canvas-parent-mcp 1.2.2 → 1.2.3

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "1.2.2"
+    "version": "1.2.3"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "1.2.2",
+      "version": "1.2.3",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/dist/auth.js

@@ -54,7 +54,7 @@
 //   - `@fetchproxy/bootstrap` is mocked at the module boundary in tests.
 //   - `loadAccount()` (the existing env-var resolver) is reused as-is so
 //     the legacy paths keep working unchanged.
-import { bootstrap } from '@fetchproxy/bootstrap';
+import { createSessionLifter } from '@fetchproxy/bootstrap';
 import { classifyBridgeError } from '@fetchproxy/server';
 import { readEnvVar } from '@chrischall/mcp-utils';
 import { loadAccount } from './config.js';
@@ -98,6 +98,12 @@ export async function resolveAuth() {
         }
     }
     // ── Path 4: fetchproxy fallback.
+    //
+    // NOTE: the browser is NOT read here. resolveAuth() runs once at process
+    // start; the lift is handed to the client as `refresh` and runs lazily on
+    // the first request and again on every 401. A cookie captured at boot made
+    // a 401 terminal — the account has empty creds, so there was nothing to
+    // re-mint with and only a restart recovered.
     if (!fetchproxyDisabled()) {
         // CANVAS_BASE_URL is guaranteed valid here — loadAccount() validates it
         // before throwing the NO_ENV_CONFIG_MARKER error we caught above.
@@ -113,60 +119,22 @@ export async function resolveAuth() {
             : baseHost;
         const name = readEnv('CANVAS_NAME') ?? baseHost;
         const cleanBaseUrl = baseUrl.replace(/\/$/, '');
-        try {
-            const session = await bootstrap({
-                serverName: pkg.name,
-                version: pkg.version,
-                domains: [declaredDomain],
-                declare: {
-                    cookies: ['canvas_session', 'pseudonym_credentials'],
-                    localStorage: [],
-                    sessionStorage: [],
-                    captureHeaders: [],
-                },
-            });
-            const canvasSession = session.cookies['canvas_session'];
-            const pseudoCreds = session.cookies['pseudonym_credentials'];
-            if (!canvasSession || !pseudoCreds) {
-                throw new Error(`required cookies not found on ${baseHost}. ` +
-                    'Sign into your Canvas instance in the browser ' +
-                    '(with the fetchproxy extension installed) and retry.');
-            }
-            const cookie = `canvas_session=${canvasSession}; pseudonym_credentials=${pseudoCreds}`;
-            // Synthesize a session account with empty creds — the client will see
-            // `preloaded` and skip the form login. This mirrors the cookie shape
-            // the legacy session-scrape path produces, so everything downstream
-            // (Cookie header, 401-retry, file downloads) keeps working.
-            const account = {
-                mode: 'session',
-                name,
-                baseUrl: cleanBaseUrl,
-                username: '',
-                password: '',
-            };
-            return {
-                account,
-                preloaded: { cookie },
-                source: 'fetchproxy',
-            };
-        }
-        catch (e) {
-            // 0.8.0+ typed-error discrimination. The fetchproxy server already
-            // retries once on SW eviction (bridgeReviveDelayMs=2000 default), so
-            // a thrown FetchproxyBridgeDownError means the retry also failed —
-            // the extension's service worker is genuinely down and the user
-            // needs to wake it. The `.hint` is the actionable copy
-            // ("click the extension toolbar icon...") that we'd otherwise have
-            // to hand-write here. Surface it verbatim so users in path 4 get
-            // the same self-service guidance as path 5.
-            if (classifyBridgeError(e) === 'bridge_down') {
-                const downErr = e;
-                throw new Error(`Canvas auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`);
-            }
-            const msg = e instanceof Error ? e.message : String(e);
-            throw new Error(`Canvas auth: no CANVAS_TOKEN, CANVAS_CLIENT_*/CANVAS_REFRESH_TOKEN, or CANVAS_USERNAME/CANVAS_PASSWORD set, ` +
-                `and fetchproxy fallback failed: ${msg}`);
-        }
+        // Synthesized session account with empty creds — the client sees `refresh`
+        // and skips the form login. Cookie shape matches the legacy session-scrape
+        // path so everything downstream (Cookie header, 401 replay, downloads)
+        // keeps working.
