canvas-parent-mcp 1.1.6 → 1.1.8

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "1.1.6"
+    "version": "1.1.8"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "1.1.6",
+      "version": "1.1.8",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "1.1.6",
+  "version": "1.1.8",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/dist/auth.js

@@ -14,17 +14,20 @@
 //      most reliable mode but most schools have disabled token creation
 //      for non-admins. Unchanged from pre-fetchproxy behavior.
 //
-//   2. OAuth refresh token (existing)
-//      CANVAS_CLIENT_ID + CANVAS_CLIENT_SECRET + CANVAS_REFRESH_TOKEN →
-//      `grant_type=refresh_token` against `/login/oauth2/token`, bootstrap
-//      via the bundled QR-login helper. Unchanged.
-//
-//   3. Username/password session-scrape (existing)
+//   2. Username/password session-scrape (existing)
 //      CANVAS_USERNAME + CANVAS_PASSWORD → scrape `authenticity_token`
 //      from `/login/canvas`, POST creds, capture `canvas_session` +
 //      `pseudonym_credentials` cookies. Brittle (breaks on SSO/2FA and
 //      every Canvas login-page restyling) but works for direct Canvas
-//      accounts. Unchanged from pre-fetchproxy behavior.
+//      accounts. Takes precedence over OAuth (path 3) — see the
+//      precedence order in `loadAccount()` (config.ts), which returns the
+//      username/password account before checking the OAuth triple.
+//      Unchanged from pre-fetchproxy behavior.
+//
+//   3. OAuth refresh token (existing)
+//      CANVAS_CLIENT_ID + CANVAS_CLIENT_SECRET + CANVAS_REFRESH_TOKEN →
+//      `grant_type=refresh_token` against `/login/oauth2/token`, bootstrap
+//      via the bundled QR-login helper. Unchanged.
 //
 //   4. fetchproxy fallback (new)
 //      When no env vars are set, lift the user's session out of their

package/dist/bundle.js

@@ -13,7 +13,11 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -34687,6 +34691,20 @@ async function runMcp(opts) {
 
 // node_modules/@chrischall/mcp-utils/dist/errors/index.js
 var DEFAULT_ERROR_MESSAGE_MAX = 500;
+var McpToolError = class extends Error {
+  /** Actionable remediation text, when one applies. */
+  hint;
+  constructor(message, opts) {
+    super(message, opts?.cause !== void 0 ? { cause: opts.cause } : void 0);
+    this.name = "McpToolError";
+    if (opts?.hint !== void 0)
+      this.hint = opts.hint;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+function createHelpfulError(message, opts) {
+  return new McpToolError(message, opts);
+}
 var BEARER_RE = /(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
 var JWT_RE = /\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/g;
 var BASIC_AUTH_RE = /(authorization\s*:\s*basic\s+)[A-Za-z0-9+/=_-]{6,}/gi;
@@ -34707,8 +34725,12 @@ var API_KEY_RE = new RegExp([
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
 var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
+var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
 }
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str = text === null || text === void 0 ? "" : String(text);
@@ -34756,6 +34778,23 @@ async function loadDotenvSafely(opts = {}) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
+function buildQueryString(params) {
+  const parts = [];
+  for (const [key, value] of Object.entries(params)) {
+    if (value === void 0 || value === null || value === "")
+      continue;
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        if (item === void 0 || item === null || item === "")
+          continue;
+        parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(item))}`);
+      }
+    } else {
+      parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
+    }
+  }
+  return parts.length > 0 ? `?${parts.join("&")}` : "";
+}
 function parseLinkHeader(header) {
   const out = {};
   if (!header)
@@ -34767,6 +34806,90 @@ function parseLinkHeader(header) {
   }
   return out;
 }
+var MAX_AGE_RE = /(?:^|;)\s*Max-Age\s*=\s*(-?\d+)\s*(?:;|$)/i;
+var EXPIRES_RE = /(?:^|;)\s*Expires\s*=\s*([^;]+)/i;
+var EXPIRES_DELETION_YEAR = 2e3;
+function isDeletionCookie(entry) {
+  const maxAge = MAX_AGE_RE.exec(entry);
+  if (maxAge)
+    return Number(maxAge[1]) <= 0;
+  const expires = EXPIRES_RE.exec(entry);
+  if (expires && expires[1]) {
+    const when = new Date(expires[1].trim());
+    if (!Number.isNaN(when.getTime()))
+      return when.getUTCFullYear() < EXPIRES_DELETION_YEAR;
+  }
+  return false;
+}
+function parseNameValue(entry) {
+  const nameValue = (entry.split(";")[0] ?? "").trim();
+  const eqIdx = nameValue.indexOf("=");
+  if (eqIdx < 1)
+    return null;
+  return { name: nameValue.slice(0, eqIdx).trim(), value: nameValue.slice(eqIdx + 1).trim() };
+}
+function parseCookieJar(setCookieHeaders) {
+  const entries = setCookieEntries(setCookieHeaders);
+  const jar = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (isDeletionCookie(entry))
+      continue;
+    const pair = parseNameValue(entry);
+    if (!pair || !pair.value)
+      continue;
+    jar.set(pair.name, pair.value);
+  }
+  const cookies = {};
+  for (const [k, v] of jar)
+    cookies[k] = v;
+  const cookieHeader = [...jar.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
+  return { cookies, cookieHeader };
+}
+function setCookieEntries(source) {
+  if (source == null)
+    return [];
+  if (Array.isArray(source))
+    return source;
+  if (typeof source === "string")
+    return splitSetCookie(source);
+  if (typeof source.getSetCookie === "function")
+    return source.getSetCookie();
+  const joined = source.get("set-cookie");
+  return joined ? splitSetCookie(joined) : [];
+}
+var CookieJar = class {
+  jar = /* @__PURE__ */ new Map();
+  /** Merge `Set-Cookie`s into the jar (later wins; deletion markers remove). */
+  absorb(setCookies) {
+    for (const entry of setCookieEntries(setCookies)) {
+      const pair = parseNameValue(entry);
+      if (!pair)
+        continue;
+      if (isDeletionCookie(entry)) {
+        this.jar.delete(pair.name);
+        continue;
+      }
+      if (!pair.value)
+        continue;
+      this.jar.set(pair.name, pair.value);
+    }
+  }
+  /** The current value of a cookie, or `undefined` when absent/deleted. */
+  get(name) {
+    return this.jar.get(name);
+  }
+  /** Render the `Cookie` request-header value: `name=value; name2=value2`. */
+  header() {
+    return [...this.jar.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
+  }
+  /** Number of cookies currently in the jar. */
+  get size() {
+    return this.jar.size;
+  }
+};
+function splitSetCookie(header) {
+  return header.split(/,(?=\s*[^;,\s]+\s*=)/).map((s) => s.trim()).filter((s) => s.length > 0);
+}
 
