infinitecampus-mcp 2.8.2 → 2.8.3

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Infinite Campus (Campus Parent) — grades, attendance, assignments, messages, documents",
-    "version": "2.8.2"
+    "version": "2.8.3"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Infinite Campus",
       "source": "./",
       "description": "Infinite Campus (Campus Parent) MCP server for Claude — grades, attendance, assignments, messages, and documents via natural language",
-      "version": "2.8.2",
+      "version": "2.8.3",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "infinitecampus-mcp",
   "displayName": "Infinite Campus",
-  "version": "2.8.2",
+  "version": "2.8.3",
   "description": "Infinite Campus (Campus Parent) MCP server for Claude — grades, attendance, assignments, messages, and documents",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -40097,6 +40097,8 @@ function validateFrame(raw) {
     return validateEncrypted(raw);
   if (t === "pair-pending")
     return validatePairPending(raw);
+  if (t === "hello-rejected")
+    return validateHelloRejected(raw);
   if (t === "extension-disconnected")
     return { type: "extension-disconnected" };
   throw new ProtocolError(`unknown frame type: ${String(t)}`);
@@ -40227,6 +40229,16 @@ function validatePairPending(raw) {
   }
   return { type: "pair-pending", mcpId: raw.mcpId, pairCode: raw.pairCode };
 }
+function validateHelloRejected(raw) {
+  assertString(raw.mcpId, "hello-rejected.mcpId");
+  if (!isValidMcpId(raw.mcpId))
+    throw new ProtocolError("hello-rejected.mcpId: invalid format");
+  assertString(raw.reason, "hello-rejected.reason");
+  if (raw.reason.length > 200) {
+    throw new ProtocolError("hello-rejected.reason: must be at most 200 characters");
+  }
+  return { type: "hello-rejected", mcpId: raw.mcpId, reason: raw.reason };
+}
 function validateInnerFrame(raw) {
   assertObject(raw, "inner");
   const t = raw.type;
@@ -40261,6 +40273,11 @@ function validateInnerRequest(raw) {
     if (raw.init.inPage !== void 0) {
       assertBoolean(raw.init.inPage, "inner.init.inPage");
     }
+    if (raw.init.credentials !== void 0) {
+      if (raw.init.credentials !== "include" && raw.init.credentials !== "omit") {
+        throw new ProtocolError("inner.init.credentials: must be 'include' or 'omit'");
+      }
+    }
     return raw;
   }
   if (raw.op === "read_cookies") {
@@ -41041,6 +41058,17 @@ var FetchproxySessionNotReadyError = class extends Error {
     Object.setPrototypeOf(this, new.target.prototype);
   }
 };
+var FetchproxyHelloRejectedError = class extends Error {
+  mcpId;
+  reason;
+  constructor(info) {
+    super(`fetchproxy: the extension refused the connection for "${info.mcpId}": ${info.reason}. This is the extension's own reason \u2014 it is not a timeout, and retrying unchanged will be refused the same way.`);
+    this.name = "FetchproxyHelloRejectedError";
+    this.mcpId = info.mcpId;
+    this.reason = info.reason;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
 async function awaitSessionReady(ready, opts) {
   const ms = opts.timeoutMs ?? SESSION_READY_TIMEOUT_MS;
   if (ms <= 0)
@@ -41066,12 +41094,21 @@ import { join as join2 } from "node:path";
 
 // node_modules/@fetchproxy/server/dist/identity.js
 import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { homedir } from "node:os";
 var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
 var SAFE_SCOPED = /^@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+function envIdentityDir() {
+  const raw = process.env.FETCHPROXY_IDENTITY_DIR;
+  if (raw === void 0)
+    return void 0;
+  const dir = raw.trim();
+  if (dir === "" || !isAbsolute(dir))
+    return void 0;
+  return dir;
+}
 function defaultIdentityDir() {
-  return join(homedir(), ".fetchproxy", "identity");
+  return envIdentityDir() ?? join(homedir(), ".fetchproxy", "identity");
 }
 function safeIdentityFileBase(serverName) {