+        const account = {
+            mode: 'session',
+            name,
+            baseUrl: cleanBaseUrl,
+            username: '',
+            password: '',
+        };
+        return {
+            account,
+            refresh: () => liftBrowserCookie(declaredDomain, baseHost),
+            source: 'fetchproxy',
+        };
     }
     // ── Path 5: nothing configured and fetchproxy explicitly disabled.
     throw new Error('Missing Canvas auth config. Set one of: CANVAS_TOKEN (personal access token), ' +
@@ -175,3 +143,64 @@ export async function resolveAuth() {
         'or install the fetchproxy extension and sign into your Canvas instance ' +
         '(unset CANVAS_DISABLE_FETCHPROXY if it is set).');
 }
+/**
+ * One lifter per declared domain, built lazily and reused.
+ *
+ * The scope is not static — self-hosted Canvas declares its literal hostname
+ * while *.instructure.com tenants share one wildcard — so the lifter cannot be
+ * a module-level constant. Caching is load-bearing rather than an
+ * optimization: `createSessionLifter` single-flights concurrent calls, and
+ * that only helps if renewals share ONE lifter instead of constructing a fresh
+ * one per call.
+ */
+const liftersByDomain = new Map();
+function lifterFor(declaredDomain) {
+    let lift = liftersByDomain.get(declaredDomain);
+    if (!lift) {
+        lift = createSessionLifter({
+            serverName: pkg.name,
+            version: pkg.version,
+            domains: [declaredDomain],
+            declare: {
+                cookies: ['canvas_session', 'pseudonym_credentials'],
+                localStorage: [],
+                sessionStorage: [],
+                captureHeaders: [],
+            },
+        });
+        liftersByDomain.set(declaredDomain, lift);
+    }
+    return lift;
+}
+/**
+ * Lift a fresh Canvas session cookie out of the user's signed-in tab.
+ *
+ * Runs on every mint, not once at startup — fetchproxy is not in the request
+ * hot path, only the renewal path.
+ */
+async function liftBrowserCookie(declaredDomain, baseHost) {
+    try {
+        const session = await lifterFor(declaredDomain)();
+        const canvasSession = session.cookies['canvas_session'];
+        const pseudoCreds = session.cookies['pseudonym_credentials'];
+        if (!canvasSession || !pseudoCreds) {
+            throw new Error(`required cookies not found on ${baseHost}. ` +
+                'Sign into your Canvas instance in the browser ' +
+                '(with the fetchproxy extension installed) and retry.');
+        }
+        return `canvas_session=${canvasSession}; pseudonym_credentials=${pseudoCreds}`;
+    }
+    catch (e) {
+        // 0.8.0+ typed-error discrimination. The fetchproxy server already retries
+        // once on SW eviction, so a thrown FetchproxyBridgeDownError means the
+        // retry also failed — the extension's service worker is genuinely down and
+        // the user needs to wake it. `.hint` is the actionable copy.
+        if (classifyBridgeError(e) === 'bridge_down') {
+            const downErr = e;
+            throw new Error(`Canvas auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`);
+        }
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new Error(`Canvas auth: no CANVAS_TOKEN, CANVAS_CLIENT_*/CANVAS_REFRESH_TOKEN, or CANVAS_USERNAME/CANVAS_PASSWORD set, ` +
+            `and fetchproxy lift failed: ${msg}`);
+    }
+}

package/dist/bundle.js

@@ -26729,17 +26729,33 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error51) {
   if (error51 && typeof error51 === "object") {
+    if ("issues" in error51 && Array.isArray(error51.issues) && error51.issues.length > 0) {
+      return error51.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join("\n");
+    }
     if ("message" in error51 && typeof error51.message === "string") {
       return error51.message;
     }
-    if ("issues" in error51 && Array.isArray(error51.issues) && error51.issues.length > 0) {
-      const firstIssue = error51.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error51);
     } catch {
@@ -33354,16 +33370,7 @@ var Server = class extends Protocol {
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
     }
-    let methodValue;
-    if (isZ4Schema(methodSchema)) {
-      const v4Schema = methodSchema;
-      const v4Def = v4Schema._zod?.def;
-      methodValue = v4Def?.value ?? v4Schema.value;
-    } else {
-      const v3Schema = methodSchema;
-      const legacyDef = v3Schema._def;
-      methodValue = legacyDef?.value ?? v3Schema.value;
-    }
+    const methodValue = getLiteralValue(methodSchema);
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
@@ -34551,8 +34558,17 @@ var EMPTY_COMPLETION_RESULT = {
 import process3 from "node:process";
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk2) {
+    const newSize = (this._buffer?.length ?? 0) + chunk2.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk2]) : chunk2;
   }
   readMessage() {
@@ -34580,18 +34596,24 @@ function serializeMessage(message) {
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
-  constructor(_stdin = process3.stdin, _stdout = process3.stdout) {
+  constructor(_stdin = process3.stdin, _stdout = process3.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer();
     this._started = false;
     this._ondata = (chunk2) => {
-      this._readBuffer.append(chunk2);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk2);
+        this.processReadBuffer();
+      } catch (error51) {
+        this.onerror?.(error51);
+        this.close().catch(() => {
+        });
+      }
     };
     this._onerror = (error51) => {
       this.onerror?.(error51);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   /**
    * Starts listening for messages on stdin.
