canvas-parent-mcp 2.1.7 → 2.1.9

package/dist/bundle.js

@@ -27002,6 +27002,17 @@ var storage = new AsyncLocalStorage();
 function withCallSignal(signal, fn, request) {
   return signal ? storage.run({ signal, ...request ? { request } : {} }, fn) : fn();
 }
+function currentCallSignal() {
+  return storage.getStore()?.signal;
+}
+function withAmbientCancellation(own2) {
+  const ambient = currentCallSignal();
+  if (!ambient)
+    return own2;
+  if (!own2)
+    return ambient;
+  return AbortSignal.any([own2, ambient]);
+}
 
 // node_modules/@chrischall/mcp-utils/dist/caller/index.js
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
@@ -41783,17 +41794,62 @@ var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
 
 // node_modules/@chrischall/mcp-utils/dist/errors/index.js
 var DEFAULT_ERROR_MESSAGE_MAX = 500;
+var MCP_TOOL_ERROR_KINDS = /* @__PURE__ */ new Set([
+  "no_credential",
+  "credential_rejected",
+  "edge_blocked",
+  "session_expired",
+  "verification_pending",
+  "timeout",
+  "http",
+  "transport",
+  "too_large",
+  "unknown"
+]);
 var McpToolError = class extends Error {
   /** Actionable remediation text, when one applies. */
   hint;
+  /** The upstream HTTP status this failure came from, when known. */
+  status;
+  /** What kind of failure this is, when the thrower knows. */
+  kind;
   constructor(message, opts) {
     super(message, opts?.cause !== void 0 ? { cause: opts.cause } : void 0);
     this.name = "McpToolError";
     if (opts?.hint !== void 0)
       this.hint = opts.hint;
+    if (opts?.status !== void 0)
+      this.status = opts.status;
+    if (opts?.kind !== void 0)
+      this.kind = opts.kind;
     Object.setPrototypeOf(this, new.target.prototype);
   }
 };
+var DECLARATION_CAUSE_DEPTH = 4;
+function firstDeclared(err, read) {
+  let cur = err;
+  for (let depth = 0; depth < DECLARATION_CAUSE_DEPTH && cur !== null && typeof cur === "object"; depth++) {
+    const found = read(cur);
+    if (found !== void 0)
+      return found;
+    cur = cur.cause;
+  }
+  return void 0;
+}
+function errorStatusOf(err) {
+  return firstDeclared(err, (link2) => {
+    const e = link2;
+    if (typeof e.status === "number")
+      return e.status;
+    return typeof e.statusCode === "number" ? e.statusCode : void 0;
+  });
+}
+function errorKindOf(err) {
+  return firstDeclared(err, (link2) => {
+    const k = link2.kind;
+    return typeof k === "string" && MCP_TOOL_ERROR_KINDS.has(k) ? k : void 0;
+  });
+}
 function createHelpfulError(message, opts) {
   return new McpToolError(message, opts);
 }
@@ -41818,7 +41874,7 @@ var API_KEY_RE = new RegExp([
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
 var GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-var QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+var QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
 var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
 var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
 var HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -41829,6 +41885,8 @@ var JSON_SECRET_KEYS = [
   "api[_-]?secret",
   "(?:x[_-])?api[_-]?key",
   "private[_-]?key",
+  "code[_-]?verifier",
+  // PKCE; a bare `verifier` key is too generic for JSON
   `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
   // bounded like HEADER_SECRET_RE
   "(?:proxy-)?authorization",
@@ -61660,7 +61718,7 @@ function readEnvVar(key, opts = {}) {
   if (typeof raw === "string") {
     const trimmed = raw.trim();
     if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
-      return trimmed;
+      return opts.trim === false ? raw : trimmed;
     }
   }
   return opts.default;
@@ -61714,12 +61772,14 @@ var SERVER_PROTOCOL_VERSIONS = Object.freeze([
   ...SUPPORTED_PROTOCOL_VERSIONS
 ]);
 function hintResultOrRethrow(err) {
+  if (err instanceof ProtocolError && err.code === ProtocolErrorCode.UrlElicitationRequired)
+    throw err;
   if (err instanceof McpToolError && err.hint) {
     return errorResult(`${err.message}
 
 Hint: ${err.hint}`);
   }
-  throw err;
+  return errorResult(messageOf(err));
 }
 function mcpRequestFrom(args) {
   const ctx = args.at(-1);
@@ -61949,6 +62009,18 @@ function isCloudflareChallenge(html) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
+var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+var RequestTimeoutError = class extends Error {
+  timeoutMs;
+  /** Always `'timeout'` unless a subclass says otherwise. */
+  kind = "timeout";
+  constructor(service, timeoutMs) {
+    super(`Request to ${service} timed out after ${timeoutMs}ms.`);
+    this.name = "RequestTimeoutError";
+    this.timeoutMs = timeoutMs;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
 var ApiError = class extends Error {
   status;
   constructor(status, message) {
@@ -61961,6 +62033,8 @@ var ApiError = class extends Error {
 var EdgeBlockedError = class extends ApiError {
   /** Which edge refused the request, e.g. `'CloudFront'` or `'Cloudflare'`. */
   vendor;
+  /** Always `'edge_blocked'`: the credential was never judged. */
+  kind = "edge_blocked";
   /**
    * @param where The service the request was for, and — when the thrower knows
    *   it — the method and path, which the message names.
