canvas-parent-mcp 1.2.0 → 1.2.3

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "1.2.0"
+    "version": "1.2.3"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "1.2.0",
+      "version": "1.2.3",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "1.2.0",
+  "version": "1.2.3",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/dist/auth.js

@@ -54,7 +54,7 @@
 //   - `@fetchproxy/bootstrap` is mocked at the module boundary in tests.
 //   - `loadAccount()` (the existing env-var resolver) is reused as-is so
 //     the legacy paths keep working unchanged.
-import { bootstrap } from '@fetchproxy/bootstrap';
+import { createSessionLifter } from '@fetchproxy/bootstrap';
 import { classifyBridgeError } from '@fetchproxy/server';
 import { readEnvVar } from '@chrischall/mcp-utils';
 import { loadAccount } from './config.js';
@@ -98,6 +98,12 @@ export async function resolveAuth() {
         }
     }
     // ── Path 4: fetchproxy fallback.
+    //
+    // NOTE: the browser is NOT read here. resolveAuth() runs once at process
+    // start; the lift is handed to the client as `refresh` and runs lazily on
+    // the first request and again on every 401. A cookie captured at boot made
+    // a 401 terminal — the account has empty creds, so there was nothing to
+    // re-mint with and only a restart recovered.
     if (!fetchproxyDisabled()) {
         // CANVAS_BASE_URL is guaranteed valid here — loadAccount() validates it
         // before throwing the NO_ENV_CONFIG_MARKER error we caught above.
@@ -113,60 +119,22 @@ export async function resolveAuth() {
             : baseHost;
         const name = readEnv('CANVAS_NAME') ?? baseHost;
         const cleanBaseUrl = baseUrl.replace(/\/$/, '');
-        try {
-            const session = await bootstrap({
-                serverName: pkg.name,
-                version: pkg.version,
-                domains: [declaredDomain],
-                declare: {
-                    cookies: ['canvas_session', 'pseudonym_credentials'],
-                    localStorage: [],
-                    sessionStorage: [],
-                    captureHeaders: [],
-                },
-            });
-            const canvasSession = session.cookies['canvas_session'];
-            const pseudoCreds = session.cookies['pseudonym_credentials'];
-            if (!canvasSession || !pseudoCreds) {
-                throw new Error(`required cookies not found on ${baseHost}. ` +
-                    'Sign into your Canvas instance in the browser ' +
-                    '(with the fetchproxy extension installed) and retry.');
-            }
-            const cookie = `canvas_session=${canvasSession}; pseudonym_credentials=${pseudoCreds}`;
-            // Synthesize a session account with empty creds — the client will see
-            // `preloaded` and skip the form login. This mirrors the cookie shape
-            // the legacy session-scrape path produces, so everything downstream
-            // (Cookie header, 401-retry, file downloads) keeps working.
-            const account = {
-                mode: 'session',
-                name,
-                baseUrl: cleanBaseUrl,
-                username: '',
-                password: '',
-            };
-            return {
-                account,
-                preloaded: { cookie },
-                source: 'fetchproxy',
-            };
-        }
-        catch (e) {
-            // 0.8.0+ typed-error discrimination. The fetchproxy server already
-            // retries once on SW eviction (bridgeReviveDelayMs=2000 default), so
-            // a thrown FetchproxyBridgeDownError means the retry also failed —
-            // the extension's service worker is genuinely down and the user
-            // needs to wake it. The `.hint` is the actionable copy
-            // ("click the extension toolbar icon...") that we'd otherwise have
-            // to hand-write here. Surface it verbatim so users in path 4 get
-            // the same self-service guidance as path 5.
-            if (classifyBridgeError(e) === 'bridge_down') {
-                const downErr = e;
-                throw new Error(`Canvas auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`);
-            }
-            const msg = e instanceof Error ? e.message : String(e);
-            throw new Error(`Canvas auth: no CANVAS_TOKEN, CANVAS_CLIENT_*/CANVAS_REFRESH_TOKEN, or CANVAS_USERNAME/CANVAS_PASSWORD set, ` +
-                `and fetchproxy fallback failed: ${msg}`);
-        }
+        // Synthesized session account with empty creds — the client sees `refresh`
+        // and skips the form login. Cookie shape matches the legacy session-scrape
+        // path so everything downstream (Cookie header, 401 replay, downloads)
+        // keeps working.
+        const account = {
+            mode: 'session',
+            name,
+            baseUrl: cleanBaseUrl,
+            username: '',
+            password: '',
+        };
+        return {
+            account,
+            refresh: () => liftBrowserCookie(declaredDomain, baseHost),
+            source: 'fetchproxy',
+        };
     }
     // ── Path 5: nothing configured and fetchproxy explicitly disabled.
     throw new Error('Missing Canvas auth config. Set one of: CANVAS_TOKEN (personal access token), ' +
@@ -175,3 +143,64 @@ export async function resolveAuth() {
         'or install the fetchproxy extension and sign into your Canvas instance ' +
         '(unset CANVAS_DISABLE_FETCHPROXY if it is set).');
 }
+/**
+ * One lifter per declared domain, built lazily and reused.
+ *
+ * The scope is not static — self-hosted Canvas declares its literal hostname
+ * while *.instructure.com tenants share one wildcard — so the lifter cannot be
+ * a module-level constant. Caching is load-bearing rather than an
+ * optimization: `createSessionLifter` single-flights concurrent calls, and
+ * that only helps if renewals share ONE lifter instead of constructing a fresh
+ * one per call.