   if (!serverName || serverName === ".." || serverName.includes("..") || !SAFE_PLAIN.test(serverName) && !SAFE_SCOPED.test(serverName)) {
@@ -41079,42 +41116,57 @@ function safeIdentityFileBase(serverName) {
   }
   return serverName.replace(/\//g, "_");
 }
-async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
-  const safeFile = safeIdentityFileBase(serverName);
-  const path = join(dir, `${safeFile}.json`);
-  await mkdir(dir, { recursive: true, mode: 448 });
-  try {
-    const raw = await readFile(path, "utf8");
-    const j2 = JSON.parse(raw);
-    return {
-      x25519Priv: fromB64(j2.x25519Priv),
-      x25519Pub: fromB64(j2.x25519Pub),
-      ed25519Priv: fromB64(j2.ed25519Priv),
-      ed25519Pub: fromB64(j2.ed25519Pub),
-      createdAt: j2.createdAt
-    };
-  } catch (e) {
-    if (e.code !== "ENOENT")
-      throw e;
-  }
+function identityFilePath(dir, serverName) {
+  return join(dir, `${safeIdentityFileBase(serverName)}.json`);
+}
+async function generateIdentity() {
   const x = await generateX25519();
   const ed = await generateEd25519();
-  const id = {
+  return {
     x25519Priv: x.privateKey,
     x25519Pub: x.publicKey,
     ed25519Priv: ed.privateKey,
     ed25519Pub: ed.publicKey,
     createdAt: Date.now()
   };
-  const j = {
+}
+function serializeIdentity(id) {
+  return JSON.stringify({
     x25519Priv: toB64(id.x25519Priv),
     x25519Pub: toB64(id.x25519Pub),
     ed25519Priv: toB64(id.ed25519Priv),
     ed25519Pub: toB64(id.ed25519Pub),
     createdAt: id.createdAt
+  }, null, 2);
+}
+function parseIdentity(text) {
+  const j = JSON.parse(text);
+  return {
+    x25519Priv: fromB64(j.x25519Priv),
+    x25519Pub: fromB64(j.x25519Pub),
+    ed25519Priv: fromB64(j.ed25519Priv),
+    ed25519Pub: fromB64(j.ed25519Pub),
+    createdAt: j.createdAt
   };
-  await writeFile(path, JSON.stringify(j, null, 2), { mode: 384 });
+}
+async function writeIdentityFile(dir, serverName, id) {
+  const path = identityFilePath(dir, serverName);
+  await mkdir(dir, { recursive: true, mode: 448 });
+  await writeFile(path, serializeIdentity(id), { mode: 384 });
   await chmod(path, 384);
+  return path;
+}
+async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
+  const path = identityFilePath(dir, serverName);
+  await mkdir(dir, { recursive: true, mode: 448 });
+  try {
+    return parseIdentity(await readFile(path, "utf8"));
+  } catch (e) {
+    if (e.code !== "ENOENT")
+      throw e;
+  }
+  const id = await generateIdentity();
+  await writeIdentityFile(dir, serverName, id);
   return id;
 }
 
@@ -41218,6 +41270,9 @@ async function startHost(opts) {
     }
   });
   const ownHello = await buildServerHello({
+    // 2.6.0: tell the extension it can say WHY it refused a hello, instead of
+    // leaving us to time out and guess.
+    accepts: ["hello-rejected"],
     identity: opts.ownIdentity,
     mcpId: opts.ownMcpId,
     serverName: opts.ownServerName,
@@ -41429,6 +41484,16 @@ async function startHost(opts) {
               extensionWs.send(JSON.stringify(frame));
           }
         }
+        if (frame.type === "hello-rejected" && identified === "extension") {
+          if (frame.mcpId === opts.ownMcpId) {
+            rejectOwnSession(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
+          } else {
+            const slot = peers.get(frame.mcpId);
+            if (slot?.helloFrame.accepts?.includes("hello-rejected")) {
+              slot.ws.send(JSON.stringify(frame));
+            }
+          }
+        }
         if (frame.type === "pair-pending" && identified === "extension") {
           if (frame.mcpId === opts.ownMcpId) {
             ownPendingPairCode = frame.pairCode;
@@ -41540,7 +41605,8 @@ async function startPeer(opts) {
     graphqlOps: opts.graphqlOps,
     // 2.5.0: let a host ≥2.5.0 tell us when the extension leaves, so
     // `extensionConnected()` / `sessionLinked()` can go back to false.
-    accepts: ["extension-disconnected"]
+    // 2.6.0: `hello-rejected` for the same reason, from the extension.
