openlearn-next 0.1.16 → 0.2.1

package/dist/server.cjs

@@ -1036,16 +1036,18 @@ function wrapProcessManager(processService, tracker, pluginId) {
     }),
     registerInterval: createSafeFunction(
       (name, intervalMs, tickFn) => {
-        return processService.registerInterval(name, intervalMs, (log) => {
-          try {
-            tickFn(log);
-          } catch (e) {
-            console.error(`[Plugin:${pluginId}] Error in interval task ${name}:`, e);
-          }
-        }).then((processId) => {
+        return Promise.resolve(
+          processService.registerInterval(name, intervalMs, (log) => {
+            try {
+              tickFn(log);
+            } catch (e) {
+              console.error(`[Plugin:${pluginId}] Error in interval task ${name}:`, e);
+            }
+          })
+        ).then((processId) => {
           tracker.track(pluginId, {
             dispose: () => {
-              processService.kill(processId).catch(() => {
+              Promise.resolve(processService.kill(processId)).catch(() => {
               });
             }
           });
@@ -3169,6 +3171,16 @@ var init_worker_manager = __esm({
         }
         return await this.registry.terminate(pluginId);
       }
+      /**
+       * 中止所有活跃 Worker 线程（有序关闭）。
+       *
+       * 遍历 WorkerRegistry 中当前活跃的 Worker，逐个调用 terminate() 释放线程资源。
+       * 供 PluginRuntimeComposition 在平台停机阶段调用。
+       */
+      async shutdownAll() {
+        const ids = this.registry.list();
+        await Promise.all(ids.map((id) => this.terminateWorker(id)));
+      }
       /**
        * 从数据库恢复所有 worker-mode 的活跃插件。
        *
@@ -3687,6 +3699,7 @@ var manifestSchema = import_zod.z.object({
     })).optional()
   }).optional(),
   contributes: contributesSchema,
+  classroomTools: import_zod.z.array(import_zod.z.unknown()).optional(),
   deploy: deploySchema
 }).passthrough();
 var requiresItemV3Schema = import_zod.z.string().regex(
@@ -6918,7 +6931,8 @@ var AiPlannerPlugin = {
     const eventBus = ctx.services.eventBus;
     const db2 = await ctx.resolve(import_plugin_sdk5.IDatabaseToken);
     const processManager = ctx.services.processManager;
-    await processManager.registerHandler("ai_planner_task", async (processId, payload, state, log, updateState) => {
+    await processManager.registerHandler("ai_planner_task", async (processId, payloadArg, state, log, updateState) => {
+      const payload = payloadArg;
       log(`[AI Planner] Started generation task: ${payload.taskType}`);
       const duration = payload.duration || 5;
       for (let i = 0; i < duration; i++) {
@@ -6929,7 +6943,7 @@ var AiPlannerPlugin = {
         }
         await new Promise((r) => setTimeout(r, 1e3));
         updateState({ step: i + 1 });
-        log(`[AI Planner] Analyzing data... step ${i + 1}/${duration}`);
+        log(`[AI Planner] Analyzing payload... step ${i + 1}/${duration}`);
       }
       log(`[AI Planner] Analysis complete. Generating proposal...`);
       const proposalTitle = `AI Suggested ${payload.taskType === "quiz" ? "Quiz" : "Plan"}: ${payload.topic}`;
@@ -9862,7 +9876,7 @@ var PluginHost = class {
     }
     const previousStatus = existingRow.status;
     const currentState = this.pluginStates.get(pluginId) ?? "installed" /* INSTALLED */;
-    const wasActive = currentState === "active" /* ACTIVE */ || previousStatus === "active";
+    const wasActive = currentState === "active" /* ACTIVE */ ? true : previousStatus === "active";
     const oldMode = this.getExecutionMode(pluginId) || "inline";
     const executionMode = options.executionMode ?? (manifest.executionMode === "worker" ? "worker" : oldMode || "inline");
     const pluginDir = this.getPluginDir(pluginId);
@@ -16694,11 +16708,12 @@ var PluginCompositionModule = class {
   }
   compose(options) {
     const serviceRegistry = getPlatformServiceRegistry();
-    const registerOrReplace = (descriptor, instance) => {
-      if (serviceRegistry.has(descriptor.id)) {
-        serviceRegistry.replace(descriptor.id, instance);
+    const registerOrReplace = (config) => {
+      const { id, instance } = config;
+      if (serviceRegistry.has(id)) {
+        serviceRegistry.replace(id, instance);
       } else {
-        serviceRegistry.register(descriptor, instance);
+        serviceRegistry.register({ id }, instance);
       }
     };
     const capabilityRegistry = new CapabilityRegistry();
@@ -16753,7 +16768,6 @@ var PluginCompositionModule = class {
       description: "OpenLearn Plugin Distribution Manager Foundation",
       instance: realDistributionManager
     });
-    capabilityRegistry.registerCapability(new PluginCapability());
     permissionManager.register({
       id: "perm_plugin_execute",
       name: "Plugin Execution Permission",
@@ -17096,713 +17110,1344 @@ function validateJsonSchema(data, schema) {
 }
 
 // server.ts
-var import_genai6 = require("@google/genai");
-var import_crypto13 = __toESM(require("crypto"), 1);
 var import_helmet = __toESM(require("helmet"), 1);
 var import_express_rate_limit = __toESM(require("express-rate-limit"), 1);
 
-// packages/core/bootstrap/adapter/bootstrap-registration.ts
-var BootstrapRegistration = class {
-  static registerConfiguration(builder, context) {
-    if (context.config) {
-      builder.withConfiguration(context.config);
-    }
-    if (context.environment) {
-      builder.withEnvironment(context.environment);
-    }
-  }
-  static registerLogger(builder, context) {
-    if (context.logger) {
-      builder.withLogger(context.logger);
+// server/realtime-bridge.ts
+function setupRealtimeBridge({ eventBus, io, db: db2 }) {
+  eventBus.subscribe("assignment.graded", (event) => {
+    try {
+      const payload = event.payload;
+      const assignment = db2.prepare("SELECT title FROM assignments WHERE id = ?").get(payload.assignmentId);
+      const assignmentTitle = assignment ? assignment.title : "Assignment";
+      console.log(`[EventBus -> Socket.IO] Broadcasting assignment-graded-toast to student ${payload.studentId}`);
+      io.emit("assignment-graded-toast", {
+        assignmentId: payload.assignmentId,
+        assignmentTitle,
+        studentId: payload.studentId,
+        score: payload.score,
+        feedback: payload.feedback || ""
+      });
+    } catch (e) {
+      console.error("[EventBus -> Socket.IO] Error dispatching assignment graded notification:", e);
     }
-  }
-  static registerInfrastructure(builder, context) {
-    if (context.existingServices) {
-      for (const [id, service] of context.existingServices.entries()) {
-        builder.addService(id, service);
+  });
+  const handleRollcallElement = (elementId) => {
+    try {
+      const el = db2.prepare("SELECT * FROM whiteboard_elements WHERE id = ?").get(elementId);
+      if (el && el.type === "rollcall") {
+        const elData = JSON.parse(el.data);
+        if (elData && elData.selectedStudent && elData.status === "picked") {
+          const studentId = elData.selectedStudent.id;
+          const studentName = elData.selectedStudent.name;
+          let classId = elData.classId || "";
+          const lessonId = el.lesson_id;
+          if (!classId && lessonId) {
+            const sched = db2.prepare("SELECT class_id FROM schedules WHERE lesson_id = ? LIMIT 1").get(lessonId);
+            if (sched) {
+              classId = sched.class_id;
+            }
+          }
+          const pickedTimeStr = elData.pickedTime || (/* @__PURE__ */ new Date()).toISOString();
+          const pickedTime = new Date(pickedTimeStr).getTime();
+          const rollcallId = `rollcall-${elementId}-${pickedTime}`;
+          const exists = db2.prepare("SELECT id FROM student_rollcalls WHERE id = ?").get(rollcallId);
+          if (!exists) {
+            db2.prepare(
+              "INSERT INTO student_rollcalls (id, student_id, class_id, lesson_id, picked_time) VALUES (?, ?, ?, ?, ?)"
+            ).run(rollcallId, studentId, classId, lessonId, pickedTime);
+            console.log(`[Rollcall] Saved rollcall for student ${studentId} (${studentName})`);
+            io.emit("student-picked", {
+              rollcallId,
+              studentId,
+              studentName,
+              classId,
+              lessonId,
+              pickedTime
+            });
+          }
+        }
       }
+    } catch (e) {
+      console.error("Error handling rollcall element:", e);
     }
-    if (context.kernelContainer) {
-      builder.addService("kernelContainer", context.kernelContainer);
+  };
+  eventBus.subscribe("whiteboard.element_drawn", (event) => {
+    try {
+      const payload = event.payload;
+      if (payload.type === "rollcall") {
+        handleRollcallElement(payload.elementId);
+      }
+      if (payload.lessonId) {
+        const syncMsg = { roomId: payload.lessonId, type: "refresh" };
+        io.to(payload.lessonId).emit("whiteboard-sync", syncMsg);
+        io.to("whiteboard-broadcast").emit("whiteboard-sync", syncMsg);
+        console.log(`[EventBus -> Socket.IO] Broadcast whiteboard refresh for lesson "${payload.lessonId}" (element: "${payload.elementId}", type: "${payload.type}")`);
+      }
+    } catch (e) {
+      console.error("[EventBus -> Socket.IO] Error processing whiteboard.element_drawn:", e);
     }
-    if (context.expressApp) {
-      builder.addService("expressApp", context.expressApp);
+  });
+  eventBus.subscribe("whiteboard.element_updated", (event) => {
+    try {
+      const payload = event.payload;
+      handleRollcallElement(payload.elementId);
+    } catch (e) {
+      console.error("[EventBus -> Socket.IO] Error processing whiteboard.element_updated for rollcall:", e);
     }
-    if (context.httpServer) {
-      builder.addService("httpServer", context.httpServer);
+  });
+  eventBus.subscribe("whiteboard.batch_drawn", (event) => {
+    try {
+      const payload = event.payload;
+      if (payload.lessonId) {
+        io.to(payload.lessonId).emit("whiteboard-sync", {
+          roomId: payload.lessonId,
+          type: "refresh"
+        });
+        console.log(`[EventBus -> Socket.IO] Broadcast refresh after batch_draw (${payload.count} elements) for lesson "${payload.lessonId}"`);
+      }
+    } catch (e) {
+      console.error("[EventBus -> Socket.IO] Error processing whiteboard.batch_drawn:", e);
     }
-  }
-  static registerExistingBootstrapStages(_builder) {
-  }
-};
-
-// packages/core/bootstrap/adapter/server-bootstrap-adapter.ts
-var ServerBootstrapAdapter = class _ServerBootstrapAdapter {
-  constructor(options) {
-    this._state = "Created";
-    this._state = "Created";
-    this._builder = PlatformBuilder.create();
-    if (options) {
-      this.configure(options);
+  });
+  eventBus.subscribe("whiteboard.element_deleted", (event) => {
+    try {
+      const payload = event.payload;
+      if (payload.lessonId) {
+        io.to(payload.lessonId).emit("whiteboard-sync", {
+          roomId: payload.lessonId,
+          type: "refresh"
+        });
+      }
+    } catch (e) {
+      console.error("[EventBus -> Socket.IO] Error processing whiteboard.element_deleted:", e);
     }
-  }
-  static create(options) {
-    return new _ServerBootstrapAdapter(options);
-  }
-  get state() {
-    return this._state;
-  }
-  configure(context) {
-    this._state = "Configuring";
-    BootstrapRegistration.registerConfiguration(this._builder, context);
-    BootstrapRegistration.registerLogger(this._builder, context);
-    BootstrapRegistration.registerInfrastructure(this._builder, context);
-    return this;
-  }
-  registerStages() {
-    BootstrapRegistration.registerExistingBootstrapStages(this._builder);
-    this._state = "PipelineRegistered";
-    return this;
-  }
-  async runBootstrap(context) {
-    if (this._state === "Created") {
-      this.configure(context);
+  });
+  eventBus.subscribe("whiteboard.cleared", (event) => {
+    try {
+      const payload = event.payload;
+      if (payload.lessonId) {
+        io.to(payload.lessonId).emit("whiteboard-sync", {
+          roomId: payload.lessonId,
+          type: "refresh"
+        });
+      }
+    } catch (e) {
+      console.error("[EventBus -> Socket.IO] Error processing whiteboard.cleared:", e);
     }
-    if (this._state === "Configuring") {
-      this.registerStages();
+  });
+  eventBus.subscribe("spotlight:state_updated", (event) => {
+    try {
+      io.emit("spotlight:state_updated", event.payload);
+    } catch (e) {
+      console.error("[EventBus -> Socket.IO] Error processing spotlight:state_updated:", e);
     }
-    const builderResult = this._builder.buildResult();
-    const pipelineResult = await builderResult.pipeline.execute({
-      startupTimestamp: Date.now(),
-      startupOptions: {},
-      startupStage: builderResult.platformContext.currentStage,
-      startupToken: { token: "srv_adapter_token", isCancelled: false, cancel: () => {
-      } },
-      isCancelled: false,
-      platformContext: builderResult.platformContext,
-      config: builderResult.platformContext.config,
-      state: "Active",
-      currentStage: builderResult.platformContext.currentStage,
-      startTime: Date.now(),
-      getMetadata: () => void 0,
-      setStage: () => {
-      }
-    });
-    if (pipelineResult.status === "Failed") {
-      throw pipelineResult.error || new Error(`ServerBootstrapAdapter pipeline failed at stage: ${pipelineResult.failedStage}`);
+  });
+  eventBus.subscribe("spotlight.state_updated", (event) => {
+    try {
+      io.emit("spotlight:state_updated", event.payload);
+    } catch (e) {
+      console.error("[EventBus -> Socket.IO] Error processing spotlight.state_updated:", e);
     }
-    this._state = "Bootstrapped";
-    return { builderResult, pipelineResult };
-  }
-  static async bootstrap(context) {
-    const adapter = _ServerBootstrapAdapter.create(context);
-    return adapter.runBootstrap(context);
-  }
-};
+  });
+}
 