+ */
+const liftersByDomain = new Map();
+function lifterFor(declaredDomain) {
+    let lift = liftersByDomain.get(declaredDomain);
+    if (!lift) {
+        lift = createSessionLifter({
+            serverName: pkg.name,
+            version: pkg.version,
+            domains: [declaredDomain],
+            declare: {
+                cookies: ['canvas_session', 'pseudonym_credentials'],
+                localStorage: [],
+                sessionStorage: [],
+                captureHeaders: [],
+            },
+        });
+        liftersByDomain.set(declaredDomain, lift);
+    }
+    return lift;
+}
+/**
+ * Lift a fresh Canvas session cookie out of the user's signed-in tab.
+ *
+ * Runs on every mint, not once at startup — fetchproxy is not in the request
+ * hot path, only the renewal path.
+ */
+async function liftBrowserCookie(declaredDomain, baseHost) {
+    try {
+        const session = await lifterFor(declaredDomain)();
+        const canvasSession = session.cookies['canvas_session'];
+        const pseudoCreds = session.cookies['pseudonym_credentials'];
+        if (!canvasSession || !pseudoCreds) {
+            throw new Error(`required cookies not found on ${baseHost}. ` +
+                'Sign into your Canvas instance in the browser ' +
+                '(with the fetchproxy extension installed) and retry.');
+        }
+        return `canvas_session=${canvasSession}; pseudonym_credentials=${pseudoCreds}`;
+    }
+    catch (e) {
+        // 0.8.0+ typed-error discrimination. The fetchproxy server already retries
+        // once on SW eviction, so a thrown FetchproxyBridgeDownError means the
+        // retry also failed — the extension's service worker is genuinely down and
+        // the user needs to wake it. `.hint` is the actionable copy.
+        if (classifyBridgeError(e) === 'bridge_down') {
+            const downErr = e;
+            throw new Error(`Canvas auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`);
+        }
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new Error(`Canvas auth: no CANVAS_TOKEN, CANVAS_CLIENT_*/CANVAS_REFRESH_TOKEN, or CANVAS_USERNAME/CANVAS_PASSWORD set, ` +
+            `and fetchproxy lift failed: ${msg}`);
+    }
+}

package/dist/bundle.js

@@ -3776,6 +3776,7 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
+    var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -3805,6 +3806,11 @@ var require_fast_uri = __commonJS({
           uri = "//" + uri;
         }
       }
+      const authorityMatch = uri.match(AUTHORITY_PREFIX);
+      if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+        parsed.error = "URI authority must not contain a literal backslash.";
+        malformedAuthorityOrPort = true;
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
         parsed.scheme = matches[1];
@@ -3848,7 +3854,7 @@ var require_fast_uri = __commonJS({
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
           if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
               parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
             }
@@ -7693,6 +7699,7 @@ var require_receiver = __commonJS({
         this._opcode = 0;
         this._totalPayloadLength = 0;
         this._messageLength = 0;
+        this._numFragments = 0;
         this._fragments = [];
         this._errored = false;
         this._loop = false;
@@ -8043,23 +8050,23 @@ var require_receiver = __commonJS({
           this.controlMessage(data, cb);
           return;
         }
+        if (this._maxFragments > 0 && ++this._numFragments > this._maxFragments) {
+          const error51 = this.createError(
+            RangeError,
+            "Too many message fragments",
+            false,
+            1008,
+            "WS_ERR_TOO_MANY_BUFFERED_PARTS"
+          );
+          cb(error51);
+          return;
+        }
         if (this._compressed) {
           this._state = INFLATING;
           this.decompress(data, cb);
           return;
         }
         if (data.length) {
-          if (this._maxFragments > 0 && this._fragments.length >= this._maxFragments) {
-            const error51 = this.createError(
-              RangeError,
-              "Too many message fragments",
-              false,
-              1008,
-              "WS_ERR_TOO_MANY_BUFFERED_PARTS"
-            );
-            cb(error51);
-            return;
-          }
           this._messageLength = this._totalPayloadLength;
           this._fragments.push(data);
         }
@@ -8089,17 +8096,6 @@ var require_receiver = __commonJS({
               cb(error51);
               return;
             }
-            if (this._maxFragments > 0 && this._fragments.length >= this._maxFragments) {
-              const error51 = this.createError(
-                RangeError,
-                "Too many message fragments",
-                false,
-                1008,
-                "WS_ERR_TOO_MANY_BUFFERED_PARTS"
-              );
-              cb(error51);
-              return;
-            }
             this._fragments.push(buf);
           }
           this.dataMessage(cb);
@@ -8122,6 +8118,7 @@ var require_receiver = __commonJS({
         this._totalPayloadLength = 0;
         this._messageLength = 0;
         this._fragmented = 0;
+        this._numFragments = 0;
         this._fragments = [];
         if (this._opcode === 2) {
           let data;
@@ -9622,8 +9619,8 @@ var require_websocket = __commonJS({
         autoPong: true,
         closeTimeout: CLOSE_TIMEOUT,
         protocolVersion: protocolVersions[1],
-        maxBufferedChunks: 1024 * 1024,
-        maxFragments: 128 * 1024,
+        maxBufferedChunks: 256 * 1024,
+        maxFragments: 16 * 1024,
         maxPayload: 100 * 1024 * 1024,
         skipUTF8Validation: false,
         perMessageDeflate: true,
@@ -10210,9 +10207,9 @@ var require_websocket_server = __commonJS({
        *     called
        * @param {Function} [options.handleProtocols] A hook to handle protocols
        * @param {String} [options.host] The hostname where to bind the server