+    accepts: ["extension-disconnected", "hello-rejected"]
   });
   const sessionNonce = fromB64(hello.sessionNonce);
   ws.send(JSON.stringify(hello));
@@ -41655,6 +41721,9 @@ async function startPeer(opts) {
         }
         return;
       }
+      if (frame.type === "hello-rejected" && frame.mcpId === opts.mcpId) {
+        rejectFirstReady(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
+      }
       if (frame.type === "pair-pending" && frame.mcpId === opts.mcpId) {
         pendingPairCode = frame.pairCode;
         pendingPairListeners.forEach((cb) => cb(frame.pairCode));
@@ -41752,6 +41821,8 @@ function classifyFetchError(error61) {
 
 // node_modules/@fetchproxy/server/dist/classify-bridge-error.js
 function classifyBridgeError(err) {
+  if (err instanceof FetchproxyHelloRejectedError)
+    return "hello_rejected";
   if (err instanceof FetchproxySessionNotReadyError)
     return "session_not_ready";
   if (err instanceof FetchproxyTimeoutError)
@@ -41852,11 +41923,20 @@ var FetchproxyNoTabError = class extends FetchproxyHintedError {
     this.name = "FetchproxyNoTabError";
   }
 };
+var FetchproxyTabOpeningError = class extends FetchproxyHintedError {
+  constructor(originalError) {
+    super(originalError, "the extension is opening that tab now \u2014 retry in a few seconds. You do not need to open one yourself, and this is not a version problem.");
+    this.name = "FetchproxyTabOpeningError";
+  }
+};
 var SCOPE_REJECTION = /not in declared/;
-var NO_TAB_REJECTION = /no tab matching (?!.*content script loaded)/;
+var NO_TAB_REJECTION = /no tab matching (?!.*(content script loaded|one is still opening))/;
+var TAB_OPENING_REJECTION = /no tab matching .*one is still opening/;
 function protocolErrorFrom(error61) {
   if (SCOPE_REJECTION.test(error61))
     return new FetchproxyScopeError(error61);
+  if (TAB_OPENING_REJECTION.test(error61))
+    return new FetchproxyTabOpeningError(error61);
   if (NO_TAB_REJECTION.test(error61))
     return new FetchproxyNoTabError(error61);
   return new FetchproxyProtocolError(error61);
@@ -42476,9 +42556,9 @@ var FetchproxyServer = class {
   async _fetchOnceWithTimeout(init) {
     const id = this.nextRequestId++;
     const inner = { type: "request", id, op: "fetch", init };
-    const pending = new Promise((resolve2) => {
+    const pending = this.guardPending(new Promise((resolve2) => {
       this.pending.set(id, resolve2);
-    });
+    }));
     await this.sendInnerFrame(inner);
     const timeoutMs = this.opts.fetchTimeoutMs;
     if (timeoutMs === void 0 || timeoutMs <= 0)
@@ -42525,6 +42605,34 @@ var FetchproxyServer = class {
    * already surface for fetch timeouts). `0`/unset opts out (unbounded),
    * matching the fetch path.
    */
+  /**
+   * Register a verb's pending promise and keep an early rejection from being
+   * fatal.
+   *
+   * Every verb stores its resolver, then AWAITS `sendInnerFrame` before the
+   * caller attaches a handler — and that send does real work (sealing, a
+   * socket write), so it yields across event-loop turns. Anything that drains
+   * the pending maps inside that window rejects a promise nothing is
+   * listening to yet: a refused pairing (`rejectAllPending(pairingErrorMessage
+   * (code))`), an extension disconnect, a `close()`. Under Node's default
+   * `--unhandled-rejections=throw` that ends the PROCESS, so an MCP that
+   * should have reported "approve pair code NNN-NN" dies instead, and each
+   * respawn mints a fresh code nobody can approve (#329).
+   *
+   * The no-op catch is a listener, not a swallow. `.catch()` derives a NEW
+   * promise and leaves this one's rejection intact, so `_withVerbTimeout` and
+   * the caller still see it — the only thing that changes is that the
+   * rejection is never unhandled.
+   *
+   * This is the same hazard `_withVerbTimeout`'s timer already guards against
+   * from the other side, where it drops the resolver "so a late bridge
+   * response doesn't become an unhandled promise that crashes the host".
+   */
+  guardPending(pending) {
+    pending.catch(() => {
+    });
+    return pending;
+  }
   async _withVerbTimeout(pending, pendingMap, id, url2, requestedTimeoutMs) {
     const timeoutMs = this.opts.fetchTimeoutMs;
     if (timeoutMs === void 0 || timeoutMs <= 0)
@@ -42604,9 +42712,9 @@ var FetchproxyServer = class {
     if (opts.subdomain !== void 0)
       assertSubdomainLabel(opts.subdomain);
     const baseDomain = this.resolveBaseDomain(opts.domain);
-    const isAbsolute = path.startsWith("http://") || path.startsWith("https://");
+    const isAbsolute2 = path.startsWith("http://") || path.startsWith("https://");
     let host;
-    if (isAbsolute) {
+    if (isAbsolute2) {
       try {
         host = new URL(path).host;
       } catch {
@@ -42615,7 +42723,7 @@ var FetchproxyServer = class {
     } else {
       host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
     }
-    const url2 = isAbsolute ? path : `https://${host}${path}`;
+    const url2 = isAbsolute2 ? path : `https://${host}${path}`;
     assertUrlInDomains("request url", url2, this.opts.domains);
     let tabUrl = `https://${host}/`;
     if (opts.viaTab !== void 0) {
@@ -42636,7 +42744,11 @@ var FetchproxyServer = class {
       // Spread rather than `inPage: opts.inPage`: the wire's validator treats
       // the key's PRESENCE as the request, and a literal `undefined` would
       // both serialize away inconsistently and read as "asked for" here.
