wicker-study-mcp 2.9.0 → 2.10.0

package/README.md

@@ -17,7 +17,7 @@ the MCP server.
 For a manually supplied key, the same secure bootstrap is available as:
 
 ```sh
-WICKER_STUDY_URL='https://study.wicker.life' WICKER_STUDY_API_KEY='wsk_…' npx -y wicker-study-mcp@2.9.0 configure
+WICKER_STUDY_URL='https://study.wicker.life' WICKER_STUDY_API_KEY='wsk_…' npx -y wicker-study-mcp@2.10.0 configure
 ```
 
 ```jsonc
@@ -100,7 +100,7 @@ authoritative list of endpoints and scopes.
 
 Direct context reads do not call the model. `tutor_ask` uses the student's AI allowance and can prepare attendance changes, assignment/catch-up trackers, group milestones, focused practice, diagnostics and rubric-based draft reviews. Reuse conversation IDs. Approve only the exact proposal the student reviewed; receipts prevent double application. No tool sends email or submits assignments to Canvas. Personal completion is separate from Canvas submission status.
 
-Update an installed client to `wicker-study-mcp@2.9.0` and restart its MCP connection to discover the new tools. The companion skill is served at [SKILL.md](https://study.wicker.life/skills/wicker-study/SKILL.md); re-download it to update an existing copy.
+Update an installed client to `wicker-study-mcp@2.10.0` and restart its MCP connection to discover the new tools. The companion skill is served at [SKILL.md](https://study.wicker.life/skills/wicker-study/SKILL.md); re-download it to update an existing copy.
 
 ## Licence
 
@@ -135,3 +135,13 @@ Do not infer or store sensitive preferences from course material or third-party
 ## AI activity log
 
 Settings → AI activity (`/app/settings?tab=activity`) shows API-key requests from this release onward, with read/write/prepare filters, outcome, duration, tool/client label and confirmed-review reference. The MCP tags requests automatically. One tool may make several HTTP requests; local actions that never reach the platform are not logged. Client labels and client-reported confirmation are not independent proof of approval. The server records confirmed prepared-review IDs separately. Arguments, query text, responses and credentials are excluded. Activity is private to the account, included in data export, and removed by account-data erasure.
+
+Automatic Canvas refresh is configurable in Settings → Connections → Manage: on/off, update frequency (15 minutes to daily), material frequency (hourly to weekly), and studying/completed status. Defaults remain 30 minutes and six hours. Course selection is re-evaluated at least hourly across period boundaries. Summer/break monitoring retains the ending year and discovers upcoming next-year courses, selecting the latest eligible edition per course. Completion or no active programme pauses background collection; manual refresh remains available. These preferences require a signed-in browser, not an MCP write.
+
+## Feedback (2.10)
+
+Use `feedback_prepare` to create an exact report preview, then show it and obtain explicit user approval before `feedback_submit` with the unchanged draft ID and revision. `feedback_list` and `feedback_read` expose only the user’s reports and public replies. `feedback_reply`, `feedback_withdraw_evidence`, and `feedback_react` each require a fresh `confirmed:true` after individual approval. A prepared draft is not a submitted report. Never attach chat or source excerpts without the user choosing to share them. Feedback is separate from remembered Tutor context.
+
+Students can follow reports and withdraw evidence at `/app/feedback`; authorized staff review them at `/app/admin/feedback`. See [the operations guide](../docs/FEEDBACK.md) for data boundaries and retention.
+
+Contact sharing is optional per report: use `shareContactEmail:true` only when the student chooses it and show the returned address in the preview. `feedback_withdraw_contact` stops sharing it after fresh confirmation. Reports show receipt, investigation and completion updates with public comments; AI-assisted replies are labeled and reviewed by the team.