@@ -38442,7 +38464,20 @@ var FetchproxyServer = class {
 
 // node_modules/@fetchproxy/bootstrap/dist/index.js
 var defaultFactory = (opts) => new FetchproxyServer(opts);
-async function bootstrap(opts) {
+function createSessionLifter(opts) {
+  let inFlight = null;
+  return () => {
+    if (inFlight)
+      return inFlight;
+    const p = runOneLift(opts).finally(() => {
+      if (inFlight === p)
+        inFlight = null;
+    });
+    inFlight = p;
+    return p;
+  };
+}
+async function runOneLift(opts) {
   const envVar = opts.serverName.toUpperCase().replace(/[^A-Z0-9]/g, "_").replace(/^_+/, "") + "_DISABLE_FETCHPROXY";
   const envVal = process.env[envVar];
   if (envVal !== void 0 && envVal !== "" && envVal !== "0" && envVal !== "false") {
@@ -38569,12 +38604,18 @@ async function bootstrap(opts) {
       });
       indexedDbBucket[`${d.database}/${d.store}`] = values;
     }
+    const absent = (declared, got) => declared.filter((k) => !(k in got));
     return {
       cookies,
       localStorage,
       sessionStorage,
       capturedHeaders,
-      indexedDb: indexedDbBucket
+      indexedDb: indexedDbBucket,
+      missing: {
+        cookies: absent(opts.declare.cookies, cookies),
+        localStorage: absent(opts.declare.localStorage, localStorage),
+        sessionStorage: absent(opts.declare.sessionStorage, sessionStorage)
+      }
     };
   } finally {
     try {
@@ -38679,7 +38720,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "1.2.2",
+  version: "1.2.3",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -38724,7 +38765,7 @@ var package_default = {
   },
   dependencies: {
     "@chrischall/mcp-utils": "^0.14.0",
-    "@fetchproxy/bootstrap": "^1.7.0",
+    "@fetchproxy/bootstrap": "^1.9.1",
     "@fetchproxy/server": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
@@ -38764,54 +38805,65 @@ async function resolveAuth() {
     const declaredDomain = baseHost.endsWith(".instructure.com") ? "instructure.com" : baseHost;
     const name = readEnv("CANVAS_NAME") ?? baseHost;
     const cleanBaseUrl = baseUrl.replace(/\/$/, "");
-    try {
-      const session = await bootstrap({
-        serverName: package_default.name,
-        version: package_default.version,
-        domains: [declaredDomain],
-        declare: {
-          cookies: ["canvas_session", "pseudonym_credentials"],
-          localStorage: [],
-          sessionStorage: [],
-          captureHeaders: []
-        }
-      });
-      const canvasSession = session.cookies["canvas_session"];
-      const pseudoCreds = session.cookies["pseudonym_credentials"];
-      if (!canvasSession || !pseudoCreds) {
-        throw new Error(
-          `required cookies not found on ${baseHost}. Sign into your Canvas instance in the browser (with the fetchproxy extension installed) and retry.`
-        );
-      }
-      const cookie = `canvas_session=${canvasSession}; pseudonym_credentials=${pseudoCreds}`;
-      const account = {
-        mode: "session",
-        name,
-        baseUrl: cleanBaseUrl,
-        username: "",
-        password: ""
-      };
-      return {
-        account,
-        preloaded: { cookie },
-        source: "fetchproxy"
-      };
-    } catch (e) {
-      if (classifyBridgeError(e) === "bridge_down") {
-        const downErr = e;
-        throw new Error(
-          `Canvas auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`
-        );
+    const account = {
+      mode: "session",
+      name,
+      baseUrl: cleanBaseUrl,
+      username: "",
+      password: ""
+    };
+    return {
+      account,
+      refresh: () => liftBrowserCookie(declaredDomain, baseHost),
+      source: "fetchproxy"
+    };
+  }
+  throw new Error(
+    "Missing Canvas auth config. Set one of: CANVAS_TOKEN (personal access token), CANVAS_USERNAME+CANVAS_PASSWORD (auto-login), all three of CANVAS_CLIENT_ID, CANVAS_CLIENT_SECRET, CANVAS_REFRESH_TOKEN (OAuth), or install the fetchproxy extension and sign into your Canvas instance (unset CANVAS_DISABLE_FETCHPROXY if it is set)."