-      ...opts.inPage === true ? { inPage: true } : {}
+      ...opts.inPage === true ? { inPage: true } : {},
+      // Spread for the reason `inPage` is: only a deliberate 'omit' goes on
+      // the wire, so an untouched request serialises byte-identically to
+      // every version before this option existed.
+      ...opts.credentials === "omit" ? { credentials: "omit" } : {}
     };
     const result = await this.fetch(init);
     if (!result.ok) {
@@ -42864,9 +42976,9 @@ var FetchproxyServer = class {
       const tabUrl = `https://${host}/`;
       inner = { type: "request", id, op: "read_cookies", init: { tabUrl } };
     }
-    const pending = new Promise((resolve2) => {
+    const pending = this.guardPending(new Promise((resolve2) => {
       this.pendingReadCookies.set(id, resolve2);
-    });
+    }));
     await this.sendInnerFrame(inner);
     const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
     if (!result.ok) {
@@ -42923,9 +43035,9 @@ var FetchproxyServer = class {
         ...cookiePath !== void 0 ? { path: cookiePath } : {}
       }
     };
-    const pending = new Promise((resolve2, reject) => {
+    const pending = this.guardPending(new Promise((resolve2, reject) => {
       this.pendingWriteCookies.set(id, { resolve: resolve2, reject });
-    });
+    }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingWriteCookies, id, `https://${host}`);
   }
@@ -42986,9 +43098,9 @@ var FetchproxyServer = class {
         ...opts.pointers ? { pointers: { ...opts.pointers } } : {}
       }
     };
-    const pending = new Promise((resolve2, reject) => {
+    const pending = this.guardPending(new Promise((resolve2, reject) => {
       this.pendingStorage.set(id, { resolve: resolve2, reject });
-    });
+    }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
   }
@@ -43091,9 +43203,9 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = new Promise((resolve2, reject) => {
+    const pending = this.guardPending(new Promise((resolve2, reject) => {
       this.pendingCapture.set(id, { resolve: resolve2, reject });
-    });
+    }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
       pending,
@@ -43184,9 +43296,9 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = new Promise((resolve2, reject) => {
+    const pending = this.guardPending(new Promise((resolve2, reject) => {
       this.pendingRedirect.set(id, { resolve: resolve2, reject });
-    });
+    }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
       pending,
@@ -43274,9 +43386,9 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = new Promise((resolve2, reject) => {
+    const pending = this.guardPending(new Promise((resolve2, reject) => {
       this.pendingDownload.set(id, { resolve: resolve2, reject });
-    });
+    }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
       pending,
@@ -43332,9 +43444,9 @@ var FetchproxyServer = class {
         keys: [...opts.keys]
       }
     };
-    const pending = new Promise((resolve2, reject) => {
+    const pending = this.guardPending(new Promise((resolve2, reject) => {
       this.pendingIdb.set(id, { resolve: resolve2, reject });
-    });
+    }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
   }
@@ -43372,9 +43484,9 @@ var FetchproxyServer = class {
       op: "read_dom",
       init: { origin, names: [...opts.names] }
     };
-    const pending = new Promise((resolve2, reject) => {
+    const pending = this.guardPending(new Promise((resolve2, reject) => {
       this.pendingStorage.set(id, { resolve: resolve2, reject });
-    });
+    }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
   }
@@ -43418,9 +43530,9 @@ var FetchproxyServer = class {
         ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
       }
     };
-    const pending = new Promise((resolve2, reject) => {
+    const pending = this.guardPending(new Promise((resolve2, reject) => {
       this.pendingGraphql.set(id, { resolve: resolve2, reject });
-    });
+    }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingGraphql, id, opts.name);
   }
@@ -43898,6 +44010,8 @@ var CREDENTIAL_ARMS = /* @__PURE__ */ new Set([
   "ok",
   "no_credential",
   "credential_rejected",
+  "session_expired",
+  "verification_pending",
   "timeout",
   "http",
   "transport",
@@ -43914,6 +44028,10 @@ function credentialHint(arm, prefix, hostLabel, source2) {
       return `No credential resolved. Nothing was available to authenticate with \u2014 sign in and reconnect the connector so ${prefix} receives a token, or set the documented environment variable.`;
     case "credential_rejected":