-// packages/activity-ecosystem/index.ts
-init_token();
+// server/shared-state.ts
+var MF_REMOTE_CACHE = /* @__PURE__ */ new Map();
+var lessonActiveSegments = /* @__PURE__ */ new Map();
 
-// packages/activity-ecosystem/context.ts
-function createActivityContext(opts) {
-  return {
-    commandBus: opts.commandBus,
-    eventBus: opts.eventBus,
-    actionRegistry: opts.actionRegistry,
-    capability: opts.capability,
-    ai: opts.ai,
-    classroom: opts.classroom ?? null
+// server/presence.ts
+function setupPresence({ io, eventBus }) {
+  const onlineStudents = /* @__PURE__ */ new Map();
+  const activeStudentLessons = /* @__PURE__ */ new Map();
+  const broadcastPresence = () => {
+    io.emit("presence-update", {
+      onlineStudentIds: Array.from(onlineStudents.keys()),
+      activeStudentLessons: Object.fromEntries(activeStudentLessons.entries())
+    });
   };
-}
-
-// packages/activity-ecosystem/provider.ts
-var import_uuid15 = require("uuid");
-var ACTIVITY_EVENTS = {
-  REGISTERED: "activity.registered",
-  INITIALIZED: "activity.initialized",
-  STARTED: "activity.started",
-  PAUSED: "activity.paused",
-  RESUMED: "activity.resumed",
-  FINISHED: "activity.finished",
-  DISPOSED: "activity.disposed"
-};
-function publishEvent(context, type, descriptor, payload) {
-  context.eventBus.publish({
-    id: (0, import_uuid15.v7)(),
-    type,
-    source: `activity:${descriptor.id}`,
-    payload,
-    timestamp: Date.now()
-  });
-}
-var BaseActivityProvider = class {
-  constructor(options) {
-    this._state = "registered";
-    if (!options?.descriptor?.id) {
-      throw new Error("BaseActivityProvider requires a descriptor with a valid id.");
-    }
-    this.descriptor = options.descriptor;
-    this.hooks = options;
-  }
-  get state() {
-    return this._state;
-  }
-  /** When the activity entered `running` (undefined before first start). */
-  get startedAt() {
-    return this._startedAt;
-  }
-  /** Internal marker used by the registry on registration. */
-  markRegistered() {
-    this._state = "registered";
-  }
-  async initialize(context) {
-    this._state = "initialized";
-    publishEvent(context, ACTIVITY_EVENTS.INITIALIZED, this.descriptor, {
-      activityId: this.descriptor.id,
-      provider: this.descriptor.provider
+  io.on("connection", (socket) => {
+    let registeredStudentId = null;
+    socket.on("register-student", (data) => {
+      registeredStudentId = data.studentId;
+      onlineStudents.set(data.studentId, { socketId: socket.id, name: data.name });
+      console.log(`[Presence] Student online: ${data.name} (${data.studentId})`);
+      broadcastPresence();
     });
-    if (this.hooks.onInitialize) {
-      await this.hooks.onInitialize(context);
-    }
-  }
-  async start(context, payload) {
-    let result;
-    if (this.hooks.onStart) {
-      result = await this.hooks.onStart(context, payload);
-    } else if (this.descriptor.commandType) {
-      const command = await context.commandBus.createCommand(
-        this.descriptor.commandType,
-        payload ?? {},
-        this.descriptor.provider,
-        { activityId: this.descriptor.id }
-      );
-      try {
-        result = await context.commandBus.execute(command);
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (!/No handler registered for command/.test(message)) {
-          throw err;
-        }
+    socket.on("enter-lesson", (data) => {
+      activeStudentLessons.set(data.studentId, data.lessonId);
+      socket.join(data.lessonId);
+      console.log(`[Presence] Student ${data.studentId} entered lesson ${data.lessonId}`);
+      broadcastPresence();
+      const activeSeg = lessonActiveSegments.get(data.lessonId);
+      if (activeSeg) {
+        socket.emit("student-active-segment-changed", {
+          lessonId: data.lessonId,
+          activeSegmentId: activeSeg
+        });
       }
-    }
-    this._state = "running";
-    this._startedAt = Date.now();
-    publishEvent(context, ACTIVITY_EVENTS.STARTED, this.descriptor, {
-      activityId: this.descriptor.id,
-      provider: this.descriptor.provider,
-      commandType: this.descriptor.commandType,
-      payload
     });
-    return result;
-  }
-  async pause(context) {
-    this._state = "paused";
-    publishEvent(context, ACTIVITY_EVENTS.PAUSED, this.descriptor, {
-      activityId: this.descriptor.id
+    socket.on("leave-lesson", (data) => {
+      const oldRoom = activeStudentLessons.get(data.studentId);
+      if (oldRoom) {
+        socket.leave(oldRoom);
+      }
+      activeStudentLessons.delete(data.studentId);
+      console.log(`[Presence] Student ${data.studentId} left lesson`);
+      broadcastPresence();
     });
-    if (this.hooks.onPause) {
-      await this.hooks.onPause(context);
-    }
-  }
-  async resume(context) {
-    this._state = "running";
-    publishEvent(context, ACTIVITY_EVENTS.RESUMED, this.descriptor, {
-      activityId: this.descriptor.id
+    socket.on("join-room", (roomId) => {
+      socket.join(roomId);
     });
-    if (this.hooks.onResume) {
-      await this.hooks.onResume(context);
-    }
-  }
-  async finish(context) {
-    this._state = "finished";
-    publishEvent(context, ACTIVITY_EVENTS.FINISHED, this.descriptor, {
-      activityId: this.descriptor.id
+    socket.on("whiteboard-update", (data) => {
+      socket.to(data.roomId).emit("whiteboard-sync", data);
     });
-    if (this.hooks.onFinish) {
-      await this.hooks.onFinish(context);
-    }
-  }
-  async dispose(context) {
-    this._state = "disposed";
-    publishEvent(context, ACTIVITY_EVENTS.DISPOSED, this.descriptor, {
-      activityId: this.descriptor.id
+    socket.on(
+      "whiteboard-event",
+      (data) => {
+        eventBus.publish({
+          id: data.id,
+          type: data.type,
+          source: "whiteboard",
+          payload: data.payload,
+          timestamp: data.timestamp,
+          correlationId: data.payload.lessonId
+        });
+        const lessonId = data.payload.lessonId;
+        if (lessonId) {
+          const roomName = lessonId.startsWith("assignment-") ? lessonId : `lesson-${lessonId}`;
+          socket.to(data.payload.lessonId).emit("whiteboard-sync", {
+            type: "refresh",
+            sourceEvent: data.type
+          });
+        }
+      }
+    );
+    socket.on("teacher-broadcast-segment", (data) => {
+      lessonActiveSegments.set(data.lessonId, data.activeSegmentId);
+      io.to(data.lessonId).emit("student-active-segment-changed", data);
     });
-    if (this.hooks.onDispose) {
-      await this.hooks.onDispose(context);
-    }
-  }
-};
+    socket.on("teacher-ping-student", (data) => {
+      console.log(`[Ping] Teacher pinged student ${data.studentId} for lesson ${data.lessonId}`);
+      const studentOnlineInfo = onlineStudents.get(data.studentId);
+      if (studentOnlineInfo) {
+        io.to(studentOnlineInfo.socketId).emit("student-pinged", {
+          lessonId: data.lessonId,
+          message: data.message
+        });
+      }
+    });
+    socket.on("disconnect", () => {
+      if (registeredStudentId) {
+        onlineStudents.delete(registeredStudentId);
+        activeStudentLessons.delete(registeredStudentId);
+        console.log(`[Presence] Student offline: ${registeredStudentId}`);
+        broadcastPresence();
+      }
+    });
+    socket.emit("presence-update", {
+      onlineStudentIds: Array.from(onlineStudents.keys()),
+      activeStudentLessons: Object.fromEntries(activeStudentLessons.entries())
+    });
+  });
+}
 
