infinitecampus-mcp 2.3.6 → 2.4.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Infinite Campus (Campus Parent) — grades, attendance, assignments, messages, documents",
-    "version": "2.3.6"
+    "version": "2.4.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Infinite Campus",
       "source": "./",
       "description": "Infinite Campus (Campus Parent) MCP server for Claude — grades, attendance, assignments, messages, and documents via natural language",
-      "version": "2.3.6",
+      "version": "2.4.2",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "infinitecampus-mcp",
   "displayName": "Infinite Campus",
-  "version": "2.3.6",
+  "version": "2.4.2",
   "description": "Infinite Campus (Campus Parent) MCP server for Claude — grades, attendance, assignments, messages, and documents",
   "author": {
     "name": "Chris Hall",
@@ -18,6 +18,6 @@
     "k12",
     "mcp"
   ],
-  "skills": "./SKILL.md",
+  "skills": "./skills/",
   "mcp": "./.mcp.json"
 }

package/dist/bundle.js

@@ -3776,6 +3776,7 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
+    var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -3805,6 +3806,11 @@ var require_fast_uri = __commonJS({
           uri = "//" + uri;
         }
       }
+      const authorityMatch = uri.match(AUTHORITY_PREFIX);
+      if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+        parsed.error = "URI authority must not contain a literal backslash.";
+        malformedAuthorityOrPort = true;
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
         parsed.scheme = matches[1];
@@ -3848,7 +3854,7 @@ var require_fast_uri = __commonJS({
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
           if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
               parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
             }
@@ -7693,6 +7699,7 @@ var require_receiver = __commonJS({
         this._opcode = 0;
         this._totalPayloadLength = 0;
         this._messageLength = 0;
+        this._numFragments = 0;
         this._fragments = [];
         this._errored = false;
         this._loop = false;
@@ -8043,23 +8050,23 @@ var require_receiver = __commonJS({
           this.controlMessage(data, cb);
           return;
         }
+        if (this._maxFragments > 0 && ++this._numFragments > this._maxFragments) {
+          const error51 = this.createError(
+            RangeError,
+            "Too many message fragments",
+            false,
+            1008,
+            "WS_ERR_TOO_MANY_BUFFERED_PARTS"
+          );
+          cb(error51);
+          return;
+        }
         if (this._compressed) {
           this._state = INFLATING;
           this.decompress(data, cb);
           return;
         }
         if (data.length) {
-          if (this._maxFragments > 0 && this._fragments.length >= this._maxFragments) {
-            const error51 = this.createError(
-              RangeError,
-              "Too many message fragments",
-              false,
-              1008,
-              "WS_ERR_TOO_MANY_BUFFERED_PARTS"
-            );
-            cb(error51);
-            return;
-          }
           this._messageLength = this._totalPayloadLength;
           this._fragments.push(data);
         }
@@ -8089,17 +8096,6 @@ var require_receiver = __commonJS({
               cb(error51);
               return;
             }
-            if (this._maxFragments > 0 && this._fragments.length >= this._maxFragments) {
-              const error51 = this.createError(
-                RangeError,
-                "Too many message fragments",
-                false,
-                1008,
-                "WS_ERR_TOO_MANY_BUFFERED_PARTS"
-              );
-              cb(error51);
-              return;
-            }
             this._fragments.push(buf);
           }
           this.dataMessage(cb);
@@ -8122,6 +8118,7 @@ var require_receiver = __commonJS({
         this._totalPayloadLength = 0;
         this._messageLength = 0;
         this._fragmented = 0;
+        this._numFragments = 0;
         this._fragments = [];
         if (this._opcode === 2) {
           let data;
@@ -9622,8 +9619,8 @@ var require_websocket = __commonJS({
         autoPong: true,
         closeTimeout: CLOSE_TIMEOUT,
         protocolVersion: protocolVersions[1],
-        maxBufferedChunks: 1024 * 1024,
-        maxFragments: 128 * 1024,
+        maxBufferedChunks: 256 * 1024,
+        maxFragments: 16 * 1024,
         maxPayload: 100 * 1024 * 1024,
         skipUTF8Validation: false,
         perMessageDeflate: true,
@@ -10210,9 +10207,9 @@ var require_websocket_server = __commonJS({
        *     called
        * @param {Function} [options.handleProtocols] A hook to handle protocols
        * @param {String} [options.host] The hostname where to bind the server
-       * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+       * @param {Number} [options.maxBufferedChunks=262144] The maximum number of
        *     buffered data chunks
-       * @param {Number} [options.maxFragments=131072] The maximum number of message
+       * @param {Number} [options.maxFragments=16384] The maximum number of message
        *     fragments
        * @param {Number} [options.maxPayload=104857600] The maximum allowed message
        *     size
@@ -10235,8 +10232,8 @@ var require_websocket_server = __commonJS({
         options = {
           allowSynchronousEvents: true,
           autoPong: true,
-          maxBufferedChunks: 1024 * 1024,
-          maxFragments: 128 * 1024,
+          maxBufferedChunks: 256 * 1024,
+          maxFragments: 16 * 1024,
           maxPayload: 100 * 1024 * 1024,
           skipUTF8Validation: false,
           perMessageDeflate: false,
@@ -34845,7 +34842,9 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "capture_request_header",
