moodle-cli 0.7.0-alpha.5 → 0.7.0-alpha.7

package/ONBOARDING.md

@@ -19,7 +19,7 @@ Wait for the answer before doing setup work. Do not ask the student to find the
 
 Once the student shares a URL, complete the setup on their computer:
 
-- Check for Node.js 22+ and Bun. Install `moodle-cli` with the runtime available on the computer. Use `bunx --bun moodle-cli` as the command prefix when Bun is the only runtime.
+- Check for Node.js 22.13+ and Bun (older Node cannot read browser cookies). Install `moodle-cli` with the runtime available on the computer. Use `bunx --bun moodle-cli` as the command prefix when Bun is the only runtime.
 - Follow redirects and resolve the URL to the final Moodle origin in the form `https://host`. Remove the path, query, and fragment. Confirm that the origin serves Moodle before saving it.
 - Read `~/.config/moodle-cli/config.yaml` if it exists. Set `base_url` to the verified origin and preserve the other settings.
 - Tell the student that Moodle may open in their browser and that you will wait while they complete their university sign-in. Run `moodle auth login`. If a browser opens, let the student finish SSO there, then continue when the command returns.

package/README.md

@@ -6,7 +6,7 @@ Let it keep up with deadlines and grades, fetch course files, and search forum d
 
 [![npm version](https://img.shields.io/npm/v/moodle-cli?logo=npm)](https://www.npmjs.com/package/moodle-cli)
 [![CI](https://github.com/bunizao/moodle-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/bunizao/moodle-cli/actions/workflows/ci.yml)
-[![Node.js 22+](https://img.shields.io/badge/Node.js-22%2B-339933?logo=nodedotjs&logoColor=white)](https://nodejs.org/)
+[![Node.js 22.13+](https://img.shields.io/badge/Node.js-22.13%2B-339933?logo=nodedotjs&logoColor=white)](https://nodejs.org/)
 [![Bun](https://img.shields.io/badge/Bun-supported-fbf0df?logo=bun&logoColor=black)](https://bun.sh/)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
@@ -32,7 +32,7 @@ Your agent asks for your Moodle URL and opens your university's sign-in page whe
 
 ### Install and sign in manually
 
-Use Node.js 22+ or Bun:
+Use Node.js 22.13+ (needed for `node:sqlite`, which reads browser cookies) or Bun:
 
 ```bash
 # npm
@@ -176,7 +176,7 @@ moodle mcp bridge
 
 The default client connection uses `moodle mcp bridge`, which keeps the Bearer token out of client configuration. Use `moodle mcp connect CLIENT --mode remote` for clients that support authenticated remote MCP headers.
 
-Alpha version `0.7.0-alpha.5` supports MCP `2026-07-28` and a stateless compatibility lane for `2025-11-25` clients.
+Alpha version `0.7.0-alpha.7` supports MCP `2026-07-28` and a stateless compatibility lane for `2025-11-25` clients.
 
 ### Configuration
 

package/dist/moodle.js

@@ -222,8 +222,16 @@ async function getAuthenticatedSession(baseUrl, options = {}) {
   if (cached) {
     return cached;
   }
+  const cookieWarnings = [];
+  const providerOptions = {
+    ...options,
+    onCookieWarnings: (warnings) => {
+      cookieWarnings.push(...warnings);
+      options.onCookieWarnings?.(warnings);
+    }
+  };
   const browserProvider = options.browserCookieProvider ?? defaultBrowserCookieProvider;
-  const browserCookies = matchingMoodleSessionCookies(await browserProvider(baseUrl, options), baseUrl);
+  const browserCookies = matchingMoodleSessionCookies(await browserProvider(baseUrl, providerOptions), baseUrl);
   const browserSession = await firstValidSession(baseUrl, browserCookies, validate);
   if (browserSession) {
     await refreshSessionCache(baseUrl, browserSession.cookie, browserSession.context, options);
@@ -247,10 +255,22 @@ async function getAuthenticatedSession(baseUrl, options = {}) {
       return { baseUrl, cookie: refreshedSession.cookie, ...refreshedSession.context, fromCache: false };
     }
   }
-  throw new AuthError(`No usable MoodleSession found for ${baseUrl}.`, authFailureHint(baseUrl));
+  throw new AuthError(
+    `No usable MoodleSession found for ${baseUrl}.`,
+    authFailureHint(baseUrl, cookieWarnings, options.platform)
+  );
 }
 async function getAuthenticatedSessionWithBrowserFallback(baseUrl, options = {}) {
-  const authOptions = { ...options, noCache: true, nonInteractive: true };
+  const cookieWarnings = [];
+  const authOptions = {
+    ...options,
+    noCache: true,
+    nonInteractive: true,
+    onCookieWarnings: (warnings) => {
+      cookieWarnings.push(...warnings);
+      options.onCookieWarnings?.(warnings);
+    }
+  };
   const browserAuthOptions = {
     ...authOptions,
     env: { ...options.env ?? process.env, [ENV_MOODLE_SESSION]: void 0 }