package/feedback-tools.mjs

@@ -0,0 +1,126 @@
+export function registerFeedbackTools(server, { z, run, api }) {
+  const id = z.string().min(1).max(180),
+    subject = z.object({
+      kind: z
+        .enum([
+          "general",
+          "answer",
+          "material",
+          "assignment",
+          "announcement",
+          "sync",
+          "attendance",
+          "credits",
+          "practice",
+        ])
+        .optional(),
+      route: z.string().max(500).optional(),
+      conversationId: id.optional(),
+      answerId: id.optional(),
+      answerRevision: id.optional(),
+      courseCode: id.optional(),
+      academicYear: id.optional(),
+      assetId: id.optional(),
+      itemId: id.optional(),
+      jobId: id.optional(),
+    });
+  const tool = (name, description, schema, handler) =>
+    server.tool(name, description, schema, run(handler));
+  tool(
+    "feedback_prepare",
+    "Prepare an encrypted feedback preview. This does NOT submit it. Show the complete returned preview and ask explicit confirmation. Include only the user’s intended feedback; excerpts require their consent. This report is separate from Tutor memory.",
+    {
+      category: z.enum([
+        "incorrect",
+        "outdated",
+        "missing",
+        "source",
+        "slow",
+        "broken",
+        "confusing",
+        "accessibility",
+        "suggestion",
+        "other",
+        "wrong-edition",
+        "incomplete-extraction",
+        "broken-download",
+        "ignored-context",
+        "too-wordy",
+        "wrong-action",
+      ]),
+      note: z.string().max(4000),
+      shareContactEmail: z
+        .boolean()
+        .optional()
+        .describe(
+          "Share the verified account email only if the user explicitly opts in. The preview shows the exact address.",
+        ),
+      subject: subject.optional(),
+      evidence: z
+        .array(
+          z.object({
+            label: z.string().max(100),
+            mediaType: z.literal("text/plain"),
+            content: z.string().max(12000),
+          }),
+        )
+        .max(5)
+        .optional(),
+    },
+    (args) => api("/api/feedback/drafts", { method: "POST", body: args }),
+  );
+  tool(
+    "feedback_submit",
+    "Submit exactly the reviewed feedback draft. Obtain fresh explicit user confirmation for this report; pass its unchanged revision. Retrying the same confirmed draft returns the same receipt.",
+    { draftId: id, revision: id },
+    (args) => api("/api/feedback/reports", { method: "POST", body: args }),
+  );
+  tool(
+    "feedback_list",
+    "Read the user’s submitted feedback and public review status. Private administrator notes are excluded.",
+    { before: id.optional() },
+    (args) => api("/api/feedback/reports", { query: args }),
+  );
+  tool(
+    "feedback_read",
+    "Read one owned feedback report, public replies and attachment metadata. Does not read any referenced chat or private course file.",
+    { reportId: id },
+    (args) => api(`/api/feedback/reports/${encodeURIComponent(args.reportId)}`),
+  );
+  tool(
+    "feedback_reply",
+    "Add the exact user-approved follow-up to an owned report.",
+    { reportId: id, body: z.string().min(1).max(4000) },
+    (args) =>
+      api(
+        `/api/feedback/reports/${encodeURIComponent(args.reportId)}/replies`,
+        { method: "POST", body: args },
+      ),
+  );
+  tool(
+    "feedback_withdraw_evidence",
+    "Permanently withdraw a shared attachment from an owned feedback report after explicit confirmation. Does not delete the original course or Tutor file.",
+    { reportId: id, evidenceId: id },
+    (args) =>
+      api(
+        `/api/feedback/reports/${encodeURIComponent(args.reportId)}/evidence/${encodeURIComponent(args.evidenceId)}`,
+        { method: "DELETE", body: args },
+      ),
+  );
+  tool(
+    "feedback_react",
+    "Record or remove the student’s explicitly chosen reaction to one exact Tutor answer revision.",
+    { subject, value: z.enum(["helpful", "not-helpful"]).nullable() },
+    (args) => api("/api/feedback/reactions", { method: "POST", body: args }),
+  );
+  tool(
+    "feedback_withdraw_contact",
+    "Stop sharing the account email on this report, after explicit user confirmation.",
+    { reportId: id },
+    (args) =>
+      api(
+        `/api/feedback/reports/${encodeURIComponent(args.reportId)}/contact`,
+        { method: "DELETE", body: args },
+      ),
+  );
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicker-study-mcp",