-       * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+       * @param {Number} [options.maxBufferedChunks=262144] The maximum number of
        *     buffered data chunks
-       * @param {Number} [options.maxFragments=131072] The maximum number of message
+       * @param {Number} [options.maxFragments=16384] The maximum number of message
        *     fragments
        * @param {Number} [options.maxPayload=104857600] The maximum allowed message
        *     size
@@ -10235,8 +10232,8 @@ var require_websocket_server = __commonJS({
         options = {
           allowSynchronousEvents: true,
           autoPong: true,
-          maxBufferedChunks: 1024 * 1024,
-          maxFragments: 128 * 1024,
+          maxBufferedChunks: 256 * 1024,
+          maxFragments: 16 * 1024,
           maxPayload: 100 * 1024 * 1024,
           skipUTF8Validation: false,
           perMessageDeflate: false,
@@ -26732,17 +26729,33 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error51) {
   if (error51 && typeof error51 === "object") {
+    if ("issues" in error51 && Array.isArray(error51.issues) && error51.issues.length > 0) {
+      return error51.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join("\n");
+    }
     if ("message" in error51 && typeof error51.message === "string") {
       return error51.message;
     }
-    if ("issues" in error51 && Array.isArray(error51.issues) && error51.issues.length > 0) {
-      const firstIssue = error51.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error51);
     } catch {
@@ -33357,16 +33370,7 @@ var Server = class extends Protocol {
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
     }
-    let methodValue;
-    if (isZ4Schema(methodSchema)) {
-      const v4Schema = methodSchema;
-      const v4Def = v4Schema._zod?.def;
-      methodValue = v4Def?.value ?? v4Schema.value;
-    } else {
-      const v3Schema = methodSchema;
-      const legacyDef = v3Schema._def;
-      methodValue = legacyDef?.value ?? v3Schema.value;
-    }
+    const methodValue = getLiteralValue(methodSchema);
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
@@ -34554,8 +34558,17 @@ var EMPTY_COMPLETION_RESULT = {
 import process3 from "node:process";
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk2) {
+    const newSize = (this._buffer?.length ?? 0) + chunk2.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk2]) : chunk2;
   }
   readMessage() {
@@ -34583,18 +34596,24 @@ function serializeMessage(message) {
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
-  constructor(_stdin = process3.stdin, _stdout = process3.stdout) {
+  constructor(_stdin = process3.stdin, _stdout = process3.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer();
     this._started = false;
     this._ondata = (chunk2) => {
-      this._readBuffer.append(chunk2);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk2);
+        this.processReadBuffer();
+      } catch (error51) {
+        this.onerror?.(error51);
+        this.close().catch(() => {
+        });
+      }
     };
     this._onerror = (error51) => {
       this.onerror?.(error51);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   /**
    * Starts listening for messages on stdin.
@@ -34990,7 +35009,8 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "capture_redirect",
   "read_indexed_db",
   "read_dom",
-  "download"
+  "download",
+  "graphql"
 ]);
 
 // node_modules/@fetchproxy/protocol/dist/mcp-id.js
@@ -35293,6 +35313,7 @@ function assertIndexedDbScopesArray(value, label) {
 }
 var DOM_SELECTOR_RE = /^[^-]{1,512}$/;
 var DOM_ATTRIBUTE_RE = /^[A-Za-z_:][A-Za-z0-9_:.\-]{0,127}$/;
+var GRAPHQL_OP_NAME_RE = /^[_A-Za-z][_0-9A-Za-z]{0,127}$/;
 function assertDomSelectorsArray(value, label) {
   if (!Array.isArray(value)) {
     throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
@@ -35329,6 +35350,37 @@ function assertDomSelectorsArray(value, label) {
     }
   }
 }
+function assertGraphqlOpsArray(value, label) {
+  if (!Array.isArray(value)) {
+    throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < value.length; i++) {
+    const entry = value[i];
+    assertObject(entry, `${label}[${i}]`);
+    if (entry.name === void 0) {
+      throw new ProtocolError(`${label}[${i}].name: missing`);
+    }
+    if (entry.operationName === void 0) {
+      throw new ProtocolError(`${label}[${i}].operationName: missing`);
+    }
+    if (typeof entry.name !== "string" || !SCOPE_KEY_RE.test(entry.name)) {
+      throw new ProtocolError(`${label}[${i}].name: invalid ${JSON.stringify(entry.name)}`);
+    }
+    if (typeof entry.operationName !== "string" || !GRAPHQL_OP_NAME_RE.test(entry.operationName)) {
+      throw new ProtocolError(`${label}[${i}].operationName: invalid ${JSON.stringify(entry.operationName)}`);
+    }
+    if (seen.has(entry.name)) {
+      throw new ProtocolError(`${label}: duplicate name ${JSON.stringify(entry.name)}`);
+    }
+    seen.add(entry.name);
+    for (const k of Object.keys(entry)) {
+      if (k !== "name" && k !== "operationName") {
+        throw new ProtocolError(`${label}[${i}]: unexpected field ${JSON.stringify(k)}`);
+      }
+    }
+  }
+}
 function validateFrame(raw) {
   assertObject(raw, "frame");
   const t = raw.type;
@@ -35407,6 +35459,9 @@ function validateHello(raw) {
     if (raw.domSelectors !== void 0) {
       assertDomSelectorsArray(raw.domSelectors, "hello.domSelectors");
     }
+    if (raw.graphqlOps !== void 0) {
+      assertGraphqlOpsArray(raw.graphqlOps, "hello.graphqlOps");
+    }
     assertBase64(raw.identityX25519Pub, "hello.identityX25519Pub");
     assertBase64(raw.identityEd25519Pub, "hello.identityEd25519Pub");
     assertBase64(raw.sessionNonce, "hello.sessionNonce");
@@ -35656,6 +35711,28 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
+  if (raw.op === "graphql_query") {
+    assertObject(raw.init, "inner.init");
+    if (raw.init.name === void 0)
+      throw new ProtocolError("inner.init.name: missing");
+    if (raw.init.variables === void 0) {
+      throw new ProtocolError("inner.init.variables: missing");
+    }
+    assertString(raw.init.name, "inner.init.name");
+    if (raw.init.name.length === 0) {
