brightspace-d2l-mcp 1.0.0

package/build/cli/setup.js

@@ -0,0 +1,189 @@
+import { execFileSync } from "node:child_process";
+import { readStoredConfig, writeStoredConfig } from "../utils/config.js";
+import { loginWithBrowser, LoginError, NoBrowserError, TokenManager } from "../auth/index.js";
+import { SERVER_NAME } from "../utils/paths.js";
+import { resolveSchool } from "./school.js";
+import { addToClient, allowToolsInClaudeCode, detectClients, isClaudeDesktopRunning, quitClaudeDesktop, serverEntry, } from "./clients.js";
+import * as ui from "./ui.js";
+export async function runSetup(flags) {
+    if (flags.yes)
+        ui.setNonInteractive();
+    console.log(`\n${ui.bold("Brightspace for your AI apps")} ${ui.dim("· setup takes about a minute")}`);
+    ui.step(1, 3, "Your school");
+    const saved = readStoredConfig().baseUrl;
+    let baseUrl = null;
+    let input = flags.school ?? "";
+    if (!input && saved) {
+        if (await ui.confirm(`Use ${ui.bold(saved)}?`))
+            input = saved;
+    }
+    while (!baseUrl) {
+        if (!input) {
+            if (!ui.interactive) {
+                ui.fail("No school given. Run again with --school <your Brightspace address>.");
+                return 1;
+            }
+            ui.info(ui.dim("Open Brightspace in your browser and copy the link from the address bar."));
+            ui.info(ui.dim("Examples: yourschool.brightspace.com, yourschool.desire2learn.com, or any link to a course page."));
+            input = await ui.ask("Brightspace address:");
+        }
+        const result = await resolveSchool(input);
+        if (result.ok) {
+            baseUrl = result.baseUrl;
+        }
+        else {
+            ui.fail(result.reason);
+            if (!ui.interactive)
+                return 1;
+            input = "";
+        }
+    }
+    writeStoredConfig({ baseUrl });
+    ui.ok(`Brightspace found at ${ui.bold(baseUrl)}`);
+    ui.step(2, 3, "Sign in");
+    if (flags.skipLogin) {
+        ui.info(ui.dim("Skipped. You'll be asked to sign in the first time your AI uses Brightspace."));
+    }
+    else {
+        const signedIn = await signIn(baseUrl);
+        if (!signedIn)
+            return 1;
+    }
+    ui.step(3, 3, "Connect your AI apps");
+    const found = detectClients().filter((c) => !flags.apps || flags.apps.includes(c.id));
+    if (found.length === 0 && flags.apps) {
+        ui.info(ui.dim("No apps selected. Add this to any MCP app's settings:"));
+        printManualConfig();
+        return 0;
+    }
+    if (found.length === 0) {
+        ui.warn("No supported AI apps found (Claude Desktop, Claude Code, Cursor, Windsurf, VS Code).");
+        printManualConfig();
+        return 0;
+    }
+    const chosen = [];
+    ui.info(`Found: ${found.map((c) => ui.bold(c.name)).join(", ")}`);
+    if (found.length > 1 && (await ui.confirm("Connect all of them?"))) {
+        chosen.push(...found);
+    }
+    else {
+        for (const client of found) {
+            if (found.length === 1 || (await ui.confirm(`Connect ${client.name}?`)))
+                chosen.push(client);
+        }
+    }
+    const connected = [];
+    for (const client of chosen) {
+        try {
+            if (await connect(client))
+                connected.push(client.name);
+        }
+        catch (error) {
+            ui.fail(`${client.name}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    console.log(`\n${ui.bold(ui.green("All set!"))}`);
+    if (connected.length) {
+        ui.info(`Connected: ${connected.join(", ")}.`);
+        const needsRestart = connected.filter((n) => n !== "Claude Desktop");
+        if (needsRestart.length)
+            ui.info(ui.dim(`Restart ${needsRestart.join(", ")} (or reload its window) to load Brightspace.`));
+    }
+    ui.info(`Try asking: ${ui.cyan('"What should I work on right now?"')}`);
+    console.log();
+    return 0;
+}
+async function signIn(baseUrl) {
+    ui.info("A browser window will open on your Brightspace sign-in page.");
+    ui.info("Sign in the way you normally do (school account, text code, authenticator...).");
+    ui.info(ui.dim("The window closes by itself once you're in. No password is saved by this tool."));
+    if (ui.interactive)
+        await ui.ask(ui.dim("Press Enter to open the browser..."));
+    for (;;) {
+        try {
+            const { token, displayName } = await loginWithBrowser({
+                baseUrl,
+                mode: "interactive",
+                onStatus: (message) => ui.info(ui.dim(message)),
+            });
