canvas-parent-mcp 1.5.5 → 1.5.6

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "1.5.5"
+    "version": "1.5.6"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "1.5.5",
+      "version": "1.5.6",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "1.5.5",
+  "version": "1.5.6",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -9444,7 +9444,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash } = __require("crypto");
+    var { randomBytes: randomBytes3, createHash } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -9982,7 +9982,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes2(16).toString("base64");
+      const key = randomBytes3(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -42204,9 +42204,29 @@ var SessionState = class {
   outboundSeq = 0;
   lastInboundSeq = 0;
   inflightInbound = /* @__PURE__ */ new Set();
+  saturationWarned = false;
   constructor(sessionKey) {
     this.sessionKey = sessionKey;
   }
+  /**
+   * Whether the caller holding this claim verdict should log saturation now.
+   * True only on the TRANSITION into it: a line per dropped frame turned a
+   * flood — or a set that never drains — into a log flood amplifying the very
+   * condition it reported (#376). An `'ok'` claim re-arms the latch, since it
+   * is the one signal every caller sees that the set has drained below the
+   * bound; a replay needs no capacity and leaves it alone. Latched per
+   * session, so a renegotiated one starts armed. A set hovering at the bound
+   * can still alternate ok/saturated, but that logs at the rate frames finish
+   * opening, not the rate they arrive.
+   */
+  saturationWarningDue(claim2) {
+    if (claim2 === "ok")
+      this.saturationWarned = false;
+    if (claim2 !== "saturated" || this.saturationWarned)
+      return false;
+    this.saturationWarned = true;
+    return true;
+  }
   nextOutboundSeq() {
     this.outboundSeq += 1;
     return this.outboundSeq;
@@ -42217,19 +42237,21 @@ var SessionState = class {
    * the first `await` of the receive path, or a duplicate frame read in the
    * same pass will be judged against a counter neither frame has moved yet.
    *
-   * Answering false means "not this frame's to process" — replayed, or a
-   * duplicate of one still in flight. Every true MUST be answered by exactly
-   * one {@link commitInboundSeq} or {@link releaseInboundSeq}.
+   * Anything but `'ok'` means "not this frame's to process": `'replay'` for
+   * a spent seq or a duplicate of one still in flight, `'saturated'` when the
+   * in-flight bound is full. Replay is checked first, since refusing a stale
+   * seq needs no capacity. Every `'ok'` MUST be answered by exactly one
+   * {@link commitInboundSeq} or {@link releaseInboundSeq}.
    */
   claimInboundSeq(seq) {
     if (seq <= this.lastInboundSeq)
-      return false;
+      return "replay";
     if (this.inflightInbound.has(seq))
-      return false;
+      return "replay";
     if (this.inflightInbound.size >= MAX_INFLIGHT_INBOUND_SEQS)
-      return false;
+      return "saturated";
     this.inflightInbound.add(seq);
-    return true;
+    return "ok";
   }
   /**
    * Give a claim back without spending the seq — for a frame that did not
@@ -42324,11 +42346,12 @@ async function awaitSessionReady(ready, opts) {
 }
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
-import { readFile as readFile2, writeFile as writeFile2, rename, unlink, mkdir as mkdir2, chmod as chmod2 } from "node:fs/promises";
+import { readFile as readFile2, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute2, join as join2 } from "node:path";
 
 // node_modules/@fetchproxy/server/dist/identity.js
-import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
+import { readFile, readdir, writeFile, mkdir, chmod, rename, rm, unlink } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
 import { isAbsolute, join } from "node:path";
 import { homedir } from "node:os";
 var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
@@ -42384,16 +42407,46 @@ function parseIdentity(text) {
     createdAt: j.createdAt
   };
 }
+async function openIdentityDir(dir) {
+  await mkdir(dir, { recursive: true, mode: 448 });
+  try {
+    await chmod(dir, 448);
+  } catch (e) {
+    const code = e.code;
+    if (code !== "EROFS" && code !== "EPERM")
+      throw e;
+  }
+}
+var STAGING_BYTES = 6;
+async function sweepStagingFiles(dir, serverName) {
+  const base = safeIdentityFileBase(serverName).replace(/[.]/g, "\\.");
+  const staging = new RegExp(`^${base}\\.json\\.[0-9a-f]{${STAGING_BYTES * 2}}\\.tmp$`);
+  let names;
+  try {
+    names = await readdir(dir);
+  } catch {
+    return;
+  }
+  await Promise.all(names.filter((name) => staging.test(name)).map((name) => unlink(join(dir, name)).catch(() => void 0)));
+}
 async function writeIdentityFile(dir, serverName, id) {
   const path = identityFilePath(dir, serverName);
-  await mkdir(dir, { recursive: true, mode: 448 });
-  await writeFile(path, serializeIdentity(id), { mode: 384 });
-  await chmod(path, 384);
+  await openIdentityDir(dir);
+  await sweepStagingFiles(dir, serverName);
+  const tmp = `${path}.${randomBytes(STAGING_BYTES).toString("hex")}.tmp`;
+  try {
+    await writeFile(tmp, serializeIdentity(id), { mode: 384, flag: "wx" });
+    await chmod(tmp, 384);
+    await rename(tmp, path);
+  } catch (e) {
+    await rm(tmp, { force: true });
+    throw e;
+  }
   return path;
 }
 async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
   const path = identityFilePath(dir, serverName);
-  await mkdir(dir, { recursive: true, mode: 448 });
+  await openIdentityDir(dir);
   try {
     return parseIdentity(await readFile(path, "utf8"));
   } catch (e) {
@@ -42506,7 +42559,7 @@ async function writeExtensionPin(serverName, pin, dir = defaultTrustDir()) {
   const tmp = `${path}.tmp`;
   await writeFile2(tmp, JSON.stringify(pin, null, 2), { mode: 384 });
   await chmod2(tmp, 384);
-  await rename(tmp, path);
+  await rename2(tmp, path);
 }
 
