canvas-parent-mcp 1.1.3 → 1.1.5

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "1.1.3"
+    "version": "1.1.5"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "1.1.3",
+      "version": "1.1.5",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/dist/auth.js

@@ -52,20 +52,15 @@
 //   - `loadAccount()` (the existing env-var resolver) is reused as-is so
 //     the legacy paths keep working unchanged.
 import { bootstrap } from '@fetchproxy/bootstrap';
+import { classifyBridgeError } from '@fetchproxy/server';
+import { readEnvVar } from '@chrischall/mcp-utils';
 import { loadAccount } from './config.js';
 import pkg from '../package.json' with { type: 'json' };
+// Fleet-shared env sanitization (`@chrischall/mcp-utils`): trim + suppress
+// empty/"undefined"/"null"/unsubstituted-${...}-placeholder. Reads process.env
+// by default. Thin alias keeps the existing call sites unchanged.
 function readEnv(key) {
-    const raw = process.env[key];
-    if (typeof raw !== 'string')
-        return undefined;
-    const trimmed = raw.trim();
-    if (trimmed.length === 0)
-        return undefined;
-    if (trimmed === 'undefined' || trimmed === 'null')
-        return undefined;
-    if (/^\$\{[^}]*\}$/.test(trimmed))
-        return undefined;
-    return trimmed;
+    return readEnvVar(key);
 }
 function fetchproxyDisabled() {
     const raw = readEnv('CANVAS_DISABLE_FETCHPROXY');
@@ -153,6 +148,18 @@ export async function resolveAuth() {
             };
         }
         catch (e) {
+            // 0.8.0+ typed-error discrimination. The fetchproxy server already
+            // retries once on SW eviction (bridgeReviveDelayMs=2000 default), so
+            // a thrown FetchproxyBridgeDownError means the retry also failed —
+            // the extension's service worker is genuinely down and the user
+            // needs to wake it. The `.hint` is the actionable copy
+            // ("click the extension toolbar icon...") that we'd otherwise have
+            // to hand-write here. Surface it verbatim so users in path 4 get
+            // the same self-service guidance as path 5.
+            if (classifyBridgeError(e) === 'bridge_down') {
+                const downErr = e;
+                throw new Error(`Canvas auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`);
+            }
             const msg = e instanceof Error ? e.message : String(e);
             throw new Error(`Canvas auth: no CANVAS_TOKEN, CANVAS_CLIENT_*/CANVAS_REFRESH_TOKEN, or CANVAS_USERNAME/CANVAS_PASSWORD set, ` +
                 `and fetchproxy fallback failed: ${msg}`);