+            await new TokenManager({ baseUrl }).setToken(token);
+            ui.ok(displayName ? `Signed in as ${ui.bold(displayName)}` : "Signed in");
+            return true;
+        }
+        catch (error) {
+            if (error instanceof NoBrowserError) {
+                ui.fail(error.message);
+                return false;
+            }
+            const message = error instanceof LoginError ? error.message : `Sign-in failed: ${error instanceof Error ? error.message : String(error)}`;
+            ui.fail(message);
+            if (!(await ui.confirm("Try signing in again?"))) {
+                ui.info(ui.dim("You can finish later with: npx brightspace-d2l-mcp login"));
+                return false;
+            }
+        }
+    }
+}
+async function connect(client) {
+    if (client.id === "claude-desktop")
+        return connectClaudeDesktop(client);
+    if (client.id === "claude-code") {
+        // Claude Code rewrites ~/.claude.json while running; its own CLI is the safe way in.
+        if (!addViaClaudeCli())
+            addToClient(client);
+        allowToolsInClaudeCode();
+        ui.ok("Claude Code connected (tools allowed without asking each time)");
+        return true;
+    }
+    addToClient(client);
+    ui.ok(`${client.name} connected`);
+    return true;
+}
+async function connectClaudeDesktop(client) {
+    // Claude Desktop saves its config from memory while open, which would erase our entry.
+    let relaunch = null;
+    if (isClaudeDesktopRunning()) {
+        if (await ui.confirm("Claude Desktop is open. Restart it now to add Brightspace?")) {
+            relaunch = await quitClaudeDesktop();
+        }
+        else {
+            ui.info("Quit Claude Desktop completely (tray icon → Quit), then press Enter.");
+            await ui.ask(ui.dim("Press Enter when it's closed..."));
+        }
+        if (isClaudeDesktopRunning()) {
+            ui.warn("Claude Desktop is still running, so it may undo this change. Quit it and run setup again if Brightspace doesn't appear.");
+        }
+    }
+    addToClient(client);
+    relaunch?.();
+    ui.ok(`Claude Desktop connected${relaunch ? " and restarted" : ""}`);
+    return true;
+}
+function addViaClaudeCli() {
+    const entry = serverEntry();
+    const json = JSON.stringify({ type: "stdio", command: entry.command, args: entry.args });
+    try {
+        const shell = process.platform === "win32";
+        try {
+            execFileSync("claude", ["mcp", "remove", SERVER_NAME, "--scope", "user"], { stdio: "ignore", shell, timeout: 30_000 });
+        }
+        catch {
+            // Not previously added.
+        }
+        execFileSync("claude", ["mcp", "add-json", SERVER_NAME, shell ? `"${json.replace(/"/g, '\\"')}"` : json, "--scope", "user"], {
+            stdio: "ignore",
+            shell,
+            timeout: 30_000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function printManualConfig() {
+    const entry = serverEntry();
+    ui.info("Add this to your AI app's MCP settings:");
+    console.log(JSON.stringify({ mcpServers: { [SERVER_NAME]: entry } }, null, 2).replace(/^/gm, "    "));
+}
+//# sourceMappingURL=setup.js.map

package/build/cli/ui.js

@@ -0,0 +1,39 @@
+import * as readline from "node:readline/promises";
+const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+const paint = (code) => (text) => (useColor ? `\x1b[${code}m${text}\x1b[0m` : text);
+export const bold = paint("1");
+export const dim = paint("2");
+export const green = paint("32");
+export const yellow = paint("33");
+export const red = paint("31");
+export const cyan = paint("36");
+export const ok = (text) => console.log(`  ${green("✔")} ${text}`);
+export const warn = (text) => console.log(`  ${yellow("!")} ${text}`);
+export const fail = (text) => console.log(`  ${red("✖")} ${text}`);
+export const info = (text) => console.log(`  ${text}`);
+export const step = (n, total, title) => console.log(`\n${bold(cyan(`Step ${n}/${total}`))}  ${bold(title)}`);
+export let interactive = process.stdin.isTTY === true;
+export function setNonInteractive() {
+    interactive = false;
+}
+export async function ask(question, fallback = "") {
+    if (!interactive)
+        return fallback;
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await rl.question(`  ${question} `)).trim();
+        return answer || fallback;
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function confirm(question, defaultYes = true) {
+    if (!interactive)
+        return defaultYes;