       return `${hostLabel} rejected the credential from '${source2}'. It is present but no longer valid \u2014 most often expired or revoked upstream. Re-authenticate and reconnect; retrying will not fix it.`;
+    case "session_expired":
+      return `The credential from '${source2}' is configured, but no session is live \u2014 ${hostLabel} served a sign-in page rather than the data. Sign in again; a cookie-session portal expires these on its own, so this recurs between uses.`;
+    case "verification_pending":
+      return `${hostLabel} is holding the sign-in on a second factor rather than refusing it. Supply the verification code the ACCOUNT HOLDER received \u2014 the credential itself is not the problem, so changing it will not help.`;
     case "timeout":
       return `The credential from '${source2}' resolved, but ${hostLabel} did not answer in time. Usually transient \u2014 retry. If it persists, ${hostLabel} is slow or unreachable from here.`;
     case "http":
@@ -43924,12 +44042,102 @@ function credentialHint(arm, prefix, hostLabel, source2) {
       return `Unexpected failure \u2014 see error.message.`;
   }
 }
+function credentialHealthcheckDescription(hostLabel) {
+  return `Resolves the credential the way real tools do, then makes one authenticated request to ${hostLabel}. Reports which source supplied the credential, whether ${hostLabel} accepted it, the round-trip time, and a plain-English hint distinguishing 'no credential' from 'credential rejected' from 'a ${hostLabel}-side problem'. Read-only; never returns the credential itself.`;
+}
+async function runCredentialHealthcheck(args) {
+  const { prefix, hostLabel, probePath, resolveCredential, probeFn, classifyThrown, hints } = args;
+  const probeUrl = probePath ? `https://${hostLabel}${probePath.startsWith("/") ? "" : "/"}${probePath}` : void 0;
+  let probeStarted = 0;
+  let state;
+  try {
+    state = await resolveCredential();
+  } catch (e) {
+    const classified = classifyThrown?.(e);
+    const result2 = {
+      ok: false,
+      // Still false, and still no source: a classification explains WHY
+      // nothing resolved, it does not invent a credential that did.
+      credential: { source: null, resolved: false },
+      // No `url`: nothing was probed, and naming one implies it was tried.
+      probe: { elapsed_ms: 0 },
+      error: {
+        kind: classified?.kind ?? "no_credential",
+        message: truncateErrorMessage(messageOf(e)),
+        ...classified?.detail !== void 0 ? { detail: classified.detail } : {}
+      },
+      // The hint must follow the KIND beside it. Falling back to
+      // `no_credential`'s copy under a classified kind would state a cause
+      // the kind contradicts — the same disagreement this path exists to
+      // remove. So: an inline hint wins; else the classified arm's own
+      // copy (consumer override first); else, for a kind this module has
+      // no copy for, the neutral `unknown` text rather than one that
+      // asserts a cause; else the unclassified `no_credential` default.
+      hint: classified?.hint ?? (isArm(classified?.kind) ? hints?.[classified.kind] ?? credentialHint(classified.kind, prefix, hostLabel, null) : classified !== void 0 ? credentialHint("unknown", prefix, hostLabel, null) : hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null))
+    };
+    return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
+  }
+  const credential = {
+    source: state.source,
+    resolved: state.source !== null,
+    ...state.detail !== void 0 ? { detail: state.detail } : {}
+  };
+  if (!credential.resolved) {
+    const result2 = {
+      ok: false,
+      credential,
+      probe: { elapsed_ms: 0 },
+      error: { kind: "no_credential", message: "no credential source resolved" },
+      hint: hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null)
+    };
+    return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
+  }
+  let arm = "ok";
+  let error61;
+  let status;
+  let customHint;
+  probeStarted = Date.now();
+  try {
+    await probeFn();
+  } catch (e) {
+    status = statusOf(e);
+    const aborted2 = e instanceof Error && e.name === "AbortError";
+    arm = status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
+    let kind = arm;
+    let detail;
+    const custom2 = classifyThrown?.(e);
+    if (custom2) {
+      kind = custom2.kind;
+      customHint = custom2.hint;
+      detail = custom2.detail;
+      arm = isArm(kind) ? kind : "unknown";
+    }
+    error61 = {
+      kind,
+      // Redacted AND bounded before it reaches the result: an upstream
+      // failure routinely quotes what it was sent, and a healthcheck is
+      // the tool people paste into a chat when something is broken.