-  "version": "2.9.0",
+  "version": "2.10.0",
   "description": "MCP server for Wicker Study: read course material and a student's academic record, study on their behalf, collect a private Canvas course snapshot, and \u2014 with an admin key \u2014 run the editorial workflow.",
   "keywords": [
     "mcp",
@@ -30,6 +30,7 @@
   "files": [
     "server.mjs",
     "study-tools.mjs",
+    "feedback-tools.mjs",
     "write-confirmation.mjs",
     "config.mjs",
     "authorize.mjs",

package/server.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { registerFeedbackTools } from './feedback-tools.mjs'
 import { installWriteConfirmation, toolRequestContext } from './write-confirmation.mjs'
 import { registerStudyTools } from './study-tools.mjs'
 // Wicker Study MCP server — a thin stdio wrapper over the HTTP API so agents
@@ -65,7 +66,7 @@ async function apiResponse(path, { method = 'GET', body, query, timeoutMs } = {}
   const response = await fetch(url, {
     ...(timeoutMs ? { signal: AbortSignal.timeout(timeoutMs) } : {}),
     method,
-    headers: { authorization: `Bearer ${requireKey()}`, accept: 'application/json', 'x-wicker-client': 'wicker-study-mcp 2.9.0', ...(toolRequestContext.getStore() ? { 'x-wicker-tool': toolRequestContext.getStore().tool, 'x-wicker-confirmed': String(toolRequestContext.getStore().confirmed) } : {}), ...(body !== undefined ? { 'content-type': 'application/json' } : {}) },
+    headers: { authorization: `Bearer ${requireKey()}`, accept: 'application/json', 'x-wicker-client': 'wicker-study-mcp 2.10.0', ...(toolRequestContext.getStore() ? { 'x-wicker-tool': toolRequestContext.getStore().tool, 'x-wicker-confirmed': String(toolRequestContext.getStore().confirmed) } : {}), ...(body !== undefined ? { 'content-type': 'application/json' } : {}) },
     body: body !== undefined ? JSON.stringify(body) : undefined
   })
   if (!response.ok) {
@@ -92,10 +93,11 @@ const json = (value) => ({ content: [{ type: 'text', text: typeof value === 'str
 const failed = (error) => ({ isError: true, content: [{ type: 'text', text: error.message }] })
 const run = (fn) => async (args) => { try { return json(await fn(args)) } catch (error) { return failed(error) } }
 
-const server = new McpServer({ name: 'wicker-study', version: '2.9.0' })
+const server = new McpServer({ name: 'wicker-study', version: '2.10.0' })
 installWriteConfirmation(server, z)
 const courseId = z.string().describe('Course id (e.g. "sec"). Use list_courses to discover ids.')
 const chapterId = z.string().describe('Chapter id (e.g. "02").')
+registerFeedbackTools(server, { z, run, api })
 registerStudyTools(server, { z, run, api, defaultCanvasUrl: DEFAULT_CANVAS_URL })
 
 const COURSE_SOURCE_EXTENSIONS = new Set(['.pdf', '.ppt', '.pptx', '.doc', '.docx', '.txt', '.md', '.csv', '.tex', '.m', '.py', '.r', '.html', '.htm', '.png', '.jpg', '.jpeg', '.webp'])

package/write-confirmation.mjs

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks'
 export const toolRequestContext = new AsyncLocalStorage()
-const writes = new Set('wicker_sign_out join_programme canvas_corpus_sync submit_answer set_mastery review_card add_to_deck create_flashcard review_flashcard resolve_mistake record_chapter_read save_academic_plan update_planning_objective set_course_visibility apply_changes save_calendar_link sync_calendar_link remove_calendar_link canvas_import_remote_course canvas_import_remote_course_set canvas_sync_control canvas_sync_course tutor_ask tutor_approve_action tutor_delete_conversation tutor_add_source tutor_remove_source tutor_forget_context tutor_confirm_update answer_study_diagnostic'.split(' '))
+const writes = new Set('feedback_withdraw_contact feedback_submit feedback_reply feedback_withdraw_evidence feedback_react wicker_sign_out join_programme canvas_corpus_sync submit_answer set_mastery review_card add_to_deck create_flashcard review_flashcard resolve_mistake record_chapter_read save_academic_plan update_planning_objective set_course_visibility apply_changes save_calendar_link sync_calendar_link remove_calendar_link canvas_import_remote_course canvas_import_remote_course_set canvas_sync_control canvas_sync_course tutor_ask tutor_approve_action tutor_delete_conversation tutor_add_source tutor_remove_source tutor_forget_context tutor_confirm_update answer_study_diagnostic'.split(' '))
 export function requiresWriteConfirmation(name) {
   return writes.has(name) || name.startsWith('admin_') && !/^(admin_status|admin_inventory_|admin_list_|admin_estimate_)/.test(name)
 }