canvas-parent-mcp 1.2.3 → 1.2.4

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "1.2.3"
+    "version": "1.2.4"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "1.2.3",
+      "version": "1.2.4",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/dist/auth.js

@@ -144,23 +144,55 @@ export async function resolveAuth() {
         '(unset CANVAS_DISABLE_FETCHPROXY if it is set).');
 }
 /**
- * One lifter per declared domain, built lazily and reused.
+ * One lifter per resolved tenant HOST, built lazily and reused.
+ *
+ * Keyed on the host, not the declared domain: every *.instructure.com tenant
+ * declares the same wildcard but holds its own host-only cookies, so a
+ * domain-keyed map would hand the second tenant the first one's lifter.
  *
  * The scope is not static — self-hosted Canvas declares its literal hostname
- * while *.instructure.com tenants share one wildcard — so the lifter cannot be
- * a module-level constant. Caching is load-bearing rather than an
- * optimization: `createSessionLifter` single-flights concurrent calls, and
- * that only helps if renewals share ONE lifter instead of constructing a fresh
- * one per call.
+ * while hosted tenants share the wildcard — so the lifter cannot be a
+ * module-level constant. Caching is load-bearing rather than an optimization:
+ * `createSessionLifter` single-flights concurrent calls, and that only helps
+ * if renewals share ONE lifter instead of constructing a fresh one per call.
+ */
+const liftersByHost = new Map();
+/**
+ * Split a tenant host into the declared domain and the subdomain that actually
+ * holds the cookies.
+ *
+ * These are NOT the same thing, and conflating them is why the lift silently
+ * read nothing. Canvas declares the `instructure.com` wildcard so any district
+ * matches without a re-pair, but `canvas_session` / `pseudonym_credentials`
+ * are host-only on the tenant (`cms.instructure.com`). The extension resolves
+ * the storage origin from domain + subdomain, so declaring the wildcard alone
+ * pointed the read at `https://instructure.com` — an apex that holds nothing —
+ * and every lift reported the user signed out while they were signed in.
+ *
+ * Returns undefined for a self-hosted install, where the host IS the domain.
  */
-const liftersByDomain = new Map();
-function lifterFor(declaredDomain) {
-    let lift = liftersByDomain.get(declaredDomain);
+function storageSubdomainFor(declaredDomain, baseHost) {
+    // Only two cases exist, because `declaredDomain` is derived FROM `baseHost`
+    // a few lines up: either it collapsed to the instructure.com wildcard (so
+    // baseHost ends with `.instructure.com`), or it is baseHost itself. A
+    // `endsWith` guard here would be a third branch that cannot be reached, and
+    // an untestable branch is worse than an asserted invariant.
+    if (baseHost === declaredDomain)
+        return undefined;
+    return baseHost.slice(0, -(declaredDomain.length + 1));
+}
+function lifterFor(declaredDomain, baseHost) {
+    // Key on the resolved host: two tenants share one declared domain but hold
+    // different cookies, so caching by domain alone would hand the second
+    // tenant the first one's lifter.
+    const subdomain = storageSubdomainFor(declaredDomain, baseHost);
+    let lift = liftersByHost.get(baseHost);
     if (!lift) {
         lift = createSessionLifter({
             serverName: pkg.name,
             version: pkg.version,
             domains: [declaredDomain],
+            ...(subdomain !== undefined ? { storageSubdomain: subdomain } : {}),
             declare: {
                 cookies: ['canvas_session', 'pseudonym_credentials'],
                 localStorage: [],
@@ -168,7 +200,7 @@ function lifterFor(declaredDomain) {
                 captureHeaders: [],
             },
         });
-        liftersByDomain.set(declaredDomain, lift);
+        liftersByHost.set(baseHost, lift);
     }
     return lift;
 }
@@ -180,7 +212,7 @@ function lifterFor(declaredDomain) {
  */
 async function liftBrowserCookie(declaredDomain, baseHost) {
     try {
-        const session = await lifterFor(declaredDomain)();
+        const session = await lifterFor(declaredDomain, baseHost)();
         const canvasSession = session.cookies['canvas_session'];
         const pseudoCreds = session.cookies['pseudonym_credentials'];
         if (!canvasSession || !pseudoCreds) {

package/dist/bundle.js

@@ -38720,7 +38720,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "1.2.3",
+  version: "1.2.4",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -38822,14 +38822,20 @@ async function resolveAuth() {
     "Missing Canvas auth config. Set one of: CANVAS_TOKEN (personal access token), CANVAS_USERNAME+CANVAS_PASSWORD (auto-login), all three of CANVAS_CLIENT_ID, CANVAS_CLIENT_SECRET, CANVAS_REFRESH_TOKEN (OAuth), or install the fetchproxy extension and sign into your Canvas instance (unset CANVAS_DISABLE_FETCHPROXY if it is set)."
   );
 }
-var liftersByDomain = /* @__PURE__ */ new Map();
-function lifterFor(declaredDomain) {
-  let lift = liftersByDomain.get(declaredDomain);
+var liftersByHost = /* @__PURE__ */ new Map();
+function storageSubdomainFor(declaredDomain, baseHost) {
+  if (baseHost === declaredDomain) return void 0;
+  return baseHost.slice(0, -(declaredDomain.length + 1));
+}
+function lifterFor(declaredDomain, baseHost) {
+  const subdomain = storageSubdomainFor(declaredDomain, baseHost);
+  let lift = liftersByHost.get(baseHost);
   if (!lift) {
     lift = createSessionLifter({
       serverName: package_default.name,
       version: package_default.version,
       domains: [declaredDomain],
+      ...subdomain !== void 0 ? { storageSubdomain: subdomain } : {},
       declare: {
         cookies: ["canvas_session", "pseudonym_credentials"],
         localStorage: [],
@@ -38837,13 +38843,13 @@ function lifterFor(declaredDomain) {
         captureHeaders: []
       }
     });
-    liftersByDomain.set(declaredDomain, lift);
+    liftersByHost.set(baseHost, lift);
   }
   return lift;
 }
 async function liftBrowserCookie(declaredDomain, baseHost) {
   try {
-    const session = await lifterFor(declaredDomain)();
+    const session = await lifterFor(declaredDomain, baseHost)();
     const canvasSession = session.cookies["canvas_session"];
     const pseudoCreds = session.cookies["pseudonym_credentials"];
     if (!canvasSession || !pseudoCreds) {
@@ -39714,7 +39720,7 @@ try {
 }
 await runMcp({
   name: "canvas",
-  version: "1.2.3",
+  version: "1.2.4",
   // x-release-please-version
   tools: [
     (server) => {

package/dist/index.js

@@ -46,7 +46,7 @@ catch (e) {
 // host's install-time `tools/list` succeeds.
 await runMcp({
     name: 'canvas',
-    version: '1.2.3', // x-release-please-version
+    version: '1.2.4', // x-release-please-version
     tools: [
         (server) => {
             if (resolved) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canvas-parent-mcp",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "mcpName": "io.github.chrischall/canvas-parent-mcp",
   "description": "Canvas LMS (Instructure) MCP server — student/observer read access with optional file download",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/canvas-parent-mcp",
     "source": "github"
   },
-  "version": "1.2.3",
+  "version": "1.2.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "canvas-parent-mcp",
-      "version": "1.2.3",
+      "version": "1.2.4",
       "transport": {
         "type": "stdio"
       },