   "capture_redirect",
   "read_indexed_db",
-  "download"
+  "read_dom",
+  "download",
+  "graphql"
 ]);
 
 // node_modules/@fetchproxy/protocol/dist/mcp-id.js
@@ -35146,6 +35145,76 @@ function assertIndexedDbScopesArray(value, label) {
     }
   }
 }
+var DOM_SELECTOR_RE = /^[^-]{1,512}$/;
+var DOM_ATTRIBUTE_RE = /^[A-Za-z_:][A-Za-z0-9_:.\-]{0,127}$/;
+var GRAPHQL_OP_NAME_RE = /^[_A-Za-z][_0-9A-Za-z]{0,127}$/;
+function assertDomSelectorsArray(value, label) {
+  if (!Array.isArray(value)) {
+    throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < value.length; i++) {
+    const entry = value[i];
+    assertObject(entry, `${label}[${i}]`);
+    if (entry.name === void 0) {
+      throw new ProtocolError(`${label}[${i}].name: missing`);
+    }
+    if (entry.selector === void 0) {
+      throw new ProtocolError(`${label}[${i}].selector: missing`);
+    }
+    if (typeof entry.name !== "string" || !SCOPE_KEY_RE.test(entry.name)) {
+      throw new ProtocolError(`${label}[${i}].name: invalid ${JSON.stringify(entry.name)}`);
+    }
+    if (typeof entry.selector !== "string" || !DOM_SELECTOR_RE.test(entry.selector)) {
+      throw new ProtocolError(`${label}[${i}].selector: invalid ${JSON.stringify(entry.selector)}`);
+    }
+    if (entry.attribute !== void 0) {
+      if (typeof entry.attribute !== "string" || !DOM_ATTRIBUTE_RE.test(entry.attribute)) {
+        throw new ProtocolError(`${label}[${i}].attribute: invalid ${JSON.stringify(entry.attribute)}`);
+      }
+    }
+    if (seen.has(entry.name)) {
+      throw new ProtocolError(`${label}: duplicate name ${JSON.stringify(entry.name)}`);
+    }
+    seen.add(entry.name);
+    for (const k of Object.keys(entry)) {
+      if (k !== "name" && k !== "selector" && k !== "attribute") {
+        throw new ProtocolError(`${label}[${i}]: unexpected field ${JSON.stringify(k)}`);
+      }
+    }
+  }
+}
+function assertGraphqlOpsArray(value, label) {
+  if (!Array.isArray(value)) {
+    throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < value.length; i++) {
+    const entry = value[i];
+    assertObject(entry, `${label}[${i}]`);
+    if (entry.name === void 0) {
+      throw new ProtocolError(`${label}[${i}].name: missing`);
+    }
+    if (entry.operationName === void 0) {
+      throw new ProtocolError(`${label}[${i}].operationName: missing`);
+    }
+    if (typeof entry.name !== "string" || !SCOPE_KEY_RE.test(entry.name)) {
+      throw new ProtocolError(`${label}[${i}].name: invalid ${JSON.stringify(entry.name)}`);
+    }
+    if (typeof entry.operationName !== "string" || !GRAPHQL_OP_NAME_RE.test(entry.operationName)) {
+      throw new ProtocolError(`${label}[${i}].operationName: invalid ${JSON.stringify(entry.operationName)}`);
+    }
+    if (seen.has(entry.name)) {
+      throw new ProtocolError(`${label}: duplicate name ${JSON.stringify(entry.name)}`);
+    }
+    seen.add(entry.name);
+    for (const k of Object.keys(entry)) {
+      if (k !== "name" && k !== "operationName") {
+        throw new ProtocolError(`${label}[${i}]: unexpected field ${JSON.stringify(k)}`);
+      }
+    }
+  }
+}
 function validateFrame(raw) {
   assertObject(raw, "frame");
   const t = raw.type;
@@ -35221,6 +35290,12 @@ function validateHello(raw) {
     if (raw.sessionStoragePointers !== void 0) {
       assertStoragePointersArray(raw.sessionStoragePointers, "hello.sessionStoragePointers", raw.sessionStorageKeys);
     }
+    if (raw.domSelectors !== void 0) {
+      assertDomSelectorsArray(raw.domSelectors, "hello.domSelectors");
+    }
+    if (raw.graphqlOps !== void 0) {
+      assertGraphqlOpsArray(raw.graphqlOps, "hello.graphqlOps");
+    }
     assertBase64(raw.identityX25519Pub, "hello.identityX25519Pub");
     assertBase64(raw.identityEd25519Pub, "hello.identityEd25519Pub");
     assertBase64(raw.sessionNonce, "hello.sessionNonce");
@@ -35455,6 +35530,43 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
+  if (raw.op === "read_dom") {
+    assertObject(raw.init, "inner.init");
+    if (raw.init.origin === void 0)
+      throw new ProtocolError("inner.init.origin: missing");
+    if (raw.init.names === void 0)
+      throw new ProtocolError("inner.init.names: missing");
+    assertHttpsOriginOnly(raw.init.origin, "inner.init.origin");
+    assertNonEmptyKeyArray(raw.init.names, "inner.init.names");
+    for (const k of Object.keys(raw.init)) {
+      if (k !== "origin" && k !== "names") {
+        throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on read_dom`);
+      }
+    }
+    return raw;
+  }
+  if (raw.op === "graphql_query") {
+    assertObject(raw.init, "inner.init");
+    if (raw.init.name === void 0)
+      throw new ProtocolError("inner.init.name: missing");
+    if (raw.init.variables === void 0) {
+      throw new ProtocolError("inner.init.variables: missing");
+    }
+    assertString(raw.init.name, "inner.init.name");
+    if (raw.init.name.length === 0) {
+      throw new ProtocolError("inner.init.name: must be non-empty");
+    }
+    assertObject(raw.init.variables, "inner.init.variables");
+    if (raw.init.tabUrl !== void 0) {
+      assertString(raw.init.tabUrl, "inner.init.tabUrl");
+    }
+    for (const k of Object.keys(raw.init)) {
+      if (k !== "name" && k !== "variables" && k !== "tabUrl") {
+        throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on graphql_query`);
+      }
+    }
+    return raw;
+  }
   if (raw.op === "download") {
     assertObject(raw.init, "inner.init");
     if (raw.init.url === void 0) {
@@ -35480,7 +35592,7 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
-  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "download"; got ${JSON.stringify(raw.op)}`);
+  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download", "graphql_query"; got ${JSON.stringify(raw.op)}`);
 }