+      message: truncateErrorMessage(messageOf(e)),
+      ...detail !== void 0 ? { detail } : {}
+    };
+  }
+  const result = {
+    ok: error61 === void 0,
+    credential,
+    probe: {
+      ...probeUrl ? { url: probeUrl } : {},
+      elapsed_ms: Date.now() - probeStarted,
+      ...status !== void 0 ? { status } : {}
+    },
+    ...error61 ? { error: error61 } : {},
+    hint: customHint ?? hints?.[arm] ?? credentialHint(arm, prefix, hostLabel, state.source)
+  };
+  return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+}
 function registerCredentialHealthcheckTool(args) {
-  const { server, prefix, hostLabel, probePath, resolveCredential, probeFn, classifyThrown, hints } = args;
-  const probeUrl = probePath ? `https://${hostLabel}${probePath}` : void 0;
-  server.registerTool(`${prefix}_healthcheck`, {
+  args.server.registerTool(`${args.prefix}_healthcheck`, {
     title: "Verify credentials and upstream reachability",
-    description: `Resolves the credential the way real tools do, then makes one authenticated request to ${hostLabel}. Reports which source supplied the credential, whether ${hostLabel} accepted it, the round-trip time, and a plain-English hint distinguishing 'no credential' from 'credential rejected' from 'a ${hostLabel}-side problem'. Call this when a real tool fails and you want to know which hop broke. Read-only; never returns the credential itself.`,
+    description: `${credentialHealthcheckDescription(args.hostLabel)} Call this when a real tool fails and you want to know which hop broke.`,
     annotations: {
       title: "Verify credentials and upstream reachability",
       readOnlyHint: true,
@@ -43937,92 +44145,7 @@ function registerCredentialHealthcheckTool(args) {
       openWorldHint: true
     },
     inputSchema: {}
-  }, async () => {
-    let probeStarted = 0;
-    let state;
-    try {
-      state = await resolveCredential();
-    } catch (e) {
-      const classified = classifyThrown?.(e);
-      const result2 = {
-        ok: false,
-        // Still false, and still no source: a classification explains WHY
-        // nothing resolved, it does not invent a credential that did.
-        credential: { source: null, resolved: false },
-        // No `url`: nothing was probed, and naming one implies it was tried.
-        probe: { elapsed_ms: 0 },
-        error: {
-          kind: classified?.kind ?? "no_credential",
-          message: truncateErrorMessage(messageOf(e)),
-          ...classified?.detail !== void 0 ? { detail: classified.detail } : {}
-        },
-        // The hint must follow the KIND beside it. Falling back to
-        // `no_credential`'s copy under a classified kind would state a cause
-        // the kind contradicts — the same disagreement this path exists to
-        // remove. So: an inline hint wins; else the classified arm's own
-        // copy (consumer override first); else, for a kind this module has
-        // no copy for, the neutral `unknown` text rather than one that
-        // asserts a cause; else the unclassified `no_credential` default.
-        hint: classified?.hint ?? (isArm(classified?.kind) ? hints?.[classified.kind] ?? credentialHint(classified.kind, prefix, hostLabel, null) : classified !== void 0 ? credentialHint("unknown", prefix, hostLabel, null) : hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null))
-      };
-      return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
-    }
-    const credential = {
-      source: state.source,
-      resolved: state.source !== null,
-      ...state.detail !== void 0 ? { detail: state.detail } : {}
-    };
-    if (!credential.resolved) {
-      const result2 = {
-        ok: false,
-        credential,
-        probe: { elapsed_ms: 0 },
-        error: { kind: "no_credential", message: "no credential source resolved" },
-        hint: hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null)
-      };
-      return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
-    }
-    let arm = "ok";
-    let error61;
-    let status;
-    let customHint;
-    probeStarted = Date.now();
-    try {
-      await probeFn();
-    } catch (e) {
-      status = statusOf(e);
-      const aborted2 = e instanceof Error && e.name === "AbortError";
-      arm = status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
-      let kind = arm;
-      let detail;
-      const custom2 = classifyThrown?.(e);
-      if (custom2) {
-        kind = custom2.kind;
-        customHint = custom2.hint;
-        detail = custom2.detail;
-      }
-      error61 = {
-        kind,
-        // Redacted AND bounded before it reaches the result: an upstream
-        // failure routinely quotes what it was sent, and a healthcheck is
-        // the tool people paste into a chat when something is broken.
-        message: truncateErrorMessage(messageOf(e)),
-        ...detail !== void 0 ? { detail } : {}
-      };
-    }
-    const result = {
-      ok: error61 === void 0,
-      credential,
-      probe: {
-        ...probeUrl ? { url: probeUrl } : {},
-        elapsed_ms: Date.now() - probeStarted,
-        ...status !== void 0 ? { status } : {}
-      },
-      ...error61 ? { error: error61 } : {},
-      hint: customHint ?? hints?.[arm] ?? credentialHint(arm, prefix, hostLabel, state.source)
-    };
-    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-  });
+  }, async () => runCredentialHealthcheck(args));
 }
 
 // src/config.ts
@@ -44066,7 +44189,7 @@ function loadAccount(env = process.env) {
 // package.json
 var package_default = {
   name: "infinitecampus-mcp",
-  version: "2.8.2",
+  version: "2.8.3",
   mcpName: "io.github.chrischall/infinitecampus-mcp",
   description: "Infinite Campus (Campus Parent) MCP server \u2014 multi-district read + message/document write",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -44111,13 +44234,13 @@ var package_default = {
     typecheck: "tsc -p tsconfig.json --noEmit"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.23.2",
+    "@chrischall/mcp-utils": "^0.26.1",
     "@fetchproxy/bootstrap": "^2.2.0",
-    "@fetchproxy/server": "^2.2.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@fetchproxy/server": "^2.10.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     dotenv: "^17.4.2",
     "node-html-parser": "^9.0.0",
-    zod: "^4.4.3"
+    zod: "^4.5.4"
   },
   devDependencies: {
     "@types/node": "^26.0.0",
@@ -46084,13 +46207,29 @@ try {
 }
 var COMMON = {
   name: "infinitecampus",
-  version: "2.8.2"
+  version: "2.8.3"
   // x-release-please-version
 };
 var healthState = { account, source, configError, client: null };
-if (account) {
-  const client = new ICClient(account, { refreshSession });
-  healthState.client = client;
+function unconfiguredClient(reason) {
+  const fail = () => {
+    throw new McpToolError(
+      `infinitecampus-mcp is not configured: ${reason?.message ?? "unknown error"}`,
+      {
+        hint: "Set IC_BASE_URL (your portal URL) and IC_DISTRICT (the app-name path segment), plus IC_USERNAME and IC_PASSWORD together if you are not signing in through the browser. Call ic_healthcheck for the resolved state."