+  );
+}
+var liftersByDomain = /* @__PURE__ */ new Map();
+function lifterFor(declaredDomain) {
+  let lift = liftersByDomain.get(declaredDomain);
+  if (!lift) {
+    lift = createSessionLifter({
+      serverName: package_default.name,
+      version: package_default.version,
+      domains: [declaredDomain],
+      declare: {
+        cookies: ["canvas_session", "pseudonym_credentials"],
+        localStorage: [],
+        sessionStorage: [],
+        captureHeaders: []
       }
-      const msg = e instanceof Error ? e.message : String(e);
+    });
+    liftersByDomain.set(declaredDomain, lift);
+  }
+  return lift;
+}
+async function liftBrowserCookie(declaredDomain, baseHost) {
+  try {
+    const session = await lifterFor(declaredDomain)();
+    const canvasSession = session.cookies["canvas_session"];
+    const pseudoCreds = session.cookies["pseudonym_credentials"];
+    if (!canvasSession || !pseudoCreds) {
+      throw new Error(
+        `required cookies not found on ${baseHost}. Sign into your Canvas instance in the browser (with the fetchproxy extension installed) and retry.`
+      );
+    }
+    return `canvas_session=${canvasSession}; pseudonym_credentials=${pseudoCreds}`;
+  } catch (e) {
+    if (classifyBridgeError(e) === "bridge_down") {
+      const downErr = e;
       throw new Error(
-        `Canvas auth: no CANVAS_TOKEN, CANVAS_CLIENT_*/CANVAS_REFRESH_TOKEN, or CANVAS_USERNAME/CANVAS_PASSWORD set, and fetchproxy fallback failed: ${msg}`
+        `Canvas auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${downErr.hint}`
       );
     }
+    const msg = e instanceof Error ? e.message : String(e);
+    throw new Error(
+      `Canvas auth: no CANVAS_TOKEN, CANVAS_CLIENT_*/CANVAS_REFRESH_TOKEN, or CANVAS_USERNAME/CANVAS_PASSWORD set, and fetchproxy lift failed: ${msg}`
+    );
   }
-  throw new Error(
-    "Missing Canvas auth config. Set one of: CANVAS_TOKEN (personal access token), CANVAS_USERNAME+CANVAS_PASSWORD (auto-login), all three of CANVAS_CLIENT_ID, CANVAS_CLIENT_SECRET, CANVAS_REFRESH_TOKEN (OAuth), or install the fetchproxy extension and sign into your Canvas instance (unset CANVAS_DISABLE_FETCHPROXY if it is set)."
-  );
 }
 
 // src/client.ts
@@ -39049,28 +39101,35 @@ var DEFAULT_MAX_PAGES = 50;
 var CanvasClient = class {
   account;
   sessionLoginFn;
-  preloadedCookie;
+  /**
+   * fetchproxy lift. Called on the first login AND on every renewal, which is
+   * what keeps the path alive once the browser cookie lapses.