+      throw new ProtocolError("inner.init.name: must be non-empty");
+    }
+    assertObject(raw.init.variables, "inner.init.variables");
+    if (raw.init.tabUrl !== void 0) {
+      assertString(raw.init.tabUrl, "inner.init.tabUrl");
+    }
+    for (const k of Object.keys(raw.init)) {
+      if (k !== "name" && k !== "variables" && k !== "tabUrl") {
+        throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on graphql_query`);
+      }
+    }
+    return raw;
+  }
   if (raw.op === "download") {
     assertObject(raw.init, "inner.init");
     if (raw.init.url === void 0) {
@@ -35681,7 +35758,7 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
-  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download"; got ${JSON.stringify(raw.op)}`);
+  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download", "graphql_query"; got ${JSON.stringify(raw.op)}`);
 }
 function assertNonEmptyKeyArray(value, label) {
   if (!Array.isArray(value)) {
@@ -35712,6 +35789,10 @@ function assertStringMap(value, label) {
     }
   }
 }
+var KNOWN_RESPONSE_OPS = /* @__PURE__ */ new Set([
+  ...KNOWN_CAPABILITIES,
+  "graphql_query"
+]);
 function validateInnerResponse(raw) {
   assertPositiveInt(raw.id, "inner.id");
   if (raw.ok === true) {
@@ -35773,6 +35854,13 @@ function validateInnerResponse(raw) {
       assertStringMap(raw.values, "inner.values");
       return raw;
     }
+    if (op === "graphql_query") {
+      if (raw.data === void 0) {
+        throw new ProtocolError("inner.data: missing on graphql_query response");
+      }
+      assertObject(raw.data, "inner.data");
+      return raw;
+    }
     if (op === "download") {
       assertObject(raw.value, "inner.value");
       assertString(raw.value.path, "inner.value.path");
@@ -35797,7 +35885,7 @@ function validateInnerResponse(raw) {
   if (raw.ok === false) {
     assertString(raw.error, "inner.error");
     if (raw.op !== void 0) {
-      if (typeof raw.op !== "string" || !KNOWN_CAPABILITIES.has(raw.op)) {
+      if (typeof raw.op !== "string" || !KNOWN_RESPONSE_OPS.has(raw.op)) {
         throw new ProtocolError(`inner.op: unknown response op ${JSON.stringify(raw.op)}`);
       }
     }
@@ -35989,11 +36077,33 @@ async function sealInnerFrame(sessionKey, mcpId, seq, inner) {
   };
 }
 async function openEncryptedFrame(sessionKey, frame) {
-  const iv = fromB64(frame.iv);
-  const ct = fromB64(frame.ciphertext);
-  const pt = await aesGcmOpen(sessionKey, iv, ct);
-  const parsed = JSON.parse(dec.decode(pt));
-  return validateInnerFrame(parsed);
+  const result = await openEncryptedFrameDetailed(sessionKey, frame);
+  if (result.stage === "ok")
+    return result.inner;
+  throw result.error instanceof Error ? result.error : new Error(String(result.error));
+}
+async function openEncryptedFrameDetailed(sessionKey, frame) {
+  let pt;
+  try {
+    const iv = fromB64(frame.iv);
+    const ct = fromB64(frame.ciphertext);
+    pt = await aesGcmOpen(sessionKey, iv, ct);
+  } catch (error51) {
+    return { stage: "decrypt-failed", error: error51 };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(dec.decode(pt));
+  } catch (error51) {
+    return { stage: "validation-failed", error: error51, recoveredId: void 0 };
+  }
+  try {
+    const inner = validateInnerFrame(parsed);
+    return { stage: "ok", inner };
+  } catch (error51) {
+    const recoveredId = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && typeof parsed.id === "number" && Number.isInteger(parsed.id) && parsed.id > 0 ? parsed.id : void 0;
+    return { stage: "validation-failed", error: error51, recoveredId };
+  }
 }
 
 // node_modules/@fetchproxy/server/dist/election.js
@@ -36119,6 +36229,12 @@ async function buildServerHello(opts) {
       ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
     }));
   }
+  if (opts.graphqlOps && opts.graphqlOps.length > 0) {
+    hello.graphqlOps = opts.graphqlOps.map((d) => ({
+      name: d.name,
+      operationName: d.operationName
+    }));
+  }
   return hello;
 }
 
@@ -36209,7 +36325,8 @@ async function startHost(opts) {
     indexedDbScopes: opts.ownIndexedDbScopes,
     localStoragePointers: opts.ownLocalStoragePointers,
     sessionStoragePointers: opts.ownSessionStoragePointers,
-    domSelectors: opts.ownDomSelectors
+    domSelectors: opts.ownDomSelectors,
+    graphqlOps: opts.ownGraphqlOps
   });
   const ownSessionNonce = fromB64(ownHello.sessionNonce);
   let extensionWs = null;
@@ -36446,7 +36563,8 @@ async function startPeer(opts) {
     indexedDbScopes: opts.indexedDbScopes,
     domSelectors: opts.domSelectors,
     localStoragePointers: opts.localStoragePointers,
-    sessionStoragePointers: opts.sessionStoragePointers
+    sessionStoragePointers: opts.sessionStoragePointers,
+    graphqlOps: opts.graphqlOps
   });
   const sessionNonce = fromB64(hello.sessionNonce);
   ws.send(JSON.stringify(hello));
@@ -36490,10 +36608,20 @@ async function startPeer(opts) {
           return;
         if (!session.acceptInboundSeq(frame.seq))
           return;
-        try {
-          const inner = await openEncryptedFrame(session.sessionKey, frame);
-          innerListeners.forEach((cb) => cb(inner));
-        } catch {
+        const result = await openEncryptedFrameDetailed(session.sessionKey, frame);
+        if (result.stage === "ok") {
+          innerListeners.forEach((cb) => cb(result.inner));
+        } else if (result.stage === "decrypt-failed") {
+        } else {
+          console.error("[fetchproxy] peer: received a frame that decrypted OK but failed validation:", result.error);
+          if (result.recoveredId !== void 0) {
+            innerListeners.forEach((cb) => cb({
+              type: "response",
+              id: result.recoveredId,
+              ok: false,
+              error: `malformed response failed protocol validation: ${String(result.error)}`
+            }));
+          }
         }
       }
     } catch (e) {
@@ -36770,6 +36898,10 @@ var FetchproxyServer = class {
   pendingIdb = /* @__PURE__ */ new Map();
   // download awaiters resolve the saved-file metadata (path + size + mime).