 function assertNonEmptyKeyArray(value, label) {
   if (!Array.isArray(value)) {
@@ -35511,6 +35623,10 @@ function assertStringMap(value, label) {
     }
   }
 }
+var KNOWN_RESPONSE_OPS = /* @__PURE__ */ new Set([
+  ...KNOWN_CAPABILITIES,
+  "graphql_query"
+]);
 function validateInnerResponse(raw) {
   assertPositiveInt(raw.id, "inner.id");
   if (raw.ok === true) {
@@ -35565,6 +35681,20 @@ function validateInnerResponse(raw) {
       assertObject(raw.values, "inner.values");
       return raw;
     }
+    if (op === "read_dom") {
+      if (raw.values === void 0) {
+        throw new ProtocolError("inner.values: missing on read_dom response");
+      }
+      assertStringMap(raw.values, "inner.values");
+      return raw;
+    }
+    if (op === "graphql_query") {
+      if (raw.data === void 0) {
+        throw new ProtocolError("inner.data: missing on graphql_query response");
+      }
+      assertObject(raw.data, "inner.data");
+      return raw;
+    }
     if (op === "download") {
       assertObject(raw.value, "inner.value");
       assertString(raw.value.path, "inner.value.path");
@@ -35589,7 +35719,7 @@ function validateInnerResponse(raw) {
   if (raw.ok === false) {
     assertString(raw.error, "inner.error");
     if (raw.op !== void 0) {
-      if (typeof raw.op !== "string" || !KNOWN_CAPABILITIES.has(raw.op)) {
+      if (typeof raw.op !== "string" || !KNOWN_RESPONSE_OPS.has(raw.op)) {
         throw new ProtocolError(`inner.op: unknown response op ${JSON.stringify(raw.op)}`);
       }
     }
@@ -35781,11 +35911,33 @@ async function sealInnerFrame(sessionKey, mcpId, seq, inner) {
   };
 }
 async function openEncryptedFrame(sessionKey, frame) {
-  const iv = fromB64(frame.iv);
-  const ct = fromB64(frame.ciphertext);
-  const pt = await aesGcmOpen(sessionKey, iv, ct);
-  const parsed = JSON.parse(dec.decode(pt));
-  return validateInnerFrame(parsed);
+  const result = await openEncryptedFrameDetailed(sessionKey, frame);
+  if (result.stage === "ok")
+    return result.inner;
+  throw result.error instanceof Error ? result.error : new Error(String(result.error));
+}
+async function openEncryptedFrameDetailed(sessionKey, frame) {
+  let pt;
+  try {
+    const iv = fromB64(frame.iv);
+    const ct = fromB64(frame.ciphertext);
+    pt = await aesGcmOpen(sessionKey, iv, ct);
+  } catch (error51) {
+    return { stage: "decrypt-failed", error: error51 };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(dec.decode(pt));
+  } catch (error51) {
+    return { stage: "validation-failed", error: error51, recoveredId: void 0 };
+  }
+  try {
+    const inner = validateInnerFrame(parsed);
+    return { stage: "ok", inner };
+  } catch (error51) {
+    const recoveredId = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && typeof parsed.id === "number" && Number.isInteger(parsed.id) && parsed.id > 0 ? parsed.id : void 0;
+    return { stage: "validation-failed", error: error51, recoveredId };
+  }
 }
 
 // node_modules/@fetchproxy/server/dist/election.js
@@ -35904,6 +36056,19 @@ async function buildServerHello(opts) {
       jsonPointer: d.jsonPointer
     }));
   }
+  if (opts.domSelectors && opts.domSelectors.length > 0) {
+    hello.domSelectors = opts.domSelectors.map((d) => ({
+      name: d.name,
+      selector: d.selector,
+      ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
+    }));
+  }
+  if (opts.graphqlOps && opts.graphqlOps.length > 0) {
+    hello.graphqlOps = opts.graphqlOps.map((d) => ({
+      name: d.name,
+      operationName: d.operationName
+    }));
+  }
   return hello;
 }
 
@@ -35993,7 +36158,9 @@ async function startHost(opts) {
     captureHeaders: opts.ownCaptureHeaders,
     indexedDbScopes: opts.ownIndexedDbScopes,
     localStoragePointers: opts.ownLocalStoragePointers,
-    sessionStoragePointers: opts.ownSessionStoragePointers
+    sessionStoragePointers: opts.ownSessionStoragePointers,
+    domSelectors: opts.ownDomSelectors,
+    graphqlOps: opts.ownGraphqlOps
   });
   const ownSessionNonce = fromB64(ownHello.sessionNonce);
   let extensionWs = null;
@@ -36228,8 +36395,10 @@ async function startPeer(opts) {
     sessionStorageKeys: opts.sessionStorageKeys,
     captureHeaders: opts.captureHeaders,
     indexedDbScopes: opts.indexedDbScopes,
+    domSelectors: opts.domSelectors,
     localStoragePointers: opts.localStoragePointers,
-    sessionStoragePointers: opts.sessionStoragePointers
+    sessionStoragePointers: opts.sessionStoragePointers,
+    graphqlOps: opts.graphqlOps
   });
   const sessionNonce = fromB64(hello.sessionNonce);
   ws.send(JSON.stringify(hello));
@@ -36273,10 +36442,20 @@ async function startPeer(opts) {
           return;
         if (!session.acceptInboundSeq(frame.seq))
           return;
-        try {
-          const inner = await openEncryptedFrame(session.sessionKey, frame);
-          innerListeners.forEach((cb) => cb(inner));
-        } catch {
+        const result = await openEncryptedFrameDetailed(session.sessionKey, frame);
+        if (result.stage === "ok") {
+          innerListeners.forEach((cb) => cb(result.inner));
+        } else if (result.stage === "decrypt-failed") {
+        } else {
+          console.error("[fetchproxy] peer: received a frame that decrypted OK but failed validation:", result.error);
+          if (result.recoveredId !== void 0) {
+            innerListeners.forEach((cb) => cb({
+              type: "response",
+              id: result.recoveredId,
+              ok: false,
+              error: `malformed response failed protocol validation: ${String(result.error)}`
+            }));
+          }
         }
       }
     } catch (e) {
@@ -36553,6 +36732,10 @@ var FetchproxyServer = class {
   pendingIdb = /* @__PURE__ */ new Map();
   // download awaiters resolve the saved-file metadata (path + size + mime).