+    const answer = (await ask(`${question} ${dim(defaultYes ? "(Y/n)" : "(y/N)")}`)).toLowerCase();
+    if (!answer)
+        return defaultYes;
+    return answer.startsWith("y");
+}
+//# sourceMappingURL=ui.js.map

package/build/index.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+const CLI_COMMANDS = new Set(["setup", "login", "status", "logout", "uninstall", "serve", "config", "help", "--help", "-h", "--version", "-v"]);
+const command = process.argv[2];
+if (command && CLI_COMMANDS.has(command)) {
+    const { runCli } = await import("./cli/main.js");
+    process.exitCode = await runCli(command, process.argv.slice(3));
+}
+else {
+    const { startServer } = await import("./server.js");
+    await startServer();
+}
+export {};
+//# sourceMappingURL=index.js.map

package/build/server.js

@@ -0,0 +1,175 @@
+import { createServer as createHttpServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { enableStdoutGuard, log } from "./utils/logger.js";
+import { loadConfig, readStoredConfig, writeStoredConfig } from "./utils/config.js";
+import { packageVersion } from "./utils/version.js";
+import { TokenManager, Authenticator, AuthRequiredError } from "./auth/index.js";
+import { SETUP_COMMAND } from "./utils/paths.js";
+import { D2LApiClient } from "./api/index.js";
+import { registerGetMyCourses, registerGetUpcomingDueDates, registerGetMyGrades, registerGetAnnouncements, registerGetAssignments, registerGetAssignmentFiles, registerGetCourseContent, registerDownloadFile, registerGetClasslistEmails, registerGetRoster, registerGetSyllabus, registerGetDiscussions, registerGetTodo, } from "./tools/index.js";
+function notConfiguredClient(client) {
+    return new Proxy(client, {
+        get(target, property) {
+            if (property === "get" || property === "getRaw") {
+                return async () => {
+                    throw new AuthRequiredError("notConfigured", `Brightspace is not set up yet. Run \`${SETUP_COMMAND}\` in a terminal.`);
+                };
+            }
+            const value = Reflect.get(target, property);
+            return typeof value === "function" ? value.bind(target) : value;
+        },
+    });
+}
+// One API client and session for the whole process, shared by every connection.
+function createBackend() {
+    const config = loadConfig();
+    if (!config.baseUrl)
+        log("WARN", "No school configured yet; tools will explain how to run setup");
+    const servers = new Set();
+    const tokenManager = new TokenManager({ baseUrl: config.baseUrl || undefined, tokenTtl: config.tokenTtl });
+    const authenticator = new Authenticator({
+        baseUrl: config.baseUrl,
+        tokenTtl: config.tokenTtl,
+        autoLogin: config.autoLogin,
+        tokenManager,
+        notify: (message) => {
+            log("INFO", message);
+            for (const server of servers) {
+                void server.sendLoggingMessage({ level: "info", logger: "brightspace-auth", data: message }).catch(() => { });
+            }
+        },
+    });
+    // Sign-in waits for the first tool call, so starting an AI app never opens a browser by itself.
+    const client = new D2LApiClient({
+        baseUrl: config.baseUrl || "https://not-configured.invalid",
+        tokenManager,
+        onAuthExpired: () => authenticator.run(),
+    });
+    return { config, apiClient: config.baseUrl ? client : notConfiguredClient(client), servers };
+}
+function createMcpServer({ config, apiClient }) {
+    const server = new McpServer({
+        name: "brightspace",
+        version: packageVersion(),
+        description: "D2L Brightspace for students: what to do next, due dates with submission status, grades, content, announcements.",
+    }, { capabilities: { logging: {} } });
+    registerGetTodo(server, apiClient, config);
+    registerGetMyCourses(server, apiClient, config);
+    registerGetUpcomingDueDates(server, apiClient, config);
+    registerGetMyGrades(server, apiClient, config);
+    registerGetAnnouncements(server, apiClient, config);
+    registerGetAssignments(server, apiClient, config);
+    registerGetAssignmentFiles(server, apiClient, config.baseUrl);
+    registerGetCourseContent(server, apiClient);
+    registerDownloadFile(server, apiClient);
+    registerGetClasslistEmails(server, apiClient);
+    registerGetRoster(server, apiClient);
+    registerGetSyllabus(server, apiClient);
+    registerGetDiscussions(server, apiClient);
+    return server;
+}
+export async function startServer() {
+    // stdout carries the MCP protocol; anything else printed there corrupts it.