 // node_modules/@chrischall/mcp-utils/dist/zod/index.js
 var PositiveInt = external_exports.number().int().positive();
@@ -34787,6 +34910,74 @@ var pageSchema = {
   page_size: external_exports.number().int().min(1).max(200).default(50).describe("Number of items per page (1-200).")
 };
 
+// node_modules/@chrischall/mcp-utils/dist/auth/index.js
+var sleep = (ms) => ms > 0 ? new Promise((r) => setTimeout(r, ms)) : Promise.resolve();
+function createOAuth2Refresher(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const grantType = opts.grantType ?? "refresh_token";
+  const maxRetries = opts.retry?.count ?? 0;
+  const retryDelayMs = opts.retry?.delayMs ?? 0;
+  let inFlight = null;
+  async function exchangeOnce() {
+    const body = new URLSearchParams({
+      grant_type: grantType,
+      refresh_token: opts.refreshToken,
+      ...opts.params
+    }).toString();
+    const res = await doFetch(opts.endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body
+    });
+    if (!res.ok) {
+      const errText = await res.text().catch(() => "");
+      throw createHelpfulError(`OAuth2 token refresh failed: ${res.status} ${res.statusText}: ${truncateErrorMessage(errText, 200)}`, { hint: "The refresh token may be expired or revoked \u2014 re-authenticate." });
+    }
+    const data = await res.json().catch(() => null);
+    const accessToken = data?.access_token;
+    if (typeof accessToken !== "string" || accessToken.length === 0) {
+      throw createHelpfulError("OAuth2 token refresh returned no access_token.", {
+        hint: "The token endpoint returned an unexpected body."
+      });
+    }
+    const result = { accessToken };
+    if (typeof data?.refresh_token === "string" && data.refresh_token.length > 0) {
+      result.refreshToken = data.refresh_token;
+    }
+    if (typeof data?.expires_in === "number") {
+      result.expiresIn = data.expires_in;
+      result.expiresAt = new Date(Date.now() + data.expires_in * 1e3);
+    }
+    return result;
+  }
+  async function exchangeWithRetry() {
+    let lastErr;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      try {
+        return await exchangeOnce();
+      } catch (e) {
+        lastErr = e;
+        if (attempt < maxRetries)
+          await sleep(retryDelayMs);
+      }
+    }
+    throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+  }
+  return function refresh() {
+    if (inFlight)
+      return inFlight;
+    const p = exchangeWithRetry().finally(() => {
+      if (inFlight === p)
+        inFlight = null;
+    });
+    inFlight = p;
+    return p;
+  };
+}
+
 // node_modules/@fetchproxy/protocol/dist/frames.js
 var PROTOCOL_VERSION = 2;
 var HKDF_SESSION_INFO = "fetchproxy/1.0.0/session";
@@ -35743,10 +35934,20 @@ async function openEncryptedFrame(sessionKey, frame) {
 
 // node_modules/@fetchproxy/server/dist/election.js
 import { createServer, Server as HttpServer } from "node:http";
+var DEFAULT_BIND_TIMEOUT_MS = 5e3;
 async function electRole(opts) {
   const server = createServer();
+  const bindTimeoutMs = opts.bindTimeoutMs ?? DEFAULT_BIND_TIMEOUT_MS;
   return new Promise((resolve, reject) => {
+    let timer;
+    const clearBindTimer = () => {
+      if (timer) {
+        clearTimeout(timer);
+        timer = void 0;
+      }
+    };
     const onError = (e) => {
+      clearBindTimer();
       server.removeListener("listening", onListening);
       if (e.code === "EADDRINUSE") {
         try {
@@ -35759,11 +35960,25 @@ async function electRole(opts) {
       }
     };
     const onListening = () => {
+      clearBindTimer();
       server.removeListener("error", onError);
       resolve({ role: "host", server });
     };
     server.once("error", onError);
     server.once("listening", onListening);
+    if (bindTimeoutMs > 0) {
+      timer = setTimeout(() => {
+        server.removeListener("error", onError);
+        server.removeListener("listening", onListening);
+        try {
+          server.close();
+        } catch {
+        }
+        reject(new Error(`fetchproxy: bind to ${opts.host}:${opts.port} timed out after ${bindTimeoutMs}ms (port may be in a bad state)`));
+      }, bindTimeoutMs);
+      if (typeof timer.unref === "function")
+        timer.unref();
+    }
     server.listen(opts.port, opts.host);
   });
 }
@@ -35856,6 +36071,44 @@ var SessionState = class {
   }
 };
 