   pendingDownload = /* @__PURE__ */ new Map();
+  // 1.x+: graphql_query awaiters resolve the GraphQL `data` object. Its
+  // shape is operation-specific, so the awaiter resolves `unknown` and the
+  // caller narrows.
+  pendingGraphql = /* @__PURE__ */ new Map();
   mcpId = null;
   identity = null;
   // 0.5.3+: in-flight role-election / handle-start promise. Set the
@@ -36635,6 +36818,15 @@ var FetchproxyServer = class {
         key: d.key,
         jsonPointer: d.jsonPointer
       })),
+      domSelectors: (opts.domSelectors ?? []).map((d) => ({
+        name: d.name,
+        selector: d.selector,
+        ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
+      })),
+      graphqlOps: (opts.graphqlOps ?? []).map((d) => ({
+        name: d.name,
+        operationName: d.operationName
+      })),
       // 0.8.0+: timer + lazy-revive default to ON. Every realty MCP
       // adapter was about to set these to the same numbers anyway; the
       // back-door is `0` (explicit opt-out) if a caller genuinely wants
@@ -36755,6 +36947,8 @@ var FetchproxyServer = class {
         ownIndexedDbScopes: this.opts.indexedDbScopes,
         ownLocalStoragePointers: this.opts.localStoragePointers,
         ownSessionStoragePointers: this.opts.sessionStoragePointers,
+        ownDomSelectors: this.opts.domSelectors,
+        ownGraphqlOps: this.opts.graphqlOps,
         onPairCode: this.opts.onPairCode
       });
       this.hostHandle.onOwnInner((inner) => this.onInner(inner));
@@ -36782,7 +36976,9 @@ var FetchproxyServer = class {
         captureHeaders: this.opts.captureHeaders,
         indexedDbScopes: this.opts.indexedDbScopes,
         localStoragePointers: this.opts.localStoragePointers,
-        sessionStoragePointers: this.opts.sessionStoragePointers
+        sessionStoragePointers: this.opts.sessionStoragePointers,
+        domSelectors: this.opts.domSelectors,
+        graphqlOps: this.opts.graphqlOps
       });
       this.peerHandle.onInner((inner) => this.onInner(inner));
       this.peerHandle.onRenegotiate(() => {
@@ -36988,6 +37184,7 @@ var FetchproxyServer = class {
         this.pendingRedirect.delete(id);
         this.pendingDownload.delete(id);
         this.pendingIdb.delete(id);
+        this.pendingGraphql.delete(id);
       }
       throw err;
     }
@@ -37757,6 +37954,92 @@ var FetchproxyServer = class {
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
   }
+  /**
+   * 1.4.0+: read declared DOM values from the user's signed-in tab.
+   * Requires `'read_dom'` in capabilities AND every requested `name` to
+   * match a declared `domSelectors` entry. The extension reads each
+   * declared selector from the matched tab's DOM (isolated-world
+   * `querySelector`, value or attribute) — no page-JS execution.
+   *
+   * Returns a `Record<string, string>` of `name → value`, with names
+   * whose element (or attribute) was absent omitted. Throws
+   * `FetchproxyProtocolError` on bridge failures and a plain `Error` on
+   * developer mistakes (undeclared capability, undeclared name).
+   */
+  async readDom(opts) {
+    if (!this.opts.capabilities.includes("read_dom")) {
+      throw new Error('FetchproxyServer.readDom(): MCP did not declare "read_dom" in capabilities');
+    }
+    await this.ensureConnected();
+    this.throwIfPendingPair();
+    if (!Array.isArray(opts.names) || opts.names.length === 0) {
+      throw new Error("FetchproxyServer.readDom: opts.names must be a non-empty array");
+    }
+    this.assertScopeSubset(opts.names, this.opts.domSelectors.map((d) => d.name), "domSelectors");
+    if (opts.subdomain !== void 0)
+      assertSubdomainLabel(opts.subdomain);
+    const baseDomain = this.resolveBaseDomain(opts.domain);
+    const host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
+    const origin = `https://${host}`;
+    const id = this.nextRequestId++;
+    const inner = {
+      type: "request",
+      id,
+      op: "read_dom",
+      init: { origin, names: [...opts.names] }
+    };
+    const pending = new Promise((resolve, reject) => {
+      this.pendingStorage.set(id, { resolve, reject });
+    });
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
+  }
+  /**
+   * 1.x+: run a declared GraphQL operation through the page's own Apollo
+   * client (`window.__APOLLO_CLIENT__`) in the signed-in tab's MAIN world.