   pendingDownload = /* @__PURE__ */ new Map();
+  // 1.x+: graphql_query awaiters resolve the GraphQL `data` object. Its
+  // shape is operation-specific, so the awaiter resolves `unknown` and the
+  // caller narrows.
+  pendingGraphql = /* @__PURE__ */ new Map();
   mcpId = null;
   identity = null;
   // 0.5.3+: in-flight role-election / handle-start promise. Set the
@@ -36857,6 +36989,10 @@ var FetchproxyServer = class {
         selector: d.selector,
         ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
       })),
+      graphqlOps: (opts.graphqlOps ?? []).map((d) => ({
+        name: d.name,
+        operationName: d.operationName
+      })),
       // 0.8.0+: timer + lazy-revive default to ON. Every realty MCP
       // adapter was about to set these to the same numbers anyway; the
       // back-door is `0` (explicit opt-out) if a caller genuinely wants
@@ -36978,6 +37114,7 @@ var FetchproxyServer = class {
         ownLocalStoragePointers: this.opts.localStoragePointers,
         ownSessionStoragePointers: this.opts.sessionStoragePointers,
         ownDomSelectors: this.opts.domSelectors,
+        ownGraphqlOps: this.opts.graphqlOps,
         onPairCode: this.opts.onPairCode
       });
       this.hostHandle.onOwnInner((inner) => this.onInner(inner));
@@ -37006,7 +37143,8 @@ var FetchproxyServer = class {
         indexedDbScopes: this.opts.indexedDbScopes,
         localStoragePointers: this.opts.localStoragePointers,
         sessionStoragePointers: this.opts.sessionStoragePointers,
-        domSelectors: this.opts.domSelectors
+        domSelectors: this.opts.domSelectors,
+        graphqlOps: this.opts.graphqlOps
       });
       this.peerHandle.onInner((inner) => this.onInner(inner));
       this.peerHandle.onRenegotiate(() => {
@@ -37212,6 +37350,7 @@ var FetchproxyServer = class {
         this.pendingRedirect.delete(id);
         this.pendingDownload.delete(id);
         this.pendingIdb.delete(id);
+        this.pendingGraphql.delete(id);
       }
       throw err;
     }
@@ -38021,6 +38160,52 @@ var FetchproxyServer = class {
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
   }
+  /**
+   * 1.x+: run a declared GraphQL operation through the page's own Apollo
+   * client (`window.__APOLLO_CLIENT__`) in the signed-in tab's MAIN world.
+   * Requires `'graphql'` in capabilities AND `name` to match a declared
+   * `graphqlOps` entry. The extension resolves `name` → `operationName` →
+   * the live DocumentNode the page already observed, then invokes
+   * `client.query({ query, variables })` — the site's own request path, so
+   * per-request bot telemetry (Akamai etc.) runs automatically.
+   *
+   * Returns the GraphQL `data` object on success (shape is
+   * operation-specific; the caller narrows). Throws a plain `Error` on
+   * developer mistakes (undeclared capability, undeclared name) and a
+   * descriptive `Error` on the `ok:false` bridge path — which includes the
+   * typed "operation not yet observed on this tab" case (open the site's
+   * page and retry).