+    enableStdoutGuard();
+    process.on("unhandledRejection", (reason) => log("ERROR", "Unhandled promise rejection", reason));
+    try {
+        const backend = createBackend();
+        const server = createMcpServer(backend);
+        backend.servers.add(server);
+        await server.connect(new StdioServerTransport());
+        log("INFO", `brightspace-d2l-mcp v${packageVersion()} running for ${backend.config.baseUrl || "(not set up)"}`);
+    }
+    catch (error) {
+        log("ERROR", "MCP server failed to start", error);
+        process.exit(1);
+    }
+    const shutdown = () => process.exit(0);
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+}
+export function httpAccessToken() {
+    const stored = readStoredConfig().httpToken;
+    if (stored)
+        return stored;
+    const token = randomBytes(24).toString("base64url");
+    writeStoredConfig({ httpToken: token });
+    return token;
+}
+function tokenMatches(given, expected) {
+    if (!given)
+        return false;
+    const a = Buffer.from(given);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/**
+ * Streamable HTTP transport for clients that can't launch a local process:
+ * ChatGPT connectors (through a tunnel), hosted agents and HTTP-only frameworks.
+ * The token is accepted as a Bearer header or as the last path segment (/mcp/<token>),
+ * since some apps only let you paste a URL.
+ */
+export async function startHttpServer(options) {
+    const isLocal = ["127.0.0.1", "localhost", "::1"].includes(options.host);
+    if (options.noAuth && !isLocal)
+        throw new Error("--no-auth is only allowed when listening on localhost.");
+    const backend = createBackend();
+    const token = options.noAuth ? null : httpAccessToken();
+    const handle = async (req, res) => {
+        const url = new URL(req.url ?? "/", "http://localhost");
+        const [, first, pathToken] = url.pathname.split("/");
+        if (req.method === "GET" && url.pathname === "/health") {
+            res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ ok: true, version: packageVersion() }));
+            return;
+        }
+        if (first !== "mcp") {
+            res.writeHead(404).end();
+            return;
+        }
+        if (token) {
+            const header = req.headers.authorization?.match(/^Bearer\s+(.+)$/i)?.[1];
+            if (!tokenMatches(header, token) && !tokenMatches(pathToken, token)) {
+                res.writeHead(401, { "content-type": "application/json", "www-authenticate": "Bearer" })
+                    .end(JSON.stringify({ error: "Missing or wrong access token." }));
+                return;
+            }
+        }
+        if (req.method !== "POST") {
+            res.writeHead(405, { allow: "POST" }).end();
+            return;
+        }
+        // Stateless: a fresh MCP server per request, sharing the one signed-in backend.