+   */
+  refreshSession;
   auth;
   /** Lazily-built shared refresh_token exchanger (oauth mode only). */
   oauthRefresh = null;
   /**
-   * `preloaded` is the fetchproxy escape hatch: when set, the client uses
-   * the supplied cookie header as-if it had just successfully run
-   * `sessionLogin()`. On a 401 it falls back to the lazy login flow only if
-   * usable credentials are present on the account — otherwise the 401
-   * surfaces as a TokenExpiredError (re-sign-in happens in the browser, not
-   * by re-running a form login with empty creds).
+   * `refreshSession` is the fetchproxy escape hatch: when set, it REPLACES
+   * `sessionLogin()` as the way this client mints a session cookie. It is
+   * called lazily on the first request and again on every 401, so a lapsed
+   * browser cookie recovers by re-reading the tab instead of dead-ending.
+   *
+   * It must re-read the browser each time rather than return a captured
+   * value — that capture-once shape is precisely what made a 401 terminal
+   * here, with a restart the only cure.
    */
   constructor(account, opts = {}) {
     this.account = account;
     this.sessionLoginFn = opts.sessionLogin ?? sessionLogin;
-    this.preloadedCookie = opts.preloaded?.cookie ?? null;
+    this.refreshSession = opts.refreshSession ?? null;
     this.auth = new CookieSessionManager({
       login: () => this.login(),
-      // Reactive expiry: only a 401 in a mode that can re-mint warrants a replay.
-      // token mode and fetchproxy-session (empty creds) can't re-auth here — their
-      // 401 falls through as a Response and `mapStatus` turns it into a
-      // TokenExpiredError so the user is told to re-sign-in / re-config.
+      // Reactive expiry: only a 401 in a mode that can re-mint warrants a
+      // replay. token mode still can't (no refresh path), and a session
+      // account with neither a lift nor credentials still can't — those 401s
+      // fall through as a Response and `mapStatus` turns them into a
+      // TokenExpiredError.
       isExpired: (res) => res.status === 401 && this.canReauth()
     });
   }
@@ -39178,7 +39237,7 @@ var CanvasClient = class {
   canReauth() {
     const acct = this.account;
     if (acct.mode === "oauth") return true;
-    if (acct.mode === "session") return !!acct.username && !!acct.password;
+    if (acct.mode === "session") return !!this.refreshSession || !!acct.username && !!acct.password;
     return false;
   }
   /** Mint the auth credential for the current mode. Invoked by the manager. */
@@ -39188,8 +39247,8 @@ var CanvasClient = class {
       return { headers: { Authorization: `Bearer ${acct.token}` } };
     }
     if (acct.mode === "session") {
-      if (this.preloadedCookie !== null) {
-        return { headers: { Cookie: this.preloadedCookie } };
+      if (this.refreshSession !== null) {
+        return { headers: { Cookie: await this.refreshSession() } };
       }
       return { headers: { Cookie: await this.mintSessionCookie(acct) } };
     }
@@ -39655,13 +39714,13 @@ try {
 }
 await runMcp({
   name: "canvas",
-  version: "1.2.2",
+  version: "1.2.3",
   // x-release-please-version
   tools: [
     (server) => {
       if (resolved) {
         const client = new CanvasClient(resolved.account, {
-          preloaded: resolved.preloaded
+          refreshSession: resolved.refresh
         });
         registerProfileTools(server, client);
         registerObserveeTools(server, client);

package/dist/client.js

@@ -13,28 +13,35 @@ const DEFAULT_MAX_PAGES = 50;
 export class CanvasClient {
     account;
     sessionLoginFn;
-    preloadedCookie;
+    /**
+     * fetchproxy lift. Called on the first login AND on every renewal, which is
+     * what keeps the path alive once the browser cookie lapses.
+     */
+    refreshSession;
     auth;
     /** Lazily-built shared refresh_token exchanger (oauth mode only). */
     oauthRefresh = null;
     /**
-     * `preloaded` is the fetchproxy escape hatch: when set, the client uses
-     * the supplied cookie header as-if it had just successfully run
-     * `sessionLogin()`. On a 401 it falls back to the lazy login flow only if
-     * usable credentials are present on the account — otherwise the 401
-     * surfaces as a TokenExpiredError (re-sign-in happens in the browser, not
-     * by re-running a form login with empty creds).
+     * `refreshSession` is the fetchproxy escape hatch: when set, it REPLACES
+     * `sessionLogin()` as the way this client mints a session cookie. It is
+     * called lazily on the first request and again on every 401, so a lapsed
+     * browser cookie recovers by re-reading the tab instead of dead-ending.
