infinitecampus-mcp 3.1.3 → 3.1.4

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Infinite Campus (Campus Parent) — grades, attendance, assignments, messages, documents",
-    "version": "3.1.3"
+    "version": "3.1.4"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Infinite Campus",
       "source": "./",
       "description": "Infinite Campus (Campus Parent) MCP server for Claude — grades, attendance, assignments, messages, and documents via natural language",
-      "version": "3.1.3",
+      "version": "3.1.4",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "infinitecampus-mcp",
   "displayName": "Infinite Campus",
-  "version": "3.1.3",
+  "version": "3.1.4",
   "description": "Infinite Campus (Campus Parent) MCP server for Claude — grades, attendance, assignments, messages, and documents",
   "author": {
     "name": "Chris Hall",

package/dist/bundle.js

@@ -67471,7 +67471,7 @@ function resolveDownloadDir(env = process.env) {
 // package.json
 var package_default = {
   name: "infinitecampus-mcp",
-  version: "3.1.3",
+  version: "3.1.4",
   mcpName: "io.github.chrischall/infinitecampus-mcp",
   description: "Infinite Campus (Campus Parent) MCP server \u2014 multi-district read + message/document write",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -67520,7 +67520,7 @@ var package_default = {
     "@fetchproxy/bootstrap": "^3.2.0",
     "@fetchproxy/server": "^3.2.0",
     "@modelcontextprotocol/server": "^2.0.0",
-    dotenv: "^17.4.2",
+    dotenv: "^18.0.2",
     "node-html-parser": "^9.0.0",
     zod: "^4.6.5"
   },
@@ -68459,7 +68459,7 @@ async function writeConfined(real, requested, buf, overwrite) {
   const flags = O_WRONLY | O_CREAT | O_NOFOLLOW | (overwrite ? O_TRUNC : O_EXCL);
   let handle;
   try {
-    handle = await open2(real, flags, 438);
+    handle = await open2(real, flags, 384);
   } catch (e) {
     const code = e.code;
     if (code === "ELOOP") throw new InvalidPathError(requested, "is a symlink");
@@ -68467,6 +68467,7 @@ async function writeConfined(real, requested, buf, overwrite) {
     throw e;
   }
   try {
+    if (overwrite) await handle.chmod(384);
     await handle.writeFile(buf);
   } finally {
     await handle.close();
@@ -69588,7 +69589,7 @@ try {
 }
 var COMMON = {
   name: "infinitecampus",
-  version: "3.1.3"
+  version: "3.1.4"
   // x-release-please-version
 };
 var healthState = { account, source, configError, client: null };

package/dist/client.js

@@ -592,7 +592,9 @@ async function writeConfined(real, requested, buf, overwrite) {
     const flags = O_WRONLY | O_CREAT | O_NOFOLLOW | (overwrite ? O_TRUNC : O_EXCL);
     let handle;
     try {
-        handle = await open(real, flags, 0o666);
+        // Owner-only (fleet-audit#1027): these are a child's report cards and
+        // transcripts, so match the 0600 session cache rather than 0666 & ~umask.
+        handle = await open(real, flags, 0o600);
     }
     catch (e) {
         const code = e.code;
@@ -603,6 +605,11 @@ async function writeConfined(real, requested, buf, overwrite) {
         throw e;
     }
     try {
+        // The create mode only applies to a NEW file; an overwrite truncates an
+        // existing inode and keeps its mode, so tighten it explicitly. (fchmod is
+        // a no-op for the mode bits on Windows.)
+        if (overwrite)
+            await handle.chmod(0o600);
         await handle.writeFile(buf);
     }
     finally {

package/dist/index.js

@@ -56,7 +56,7 @@ catch (e) {
 // avoids — see `unconfiguredClient`.
 const COMMON = {
     name: 'infinitecampus',
-    version: '3.1.3', // x-release-please-version
+    version: '3.1.4', // x-release-please-version
 };
 // Shared with the healthcheck so it can report the SAME state the tools see,
 // including on the unconfigured path where there are no tools at all.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinitecampus-mcp",
-  "version": "3.1.3",
+  "version": "3.1.4",
   "mcpName": "io.github.chrischall/infinitecampus-mcp",
   "description": "Infinite Campus (Campus Parent) MCP server — multi-district read + message/document write",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -49,7 +49,7 @@
     "@fetchproxy/bootstrap": "^3.2.0",
     "@fetchproxy/server": "^3.2.0",
     "@modelcontextprotocol/server": "^2.0.0",
-    "dotenv": "^17.4.2",
+    "dotenv": "^18.0.2",
     "node-html-parser": "^9.0.0",
     "zod": "^4.6.5"
   },

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/infinitecampus-mcp",
     "source": "github"
   },
-  "version": "3.1.3",
+  "version": "3.1.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "infinitecampus-mcp",
-      "version": "3.1.3",
+      "version": "3.1.4",
       "transport": {
         "type": "stdio"
       },