+   * Requires `'graphql'` in capabilities AND `name` to match a declared
+   * `graphqlOps` entry. The extension resolves `name` → `operationName` →
+   * the live DocumentNode the page already observed, then invokes
+   * `client.query({ query, variables })` — the site's own request path, so
+   * per-request bot telemetry (Akamai etc.) runs automatically.
+   *
+   * Returns the GraphQL `data` object on success (shape is
+   * operation-specific; the caller narrows). Throws a plain `Error` on
+   * developer mistakes (undeclared capability, undeclared name) and a
+   * descriptive `Error` on the `ok:false` bridge path — which includes the
+   * typed "operation not yet observed on this tab" case (open the site's
+   * page and retry).
+   */
+  async graphqlQuery(opts) {
+    if (!this.opts.capabilities.includes("graphql")) {
+      throw new Error('FetchproxyServer.graphqlQuery(): MCP did not declare "graphql" in capabilities');
+    }
+    if (typeof opts.name !== "string" || opts.name.length === 0) {
+      throw new Error("FetchproxyServer.graphqlQuery: opts.name must be a non-empty string");
+    }
+    const declaredNames = this.opts.graphqlOps.map((d) => d.name);
+    if (!declaredNames.includes(opts.name)) {
+      throw new Error(`FetchproxyServer.graphqlQuery: operation ${JSON.stringify(opts.name)} not in declared graphqlOps [${declaredNames.map((n) => JSON.stringify(n)).join(", ")}]`);
+    }
+    await this.ensureConnected();
+    this.throwIfPendingPair();
+    const id = this.nextRequestId++;
+    const inner = {
+      type: "request",
+      id,
+      op: "graphql_query",
+      init: {
+        name: opts.name,
+        variables: opts.variables,
+        ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
+      }
+    };
+    const pending = new Promise((resolve, reject) => {
+      this.pendingGraphql.set(id, { resolve, reject });
+    });
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingGraphql, id, opts.name);
+  }
   assertScopeSubset(requested, declared, label) {
     const undeclared = undeclaredKeys(requested, declared);
     if (undeclared.length > 0) {
@@ -37828,7 +38111,7 @@ var FetchproxyServer = class {
     if (storageCb) {
       this.pendingStorage.delete(inner.id);
       if (inner.ok) {
-        if ((inner.op === "read_local_storage" || inner.op === "read_session_storage") && inner.values) {
+        if ((inner.op === "read_local_storage" || inner.op === "read_session_storage" || inner.op === "read_dom") && inner.values) {
           storageCb.resolve({ ...inner.values });
         } else {
           storageCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on storage awaiter`));
@@ -37894,6 +38177,20 @@ var FetchproxyServer = class {
       }
       return;
     }
+    const graphqlCb = this.pendingGraphql.get(inner.id);
+    if (graphqlCb) {
+      this.pendingGraphql.delete(inner.id);
+      if (inner.ok) {
+        if (inner.op === "graphql_query") {
+          graphqlCb.resolve(inner.data);
+        } else {
+          graphqlCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on graphql_query awaiter`));
+        }
+      } else {
+        graphqlCb.reject(new FetchproxyProtocolError(inner.error));
+      }
+      return;
+    }
     const cookiesCb = this.pendingReadCookies.get(inner.id);
     if (cookiesCb) {
       this.pendingReadCookies.delete(inner.id);
@@ -37945,6 +38242,9 @@ var FetchproxyServer = class {
     for (const { reject } of this.pendingDownload.values())
       reject(err);
     this.pendingDownload.clear();
+    for (const { reject } of this.pendingGraphql.values())
+      reject(err);
+    this.pendingGraphql.clear();
   }
   /**
    * 0.5.2+: read the current pair-pending pair code from whichever handle
@@ -38191,7 +38491,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "infinitecampus-mcp",
-  version: "2.3.6",
+  version: "2.4.2",
   mcpName: "io.github.chrischall/infinitecampus-mcp",
   description: "Infinite Campus (Campus Parent) MCP server \u2014 multi-district read + message/document write",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -38233,19 +38533,19 @@ var package_default = {
     "test:watch": "vitest"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.12.0",
-    "@fetchproxy/bootstrap": "^1.0.0",
-    "@fetchproxy/server": "^1.0.0",
+    "@chrischall/mcp-utils": "^0.14.0",
+    "@fetchproxy/bootstrap": "^1.7.0",
+    "@fetchproxy/server": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
-    "node-html-parser": "^8.0.2",
+    "node-html-parser": "^9.0.0",
     zod: "^4.4.3"
   },
   devDependencies: {
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.7",
     esbuild: "^0.28.0",
-    typescript: "^6.0.3",
+    typescript: "^7.0.2",
     vitest: "^4.1.7"
   }
 };
@@ -39807,7 +40107,7 @@ try {
 }
 var COMMON = {
   name: "infinitecampus",
-  version: "2.3.6"
+  version: "2.4.2"
   // x-release-please-version
 };
 if (account) {

package/dist/index.js

@@ -57,7 +57,7 @@ catch (e) {
 // actionable stderr message (banner) instead of a crash loop.