@@ -271,6 +291,12 @@ async function getAuthenticatedSessionWithBrowserFallback(baseUrl, options = {})
       }
     }
   }
+  if (cookieAccessBlocked(cookieWarnings)) {
+    throw new AuthError(
+      `Cannot read browser cookies for ${baseUrl}.`,
+      cookieAccessHint(cookieWarnings, options.platform)
+    );
+  }
   const url = loginUrl(baseUrl);
   await (options.openBrowser ?? ((target) => openSystemBrowser(target, options)))(url);
   options.onBrowserOpened?.(url);
@@ -330,7 +356,11 @@ async function defaultBrowserCookieProvider(baseUrl, options = {}) {
     mode: "merge"
   });
   const braveProfiles = await braveProfilePaths(options);
-  const brave = braveProfiles.length ? await getCookies({ url: baseUrl, browsers: ["chrome"], chromeProfile: braveProfiles, mode: "merge" }) : { cookies: [] };
+  const brave = braveProfiles.length ? await getCookies({ url: baseUrl, browsers: ["chrome"], chromeProfile: braveProfiles, mode: "merge" }) : { cookies: [], warnings: [] };
+  const warnings = [...primary.warnings ?? [], ...brave.warnings ?? []];
+  if (warnings.length) {
+    options.onCookieWarnings?.(warnings);
+  }
   return [...primary.cookies, ...brave.cookies].map((cookie) => ({
     name: cookie.name,
     value: cookie.value,
@@ -345,7 +375,7 @@ async function braveProfilePaths(options = {}) {
   const roots = platform === "linux" ? [
     join2(home, ".config/BraveSoftware/Brave-Browser"),
     join2(home, ".var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser")
-  ] : platform === "win32" ? [join2(home, "AppData/Local/BraveSoftware/Brave-Browser/User Data")] : [];
+  ] : platform === "win32" ? [join2(home, "AppData/Local/BraveSoftware/Brave-Browser/User Data")] : platform === "darwin" ? [join2(home, "Library/Application Support/BraveSoftware/Brave-Browser")] : [];
   const profiles = [];
   for (const root of roots) {
     try {
@@ -375,13 +405,43 @@ async function loadSessionsFromOktaCli(baseUrl, options = {}, forceLogin = false
   const refreshed = await readOktaCookies(executable, baseUrl, execFile2);
   return refreshed.length ? refreshed : stored;
 }
-function authFailureHint(baseUrl) {
+var COOKIE_ACCESS_DENIED = /EPERM|EACCES|operation not permitted|permission denied/i;
+var COOKIE_SQLITE_UNAVAILABLE = /No such built-in module: node:sqlite/i;
+var MINIMUM_NODE_FOR_BROWSER_COOKIES = "22.13.0";
+function cookieAccessBlocked(warnings) {
+  return warnings.some((warning) => COOKIE_ACCESS_DENIED.test(warning) || COOKIE_SQLITE_UNAVAILABLE.test(warning));
+}
+function cookieAccessHint(warnings, platform = process.platform) {
+  const grant = platform === "darwin" ? "Grant Full Disk Access to the application running this command (System Settings > Privacy & Security > Full Disk Access), then restart it." : "Run this command as the user that owns the browser profile, or grant it read access to the browser cookie store.";
+  const remedy = warnings.some((warning) => COOKIE_SQLITE_UNAVAILABLE.test(warning)) ? [
+    `This Node.js runtime has no node:sqlite, which is needed to read browser cookies. Use Node.js ${MINIMUM_NODE_FOR_BROWSER_COOKIES} or newer, or run the CLI with Bun (bunx --bun moodle-cli).`
+  ] : [
+    "If this runs inside a sandboxed app (an IDE or agent terminal), rerun it from a regular terminal first.",
+    grant
+  ];
   return [
+    "The browser cookie store could not be read, so the session could not be detected.",
+    ...remedy,
+    `Alternatively set ${ENV_MOODLE_SESSION} to a valid MoodleSession cookie value.`,
+    "",
+    "Cookie store diagnostics:",
+    ...warnings.map((warning) => `  - ${warning}`)
+  ].join("\n");
+}
+function authFailureHint(baseUrl, cookieWarnings = [], platform = process.platform) {
+  if (cookieAccessBlocked(cookieWarnings)) {
+    return cookieAccessHint(cookieWarnings, platform);
+  }
+  const lines = [
     `Log in to ${loginUrl(baseUrl)} in your browser, then rerun the command.`,
     `Or set ${ENV_MOODLE_SESSION} to a valid MoodleSession cookie value.`,
     `For automatic login, install okta-auth: ${OKTA_AUTH_INSTALL_COMMAND}, then run ${OKTA_AUTH_CONFIG_COMMAND}.`,
     `okta-auth: ${OKTA_AUTH_URL}`
-  ].join("\n");
+  ];
+  if (cookieWarnings.length) {
+    lines.push("", "Cookie store diagnostics:", ...cookieWarnings.map((warning) => `  - ${warning}`));
+  }
+  return lines.join("\n");
 }
 async function invalidateCachedSession(baseUrl, options = {}) {
   await deleteCachedSession(baseUrl, cacheOptions(options));
@@ -3745,8 +3805,8 @@ function keepaliveProgramArguments(execPath = process.execPath, argv1 = process.