+        const server = createMcpServer(backend);
+        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
+        backend.servers.add(server);
+        res.on("close", () => {
+            backend.servers.delete(server);
+            void transport.close();
+            void server.close();
+        });
+        try {
+            await server.connect(transport);
+            await transport.handleRequest(req, res);
+        }
+        catch (error) {
+            log("ERROR", "HTTP request failed", error);
+            if (!res.headersSent)
+                res.writeHead(500).end();
+        }
+    };
+    const httpServer = createHttpServer((req, res) => void handle(req, res));
+    await new Promise((resolve, reject) => {
+        httpServer.once("error", reject);
+        httpServer.listen(options.port, options.host, resolve);
+    });
+    const address = httpServer.address();
+    const port = typeof address === "object" && address ? address.port : options.port;
+    const displayHost = options.host.includes(":") ? `[${options.host}]` : options.host;
+    return {
+        url: `http://${displayHost}:${port}/mcp${token ? `/${token}` : ""}`,
+        close: () => new Promise((resolve) => httpServer.close(() => resolve())),
+    };
+}
+//# sourceMappingURL=server.js.map

package/build/tools/download-file.js

@@ -0,0 +1,167 @@
+import { DownloadFileSchema } from "./schemas.js";
+import { toolResponse, sanitizeError, errorResponse } from "./tool-helpers.js";
+import { log } from "../utils/logger.js";
+import { validateContentId, MAX_FILE_SIZE, } from "../utils/file-validator.js";
+import { secureDownload } from "../utils/download-helpers.js";
+import fs from "node:fs/promises";
+import path from "node:path";
+export function registerDownloadFile(server, apiClient) {
+    server.registerTool("download_file", {
+        title: "Download File",
+        description: "Download a file from course content or assignment submissions to a local directory. Use this when the user wants to download, save, or get a file from Brightspace course content or dropbox submissions. IMPORTANT: You MUST ask the user where they want to save the file before calling this tool. Never guess or assume a download directory. After identifying the file to download, suggest a clean readable filename to the user (e.g., 'Lecture 7 - Memory Management.pdf' instead of 'L07_CS251_2026SP_v2.pdf') and ask if they'd like to rename it. Pass their preferred name as customFilename, or omit it to keep the original.",
+        inputSchema: DownloadFileSchema,
+    }, async (args) => {
+        try {
+            log("DEBUG", "download_file tool called", { args });
+            // Parse and validate input
+            const { courseId, topicId, folderId, fileId, downloadPath, customFilename } = DownloadFileSchema.parse(args);
+            // Validate courseId
+            validateContentId(courseId);
+            // Validate download path is absolute
+            if (!path.isAbsolute(downloadPath)) {
+                return errorResponse("Download path must be an absolute path (e.g., /Users/username/Downloads on Mac or C:\\Users\\username\\Downloads on Windows)");
+            }
+            // Validate download directory exists and is a directory
+            try {
+                const stats = await fs.stat(downloadPath);
+                if (!stats.isDirectory()) {
+                    return errorResponse(`Download path is not a directory: ${downloadPath}`);
+                }
+            }
+            catch (error) {
+                if (error?.code === "ENOENT") {
+                    return errorResponse(`Download directory does not exist: ${downloadPath}`);
+                }
+                throw error;
+            }
+            // Determine download source
+            if (topicId !== undefined) {
+                // Content file download
+                validateContentId(topicId);
+                return await downloadContentFile(apiClient, courseId, topicId, downloadPath, customFilename);
+            }
+            else if (folderId !== undefined && fileId !== undefined) {
+                // Submission file download
+                validateContentId(folderId);
+                validateContentId(fileId);
+                return await downloadSubmissionFile(apiClient, courseId, folderId, fileId, downloadPath, customFilename);
+            }
+            else {
+                return errorResponse("Either topicId (for content files) or both folderId and fileId (for submission files) must be provided");
+            }
+        }
+        catch (error) {
+            return sanitizeError(error);
+        }
+    });
+}
+export function parseContentDispositionFilename(disposition) {
+    const extended = disposition.match(/filename\*\s*=\s*([^;]+)/i);
+    if (extended?.[1]) {
+        const value = extended[1].trim();
+        const parts = value.split("'");
+        const encoded = parts.length >= 3 ? parts.slice(2).join("'") : value;
+        try {
+            return decodeURIComponent(encoded);
+        }
+        catch {
+            return encoded;
+        }
+    }