+      }
+    );
+  };
+  return new Proxy({}, {
+    get(_target, prop) {
+      if (typeof prop === "symbol" || prop === "then") return void 0;
+      return fail;
+    }
+  });
+}
+{
+  const client = account ? new ICClient(account, { refreshSession }) : unconfiguredClient(configError);
+  if (account) healthState.client = client;
   const tools = [
     (server) => registerHealthcheckTools(server, healthState),
     registerDistrictTools,
@@ -46112,16 +46251,8 @@ if (account) {
     registerFeaturesTools
   ];
   const suffix = source === "fetchproxy" ? " [via fetchproxy]" : "";
-  const districtLine = `[infinitecampus-mcp] District: ${account.name} (${account.baseUrl})${suffix}`;
-  await runMcp({ ...COMMON, deps: client, tools, banner: `${districtLine}
+  const banner = account ? `[infinitecampus-mcp] District: ${account.name} (${account.baseUrl})${suffix}` : `[infinitecampus-mcp] Not configured: ${configError?.message ?? "unknown error"}
+[infinitecampus-mcp] Every tool is registered and will report this until the required env vars are set. Call ic_healthcheck for the resolved state.`;
+  await runMcp({ ...COMMON, deps: client, tools, banner: `${banner}
 ${AI_NOTICE}` });
-} else {
-  const notConfigured = `[infinitecampus-mcp] Not configured: ${configError?.message ?? "unknown error"}
-[infinitecampus-mcp] Server is running with no tools registered. Set the required env vars and reinstall.`;
-  await runMcp({
-    ...COMMON,
-    tools: [(server) => registerHealthcheckTools(server, healthState)],
-    banner: `${notConfigured}
-${AI_NOTICE}`
-  });
 }

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
-import { loadDotenvSafely, runMcp } from '@chrischall/mcp-utils';
+import { loadDotenvSafely, McpToolError, runMcp } from '@chrischall/mcp-utils';
 // quiet load of the local .env (no-throw, silent when the file is absent —
 // e.g. inside an mcpb bundle). Path is resolved next to dist/ so the same
 // `..`/.env that the previous inline dotenv call used still applies.
@@ -35,7 +35,7 @@ const AI_NOTICE = '[infinitecampus-mcp] Developed and maintained by AI (Claude).
 // Defer config errors so the server can still start cleanly when env vars
 // aren't set (e.g. during the host's install-time smoke test, before the
 // user has filled in user_config OR the user hasn't yet signed into their
-// IC portal in the browser). When not configured we register no tools and
+// IC portal in the browser). When not configured every tool still registers and
 // log a clear stderr message — far better than the previous crash loop.
 let account = null;
 let refreshSession;
@@ -51,21 +51,61 @@ catch (e) {
     configError = e;
 }
 // Hand off to mcp-utils' runMcp for the connect + stdio transport + graceful
-// shutdown. We keep the deferred-config-error pattern by deciding the registrar
-// list and banner up here: when configured we wire every
-// register<Domain>Tools(server, client) call; when not, we register no tools so
-// the host's install-time tools/list still succeeds and the user gets an
-// actionable stderr message (banner) instead of a crash loop.
+// shutdown. The registrar list is the SAME either way; only the client and the
+// banner differ. A tool surface that follows the environment is what this
+// avoids — see `unconfiguredClient`.
 const COMMON = {
     name: 'infinitecampus',
-    version: '2.8.2', // x-release-please-version
+    version: '2.8.3', // x-release-please-version
 };
 // Shared with the healthcheck so it can report the SAME state the tools see,
 // including on the unconfigured path where there are no tools at all.
 const healthState = { account, source, configError, client: null };
-if (account) {
-    const client = new ICClient(account, { refreshSession });
-    healthState.client = client;
+/**
+ * Stands in for the client when configuration is missing, so that every tool
+ * registers either way and the failure surfaces WHERE IT IS ACTIONABLE — in the
+ * answer to the tool somebody called, not in a tool list they never saw.
