infinitecampus-mcp 2.4.3 → 2.4.4

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Infinite Campus (Campus Parent) — grades, attendance, assignments, messages, documents",
-    "version": "2.4.3"
+    "version": "2.4.4"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Infinite Campus",
       "source": "./",
       "description": "Infinite Campus (Campus Parent) MCP server for Claude — grades, attendance, assignments, messages, and documents via natural language",
-      "version": "2.4.3",
+      "version": "2.4.4",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "infinitecampus-mcp",
   "displayName": "Infinite Campus",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "description": "Infinite Campus (Campus Parent) MCP server for Claude — grades, attendance, assignments, messages, and documents",
   "author": {
     "name": "Chris Hall",

package/dist/auth.js

@@ -115,6 +115,18 @@ function lifterFor(host) {
             // <district>.infinitecampus.org, etc.). Declare just this host
             // — each district is its own root, no wildcard needed.
             domains: [host],
+            // IC is a Tomcat app deployed at /campus, and Tomcat scopes JSESSIONID
+            // to the servlet context by default:
+            //
+            //   JSESSIONID=...; Path=/campus; Secure; HttpOnly; SameSite=Lax
+            //
+            // chrome.cookies.get matches that Path against the URL it is given, so a
+            // read aimed at the origin root silently returns nothing — which is
+            // indistinguishable from "the user is signed out", and is why this path
+            // never worked on any tenant. Verified live: without this the lift found
+            // no cookies while a fetch through the same tab returned authenticated
+            // data; with it, JSESSIONID + XSRF-TOKEN both come back.
+            storagePath: '/campus',
             declare: {
                 // JSESSIONID is HttpOnly (chrome.cookies.get sees it; the
                 // security gate is the declared key list). XSRF-TOKEN is