+    const plain = disposition.match(/filename\s*=\s*("([^"]*)"|[^;\n]*)/i);
+    if (plain) {
+        const value = (plain[2] ?? plain[1] ?? "").trim();
+        if (value)
+            return value;
+    }
+    return null;
+}
+async function downloadContentFile(apiClient, courseId, topicId, downloadPath, customFilename) {
+    log("INFO", `Downloading content file: courseId=${courseId}, topicId=${topicId}`);
+    // Build download URL using D2L API path helper
+    const apiPath = apiClient.le(courseId, `/content/topics/${topicId}/file`);
+    // Fetch file using getRaw (returns Response object, not parsed JSON)
+    const response = await apiClient.getRaw(apiPath);
+    // Check Content-Length BEFORE downloading body (prevent memory exhaustion)
+    const contentLength = parseInt(response.headers.get("Content-Length") ?? "0", 10);
+    if (contentLength > MAX_FILE_SIZE) {
+        return errorResponse(`File too large (${Math.round(contentLength / 1024 / 1024)}MB). Maximum allowed: ${MAX_FILE_SIZE / 1024 / 1024}MB`);
+    }
+    // Get filename from Content-Disposition header
+    const disposition = response.headers.get("Content-Disposition") ?? "";
+    const filename = parseContentDispositionFilename(disposition) ?? "download";
+    log("DEBUG", `Content-Disposition filename: ${filename}`);
+    // Download body as buffer
+    const buffer = Buffer.from(await response.arrayBuffer());
+    // Double-check actual size
+    if (buffer.length > MAX_FILE_SIZE) {
+        return errorResponse(`File too large (${Math.round(buffer.length / 1024 / 1024)}MB). Maximum allowed: ${MAX_FILE_SIZE / 1024 / 1024}MB`);
+    }
+    // Use custom filename if provided, otherwise use Content-Disposition filename
+    const originalFilename = filename;
+    const effectiveFilename = customFilename || filename;
+    // Use secureDownload for path traversal prevention, file type validation, and conflict resolution
+    const result = await secureDownload({
+        targetDir: downloadPath,
+        filename: effectiveFilename,
+        data: buffer,
+    });
+    log("INFO", `File downloaded successfully: ${result.path} (${result.size} bytes, ${result.mime})`);
+    return toolResponse({
+        success: true,
+        filePath: result.path,
+        fileSize: result.size,
+        mimeType: result.mime,
+        originalFilename,
+        message: `File downloaded successfully to ${result.path}`,
+    });
+}
+async function downloadSubmissionFile(apiClient, courseId, folderId, fileId, downloadPath, customFilename) {
+    log("INFO", `Downloading submission file: courseId=${courseId}, folderId=${folderId}, fileId=${fileId}`);
+    // First, fetch the submission to get file metadata
+    const submissionsPath = apiClient.le(courseId, `/dropbox/folders/${folderId}/submissions/mysubmissions/`);
+    const submissions = await apiClient.get(submissionsPath);
+    if (!submissions || submissions.length === 0) {
+        return errorResponse("No submissions found for this assignment. Upload a submission first.");
+    }
+    // Find the file in the submission
+    const submission = submissions[0];
+    const file = submission.Files.find((f) => f.FileId === fileId);
+    if (!file) {
+        return errorResponse(`File ID ${fileId} not found in submission. Available files: ${submission.Files.map((f) => `${f.FileName} (ID: ${f.FileId})`).join(", ")}`);
+    }
+    // Check file size before downloading
+    if (file.Size > MAX_FILE_SIZE) {
+        return errorResponse(`File too large (${Math.round(file.Size / 1024 / 1024)}MB). Maximum allowed: ${MAX_FILE_SIZE / 1024 / 1024}MB`);
+    }
+    // D2L file download URL pattern for submission files
+    // GET /d2l/api/le/(version)/(orgUnitId)/dropbox/folders/(folderId)/submissions/(submissionId)/files/(fileId)/download
+    const downloadApiPath = apiClient.le(courseId, `/dropbox/folders/${folderId}/submissions/${submission.Id}/files/${fileId}/download`);
+    // Fetch file
+    const response = await apiClient.getRaw(downloadApiPath);
+    // Download body as buffer
+    const buffer = Buffer.from(await response.arrayBuffer());
+    // Double-check actual size
+    if (buffer.length > MAX_FILE_SIZE) {
+        return errorResponse(`File too large (${Math.round(buffer.length / 1024 / 1024)}MB). Maximum allowed: ${MAX_FILE_SIZE / 1024 / 1024}MB`);
+    }
+    // Use custom filename if provided, otherwise use original submission filename
+    const originalFilename = file.FileName;
+    const effectiveFilename = customFilename || file.FileName;
+    // Use secureDownload for path traversal prevention, file type validation, and conflict resolution
+    const result = await secureDownload({
+        targetDir: downloadPath,
+        filename: effectiveFilename,
+        data: buffer,
+    });
+    log("INFO", `Submission file downloaded successfully: ${result.path} (${result.size} bytes, ${result.mime})`);
+    return toolResponse({
+        success: true,
+        filePath: result.path,
+        fileSize: result.size,
+        mimeType: result.mime,
+        originalFilename,
+        message: `File downloaded successfully to ${result.path}`,
+    });
+}
+//# sourceMappingURL=download-file.js.map