+   */
+  async graphqlQuery(opts) {
+    if (!this.opts.capabilities.includes("graphql")) {
+      throw new Error('FetchproxyServer.graphqlQuery(): MCP did not declare "graphql" in capabilities');
+    }
+    if (typeof opts.name !== "string" || opts.name.length === 0) {
+      throw new Error("FetchproxyServer.graphqlQuery: opts.name must be a non-empty string");
+    }
+    const declaredNames = this.opts.graphqlOps.map((d) => d.name);
+    if (!declaredNames.includes(opts.name)) {
+      throw new Error(`FetchproxyServer.graphqlQuery: operation ${JSON.stringify(opts.name)} not in declared graphqlOps [${declaredNames.map((n) => JSON.stringify(n)).join(", ")}]`);
+    }
+    await this.ensureConnected();
+    this.throwIfPendingPair();
+    const id = this.nextRequestId++;
+    const inner = {
+      type: "request",
+      id,
+      op: "graphql_query",
+      init: {
+        name: opts.name,
+        variables: opts.variables,
+        ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
+      }
+    };
+    const pending = new Promise((resolve, reject) => {
+      this.pendingGraphql.set(id, { resolve, reject });
+    });
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingGraphql, id, opts.name);
+  }
   assertScopeSubset(requested, declared, label) {
     const undeclared = undeclaredKeys(requested, declared);
     if (undeclared.length > 0) {
@@ -38158,6 +38343,20 @@ var FetchproxyServer = class {
       }
       return;
     }
+    const graphqlCb = this.pendingGraphql.get(inner.id);
+    if (graphqlCb) {
+      this.pendingGraphql.delete(inner.id);
+      if (inner.ok) {
+        if (inner.op === "graphql_query") {
+          graphqlCb.resolve(inner.data);
+        } else {
+          graphqlCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on graphql_query awaiter`));
+        }
+      } else {
+        graphqlCb.reject(new FetchproxyProtocolError(inner.error));
+      }
+      return;
+    }
     const cookiesCb = this.pendingReadCookies.get(inner.id);
     if (cookiesCb) {
       this.pendingReadCookies.delete(inner.id);
@@ -38209,6 +38408,9 @@ var FetchproxyServer = class {
     for (const { reject } of this.pendingDownload.values())
       reject(err);
     this.pendingDownload.clear();
+    for (const { reject } of this.pendingGraphql.values())
+      reject(err);
+    this.pendingGraphql.clear();
   }
   /**
    * 0.5.2+: read the current pair-pending pair code from whichever handle
@@ -38262,7 +38464,20 @@ var FetchproxyServer = class {
 
 // node_modules/@fetchproxy/bootstrap/dist/index.js
 var defaultFactory = (opts) => new FetchproxyServer(opts);
-async function bootstrap(opts) {
+function createSessionLifter(opts) {
+  let inFlight = null;
+  return () => {
+    if (inFlight)
+      return inFlight;
+    const p = runOneLift(opts).finally(() => {
+      if (inFlight === p)
+        inFlight = null;
+    });
+    inFlight = p;
+    return p;
+  };
+}
+async function runOneLift(opts) {
   const envVar = opts.serverName.toUpperCase().replace(/[^A-Z0-9]/g, "_").replace(/^_+/, "") + "_DISABLE_FETCHPROXY";
   const envVal = process.env[envVar];
   if (envVal !== void 0 && envVal !== "" && envVal !== "0" && envVal !== "false") {
@@ -38389,12 +38604,18 @@ async function bootstrap(opts) {
       });
       indexedDbBucket[`${d.database}/${d.store}`] = values;
     }
+    const absent = (declared, got) => declared.filter((k) => !(k in got));
     return {
       cookies,
       localStorage,
       sessionStorage,
       capturedHeaders,
-      indexedDb: indexedDbBucket
+      indexedDb: indexedDbBucket,
+      missing: {
+        cookies: absent(opts.declare.cookies, cookies),
+        localStorage: absent(opts.declare.localStorage, localStorage),
+        sessionStorage: absent(opts.declare.sessionStorage, sessionStorage)
+      }
     };
   } finally {
     try {
@@ -38499,7 +38720,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "1.2.0",
+  version: "1.2.3",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -38543,9 +38764,9 @@ var package_default = {
     "test:watch": "vitest"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.13.0",
-    "@fetchproxy/bootstrap": "^1.0.0",
-    "@fetchproxy/server": "^1.0.0",
+    "@chrischall/mcp-utils": "^0.14.0",
+    "@fetchproxy/bootstrap": "^1.9.1",
+    "@fetchproxy/server": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
     zod: "^4.4.3"
@@ -38584,54 +38805,65 @@ async function resolveAuth() {
     const declaredDomain = baseHost.endsWith(".instructure.com") ? "instructure.com" : baseHost;
     const name = readEnv("CANVAS_NAME") ?? baseHost;
     const cleanBaseUrl = baseUrl.replace(/\/$/, "");
-    try {
-      const session = await bootstrap({
-        serverName: package_default.name,
-        version: package_default.version,
-        domains: [declaredDomain],
-        declare: {
-          cookies: ["canvas_session", "pseudonym_credentials"],
-          localStorage: [],
-          sessionStorage: [],
-          captureHeaders: []
-        }
-      });
-      const canvasSession = session.cookies["canvas_session"];
-      const pseudoCreds = session.cookies["pseudonym_credentials"];
-      if (!canvasSession || !pseudoCreds) {
-        throw new Error(
-          `required cookies not found on ${baseHost}. Sign into your Canvas instance in the browser (with the fetchproxy extension installed) and retry.`
-        );
-      }
-      const cookie = `canvas_session=${canvasSession}; pseudonym_credentials=${pseudoCreds}`;
-      const account = {
-        mode: "session",
-        name,
-        baseUrl: cleanBaseUrl,
-        username: "",
-        password: ""
-      };
-      return {
-        account,
-        preloaded: { cookie },
-        source: "fetchproxy"
-      };
-    } catch (e) {
-      if (classifyBridgeError(e) === "bridge_down") {
-        const downErr = e;
-        throw new Error(
-          `Canvas auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`
-        );
+    const account = {
+      mode: "session",
+      name,
+      baseUrl: cleanBaseUrl,
+      username: "",
+      password: ""
+    };
+    return {
+      account,
+      refresh: () => liftBrowserCookie(declaredDomain, baseHost),
+      source: "fetchproxy"
+    };
+  }
+  throw new Error(
+    "Missing Canvas auth config. Set one of: CANVAS_TOKEN (personal access token), CANVAS_USERNAME+CANVAS_PASSWORD (auto-login), all three of CANVAS_CLIENT_ID, CANVAS_CLIENT_SECRET, CANVAS_REFRESH_TOKEN (OAuth), or install the fetchproxy extension and sign into your Canvas instance (unset CANVAS_DISABLE_FETCHPROXY if it is set)."
