Skip to content

v0.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Sep 18:57
· 320 commits to main since this release
v0.7.0
This tag was signed with the committer’s verified signature.
bunizao Lucian B
SSH Key Fingerprint: rucLG4O1YmMaXfYynsTdWKY3zeE5UaJOg9H4Sg+rLwY
Verified
Learn about vigilant mode.
cabeceb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

moodle-cli 0.7.0

Moodle access for terminal and AI clients, with a managed private MCP server and authenticated file downloads.

What's included

  • Local stdio MCP and a private Cloudflare Worker for one Moodle account, exposing eleven read-only tools for profile, courses, activities, deadlines, grades, forums and files.
  • Claude.ai OAuth connections with one-time pairing, PKCE S256, rotating refresh tokens, and owner commands to list or revoke clients.
  • MCP compatibility with 2026-07-28, 2025-11-25, 2025-06-18 and 2025-03-26, including browser-tested authorization redirects.
  • Authenticated file downloads and embedded MCP file resources up to 16 MiB.
  • Managed deployment, background session renewal, local client setup, live status, repair and compatible rollback.
  • Readable terminal tables, structured JSON output and actionable Moodle error messages.

Upgrade

npm install -g moodle-cli@0.7.0
moodle --version

Node.js 22.13 or newer is required for browser cookie access; Bun is also supported. Existing configuration remains in ~/.config/moodle-cli/.

Update an existing managed Worker with moodle mcp deploy. Publishing or installing the npm package does not update an already deployed Worker. After upgrading from an earlier prerelease, pair hosted OAuth clients again with moodle mcp pair.

Session and deployment protections

  • Encrypt the full remote session record and local session cache, with OS-protected local keys and credentials. --no-cache bypasses both reads and writes.
  • Reject session replacement by another Moodle account and prevent cookies from following redirects to foreign origins.
  • Invalidate OAuth access on revocation or owner credential rotation; reclaim expired pending registrations without evicting approved clients.
  • Deploy Worker code, secrets and Durable Object migrations atomically. Verify a compatible recovery release before updates and refuse incompatible rollback. Recovery mode supports the owner's static bridge while OAuth is unavailable.
  • Retain accurate deployment history, session revisions and release digests after interrupted updates or rollback.

Verification

  • 365 tests pass locally under Node and Bun; the Windows protected-store test runs in Windows CI.
  • Release CI checks Node 22, Node 24, Bun, types, CLI and Worker builds, generated skill files and standalone binaries.
  • Real workerd tests cover account isolation, cross-origin redirects, refresh replay, credential rotation and concurrent pairing. Chromium verifies the authorization callback.
  • Installed-tarball checks exercise CLI version, command help, terminal table output and JSON output with synthetic Moodle responses.
  • Both repository and fresh production-install dependency audits pass. The patched terminal-table dependency is bundled so installs retain the audited transitive versions.
Assets 4
Loading