+ *
+ * The surface must not follow the environment. This server is hosted with
+ * `perUserChild` + `authFields`, so mcp-host spawns a principal-less child with
+ * none of the per-user config for prewarm, auto-update, restart and every
+ * admin-portal tool listing — and THAT child's list is what the portal
+ * publishes as the connector's surface. It advertised one tool for a connector
+ * that has twenty.
+ *
+ * This continues the reasoning that put the healthcheck on this path rather
+ * than reversing it: a server that can explain itself beats one that cannot,
+ * and nineteen tools that each name the missing variables explain it better
+ * than nineteen absences do. The healthcheck still reports the same state, and
+ * `healthState.client` deliberately stays null so it reports "unconfigured"
+ * rather than mistaking this stand-in for a live client.
+ */
+function unconfiguredClient(reason) {
+    const fail = () => {
+        throw new McpToolError(`infinitecampus-mcp is not configured: ${reason?.message ?? 'unknown error'}`, {
+            hint: 'Set IC_BASE_URL (your portal URL) and IC_DISTRICT (the app-name path segment), ' +
+                'plus IC_USERNAME and IC_PASSWORD together if you are not signing in through the ' +
+                'browser. Call ic_healthcheck for the resolved state.',
+        });
+    };
+    return new Proxy({}, {
+        get(_target, prop) {
+            // `then` must answer undefined or this object is thenable, and any
+            // `await client` would resolve to something other than the client.
+            // Symbols (toStringTag, node's inspect) are asked for by the runtime
+            // rather than by tool code, so they get the same treatment.
+            if (typeof prop === 'symbol' || prop === 'then')
+                return undefined;
+            return fail;
+        },
+    });
+}
+{
+    const client = account
+        ? new ICClient(account, { refreshSession })
+        : unconfiguredClient(configError);
+    if (account)
+        healthState.client = client;
     const tools = [
         (server) => registerHealthcheckTools(server, healthState),
         registerDistrictTools,
@@ -87,19 +127,10 @@ if (account) {
         registerFeaturesTools,
     ];
     const suffix = source === 'fetchproxy' ? ' [via fetchproxy]' : '';
-    const districtLine = `[infinitecampus-mcp] District: ${account.name} (${account.baseUrl})${suffix}`;
-    await runMcp({ ...COMMON, deps: client, tools, banner: `${districtLine}\n${AI_NOTICE}` });
-}
-else {
-    const notConfigured = `[infinitecampus-mcp] Not configured: ${configError?.message ?? 'unknown error'}\n` +
-        '[infinitecampus-mcp] Server is running with no tools registered. Set the required env vars and reinstall.';
-    // NOT `tools: []` any more. A server that registers nothing explains itself
-    // only on stderr, which a hosted connector never sees — so a misconfigured
-    // server was indistinguishable from a broken one. The healthcheck is the one
-    // tool that must survive this path, because this is the path that needs it.
-    await runMcp({
-        ...COMMON,
-        tools: [(server) => registerHealthcheckTools(server, healthState)],
-        banner: `${notConfigured}\n${AI_NOTICE}`,
-    });
+    const banner = account
+        ? `[infinitecampus-mcp] District: ${account.name} (${account.baseUrl})${suffix}`
+        : `[infinitecampus-mcp] Not configured: ${configError?.message ?? 'unknown error'}\n` +
+            '[infinitecampus-mcp] Every tool is registered and will report this until the ' +
+            'required env vars are set. Call ic_healthcheck for the resolved state.';
+    await runMcp({ ...COMMON, deps: client, tools, banner: `${banner}\n${AI_NOTICE}` });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinitecampus-mcp",
-  "version": "2.8.2",
+  "version": "2.8.3",
   "mcpName": "io.github.chrischall/infinitecampus-mcp",
   "description": "Infinite Campus (Campus Parent) MCP server — multi-district read + message/document write",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,13 +45,13 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.23.2",
+    "@chrischall/mcp-utils": "^0.26.1",
     "@fetchproxy/bootstrap": "^2.2.0",
-    "@fetchproxy/server": "^2.2.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@fetchproxy/server": "^2.10.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "dotenv": "^17.4.2",
     "node-html-parser": "^9.0.0",
-    "zod": "^4.4.3"
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "@types/node": "^26.0.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/infinitecampus-mcp",
     "source": "github"
   },
-  "version": "2.8.2",
+  "version": "2.8.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "infinitecampus-mcp",
-      "version": "2.8.2",
+      "version": "2.8.3",
       "transport": {
         "type": "stdio"
       },