@@ -62140,7 +62214,7 @@ var PositiveInt = external_exports.number().int().positive();
 var NonNegInt = external_exports.number().int().nonnegative();
 var NonEmptyString = external_exports.string().min(1);
 var IsoDate = external_exports.iso.date();
-var IsoTime = external_exports.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/, "must be HH:MM (24h), e.g. 19:30");
+var IsoTime = external_exports.string().regex(/^([01]?\d|2[0-3]):[0-5]\d$/, "must be HH:MM (24h), e.g. 19:30").overwrite((v) => v.padStart(5, "0"));
 var NumericIdString = external_exports.string().regex(/^\d+$/, "must be a numeric id (digits only)").describe("A numeric id string (digits only), safe to interpolate into a URL path.");
 var SafePathSegment = external_exports.string().min(1).regex(/^[^/?#\s]+$/, 'must not contain "/", "?", "#", or whitespace').refine((v) => !v.includes(".."), 'must not contain ".."').describe('A single URL path segment, safe to interpolate: no "/", "..", "?", "#", or whitespace.');
 var schemaOrigin = external_exports.string().optional().describe("Portal origin (e.g. https://<vendor>.example.co) selecting which active session to use. Optional when only one session is active.");
@@ -62158,7 +62232,11 @@ var pageSchema = {
 var OAuth2RefreshError = class extends McpToolError {
   status;
   constructor(status, message, opts) {
-    super(message, opts);
+    super(message, {
+      ...opts,
+      status,
+      kind: status >= 400 && status < 500 && status !== 408 && status !== 429 ? "credential_rejected" : "http"
+    });
     this.name = "OAuth2RefreshError";
     this.status = status;
     Object.setPrototypeOf(this, new.target.prototype);
@@ -62190,6 +62268,7 @@ function createOAuth2Refresher(opts) {
   const grantType = opts.grantType ?? "refresh_token";
   const maxRetries = opts.retry?.count ?? 0;
   const retryDelayMs = opts.retry?.delayMs ?? 0;
+  const timeoutMs = opts.timeout === false ? 0 : opts.timeout ?? DEFAULT_REQUEST_TIMEOUT_MS;
   let inFlight = null;
   let currentRefreshToken = opts.refreshToken;
   const spent = /* @__PURE__ */ new Set();
@@ -62200,22 +62279,57 @@ function createOAuth2Refresher(opts) {
       refresh_token: currentRefreshToken,
       ...opts.params
     }).toString();
-    const res = await doFetch(opts.endpoint, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        Accept: "application/json"
-      },
-      body
+    const controller = timeoutMs > 0 ? new AbortController() : void 0;
+    const timedOut = () => new RequestTimeoutError(endpointWhere(opts.endpoint).service, timeoutMs);
+    let timer;
+    const expired = controller ? new Promise((_resolve, reject) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        reject(timedOut());
+      }, timeoutMs);
+    }) : void 0;
+    expired?.catch(() => {
     });
+    const bounded = (p) => expired ? Promise.race([p, expired]) : p;
+    try {
+      return await exchangeBounded(body, controller?.signal, bounded, timedOut);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async function exchangeBounded(body, signal, bounded, timedOut) {
+    let res;
+    try {
+      res = await bounded(doFetch(opts.endpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body,
+        ...signal ? { signal } : {}
+      }));
+    } catch (err) {
+      if (signal?.aborted && !(err instanceof RequestTimeoutError))
+        throw timedOut();
+      throw err;
+    }
+    const keepTimeout = (fallback) => (err) => {
+      if (err instanceof RequestTimeoutError) {
+        res.body?.cancel().catch(() => {
+        });
+        throw err;
+      }
+      return fallback;
+    };
     if (!res.ok) {
-      const errText = await res.text().catch(() => "");
+      const errText = await bounded(res.text()).catch(keepTimeout(""));
       const edge = detectEdgeBlock({ body: errText, headers: res.headers, status: res.status });
       if (edge)
         throw new EdgeBlockedError(res.status, edge.vendor, endpointWhere(opts.endpoint));
       throw new OAuth2RefreshError(res.status, `OAuth2 token refresh failed: ${res.status} ${res.statusText}: ${truncateErrorMessage(errText, 200)}`, { hint: "The refresh token may be expired or revoked \u2014 re-authenticate." });
     }
-    const data = await res.json().catch(() => null);
+    const data = await bounded(res.json()).catch(keepTimeout(null));
     const accessToken = data?.access_token;
     if (typeof accessToken !== "string" || accessToken.length === 0) {
       throw createHelpfulError("OAuth2 token refresh returned no access_token.", {
@@ -62253,6 +62367,14 @@ function createOAuth2Refresher(opts) {
     throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
   }
   return function refresh(refreshToken) {
+    const signal = currentCallSignal();
+    if (!signal)
+      return shared(refreshToken);
+    if (signal.aborted)
+      return Promise.reject(abortReasonOf(signal));
+    return releaseOnAbort(shared(refreshToken), signal);
+  };
+  function shared(refreshToken) {
     if (inFlight)
       return inFlight;
     if (typeof refreshToken === "string" && refreshToken.length > 0 && !spent.has(refreshToken)) {
@@ -62275,7 +62397,18 @@ function createOAuth2Refresher(opts) {
     });
     inFlight = p;
     return p;
-  };
+  }
+}
+function releaseOnAbort(p, signal) {
+  return new Promise((resolve5, reject) => {
+    const onAbort = () => reject(abortReasonOf(signal));
+    signal.addEventListener("abort", onAbort, { once: true });
+    p.then(resolve5, reject).finally(() => signal.removeEventListener("abort", onAbort));
+  });
+}
+function abortReasonOf(signal) {
+  const reason = signal.reason;
+  return reason instanceof Error ? reason : new Error(String(reason));
 }
 function endpointWhere(endpoint) {
   try {
@@ -62493,6 +62626,17 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
 ]);
 var ACCOUNT_KEY_FRAME = "account-key";
 var ACCOUNT_ATTEST_FRAME = "account-attest";
+var BRIDGE_ROLE_FRAME = "bridge-role";
+var BRIDGE_SERVE_FRAME = "bridge-serve";
+var ROOM_PING_FRAME = "room-ping";
+var ROOM_PONG_FRAME = "room-pong";