+// node_modules/@fetchproxy/server/dist/session-ready.js
+var SESSION_READY_TIMEOUT_MS = 3e4;
+var FetchproxySessionNotReadyError = class extends Error {
+  reason;
+  pairCode;
+  mcpId;
+  hint;
+  constructor(info) {
+    const pairing = info.pairCode !== null && info.pairCode !== "";
+    const hint = pairing ? `Open the Transporter extension popup and approve pair code ${info.pairCode} for "${info.mcpId}", then retry.` : `The extension is connected but hasn't confirmed a session for "${info.mcpId}" \u2014 sign in to the target site in that browser (and approve the requested scope if it changed), then retry.`;
+    super(`fetchproxy: ${pairing ? "pairing not yet approved" : "no confirmed browser session"} for "${info.mcpId}". ${hint}`);
+    this.name = "FetchproxySessionNotReadyError";
+    this.reason = pairing ? "pair-required" : "not-ready";
+    this.pairCode = pairing ? info.pairCode : null;
+    this.mcpId = info.mcpId;
+    this.hint = hint;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+async function awaitSessionReady(ready, opts) {
+  const ms = opts.timeoutMs ?? SESSION_READY_TIMEOUT_MS;
+  if (ms <= 0)
+    return ready;
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      reject(new FetchproxySessionNotReadyError({ mcpId: opts.mcpId, pairCode: opts.pendingPairCode() }));
+    }, ms);
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([ready, timeout]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+
 // node_modules/@fetchproxy/server/dist/host.js
 var PUBLIC_ORIGIN_RE = /^https?:\/\/(?!(127\.0\.0\.1|localhost)(:|$))/i;
 var enc2 = new TextEncoder();
@@ -35943,6 +36196,29 @@ async function startHost(opts) {
           return;
         }
         if (frame.type === "hello" && frame.role === "server") {
+          const peerEdPub = fromB64(frame.identityEd25519Pub);
+          const peerSigMsg = concatBytes(enc2.encode(frame.mcpId), fromB64(frame.sessionNonce));
+          const peerSig = fromB64(frame.sessionSig);
+          let peerSigOk = false;
+          try {
+            peerSigOk = await ed25519Verify(peerEdPub, peerSigMsg, peerSig);
+          } catch {
+            peerSigOk = false;
+          }
+          if (!peerSigOk) {
+            console.warn("[fetchproxy] peer hello signature invalid \u2014 refusing registration (possible squatter)");
+            ws.close(1008, "peer hello signature invalid");
+            return;
+          }
+          const existing = peers.get(frame.mcpId);
+          if (existing && existing.ws !== ws) {
+            const existingEdPub = existing.helloFrame.identityEd25519Pub;
+            if (existingEdPub !== frame.identityEd25519Pub) {
+              console.warn("[fetchproxy] peer mcpId already mapped to a different identity \u2014 refusing (mcpId squatting)");
+              ws.close(1008, "mcpId already registered to another identity");
+              return;
+            }
+          }
           identified = "peer";
           peerMcpId = frame.mcpId;
           peers.set(frame.mcpId, { ws, helloFrame: frame });
@@ -36035,8 +36311,10 @@ async function startHost(opts) {
         resetSessionPromise();
         disconnectListeners.forEach((cb) => cb());
       }
-      if (identified === "peer" && peerMcpId)
-        peers.delete(peerMcpId);
+      if (identified === "peer" && peerMcpId) {
+        if (peers.get(peerMcpId)?.ws === ws)
+          peers.delete(peerMcpId);
+      }
     });
   });
   return {
@@ -36052,7 +36330,10 @@ async function startHost(opts) {
       });
     }),
     sendOwnInner: async (inner) => {
-      const session = await ownSessionReady;
+      const session = await awaitSessionReady(ownSessionReady, {
+        mcpId: opts.ownMcpId,
+        pendingPairCode: () => ownPendingPairCode
+      });
       if (!extensionWs)
         throw new Error("host: no extension connected");
       const sealed = await sealInnerFrame(session.sessionKey, opts.ownMcpId, session.nextOutboundSeq(), inner);
@@ -36157,7 +36438,10 @@ async function startPeer(opts) {
     ws,
     session: sessionPromise,
     sendInner: async (inner) => {
-      await sessionPromise;
+      await awaitSessionReady(sessionPromise, {
+        mcpId: opts.mcpId,
+        pendingPairCode: () => pendingPairCode
+      });
       const s = session;
       const sealed = await sealInnerFrame(s.sessionKey, opts.mcpId, s.nextOutboundSeq(), inner);
       ws.send(JSON.stringify(sealed));
@@ -36823,6 +37107,35 @@ var FetchproxyServer = class {
       this.keepAliveTimer = null;
     }
   }
+  /**
+   * Send an inner request frame via whichever bridge handle is active. If the
+   * send throws (e.g. `FetchproxySessionNotReadyError` — the session never
+   * confirmed), the frame never reached the bridge, so no reply will arrive:
+   * drop the just-registered pending resolver for this id (it lives in exactly
+   * one of the op maps — request ids are unique) so it doesn't leak until the
+   * server closes, then rethrow.
+   */
+  async sendInnerFrame(inner) {
+    try {
+      if (this.hostHandle) {
+        await this.hostHandle.sendOwnInner(inner);
+      } else if (this.peerHandle) {
+        await this.peerHandle.sendInner(inner);
+      }
+    } catch (err) {
+      if ("id" in inner && typeof inner.id === "number") {
+        const { id } = inner;
+        this.pending.delete(id);
+        this.pendingReadCookies.delete(id);
+        this.pendingStorage.delete(id);
+        this.pendingCapture.delete(id);
+        this.pendingRedirect.delete(id);
+        this.pendingDownload.delete(id);
+        this.pendingIdb.delete(id);
+      }
+      throw err;
+    }
+  }
   /**
    * Single bridge round-trip, wrapped by `fetchTimeoutMs` when set.
    * On timeout returns the `{ok:false, kind:'timeout'}` envelope —
@@ -36834,11 +37147,7 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve) => {
       this.pending.set(id, resolve);