   }
   return [execPath, resolvedArgv1, ...tail];
 }
-function buildKeepalivePlist(programArguments, intervalMinutes, logPath) {
-  const args = programArguments.map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n");
+function buildKeepalivePlist(programArguments2, intervalMinutes, logPath) {
+  const args = programArguments2.map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n");
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
@@ -3827,7 +3887,7 @@ function escapeXml(value) {
 }
 
 // src/version.ts
-var VERSION = "0.7.0-alpha.5";
+var VERSION = "0.7.0-alpha.7";
 
 // src/forum.ts
 function parseDiscussionReference(value) {
@@ -4412,7 +4472,7 @@ function jsonCodec(container) {
   };
 }
 function jsonRegistration(connection) {
-  return connection.mode === "bridge" ? { command: connection.command, args: ["mcp", "bridge", "--profile", connection.profile] } : {
+  return connection.mode === "bridge" ? { command: connection.command, args: connection.args } : {
     type: "http",
     url: connection.endpoint,
     headers: { Authorization: `Bearer ${connection.accessToken}` }
@@ -4426,7 +4486,7 @@ function tomlBlock(registration, connection) {
   if (connection.mode === "bridge") {
     lines.push(
       `command = ${JSON.stringify(connection.command)}`,
-      `args = ${JSON.stringify(["mcp", "bridge", "--profile", connection.profile])}`
+      `args = ${JSON.stringify(connection.args)}`
     );
   } else {
     lines.push(
@@ -4478,7 +4538,11 @@ function validateProfile(profile) {
 }
 function resolveConnection(options) {
   if (options.mode !== "remote") {
-    return { mode: "bridge", command: options.command ?? "moodle", profile: options.profile };
+    return {
+      mode: "bridge",
+      command: options.command ?? "moodle",
+      args: [...options.commandArgs ?? [], "mcp", "bridge", "--profile", options.profile]
+    };
   }
   if (!options.endpoint || !options.accessToken) {
     throw new Error("Remote MCP connection requires an endpoint and access token");
@@ -4498,6 +4562,15 @@ function resolveConnection(options) {
   return { mode: "remote", endpoint: endpoint.toString(), accessToken: options.accessToken };
 }
 
+// src/mcp/self-command.ts
+function selfCommand(argv = process.argv, execPath = process.execPath) {
+  const script = argv[1];
+  return script && script !== execPath ? { command: execPath, args: [script] } : { command: execPath, args: [] };
+}
+function runtimeCommand(command, args) {
+  return command ? { command, args: [...args ?? []] } : selfCommand();
+}
+
 // src/mcp/connectors/node-connectors.ts
 import { chmod as chmod2, mkdir as mkdir4, readFile as readFile3, rm as rm3, stat as stat2, writeFile as writeFile4 } from "fs/promises";
 import { homedir as homedir5 } from "os";
@@ -4530,9 +4603,11 @@ function createDefaultClientConnectors(profile, options = {}) {
   const home = options.homeDirectory ?? homedir5();
   const platform = options.platform ?? process.platform;
   const fileSystem = options.fileSystem ?? new NodeConnectorFileSystem();
+  const runtime = runtimeCommand(options.command, options.commandArgs);
   const shared = {
     profile,
-    command: options.command,
+    command: runtime.command,
+    commandArgs: runtime.args,
     mode: options.mode,
     endpoint: options.endpoint,
     accessToken: options.accessToken
@@ -5279,8 +5354,8 @@ var DeploymentPlanError = class extends Error {
   code;
 };
 var DeploymentApplyError = class extends Error {
-  constructor(code, message) {
-    super(message);
+  constructor(code, message, options) {
+    super(message, options);
     this.code = code;
     this.name = "DeploymentApplyError";
   }
@@ -5309,7 +5384,7 @@ var ManagedMcpDeployment = class {
     const receipt = replacingExisting || remote === null ? null : matchingReceipt;
     const existing = remote && receipt ? { ...remote, productionEndpoint: receipt.productionEndpoint, releaseDigest: receipt.releaseDigest } : remote;
     const rotate = intent.rotateToken === true && credentials !== null;
-    const releaseChanged = existing?.releaseDigest !== intent.releaseDigest;
+    const releaseChanged = existing?.releaseDigest !== intent.releaseDigest || receipt?.restoredRelease === true;