+var BRIDGE_ROLE_LABEL_MAX = 64;
+var ROOM_FRAME_ACCEPTS = Object.freeze({
+  [BRIDGE_ROLE_FRAME]: BRIDGE_ROLE_FRAME,
+  [BRIDGE_SERVE_FRAME]: BRIDGE_SERVE_FRAME,
+  [ROOM_PING_FRAME]: ROOM_PING_FRAME,
+  [ROOM_PONG_FRAME]: ROOM_PING_FRAME
+});
 
 // node_modules/@fetchproxy/protocol/dist/mcp-id.js
 var ID_RE = /^([^:]+):([^:]+):([0-9a-f]{16})$/;
@@ -63158,6 +63302,12 @@ function validateFrame(raw) {
     return validateAccountKey(raw);
   if (t === ACCOUNT_ATTEST_FRAME)
     return validateAccountAttest(raw);
+  if (t === BRIDGE_ROLE_FRAME)
+    return validateBridgeRole(raw);
+  if (t === BRIDGE_SERVE_FRAME || t === ROOM_PING_FRAME || t === ROOM_PONG_FRAME) {
+    assertExactFields(raw, TYPE_ONLY_FIELDS, t);
+    return { type: t };
+  }
   throw new ProtocolError3(`unknown frame type: ${String(t)}`);
 }
 function validateHello(raw) {
@@ -63483,6 +63633,43 @@ function validateAccountAttest(raw) {
     sig: raw.sig
   };
 }
+var TYPE_ONLY_FIELDS = ["type"];
+var BRIDGE_ROLE_FIELDS = ["type", "role", "canServe", "serving"];
+var BRIDGE_ROLE_SERVING_FIELDS = ["label", "since"];
+function validateBridgeRole(raw) {
+  const L = BRIDGE_ROLE_FRAME;
+  const role = raw.role;
+  if (role !== "serving" && role !== "standby") {
+    throw new ProtocolError3(`${L}.role: must be one of serving, standby`);
+  }
+  const canServe = raw.canServe;
+  assertBoolean(canServe, `${L}.canServe`);
+  assertExactFields(raw, BRIDGE_ROLE_FIELDS, L);
+  const serving = raw.serving;
+  if (role === "serving") {
+    if (serving !== void 0) {
+      throw new ProtocolError3(`${L}.serving: must be absent when role is serving`);
+    }
+    return { type: BRIDGE_ROLE_FRAME, role, canServe };
+  }
+  if (serving === void 0) {
+    throw new ProtocolError3(`${L}.serving: required when role is standby`);
+  }
+  assertObject(serving, `${L}.serving`);
+  const label = serving.label;
+  assertDisplayString(label, `${L}.serving.label`, 1, BRIDGE_ROLE_LABEL_MAX);
+  const since = serving.since;
+  if (typeof since !== "number" || !Number.isSafeInteger(since) || since < 0) {
+    throw new ProtocolError3(`${L}.serving.since: expected non-negative safe integer (Unix ms)`);
+  }
+  assertExactFields(serving, BRIDGE_ROLE_SERVING_FIELDS, `${L}.serving`);
+  return {
+    type: BRIDGE_ROLE_FRAME,
+    role,
+    canServe,
+    serving: { label, since }
+  };
+}
 function validateInnerFrame(raw) {
   assertObject(raw, "inner");
   const t = raw.type;
@@ -65425,9 +65612,9 @@ async function startHost(opts) {
   });
   return {
     close: () => new Promise((resolve5) => {
-      for (const client of wss.clients) {
+      for (const client2 of wss.clients) {
         try {
-          client.terminate();
+          client2.terminate();
         } catch {
         }
       }
@@ -68517,7 +68704,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "canvas-parent-mcp",
-  version: "2.1.7",
+  version: "2.1.9",
   mcpName: "io.github.chrischall/canvas-parent-mcp",
   description: "Canvas LMS (Instructure) MCP server \u2014 student/observer read access with optional file download",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -68564,9 +68751,9 @@ var package_default = {
     typecheck: "tsc -p tsconfig.json --noEmit"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^2.14.0",
-    "@fetchproxy/bootstrap": "^3.4.1",
-    "@fetchproxy/server": "^3.4.1",
+    "@chrischall/mcp-utils": "^3.0.0",
+    "@fetchproxy/bootstrap": "^3.6.0",
+    "@fetchproxy/server": "^3.6.0",
     "@modelcontextprotocol/server": "^2.3.0",
     dotenv: "^18.0.0",
     zod: "^4.6.5"
@@ -68724,12 +68911,6 @@ async function responseEdgeBlock(res) {
 }
 
 // node_modules/@chrischall/mcp-utils/dist/healthcheck/index.js
-function statusOf2(err) {
-  if (typeof err !== "object" || err === null)
-    return void 0;
-  const s = err.status ?? err.statusCode;
-  return typeof s === "number" ? s : void 0;
-}
 var CREDENTIAL_ARMS = /* @__PURE__ */ new Set([
   "ok",
   "no_credential",
@@ -68745,6 +68926,9 @@ var CREDENTIAL_ARMS = /* @__PURE__ */ new Set([
 function isArm(kind) {
   return kind !== void 0 && CREDENTIAL_ARMS.has(kind);
 }
+function fromSource(source) {
+  return source !== null ? ` from '${source}'` : "";
+}
 function credentialHint(arm, prefix, hostLabel, source) {
   switch (arm) {
     case "ok":
@@ -68752,15 +68936,15 @@ function credentialHint(arm, prefix, hostLabel, source) {
     case "no_credential":
       return `No credential resolved. Nothing was available to authenticate with \u2014 sign in and reconnect the connector so ${prefix} receives a token, or set the documented environment variable.`;
     case "credential_rejected":
-      return `${hostLabel} rejected the credential from '${source}'. It is present but no longer valid \u2014 most often expired or revoked upstream. Re-authenticate and reconnect; retrying will not fix it.`;
+      return `${hostLabel} rejected the credential${fromSource(source)}. It is present but no longer valid \u2014 most often expired or revoked upstream. Re-authenticate and reconnect; retrying will not fix it.`;
     case "edge_blocked":
       return `${hostLabel} refused the request at its CDN/WAF before it reached the API, so the credential${source !== null ? ` from '${source}'` : ""} was never judged \u2014 re-signing in or rotating it will not help. This is usually a block on this host's IP address or request fingerprint: route through the ContextMint Bridge if this connector supports it, or retry later from a different network.`;
     case "session_expired":
-      return `The credential from '${source}' is configured, but no session is live \u2014 ${hostLabel} served a sign-in page rather than the data. Sign in again; a cookie-session portal expires these on its own, so this recurs between uses.`;
+      return `The credential${fromSource(source)} is configured, but no session is live \u2014 ${hostLabel} served a sign-in page rather than the data. Sign in again; a cookie-session portal expires these on its own, so this recurs between uses.`;
     case "verification_pending":