 const COMMON = {
     name: 'infinitecampus',
-    version: '2.3.6', // x-release-please-version
+    version: '2.4.2', // x-release-please-version
 };
 if (account) {
     const client = new ICClient(account, { preloaded });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinitecampus-mcp",
-  "version": "2.3.6",
+  "version": "2.4.2",
   "mcpName": "io.github.chrischall/infinitecampus-mcp",
   "description": "Infinite Campus (Campus Parent) MCP server — multi-district read + message/document write",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -42,19 +42,19 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.12.0",
-    "@fetchproxy/bootstrap": "^1.0.0",
-    "@fetchproxy/server": "^1.0.0",
+    "@chrischall/mcp-utils": "^0.14.0",
+    "@fetchproxy/bootstrap": "^1.7.0",
+    "@fetchproxy/server": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.2",
-    "node-html-parser": "^8.0.2",
+    "node-html-parser": "^9.0.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.7",
     "esbuild": "^0.28.0",
-    "typescript": "^6.0.3",
+    "typescript": "^7.0.2",
     "vitest": "^4.1.7"
   }
 }

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/infinitecampus-mcp",
     "source": "github"
   },
-  "version": "2.3.6",
+  "version": "2.4.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "infinitecampus-mcp",
-      "version": "2.3.6",
+      "version": "2.4.2",
       "transport": {
         "type": "stdio"
       },

package/skills/infinitecampus-api/SKILL.md

@@ -0,0 +1,142 @@
+---
+name: infinitecampus-api
+description: >-
+  Query an Infinite Campus (Campus Parent portal) district directly with curl
+  instead of running the infinitecampus-mcp server — log in with a real
+  username/password, capture the session cookie + XSRF token, and curl grades,
+  attendance, assignments, schedule, messages, documents, and fees. Use when
+  you want IC data without the MCP, in a script, or on a machine where the MCP
+  isn't installed. Infinite Campus is per-district: the base URL and district
+  app name are configurable, not hardcoded.
+---
+
+# Infinite Campus via curl (no MCP)
+
+Infinite Campus's Campus Parent portal is a classic server-rendered site
+(no public API, no bot wall). A plain form POST to `verify.jsp` logs a
+parent in and hands back a session cookie — no browser bridge needed. This
+is the same login `infinitecampus-mcp`'s `src/client.ts`/`src/auth.ts` do;
+this skill reproduces it with `curl` + a cookie jar.
+
+**Infinite Campus is per-district.** Every parent's portal lives at their
+own district's host (`https://campus.<district>.k12.example.us` or similar)
+under an `appName` path segment. There is no shared IC endpoint — carry the
+base URL and district from the same config the MCP uses:
+
+```sh
+: "${IC_BASE_URL:?set to your district's portal URL, e.g. https://campus.yourdistrict.org}"
+: "${IC_DISTRICT:?set to the appName path segment, e.g. yourdistrict}"
+: "${IC_USERNAME:?parent portal username}"
+: "${IC_PASSWORD:?parent portal password}"
+```
+
+(Same 4 env vars the MCP reads — reuse the repo's `.env` or the host's
+secret store; don't hardcode a district.)
+
+## One-time setup
+
+None — `curl` and `jq` are the only tools needed (`brew install jq` if
+missing). No profile/pairing step, no extension.
+
+## Login (capture cookies + XSRF token)
+
+`verify.jsp` accepts a urlencoded form POST and returns 200 with an
+`<AUTHENTICATION>state</AUTHENTICATION>` marker in the body — **not**
+via HTTP status — plus ~20 `Set-Cookie` headers. Use a cookie jar so curl
+does the Set-Cookie parsing/deduping for you:
+
+```sh
+JAR=$(mktemp)
+BODY=$(curl -sS -c "$JAR" \
+  "$IC_BASE_URL/campus/verify.jsp?nonBrowser=true" \
+  --data-urlencode "username=$IC_USERNAME" \
+  --data-urlencode "password=$IC_PASSWORD" \
+  --data-urlencode "appName=$IC_DISTRICT" \
+  --data-urlencode "portalLoginPage=parents")
+
+echo "$BODY" | grep -o '<AUTHENTICATION>[^<]*' # AUTHENTICATIONsuccess = good
+```
+
+`password-error` / `account-locked` / any non-`success` state means the
+login failed — check that string before doing anything else. Credentials
+go in the form body (never the query string — it lands in access logs).
+
+Pull the XSRF token out of the jar (IC's JS reads it back and echoes it on
+every request as `X-XSRF-TOKEN`; `JSESSIONID` alone is not enough):
+
+```sh
+XSRF=$(awk -F'\t' '$6=="XSRF-TOKEN"{print $7}' "$JAR")
+```
+
+## Core call pattern
+
+Every subsequent request rides the jar + the XSRF header:
+
+```sh
+ic_get() { # ic_get <path-with-query>
+  curl -sS -b "$JAR" -H "X-XSRF-TOKEN: $XSRF" -H 'Accept: application/json' \
+    "$IC_BASE_URL$1"
+}
+
+ic_get '/campus/api/portal/students' | jq .
+```
+
+A **401** means the session expired (IC sessions last ~5-6h) — re-run the
+Login step to get a fresh `$JAR`/`$XSRF` and retry once. There is no retry
+budget beyond that in this shell version (the MCP's `CookieSessionManager`
+does this automatically; here just redo the login block).
+
+## The one rule: resolve student + enrollment first
+
+Almost every read is scoped to a `personID` (student), and several need the
+student's **enrollment** (`enrollmentID` / `calendarID` / `structureID`).
+Always start with:
+
+```sh
+ic_get '/campus/api/portal/students' | jq '.[] | {personID, firstName, lastName, enrollments}'
+```
+
+Take `personID` for `studentId`/`personID` params, and the first (or
+relevant) `enrollments[]` entry's `enrollmentID`/`calendarID`/`structureID`
+for the endpoints that need them (attendance, school days, assessments,
+features). There is no name→id search — `ic_list_students` (i.e. this call)
+*is* the resolve step.
+
+## Endpoints
+
+All 17 read endpoints (grades, attendance, assignments, schedule, messages,
+documents, fees, teachers, assessments, feature flags) with ready-to-run
+`curl`+`jq` recipes are in `references/endpoints.md`. Two (`behavior`,
+`food_service`) have real paths that were never confirmed live against a
+district with that module enabled — try them, expect a 404 if the module
+is off or the district's shape differs.