+  );
+}
+var liftersByDomain = /* @__PURE__ */ new Map();
+function lifterFor(declaredDomain) {
+  let lift = liftersByDomain.get(declaredDomain);
+  if (!lift) {
+    lift = createSessionLifter({
+      serverName: package_default.name,
+      version: package_default.version,
+      domains: [declaredDomain],
+      declare: {
+        cookies: ["canvas_session", "pseudonym_credentials"],
+        localStorage: [],
+        sessionStorage: [],
+        captureHeaders: []
       }
-      const msg = e instanceof Error ? e.message : String(e);
+    });
+    liftersByDomain.set(declaredDomain, lift);
+  }
+  return lift;
+}
+async function liftBrowserCookie(declaredDomain, baseHost) {
+  try {
+    const session = await lifterFor(declaredDomain)();
+    const canvasSession = session.cookies["canvas_session"];
+    const pseudoCreds = session.cookies["pseudonym_credentials"];
+    if (!canvasSession || !pseudoCreds) {
+      throw new Error(
+        `required cookies not found on ${baseHost}. Sign into your Canvas instance in the browser (with the fetchproxy extension installed) and retry.`
+      );
+    }
+    return `canvas_session=${canvasSession}; pseudonym_credentials=${pseudoCreds}`;
+  } catch (e) {
+    if (classifyBridgeError(e) === "bridge_down") {
+      const downErr = e;
       throw new Error(
-        `Canvas auth: no CANVAS_TOKEN, CANVAS_CLIENT_*/CANVAS_REFRESH_TOKEN, or CANVAS_USERNAME/CANVAS_PASSWORD set, and fetchproxy fallback failed: ${msg}`
+        `Canvas auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`
       );
     }
+    const msg = e instanceof Error ? e.message : String(e);
+    throw new Error(
+      `Canvas auth: no CANVAS_TOKEN, CANVAS_CLIENT_*/CANVAS_REFRESH_TOKEN, or CANVAS_USERNAME/CANVAS_PASSWORD set, and fetchproxy lift failed: ${msg}`
+    );
   }
-  throw new Error(
-    "Missing Canvas auth config. Set one of: CANVAS_TOKEN (personal access token), CANVAS_USERNAME+CANVAS_PASSWORD (auto-login), all three of CANVAS_CLIENT_ID, CANVAS_CLIENT_SECRET, CANVAS_REFRESH_TOKEN (OAuth), or install the fetchproxy extension and sign into your Canvas instance (unset CANVAS_DISABLE_FETCHPROXY if it is set)."
-  );
 }
 
 // src/client.ts
@@ -38869,28 +39101,35 @@ var DEFAULT_MAX_PAGES = 50;
 var CanvasClient = class {
   account;
   sessionLoginFn;
-  preloadedCookie;
+  /**
+   * fetchproxy lift. Called on the first login AND on every renewal, which is
+   * what keeps the path alive once the browser cookie lapses.
+   */
+  refreshSession;
   auth;
   /** Lazily-built shared refresh_token exchanger (oauth mode only). */
   oauthRefresh = null;
   /**
-   * `preloaded` is the fetchproxy escape hatch: when set, the client uses
-   * the supplied cookie header as-if it had just successfully run
-   * `sessionLogin()`. On a 401 it falls back to the lazy login flow only if
-   * usable credentials are present on the account — otherwise the 401
-   * surfaces as a TokenExpiredError (re-sign-in happens in the browser, not
-   * by re-running a form login with empty creds).
+   * `refreshSession` is the fetchproxy escape hatch: when set, it REPLACES
+   * `sessionLogin()` as the way this client mints a session cookie. It is
+   * called lazily on the first request and again on every 401, so a lapsed
+   * browser cookie recovers by re-reading the tab instead of dead-ending.
+   *
+   * It must re-read the browser each time rather than return a captured
+   * value — that capture-once shape is precisely what made a 401 terminal
+   * here, with a restart the only cure.
    */
   constructor(account, opts = {}) {
     this.account = account;
     this.sessionLoginFn = opts.sessionLogin ?? sessionLogin;
-    this.preloadedCookie = opts.preloaded?.cookie ?? null;
+    this.refreshSession = opts.refreshSession ?? null;
     this.auth = new CookieSessionManager({
       login: () => this.login(),
-      // Reactive expiry: only a 401 in a mode that can re-mint warrants a replay.
-      // token mode and fetchproxy-session (empty creds) can't re-auth here — their
-      // 401 falls through as a Response and `mapStatus` turns it into a
-      // TokenExpiredError so the user is told to re-sign-in / re-config.
+      // Reactive expiry: only a 401 in a mode that can re-mint warrants a
+      // replay. token mode still can't (no refresh path), and a session
+      // account with neither a lift nor credentials still can't — those 401s
+      // fall through as a Response and `mapStatus` turns them into a
+      // TokenExpiredError.
       isExpired: (res) => res.status === 401 && this.canReauth()
     });
   }
@@ -38998,7 +39237,7 @@ var CanvasClient = class {
   canReauth() {
     const acct = this.account;
     if (acct.mode === "oauth") return true;
-    if (acct.mode === "session") return !!acct.username && !!acct.password;
+    if (acct.mode === "session") return !!this.refreshSession || !!acct.username && !!acct.password;
     return false;
   }
   /** Mint the auth credential for the current mode. Invoked by the manager. */
@@ -39008,8 +39247,8 @@ var CanvasClient = class {
       return { headers: { Authorization: `Bearer ${acct.token}` } };
     }
     if (acct.mode === "session") {
-      if (this.preloadedCookie !== null) {
-        return { headers: { Cookie: this.preloadedCookie } };
+      if (this.refreshSession !== null) {
+        return { headers: { Cookie: await this.refreshSession() } };
       }
       return { headers: { Cookie: await this.mintSessionCookie(acct) } };
     }
@@ -39475,13 +39714,13 @@ try {
 }
 await runMcp({
   name: "canvas",
-  version: "1.2.0",
+  version: "1.2.3",
   // x-release-please-version
   tools: [
     (server) => {
       if (resolved) {
         const client = new CanvasClient(resolved.account, {
-          preloaded: resolved.preloaded
+          refreshSession: resolved.refresh
         });
         registerProfileTools(server, client);
         registerObserveeTools(server, client);

package/dist/client.js

@@ -13,28 +13,35 @@ const DEFAULT_MAX_PAGES = 50;
 export class CanvasClient {
     account;
     sessionLoginFn;
-    preloadedCookie;
+    /**
+     * fetchproxy lift. Called on the first login AND on every renewal, which is
+     * what keeps the path alive once the browser cookie lapses.
