brightspace-mcp-server 5.1.22 → 5.1.24

package/README.md

@@ -159,7 +159,7 @@ npx -y brightspace-mcp-server@latest auth
 
 **Want fewer 2FA prompts?** `setup` asks one question, "How often do you want to approve sign-ins on your phone?": **1** every time (default), **2** remember this computer, or **3** let this computer answer Microsoft's code requests itself (needs an authenticator setup key). Options 2 and 3 are opt-in and not for shared computers; to turn them off, rerun `setup` and pick 1. The tradeoffs and the steps for getting the key are in [docs/sign-in.md](docs/sign-in.md#fewer-2fa-prompts).
 
-**To sign out early** (on a shared computer, say), just ask your AI app to sign you out of Brightspace, or run `npx -y brightspace-mcp-server@latest auth --logout` in a terminal. It deletes this computer's saved Brightspace session, so the next question does a full sign-in. Your saved password, authenticator key, and settings are kept, so with a saved authenticator key that sign-in can finish without you; on a shared computer, also delete the saved `brightspace-mcp-server` entries from your computer's password store (Keychain Access on a Mac, Credential Manager on Windows). Other AI apps open on this computer are signed out too and will ask you to sign in on their next question. (An app you opened before updating may keep answering for up to an hour; quit and reopen it to sign it out right away.) It only clears this computer; it does not sign you out of Microsoft or Brightspace anywhere else. Asking your AI app also cancels a sign-in still waiting for you to approve it; the `auth --logout` command instead refuses and deletes nothing while a sign-in is in progress. Cancelling doesn't get you a new prompt any sooner: Microsoft won't send another until the earlier one expires, up to 5 minutes after it was sent.
+**To sign out early** (on a shared computer, say), just ask your AI app to sign you out of Brightspace, or run `npx -y brightspace-mcp-server@latest auth --logout` in a terminal. It deletes this computer's saved Brightspace session, so the next question does a full sign-in. Your saved password, authenticator key, and settings are kept, so with a saved authenticator key that sign-in can finish without you; on a shared computer, also delete the saved `brightspace-mcp-server` entries from your computer's password store (Keychain Access on a Mac, Credential Manager on Windows). Other AI apps open on this computer are signed out too and will ask you to sign in on their next question. (An app you opened before updating may keep answering for up to an hour; quit and reopen it to sign it out right away.) It only clears this computer; it does not sign you out of Microsoft or Brightspace anywhere else. Both also cancel a sign-in an AI app started that is still waiting for you to approve it (`auth --logout` can't on Windows, and leaves an `auth` run in another terminal alone, deleting nothing). Cancelling doesn't get you a new prompt any sooner: Microsoft won't send another until the earlier one expires, up to 5 minutes after it was sent.
 
 How often you're asked is up to your school, not this tool. Everything else about sign-in — Duo, authenticator codes, visible-browser mode, and running without a browser at all (Docker, WSL, hardware keys) — is in [docs/sign-in.md](docs/sign-in.md).
 

package/build/auth/auth-lock.js

@@ -119,7 +119,7 @@ export async function inspectLockOwner(lockPath) {
 /**
  * The PID of a live "automatic" owner (a background AuthRunner child), or
  * undefined when the lock is free, its owner is gone, or it is held some other
- * way. Used by sign_out to cancel another app's waiting sign-in.
+ * way. Used by sign_out and `auth --logout` to cancel another app's waiting sign-in.
  */
 export async function liveAutomaticOwner(lockPath) {
     const owner = await readOwner(lockPath);