+
+## Downloads
+
+`ic_download_document`'s `url` field (from the documents list) may be a
+relative `/campus/...` path or an absolute URL. Same jar + header pattern,
+just write to a file instead of piping to `jq`:
+
+```sh
+curl -sS -b "$JAR" -H "X-XSRF-TOKEN: $XSRF" -o report-card.pdf "$IC_BASE_URL$DOC_URL"
+```
+
+## FeatureDisabled districts
+
+Some districts turn whole modules off (behavior, food service, assessments,
+documents, attendance). The MCP checks `displayOptions` first and falls
+back to treating a 404 as "disabled." Doing the same by hand: fetch
+`/campus/api/portal/displayOptions/{structureID}?personID=X` (see
+references) and check the flag before assuming a 404 is a bug.
+
+## Notes
+
+- Read-only in practice: every recipe here is a GET. `ic_get_message`
+  fetching a message body *may* mark it read on some district configs — the
+  MCP's own probe couldn't confirm the side effect either way.
+- No CUPS linked-district switching in this skill (a parent with kids in
+  2+ IC instances under shared SSO) — that's a multi-step token-exchange
+  flow (`src/client.ts`'s `discoverLinkedDistricts`); out of scope here.
+  Run the login flow again against the linked district's own
+  `IC_BASE_URL`/`IC_DISTRICT` if you need it.
+- This project is developed and maintained by AI (Claude).

package/skills/infinitecampus-api/references/endpoints.md

@@ -0,0 +1,225 @@
+# Infinite Campus endpoints for curl
+
+Assumes the Login block from `../SKILL.md` has already run (`$JAR`, `$XSRF`,
+`$IC_BASE_URL` set) and the `ic_get` helper is defined:
+
+```sh
+ic_get() { curl -sS -b "$JAR" -H "X-XSRF-TOKEN: $XSRF" -H 'Accept: application/json' "$IC_BASE_URL$1"; }
+```
+
+All paths are transcribed from `infinitecampus-mcp`'s `src/tools/*.ts` and
+`docs/endpoints.md` — the same requests the `ic_*` MCP tools make. `$PID` =
+a student's `personID` from the resolve-first step.
+
+Some IC/prism responses serialize a 1-item collection as a bare object
+instead of a 1-element array — pipe through `jq 'if type=="array" then . else [.] end'`
+if a recipe below assumes an array and you get an object back.
+
+---
+
+## Students (resolve-first — always start here)
+
+```sh
+ic_get '/campus/api/portal/students' \
+  | jq '.[] | {personID, firstName, lastName, enrollments}'
+```
+
+Each `enrollments[]` entry carries `enrollmentID`, `calendarID`,
+`structureID`, `schoolName`, `endDate` — needed by several endpoints below.
+
+## Schedule
+
+```sh
+ic_get "/campus/resources/portal/roster?personID=$PID" | jq .
+```
+
+(Only `personID` is honored server-side — no working date/term filter, even
+though the MCP tool's schema accepts `date`/`termFilter` args.)
+
+## Assignments
+
+```sh
+# all assignments (full term history, ~hundreds of rows)
+ic_get "/campus/api/portal/assignment/listView?personID=$PID" | jq .
+
+# scoped to one course (sectionID from the schedule call above)
+ic_get "/campus/api/portal/assignment/listView?personID=$PID&sectionID=$SECTION_ID" | jq .
+
+# client-side filters (server ignores date/missing params entirely):
+ic_get "/campus/api/portal/assignment/listView?personID=$PID" \
+  | jq --arg since 2026-01-01 '[.[] | select(.dueDate >= $since)]'
+```
+
+## Recent (recently-graded) assignments
+
+Server-side filtered by `modifiedDate` (defaults to 14 days ago in the MCP;
+reproduce with `date -u -v-14d '+%Y-%m-%dT00:00:00'` on macOS):
+
+```sh
+SINCE=$(date -u -v-14d '+%Y-%m-%dT00:00:00')
+ic_get "/campus/api/portal/assignment/recentlyScored?modifiedDate=$SINCE&personID=$PID" | jq .
+```
+
+## Grades
+
+```sh
+ic_get "/campus/resources/portal/grades?personID=$PID" | jq .
+# scoped to one term:
+ic_get "/campus/resources/portal/grades?personID=$PID&termID=$TERM_ID" | jq .
+```
+
+## Attendance (per-course summary, loop over each enrollment)
+
+```sh
+ic_get "/campus/resources/portal/attendance/$ENROLLMENT_ID?courseSummary=true&personID=$PID" \
+  | jq '.terms[]?.courses[]? | {absentList, tardyList, presentList, earlyReleaseList}'
+```
+
+Feature-gated: check `displayOptions.attendance` first (see Feature flags,
+below) — a 404 here on a district with attendance disabled is expected, not
+a bug.
+
+## Attendance events (individual absences/tardies, loop over each enrollment)
+
+```sh
+ic_get "/campus/resources/portal/attendance/events?enrollmentID=$ENROLLMENT_ID&personID=$PID" \
+  | jq '.events[]? | {date: .localDate, code, description, excuse, comments}'
+
+# excused-only, since a date (client-side filter):
+ic_get "/campus/resources/portal/attendance/events?enrollmentID=$ENROLLMENT_ID&personID=$PID" \
+  | jq --arg since 2026-01-01 '[.events[]? | select((.localDate[0:10] >= $since) and (.excuse == "E"))]'
+```
+
+## School days / calendar (loop over each enrollment)
+
+Two calls per enrollment, then join term windows to days client-side:
+
+```sh
+ic_get "/campus/resources/term?structureID=$STRUCTURE_ID" | jq .          # term boundaries
+ic_get "/campus/resources/calendar/instructionalDay?calendarID=$CALENDAR_ID" | jq .  # day list
+
+# days within term N's [startDate,endDate]:
+jq --slurpfile terms terms.json --arg t "$TERM_ID" \
+  '[.[] | select(.date >= $terms[0][0].startDate and .date <= $terms[0][0].endDate)]' days.json
+```
+
+## Assessments (standardized tests, loop over each enrollment)
+
+```sh
+ic_get "/campus/resources/prism/portal/assessments?personID=$PID&calendarID=$CALENDAR_ID" \
+  | jq '{stateTests, nationalTests, districtTests}'
+```
+
+Feature-gated on `displayOptions.assessment`; test-item shape varies by
+district/test type — pass through unchanged, don't assume field names
+beyond `stateTests`/`nationalTests`/`districtTests`.
