canvas-parent-mcp 2.1.3 → 2.1.4

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Canvas LMS (Instructure) — courses, grades, assignments, announcements, planner, conversations, files",
-    "version": "2.1.3"
+    "version": "2.1.4"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Canvas LMS",
       "source": "./",
       "description": "Canvas LMS (Instructure) MCP server for Claude — student/observer access via natural language",
-      "version": "2.1.3",
+      "version": "2.1.4",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas-parent-mcp",
   "displayName": "Canvas LMS",
-  "version": "2.1.3",
+  "version": "2.1.4",
   "description": "Canvas LMS (Instructure) MCP server for Claude — courses, grades, assignments, announcements, planner, conversations, files",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -29,7 +29,7 @@ Mirrors the read-only parent-portal scope of sibling [`infinitecampus-mcp`](http
 
 Tools that the harness will gate as write/IO operations: `canvas_download_file`.
 
-`canvas_download_file` only fetches `/files/…` URLs on your `CANVAS_BASE_URL` host (https), so your Canvas credential is never sent anywhere else, and it only writes inside a download directory: `CANVAS_OUTPUT_DIR` if set, otherwise `~/Downloads`. A relative `destinationPath` is resolved against that directory.
+`canvas_download_file` only fetches `/files/…` URLs on your `CANVAS_BASE_URL` host (https), so your Canvas credential is never sent anywhere else, and it only writes inside a download directory: `CANVAS_OUTPUT_DIR` if set, otherwise `~/Downloads`. A relative `destinationPath` is resolved against that directory. It never writes through a symlink at the destination, and new files are created owner-only (0600).
 
 ## Configuration
 

package/dist/bundle.js

@@ -5007,7 +5007,7 @@ var require_memoizer = __commonJS({
       return bucket;
     }
     var handoff2;
-    var open2 = [];
+    var open3 = [];
     var memo3 = {
       alloc(_inst, payload, empty) {
         const bucket = handoff2;
@@ -5016,7 +5016,7 @@ var require_memoizer = __commonJS({
         handoff2 = void 0;
         const entry = { value: empty, issues: null };
         bucket.set(payload.value, entry);
-        open2.push(entry);
+        open3.push(entry);
         return empty;
       },
       guard(inst) {
@@ -5087,10 +5087,10 @@ var require_memoizer = __commonJS({
               return payload;
             }
             handoff2 = bucket;
-            const depth = open2.length;
+            const depth = open3.length;
             const result = base(payload, ctx);
             handoff2 = void 0;
-            const entry = open2.length > depth ? open2.pop() : void 0;
+            const entry = open3.length > depth ? open3.pop() : void 0;
             if (result instanceof Promise) {
               return result.then((r) => {
                 if (entry)
@@ -26497,7 +26497,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open2() {
+          ws.once("open", function open3() {
             duplex._final(callback);
           });
           return;
@@ -26518,7 +26518,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk2, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open2() {
+          ws.once("open", function open3() {
             duplex._write(chunk2, encoding, callback);
           });
           return;
@@ -67581,7 +67581,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "2.1.3",
+  version: "2.1.4",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -67887,7 +67887,8 @@ function registerCredentialHealthcheckTool(args) {
 }
 
 // src/client.ts
-import { writeFile as writeFile3, stat } from "fs/promises";
+import { constants as fsConstants } from "fs";
+import { lstat as lstat2, open as open2, stat } from "fs/promises";
 