     const uploadCandidate = !existing || replacingExisting || releaseChanged || intent.repair === true || rotate;
     return {
       intent: { ...intent },
@@ -5356,20 +5431,13 @@ var ManagedMcpDeployment = class {
       yield completed(activeStage);
       activeStage = "upload_private_credentials";
       yield started(activeStage);
-      if (plan.uploadCandidate) {
-        if (plan.operation === "create") {
-          initializedWorker = await this.dependencies.wrangler.initializeWorker({
-            accountId: plan.intent.accountId,
-            workerName: plan.intent.workerName,
-            configPath: prepared.wranglerConfigPath,
-            releaseDigest: plan.intent.releaseDigest
-          });
-        }
-        await this.dependencies.wrangler.uploadSecrets({
+      if (plan.uploadCandidate && plan.operation === "create") {
+        initializedWorker = await this.dependencies.wrangler.initializeWorker({
           accountId: plan.intent.accountId,
           workerName: plan.intent.workerName,
           configPath: prepared.wranglerConfigPath,
-          secretsFilePath: prepared.secretsFilePath
+          secretsFilePath: prepared.secretsFilePath,
+          releaseDigest: plan.intent.releaseDigest
         });
         secretsUploaded = true;
       }
@@ -5385,14 +5453,17 @@ var ManagedMcpDeployment = class {
           accountId: plan.intent.accountId,
           workerName: plan.intent.workerName,
           configPath: prepared.wranglerConfigPath,
+          secretsFilePath: prepared.secretsFilePath,
           releaseDigest: plan.intent.releaseDigest,
           productionEndpoint: productionEndpoint2
         });
+        secretsUploaded = true;
         if (!candidate.previewEndpoint) {
           await this.dependencies.wrangler.promote({
             accountId: plan.intent.accountId,
             workerName: plan.intent.workerName,
-            versionId: candidate.versionId
+            versionId: candidate.versionId,
+            releaseDigest: plan.intent.releaseDigest
           });
           promoted = true;
         }
@@ -5434,7 +5505,8 @@ var ManagedMcpDeployment = class {
         await this.dependencies.wrangler.promote({
           accountId: plan.intent.accountId,
           workerName: plan.intent.workerName,
-          versionId: candidate.versionId
+          versionId: candidate.versionId,
+          releaseDigest: plan.intent.releaseDigest
         });
         promoted = true;
       }
@@ -5535,15 +5607,14 @@ var ManagedMcpDeployment = class {
     let readinessReasonCode = null;
     let sessionRevision = null;
     if (worker && credentials) {
-      const remoteReadiness = await this.dependencies.worker.getReadiness({
-        endpoint: receipt.productionEndpoint,
-        sessionSyncToken: credentials.sessionSyncToken
-      });
+      const target = { endpoint: receipt.productionEndpoint, sessionSyncToken: credentials.sessionSyncToken };
+      await this.dependencies.worker.touchSession(target);
+      const remoteReadiness = await this.dependencies.worker.getReadiness(target);
       readiness = remoteReadiness.status;
       readinessReasonCode = remoteReadiness.reasonCode;
       sessionRevision = remoteReadiness.revision;
     }
-    const resolvedWorker = worker ? { ...worker, productionEndpoint: receipt.productionEndpoint } : null;
+    const resolvedWorker = worker ? { ...worker, productionEndpoint: receipt.productionEndpoint, releaseDigest: worker.releaseDigest || receipt.releaseDigest } : null;
     return {
       profile,
       worker: resolvedWorker,
@@ -5606,6 +5677,7 @@ var ManagedMcpDeployment = class {
       await this.dependencies.receipts.write({
         ...receipt,
         productionVersionId: worker.previousHealthyVersionId,
+        ...swappedDigests(receipt),
         sessionRevision: upload.revision
       });
       await this.reconcileLocalIntegrations(profile);
@@ -5652,7 +5724,8 @@ var ManagedMcpDeployment = class {
     }
     await this.dependencies.receipts.write({
       ...receipt,
-      productionVersionId: previousVersionId
+      productionVersionId: previousVersionId,
+      ...swappedDigests(receipt)
     });
     return { status: "restored", versionId: previousVersionId };
   }