-// packages/activity-ecosystem/registry.ts
-var ActivityRegistry2 = class {
-  constructor() {
-    this.providers = /* @__PURE__ */ new Map();
-  }
-  /**
-   * Register an Activity Provider. Throws on missing id or duplicate id.
-   * Official and plugin providers go through this identical method.
-   */
-  registerProvider(provider) {
-    if (!provider || !provider.descriptor || !provider.descriptor.id) {
-      throw new Error("ActivityRegistry: an ActivityProvider must expose a descriptor with a valid id.");
-    }
-    const id = provider.descriptor.id;
-    if (this.providers.has(id)) {
-      throw new Error(`ActivityRegistry: activity provider "${id}" is already registered.`);
+// server/bootstrap-db.ts
+async function runStartupMigrations(db2) {
+  try {
+    const existingQuiz = db2.prepare("SELECT id, manifest, source_code FROM plugins WHERE name = ?").get("Quiz Component Plugin");
+    if (existingQuiz && (!existingQuiz.manifest || !existingQuiz.manifest.includes("classroomTools") || !existingQuiz.source_code.includes("actorId:"))) {
+      console.log("Upgrading old Quiz Component Plugin to add classroomTools and fix Actor...");
+      db2.prepare("DELETE FROM plugins WHERE id = ?").run(existingQuiz.id);
     }
-    this.providers.set(id, provider);
-    if (typeof provider.markRegistered === "function") {
-      provider.markRegistered();
+    const existingRollCall = db2.prepare("SELECT id, manifest FROM plugins WHERE name = ?").get("Random Student Picker (\u968F\u673A\u70B9\u540D\u5C0F\u5DE5\u5177)");
+    if (existingRollCall && (!existingRollCall.manifest || !existingRollCall.manifest.includes("classroomTools"))) {
+      console.log("Upgrading old Random Student Picker Plugin to add classroomTools...");
+      db2.prepare("DELETE FROM plugins WHERE id = ?").run(existingRollCall.id);
     }
+  } catch (e) {
+    console.error("Error upgrading old default plugins:", e);
   }
-  /** Remove a provider by id. Returns true if it was present. */
-  unregisterProvider(id) {
-    return this.providers.delete(id);
-  }
-  getProvider(id) {
-    return this.providers.get(id);
-  }
-  listProviders() {
-    return Array.from(this.providers.values());
+  try {
+    db2.exec(`
+      CREATE TABLE IF NOT EXISTS student_rollcalls (
+        id TEXT PRIMARY KEY,
+        student_id TEXT NOT NULL,
+        class_id TEXT,
+        lesson_id TEXT,
+        picked_time INTEGER NOT NULL
+      );
+    `);
+    console.log("student_rollcalls table successfully ensured.");
+  } catch (e) {
+    console.error("Error creating student_rollcalls table:", e);
   }
-  /** List the declarative descriptors (for Workspace catalogue / REST). */
-  listDescriptors() {
-    return this.listProviders().map((p) => p.descriptor);
+  try {
+    db2.exec(`
+      CREATE TABLE IF NOT EXISTS site_settings (
+        id TEXT PRIMARY KEY,
+        site_name TEXT,
+        slogan TEXT,
+        logo_url TEXT
+      );
+    `);
+    console.log("site_settings table successfully ensured.");
+  } catch (e) {
+    console.error("Error creating site_settings table:", e);
   }
-  /** Activities visible to a given role (`all` matches everything). */
-  listByRole(role) {
-    return this.listProviders().filter(
-      (p) => p.descriptor.supportedRoles.includes("all") || p.descriptor.supportedRoles.includes(role)
+  try {
+    db2.exec(`
+      CREATE TABLE IF NOT EXISTS agent_conversations (
+        id TEXT PRIMARY KEY,
+        conv_key TEXT NOT NULL,
+        role TEXT NOT NULL,
+        content TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      );
+    `);
+    db2.exec(
+      `CREATE INDEX IF NOT EXISTS idx_agent_conv_key ON agent_conversations(conv_key, created_at);`
     );
+    console.log("agent_conversations table successfully ensured.");
+  } catch (e) {
+    console.error("Error creating agent_conversations table:", e);
   }
-  listByCategory(category) {
-    return this.listProviders().filter((p) => p.descriptor.category === category);
+  try {
+    db2.exec(`ALTER TABLE client_sessions ADD COLUMN expires_at INTEGER`);
+    console.log("client_sessions.expires_at column ensured.");
+  } catch {
   }
-  /**
-   * Execute an activity's `start` lifecycle on the supplied context.
-   *
-   * Permission isolation: when the provider declares `permissions`, at least
-   * one must be granted to `actorId` via the (reused) capability service,
-   * otherwise a PERMISSION_DENIED error is thrown (403 at the REST layer).
-   *
-   * The activity itself reuses the Command Bus / Event Bus — this method only
-   * orchestrates the lifecycle and enforces permission.
-   */
-  async startActivity(id, context, payload, actorId) {
-    const provider = this.providers.get(id);
-    if (!provider) {
-      throw new Error(`ActivityRegistry: activity provider "${id}" not found.`);
-    }
-    const required = provider.descriptor.permissions ?? [];
-    if (required.length > 0 && actorId) {
-      const results = await Promise.all(
-        required.map((cap) => context.capability.check(actorId, cap))
-      );
-      const granted = results.some(Boolean);
-      if (!granted) {
-        const err = new Error(
-          `[ActivityPermission] Actor "${actorId}" is missing a required permission (${required.join(", ")}) for activity "${id}".`
-        );
-        err.code = "PERMISSION_DENIED";
-        throw err;
-      }
+  try {
+    const now = Date.now();
+    const idleTimeout = 24 * 60 * 60 * 1e3;
+    const deletedExpired = db2.prepare(
+      "DELETE FROM client_sessions WHERE expires_at IS NOT NULL AND expires_at < ?"
+    ).run(now);
+    const deletedIdle = db2.prepare(
+      "DELETE FROM client_sessions WHERE updated_at IS NOT NULL AND (? - updated_at) > ?"
+    ).run(now, idleTimeout);
+    const totalDeleted = (deletedExpired.changes || 0) + (deletedIdle.changes || 0);
+    if (totalDeleted > 0) {
+      console.log(`[Session] Cleaned up ${totalDeleted} expired sessions on startup.`);
     }
-    const result = await provider.start(context, payload);
-    return {
-      provider: provider.descriptor.provider,
-      dispatched: Boolean(provider.descriptor.commandType),
-      result
-    };
+  } catch (e) {
+    console.warn("[Session] Could not clean up expired sessions:", e);
   }
-  clear() {
-    this.providers.clear();
+}
+
+// server/ai-agent.ts
+var import_genai2 = require("@google/genai");
+var import_crypto4 = __toESM(require("crypto"), 1);
+var buildAgentSystemInstruction = (lang, currentLessonId) => {
+  let systemInstruction = lang === "zh" ? "\u4F60\u662F\u4E00\u4E2A\u6559\u80B2\u7CFB\u7EDF\u5E95\u5C42\u7684 OS Agent\u3002\u4F60\u9700\u8981\u7406\u89E3\u8001\u5E08\u7684\u6307\u4EE4\uFF0C\u5E76\u8C03\u7528\u53EF\u7528\u7684\u5DE5\u5177\uFF08\u547D\u4EE4\uFF09\u53BB\u6267\u884C\u8FD9\u4E9B\u64CD\u4F5C\u3002\u5982\u679C\u8001\u5E08\u8BA9\u4F60\u521B\u5EFA\u4E00\u8282\u8BFE\uFF0C\u8BF7\u52A1\u5FC5\u5229\u7528\u5DE5\u5177\u751F\u6210\u8BE6\u7EC6\u7684\u521D\u59CB\u8BFE\u7A0B\u5185\u5BB9\u3002\u5982\u679C\u8001\u5E08\u8981\u6C42\u7BA1\u7406\u8FDB\u7A0B/\u4EFB\u52A1\uFF0C\u8BF7\u4F7F\u7528 process.spawn, process.kill, process.list\u3002\u5982\u679C\u9700\u5B58\u50A8\u6587\u4EF6\u3001\u7D20\u6750\u6216\u521B\u5EFA\u76EE\u5F55\uFF0C\u8BF7\u4F7F\u7528 vfs.* \u5E76\u5728\u9700\u8981\u65F6\u7BA1\u7406\u73ED\u7EA7\u548C\u5B66\u751F\u3002\u4F60\u652F\u6301\u901A\u8FC7 class_create \u521B\u5EFA\u73ED\u7EA7, student_create \u521B\u5EFA\u5B66\u751F, class_add_student \u5C06\u5B66\u751F\u52A0\u5165\u73ED\u7EA7\u3002\u5F53\u8001\u5E08\u8981\u6C42\u4ECE\u63D0\u4F9B\u7684\u6570\u636E\uFF08\u5982CSV\u3001JSON\u3001Markdown\u6216\u5BF9\u8BDD\u4E2D\uFF09\u521B\u5EFA\u73ED\u7EA7\u6216\u5B66\u751F\u65F6\uFF0C\u8BF7\u4F9D\u6B21\u53D1\u51FA\u8FD9\u4E9B\u6307\u4EE4\u3002\u5982\u679C\u4E0A\u4E00\u9636\u6BB5\u8FD4\u56DE\u4E86\u521B\u5EFA\u6210\u529F\u7684\u73ED\u7EA7ID\u6216\u5B66\u751FID\uFF0C\u4F60\u9700\u8981\u5728\u540E\u7EED\uFFFD? functionCall \u4E2D\u5F15\u7528\u8FD9\u4E9BID\uFF08\u4F8B\u5982\uFF1A\u628A\u521A\u521B\u5EFA\u7684\u5B66\u751FID\u52A0\u5165\u5230\u521A\u521B\u5EFA\u7684\u73ED\u7EA7ID\u4E2D\uFF09\u3002\u901A\u8FC7\u5F80\u590D\u7684\u5DE5\u5177\u8C03\u7528\uFF0C\u4F60\u53EF\u4EE5\u81EA\u52A8\u5B8C\u6210\u5B8C\u6574\u7684\u6D41\u7A0B\uFFFD?" : "You are an educational OS kernel agent. You interpret teacher instructions and use your available tools (commands) to execute them. If the teacher asks to create a lesson, always generate some detailed initial content for it. If the teacher asks to spawn or kill processes, use process tools. Use vfs tools to store assets, and manage classes/students as necessary. You support class_create, student_create, class_add_student. Always use tool chaining if you need to create a class and enroll students: first call class_create/student_create, receive their returned IDs, and then call class_add_student in the next turn. Always answer with a helpful summary.";
+  if (currentLessonId) {
+    systemInstruction += `
+[Context] The current selected lesson ID is "${currentLessonId}". Use this ID if the teacher's instruction is about modifying or adding to the current lesson.
+
+Available tools (functions) can be used multiple times in sequence if needed.`;
   }
+  return systemInstruction;
 };
+var buildAgentFinalMessage = (message, attachments) => {
+  let finalMessage = message;
+  if (attachments && Array.isArray(attachments) && attachments.length > 0) {
+    finalMessage += "\n\n[Attached Reference Files]";
+    attachments.forEach((file, index) => {
+      if (file.name.endsWith(".zip") || file.content.startsWith("data:application/zip") || file.content.length > 5e3) {
+        finalMessage += `
 