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
+    await this.sendInnerFrame(inner);
     const timeoutMs = this.opts.fetchTimeoutMs;
     if (timeoutMs === void 0 || timeoutMs <= 0)
       return pending;
@@ -36867,6 +37176,51 @@ var FetchproxyServer = class {
         clearTimeout(timer);
     }
   }
+  /**
+   * FP-B2: bound a non-`fetch` verb's reply wait by `fetchTimeoutMs`.
+   *
+   * Before this, only `fetch()` raced its `pending` reply against a timer
+   * (`_fetchOnceWithTimeout`); `readCookies`, the storage reads,
+   * `capture_request_header`, `capture_redirect`, `download`, and
+   * `read_indexed_db` awaited their `pending` promise with no race, so a
+   * wedged extension hung the tool call indefinitely.
+   *
+   * `pending` is the already-registered reply promise. `pendingMap`/`id`
+   * point at the op-specific map entry so we can drop it on expiry exactly
+   * as `_fetchOnceWithTimeout` does — otherwise a late bridge reply would
+   * resolve into a stale resolver / leak. On timeout we reject with a
+   * `FetchproxyTimeoutError` (the same throwable the convenience methods
+   * already surface for fetch timeouts). `0`/unset opts out (unbounded),
+   * matching the fetch path.
+   */
+  async _withVerbTimeout(pending, pendingMap, id, url2) {
+    const timeoutMs = this.opts.fetchTimeoutMs;
+    if (timeoutMs === void 0 || timeoutMs <= 0)
+      return pending;
+    let timer;
+    const start = Date.now();
+    try {
+      return await Promise.race([
+        pending,
+        new Promise((_resolve, reject) => {
+          timer = setTimeout(() => {
+            pendingMap.delete(id);
+            reject(new FetchproxyTimeoutError({
+              url: url2,
+              timeoutMs,
+              role: this.role,
+              port: this.opts.port,
+              elapsedMs: Date.now() - start,
+              retryAttempted: false
+            }));
+          }, timeoutMs);
+        })
+      ]);
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+    }
+  }
   /**
    * Map an `ok:false` fetch result to its typed throwable. Centralizes
    * the kind-to-error-class switch so `request()` and (via the same
@@ -37157,12 +37511,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve) => {
       this.pendingReadCookies.set(id, resolve);
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    const result = await pending;
+    await this.sendInnerFrame(inner);
+    const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
     if (!result.ok) {
       throw new FetchproxyProtocolError(result.error);
     }
@@ -37228,12 +37578,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingStorage.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
   }
   /**
    * 0.3.0+: snapshot the next outgoing request's named header. Single-
@@ -37337,12 +37683,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingCapture.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingCapture, id, `https://${opts.host}${opts.path ?? "/*"}`);
   }
   /**
    * Snapshot the redirect target URL of the next request the browser
@@ -37426,12 +37768,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingRedirect.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingRedirect, id, `https://${opts.host}${opts.path ?? "/*"}`);
   }
   /**
    * Download `url` through the BROWSER's own network stack via
@@ -37512,12 +37850,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingDownload.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingDownload, id, opts.url);
   }
   /**
    * 0.4.0+: read declared IndexedDB keys from the user's signed-in
@@ -37564,12 +37898,8 @@ var FetchproxyServer = class {
     const pending = new Promise((resolve, reject) => {
       this.pendingIdb.set(id, { resolve, reject });
     });
-    if (this.hostHandle) {
-      await this.hostHandle.sendOwnInner(inner);
-    } else if (this.peerHandle) {
-      await this.peerHandle.sendInner(inner);
-    }
-    return pending;
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
   }
   assertScopeSubset(requested, declared, label) {
     const undeclared = undeclaredKeys(requested, declared);
@@ -38049,7 +38379,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "1.1.6",
+  version: "1.1.8",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -38093,7 +38423,7 @@ var package_default = {
     "test:watch": "vitest"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.8.0",
+    "@chrischall/mcp-utils": "^0.12.0",
     "@fetchproxy/bootstrap": "^1.0.0",
     "@fetchproxy/server": "^1.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -38101,7 +38431,7 @@ var package_default = {
     zod: "^4.4.3"
   },
   devDependencies: {
-    "@types/node": "^25.9.1",
+    "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.7",
     esbuild: "^0.28.0",
     typescript: "^6.0.3",
@@ -38195,18 +38525,30 @@ var CookieSessionManager = class {
   inFlight;
   /** A cached *permanent* config error: once set, every `ensure` rethrows it. */
   permanentError;
+  /** When the current session was minted (login) or installed (seed) — for maxAgeMs. */
+  sessionAt = 0;
   loginFn;
   isExpiredFn;
   isPermanentErrorFn;
+  maxAgeMs;
+  now;
+  onReplayLoginErrorFn;
   constructor(opts) {
     this.loginFn = opts.login;
-    this.isExpiredFn = opts.isExpired;
+    this.isExpiredFn = opts.isExpired ?? (() => false);
     this.isPermanentErrorFn = opts.isPermanentError ?? (() => false);
+    this.maxAgeMs = opts.maxAgeMs;
+    this.now = opts.now ?? Date.now;
+    this.onReplayLoginErrorFn = opts.onReplayLoginError;
   }
   /** The current session, or `undefined` before the first successful login. */
   get current() {
     return this.session;
   }
+  /** True when {@link CookieSessionManagerOptions.maxAgeMs} says the session is too old. */
+  isStale() {
+    return this.maxAgeMs !== void 0 && this.now() - this.sessionAt >= this.maxAgeMs;
+  }
   /**