@@ -5759,6 +5832,7 @@ function makeReceipt(plan, candidate, sessionRevision) {
       productionEndpoint: candidate.productionEndpoint,
       productionVersionId: candidate.versionId,
       releaseDigest: plan.intent.releaseDigest,
+      ...previousDigest(plan.existing?.releaseDigest),
       sessionRevision
     };
   }
@@ -5774,9 +5848,16 @@ function makeReceipt(plan, candidate, sessionRevision) {
     productionEndpoint: plan.existing.productionEndpoint,
     productionVersionId: plan.existing.productionVersionId,
     releaseDigest: plan.existing.releaseDigest,
+    ...previousDigest(plan.receipt?.previousReleaseDigest),
     sessionRevision
   };
 }
+function previousDigest(digest2) {
+  return digest2 === void 0 ? {} : { previousReleaseDigest: digest2 };
+}
+function swappedDigests(receipt) {
+  return { releaseDigest: receipt.previousReleaseDigest ?? "", previousReleaseDigest: receipt.releaseDigest, restoredRelease: true };
+}
 function started(stageId) {
   return event(stageId, "started");
 }
@@ -5797,7 +5878,8 @@ function asDeploymentError(error) {
   if (error instanceof DeploymentApplyError) {
     return error;
   }
-  return new DeploymentApplyError("DEPLOYMENT_FAILED", "The managed Moodle MCP deployment failed");
+  const detail = error instanceof Error && error.message ? `: ${error.message}` : "";
+  return new DeploymentApplyError("DEPLOYMENT_FAILED", `The managed Moodle MCP deployment failed${detail}`, { cause: error });
 }
 
 // src/mcp/deployment/node-adapters.ts
@@ -5945,17 +6027,19 @@ function macOSPlan(options, intervalMinutes) {
   const label = `com.moodle-cli.mcp-renewal.${options.profile}`;
   const path4 = `${trimEnd(options.homeDirectory, "/")}/Library/LaunchAgents/${label}.plist`;
   const target = `gui/${options.uid}`;
-  const args = renewalArgs(options.profile);
+  const logPath = `${trimEnd(options.homeDirectory, "/")}/Library/Logs/${label}.log`;
   const plist = [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
     '<plist version="1.0"><dict>',
     `<key>Label</key><string>${xml(label)}</string>`,
     "<key>ProgramArguments</key><array>",
-    ...[options.executable, ...args].map((arg) => `<string>${xml(arg)}</string>`),
+    ...programArguments(options).map((arg) => `<string>${xml(arg)}</string>`),
     "</array>",
     `<key>StartInterval</key><integer>${intervalMinutes * 60}</integer>`,
     "<key>RunAtLoad</key><true/>",
+    `<key>StandardOutPath</key><string>${xml(logPath)}</string>`,
+    `<key>StandardErrorPath</key><string>${xml(logPath)}</string>`,
     "</dict></plist>",
     ""
   ].join("\n");
@@ -5976,7 +6060,7 @@ function linuxPlan(options, intervalMinutes) {
   const directory = `${trimEnd(options.homeDirectory, "/")}/.config/systemd/user`;
   const servicePath = `${directory}/${label}.service`;
   const timerPath = `${directory}/${label}.timer`;
-  const command = [options.executable, ...renewalArgs(options.profile)].map(systemdQuote).join(" ");
+  const command = programArguments(options).map(systemdQuote).join(" ");
   const service = [
     "[Unit]",
     `Description=Moodle MCP session renewal (${options.profile})`,
@@ -6020,7 +6104,7 @@ function linuxPlan(options, intervalMinutes) {
 function windowsPlan(options, intervalMinutes) {
   const label = `Moodle CLI MCP Renewal (${options.profile})`;
   const path4 = `${trimEnd(options.homeDirectory, "\\/")}\\AppData\\Local\\moodle-cli\\renewal\\${options.profile}.xml`;
-  const argumentsText = renewalArgs(options.profile).map(windowsArgument).join(" ");
+  const argumentsText = [...options.executableArgs ?? [], ...renewalArgs(options.profile)].map(windowsArgument).join(" ");
   const task = [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">',
@@ -6047,6 +6131,9 @@ function windowsPlan(options, intervalMinutes) {
 function renewalArgs(profile) {
   return ["mcp", "renewal", "run", "--profile", profile, "--json"];
 }
+function programArguments(options) {
+  return [options.executable, ...options.executableArgs ?? [], ...renewalArgs(options.profile)];
+}
 function validateOptions(options) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(options.profile)) {
     throw new Error("Invalid renewal profile name");
@@ -6054,6 +6141,9 @@ function validateOptions(options) {