       return `${hostLabel} is holding the sign-in on a second factor rather than refusing it. Supply the verification code the ACCOUNT HOLDER received \u2014 the credential itself is not the problem, so changing it will not help.`;
     case "timeout":
-      return `The credential from '${source}' resolved, but ${hostLabel} did not answer in time. Usually transient \u2014 retry. If it persists, ${hostLabel} is slow or unreachable from here.`;
+      return `${source !== null ? `The credential from '${source}' resolved, but ` : ""}${hostLabel} did not answer in time. Usually transient \u2014 retry. If it persists, ${hostLabel} is slow or unreachable from here.`;
     case "http":
       return `${hostLabel} answered with an error status that is not an auth rejection. That is USUALLY a ${hostLabel}-side problem rather than an auth one \u2014 but a 404 here more often means the probe path is wrong than that ${hostLabel} is broken, so check error.message and probe.url before concluding anything about the credential.`;
     case "transport":
@@ -68781,7 +68965,8 @@ async function runCredentialHealthcheck(args) {
     state = await resolveCredential();
   } catch (e) {
     const edge = edgeBlockOf(e);
-    const classified = classifyThrown?.(e) ?? (edge !== null ? { kind: "edge_blocked", detail: { vendor: edge.vendor } } : void 0);
+    const declared = errorKindOf(e);
+    const classified = classifyThrown?.(e) ?? (edge !== null ? { kind: "edge_blocked", detail: { vendor: edge.vendor } } : declared !== void 0 ? { kind: declared } : void 0);
     const result2 = {
       ok: false,
       // Still false, and still no source: a classification explains WHY
@@ -68828,10 +69013,11 @@ async function runCredentialHealthcheck(args) {
   try {
     await probeFn();
   } catch (e) {
-    status = statusOf2(e);
+    status = errorStatusOf(e);
     const aborted2 = e instanceof Error && e.name === "AbortError";
     const edge = edgeBlockOf(e);
-    arm = edge !== null ? "edge_blocked" : status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
+    const declared = errorKindOf(e);
+    arm = edge !== null ? "edge_blocked" : declared !== void 0 ? declared : status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
     let kind = arm;
     let detail = edge !== null ? { vendor: edge.vendor } : void 0;
     const custom2 = classifyThrown?.(e);
@@ -68877,9 +69063,35 @@ function registerCredentialHealthcheckTool(args) {
   }, async () => runCredentialHealthcheck(args));
 }
 
+// src/tools/healthcheck.ts
+function registerHealthcheckTools(server, state) {
+  registerCredentialHealthcheckTool({
+    server,
+    prefix: "canvas",
+    hostLabel: "canvas",
+    probePath: "/api/v1/users/self/profile",
+    resolveCredential: async () => {
+      if (!state.resolved) {
+        throw state.configError ?? new Error("Canvas auth is not configured.");
+      }
+      return {
+        source: state.resolved.source,
+        detail: {
+          base_url: state.resolved.account.baseUrl,
+          mode: state.resolved.account.mode
+        }
+      };
+    },
+    probeFn: async () => {
+      if (!state.client) throw new Error("Canvas client is not initialised.");
+      return state.client.request("/api/v1/users/self/profile");
+    }
+  });
+}
+
 // src/client.ts
 import { constants as fsConstants3 } from "fs";
-import { lstat as lstat2, open as open2, stat } from "fs/promises";
+import { lstat as lstat2, open as open2, rm as rm3, stat } from "fs/promises";
 
 // node_modules/@chrischall/mcp-utils/dist/session/index.js
 import { existsSync as existsSync4, readFileSync as readFileSync2, mkdirSync as mkdirSync3, chmodSync as chmodSync2, renameSync as renameSync2, unlinkSync as unlinkSync3 } from "node:fs";
@@ -69434,6 +69646,12 @@ function reportCacheWriteFailure(err) {
 import { dirname as dirname4, isAbsolute as isAbsolute5, join as join6, resolve as resolve4 } from "path";
 import { homedir as homedir4 } from "os";
 
+// src/signal.ts
+var REQUEST_TIMEOUT_MS = 3e4;
+function requestSignal(timeoutMs = REQUEST_TIMEOUT_MS) {
+  return withAmbientCancellation(AbortSignal.timeout(timeoutMs));
+}
+
 // src/session-login.ts
 var USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36";
 var SessionLoginError = class extends Error {
@@ -69465,6 +69683,7 @@ async function sessionLogin(opts) {
   const baseUrl = opts.baseUrl.replace(/\/$/, "");
   const loginUrl = `${baseUrl}/login/canvas`;
   const getRes = await fetch(loginUrl, {
+    signal: requestSignal(),
     headers: {
       "User-Agent": USER_AGENT,
       Accept: "text/html,application/xhtml+xml"
@@ -69495,6 +69714,7 @@ async function sessionLogin(opts) {
   body.append("pseudonym_session[remember_me]", "1");
   const postRes = await fetch(loginUrl, {
     method: "POST",
+    signal: requestSignal(),
     redirect: "manual",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded",
@@ -69526,6 +69746,8 @@ async function sessionLogin(opts) {
 // src/client.ts
 var DEFAULT_PER_PAGE = 100;
 var DEFAULT_MAX_PAGES = 50;
+var DOWNLOAD_TIMEOUT_MS = 10 * 6e4;
+var MAX_DOWNLOAD_BYTES = 1024 ** 3;
 var CanvasClient = class {
   account;
   sessionLoginFn;
@@ -69536,6 +69758,7 @@ var CanvasClient = class {
   refreshSession;
   /** Explicit download root; when unset, resolved per call (see {@link downloadRoot}). */
   outputDir;
+  maxDownloadBytes;
   auth;
   /** Lazily-built shared refresh_token exchanger (oauth mode only). */
   oauthRefresh = null;
@@ -69552,6 +69775,7 @@ var CanvasClient = class {
   constructor(account, opts = {}) {
     this.account = account;
     this.outputDir = opts.outputDir;
+    this.maxDownloadBytes = opts.maxDownloadBytes ?? MAX_DOWNLOAD_BYTES;
     this.sessionLoginFn = opts.sessionLogin ?? sessionLogin;
     this.refreshSession = opts.refreshSession ?? null;
     this.auth = new CookieSessionManager({
@@ -69607,6 +69831,10 @@ var CanvasClient = class {
    *  - `destinationPath` must lie inside the download root (see
    *    {@link downloadRoot}), checked through symlinks; a relative path is
    *    resolved against that root.