    * Return the current session, or single-flight a login if there is none.
    *
@@ -38215,10 +38557,16 @@ var CookieSessionManager = class {
    * the next call retries. A login error classified permanent by
    * {@link CookieSessionManagerOptions.isPermanentError} is cached and rethrown
    * on every later call; a transient error is not cached (next call retries).
+   * With {@link CookieSessionManagerOptions.maxAgeMs} set, a session past its
+   * TTL is invalidated first, so the call falls through to a (single-flight)
+   * re-login.
    */
   async ensure() {
-    if (this.session !== void 0)
-      return this.session;
+    if (this.session !== void 0) {
+      if (!this.isStale())
+        return this.session;
+      this.invalidate();
+    }
     if (this.permanentError !== void 0)
       throw this.permanentError;
     if (this.inFlight === void 0) {
@@ -38226,6 +38574,21 @@ var CookieSessionManager = class {
     }
     return this.inFlight;
   }
+  /**
+   * Install an externally-minted session (e.g. infinitecampus's CUPS linked-
+   * district discovery, which mints sessions outside {@link
+   * CookieSessionManagerOptions.login}). The seed becomes the current session
+   * with a fresh {@link CookieSessionManagerOptions.maxAgeMs} clock, and any
+   * in-flight login is DETACHED: its waiters still receive its result, but a
+   * late resolution will not overwrite the seed. A cached permanent config
+   * error is left intact — the login path is still misconfigured, and the next
+   * post-seed re-login should keep saying so.
+   */
+  seed(session) {
+    this.session = session;
+    this.sessionAt = this.now();
+    this.inFlight = void 0;
+  }
   /**
    * One login attempt. Self-clears `inFlight` on settle so a rejected login
    * never sticks, and stamps the resulting session only while it's still the
@@ -38237,8 +38600,10 @@ var CookieSessionManager = class {
     holder.p = (async () => {
       try {
         const session = await this.loginFn();
-        if (this.inFlight === holder.p)
+        if (this.inFlight === holder.p) {
           this.session = session;
+          this.sessionAt = this.now();
+        }
         return session;
       } catch (err) {
         if (this.isPermanentErrorFn(err))
@@ -38270,6 +38635,10 @@ var CookieSessionManager = class {
    * rather than looping. If the re-login itself fails, the original
    * (expired-looking) response is returned so the caller can surface a clean
    * sign-in error rather than the login failure.
+   *
+   * `call` resolves to `R` (the generic response type, default {@link Response});
+   * the manager passes it untouched to {@link CookieSessionManagerOptions.isExpired}
+   * and returns it untouched, so a custom transport type flows through cleanly.
    */
   async withSession(call) {
     const session = await this.ensure();
@@ -38281,7 +38650,8 @@ var CookieSessionManager = class {
     let fresh;
     try {
       fresh = await this.ensure();
-    } catch {
+    } catch (err) {
+      this.onReplayLoginErrorFn?.(err);
       return res;
     }
     return call(fresh);
@@ -38306,27 +38676,12 @@ function extractAuthenticityToken(html) {
   }
   return null;
 }
-function parseSetCookie(setCookieValue) {
-  const semi = setCookieValue.indexOf(";");
-  const nameValue = semi === -1 ? setCookieValue : setCookieValue.slice(0, semi);
-  const eq = nameValue.indexOf("=");
-  if (eq === -1) return null;
-  const name = nameValue.slice(0, eq).trim();
-  const value = nameValue.slice(eq + 1).trim();
-  if (!name) return null;
-  return { name, value };
-}
-function serializeCookies(cookies) {
-  return cookies.map((c) => `${c.name}=${c.value}`).join("; ");
-}
-function collectSetCookies(headers) {
-  const out = [];
-  for (const sc of headers.getSetCookie()) {
-    const parsed = parseSetCookie(sc);
-    if (parsed) out.push(parsed);
-  }
-  return out;
-}
+var SESSION_COOKIE_NAMES = [
+  "canvas_session",
+  "pseudonym_credentials",
+  "_csrf_token",
+  "log_session_id"
+];
 async function sessionLogin(opts) {
   const baseUrl = opts.baseUrl.replace(/\/$/, "");
   const loginUrl = `${baseUrl}/login/canvas`;
@@ -38342,7 +38697,8 @@ async function sessionLogin(opts) {
     );
   }
   const html = await getRes.text();
-  const initialCookies = collectSetCookies(getRes.headers);
+  const jar = new CookieJar();
+  jar.absorb(getRes.headers);
   const authToken = extractAuthenticityToken(html);
   if (!authToken) {
     throw new SessionLoginError(
@@ -38364,14 +38720,14 @@ async function sessionLogin(opts) {
       "Content-Type": "application/x-www-form-urlencoded",
       Accept: "text/html,application/xhtml+xml",
       "User-Agent": USER_AGENT,
-      Cookie: serializeCookies(initialCookies),
+      Cookie: jar.header(),
       Origin: baseUrl,
       Referer: loginUrl
     },
     body: body.toString()
   });
-  const respCookies = collectSetCookies(postRes.headers);
-  const hasCreds = respCookies.some((c) => c.name === "pseudonym_credentials");
+  const respJar = parseCookieJar(postRes.headers.getSetCookie());
+  const hasCreds = "pseudonym_credentials" in respJar.cookies;
   if (!hasCreds) {
     const location = postRes.headers.get("location") ?? "";
     if (location && !location.startsWith(baseUrl) && !location.includes("sso.canvaslms.com")) {
@@ -38383,10 +38739,8 @@ async function sessionLogin(opts) {
       "Login response did not include a pseudonym_credentials cookie \u2014 incorrect username or password, or the account is locked."
     );
   }
-  const sessionCookies = respCookies.filter(
-    (c) => ["canvas_session", "pseudonym_credentials", "_csrf_token", "log_session_id"].includes(c.name)
-  );
-  return { cookie: serializeCookies(sessionCookies) };
+  const cookie = Object.entries(respJar.cookies).filter(([name]) => SESSION_COOKIE_NAMES.includes(name)).map(([name, value]) => `${name}=${value}`).join("; ");
+  return { cookie };
 }
 