-// packages/activity-ecosystem/default-providers.ts
-var OFFICIAL_PROVIDER = "official";
-function aiActionFor(d) {
-  return {
-    id: `activity_ai_${d.id}`,
-    commandType: d.commandType ?? `activity.${d.id}.start`,
-    description: `Start the ${d.name} activity${d.description ? ` \u2014 ${d.description}` : ""}`,
-    inputSchema: {
-      type: "OBJECT",
-      properties: {
-        payload: {
-          type: "OBJECT",
-          description: `Optional configuration for the ${d.name} activity`
-        }
+Filename: "${file.name}"
+Content: "ATTACHMENT_BASE64:${index}"`;
+      } else {
+        finalMessage += `
+
+Filename: "${file.name}"
+Content:
+"""
+${file.content}
+"""`;
       }
-    },
-    capabilityRequired: d.permissions?.[0] ?? "lesson:read"
-  };
-}
-var OFFICIAL_ACTIVITY_DEFINITIONS = [
-  {
-    id: "official_quiz",
-    name: "Quiz",
-    description: "In-class multiple choice / graded quiz.",
-    icon: "HelpCircle",
-    category: "assessment",
-    permissions: ["quiz:write"],
-    supportedRoles: ["teacher", "student", "all"],
-    supportedDevices: ["desktop", "tablet", "all"],
-    tags: ["assessment", "quiz"],
-    version: "1.0.0",
-    provider: OFFICIAL_PROVIDER,
-    commandType: "quiz.create"
-  },
-  {
-    id: "official_vote",
-    name: "Vote",
-    description: "Quick classroom vote / poll on a question.",
-    icon: "Vote",
-    category: "engagement",
-    permissions: ["lesson:control"],
-    supportedRoles: ["teacher", "student", "all"],
-    supportedDevices: ["desktop", "tablet", "mobile", "all"],
-    tags: ["engagement", "vote", "poll"],
-    version: "1.0.0",
-    provider: OFFICIAL_PROVIDER,
-    commandType: "vote.create"
-  },
-  {
-    id: "official_poll",
-    name: "Poll",
-    description: "Live polling with instant results.",
-    icon: "BarChart3",
-    category: "engagement",
-    permissions: ["lesson:control"],
-    supportedRoles: ["teacher", "student", "all"],
-    supportedDevices: ["desktop", "tablet", "mobile", "all"],
-    tags: ["engagement", "poll"],
-    version: "1.0.0",
-    provider: OFFICIAL_PROVIDER,
-    commandType: "poll.create"
-  },
-  {
-    id: "official_discussion",
-    name: "Discussion",
-    description: "Whole-class or group real-time discussion thread.",
-    icon: "MessagesSquare",
-    category: "collaboration",
-    permissions: ["lesson:control"],
-    supportedRoles: ["teacher", "student", "all"],
-    supportedDevices: ["desktop", "tablet", "all"],
-    tags: ["collaboration", "discussion"],
-    version: "1.0.0",
-    provider: OFFICIAL_PROVIDER,
-    commandType: "discussion.create"
-  },
-  {
-    id: "official_grouping",
-    name: "Grouping",
-    description: "Auto / random / manual student grouping.",
-    icon: "Users",
-    category: "collaboration",
-    permissions: ["lesson:control"],
-    supportedRoles: ["teacher"],
-    supportedDevices: ["desktop", "all"],
-    tags: ["collaboration", "group"],
-    version: "1.0.0",
-    provider: OFFICIAL_PROVIDER,
-    commandType: "grouping.create"
-  },
-  {
-    id: "official_assignment",
-    name: "Assignment",
-    description: "Create, submit and grade student assignments / homework.",
-    icon: "FileText",
-    category: "management",
-    permissions: ["management:write"],
-    supportedRoles: ["teacher", "student", "all"],
-    supportedDevices: ["desktop", "tablet", "all"],
-    tags: ["management", "assignment", "homework"],
-    version: "1.0.0",
-    provider: OFFICIAL_PROVIDER,
-    commandType: "assignment.create"
-  },
-  {
-    id: "official_competition",
-    name: "Competition",
-    description: "Timed leaderboard competition between students / groups.",
-    icon: "Trophy",
-    category: "engagement",
-    permissions: ["lesson:control"],
-    supportedRoles: ["teacher", "student", "all"],
-    supportedDevices: ["desktop", "tablet", "mobile", "all"],
-    tags: ["engagement", "competition", "gamification"],
-    version: "1.0.0",
-    provider: OFFICIAL_PROVIDER,
-    commandType: "competition.create"
-  },
-  {
-    id: "official_checkin",
-    name: "Check-in",
-    description: "Take class attendance / check-in.",
-    icon: "CheckCircle2",
-    category: "management",
-    permissions: ["management:write"],
-    supportedRoles: ["teacher"],
-    supportedDevices: ["desktop", "tablet", "mobile", "all"],
-    tags: ["management", "attendance", "checkin"],
-    version: "1.0.0",
-    provider: OFFICIAL_PROVIDER,
-    commandType: "attendance.record"
-  },
-  {
-    id: "official_homework",
-    name: "Homework",
-    description: "Assign and track out-of-class homework.",
-    icon: "BookOpen",
-    category: "management",
-    permissions: ["management:write"],
-    supportedRoles: ["teacher", "student", "all"],
-    supportedDevices: ["desktop", "tablet", "all"],
-    tags: ["management", "homework", "assignment"],
-    version: "1.0.0",
-    provider: OFFICIAL_PROVIDER,
-    commandType: "assignment.create"
+    });
   }
-];
-function registerOfficialActivities(registry, actionRegistry) {
-  for (const def of OFFICIAL_ACTIVITY_DEFINITIONS) {
-    const descriptor = {
-      ...def,
-      aiAction: aiActionFor(def)
-    };
-    registry.registerProvider(new BaseActivityProvider({ descriptor }));
-    if (actionRegistry && descriptor.aiAction) {
-      actionRegistry.register(descriptor.aiAction);
+  return finalMessage;
+};
+var normalizeToolSchema = (schema) => {
+  if (!schema || typeof schema !== "object") return schema;
+  if (Array.isArray(schema)) return schema.map(normalizeToolSchema);
+  const normalized = {};
+  for (const [key, value] of Object.entries(schema)) {
+    if (key === "type" && typeof value === "string") {
+      const typeMap = {
+        OBJECT: "object",
+        STRING: "string",
+        ARRAY: "array",
+        INTEGER: "integer",
+        NUMBER: "number",
+        BOOLEAN: "boolean"
+      };
+      normalized.type = typeMap[value.toUpperCase()] || value.toLowerCase();
+      continue;
+    }
+    if (key === "properties" && value && typeof value === "object" && !Array.isArray(value)) {
+      normalized.properties = Object.fromEntries(
+        Object.entries(value).map(([propKey, propSchema]) => [propKey, normalizeToolSchema(propSchema)])
+      );
+      continue;
+    }
+    if (key === "items") {
+      normalized.items = normalizeToolSchema(value);
+      continue;
     }
+    normalized[key] = value;
   }
-}
-
-// packages/activity-ecosystem/index.ts
-var IActivityRegistryToken = new Token(
-  "@openlearn/activity-ecosystem:IActivityRegistry"
-);
-
-// server/routes/os.ts
-var import_path8 = __toESM(require("path"), 1);
-var import_fs8 = __toESM(require("fs"), 1);
-var import_child_process = require("child_process");
-var import_crypto6 = __toESM(require("crypto"), 1);
-var import_xss = require("xss");
-
-// server/utils/crypto.ts
-var import_crypto4 = __toESM(require("crypto"), 1);
-var import_fs7 = __toESM(require("fs"), 1);
-var import_path6 = __toESM(require("path"), 1);
-var _encryptionKey = null;
-function getEncryptionKey() {
-  if (_encryptionKey) return _encryptionKey;
-  const envPath = import_path6.default.resolve(process.cwd(), ".env");
-  const keyHex = process.env.ENCRYPTION_KEY;
-  if (keyHex && keyHex.trim() !== "") {
-    _encryptionKey = Buffer.from(keyHex.trim(), "hex");
-    return _encryptionKey;
-  }
-  if (import_fs7.default.existsSync(envPath)) {
+  return normalized;
+};
+var buildOpenAITools = () => {
+  const actions = kernelContainer.actionRegistry.getAllActions();
+  return actions.map((action) => ({
+    type: "function",
+    function: {
+      name: action.commandType.replace(/[^a-zA-Z0-9_\-]/g, "_"),
+      description: action.description,
+      parameters: normalizeToolSchema(action.inputSchema)
+    }
+  }));
+};
+var executeAgentToolCall = async (toolName, args, allExecutedTools, callerRole, currentLessonId) => {
+  const actionDesc = kernelContainer.actionRegistry.getActionByToolName(toolName);
+  let actionResult;
+  const isAdmin = callerRole === "administrator";
+  const actorId = isAdmin ? "user-frontend" : "agent-system-0";
+  const metadata = isAdmin ? { approved: true } : void 0;
+  if (actionDesc) {
+    const cmd = kernelContainer.commandBus.createCommand(
+      actionDesc.commandType,
+      args,
+      actorId,
+      metadata
+    );
     try {
-      const content = import_fs7.default.readFileSync(envPath, "utf-8");
-      const match = content.match(/^ENCRYPTION_KEY=(.+)$/m);
-      if (match && match[1].trim() !== "") {
-        const fileKeyHex = match[1].trim();
-        _encryptionKey = Buffer.from(fileKeyHex, "hex");
-        process.env.ENCRYPTION_KEY = fileKeyHex;
-        console.log("[Crypto] ENCRYPTION_KEY loaded from .env file");
-        return _encryptionKey;
+      const cmdResult = await kernelContainer.commandBus.execute(cmd);
+      actionResult = cmdResult;
+      allExecutedTools.push({ callName: toolName, success: true, result: cmdResult });
+      if (cmdResult && cmdResult.elementId && currentLessonId) {
+        const activeSeg = lessonActiveSegments.get(currentLessonId);
+        if (activeSeg) {
+          const row = kernelContainer.db.prepare("SELECT data FROM whiteboard_elements WHERE id = ?").get(cmdResult.elementId);
+          if (row) {
+            try {
+              const dataObj = JSON.parse(row.data);
+              if (!dataObj.segmentId) {
+                dataObj.segmentId = activeSeg;
+                kernelContainer.db.prepare("UPDATE whiteboard_elements SET data = ? WHERE id = ?").run(JSON.stringify(dataObj), cmdResult.elementId);
+                console.log(`[Agent Tool Sync] Injected active segment "${activeSeg}" into element "${cmdResult.elementId}"`);
+                kernelContainer.eventBus.publish({
+                  id: import_crypto4.default.randomUUID(),
+                  type: "whiteboard.element_updated",
+                  source: "agent-tool-sync",
+                  payload: { elementId: cmdResult.elementId, lessonId: currentLessonId },
+                  timestamp: Date.now(),
+                  correlationId: cmd.id
+                }).catch((e) => console.error("[Agent Tool Sync] Failed to publish element_updated event:", e));
+              }
+            } catch (e) {
+              console.error("[Agent Tool Sync] Failed to parse/update element data:", e);
+            }
+          }
+        }
       }
-    } catch {
+    } catch (err) {
+      actionResult = { error: err.message };
+      allExecutedTools.push({ callName: toolName, success: false, error: err.message });
     }
+  } else {
+    actionResult = { error: `Command / Tool not found: ${toolName}` };
+    allExecutedTools.push({ callName: toolName, success: false, error: "Command not registered" });
   }
-  const newKey = import_crypto4.default.randomBytes(32).toString("hex");
-  try {
-    if (import_fs7.default.existsSync(envPath)) {
-      let content = import_fs7.default.readFileSync(envPath, "utf-8");
-      if (/^ENCRYPTION_KEY=/m.test(content)) {
-        content = content.replace(/^ENCRYPTION_KEY=.*$/m, `ENCRYPTION_KEY=${newKey}`);
-        import_fs7.default.writeFileSync(envPath, content);
-        console.log("[Crypto] ENCRYPTION_KEY replaced in .env (was empty or invalid)");
-      } else {
-        import_fs7.default.appendFileSync(envPath, `
-ENCRYPTION_KEY=${newKey}
-`);
-        console.log("[Crypto] ENCRYPTION_KEY auto-generated and persisted to .env");
-      }
-    } else {
-      import_fs7.default.writeFileSync(envPath, `ENCRYPTION_KEY=${newKey}
-`);
-      console.log("[Crypto] .env created with auto-generated ENCRYPTION_KEY");
-    }
-  } catch (e) {
-    console.warn("[Crypto] Could not persist ENCRYPTION_KEY, using in-memory fallback");
+  return actionResult;
+};
+var buildOpenAIChatUrl = (apiUrl) => {
+  let cleanUrl = apiUrl.trim();
+  if (!cleanUrl.endsWith("/chat/completions")) {
+    cleanUrl = cleanUrl.endsWith("/") ? cleanUrl + "chat/completions" : cleanUrl + "/chat/completions";
   }
-  process.env.ENCRYPTION_KEY = newKey;
-  _encryptionKey = Buffer.from(newKey, "hex");
-  return _encryptionKey;
-}
-function encryptApiKey(plaintext) {
-  if (!plaintext) return "";
-  const key = getEncryptionKey();
-  const iv = import_crypto4.default.randomBytes(16);
-  const cipher = import_crypto4.default.createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-  const authTag = cipher.getAuthTag();
-  return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
-}
-function decryptApiKey(encrypted) {
-  if (!encrypted) return "";
-  const parts = encrypted.split(":");
-  if (parts.length !== 3) return encrypted;
-  try {
-    const key = getEncryptionKey();
-    const iv = Buffer.from(parts[0], "hex");
-    const authTag = Buffer.from(parts[1], "hex");
-    const ciphertext = Buffer.from(parts[2], "hex");
-    const decipher = import_crypto4.default.createDecipheriv("aes-256-gcm", key, iv);
-    decipher.setAuthTag(authTag);
-    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf-8");
-  } catch {
-    console.warn("[Crypto] Failed to decrypt API key, treating as plaintext");
-    return encrypted;
+  return cleanUrl;
+};
+var runGeminiAgentChat = async (request) => {
+  const { message, lang = "zh", currentLessonId, attachments, callerRole, history } = request;
+  const apiKey = process.env.GEMINI_API_KEY;
+  if (!apiKey || apiKey.trim() === "" || apiKey.trim() === "MY_GEMINI_API_KEY") {
+    throw new Error(
+      lang === "zh" ? "\u672A\u914D\u7F6E\u53EF\u7528\u7684 AI \u670D\u52A1\u3002\u8BF7\u5728\u7BA1\u7406\u540E\u53F0\u7684\u300CAI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u4E2D\u6DFB\u52A0\u4E00\u4E2A AI \u63D0\u4F9B\u5546\uFF08\u6216\u8BBE\u7F6E GEMINI_API_KEY \u4F5C\u4E3A\u517C\u5BB9\u56DE\u9000\uFF09\u3002" : 'No AI service is configured. Please add an AI Provider in the admin dashboard\'s "AI Provider Management" (or set `GEMINI_API_KEY` as a compatible fallback).'
+    );
   }
-}
-function maskApiKey(key) {
-  if (!key || key.length <= 8) return key ? "****" : "";
-  return key.substring(0, 4) + "****" + key.substring(key.length - 4);
-}
-var PROMPT_INJECTION_PATTERNS = [
-  /ignore\s+(all\s+)?(previous|prior|above|system)\s+(instructions?|prompts?|directives?)/i,
-  /you\s+are\s+now\s+(a\s+)?(different|new|another)/i,
-  /forget\s+(all\s+)?(your|the)\s+(training|instructions?|rules?)/i,
-  /system\s*(prompt|message|instruction):\s*/i,
-  /<\|im_start\|>/i,
-  /<\|im_end\|>/i
-];
-function detectPromptInjection(input) {
-  return PROMPT_INJECTION_PATTERNS.some((p) => p.test(input));
-}
-
-// server/middleware/auth.ts
-function getValidSession(token) {
-  let sessionRow;
-  try {
-    sessionRow = kernelContainer.db.prepare("SELECT * FROM client_sessions WHERE id = ?").get(token);
-  } catch {
-    return null;
+  const ai = new import_genai2.GoogleGenAI({ apiKey: apiKey.trim() });
+  const tools = kernelContainer.actionRegistry.getAgentTools();
+  const systemInstruction = buildAgentSystemInstruction(lang, currentLessonId);
+  const finalMessage = buildAgentFinalMessage(message, attachments);
+  const historyContents = (history || []).map((h) => ({
+    role: h.role === "assistant" ? "model" : "user",
+    parts: [{ text: h.content }]
+  }));
+  const contents = [...historyContents, { role: "user", parts: [{ text: finalMessage }] }];
+  let loopCount = 0;
+  const MAX_LOOPS = 5;
+  let finalResponseText = "";
+  const allExecutedTools = [];
+  while (loopCount < MAX_LOOPS) {
+    const response = await ai.models.generateContent({
+      model: "gemini-3.5-flash",
+      contents,
+      config: {
+        systemInstruction,
+        tools,
+        temperature: 0.1
+      }
+    });
+    const candidate = response.candidates?.[0];
+    const contentParts = candidate?.content?.parts || [];
+    const functionCalls = contentParts.filter((p) => "functionCall" in p);
+    if (functionCalls.length === 0) {
+      finalResponseText = response.text || "";
+      break;
+    }
+    contents.push({
+      role: "model",
+      parts: contentParts
+    });
+    const toolParts = [];
+    for (const part of contentParts) {
+      if ("functionCall" in part && part.functionCall) {
+        const call = part.functionCall;
+        if (call.args && typeof call.args === "object" && attachments) {
+          for (const key of Object.keys(call.args)) {
+            const val = call.args[key];
+            if (typeof val === "string" && val.startsWith("ATTACHMENT_BASE64:")) {
+              const idx = parseInt(val.split(":")[1]);
+              if (attachments[idx]) {
+                call.args[key] = attachments[idx].content;
+              }
+            }
+          }
+        }
+        const actionResult = await executeAgentToolCall(call.name, call.args, allExecutedTools, callerRole, currentLessonId);
+        toolParts.push({
+          functionResponse: {
+            name: call.name,
+            response: typeof actionResult === "object" && actionResult !== null ? actionResult : { value: actionResult }
+          }
+        });
+      }
+    }
+    contents.push({
+      role: "tool",
+      parts: toolParts
+    });
+    loopCount++;
   }
-  if (!sessionRow) return null;
-  const now = Date.now();
-  if (sessionRow.expires_at && sessionRow.expires_at < now) {
-    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
-    return null;
+  if (loopCount >= MAX_LOOPS && !finalResponseText) {
+    finalResponseText = "I have executed several internal commands to create or link resources, but reached the iteration limit. Please double-check the interface to confirm.";
   }
-  const idleTimeout = 24 * 60 * 60 * 1e3;
-  if (sessionRow.updated_at && now - sessionRow.updated_at > idleTimeout) {
-    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
-    return null;
+  return {
+    agentText: finalResponseText,
+    toolResults: allExecutedTools
+  };
+};
+var runOpenAIAgentChat = async (provider, request) => {
+  const { message, lang = "zh", currentLessonId, attachments, callerRole, history } = request;
+  const systemInstruction = buildAgentSystemInstruction(lang, currentLessonId);
+  const finalMessage = buildAgentFinalMessage(message, attachments);
+  const tools = buildOpenAITools();
+  const chatUrl = buildOpenAIChatUrl(provider.api_url);
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  if (provider.api_key && provider.api_key.trim()) {
+    headers.Authorization = `Bearer ${provider.api_key.trim()}`;
   }
-  kernelContainer.db.prepare("UPDATE client_sessions SET updated_at = ? WHERE id = ?").run(now, token);
-  return JSON.parse(sessionRow.session_data);
-}
-function getCookieToken(req) {
-  const rc = req.headers.cookie;
-  if (!rc) return null;
-  const parts = rc.split(";");
-  for (const part of parts) {
-    const trimmed = part.trim();
-    if (trimmed.startsWith("edu_os_token=")) {
-      return trimmed.substring("edu_os_token=".length);
+  const historyMessages = (history || []).map((h) => ({ role: h.role, content: h.content }));
+  const messages = [
+    { role: "system", content: systemInstruction },
+    ...historyMessages,
+    { role: "user", content: finalMessage }
+  ];
+  const allExecutedTools = [];
+  let finalResponseText = "";
+  const MAX_LOOPS = 5;
+  let loopCount = 0;
+  while (loopCount < MAX_LOOPS) {
+    const response = await fetch(chatUrl, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        model: provider.model_name,
+        messages,
+        tools,
+        tool_choice: tools.length > 0 ? "auto" : void 0,
+        temperature: 0.1
+      })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`AI provider request failed (${response.status}): ${errorText || response.statusText}`);
     }
-  }
-  return null;
-}
-function getActorId(req) {
-  const token = getCookieToken(req);
-  if (!token) return "user-frontend";
-  try {
-    const session = getValidSession(token);
-    if (!session) return "user-frontend";
-    let role = session.subRole || session.role;
-    if (session.username === "admin" || session.userId === "usr_admin" || role === "admin" || role === "administrator") {
-      role = "administrator";
+    const data = await response.json();
+    const assistantMessage = data.choices?.[0]?.message;
+    if (!assistantMessage) {
+      throw new Error("AI provider returned no assistant message");
     }
-    if (role) {
-      return `user:${session.userId || "demo"}:${role}`;
+    finalResponseText = typeof assistantMessage.content === "string" ? assistantMessage.content.trim() : "";
+    const toolCalls = Array.isArray(assistantMessage.tool_calls) ? assistantMessage.tool_calls : [];
+    messages.push({
+      role: "assistant",
+      content: assistantMessage.content ?? "",
+      tool_calls: toolCalls
+    });
+    if (toolCalls.length === 0) {
+      break;
     }
-    return "user-frontend";
-  } catch {
-    return "user-frontend";
+    for (const call of toolCalls) {
+      const toolName = call?.function?.name;
+      if (!toolName) continue;
+      let parsedArgs = {};
+      if (typeof call?.function?.arguments === "string" && call.function.arguments.trim()) {
+        try {
+          parsedArgs = JSON.parse(call.function.arguments);
+        } catch (err) {
+          parsedArgs = {};
+        }
+      }
+      if (parsedArgs && typeof parsedArgs === "object" && attachments) {
+        for (const key of Object.keys(parsedArgs)) {
+          const val = parsedArgs[key];
+          if (typeof val === "string" && val.startsWith("ATTACHMENT_BASE64:")) {
+            const idx = parseInt(val.split(":")[1]);
+            if (attachments[idx]) {
+              parsedArgs[key] = attachments[idx].content;
+            }
+          }
+        }
+      }
+      const actionResult = await executeAgentToolCall(toolName, parsedArgs, allExecutedTools, callerRole, currentLessonId);
+      messages.push({
+        role: "tool",
+        tool_call_id: call.id,
+        content: JSON.stringify(actionResult)
+      });
+    }
+    loopCount++;
   }
-}
-function checkIsTeacherOrAdmin(req) {
-  const token = getCookieToken(req);
-  if (!token) return false;
-  try {
-    const session = getValidSession(token);
-    if (!session) return false;
-    return session.role === "teacher" || session.role === "administrator";
-  } catch {
-    return false;
+  if (loopCount >= MAX_LOOPS && !finalResponseText) {
+    finalResponseText = "I have executed several internal commands, but reached the iteration limit. Please review the assistant panel for the latest state.";
   }
-}
+  return {
+    agentText: finalResponseText,
+    toolResults: allExecutedTools
+  };
+};
 