 // node_modules/@fetchproxy/server/dist/host.js
@@ -42861,7 +42914,11 @@ async function startHost(opts) {
               const session = ownSession;
               if (!session)
                 return;
-              if (!session.claimInboundSeq(frame.seq))
+              const claim2 = session.claimInboundSeq(frame.seq);
+              if (session.saturationWarningDue(claim2)) {
+                console.warn(`[fetchproxy] ${opts.ownServerName}: dropped an inbound frame (seq ${frame.seq}) unread \u2014 too many frames from the extension are still being opened (inbound claims saturated). Not a replay. Further drops are not logged until the in-flight set drains.`);
+              }
+              if (claim2 !== "ok")
                 return;
               let inner;
               try {
@@ -42990,7 +43047,9 @@ async function startHost(opts) {
 // node_modules/@fetchproxy/server/dist/peer.js
 var enc5 = new TextEncoder();
 async function startPeer(opts) {
-  const ws = new import_websocket.default(`ws://${opts.host}:${opts.port}`);
+  const ws = new import_websocket.default(`ws://${opts.host}:${opts.port}`, {
+    maxPayload: opts.maxPayloadBytes ?? MAX_PAYLOAD_BYTES
+  });
   await new Promise((resolve2, reject) => {
     const onOpen = () => {
       cleanup();
@@ -43228,7 +43287,11 @@ async function startPeer(opts) {
         const inboundSession = session;
         if (!inboundSession)
           return;
-        if (!inboundSession.claimInboundSeq(frame.seq))
+        const claim2 = inboundSession.claimInboundSeq(frame.seq);
+        if (inboundSession.saturationWarningDue(claim2)) {
+          console.warn(`[fetchproxy] ${opts.serverName}: dropped an inbound frame (seq ${frame.seq}) unread \u2014 too many frames from the extension are still being opened (inbound claims saturated). Not a replay. Further drops are not logged until the in-flight set drains.`);
+        }
+        if (claim2 !== "ok")
           return;
         let result;
         try {
@@ -45679,7 +45742,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "1.5.5",
+  version: "1.5.6",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45727,8 +45790,8 @@ var package_default = {
   },
   dependencies: {
     "@chrischall/mcp-utils": "^0.27.1",
-    "@fetchproxy/bootstrap": "^3.0.0",
-    "@fetchproxy/server": "^3.0.0",
+    "@fetchproxy/bootstrap": "^3.0.1",
+    "@fetchproxy/server": "^3.0.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     dotenv: "^17.4.2",
     zod: "^4.5.4"
@@ -45990,7 +46053,7 @@ import { writeFile as writeFile3, stat } from "fs/promises";
 import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
 import { dirname, join as join3, resolve } from "node:path";
 import { homedir as homedir2 } from "node:os";
-import { randomBytes, createHmac } from "node:crypto";
+import { randomBytes as randomBytes2, createHmac } from "node:crypto";
 function bindingDigest(secret, salt) {
   return createHmac("sha256", salt).update(secret).digest("hex").slice(0, 32);
 }
@@ -46042,7 +46105,7 @@ function createFileStatePersistence(opts) {
     },
     save(state) {
       const dir = dirname(filePath);
-      const tmp = `${filePath}.tmp-${randomBytes(6).toString("hex")}`;
+      const tmp = `${filePath}.tmp-${randomBytes2(6).toString("hex")}`;
       const dirExisted = existsSync(dir);
       try {
         mkdirSync(dir, { recursive: true, mode: 448 });
@@ -46050,7 +46113,7 @@ function createFileStatePersistence(opts) {
           chmodSync(dir, 448);
         let boundTo;
         if (secret !== void 0) {
-          const salt = randomBytes(16).toString("hex");
+          const salt = randomBytes2(16).toString("hex");
           boundTo = { salt, digest: bindingDigest(secret, salt) };
         }
         const envelope = { v: 1, ...boundTo !== void 0 ? { boundTo } : {}, state };
@@ -47149,7 +47212,7 @@ try {
 }
 await runMcp({
   name: "canvas",
-  version: "1.5.5",
+  version: "1.5.6",
   // x-release-please-version
   tools: [
     // Outside the `if (resolved)` on purpose: an unconfigured server must

package/dist/index.js

@@ -47,7 +47,7 @@ catch (e) {
 // host's install-time `tools/list` succeeds.
 await runMcp({
     name: 'canvas',
-    version: '1.5.5', // x-release-please-version
+    version: '1.5.6', // x-release-please-version
     tools: [
         // Outside the `if (resolved)` on purpose: an unconfigured server must
         // still expose something that can say WHY (see the tool's docblock).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canvas-parent-mcp",
-  "version": "1.5.5",
+  "version": "1.5.6",
   "mcpName": "io.github.chrischall/canvas-parent-mcp",
   "description": "Canvas LMS (Instructure) MCP server — student/observer read access with optional file download",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -48,8 +48,8 @@
   },
   "dependencies": {
     "@chrischall/mcp-utils": "^0.27.1",
-    "@fetchproxy/bootstrap": "^3.0.0",
-    "@fetchproxy/server": "^3.0.0",
+    "@fetchproxy/bootstrap": "^3.0.1",
+    "@fetchproxy/server": "^3.0.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "dotenv": "^17.4.2",
     "zod": "^4.5.4"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/canvas-parent-mcp",
     "source": "github"
   },
-  "version": "1.5.5",
+  "version": "1.5.6",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "canvas-parent-mcp",
-      "version": "1.5.5",
+      "version": "1.5.6",
       "transport": {
         "type": "stdio"
       },