 // src/client.ts
@@ -38397,6 +38751,8 @@ var CanvasClient = class {
   sessionLoginFn;
   preloadedCookie;
   auth;
+  /** Lazily-built shared refresh_token exchanger (oauth mode only). */
+  oauthRefresh = null;
   /**
    * `preloaded` is the fetchproxy escape hatch: when set, the client uses
    * the supplied cookie header as-if it had just successfully run
@@ -38547,29 +38903,32 @@ var CanvasClient = class {
     });
     return result.cookie;
   }
+  /**
+   * Exchange the refresh token for a fresh access token via the fleet-shared
+   * `createOAuth2Refresher` (which owns the form-encoded POST, the single-
+   * in-flight guard, and the redact-then-truncate sanitizing of upstream error
+   * bodies — so if Canvas's /login/oauth2/token error echoes the client_secret
+   * or refresh_token, it never reaches the client-facing error). Canvas-specific
+   * bits stay here: the TokenExpiredError('oauth') wrapper and the 60s
+   * proactive-expiry skew baked into `accessTokenExpiresAt`.
+   */
   async refreshAccessToken(acct) {
-    const body = new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: acct.clientId,
-      client_secret: acct.clientSecret,
-      refresh_token: acct.refreshToken
-    }).toString();
-    const res = await fetch(`${acct.baseUrl}/login/oauth2/token`, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body
+    this.oauthRefresh ??= createOAuth2Refresher({
+      endpoint: `${acct.baseUrl}/login/oauth2/token`,
+      refreshToken: acct.refreshToken,
+      params: { client_id: acct.clientId, client_secret: acct.clientSecret }
     });
-    if (!res.ok) {
-      const errBody = await res.text();
-      throw new TokenExpiredError(
-        "oauth",
-        `${res.status} ${res.statusText}: ${truncateErrorMessage(errBody, 200)}`
-      );
+    let accessToken;
+    let expiresIn;
+    try {
+      const result = await this.oauthRefresh();
+      accessToken = result.accessToken;
+      expiresIn = result.expiresIn ?? 3600;
+    } catch (e) {
+      throw new TokenExpiredError("oauth", e.message);
     }
-    const data = await res.json();
-    const expiresIn = data.expires_in ?? 3600;
     return {
-      headers: { Authorization: `Bearer ${data.access_token}` },
+      headers: { Authorization: `Bearer ${accessToken}` },
       accessTokenExpiresAt: Date.now() + (expiresIn - 60) * 1e3
     };
   }
@@ -38631,16 +38990,7 @@ var FileExistsError = class extends Error {
 // src/tools/_shared.ts
 var textContent = textResult;
 function buildPath(base, params = {}) {
-  const parts = [];
-  for (const [key, value] of Object.entries(params)) {
-    if (value === void 0 || value === null) continue;
-    if (Array.isArray(value)) {
-      for (const v of value) parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(v))}`);
-    } else {
-      parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
-    }
-  }
-  return parts.length ? `${base}?${parts.join("&")}` : base;
+  return `${base}${buildQueryString(params)}`;
 }
 function userSegment(observeeId) {
   return observeeId ? `users/${encodeURIComponent(observeeId)}` : "users/self";
@@ -39005,7 +39355,7 @@ try {
 }
 await runMcp({
   name: "canvas",
-  version: "1.1.6",
+  version: "1.1.8",
   // x-release-please-version
   tools: [
     (server) => {