 // node_modules/@chrischall/mcp-utils/dist/session/index.js
 import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
@@ -68466,9 +68467,10 @@ var CanvasClient = class {
     const dest = this.confineDestination(destinationPath);
     let destStat = null;
     try {
-      destStat = await stat(dest);
+      destStat = await lstat2(dest);
     } catch {
     }
+    if (destStat?.isSymbolicLink()) throw new InvalidPathError(destinationPath, "is a symlink");
     if (destStat?.isDirectory()) throw new InvalidPathError(destinationPath);
     if (destStat && !opts.overwrite) throw new FileExistsError(destinationPath);
     const parent = dirname3(dest);
@@ -68482,7 +68484,7 @@ var CanvasClient = class {
     if (res.status === 404) throw new Error(`Canvas download 404 for ${path}`);
     if (!res.ok) throw new Error(`Canvas download ${res.status} for ${path}`);
     const buf = new Uint8Array(await res.arrayBuffer());
-    await writeFile3(dest, buf);
+    await writeConfined(dest, destinationPath, buf, opts.overwrite === true);
     return {
       path: dest,
       bytes: buf.byteLength,
@@ -68678,9 +68680,28 @@ var DownloadDestinationRejectedError = class extends Error {
   path;
   root;
 };
+async function writeConfined(dest, requested, buf, overwrite) {
+  const { O_WRONLY, O_CREAT, O_TRUNC, O_EXCL, O_NOFOLLOW } = fsConstants;
+  const flags = O_WRONLY | O_CREAT | O_NOFOLLOW | (overwrite ? O_TRUNC : O_EXCL);
+  let handle;
+  try {
+    handle = await open2(dest, flags, 384);
+  } catch (e) {
+    const code = e.code;
+    if (code === "ELOOP") throw new InvalidPathError(requested, "is a symlink");
+    if (code === "EEXIST") throw new FileExistsError(requested);
+    if (code === "EISDIR") throw new InvalidPathError(requested);
+    throw e;
+  }
+  try {
+    await handle.writeFile(buf);
+  } finally {
+    await handle.close();
+  }
+}
 var InvalidPathError = class extends Error {
-  constructor(path) {
-    super(`InvalidPath: destinationPath must be a filename, not a directory: ${path}`);
+  constructor(path, reason = "must be a filename, not a directory") {
+    super(`InvalidPath: destinationPath ${reason}: ${path}`);
     this.path = path;
     this.name = "InvalidPathError";
   }
@@ -69041,12 +69062,13 @@ function registerConversationTools(server, client) {
     return viewResponse(args.view, data);
   });
   server.registerTool("canvas_get_conversation", {
-    description: "Get a full Canvas conversation thread with all messages.",
+    description: "Get a full Canvas conversation thread with all messages. Read-only: does not mark the conversation as read.",
     annotations: { readOnlyHint: true },
     inputSchema: getArgs3
   }, async (rawArgs) => {
     const args = getArgs3.parse(rawArgs);
     const path = buildPath(`/api/v1/conversations/${encodeURIComponent(args.id)}`, {
+      auto_mark_as_read: false,
       "include[]": ["participant_avatars"]
     });
     const data = await client.request(path);
@@ -69127,7 +69149,7 @@ try {
 }
 await runMcp({
   name: "canvas",
-  version: "2.1.3",
+  version: "2.1.4",
   // x-release-please-version
   tools: [
     // Outside the `if (resolved)` on purpose: an unconfigured server must