   if (!options.executable || /[\r\n]/.test(options.executable)) {
     throw new Error("Invalid renewal executable path");
   }
+  if ((options.executableArgs ?? []).some((arg) => /[\r\n]/.test(arg))) {
+    throw new Error("Invalid renewal executable arguments");
+  }
   if (!options.homeDirectory || /[\r\n]/.test(options.homeDirectory)) {
     throw new Error("Invalid renewal home directory");
   }
@@ -6128,10 +6218,12 @@ function createDefaultRenewalInstaller(profile, options = {}) {
   if (!isSupportedPlatform(platform)) {
     throw new Error(`Moodle MCP renewal is not supported on ${platform}`);
   }
+  const runtime = runtimeCommand(options.executable, options.executableArgs);
   const plan = buildRenewalInstallPlan({
     platform,
     profile,
-    executable: options.executable ?? process.argv[1] ?? process.execPath,
+    executable: runtime.command,
+    executableArgs: runtime.args,
     homeDirectory: options.homeDirectory ?? homedir7(),
     uid: options.uid ?? (typeof process.getuid === "function" ? process.getuid() : void 0),
     intervalMinutes: options.intervalMinutes
@@ -6242,7 +6334,7 @@ var NodeDeploymentCommandRunner = class {
 };
 var WranglerCommandError = class extends Error {
   constructor(exitCode, stdout, stderr) {
-    super("Packaged Wrangler command failed");
+    super(wranglerFailureMessage(stderr, stdout));
     this.exitCode = exitCode;
     this.stdout = stdout;
     this.stderr = stderr;
@@ -6252,6 +6344,13 @@ var WranglerCommandError = class extends Error {
   stdout;
   stderr;
 };
+function wranglerFailureMessage(stderr, stdout) {
+  const lines = `${stderr}
+${stdout}`.replace(/\u001B\[[0-9;]*m/gu, "").split(/\r?\n/u).map((line) => line.trim());
+  const errorIndex = lines.findIndex((line) => line.includes("[ERROR]"));
+  const detail = errorIndex >= 0 ? lines.slice(errorIndex).filter((line) => line && !/^(To learn more|If you think this is a bug|Logs were written)/u.test(line)).slice(0, 3).join(" ").replace(/^.*\[ERROR\]\s*/u, "") : "";
+  return detail ? `Packaged Wrangler command failed: ${detail.slice(0, 600)}` : "Packaged Wrangler command failed";
+}
 var NodeWranglerDeploymentAdapter = class {
   wranglerBinPath;
   runner;
@@ -6294,8 +6393,8 @@ ${error.stderr}`)) {
       throw error;
     }
     const document = parseJsonOutput(result.stdout);
-    const versionIds = deploymentVersionIds(document);
-    if (!versionIds.length) {
+    const [current, previous] = deploymentHistory(document);
+    if (!current) {
       return null;
     }
     const productionEndpoint = firstWorkersDevUrl(document) ?? `https://${workerName}.workers.dev`;
@@ -6306,22 +6405,11 @@ ${error.stderr}`)) {
       deploymentId: deploymentId2,
       ownershipTag: deploymentId2,
       productionEndpoint,
-      productionVersionId: versionIds[0],
-      previousHealthyVersionId: versionIds[1] ?? null,
-      releaseDigest: releaseDigestFromDocument(document) ?? ""
+      productionVersionId: current.versionId,
+      previousHealthyVersionId: previous?.versionId ?? null,
+      releaseDigest: releaseDigestFromMessage(current.message) ?? ""
     };
   }
-  async uploadSecrets(input) {
-    await this.wrangler([
-      "secret",
-      "bulk",
-      input.secretsFilePath,
-      "--name",
-      input.workerName,
-      "--config",
-      input.configPath
-    ], input.accountId);
-  }
   async initializeWorker(input) {
     let result = null;
     try {
@@ -6331,6 +6419,8 @@ ${error.stderr}`)) {
         input.workerName,
         "--config",
         input.configPath,
+        "--secrets-file",
+        input.secretsFilePath,
         "--message",
         `moodle-cli-bootstrap:${input.releaseDigest}`
       ], input.accountId);
@@ -6365,6 +6455,8 @@ ${error.stderr}`)) {
         input.workerName,
         "--config",
         input.configPath,
+        "--secrets-file",
+        input.secretsFilePath,
         "--preview-alias",
         "moodle-cli-candidate",
         "--message",
@@ -6386,6 +6478,8 @@ ${error.stderr}`)) {
       await rm6(outputFilePath, { force: true });
     }
   }
+  // restoreProduction re-deploys an older version whose digest is unknown, so the
+  // release annotation is only written when the caller knows it.