-// server/routes/shared.ts
-var import_path7 = __toESM(require("path"), 1);
-var import_crypto5 = __toESM(require("crypto"), 1);
+// packages/core/bootstrap/adapter/bootstrap-registration.ts
+var BootstrapRegistration = class {
+  static registerConfiguration(builder, context) {
+    if (context.config) {
+      builder.withConfiguration(context.config);
+    }
+    if (context.environment) {
+      builder.withEnvironment(context.environment);
+    }
+  }
+  static registerLogger(builder, context) {
+    if (context.logger) {
+      builder.withLogger(context.logger);
+    }
+  }
+  static registerInfrastructure(builder, context) {
+    if (context.existingServices) {
+      for (const [id, service] of context.existingServices.entries()) {
+        builder.addService(id, service);
+      }
+    }
+    if (context.kernelContainer) {
+      builder.addService("kernelContainer", context.kernelContainer);
+    }
+    if (context.expressApp) {
+      builder.addService("expressApp", context.expressApp);
+    }
+    if (context.httpServer) {
+      builder.addService("httpServer", context.httpServer);
+    }
+  }
+  static registerExistingBootstrapStages(_builder) {
+  }
+};
 
-// server/utils/bridge-sdk.ts
-var BRIDGE_SDK_CODE = `(function() {
-  // Mock document.cookie to prevent SecurityError in sandboxed iframes lacking 'allow-same-origin'
-  try {
-    Object.defineProperty(document, 'cookie', {
-      get: function() { return ""; },
-      set: function(val) {},
-      configurable: true
+// packages/core/bootstrap/adapter/server-bootstrap-adapter.ts
+var ServerBootstrapAdapter = class _ServerBootstrapAdapter {
+  constructor(options) {
+    this._state = "Created";
+    this._state = "Created";
+    this._builder = PlatformBuilder.create();
+    if (options) {
+      this.configure(options);
+    }
+  }
+  static create(options) {
+    return new _ServerBootstrapAdapter(options);
+  }
+  get state() {
+    return this._state;
+  }
+  configure(context) {
+    this._state = "Configuring";
+    BootstrapRegistration.registerConfiguration(this._builder, context);
+    BootstrapRegistration.registerLogger(this._builder, context);
+    BootstrapRegistration.registerInfrastructure(this._builder, context);
+    return this;
+  }
+  registerStages() {
+    BootstrapRegistration.registerExistingBootstrapStages(this._builder);
+    this._state = "PipelineRegistered";
+    return this;
+  }
+  async runBootstrap(context) {
+    if (this._state === "Created") {
+      this.configure(context);
+    }
+    if (this._state === "Configuring") {
+      this.registerStages();
+    }
+    const builderResult = this._builder.buildResult();
+    const pipelineResult = await builderResult.pipeline.execute({
+      startupTimestamp: Date.now(),
+      startupOptions: {},
+      startupStage: builderResult.platformContext.currentStage,
+      startupToken: { token: "srv_adapter_token", isCancelled: false, cancel: () => {
+      } },
+      isCancelled: false,
+      platformContext: builderResult.platformContext,
+      config: builderResult.platformContext.config,
+      state: "Active",
+      currentStage: builderResult.platformContext.currentStage,
+      startTime: Date.now(),
+      getMetadata: () => void 0,
+      setStage: () => {
+      }
     });
-  } catch (e) {
-    try {
-      Object.defineProperty(Document.prototype, 'cookie', {
-        get: function() { return ""; },
-        set: function(val) {},
-        configurable: true
-      });
-    } catch (err) {}
+    if (pipelineResult.status === "Failed") {
+      throw pipelineResult.error || new Error(`ServerBootstrapAdapter pipeline failed at stage: ${pipelineResult.failedStage}`);
+    }
+    this._state = "Bootstrapped";
+    return { builderResult, pipelineResult };
+  }
+  static async bootstrap(context) {
+    const adapter = _ServerBootstrapAdapter.create(context);
+    return adapter.runBootstrap(context);
   }
+};
 