+   *
+   * The body is streamed to disk (never buffered whole) and capped at
+   * `maxDownloadBytes`; a transfer that fails or overruns part-way leaves no
+   * partial file behind.
    */
   async download(path, destinationPath, opts = {}) {
     const url4 = this.pinDownloadUrl(path);
@@ -69625,16 +69853,25 @@ var CanvasClient = class {
     } catch {
       throw new ParentDirectoryMissingError(parent);
     }
-    const res = await this.authedFetch(url4, {});
+    const res = await this.authedFetch(url4, {}, DOWNLOAD_TIMEOUT_MS);
     await throwIfEdgeBlocked(res, "GET", path);
-    if (res.status === 401) throw new TokenExpiredError(this.account.mode);
-    if (res.status === 404) throw new Error(`Canvas download 404 for ${path}`);
-    if (!res.ok) throw new Error(`Canvas download ${res.status} for ${path}`);
-    const buf = new Uint8Array(await res.arrayBuffer());
-    await writeConfined(dest, destinationPath, buf, opts.overwrite === true);
+    if (res.status === 401) throw this.expiredError();
+    if (res.status === 404) throw new Error(`Canvas download 404 for ${redactPath(path)}`);
+    if (!res.ok) throw new Error(`Canvas download ${res.status} for ${redactPath(path)}`);
+    if (Number(res.headers.get("content-length")) > this.maxDownloadBytes) {
+      await res.body?.cancel();
+      throw new DownloadTooLargeError(this.maxDownloadBytes);
+    }
+    const bytes = await writeConfined(
+      dest,
+      destinationPath,
+      res.body,
+      opts.overwrite === true,
+      this.maxDownloadBytes
+    );
     return {
       path: dest,
-      bytes: buf.byteLength,
+      bytes,
       contentType: res.headers.get("content-type") ?? "application/octet-stream"
     };
   }
@@ -69682,10 +69919,10 @@ var CanvasClient = class {
       body: opts.body
     });
     await throwIfEdgeBlocked(res, opts.method ?? "GET", path);
-    if (res.status === 401) throw new TokenExpiredError(this.account.mode);
-    if (res.status === 404) throw new Error(`Canvas 404 ${path}`);
+    if (res.status === 401) throw this.expiredError();
+    if (res.status === 404) throw new Error(`Canvas 404 ${redactPath(path)}`);
     if (res.status >= 500) throw new CanvasUnreachableError(res.status);
-    if (!res.ok) throw withBodyPreview(new Error(`Canvas ${res.status} ${res.statusText} for ${path}`), await res.text());
+    if (!res.ok) throw withBodyPreview(new Error(`Canvas ${res.status} ${res.statusText} for ${redactPath(path)}`), await res.text());
     return res;
   }
   /**
@@ -69697,12 +69934,14 @@ var CanvasClient = class {
    * download callers map that to a {@link TokenExpiredError}. Used by both API
    * requests and file downloads.
    */
-  async authedFetch(url4, init) {
+  async authedFetch(url4, init, timeoutMs) {
     this.proactivelyExpire();
     return this.auth.withSession(
       async (state) => fetch(url4, {
         ...init,
-        headers: { ...state.headers, ...init.headers }
+        headers: { ...state.headers, ...init.headers },
+        // Fresh per attempt, so a 401 replay gets its own full timeout.
+        signal: requestSignal(timeoutMs)
       })
     );
   }
@@ -69720,6 +69959,14 @@ var CanvasClient = class {
       this.auth.invalidate();
     }
   }
+  /**
+   * The error for a 401 that survived any re-auth. On the fetchproxy path the
+   * session came from the browser and the user never set CANVAS_USERNAME /
+   * CANVAS_PASSWORD, so the message must point at the browser instead.
+   */
+  expiredError() {
+    return new TokenExpiredError(this.account.mode, void 0, { browser: this.refreshSession !== null });
+  }
   /** Whether a 401 in the current mode can be recovered by re-running login(). */
   canReauth() {
     const acct = this.account;
@@ -69762,7 +70009,8 @@ var CanvasClient = class {
     this.oauthRefresh ??= createOAuth2Refresher({
       endpoint: `${acct.baseUrl}/login/oauth2/token`,
       refreshToken: acct.refreshToken,
-      params: { client_id: acct.clientId, client_secret: acct.clientSecret }
+      params: { client_id: acct.clientId, client_secret: acct.clientSecret },
+      fetchImpl: (input2, init) => fetch(input2, { ...init, signal: requestSignal() })
     });
     let accessToken;
     let expiresIn;
@@ -69806,8 +70054,12 @@ function injectPerPage(pathOrUrl, perPage) {
   return `${pathOrUrl}${sep2}per_page=${perPage}`;
 }
 var TokenExpiredError = class extends Error {
-  constructor(mode, detail) {
-    const base = mode === "token" ? "Canvas access token rejected (401). Check CANVAS_TOKEN \u2014 it may be expired or revoked." : mode === "session" ? "Canvas session login failed (401). Check CANVAS_USERNAME / CANVAS_PASSWORD \u2014 they may have changed, or the account may be locked or behind SSO." : "Canvas OAuth refresh failed. Check CANVAS_CLIENT_ID, CANVAS_CLIENT_SECRET, CANVAS_REFRESH_TOKEN.";
+  /**
+   * `opts.browser`: the session was lifted from the user's signed-in browser
+   * tab (the fetchproxy path), not minted from CANVAS_USERNAME/PASSWORD.