package/dist/client.js

@@ -1,6 +1,6 @@
 import { writeFile, stat } from 'fs/promises';
 import { dirname } from 'path';
-import { parseLinkHeader, truncateErrorMessage } from '@chrischall/mcp-utils';
+import { createOAuth2Refresher, parseLinkHeader } from '@chrischall/mcp-utils';
 import { CookieSessionManager } from '@chrischall/mcp-utils/session';
 import { sessionLogin as defaultSessionLogin } from './session-login.js';
 // Re-export the fleet-shared RFC 5988 Link parser so existing importers
@@ -15,6 +15,8 @@ export class CanvasClient {
     sessionLoginFn;
     preloadedCookie;
     auth;
+    /** Lazily-built shared refresh_token exchanger (oauth mode only). */
+    oauthRefresh = null;
     /**
      * `preloaded` is the fetchproxy escape hatch: when set, the client uses
      * the supplied cookie header as-if it had just successfully run
@@ -187,30 +189,35 @@ export class CanvasClient {
         });
         return result.cookie;
     }
+    /**
+     * Exchange the refresh token for a fresh access token via the fleet-shared
+     * `createOAuth2Refresher` (which owns the form-encoded POST, the single-
+     * in-flight guard, and the redact-then-truncate sanitizing of upstream error
+     * bodies — so if Canvas's /login/oauth2/token error echoes the client_secret
+     * or refresh_token, it never reaches the client-facing error). Canvas-specific
+     * bits stay here: the TokenExpiredError('oauth') wrapper and the 60s
+     * proactive-expiry skew baked into `accessTokenExpiresAt`.
+     */
     async refreshAccessToken(acct) {
-        const body = new URLSearchParams({
-            grant_type: 'refresh_token',
-            client_id: acct.clientId,
-            client_secret: acct.clientSecret,
-            refresh_token: acct.refreshToken,
-        }).toString();
-        const res = await fetch(`${acct.baseUrl}/login/oauth2/token`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body,
+        this.oauthRefresh ??= createOAuth2Refresher({
+            endpoint: `${acct.baseUrl}/login/oauth2/token`,
+            refreshToken: acct.refreshToken,
+            params: { client_id: acct.clientId, client_secret: acct.clientSecret },
         });
-        if (!res.ok) {
-            // Run the upstream body through the fleet-shared sanitizer: it redacts
-            // `Bearer <token>` headers and JWTs FIRST, then truncates — so if Canvas's
-            // /login/oauth2/token error echoes the client_secret or refresh_token, it
-            // never reaches the client-facing error (audit HIGH finding).
-            const errBody = await res.text();
-            throw new TokenExpiredError('oauth', `${res.status} ${res.statusText}: ${truncateErrorMessage(errBody, 200)}`);
+        let accessToken;
+        let expiresIn;
+        try {
+            const result = await this.oauthRefresh();
+            accessToken = result.accessToken;
+            expiresIn = result.expiresIn ?? 3600;
+        }
+        catch (e) {
+            // The refresher always throws Error (McpToolError) with a pre-redacted,
+            // pre-truncated message — safe to embed as the TokenExpiredError detail.
+            throw new TokenExpiredError('oauth', e.message);
         }
-        const data = await res.json();
-        const expiresIn = data.expires_in ?? 3600;
         return {
-            headers: { Authorization: `Bearer ${data.access_token}` },
+            headers: { Authorization: `Bearer ${accessToken}` },
             accessTokenExpiresAt: Date.now() + (expiresIn - 60) * 1000,
         };
     }

package/dist/index.js

@@ -46,7 +46,7 @@ catch (e) {
 // host's install-time `tools/list` succeeds.
 await runMcp({
     name: 'canvas',
-    version: '1.1.6', // x-release-please-version
+    version: '1.1.8', // x-release-please-version
     tools: [
         (server) => {
             if (resolved) {

