(lockPath);
-            if (current?.nonce !== stale.nonce || !lockOps.isDead(current))
+            if (current?.nonce !== stale.nonce || !gone(current))
                 throw new AuthenticationInProgressError();
             const retired = `${lockPath}.stale.${owner.nonce}`;
             // A rename blocked by contention means another contender is inside this

package/build/runtime-relay.js

@@ -144,11 +144,18 @@ async function post(address, message, signal, reply) {
         await response.body?.cancel();
         throw new Unreachable(`HTTP ${response.status}`);
     }
+    // A runtime answers every request with JSON or an event stream, or with a
+    // bodiless 202. Anything else is another program that took a dead
+    // runtime's port, so this is no runtime at all: start a fresh one.
+    const type = response.headers.get("content-type") ?? "";
+    if (response.status !== 202 && !/application\/json|text\/event-stream/i.test(type)) {
+        await response.body?.cancel();
+        throw new Unreachable(`HTTP ${response.status} from something other than a Brightspace runtime`);
+    }
     if (!response.ok)
         throw new Error(`HTTP ${response.status}: ${await response.text()}`);
     if (response.status === 202 || !response.body)
         return;
-    const type = response.headers.get("content-type") ?? "";
     if (!type.includes("text/event-stream")) {
         const body = JSON.parse(await response.text());
         for (const item of Array.isArray(body) ? body : [body])

package/build/shared-runtime.js

@@ -13,6 +13,8 @@ import { log } from "./utils/logger.js";
 export const DEFAULT_IDLE_MS = 10 * 60_000;
 /** How long a starting runtime waits for a runtime that is starting or stopping to settle. */
 const CLAIM_WAIT_MS = 10_000;
+/** How long a published runtime has to answer before it is taken for dead. */
+const PROBE_TIMEOUT_MS = 2_000;
 const STATE_FILE = "state.json";
 const OWNER_LOCK = "owner.lock";
 /**
@@ -108,19 +110,52 @@ export async function serveSharedRuntime(runtime, { dir, idleMs }) {
 /**
  * Take the owner lock for `dir`, waiting out a runtime that is starting or
  * stopping. undefined when another live runtime has published its address.
+ *
+ * A published address that does not answer belongs to a runtime that died
+ * without cleaning up, typically in a reboot, which also leaves its owner
+ * lock behind. Its pid may since have gone to an unrelated process, so the
+ * lock is reclaimed when its owner is that pid, not only when the pid is gone.
+ * A runtime that is still starting holds the lock under its own pid and has
+ * not published yet, so it is waited for instead.
  */
 async function claimOwnership(dir) {
     const deadline = Date.now() + CLAIM_WAIT_MS;
     for (;;) {
+        const published = await readRuntimeAddress(dir);
+        if (published && await answers(published))
+            return undefined;
         try {
-            return await acquireProcessLock(path.join(dir, OWNER_LOCK), { mode: "exclusive" });
+            return await acquireProcessLock(path.join(dir, OWNER_LOCK), {
+                mode: "exclusive",
+                abandoned: (pid) => pid === published?.pid,
+            });
         }
         catch (error) {
             if (!(error instanceof AuthenticationInProgressError))
                 throw error;
         }
-        if (await readRuntimeAddress(dir) || Date.now() > deadline)
+        if (Date.now() > deadline)
             return undefined;
         await delay(50);
     }
 }
+/**
+ * Whether the runtime at `address` is still serving it. Anything but a
+ * refused or timed-out connection, or a 401 from another server now on that
+ * port, counts: a runtime that is shutting down (503) is still alive.
+ */
+async function answers(address) {
+    try {
+        const response = await fetch(address.url, {
+            headers: { Authorization: `Bearer ${address.token}` },
+            signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+        });
+        await response.body?.cancel();
+        // A runtime answers an authorized GET with 405 (it serves POST only). Any
+        // other answer is another program that took a dead runtime's port.
+        return response.status === 405;
+    }
+    catch {
+        return false;
+    }
+}

package/build/utils/html-attributes.js

@@ -3,11 +3,15 @@
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
  * Licensed under MIT — see LICENSE file for details.
  */
+/** A numeric reference as its character, or left as written when it names no code point (issue #352). */
+function codePoint(whole, code) {
+    return code <= 0x10ffff ? String.fromCodePoint(code) : whole;
+}
 /** Decode the character references Brightspace's HTML editor writes into attribute values. */
 export function decodeEntities(value) {
     return value
-        .replace(/&#x([0-9a-f]+);/gi, (_, hex) => String.fromCodePoint(parseInt(hex, 16)))
-        .replace(/&#(\d+);/g, (_, dec) => String.fromCodePoint(parseInt(dec, 10)))
+        .replace(/&#x([0-9a-f]+);/gi, (whole, hex) => codePoint(whole, parseInt(hex, 16)))
+        .replace(/&#(\d+);/g, (whole, dec) => codePoint(whole, parseInt(dec, 10)))
         .replace(/&quot;/g, '"')
         .replace(/&lt;/g, "<")
         .replace(/&gt;/g, ">")

package/build/utils/transcript/captions.js

@@ -26,11 +26,11 @@ function decodeEntities(text) {
             return ENTITIES[key];
         if (key.startsWith("#x")) {
             const code = Number.parseInt(key.slice(2), 16);
-            return Number.isFinite(code) && code > 0 ? String.fromCodePoint(code) : whole;
+            return Number.isFinite(code) && code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : whole;
         }
         if (key.startsWith("#")) {
             const code = Number.parseInt(key.slice(1), 10);
-            return Number.isFinite(code) && code > 0 ? String.fromCodePoint(code) : whole;
+            return Number.isFinite(code) && code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : whole;
         }
         return whole;
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.1.14",
+  "version": "5.1.16",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",