+   */
+  constructor(mode, detail, opts = {}) {
+    const base = mode === "token" ? "Canvas access token rejected (401). Check CANVAS_TOKEN \u2014 it may be expired or revoked." : mode === "session" ? opts.browser ? "Canvas rejected the session read from your browser (401). Sign back into Canvas in your browser (the tab the ContextMint Bridge extension reads), then retry." : "Canvas session login failed (401). Check CANVAS_USERNAME / CANVAS_PASSWORD \u2014 they may have changed, or the account may be locked or behind SSO." : "Canvas OAuth refresh failed. Check CANVAS_CLIENT_ID, CANVAS_CLIENT_SECRET, CANVAS_REFRESH_TOKEN.";
     super(detail ? `${base} (${detail})` : base);
     this.mode = mode;
     this.detail = detail;
@@ -69832,6 +70084,14 @@ var DownloadUrlRejectedError = class extends Error {
   }
   url;
 };
+var DownloadTooLargeError = class extends Error {
+  constructor(maxBytes) {
+    super(`DownloadTooLarge: the file is larger than the ${maxBytes} bytes canvas_download_file accepts.`);
+    this.maxBytes = maxBytes;
+    this.name = "DownloadTooLargeError";
+  }
+  maxBytes;
+};
 var DownloadDestinationRejectedError = class extends Error {
   constructor(path, root) {
     super(
@@ -69844,7 +70104,7 @@ var DownloadDestinationRejectedError = class extends Error {
   path;
   root;
 };
-async function writeConfined(dest, requested, buf, overwrite) {
+async function writeConfined(dest, requested, body, overwrite, maxBytes) {
   const { O_WRONLY: O_WRONLY2, O_CREAT: O_CREAT2, O_TRUNC: O_TRUNC2, O_EXCL: O_EXCL2, O_NOFOLLOW: O_NOFOLLOW3 } = fsConstants3;
   const flags = O_WRONLY2 | O_CREAT2 | O_NOFOLLOW3 | (overwrite ? O_TRUNC2 : O_EXCL2);
   let handle;
@@ -69857,11 +70117,22 @@ async function writeConfined(dest, requested, buf, overwrite) {
     if (code === "EISDIR") throw new InvalidPathError(requested);
     throw e;
   }
+  let bytes = 0;
   try {
-    await handle.writeFile(buf);
-  } finally {
+    if (body) {
+      for await (const chunk2 of body) {
+        bytes += chunk2.byteLength;
+        if (bytes > maxBytes) throw new DownloadTooLargeError(maxBytes);
+        await handle.write(chunk2);
+      }
+    }
+  } catch (e) {
     await handle.close();
+    await rm3(dest, { force: true });
+    throw e;
   }
+  await handle.close();
+  return bytes;
 }
 var InvalidPathError = class extends Error {
   constructor(path, reason = "must be a filename, not a directory") {
@@ -69888,34 +70159,6 @@ var FileExistsError = class extends Error {
   path;
 };
 
-// src/tools/healthcheck.ts
-function registerHealthcheckTools(server, state) {
-  registerCredentialHealthcheckTool({
-    server,
-    prefix: "canvas",
-    hostLabel: "canvas",
-    probePath: "/api/v1/users/self/profile",
-    resolveCredential: async () => {
-      if (!state.resolved) {
-        throw state.configError ?? new Error("Canvas auth is not configured.");
-      }
-      return {
-        source: state.resolved.source,
-        detail: {
-          base_url: state.resolved.account.baseUrl,
-          mode: state.resolved.account.mode
-        }
-      };
-    },
-    probeFn: async () => {
-      const client = new CanvasClient(state.resolved.account, {
-        refreshSession: state.resolved.refresh
-      });
-      return client.request("/api/v1/users/self/profile");
-    }
-  });
-}
-
 // src/view.ts
 var CV_VIEWS = ["compact", "full"];
 var NOTE = `compact removes the avatar URLs Canvas attaches to user objects (avatar_url, avatar_image_url); "full" returns Canvas's payload untouched. Link fields (url, html_url, preview_url) survive both rungs. No field projection: this server passes Canvas's payload through verbatim and has no verified record of which of its fields a caller needs.`;
@@ -69931,14 +70174,14 @@ function viewResponse(view, data) {
 var argsSchema = external_exports.object({
   view: viewArg()
 });
-function registerProfileTools(server, client) {
+function registerProfileTools(server, client2) {
   server.registerTool("canvas_get_profile", {
     description: "Get the logged-in user's Canvas profile (id, name, primary_email, login_id, locale, time_zone). Useful first call to confirm credentials.",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: argsSchema
   }, async (rawArgs) => {
     const args = argsSchema.parse(rawArgs);
-    const data = await client.request("/api/v1/users/self/profile");
+    const data = await client2.request("/api/v1/users/self/profile");
     return viewResponse(args.view, data);
   });
 }
@@ -69947,14 +70190,14 @@ function registerProfileTools(server, client) {
 var argsSchema2 = external_exports.object({
   view: viewArg()
 });
-function registerObserveeTools(server, client) {
+function registerObserveeTools(server, client2) {
   server.registerTool("canvas_list_observees", {
     description: "List students linked to your Canvas observer account. Returns an empty array for plain student tokens.",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: argsSchema2
   }, async (rawArgs) => {
     const args = argsSchema2.parse(rawArgs);
-    const data = await client.requestPaginated("/api/v1/users/self/observees?include[]=avatar_url");
+    const data = await client2.requestPaginated("/api/v1/users/self/observees?include[]=avatar_url");
     return viewResponse(args.view, data);
   });
 }
@@ -69976,10 +70219,10 @@ var getArgs = external_exports.object({
   courseId: external_exports.string(),
   view: viewArg()
 });
-function registerCourseTools(server, client) {
+function registerCourseTools(server, client2) {
   server.registerTool("canvas_list_courses", {
     description: "List active Canvas courses (with course-level grades, total scores, current grading period scores, and term).",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: listArgs
   }, async (rawArgs) => {
     const args = listArgs.parse(rawArgs);
@@ -69988,19 +70231,19 @@ function registerCourseTools(server, client) {
       "state[]": "available",
       "include[]": ["total_scores", "current_grading_period_scores", "term"]
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return textContent(data);
   });
   server.registerTool("canvas_get_course", {
     description: "Get a single Canvas course with its syllabus, teachers, and term.",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: getArgs
   }, async (rawArgs) => {
     const args = getArgs.parse(rawArgs);
     const path = buildPath(`/api/v1/courses/${encodeURIComponent(args.courseId)}`, {
       "include[]": ["syllabus_body", "teachers", "term"]
     });
-    const data = await client.request(path);
+    const data = await client2.request(path);
     return viewResponse(args.view, data);
   });
 }
@@ -70011,13 +70254,13 @@ var listArgs2 = external_exports.object({
   bucket: external_exports.enum(["past", "overdue", "undated", "ungraded", "unsubmitted", "upcoming", "future"]).optional().describe("Optional Canvas-side filter.")