+     */
+    refreshSession;
     auth;
     /** Lazily-built shared refresh_token exchanger (oauth mode only). */
     oauthRefresh = null;
     /**
-     * `preloaded` is the fetchproxy escape hatch: when set, the client uses
-     * the supplied cookie header as-if it had just successfully run
-     * `sessionLogin()`. On a 401 it falls back to the lazy login flow only if
-     * usable credentials are present on the account — otherwise the 401
-     * surfaces as a TokenExpiredError (re-sign-in happens in the browser, not
-     * by re-running a form login with empty creds).
+     * `refreshSession` is the fetchproxy escape hatch: when set, it REPLACES
+     * `sessionLogin()` as the way this client mints a session cookie. It is
+     * called lazily on the first request and again on every 401, so a lapsed
+     * browser cookie recovers by re-reading the tab instead of dead-ending.
+     *
+     * It must re-read the browser each time rather than return a captured
+     * value — that capture-once shape is precisely what made a 401 terminal
+     * here, with a restart the only cure.
      */
     constructor(account, opts = {}) {
         this.account = account;
         this.sessionLoginFn = opts.sessionLogin ?? defaultSessionLogin;
-        this.preloadedCookie = opts.preloaded?.cookie ?? null;
+        this.refreshSession = opts.refreshSession ?? null;
         this.auth = new CookieSessionManager({
             login: () => this.login(),
-            // Reactive expiry: only a 401 in a mode that can re-mint warrants a replay.
-            // token mode and fetchproxy-session (empty creds) can't re-auth here — their
-            // 401 falls through as a Response and `mapStatus` turns it into a
-            // TokenExpiredError so the user is told to re-sign-in / re-config.
+            // Reactive expiry: only a 401 in a mode that can re-mint warrants a
+            // replay. token mode still can't (no refresh path), and a session
+            // account with neither a lift nor credentials still can't — those 401s
+            // fall through as a Response and `mapStatus` turns them into a
+            // TokenExpiredError.
             isExpired: (res) => res.status === 401 && this.canReauth(),
         });
     }
@@ -157,11 +164,12 @@ export class CanvasClient {
         const acct = this.account;
         if (acct.mode === 'oauth')
             return true;
-        // session: only when we hold real form credentials. The fetchproxy path
-        // synthesizes a SessionAccount with empty username/password and a preloaded
-        // cookie — it can't re-mint, so its 401 is terminal.
+        // session: either a browser lift (fetchproxy) or real form credentials
+        // can re-mint. The lift is the fetchproxy path's re-auth — before it
+        // existed, that path synthesized empty username/password and a captured
+        // cookie, so its 401 was terminal and only a restart recovered.
         if (acct.mode === 'session')
-            return !!acct.username && !!acct.password;
+            return !!this.refreshSession || (!!acct.username && !!acct.password);
         return false; // token mode: no refresh path.
     }
     /** Mint the auth credential for the current mode. Invoked by the manager. */
@@ -171,11 +179,10 @@ export class CanvasClient {
             return { headers: { Authorization: `Bearer ${acct.token}` } };
         }
         if (acct.mode === 'session') {
-            // fetchproxy path: a preloaded cookie stands in for a form login on the
-            // first ensure(). (A 401 here is terminal — canReauth() is false — so the
-            // manager never asks login() to re-mint with empty creds.)
-            if (this.preloadedCookie !== null) {
-                return { headers: { Cookie: this.preloadedCookie } };
+            // fetchproxy path: re-read the browser instead of posting a form login.
+            // Runs on every mint, not just the first, so an expiry renews.
+            if (this.refreshSession !== null) {
+                return { headers: { Cookie: await this.refreshSession() } };
             }
             return { headers: { Cookie: await this.mintSessionCookie(acct) } };
         }

package/dist/index.js

@@ -46,12 +46,12 @@ catch (e) {
 // host's install-time `tools/list` succeeds.
 await runMcp({
     name: 'canvas',
-    version: '1.2.0', // x-release-please-version
+    version: '1.2.3', // x-release-please-version
     tools: [
         (server) => {
             if (resolved) {
                 const client = new CanvasClient(resolved.account, {
-                    preloaded: resolved.preloaded,
+                    refreshSession: resolved.refresh,
                 });
                 registerProfileTools(server, client);
                 registerObserveeTools(server, client);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canvas-parent-mcp",
-  "version": "1.2.0",
+  "version": "1.2.3",
   "mcpName": "io.github.chrischall/canvas-parent-mcp",
   "description": "Canvas LMS (Instructure) MCP server — student/observer read access with optional file download",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -44,9 +44,9 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.13.0",
-    "@fetchproxy/bootstrap": "^1.0.0",
-    "@fetchproxy/server": "^1.0.0",
+    "@chrischall/mcp-utils": "^0.14.0",
+    "@fetchproxy/bootstrap": "^1.9.1",
+    "@fetchproxy/server": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.2",
     "zod": "^4.4.3"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/canvas-parent-mcp",
     "source": "github"
   },
-  "version": "1.2.0",
+  "version": "1.2.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "canvas-parent-mcp",
-      "version": "1.2.0",
+      "version": "1.2.3",
       "transport": {
         "type": "stdio"
       },