package/dist/bundle.js

@@ -34977,6 +34977,15 @@ function assertHttpUrl(x, label) {
     throw new ProtocolError(`${label}: must be http(s), got ${u.protocol}`);
   }
 }
+function assertCookiePath(x, label) {
+  assertString(x, label);
+  if (!x.startsWith("/") || x.startsWith("//")) {
+    throw new ProtocolError(`${label}: must be an absolute path like "/campus"`);
+  }
+  if (x.includes("?") || x.includes("#") || x.includes("\\")) {
+    throw new ProtocolError(`${label}: must not contain a query, fragment, or backslash`);
+  }
+}
 function assertHttpsOriginOnly(x, label) {
   assertString(x, label);
   let u;
@@ -35421,8 +35430,10 @@ function validateInnerRequest(raw) {
     }
     assertHttpsOriginOnly(raw.init.origin, "inner.init.origin");
     assertNonEmptyKeyArray(raw.init.keys, "inner.init.keys");
+    if (raw.init.path !== void 0)
+      assertCookiePath(raw.init.path, "inner.init.path");
     for (const k of Object.keys(raw.init)) {
-      if (k !== "origin" && k !== "keys") {
+      if (k !== "origin" && k !== "keys" && k !== "path") {
         throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on read_cookies`);
       }
     }
@@ -36653,6 +36664,22 @@ var FetchproxyBridgeDownError = class extends FetchproxyProtocolError {
     this.hint = hint;
   }
 };
+var FetchproxyScopeError = class extends FetchproxyProtocolError {
+  /** The extension's raw rejection, unmodified. */
+  originalError;
+  hint;
+  constructor(originalError) {
+    const hint = "the declared scope changed since you paired, so the extension is refusing the request. Revoke this MCP in the Transporter extension popup, then re-run \u2014 you will be asked to approve the new scope. This is not a version problem and does not need an update.";
+    super(`${originalError} \u2014 ${hint}`);
+    this.name = "FetchproxyScopeError";
+    this.originalError = originalError;
+    this.hint = hint;
+  }
+};
+var SCOPE_REJECTION = /not in declared/;
+function protocolErrorFrom(error51) {
+  return SCOPE_REJECTION.test(error51) ? new FetchproxyScopeError(error51) : new FetchproxyProtocolError(error51);
+}
 var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
   url;
   timeoutMs;
@@ -36682,6 +36709,17 @@ var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
   }
 };
 var SUBDOMAIN_LABEL_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
+function normalizeCookiePath(path) {
+  if (path === void 0 || path === "")
+    return void 0;
+  const trimmed = path.endsWith("/") && path !== "/" ? path.slice(0, -1) : path;
+  try {
+    assertCookiePath(trimmed, "path");
+  } catch (e) {
+    throw new Error(`FetchproxyServer: ${e instanceof Error ? e.message : String(e)} (got ${JSON.stringify(path)})`);
+  }
+  return trimmed;
+}
 function assertSubdomainLabel(label) {
   if (!SUBDOMAIN_LABEL_RE.test(label)) {
     throw new Error(`FetchproxyServer: subdomain must be a DNS label like "www" or "api" (or dot-separated like "auth.api"), got ${JSON.stringify(label)}`);
@@ -37323,7 +37361,7 @@ var FetchproxyServer = class {
         port: this.opts.port
       });
     }
-    return new FetchproxyProtocolError(result.error);
+    return protocolErrorFrom(result.error);
   }
   /**
    * Convenience wrapper around `fetch()`. Builds the URL from a path
@@ -37574,9 +37612,14 @@ var FetchproxyServer = class {
     let inner;
     if (opts.keys !== void 0) {
       this.assertScopeSubset(opts.keys, this.opts.cookieKeys, "cookieKeys");
+      const cookiePath = normalizeCookiePath(opts.path);
       const initV3 = {
+        // Origin stays BARE. The path travels as its own validated field —
+        // `assertHttpsOriginOnly` deliberately refuses a path here so one
+        // cannot be used to re-point the read past the domain gate.
         origin: `https://${host}`,
-        keys: [...opts.keys]
+        keys: [...opts.keys],
+        ...cookiePath !== void 0 ? { path: cookiePath } : {}
       };
       inner = { type: "request", id, op: "read_cookies", init: initV3 };
     } else {
@@ -37589,7 +37632,7 @@ var FetchproxyServer = class {
     await this.sendInnerFrame(inner);
     const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
     if (!result.ok) {
-      throw new FetchproxyProtocolError(result.error);
+      throw protocolErrorFrom(result.error);
     }
     return result.cookies;
   }
@@ -38139,7 +38182,7 @@ var FetchproxyServer = class {
           storageCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on storage awaiter`));
         }
       } else {
-        storageCb.reject(new FetchproxyProtocolError(inner.error));
+        storageCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38153,7 +38196,7 @@ var FetchproxyServer = class {
           captureCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture awaiter`));
         }
       } else {
-        captureCb.reject(new FetchproxyProtocolError(inner.error));
+        captureCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38167,7 +38210,7 @@ var FetchproxyServer = class {
           redirectCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture_redirect awaiter`));
         }
       } else {
-        redirectCb.reject(new FetchproxyProtocolError(inner.error));
+        redirectCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38181,7 +38224,7 @@ var FetchproxyServer = class {
           idbCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on read_indexed_db awaiter`));
         }
       } else {
-        idbCb.reject(new FetchproxyProtocolError(inner.error));
+        idbCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38195,7 +38238,7 @@ var FetchproxyServer = class {
           downloadCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on download awaiter`));
         }
       } else {
-        downloadCb.reject(new FetchproxyProtocolError(inner.error));
+        downloadCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38209,7 +38252,7 @@ var FetchproxyServer = class {
           graphqlCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on graphql_query awaiter`));
         }
       } else {
-        graphqlCb.reject(new FetchproxyProtocolError(inner.error));
+        graphqlCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38402,7 +38445,9 @@ async function runOneLift(opts) {
     if (opts.declare.cookies.length > 0) {
       const joined = await server.readCookies({
         keys: opts.declare.cookies,
-        ...storageDomainOpts
+        ...storageDomainOpts,
+        // Cookie-only: the other buckets are origin-scoped and ignore path.
+        ...opts.storagePath !== void 0 ? { path: opts.storagePath } : {}
       });
       for (const piece of joined.split("; ")) {
         if (!piece)
@@ -38532,7 +38577,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "infinitecampus-mcp",
-  version: "2.4.3",
+  version: "2.4.4",
   mcpName: "io.github.chrischall/infinitecampus-mcp",
   description: "Infinite Campus (Campus Parent) MCP server \u2014 multi-district read + message/document write",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -38575,7 +38620,7 @@ var package_default = {
   },
   dependencies: {
     "@chrischall/mcp-utils": "^0.14.0",
-    "@fetchproxy/bootstrap": "^1.9.1",
+    "@fetchproxy/bootstrap": "^1.11.0",
     "@fetchproxy/server": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
@@ -38622,6 +38667,18 @@ function lifterFor(host) {
       // <district>.infinitecampus.org, etc.). Declare just this host
       // — each district is its own root, no wildcard needed.
       domains: [host],
+      // IC is a Tomcat app deployed at /campus, and Tomcat scopes JSESSIONID
+      // to the servlet context by default:
+      //
+      //   JSESSIONID=...; Path=/campus; Secure; HttpOnly; SameSite=Lax
+      //
+      // chrome.cookies.get matches that Path against the URL it is given, so a
+      // read aimed at the origin root silently returns nothing — which is
+      // indistinguishable from "the user is signed out", and is why this path
+      // never worked on any tenant. Verified live: without this the lift found
+      // no cookies while a fetch through the same tab returned authenticated
+      // data; with it, JSESSIONID + XSRF-TOKEN both come back.
+      storagePath: "/campus",
       declare: {
         // JSESSIONID is HttpOnly (chrome.cookies.get sees it; the
         // security gate is the declared key list). XSRF-TOKEN is
@@ -40158,7 +40215,7 @@ try {
 }
 var COMMON = {
   name: "infinitecampus",
-  version: "2.4.3"
+  version: "2.4.4"
   // x-release-please-version
 };
 if (account) {

package/dist/index.js

@@ -57,7 +57,7 @@ catch (e) {
 // actionable stderr message (banner) instead of a crash loop.
 const COMMON = {
     name: 'infinitecampus',
-    version: '2.4.3', // x-release-please-version
+    version: '2.4.4', // x-release-please-version
 };
 if (account) {
     const client = new ICClient(account, { refreshSession });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinitecampus-mcp",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "mcpName": "io.github.chrischall/infinitecampus-mcp",
   "description": "Infinite Campus (Campus Parent) MCP server — multi-district read + message/document write",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@chrischall/mcp-utils": "^0.14.0",
-    "@fetchproxy/bootstrap": "^1.9.1",
+    "@fetchproxy/bootstrap": "^1.11.0",
     "@fetchproxy/server": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.2",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/infinitecampus-mcp",
     "source": "github"
   },
-  "version": "2.4.3",
+  "version": "2.4.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "infinitecampus-mcp",
-      "version": "2.4.3",
+      "version": "2.4.4",
       "transport": {
         "type": "stdio"
       },