-  // Proxy postMessage calls to enrich them with attempt_id/uuid and normalize targetOrigin
-  try {
-    const originalPostMessage = window.postMessage;
-    window.postMessage = function(message, targetOrigin, transfer) {
-      try {
-        if (message && typeof message === 'object') {
-          if (!message.attempt_id && window.__LMS_STUDENT__?.attempt_id) {
-            message.attempt_id = window.__LMS_STUDENT__.attempt_id;
-          }
-          if (!message.uuid && window.__LMS_COURSEWARE__?.uuid) {
-            message.uuid = window.__LMS_COURSEWARE__.uuid;
-          }
-        }
-      } catch (e) {}
-      
-      let origin = targetOrigin;
-      if (origin === 'null') {
-        origin = '*';
-      }
-      try {
-        return originalPostMessage.call(this, message, origin, transfer);
-      } catch (err) {
-        if (err.name === 'SyntaxError' && origin !== '*') {
-          return originalPostMessage.call(this, message, '*', transfer);
-        }
-        throw err;
-      }
-    };
+// packages/activity-ecosystem/index.ts
+init_token();
 
-    if (window.parent && window.parent !== window) {
+// packages/activity-ecosystem/context.ts
+function createActivityContext(opts) {
+  return {
+    commandBus: opts.commandBus,
+    eventBus: opts.eventBus,
+    actionRegistry: opts.actionRegistry,
+    capability: opts.capability,
+    ai: opts.ai,
+    classroom: opts.classroom ?? null
+  };
+}
+
+// packages/activity-ecosystem/provider.ts
+var import_uuid15 = require("uuid");
+var ACTIVITY_EVENTS = {
+  REGISTERED: "activity.registered",
+  INITIALIZED: "activity.initialized",
+  STARTED: "activity.started",
+  PAUSED: "activity.paused",
+  RESUMED: "activity.resumed",
+  FINISHED: "activity.finished",
+  DISPOSED: "activity.disposed"
+};
+function publishEvent(context, type, descriptor, payload) {
+  context.eventBus.publish({
+    id: (0, import_uuid15.v7)(),
+    type,
+    source: `activity:${descriptor.id}`,
+    payload,
+    timestamp: Date.now()
+  });
+}
+var BaseActivityProvider = class {
+  constructor(options) {
+    this._state = "registered";
+    if (!options?.descriptor?.id) {
+      throw new Error("BaseActivityProvider requires a descriptor with a valid id.");
+    }
+    this.descriptor = options.descriptor;
+    this.hooks = options;
+  }
+  get state() {
+    return this._state;
+  }
+  /** When the activity entered `running` (undefined before first start). */
+  get startedAt() {
+    return this._startedAt;
+  }
+  /** Internal marker used by the registry on registration. */
+  markRegistered() {
+    this._state = "registered";
+  }
+  async initialize(context) {
+    this._state = "initialized";
+    publishEvent(context, ACTIVITY_EVENTS.INITIALIZED, this.descriptor, {
+      activityId: this.descriptor.id,
+      provider: this.descriptor.provider
+    });
+    if (this.hooks.onInitialize) {
+      await this.hooks.onInitialize(context);
+    }
+  }
+  async start(context, payload) {
+    let result;
+    if (this.hooks.onStart) {
+      result = await this.hooks.onStart(context, payload);
+    } else if (this.descriptor.commandType) {
+      const command = await context.commandBus.createCommand(
+        this.descriptor.commandType,
+        payload ?? {},
+        this.descriptor.provider,
+        { activityId: this.descriptor.id }
+      );
+      try {
+        result = await context.commandBus.execute(command);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (!/No handler registered for command/.test(message)) {
+          throw err;
+        }
+      }
+    }
+    this._state = "running";
+    this._startedAt = Date.now();
+    publishEvent(context, ACTIVITY_EVENTS.STARTED, this.descriptor, {
+      activityId: this.descriptor.id,
+      provider: this.descriptor.provider,
+      commandType: this.descriptor.commandType,
+      payload
+    });
+    return result;
+  }
+  async pause(context) {
+    this._state = "paused";
+    publishEvent(context, ACTIVITY_EVENTS.PAUSED, this.descriptor, {
+      activityId: this.descriptor.id
+    });
+    if (this.hooks.onPause) {
+      await this.hooks.onPause(context);
+    }
+  }
+  async resume(context) {
+    this._state = "running";
+    publishEvent(context, ACTIVITY_EVENTS.RESUMED, this.descriptor, {
+      activityId: this.descriptor.id
+    });
+    if (this.hooks.onResume) {
+      await this.hooks.onResume(context);
+    }
+  }
+  async finish(context) {
+    this._state = "finished";
+    publishEvent(context, ACTIVITY_EVENTS.FINISHED, this.descriptor, {
+      activityId: this.descriptor.id
+    });
+    if (this.hooks.onFinish) {
+      await this.hooks.onFinish(context);
+    }
+  }
+  async dispose(context) {
+    this._state = "disposed";
+    publishEvent(context, ACTIVITY_EVENTS.DISPOSED, this.descriptor, {
+      activityId: this.descriptor.id
+    });
+    if (this.hooks.onDispose) {
+      await this.hooks.onDispose(context);
+    }
+  }
+};
+
+// packages/activity-ecosystem/registry.ts
+var ActivityRegistry2 = class {
+  constructor() {
+    this.providers = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Register an Activity Provider. Throws on missing id or duplicate id.
+   * Official and plugin providers go through this identical method.
+   */
+  registerProvider(provider) {
+    if (!provider || !provider.descriptor || !provider.descriptor.id) {
+      throw new Error("ActivityRegistry: an ActivityProvider must expose a descriptor with a valid id.");
+    }
+    const id = provider.descriptor.id;
+    if (this.providers.has(id)) {
+      throw new Error(`ActivityRegistry: activity provider "${id}" is already registered.`);
+    }
+    this.providers.set(id, provider);
+    if (typeof provider.markRegistered === "function") {
+      provider.markRegistered();
+    }
+  }
+  /** Remove a provider by id. Returns true if it was present. */
+  unregisterProvider(id) {
+    return this.providers.delete(id);
+  }
+  getProvider(id) {
+    return this.providers.get(id);
+  }
+  listProviders() {
+    return Array.from(this.providers.values());
+  }
+  /** List the declarative descriptors (for Workspace catalogue / REST). */
+  listDescriptors() {
+    return this.listProviders().map((p) => p.descriptor);
+  }
+  /** Activities visible to a given role (`all` matches everything). */
+  listByRole(role) {
+    return this.listProviders().filter(
+      (p) => p.descriptor.supportedRoles.includes("all") || p.descriptor.supportedRoles.includes(role)
+    );
+  }
+  listByCategory(category) {
+    return this.listProviders().filter((p) => p.descriptor.category === category);
+  }
+  /**
+   * Execute an activity's `start` lifecycle on the supplied context.
+   *
+   * Permission isolation: when the provider declares `permissions`, at least
+   * one must be granted to `actorId` via the (reused) capability service,
+   * otherwise a PERMISSION_DENIED error is thrown (403 at the REST layer).
+   *
+   * The activity itself reuses the Command Bus / Event Bus — this method only
+   * orchestrates the lifecycle and enforces permission.
+   */
+  async startActivity(id, context, payload, actorId) {
+    const provider = this.providers.get(id);
+    if (!provider) {
+      throw new Error(`ActivityRegistry: activity provider "${id}" not found.`);
+    }
+    const required = provider.descriptor.permissions ?? [];
+    if (required.length > 0 && actorId) {
+      const results = await Promise.all(
+        required.map((cap) => context.capability.check(actorId, cap))
+      );
+      const granted = results.some(Boolean);
+      if (!granted) {
+        const err = new Error(
+          `[ActivityPermission] Actor "${actorId}" is missing a required permission (${required.join(", ")}) for activity "${id}".`
+        );
+        err.code = "PERMISSION_DENIED";
+        throw err;
+      }
+    }
+    const result = await provider.start(context, payload);
+    return {
+      provider: provider.descriptor.provider,
+      dispatched: Boolean(provider.descriptor.commandType),
+      result
+    };
+  }
+  clear() {
+    this.providers.clear();
+  }
+};
+
+// packages/activity-ecosystem/default-providers.ts
+var OFFICIAL_PROVIDER = "official";
+function aiActionFor(d) {
+  return {
+    id: `activity_ai_${d.id}`,
+    commandType: d.commandType ?? `activity.${d.id}.start`,
+    description: `Start the ${d.name} activity${d.description ? ` \u2014 ${d.description}` : ""}`,
+    inputSchema: {
+      type: "OBJECT",
+      properties: {
+        payload: {
+          type: "OBJECT",
+          description: `Optional configuration for the ${d.name} activity`
+        }
+      }
+    },
+    capabilityRequired: d.permissions?.[0] ?? "lesson:read"
+  };
+}
+var OFFICIAL_ACTIVITY_DEFINITIONS = [
+  {
+    id: "official_quiz",
+    name: "Quiz",
+    description: "In-class multiple choice / graded quiz.",
+    icon: "HelpCircle",
+    category: "assessment",
+    permissions: ["quiz:write"],
+    supportedRoles: ["teacher", "student", "all"],
+    supportedDevices: ["desktop", "tablet", "all"],
+    tags: ["assessment", "quiz"],
+    version: "1.0.0",
+    provider: OFFICIAL_PROVIDER,
+    commandType: "quiz.create"
+  },
+  {
+    id: "official_vote",
+    name: "Vote",
+    description: "Quick classroom vote / poll on a question.",
+    icon: "Vote",
+    category: "engagement",
+    permissions: ["lesson:control"],
+    supportedRoles: ["teacher", "student", "all"],
+    supportedDevices: ["desktop", "tablet", "mobile", "all"],
+    tags: ["engagement", "vote", "poll"],
+    version: "1.0.0",
+    provider: OFFICIAL_PROVIDER,
+    commandType: "vote.create"
+  },
+  {
+    id: "official_poll",
+    name: "Poll",
+    description: "Live polling with instant results.",
+    icon: "BarChart3",
+    category: "engagement",
+    permissions: ["lesson:control"],
+    supportedRoles: ["teacher", "student", "all"],
+    supportedDevices: ["desktop", "tablet", "mobile", "all"],
+    tags: ["engagement", "poll"],
+    version: "1.0.0",
+    provider: OFFICIAL_PROVIDER,
+    commandType: "poll.create"
+  },
+  {
+    id: "official_discussion",
+    name: "Discussion",
+    description: "Whole-class or group real-time discussion thread.",
+    icon: "MessagesSquare",
+    category: "collaboration",
+    permissions: ["lesson:control"],
+    supportedRoles: ["teacher", "student", "all"],
+    supportedDevices: ["desktop", "tablet", "all"],
+    tags: ["collaboration", "discussion"],
+    version: "1.0.0",
+    provider: OFFICIAL_PROVIDER,
+    commandType: "discussion.create"
+  },
+  {
+    id: "official_grouping",
+    name: "Grouping",
+    description: "Auto / random / manual student grouping.",
+    icon: "Users",
+    category: "collaboration",
+    permissions: ["lesson:control"],
+    supportedRoles: ["teacher"],
+    supportedDevices: ["desktop", "all"],
+    tags: ["collaboration", "group"],
+    version: "1.0.0",
+    provider: OFFICIAL_PROVIDER,
+    commandType: "grouping.create"
+  },
+  {
+    id: "official_assignment",
+    name: "Assignment",
+    description: "Create, submit and grade student assignments / homework.",
+    icon: "FileText",
+    category: "management",
+    permissions: ["management:write"],
+    supportedRoles: ["teacher", "student", "all"],
+    supportedDevices: ["desktop", "tablet", "all"],
+    tags: ["management", "assignment", "homework"],
+    version: "1.0.0",
+    provider: OFFICIAL_PROVIDER,
+    commandType: "assignment.create"
+  },
+  {
+    id: "official_competition",
+    name: "Competition",
+    description: "Timed leaderboard competition between students / groups.",
+    icon: "Trophy",
+    category: "engagement",
+    permissions: ["lesson:control"],
+    supportedRoles: ["teacher", "student", "all"],
+    supportedDevices: ["desktop", "tablet", "mobile", "all"],
+    tags: ["engagement", "competition", "gamification"],
+    version: "1.0.0",
+    provider: OFFICIAL_PROVIDER,
+    commandType: "competition.create"
+  },
+  {
+    id: "official_checkin",
+    name: "Check-in",
+    description: "Take class attendance / check-in.",
+    icon: "CheckCircle2",
+    category: "management",
+    permissions: ["management:write"],
+    supportedRoles: ["teacher"],
+    supportedDevices: ["desktop", "tablet", "mobile", "all"],
+    tags: ["management", "attendance", "checkin"],
+    version: "1.0.0",
+    provider: OFFICIAL_PROVIDER,
+    commandType: "attendance.record"
+  },
+  {
+    id: "official_homework",
+    name: "Homework",
+    description: "Assign and track out-of-class homework.",
+    icon: "BookOpen",
+    category: "management",
+    permissions: ["management:write"],
+    supportedRoles: ["teacher", "student", "all"],
+    supportedDevices: ["desktop", "tablet", "all"],
+    tags: ["management", "homework", "assignment"],
+    version: "1.0.0",
+    provider: OFFICIAL_PROVIDER,
+    commandType: "assignment.create"
+  }
+];
+function registerOfficialActivities(registry, actionRegistry) {
+  for (const def of OFFICIAL_ACTIVITY_DEFINITIONS) {
+    const descriptor = {
+      ...def,
+      aiAction: aiActionFor(def)
+    };
+    registry.registerProvider(new BaseActivityProvider({ descriptor }));
+    if (actionRegistry && descriptor.aiAction) {
+      actionRegistry.register(descriptor.aiAction);
+    }
+  }
+}
+
+// packages/activity-ecosystem/index.ts
+var IActivityRegistryToken = new Token(
+  "@openlearn/activity-ecosystem:IActivityRegistry"
+);
+
+// server/routes/os.ts
+var import_path8 = __toESM(require("path"), 1);
+var import_fs8 = __toESM(require("fs"), 1);
+var import_child_process = require("child_process");
+var import_crypto7 = __toESM(require("crypto"), 1);
+var import_xss = require("xss");
+
+// server/utils/crypto.ts
+var import_crypto5 = __toESM(require("crypto"), 1);
+var import_fs7 = __toESM(require("fs"), 1);
+var import_path6 = __toESM(require("path"), 1);