   async promote(input) {
     await this.wrangler([
       "versions",
@@ -6393,7 +6487,8 @@ ${error.stderr}`)) {
       `${input.versionId}@100`,
       "--name",
       input.workerName,
-      "--yes"
+      "--yes",
+      ...input.releaseDigest ? ["--message", `moodle-cli-release:${input.releaseDigest}`] : []
     ], input.accountId);
   }
   async restoreProduction(input) {
@@ -6488,7 +6583,7 @@ var DefaultMoodleSessionSource = class {
   }
   options;
   async loadValidated(_profile, moodleOrigin) {
-    const session = this.options.interactive === false ? await getAuthenticatedSession(moodleOrigin, { ...this.options, nonInteractive: true }) : await getAuthenticatedSessionWithBrowserFallback(moodleOrigin, this.options);
+    const session = this.options.interactive === false ? await getAuthenticatedSession(moodleOrigin, { ...this.options, nonInteractive: true, noCache: true }) : await getAuthenticatedSessionWithBrowserFallback(moodleOrigin, this.options);
     return {
       moodleOrigin,
       cookieName: session.cookie.name,
@@ -6530,7 +6625,7 @@ var FetchManagedWorkerClient = class {
       return { revision: body.revision };
     }
     const code = isRecord8(body) && typeof body.code === "string" ? body.code : "SESSION_UPLOAD_FAILED";
-    throw new DeploymentApplyError(code, "The Worker rejected the Moodle session update");
+    throw new DeploymentApplyError(code, `The Worker rejected the Moodle session update (${code})`);
   }
   async getReadiness(input) {
     const response = await this.fetchWithRetry(endpointUrl(input.endpoint, "/readyz"), {
@@ -6548,6 +6643,12 @@ var FetchManagedWorkerClient = class {
     }
     return { status: "fail", reasonCode: null, revision: null };
   }
+  async touchSession(input) {
+    await this.fetchWithRetry(endpointUrl(input.endpoint, "/session/touch"), {
+      method: "POST",
+      headers: { authorization: `Bearer ${input.sessionSyncToken}` }
+    }, isRetryableWorkerRouting);
+  }
   async runSmoke(input) {
     const health = await this.fetchWithRetry(
       endpointUrl(input.endpoint, "/healthz"),
@@ -6657,7 +6758,7 @@ var PrivateDeploymentReceiptStore = class {
 function createDefaultManagedDeployment(options) {
   const homeDirectory = options.homeDirectory ?? homedir8();
   const platform = options.platform ?? process.platform;
-  const executable = options.executable ?? process.argv[1] ?? process.execPath;
+  const runtime = runtimeCommand(options.executable, options.executableArgs);
   const defaults = {
     wrangler: new NodeWranglerDeploymentAdapter({ wranglerBinPath: options.wranglerBinPath }),
     materializer: new NodeReleaseMaterializer({
@@ -6671,14 +6772,16 @@ function createDefaultManagedDeployment(options) {
       ...options.renewal,
       platform,
       homeDirectory,
-      executable,
+      executable: runtime.command,
+      executableArgs: runtime.args,
       uid: options.uid
     }),
     clients: new DefaultClientIntegration({
       ...options.connector,
       platform,
       homeDirectory,
-      command: executable
+      command: runtime.command,
+      commandArgs: runtime.args
     }),
     receipts: new PrivateDeploymentReceiptStore(join7(homeDirectory, ".config", "moodle-cli", "mcp", "deployments")),
     createToken: () => randomBytes(32).toString("base64url")
@@ -6737,6 +6840,9 @@ function isRetryableSessionUpload(status) {
 function isRetryableWorkerPropagation(status) {
   return status === 404 || status === 429 || status >= 500;
 }
+function isRetryableWorkerRouting(status) {
+  return status === 404 || status === 429;
+}
 async function safeJson(response) {
   try {
     return await response.json();
@@ -6789,30 +6895,35 @@ async function readWranglerVersionUpload(outputFilePath, workerName) {
   }
   throw new DeploymentApplyError("CANDIDATE_UPLOAD_INVALID", "Wrangler wrote unsupported candidate metadata");
 }
-function collectStrings(value, keys) {
-  const result = [];
-  visit(value, (key, item) => {
-    if (keys.has(key) && typeof item === "string") {
-      result.push(item);
+function deploymentHistory(value) {
+  const entries = [];
+  visit(value, (_key, item) => {
+    if (!isRecord8(item) || !Array.isArray(item.versions)) {
+      return;
     }
+    const versionId = activeVersionId(item.versions);
+    if (!versionId) {
+      return;
+    }
+    const createdOn = typeof item.created_on === "string" ? Date.parse(item.created_on) : Number.NaN;
+    const message = isRecord8(item.annotations) ? item.annotations["workers/message"] : void 0;
+    entries.push({
+      versionId,
+      message: typeof message === "string" ? message : null,
+      createdOn: Number.isNaN(createdOn) ? 0 : createdOn,
+      index: entries.length
+    });
   });
-  return result;
+  return entries.sort((a, b) => b.createdOn - a.createdOn || b.index - a.index).map(({ versionId, message }) => ({ versionId, message }));
 }
-function deploymentVersionIds(value) {
-  const ids = collectStrings(value, /* @__PURE__ */ new Set(["version_id", "versionId"]));
-  return [...new Set(ids)];