+     *
+     * It must re-read the browser each time rather than return a captured
+     * value — that capture-once shape is precisely what made a 401 terminal
+     * here, with a restart the only cure.
      */
     constructor(account, opts = {}) {
         this.account = account;
         this.sessionLoginFn = opts.sessionLogin ?? defaultSessionLogin;
-        this.preloadedCookie = opts.preloaded?.cookie ?? null;
+        this.refreshSession = opts.refreshSession ?? null;
         this.auth = new CookieSessionManager({
             login: () => this.login(),
-            // Reactive expiry: only a 401 in a mode that can re-mint warrants a replay.
-            // token mode and fetchproxy-session (empty creds) can't re-auth here — their
-            // 401 falls through as a Response and `mapStatus` turns it into a
-            // TokenExpiredError so the user is told to re-sign-in / re-config.
+            // Reactive expiry: only a 401 in a mode that can re-mint warrants a
+            // replay. token mode still can't (no refresh path), and a session
+            // account with neither a lift nor credentials still can't — those 401s
+            // fall through as a Response and `mapStatus` turns them into a
+            // TokenExpiredError.
             isExpired: (res) => res.status === 401 && this.canReauth(),
         });
     }
@@ -157,11 +164,12 @@ export class CanvasClient {
         const acct = this.account;
         if (acct.mode === 'oauth')
             return true;
-        // session: only when we hold real form credentials. The fetchproxy path
-        // synthesizes a SessionAccount with empty username/password and a preloaded
-        // cookie — it can't re-mint, so its 401 is terminal.
+        // session: either a browser lift (fetchproxy) or real form credentials
+        // can re-mint. The lift is the fetchproxy path's re-auth — before it
+        // existed, that path synthesized empty username/password and a captured
+        // cookie, so its 401 was terminal and only a restart recovered.
         if (acct.mode === 'session')
-            return !!acct.username && !!acct.password;
+            return !!this.refreshSession || (!!acct.username && !!acct.password);
         return false; // token mode: no refresh path.
     }
     /** Mint the auth credential for the current mode. Invoked by the manager. */
@@ -171,11 +179,10 @@ export class CanvasClient {
             return { headers: { Authorization: `Bearer ${acct.token}` } };
         }
         if (acct.mode === 'session') {
-            // fetchproxy path: a preloaded cookie stands in for a form login on the
-            // first ensure(). (A 401 here is terminal — canReauth() is false — so the
-            // manager never asks login() to re-mint with empty creds.)
-            if (this.preloadedCookie !== null) {
-                return { headers: { Cookie: this.preloadedCookie } };
+            // fetchproxy path: re-read the browser instead of posting a form login.
+            // Runs on every mint, not just the first, so an expiry renews.
+            if (this.refreshSession !== null) {
+                return { headers: { Cookie: await this.refreshSession() } };
             }
             return { headers: { Cookie: await this.mintSessionCookie(acct) } };
         }

package/dist/index.js

@@ -46,12 +46,12 @@ catch (e) {
 // host's install-time `tools/list` succeeds.
 await runMcp({
     name: 'canvas',
-    version: '1.2.2', // x-release-please-version
+    version: '1.2.3', // x-release-please-version
     tools: [
         (server) => {
             if (resolved) {
                 const client = new CanvasClient(resolved.account, {
-                    preloaded: resolved.preloaded,
+                    refreshSession: resolved.refresh,
                 });
                 registerProfileTools(server, client);
                 registerObserveeTools(server, client);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canvas-parent-mcp",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "mcpName": "io.github.chrischall/canvas-parent-mcp",
   "description": "Canvas LMS (Instructure) MCP server — student/observer read access with optional file download",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,7 +45,7 @@
   },
   "dependencies": {
     "@chrischall/mcp-utils": "^0.14.0",
-    "@fetchproxy/bootstrap": "^1.7.0",
+    "@fetchproxy/bootstrap": "^1.9.1",
     "@fetchproxy/server": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.2",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/canvas-parent-mcp",
     "source": "github"
   },
-  "version": "1.2.2",
+  "version": "1.2.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "canvas-parent-mcp",
-      "version": "1.2.2",
+      "version": "1.2.3",
       "transport": {
         "type": "stdio"
       },