package/build/auth/auth-runner.js

@@ -243,16 +243,25 @@ function forceStop(pid) {
 const CANCEL_WAIT_MS = 5000;
 /**
  * Stop a background sign-in that ANOTHER server process on this computer
- * started and that holds the cross-process lock, so sign_out can cancel a
- * sign-in whichever app began it. Only an "automatic" owner is stopped (a
+ * started and that holds the cross-process lock, so sign_out and
+ * `auth --logout` can cancel a sign-in whichever app began it. Only an "automatic" owner is stopped (a
  * person's `auth` run in a terminal never is), and only after its command
  * line confirms it is this package's sign-in child: the PID comes from a file,
  * and a PID the system has since reused must never be killed. That check
- * needs ps, so on Windows nothing is stopped and sign_out reports the sign-in
- * as one it cannot cancel. Its own server's waiting calls are answered
+ * needs ps, so on Windows nothing is stopped and sign_out or `auth --logout`
+ * reports the sign-in as one it cannot cancel. Its own server's waiting calls are answered
  * "cancelled" (see the close handler in spawnAuth). The dead owner leaves a
  * stale lock the next lock holder reclaims. Resolves true once it has exited.
  */
+/**
+ * True when a `ps` command line is this package's background sign-in child:
+ * `auth-cli.js` as a whole path segment, followed later by a standalone
+ * `--automatic`. The runtime binary is not checked, since an app may run the
+ * server on an embedded runtime that isn't named node.
+ */
+export function isAutomaticSignInCommand(command) {
+    return /(?:^|[\s/\\])auth-cli\.js\s(?:.*\s)?--automatic(?:\s|$)/.test(command.trim());
+}
 export async function stopAutomaticSignIn(lockPath) {
     if (process.platform === "win32")
         return false;
@@ -266,17 +275,20 @@ export async function stopAutomaticSignIn(lockPath) {
     catch {
         return false;
     }
-    if (!/auth-cli\.js\b/.test(command) || !command.includes("--automatic"))
+    if (!isAutomaticSignInCommand(command))
         return false;
-    log("WARN", `Cancelling another app's background sign-in (pid ${pid}) for sign_out`);
+    log("WARN", `Cancelling another app's background sign-in (pid ${pid}) to sign out`);
     forceStop(pid);
     const deadline = Date.now() + CANCEL_WAIT_MS;
     while (Date.now() < deadline) {
+        // Only "no such process" means it exited: EPERM is a live process this
+        // user cannot signal, which the SIGKILL did not stop either.
         try {
             process.kill(pid, 0);
         }
-        catch {
-            return true;
+        catch (error) {
+            if (error.code === "ESRCH")
+                return true;
         }
         await new Promise((resolve) => setTimeout(resolve, 50));
     }

package/build/auth/logout.js

@@ -3,8 +3,9 @@
  *
  * `auth --logout`: end the saved Brightspace session on this computer early.
  *
- * This is a local sign-out only. It deletes the files that let the next tool
- * call skip the browser, so that call does a full sign-in. It does not log out
+ * This is a local sign-out only. It first stops a background sign-in an AI
+ * app started (as sign_out does), then deletes the files that let the next
+ * tool call skip the browser, so that call does a full sign-in. It does not log out
  * of Microsoft or D2L on their servers, and it leaves the saved password,
  * config.json, and every credential-store entry (including the session
  * encryption key, which the next sign-in reuses) exactly as they were.
@@ -15,6 +16,7 @@ import { acquireProcessLock, AuthenticationInProgressError } from "./auth-lock.j
 import { BROWSER_STATE_FILE, LEGACY_BROWSER_STATE_FILE } from "./browser-state-store.js";
 import { MICROSOFT_SESSION_FILE } from "./microsoft-session.js";
 import { authLockPath } from "./mfa-challenge.js";
+import { stopAutomaticSignIn } from "./auth-runner.js";
 import { SESSION_FILE, SessionStore } from "./session-store.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
 import { resolveSessionLocation } from "../utils/config.js";
@@ -94,16 +96,38 @@ export async function clearSavedSession(sessionDir) {
 const KEPT = "Kept: your saved password, config.json, and any authenticator or credential-store entries.";
 const MEMORY_NOTE = "Other Brightspace apps open on this computer sign out on their next request. One you opened before updating may keep answering for up to an hour; quit and reopen it to sign it out right away.";
 const LOCAL_ONLY = "This only clears files on this computer. It does not sign you out of Microsoft or Brightspace on their servers.";
+const CANCELLED = "Cancelled the Brightspace sign-in that was waiting for approval, so the prompt or number from it no longer works.";
+const NEXT_PROMPT = "Microsoft keeps that prompt open for up to 5 minutes after sending it and sends this account no other until then, so the next sign-in can take that long to show a new number to approve.";
 /**
  * The `auth --logout` command. Resolves to the process exit code: 0 when the
- * session was cleared or there was nothing to clear, 2 when a sign-in is in
- * progress (the same code `auth` uses for that), 1 for anything else.
+ * session was cleared or there was nothing to clear, 2 when a sign-in or
+ * sign-out it can't stop holds the lock (the same code `auth` uses for that),
+ * 1 for anything else. A background sign-in an AI app started is stopped
+ * first; a person's `auth` run is never stopped.
  */
 export async function runLogout(options = {}) {
     const print = options.print ?? ((line) => console.error(line));
     try {
         const sessionDir = options.sessionDir ?? resolveSessionLocation().sessionDir;
-        const { removed } = await clearSavedSession(sessionDir);
+        // A sign-in an AI app started in the background holds the lock, and a
+        // terminal has no other way to stop it, so stop it as sign_out does.
+        const stopBackground = options.stopBackground ?? ((dir) => stopAutomaticSignIn(authLockPath(dir)));
+        const cancelled = await stopBackground(sessionDir);
+        if (cancelled)
+            print(CANCELLED);
+        let removed;
+        try {
+            ({ removed } = await clearSavedSession(sessionDir));
+        }
+        catch (error) {
+            // The lock was taken again between stopping one sign-in and clearing:
+            // most likely the AI app's next question started a new one.
+            if (cancelled && error instanceof AuthenticationInProgressError) {
+                print("Not signed out: a new sign-in started before the session could be cleared, so nothing was deleted. Run this command again.");
+                return 2;
+            }
+            throw error;
+        }
         if (removed.length === 0) {
             print("No saved Brightspace session was found on this computer, so there is nothing to clear.");
         }
@@ -114,13 +138,15 @@ export async function runLogout(options = {}) {
             print(`The next Brightspace request, or \`${AUTH_COMMAND}\`, will do a full sign-in.`);
         }
         print(MEMORY_NOTE);
+        if (cancelled)
+            print(NEXT_PROMPT);
         print(LOCAL_ONLY);
         return 0;
     }
     catch (error) {
         if (error instanceof AuthenticationInProgressError) {
-            print("Not signed out: a sign-in is in progress. Nothing was deleted.");
-            print("Wait for it to finish (or cancel it), then run this command again.");
+            print("Not signed out: a sign-in or sign-out this command can't stop is in progress, so nothing was deleted.");
+            print("If it is an `auth` run in another terminal, finish or close it there. On Windows, a sign-in an AI app started can't be stopped from here: wait for it to finish (up to 5 minutes). Then run this command again.");
             return 2;
         }
         if (error instanceof RemoveError) {