 });
 var missingArgs = external_exports.object({
-  observeeId: external_exports.string().optional(),
-  courseIds: external_exports.array(external_exports.string()).optional().describe("Required when observeeId is set.")
+  observeeId: external_exports.string().optional().describe("A linked observee's user id. When set, courseIds is required."),
+  courseIds: external_exports.array(external_exports.string()).optional().describe("Required (non-empty) when observeeId is set; optional otherwise.")
 });
-function registerAssignmentTools(server, client) {
+function registerAssignmentTools(server, client2) {
   server.registerTool("canvas_list_assignments", {
     description: "List a course's assignments (with the user's submission inline). Supports the standard Canvas `bucket` filter.",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: listArgs2
   }, async (rawArgs) => {
     const args = listArgs2.parse(rawArgs);
@@ -70026,21 +70269,24 @@ function registerAssignmentTools(server, client) {
       bucket: args.bucket,
       order_by: "due_at"
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return textContent(data);
   });
   server.registerTool("canvas_list_missing_submissions", {
     description: "List past-due unsubmitted assignments for the user (or a linked observee). For an observee, courseIds is required.",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: missingArgs
   }, async (rawArgs) => {
     const args = missingArgs.parse(rawArgs);
+    if (args.observeeId !== void 0 && !args.courseIds?.length) {
+      throw new Error("courseIds is required when observeeId is set (list the observee's courses with canvas_list_courses).");
+    }
     const path = buildPath(`/api/v1/${userSegment(args.observeeId)}/missing_submissions`, {
       "include[]": ["planner_overrides", "course"],
       "filter[]": "submittable",
       "course_ids[]": args.courseIds
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return textContent(data);
   });
 }
@@ -70058,10 +70304,10 @@ var recentArgs = external_exports.object({
   since: external_exports.string().optional().describe("ISO 8601 timestamp; defaults to 14 days ago."),
   view: viewArg()
 });
-function registerSubmissionTools(server, client) {
+function registerSubmissionTools(server, client2) {
   server.registerTool("canvas_get_submission", {
     description: "Get a single submission with rubric assessment and grader comments. userId defaults to 'self'.",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: getArgs2
   }, async (rawArgs) => {
     const args = getArgs2.parse(rawArgs);
@@ -70070,12 +70316,12 @@ function registerSubmissionTools(server, client) {
       `/api/v1/courses/${encodeURIComponent(args.courseId)}/assignments/${encodeURIComponent(args.assignmentId)}/submissions/${encodeURIComponent(userId)}`,
       { "include[]": ["submission_comments", "rubric_assessment", "assignment"] }
     );
-    const data = await client.request(path);
+    const data = await client2.request(path);
     return viewResponse(args.view, data);
   });
   server.registerTool("canvas_list_recent_submissions", {
     description: "List recently graded submissions in a course. Defaults to a 14-day window for the calling user.",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: recentArgs
   }, async (rawArgs) => {
     const args = recentArgs.parse(rawArgs);
@@ -70087,7 +70333,7 @@ function registerSubmissionTools(server, client) {
       graded_since: since,
       "include[]": ["assignment", "submission_comments"]
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return viewResponse(args.view, data);
   });
 }
@@ -70096,10 +70342,10 @@ function registerSubmissionTools(server, client) {
 var argsSchema3 = external_exports.object({
   observeeId: external_exports.string().optional()
 });
-function registerGradeTools(server, client) {
+function registerGradeTools(server, client2) {
   server.registerTool("canvas_list_enrollments", {
     description: "List active student enrollments with per-course grades (current_score, final_score, current_grade, final_grade, current grading period info).",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: argsSchema3
   }, async (rawArgs) => {
     const args = argsSchema3.parse(rawArgs);
@@ -70108,7 +70354,7 @@ function registerGradeTools(server, client) {
       "type[]": "StudentEnrollment",
       "include[]": ["current_points", "grades"]
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return textContent(data);
   });
 }
@@ -70121,10 +70367,10 @@ var eventsArgs = external_exports.object({
   endDate: external_exports.string().optional(),
   allEvents: external_exports.boolean().optional()
 });
-function registerCalendarTools(server, client) {
+function registerCalendarTools(server, client2) {
   server.registerTool("canvas_list_calendar_events", {
     description: "List Canvas calendar events or assignments across selected contexts (courses/users).",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: eventsArgs
   }, async (rawArgs) => {
     const args = eventsArgs.parse(rawArgs);
@@ -70135,14 +70381,14 @@ function registerCalendarTools(server, client) {
       "context_codes[]": args.contextCodes,
       all_events: args.allEvents
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return textContent(data);
   });
   server.registerTool("canvas_list_upcoming_events", {
     description: "List the calling user's upcoming events (Canvas's curated next-7-days view).",
-    annotations: { readOnlyHint: true }
+    annotations: { readOnlyHint: true, openWorldHint: true }
   }, async () => {
-    const data = await client.request("/api/v1/users/self/upcoming_events");
+    const data = await client2.request("/api/v1/users/self/upcoming_events");
     return textContent(data);
   });
 }
@@ -70155,10 +70401,10 @@ var argsSchema4 = external_exports.object({
   contextCodes: external_exports.array(external_exports.string()).optional(),
   filter: external_exports.enum(["new_activity"]).optional()
 });
-function registerPlannerTools(server, client) {
+function registerPlannerTools(server, client2) {
   server.registerTool("canvas_list_planner_items", {
     description: "List planner items (assignments + announcements + planner notes + calendar events) for the user or a linked observee.",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: argsSchema4