package/dist/client.js

@@ -1,4 +1,5 @@
-import { writeFile, stat } from 'fs/promises';
+import { constants as fsConstants } from 'fs';
+import { lstat, open, stat } from 'fs/promises';
 import { createSessionCache, reportCacheWriteFailure } from './session-cache.js';
 import { dirname, isAbsolute, join, resolve } from 'path';
 import { homedir } from 'os';
@@ -100,11 +101,15 @@ export class CanvasClient {
     async download(path, destinationPath, opts = {}) {
         const url = this.pinDownloadUrl(path);
         const dest = this.confineDestination(destinationPath);
+        // lstat, not stat: a symlink at the final component is refused outright
+        // rather than judged by whatever it points at.
         let destStat = null;
         try {
-            destStat = await stat(dest);
+            destStat = await lstat(dest);
         }
         catch { /* not present, ok */ }
+        if (destStat?.isSymbolicLink())
+            throw new InvalidPathError(destinationPath, 'is a symlink');
         if (destStat?.isDirectory())
             throw new InvalidPathError(destinationPath);
         if (destStat && !opts.overwrite)
@@ -124,7 +129,7 @@ export class CanvasClient {
         if (!res.ok)
             throw new Error(`Canvas download ${res.status} for ${path}`);
         const buf = new Uint8Array(await res.arrayBuffer());
-        await writeFile(dest, buf);
+        await writeConfined(dest, destinationPath, buf, opts.overwrite === true);
         return {
             path: dest,
             bytes: buf.byteLength,
@@ -349,10 +354,44 @@ export class DownloadDestinationRejectedError extends Error {
         this.name = 'DownloadDestinationRejectedError';
     }
 }
+/**
+ * Write a download to its (already confined) destination without ever
+ * following a symlink at the final path component (fleet-audit#925). The
+ * pre-flight lstat in download() is separated from this write by a network
+ * fetch, so a link can be planted in between; O_NOFOLLOW makes the open itself
+ * refuse it (ELOOP), and O_EXCL (without overwrite) refuses anything that
+ * appeared at all. New files are created owner-only (0600): they are a
+ * student's school records.
+ */
+async function writeConfined(dest, requested, buf, overwrite) {
+    // O_NOFOLLOW is POSIX-only: on Windows it is undefined, which `|` coerces to 0.
+    const { O_WRONLY, O_CREAT, O_TRUNC, O_EXCL, O_NOFOLLOW } = fsConstants;
+    const flags = O_WRONLY | O_CREAT | O_NOFOLLOW | (overwrite ? O_TRUNC : O_EXCL);
+    let handle;
+    try {
+        handle = await open(dest, flags, 0o600);
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === 'ELOOP')
+            throw new InvalidPathError(requested, 'is a symlink');
+        if (code === 'EEXIST')
+            throw new FileExistsError(requested);
+        if (code === 'EISDIR')
+            throw new InvalidPathError(requested);
+        throw e;
+    }
+    try {
+        await handle.writeFile(buf);
+    }
+    finally {
+        await handle.close();
+    }
+}
 export class InvalidPathError extends Error {
     path;
-    constructor(path) {
-        super(`InvalidPath: destinationPath must be a filename, not a directory: ${path}`);
+    constructor(path, reason = 'must be a filename, not a directory') {
+        super(`InvalidPath: destinationPath ${reason}: ${path}`);
         this.path = path;
         this.name = 'InvalidPathError';
     }

package/dist/index.js

@@ -47,7 +47,7 @@ catch (e) {
 // host's install-time `tools/list` succeeds.
 await runMcp({
     name: 'canvas',
-    version: '2.1.3', // x-release-please-version
+    version: '2.1.4', // x-release-please-version
     tools: [
         // Outside the `if (resolved)` on purpose: an unconfigured server must
         // still expose something that can say WHY (see the tool's docblock).

package/dist/tools/conversations.js

@@ -26,12 +26,16 @@ export function registerConversationTools(server, client) {
         return viewResponse(args.view, data);
     });
     server.registerTool('canvas_get_conversation', {
-        description: 'Get a full Canvas conversation thread with all messages.',
+        description: 'Get a full Canvas conversation thread with all messages. Read-only: does not mark the conversation as read.',
         annotations: { readOnlyHint: true },
         inputSchema: getArgs,
     }, async (rawArgs) => {
         const args = getArgs.parse(rawArgs);
+        // Canvas marks a conversation read on GET unless told otherwise; pin it
+        // off so this tool honours its readOnlyHint and never sends the parent's
+        // read receipt to the teacher on a model's behalf (fleet-audit#926).
         const path = buildPath(`/api/v1/conversations/${encodeURIComponent(args.id)}`, {
+            auto_mark_as_read: false,
             'include[]': ['participant_avatars'],
         });
         const data = await client.request(path);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canvas-parent-mcp",
-  "version": "2.1.3",
+  "version": "2.1.4",
   "mcpName": "io.github.chrischall/canvas-parent-mcp",
   "description": "Canvas LMS (Instructure) MCP server — student/observer read access with optional file download",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/canvas-parent-mcp",
     "source": "github"
   },
-  "version": "2.1.3",
+  "version": "2.1.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "canvas-parent-mcp",
-      "version": "2.1.3",
+      "version": "2.1.4",
       "transport": {
         "type": "stdio"
       },