+
+## Behavior *(path unconfirmed — never verified live against a district with the module on)*
+
+```sh
+ic_get "/campus/resources/portal/behavior?personID=$PID" | jq .
+# with a date range:
+ic_get "/campus/resources/portal/behavior?personID=$PID&startDate=2026-01-01&endDate=2026-06-01" | jq .
+```
+
+Feature-gated on `displayOptions.behavior` — a 404 is the expected result
+on most districts (few enable this module for parent portal).
+
+## Food service *(path unconfirmed — same caveat as behavior)*
+
+```sh
+ic_get "/campus/resources/portal/foodService?personID=$PID" | jq .
+ic_get "/campus/resources/portal/foodService?personID=$PID&startDate=2026-01-01&endDate=2026-06-01" | jq .
+```
+
+Feature-gated on `displayOptions.foodService`.
+
+## Documents + download
+
+```sh
+ic_get "/campus/resources/portal/report/all?personID=$PID" \
+  | jq '.[] | {name, type, url, moduleLabel, endYear}'
+
+# download (url may be relative /campus/... or an absolute URL — handle both):
+DOC_URL='/campus/resources/portal/report/...'   # from the .url field above
+curl -sS -b "$JAR" -H "X-XSRF-TOKEN: $XSRF" -o report-card.pdf \
+  "$( [[ "$DOC_URL" == http* ]] && echo "$DOC_URL" || echo "$IC_BASE_URL$DOC_URL" )"
+```
+
+Feature-gated on `displayOptions.documents`.
+
+## Teachers + counselors
+
+```sh
+ic_get "/campus/resources/portal/section/contacts?personID=$PID" | jq .
+ic_get "/campus/resources/portal/studentCounselor/byUser?personID=$PID" | jq .
+```
+
+Either endpoint 404ing is treated as "no results" (not FeatureDisabled) by
+the MCP — do the same.
+
+## Messages (three independent sources — combine client-side)
+
+```sh
+# 1. prism notifications (assignment/grade/attendance alerts)
+ic_get '/campus/prism?x=notifications.Notification-retrieve&limitCount=20' \
+  | jq '.data.NotificationList.Notification'
+
+# 2. Messenger 2.0 inbox (teacher messages, district announcements)
+ic_get '/campus/api/portal/process-message' | jq .
+
+# 3. portal userNotice announcements
+ic_get '/campus/resources/portal/userNotice' | jq .
+```
+
+Each inbox item's `url` field feeds `ic_get_message` below (normalize a bare
+or `portal/...`-relative URL to `/campus/portal/...` first).
+
+## Get one message body (HTML → text)
+
+```sh
+# normalize: bare "portal/..." → "/campus/portal/..."; already-absolute /campus/... stays as-is
+MSG_PATH='/campus/portal/messageView.xsl?x=messenger.MessengerEngine-getMessageRecipientView&messageID=...&messageRecipientID=...'
+curl -sS -b "$JAR" -H "X-XSRF-TOKEN: $XSRF" -H 'Accept: text/html' "$IC_BASE_URL$MSG_PATH"
+# then strip tags/entities yourself, or eyeball the rendered HTML — this is
+# an HTML fragment, not JSON, so `jq` doesn't apply.
+```
+
+Fetching a message body *may* mark it read on some district configs
+(unconfirmed either way).
+
+## Fees (two endpoints in parallel; either can 404 independently)
+
+```sh
+ic_get "/campus/api/portal/fees/feeAssignments?personID=$PID" | jq .
+ic_get "/campus/api/portal/fees/feeTransactionDetail/totalSurplus/-1?personID=$PID" | jq .
+```
+
+Both 404 → module is off for this district. One 404 → report the other
+side plus a note that the failing endpoint may be disabled.
+
+## Feature flags (displayOptions — check before assuming a 404 is a bug)
+
+```sh
+ic_get "/campus/api/portal/displayOptions/$STRUCTURE_ID?personID=$PID" \
+  | jq '{attendance, behavior, assessment, documents, foodService, grades, schedule}'
+```
+
+`false` = district has that module turned off for this enrollment; `true`
+or absent = available. ~90 flags total; the MCP caches this per
+`(district, structureID)` for the session lifetime since it rarely changes
+mid-session — worth doing the same if you're calling it more than once.
+
+---
+
+## Not covered here (out of scope for this skill)
+
+- **CUPS linked-district discovery/switching** — a parent with kids at 2+
+  IC-hosted districts under shared SSO. Multi-step: fetch
+  `cups/linkedAccounts`, `userAccountSwitch/originalDistrict`,
+  `districts/current`, then per linked account a `cups/loginToken` POST
+  followed by a second `verify.jsp`-style POST at the *linked* district's
+  own host with the CUPS token. Fully discoverable in `src/client.ts`
+  (`discoverLinkedDistricts`) but a lot of shell for a one-shot skill —
+  just re-run the Login block against the linked district's own
+  `IC_BASE_URL`/`IC_DISTRICT` instead.