package/dist/session-login.js

@@ -10,6 +10,12 @@
 // place of an OAuth bearer token; on a 401 the manager re-invokes sessionLogin
 // to mint a fresh jar. pseudonym_credentials is the "remember me" cookie with a
 // meaningful expiry (~14 days); canvas_session piggybacks on it.
+//
+// Cookie parsing/serialization is the fleet-shared `CookieJar` /
+// `parseCookieJar` from `@chrischall/mcp-utils` (same attribute-stripping
+// `name=value; …` semantics the hand-rolled helpers here used to implement,
+// plus deletion-marker handling).
+import { CookieJar, parseCookieJar } from '@chrischall/mcp-utils';
 const USER_AGENT = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 ' +
     '(KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36';
 export class SessionLoginError extends Error {
@@ -30,31 +36,13 @@ export function extractAuthenticityToken(html) {
     }
     return null;
 }
-export function parseSetCookie(setCookieValue) {
-    const semi = setCookieValue.indexOf(';');
-    const nameValue = semi === -1 ? setCookieValue : setCookieValue.slice(0, semi);
-    const eq = nameValue.indexOf('=');
-    if (eq === -1)
-        return null;
-    const name = nameValue.slice(0, eq).trim();
-    const value = nameValue.slice(eq + 1).trim();
-    if (!name)
-        return null;
-    return { name, value };
-}
-export function serializeCookies(cookies) {
-    return cookies.map((c) => `${c.name}=${c.value}`).join('; ');
-}
-function collectSetCookies(headers) {
-    const out = [];
-    // Node 18+: Headers.getSetCookie() returns each Set-Cookie as a separate string.
-    for (const sc of headers.getSetCookie()) {
-        const parsed = parseSetCookie(sc);
-        if (parsed)
-            out.push(parsed);
-    }
-    return out;
-}
+/** The cookies that actually authenticate Canvas API calls. */
+const SESSION_COOKIE_NAMES = [
+    'canvas_session',
+    'pseudonym_credentials',
+    '_csrf_token',
+    'log_session_id',
+];
 export async function sessionLogin(opts) {
     const baseUrl = opts.baseUrl.replace(/\/$/, '');
     const loginUrl = `${baseUrl}/login/canvas`;
@@ -69,7 +57,8 @@ export async function sessionLogin(opts) {
         throw new SessionLoginError(`Login page fetch failed: ${getRes.status} ${getRes.statusText}`);
     }
     const html = await getRes.text();
-    const initialCookies = collectSetCookies(getRes.headers);
+    const jar = new CookieJar();
+    jar.absorb(getRes.headers);
     const authToken = extractAuthenticityToken(html);
     if (!authToken) {
         throw new SessionLoginError("Could not find authenticity_token on the login page. " +
@@ -93,7 +82,7 @@ export async function sessionLogin(opts) {
             'Content-Type': 'application/x-www-form-urlencoded',
             Accept: 'text/html,application/xhtml+xml',
             'User-Agent': USER_AGENT,
-            Cookie: serializeCookies(initialCookies),
+            Cookie: jar.header(),
             Origin: baseUrl,
             Referer: loginUrl,
         },
@@ -102,8 +91,8 @@ export async function sessionLogin(opts) {
     // 3. Verify success by looking for the pseudonym_credentials cookie. Canvas sets it
     //    only when authentication actually succeeded; a failed login returns a fresh
     //    csrf token but no credentials cookie.
-    const respCookies = collectSetCookies(postRes.headers);
-    const hasCreds = respCookies.some((c) => c.name === 'pseudonym_credentials');
+    const respJar = parseCookieJar(postRes.headers.getSetCookie());
+    const hasCreds = 'pseudonym_credentials' in respJar.cookies;
     if (!hasCreds) {
         const location = postRes.headers.get('location') ?? '';
         if (location && !location.startsWith(baseUrl) && !location.includes('sso.canvaslms.com')) {
@@ -114,7 +103,10 @@ export async function sessionLogin(opts) {
             'incorrect username or password, or the account is locked.');
     }
     // Filter to the cookies that actually authenticate API calls. Path/Secure/HttpOnly
-    // attributes are stripped during parseSetCookie, so we just join name=value pairs.
-    const sessionCookies = respCookies.filter((c) => ['canvas_session', 'pseudonym_credentials', '_csrf_token', 'log_session_id'].includes(c.name));
-    return { cookie: serializeCookies(sessionCookies) };
+    // attributes are stripped by parseCookieJar, so we just join name=value pairs.
+    const cookie = Object.entries(respJar.cookies)
+        .filter(([name]) => SESSION_COOKIE_NAMES.includes(name))
+        .map(([name, value]) => `${name}=${value}`)
+        .join('; ');
+    return { cookie };
 }

package/dist/tools/_shared.js

@@ -1,4 +1,4 @@
-import { textResult } from '@chrischall/mcp-utils';
+import { buildQueryString, textResult } from '@chrischall/mcp-utils';
 /**
  * Wrap a value as an MCP text content block — the standard tool return shape.
  * Backed by the fleet-shared `textResult` from `@chrischall/mcp-utils` (same
@@ -19,19 +19,7 @@ export function toArray(value) {
     return Array.isArray(value) ? value : [value];
 }
 export function buildPath(base, params = {}) {
-    const parts = [];
-    for (const [key, value] of Object.entries(params)) {
-        if (value === undefined || value === null)
-            continue;
-        if (Array.isArray(value)) {
-            for (const v of value)
-                parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(v))}`);
-        }
-        else {
-            parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
-        }
-    }
-    return parts.length ? `${base}?${parts.join('&')}` : base;
+    return `${base}${buildQueryString(params)}`;
 }
 /** Compute the user path segment: 'users/self' or 'users/{id}'. */
 export function userSegment(observeeId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canvas-parent-mcp",
-  "version": "1.1.6",
+  "version": "1.1.8",
   "mcpName": "io.github.chrischall/canvas-parent-mcp",
   "description": "Canvas LMS (Instructure) MCP server — student/observer read access with optional file download",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -44,7 +44,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.8.0",
+    "@chrischall/mcp-utils": "^0.12.0",
     "@fetchproxy/bootstrap": "^1.0.0",
     "@fetchproxy/server": "^1.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -52,7 +52,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.7",
     "esbuild": "^0.28.0",
     "typescript": "^6.0.3",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/canvas-parent-mcp",
     "source": "github"
   },
-  "version": "1.1.6",
+  "version": "1.1.8",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "canvas-parent-mcp",
-      "version": "1.1.6",
+      "version": "1.1.8",
       "transport": {
         "type": "stdio"
       },