+function activeVersionId(versions) {
+  const records = versions.filter(isRecord8);
+  const active = records.find((version) => version.percentage === 100) ?? records[0];
+  const id = active?.version_id ?? active?.versionId;
+  return typeof id === "string" ? id : null;
 }
-function releaseDigestFromDocument(value) {
-  let digestValue = null;
-  visit(value, (_key, item) => {
-    if (!digestValue && typeof item === "string") {
-      const match = item.match(/moodle-cli-release:([a-zA-Z0-9._-]+)/u);
-      if (match?.[1]) {
-        digestValue = match[1];
-      }
-    }
-  });
-  return digestValue;
+function releaseDigestFromMessage(message) {
+  return message?.match(/moodle-cli-release:([a-zA-Z0-9._-]+)/u)?.[1] ?? null;
 }
 function collectAccountObjects(value) {
   const accounts = [];
@@ -7744,8 +7855,7 @@ var DefaultMcpCommandService = class {
     this.worker = options.worker ?? new FetchManagedWorkerClient(options.fetchImpl);
     this.renewal = options.renewal ?? new DefaultRenewalIntegration({
       platform: process.platform,
-      homeDirectory: this.homeDirectory,
-      executable: process.argv[1] ?? process.execPath
+      homeDirectory: this.homeDirectory
     });
     this.sessions = options.sessions ?? createBackgroundMoodleSessionSource({
       env: options.env,
@@ -7908,7 +8018,6 @@ var DefaultMcpCommandService = class {
     const connectors = createDefaultClientConnectors(profile, {
       homeDirectory: this.homeDirectory,
       platform: process.platform,
-      command: process.argv[1] ?? "moodle",
       mode: input.mode,
       ...input.mode === "remote" ? { endpoint, accessToken: credentials.mcpAccessToken } : {}
     });
@@ -7982,10 +8091,9 @@ var DefaultMcpCommandService = class {
       throw new UsageError(`No managed Moodle MCP deployment exists for profile ${profile}.`);
     }
     let receipt = storedReceipt;
-    const readiness = await this.worker.getReadiness({
-      endpoint: receipt.productionEndpoint,
-      sessionSyncToken: credentials.sessionSyncToken
-    });
+    const target = { endpoint: receipt.productionEndpoint, sessionSyncToken: credentials.sessionSyncToken };
+    await this.worker.touchSession(target);
+    const readiness = await this.worker.getReadiness(target);
     if (readiness.revision !== null && readiness.revision !== receipt.sessionRevision) {
       receipt = await this.writeRenewalRevision(receipt, readiness.revision);
     }
@@ -7997,6 +8105,7 @@ var DefaultMcpCommandService = class {
       agentInstalled: await this.renewal.inspect(profile)
     };
     let replacement = null;
+    let signInDetail;
     if (snapshot.remote === "expiring" || snapshot.remote === "expired") {
       try {
         replacement = await this.sessions.loadValidated(profile, receipt.moodleOrigin);
@@ -8006,6 +8115,7 @@ var DefaultMcpCommandService = class {
           throw error;
         }
         snapshot.replacement = { source: "mfa_required" };
+        signInDetail = [error.message, error.hint].filter(Boolean).join(" ");
       }
     }
     let uploaded = false;
@@ -8058,9 +8168,10 @@ var DefaultMcpCommandService = class {
         text: "Moodle MCP session renewed."
       };
     }
+    const detail = decision.state === "needs_sign_in" && signInDetail ? { detail: signInDetail } : {};
     return {
-      data: { profile, state: decision.state, reasonCode: decision.reasonCode, revision: receipt.sessionRevision },
-      text: renewalResultText(decision)
+      data: { profile, state: decision.state, reasonCode: decision.reasonCode, revision: receipt.sessionRevision, ...detail },
+      text: [renewalResultText(decision), signInDetail].filter(Boolean).join("\n")
     };
   }
   async writeRenewalRevision(receipt, revision) {
@@ -8111,7 +8222,6 @@ var DefaultMcpCommandService = class {
       compatibilityDate: this.options.compatibilityDate ?? WORKER_COMPATIBILITY_DATE,
       homeDirectory: this.homeDirectory,
       platform: process.platform,
-      executable: process.argv[1] ?? process.execPath,
       fetch: this.options.fetchImpl,
       auth: {
         env: this.options.env,
@@ -8183,8 +8293,7 @@ Selection: `)).trim());
   async connectedClientNames(profile) {
     const connectors = createDefaultClientConnectors(profile, {
       homeDirectory: this.homeDirectory,
-      platform: process.platform,
-      command: process.argv[1] ?? "moodle"
+      platform: process.platform
     });
     const clients = [];
     for (const connector of connectors) {

package/dist/worker/worker.js

@@ -20597,7 +20597,7 @@ function stringValue(value) {
 }
 
 // src/version.ts
-var VERSION = "0.7.0-alpha.5";
+var VERSION = "0.7.0-alpha.7";
 
 // src/worker/http.ts
 var HEALTH_PATH = "/healthz";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moodle-cli",
-  "version": "0.7.0-alpha.5",
+  "version": "0.7.0-alpha.7",
   "description": "Terminal-first CLI for Moodle LMS",
   "license": "MIT",
   "type": "module",
@@ -47,7 +47,7 @@
     "vitest": "^3.2.4"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=22.13"
   },
   "repository": {
     "type": "git",