   }, async (rawArgs) => {
     const args = argsSchema4.parse(rawArgs);
@@ -70169,7 +70415,7 @@ function registerPlannerTools(server, client) {
       "context_codes[]": args.contextCodes,
       filter: args.filter
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return textContent(data);
   });
 }
@@ -70182,10 +70428,10 @@ var argsSchema5 = external_exports.object({
   activeOnly: external_exports.boolean().optional(),
   view: viewArg()
 });
-function registerAnnouncementTools(server, client) {
+function registerAnnouncementTools(server, client2) {
   server.registerTool("canvas_list_announcements", {
     description: 'List announcements across one or more courses. `contextCodes` is required (e.g. ["course_123"]). Defaults to active-only.',
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: argsSchema5
   }, async (rawArgs) => {
     const args = argsSchema5.parse(rawArgs);
@@ -70195,7 +70441,7 @@ function registerAnnouncementTools(server, client) {
       end_date: args.endDate,
       active_only: args.activeOnly ?? true
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return viewResponse(args.view, data);
   });
 }
@@ -70210,10 +70456,10 @@ var getArgs3 = external_exports.object({
   id: external_exports.string(),
   view: viewArg()
 });
-function registerConversationTools(server, client) {
+function registerConversationTools(server, client2) {
   server.registerTool("canvas_list_conversations", {
     description: "List Canvas inbox conversations. Optional `scope` (unread/starred/archived/sent) and `filter` (array of context codes).",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: listArgs3
   }, async (rawArgs) => {
     const args = listArgs3.parse(rawArgs);
@@ -70222,12 +70468,12 @@ function registerConversationTools(server, client) {
       "filter[]": args.filter,
       "include[]": ["participant_avatars"]
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return viewResponse(args.view, data);
   });
   server.registerTool("canvas_get_conversation", {
     description: "Get a full Canvas conversation thread with all messages. Read-only: does not mark the conversation as read.",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: getArgs3
   }, async (rawArgs) => {
     const args = getArgs3.parse(rawArgs);
@@ -70235,7 +70481,7 @@ function registerConversationTools(server, client) {
       auto_mark_as_read: false,
       "include[]": ["participant_avatars"]
     });
-    const data = await client.request(path);
+    const data = await client2.request(path);
     return viewResponse(args.view, data);
   });
 }
@@ -70247,10 +70493,10 @@ var argsSchema6 = external_exports.object({
   orderBy: external_exports.enum(["position", "recent_activity", "title"]).optional(),
   view: viewArg()
 });
-function registerDiscussionTools(server, client) {
+function registerDiscussionTools(server, client2) {
   server.registerTool("canvas_list_discussion_topics", {
     description: "List discussion topics for a course (read-only).",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: argsSchema6
   }, async (rawArgs) => {
     const args = argsSchema6.parse(rawArgs);
@@ -70258,7 +70504,7 @@ function registerDiscussionTools(server, client) {
       only_announcements: args.onlyAnnouncements ?? false,
       order_by: args.orderBy
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return viewResponse(args.view, data);
   });
 }
@@ -70274,10 +70520,10 @@ var downloadArgs = external_exports.object({
   destinationPath: external_exports.string().describe("Where to write the file. Must be inside the download directory (CANVAS_OUTPUT_DIR, default ~/Downloads); a relative path is resolved against it."),
   overwrite: external_exports.boolean().optional()
 });
-function registerFileTools(server, client) {
+function registerFileTools(server, client2) {
   server.registerTool("canvas_list_course_files", {
     description: "List a course's files (metadata only \u2014 use canvas_download_file with the `url` field).",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: true, openWorldHint: true },
     inputSchema: listArgs4
   }, async (rawArgs) => {
     const args = listArgs4.parse(rawArgs);
@@ -70285,16 +70531,16 @@ function registerFileTools(server, client) {
       search_term: args.searchTerm,
       "content_types[]": args.contentTypes
     });
-    const data = await client.requestPaginated(path);
+    const data = await client2.requestPaginated(path);
     return textContent(data);
   });
   server.registerTool("canvas_download_file", {
     description: "Download a Canvas file to disk. `url` is the absolute URL from canvas_list_course_files (only file URLs on the configured Canvas host are accepted); `destinationPath` is required and must be inside the download directory (CANVAS_OUTPUT_DIR, default ~/Downloads).",
-    annotations: { destructiveHint: true, openWorldHint: true },
+    annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     inputSchema: downloadArgs
   }, async (rawArgs) => {
     const args = downloadArgs.parse(rawArgs);
-    const meta3 = await client.download(args.url, args.destinationPath, {
+    const meta3 = await client2.download(args.url, args.destinationPath, {
       overwrite: args.overwrite ?? false
     });
     return textContent(meta3);
@@ -70311,19 +70557,17 @@ try {
 } catch (e) {
   configError = e;
 }
+var client = resolved ? new CanvasClient(resolved.account, { refreshSession: resolved.refresh }) : null;
 await runMcp({
   name: "canvas",
-  version: "2.1.7",
+  version: "2.1.9",
   // x-release-please-version
   tools: [
     // Outside the `if (resolved)` on purpose: an unconfigured server must
     // still expose something that can say WHY (see the tool's docblock).
-    (server) => registerHealthcheckTools(server, { resolved, configError }),
+    (server) => registerHealthcheckTools(server, { resolved, configError, client }),
     (server) => {
-      if (resolved) {
-        const client = new CanvasClient(resolved.account, {
-          refreshSession: resolved.refresh
-        });
+      if (resolved && client) {
         registerProfileTools(server, client);
         registerObserveeTools(server, client);
         registerCourseTools(server, client);