package/build/tools/get-assignments.js

@@ -23,6 +23,13 @@ function richTextHtml(field) {
     const nested = typeof field.Text === "object" && field.Text !== null ? field.Text.Html : null;
     return nested ?? field.Html ?? null;
 }
+/** The highest Score among attempts D2L has scored, or null when none has one. */
+function bestAttemptScore(attempts) {
+    const scores = (attempts ?? [])
+        .map((a) => a.Score)
+        .filter((score) => typeof score === "number");
+    return scores.length > 0 ? Math.max(...scores) : null;
+}
 /**
  * The grade types a student is actually scored on. D2L documents exactly four
  * GradeObject shapes, told apart by a string GradeType; anything else a
@@ -764,9 +771,9 @@ async function fetchCourseInventory(apiClient, courseId, baseUrl) {
             attemptsUsed: completedAttempts?.length ?? null,
             attemptsRemaining,
             attemptWarning,
-            bestScore: completedAttempts && completedAttempts.length > 0
-                ? Math.max(...completedAttempts.map((a) => a.Score ?? 0))
-                : null,
+            // An attempt awaiting manual grading carries Score null: it is not a
+            // zero, so only scored attempts count toward the best (issue #370).
+            bestScore: bestAttemptScore(completedAttempts),
             gracePeriodMinutes: quiz.SubmissionGracePeriod ?? null,
             hasPassword: Boolean(quiz.Password),
             // Additive fields, each emitted only when it has something to say.

package/build/tools/sign-out.js

@@ -27,10 +27,10 @@ function text(message, isError = false) {
 /**
  * Register sign_out tool.
  *
- * The in-chat version of `auth --logout`, plus one thing the command does not
- * do: it first cancels a background sign-in still waiting on MFA, this
- * server's (AuthRunner.cancel, which answers every call waiting on it) or
- * another app's on this computer (stopAutomaticSignIn). A user who missed the
+ * The in-chat version of `auth --logout`. Both first cancel a background
+ * sign-in another app on this computer started (stopAutomaticSignIn); this
+ * one also cancels this server's own (AuthRunner.cancel, which answers every
+ * call waiting on it), which the command has no server to do. A user who missed the
  * prompt otherwise waited out its 5-minute window for a new one. Then it
  * deletes this computer's saved
  * session for the account the server is configured with (clearSavedSession,

package/build/utils/course-files.js

@@ -59,6 +59,13 @@ function quickLinkFilePath(input, courseId, origin) {
 function enforcedFilePath(input, courseId, origin) {
     let path = input;
     if (!path.startsWith("/")) {
+        // Check the raw authority before URL parsing can normalize it. The first
+        // literal slash must start the path, not occur inside a query or fragment.
+        const authorityStart = path.indexOf("//") + 2;
+        const pathStart = path.indexOf("/", authorityStart);
+        if (pathStart <= authorityStart ||
+            /[?#\\\x00-\x20\x7f]/.test(path.slice(authorityStart, pathStart)))
+            return null;
         let link;
         try {
             link = new URL(path);
@@ -68,7 +75,7 @@ function enforcedFilePath(input, courseId, origin) {
         }
         if (!origin || link.origin !== new URL(origin).origin || link.username || link.password)
             return null;
-        path = path.slice(path.indexOf("/", path.indexOf("//") + 2));
+        path = path.slice(pathStart);
     }
     if (!path.startsWith(ENFORCED_PREFIX))
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.1.22",
+  "version": "5.1.24",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",