+var _encryptionKey = null;
+function getEncryptionKey() {
+  if (_encryptionKey) return _encryptionKey;
+  const envPath = import_path6.default.resolve(process.cwd(), ".env");
+  const keyHex = process.env.ENCRYPTION_KEY;
+  if (keyHex && keyHex.trim() !== "") {
+    _encryptionKey = Buffer.from(keyHex.trim(), "hex");
+    return _encryptionKey;
+  }
+  if (import_fs7.default.existsSync(envPath)) {
+    try {
+      const content = import_fs7.default.readFileSync(envPath, "utf-8");
+      const match = content.match(/^ENCRYPTION_KEY=(.+)$/m);
+      if (match && match[1].trim() !== "") {
+        const fileKeyHex = match[1].trim();
+        _encryptionKey = Buffer.from(fileKeyHex, "hex");
+        process.env.ENCRYPTION_KEY = fileKeyHex;
+        console.log("[Crypto] ENCRYPTION_KEY loaded from .env file");
+        return _encryptionKey;
+      }
+    } catch {
+    }
+  }
+  const newKey = import_crypto5.default.randomBytes(32).toString("hex");
+  try {
+    if (import_fs7.default.existsSync(envPath)) {
+      let content = import_fs7.default.readFileSync(envPath, "utf-8");
+      if (/^ENCRYPTION_KEY=/m.test(content)) {
+        content = content.replace(/^ENCRYPTION_KEY=.*$/m, `ENCRYPTION_KEY=${newKey}`);
+        import_fs7.default.writeFileSync(envPath, content);
+        console.log("[Crypto] ENCRYPTION_KEY replaced in .env (was empty or invalid)");
+      } else {
+        import_fs7.default.appendFileSync(envPath, `
+ENCRYPTION_KEY=${newKey}
+`);
+        console.log("[Crypto] ENCRYPTION_KEY auto-generated and persisted to .env");
+      }
+    } else {
+      import_fs7.default.writeFileSync(envPath, `ENCRYPTION_KEY=${newKey}
+`);
+      console.log("[Crypto] .env created with auto-generated ENCRYPTION_KEY");
+    }
+  } catch (e) {
+    console.warn("[Crypto] Could not persist ENCRYPTION_KEY, using in-memory fallback");
+  }
+  process.env.ENCRYPTION_KEY = newKey;
+  _encryptionKey = Buffer.from(newKey, "hex");
+  return _encryptionKey;
+}
+function encryptApiKey(plaintext) {
+  if (!plaintext) return "";
+  const key = getEncryptionKey();
+  const iv = import_crypto5.default.randomBytes(16);
+  const cipher = import_crypto5.default.createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
+}
+function decryptApiKey(encrypted) {
+  if (!encrypted) return "";
+  const parts = encrypted.split(":");
+  if (parts.length !== 3) return encrypted;
+  try {
+    const key = getEncryptionKey();
+    const iv = Buffer.from(parts[0], "hex");
+    const authTag = Buffer.from(parts[1], "hex");
+    const ciphertext = Buffer.from(parts[2], "hex");
+    const decipher = import_crypto5.default.createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(authTag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf-8");
+  } catch {
+    console.warn("[Crypto] Failed to decrypt API key, treating as plaintext");
+    return encrypted;
+  }
+}
+function maskApiKey(key) {
+  if (!key || key.length <= 8) return key ? "****" : "";
+  return key.substring(0, 4) + "****" + key.substring(key.length - 4);
+}
+var PROMPT_INJECTION_PATTERNS = [
+  /ignore\s+(all\s+)?(previous|prior|above|system)\s+(instructions?|prompts?|directives?)/i,
+  /you\s+are\s+now\s+(a\s+)?(different|new|another)/i,
+  /forget\s+(all\s+)?(your|the)\s+(training|instructions?|rules?)/i,
+  /system\s*(prompt|message|instruction):\s*/i,
+  /<\|im_start\|>/i,
+  /<\|im_end\|>/i
+];
+function detectPromptInjection(input) {
+  return PROMPT_INJECTION_PATTERNS.some((p) => p.test(input));
+}
+
+// server/middleware/auth.ts
+function getValidSession(token) {
+  let sessionRow;
+  try {
+    sessionRow = kernelContainer.db.prepare("SELECT * FROM client_sessions WHERE id = ?").get(token);
+  } catch {
+    return null;
+  }
+  if (!sessionRow) return null;
+  const now = Date.now();
+  if (sessionRow.expires_at && sessionRow.expires_at < now) {
+    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
+    return null;
+  }
+  const idleTimeout = 24 * 60 * 60 * 1e3;
+  if (sessionRow.updated_at && now - sessionRow.updated_at > idleTimeout) {
+    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
+    return null;
+  }
+  kernelContainer.db.prepare("UPDATE client_sessions SET updated_at = ? WHERE id = ?").run(now, token);
+  return JSON.parse(sessionRow.session_data);
+}
+function getCookieToken(req) {
+  const rc = req.headers.cookie;
+  if (!rc) return null;
+  const parts = rc.split(";");
+  for (const part of parts) {
+    const trimmed = part.trim();
+    if (trimmed.startsWith("edu_os_token=")) {
+      return trimmed.substring("edu_os_token=".length);
+    }
+  }
+  return null;
+}
+function getActorId(req) {
+  const token = getCookieToken(req);
+  if (!token) return "user-frontend";
+  try {
+    const session = getValidSession(token);
+    if (!session) return "user-frontend";
+    let role = session.subRole || session.role;
+    if (session.username === "admin" || session.userId === "usr_admin" || role === "admin" || role === "administrator") {
+      role = "administrator";
+    }
+    if (role) {
+      return `user:${session.userId || "demo"}:${role}`;
+    }
+    return "user-frontend";
+  } catch {
+    return "user-frontend";
+  }
+}
+function checkIsTeacherOrAdmin(req) {
+  const token = getCookieToken(req);
+  if (!token) return false;
+  try {
+    const session = getValidSession(token);
+    if (!session) return false;
+    return session.role === "teacher" || session.role === "administrator";
+  } catch {
+    return false;
+  }
+}
+
+// server/routes/shared.ts
+var import_path7 = __toESM(require("path"), 1);
+var import_crypto6 = __toESM(require("crypto"), 1);
+
+// server/utils/bridge-sdk.ts
+var BRIDGE_SDK_CODE = `(function() {
+  // Mock document.cookie to prevent SecurityError in sandboxed iframes lacking 'allow-same-origin'
+  try {
+    Object.defineProperty(document, 'cookie', {
+      get: function() { return ""; },
+      set: function(val) {},
+      configurable: true
+    });
+  } catch (e) {
+    try {
+      Object.defineProperty(Document.prototype, 'cookie', {
+        get: function() { return ""; },
+        set: function(val) {},
+        configurable: true
+      });
+    } catch (err) {}
+  }
+
+  // Proxy postMessage calls to enrich them with attempt_id/uuid and normalize targetOrigin
+  try {
+    const originalPostMessage = window.postMessage;
+    window.postMessage = function(message, targetOrigin, transfer) {
+      try {
+        if (message && typeof message === 'object') {
+          if (!message.attempt_id && window.__LMS_STUDENT__?.attempt_id) {
+            message.attempt_id = window.__LMS_STUDENT__.attempt_id;
+          }
+          if (!message.uuid && window.__LMS_COURSEWARE__?.uuid) {
+            message.uuid = window.__LMS_COURSEWARE__.uuid;
+          }
+        }
+      } catch (e) {}
+      
+      let origin = targetOrigin;
+      if (origin === 'null') {
+        origin = '*';
+      }
+      try {
+        return originalPostMessage.call(this, message, origin, transfer);
+      } catch (err) {
+        if (err.name === 'SyntaxError' && origin !== '*') {
+          return originalPostMessage.call(this, message, '*', transfer);
+        }
+        throw err;
+      }
+    };
+
+    if (window.parent && window.parent !== window) {
       const parentPostMessage = window.parent.postMessage;
       try {
         window.parent.postMessage = function(message, targetOrigin, transfer) {
@@ -18264,7 +18909,7 @@ function injectLmsSdk(htmlContent, req, cwInfo) {
         const classRow = kernelContainer.db.prepare("SELECT class_id FROM class_students WHERE student_id = ? LIMIT 1").get(session.studentId);
         let attempt = kernelContainer.db.prepare("SELECT id FROM courseware_attempt WHERE courseware_id = ? AND student_id = ? AND status = ?").get(cwInfo.id, session.studentId, "active");
         if (!attempt) {
-          const attemptId = "att_" + import_crypto5.default.randomBytes(8).toString("hex");
+          const attemptId = "att_" + import_crypto6.default.randomBytes(8).toString("hex");
           kernelContainer.db.prepare("INSERT INTO courseware_attempt (id, courseware_id, student_id, started_at, status) VALUES (?, ?, ?, ?, ?)").run(attemptId, cwInfo.id, session.studentId, Date.now(), "active");
           attempt = { id: attemptId };
         }
@@ -18277,7 +18922,7 @@ function injectLmsSdk(htmlContent, req, cwInfo) {
       } else if (session.role === "teacher" || session.role === "administrator") {
         let attempt = kernelContainer.db.prepare("SELECT id FROM courseware_attempt WHERE courseware_id = ? AND student_id = ? AND status = ?").get(cwInfo.id, "teacher", "active");
         if (!attempt) {
-          const attemptId = "att_teacher_" + import_crypto5.default.randomBytes(8).toString("hex");
+          const attemptId = "att_teacher_" + import_crypto6.default.randomBytes(8).toString("hex");
           kernelContainer.db.prepare("INSERT INTO courseware_attempt (id, courseware_id, student_id, started_at, status) VALUES (?, ?, ?, ?, ?)").run(attemptId, cwInfo.id, "teacher", Date.now(), "active");
           attempt = { id: attemptId };
         }
@@ -18293,7 +18938,7 @@ function injectLmsSdk(htmlContent, req, cwInfo) {
   if (studentInfo.attempt_id === "guest-attempt") {
     let attempt = kernelContainer.db.prepare("SELECT id FROM courseware_attempt WHERE courseware_id = ? AND student_id = ? AND status = ?").get(cwInfo.id, "guest", "active");
     if (!attempt) {
-      const attemptId = "att_guest_" + import_crypto5.default.randomBytes(8).toString("hex");
+      const attemptId = "att_guest_" + import_crypto6.default.randomBytes(8).toString("hex");
       kernelContainer.db.prepare("INSERT INTO courseware_attempt (id, courseware_id, student_id, started_at, status) VALUES (?, ?, ?, ?, ?)").run(attemptId, cwInfo.id, "guest", Date.now(), "active");
       attempt = { id: attemptId };
     }
@@ -18381,7 +19026,7 @@ function registerOsRoutes(ctx) {
       if (!import_fs8.default.existsSync(uploadsDir)) {
         import_fs8.default.mkdirSync(uploadsDir, { recursive: true });
       }
-      const uniqueName = `${Date.now()}-${import_crypto6.default.randomBytes(4).toString("hex")}${ext}`;
+      const uniqueName = `${Date.now()}-${import_crypto7.default.randomBytes(4).toString("hex")}${ext}`;
       const filePath = import_path8.default.join(uploadsDir, uniqueName);
       import_fs8.default.writeFileSync(filePath, fileBuffer);
       let slideCount = 1;
@@ -18591,8 +19236,8 @@ function registerOsRoutes(ctx) {
       const result = provider ? await runOpenAIAgentChat2(provider, { message, lang, currentLessonId, attachments, callerRole, history }) : await runGeminiAgentChat2({ message, lang, currentLessonId, attachments, callerRole, history });
       if (result && typeof result.agentText === "string") {
         const now = Date.now();
-        kernelContainer.db.prepare("INSERT INTO agent_conversations (id, conv_key, role, content, created_at) VALUES (?, ?, ?, ?, ?)").run("ac_" + import_crypto6.default.randomUUID(), convKey, "user", message, now);
-        kernelContainer.db.prepare("INSERT INTO agent_conversations (id, conv_key, role, content, created_at) VALUES (?, ?, ?, ?, ?)").run("ac_" + import_crypto6.default.randomUUID(), convKey, "assistant", result.agentText, now + 1);
+        kernelContainer.db.prepare("INSERT INTO agent_conversations (id, conv_key, role, content, created_at) VALUES (?, ?, ?, ?, ?)").run("ac_" + import_crypto7.default.randomUUID(), convKey, "user", message, now);
+        kernelContainer.db.prepare("INSERT INTO agent_conversations (id, conv_key, role, content, created_at) VALUES (?, ?, ?, ?, ?)").run("ac_" + import_crypto7.default.randomUUID(), convKey, "assistant", result.agentText, now + 1);
       }
       res.json({
         success: true,
@@ -18934,7 +19579,7 @@ function registerResourcesRoutes(ctx) {
 // server/routes/courseware.ts
 var import_path9 = __toESM(require("path"), 1);
 var import_fs9 = __toESM(require("fs"), 1);
-var import_crypto8 = __toESM(require("crypto"), 1);
+var import_crypto9 = __toESM(require("crypto"), 1);
 function registerCoursewareRoutes(ctx) {
   const {
     app,
@@ -19079,7 +19724,7 @@ function registerCoursewareRoutes(ctx) {
     try {
       const { attemptId } = req.params;
       const { eventType, payload } = req.body;
-      const rawId = "raw_" + import_crypto8.default.randomBytes(8).toString("hex");
+      const rawId = "raw_" + import_crypto9.default.randomBytes(8).toString("hex");
       kernelContainer.db.prepare(
         "INSERT INTO submission_raw (id, attempt_id, event_type, payload_json, created_at) VALUES (?, ?, ?, ?, ?)"
       ).run(rawId, attemptId, eventType, JSON.stringify(payload), Date.now());
@@ -19107,7 +19752,7 @@ function registerCoursewareRoutes(ctx) {
           kernelContainer.db.prepare(
             "INSERT INTO submission_result (id, attempt_id, score, comment, completion, extra_json) VALUES (?, ?, ?, ?, ?, ?)"
           ).run(
-            "res_" + import_crypto8.default.randomBytes(8).toString("hex"),
+            "res_" + import_crypto9.default.randomBytes(8).toString("hex"),
             attemptId,
             parsedScore,
             comment || null,
@@ -19258,7 +19903,7 @@ function registerCoursewareRoutes(ctx) {
       ).get(classId, lessonId, assignmentTitle);
       let assignmentId = assignment?.id;
       if (!assignmentId) {
-        assignmentId = "ast-cw-" + import_crypto8.default.randomBytes(8).toString("hex");
+        assignmentId = "ast-cw-" + import_crypto9.default.randomBytes(8).toString("hex");
         kernelContainer.db.prepare(
           "INSERT INTO assignments (id, class_id, lesson_id, title, description, content, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)"
         ).run(
@@ -19415,7 +20060,7 @@ function registerBridgeRoutes(ctx) {
 }
 
 // server/routes/lessons.ts
-var import_genai2 = require("@google/genai");
+var import_genai3 = require("@google/genai");
 function registerLessonsRoutes(ctx) {
   const {
     app,
@@ -19796,7 +20441,7 @@ function registerLessonsRoutes(ctx) {
   app.post("/api/lessons/:id/ai-tutor", async (req, res) => {
     try {
       const { elements } = req.body;
-      const ai = new import_genai2.GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });
+      const ai = new import_genai3.GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });
       const elementsSummary = elements.map((e, i) => `Element ${i + 1}: type=${e.type}, content=${JSON.stringify(e.data)}`).join("\n");
       const prompt = `You are a real-time AI Tutor monitoring a student's interactive whiteboard.
 The student has pressed the "Ask AI" button for help.
@@ -20226,7 +20871,7 @@ function registerAdminRoutes(ctx) {
 // server/routes/roster.ts
 var import_path12 = __toESM(require("path"), 1);
 var import_fs11 = __toESM(require("fs"), 1);
-var import_crypto9 = __toESM(require("crypto"), 1);
+var import_crypto10 = __toESM(require("crypto"), 1);
 var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
 function registerRosterRoutes(ctx) {
   const {
@@ -20486,7 +21131,7 @@ function registerRosterRoutes(ctx) {
         if (storedPwd.startsWith("$2")) {
           matches = import_bcryptjs2.default.compareSync(oldPassword, storedPwd);
         } else if (/^[a-f0-9]{64}$/.test(storedPwd)) {
-          matches = import_crypto9.default.createHash("sha256").update(oldPassword).digest("hex") === storedPwd;
+          matches = import_crypto10.default.createHash("sha256").update(oldPassword).digest("hex") === storedPwd;
         } else {
           matches = storedPwd === oldPassword;
         }
@@ -20558,7 +21203,7 @@ function registerRosterRoutes(ctx) {
       }
       const avatarDir = import_path12.default.join(process.cwd(), "uploads", "avatars");
       import_fs11.default.mkdirSync(avatarDir, { recursive: true });
-      const uniqueName = `${Date.now()}-${import_crypto9.default.randomBytes(4).toString("hex")}${ext}`;
+      const uniqueName = `${Date.now()}-${import_crypto10.default.randomBytes(4).toString("hex")}${ext}`;
       const filePath = import_path12.default.join(avatarDir, uniqueName);
       import_fs11.default.writeFileSync(filePath, fileBuffer);
       const avatarUrl = `/uploads/avatars/${uniqueName}`;
@@ -20677,7 +21322,7 @@ function registerRosterRoutes(ctx) {
         if (storedPwd.startsWith("$2")) {
           matchesOwnPassword = import_bcryptjs2.default.compareSync(providedPassword, storedPwd);
         } else if (/^[a-f0-9]{64}$/.test(storedPwd)) {
-          const sha256Hash = import_crypto9.default.createHash("sha256").update(providedPassword).digest("hex");
+          const sha256Hash = import_crypto10.default.createHash("sha256").update(providedPassword).digest("hex");
           if (sha256Hash === storedPwd) {
             matchesOwnPassword = true;
             kernelContainer.db.prepare("UPDATE students SET password = ? WHERE id = ?").run(hashPassword(providedPassword), studentObj.id);
@@ -20716,7 +21361,7 @@ function registerRosterRoutes(ctx) {
         };
       }
       if (sessionData) {
-        const sessionToken = "token_" + import_crypto9.default.randomBytes(16).toString("hex");
+        const sessionToken = "token_" + import_crypto10.default.randomBytes(16).toString("hex");
         const now = Date.now();
         const expiresAt = now + 7 * 24 * 60 * 60 * 1e3;
         kernelContainer.db.prepare("INSERT INTO client_sessions (id, session_data, updated_at, expires_at) VALUES (?, ?, ?, ?)").run(sessionToken, JSON.stringify(sessionData), now, expiresAt);
@@ -21295,7 +21940,7 @@ function registerRosterRoutes(ctx) {
 }
 
 // server/routes/assignments.ts
-var import_genai3 = require("@google/genai");
+var import_genai4 = require("@google/genai");
 function registerAssignmentsRoutes(ctx) {
   const {
     app,
@@ -21323,7 +21968,7 @@ function registerAssignmentsRoutes(ctx) {
   app.post("/api/classes/:classId/assignments/generate", async (req, res) => {
     try {
       const { topic, lessonId } = req.body;
-      const ai = new import_genai3.GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });
+      const ai = new import_genai4.GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });
       const prompt = `You are an expert teacher. Generate a short 1-question quiz or assignment about "${topic}". Output in this JSON format: {"title": "...", "description": "...", "content": "..."} without markdown blocks.`;
       const response = await ai.models.generateContent({ model: "gemini-3.5-flash", contents: prompt });
       const text = response.text || "{}";
@@ -21355,7 +22000,7 @@ function registerAssignmentsRoutes(ctx) {
       if (!lesson) {
         return res.status(404).json({ error: "Lesson not found" });
       }
-      const ai = new import_genai3.GoogleGenAI({
+      const ai = new import_genai4.GoogleGenAI({
         apiKey: process.env.GEMINI_API_KEY,
         httpOptions: {
           headers: {
@@ -21380,26 +22025,26 @@ Generate the response in the specified JSON schema.`;
         config: {
           responseMimeType: "application/json",
           responseSchema: {
-            type: import_genai3.Type.OBJECT,
+            type: import_genai4.Type.OBJECT,
             properties: {
               learningObjectives: {
-                type: import_genai3.Type.ARRAY,
-                items: { type: import_genai3.Type.STRING },
+                type: import_genai4.Type.ARRAY,
+                items: { type: import_genai4.Type.STRING },
                 description: "List of identified key learning objectives for the lesson"
               },
               questions: {
-                type: import_genai3.Type.ARRAY,
+                type: import_genai4.Type.ARRAY,
                 items: {
-                  type: import_genai3.Type.OBJECT,
+                  type: import_genai4.Type.OBJECT,
                   properties: {
-                    objective: { type: import_genai3.Type.STRING, description: "The specific learning objective tested by this question" },
-                    question: { type: import_genai3.Type.STRING, description: "The multiple-choice question text" },
+                    objective: { type: import_genai4.Type.STRING, description: "The specific learning objective tested by this question" },
+                    question: { type: import_genai4.Type.STRING, description: "The multiple-choice question text" },
                     options: {
-                      type: import_genai3.Type.ARRAY,
-                      items: { type: import_genai3.Type.STRING },
+                      type: import_genai4.Type.ARRAY,
+                      items: { type: import_genai4.Type.STRING },
                       description: "Exactly 4 options, including letter prefix like 'A) ...', 'B) ...'"
                     },
-                    correctAnswer: { type: import_genai3.Type.STRING, description: "The correct option (must exactly match one of the string options in the options array)" }
+                    correctAnswer: { type: import_genai4.Type.STRING, description: "The correct option (must exactly match one of the string options in the options array)" }
                   },
                   required: ["objective", "question", "options", "correctAnswer"]
                 }
@@ -21471,7 +22116,7 @@ Generate the response in the specified JSON schema.`;
       const asb = kernelContainer.db.prepare("SELECT * FROM assignment_submissions WHERE assignment_id = ? AND student_id = ?").get(req.params.id, req.params.studentId);
       const ast = kernelContainer.db.prepare("SELECT * FROM assignments WHERE id = ?").get(req.params.id);
       if (!asb || !ast) throw new Error("Submission or assignment not found");
-      const ai = new import_genai3.GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });
+      const ai = new import_genai4.GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });
       let grade = { score: 0, feedback: "" };
       let isMcqQuiz = false;
       let autoScore = null;
@@ -21554,7 +22199,7 @@ Provide a grade score (0-100) and brief feedback. Ensure you output in this exac
 }
 
 // server/routes/schedules.ts
-var import_genai4 = require("@google/genai");
+var import_genai5 = require("@google/genai");
 function registerSchedulesRoutes(ctx) {
   const {
     app,
@@ -21841,7 +22486,7 @@ function registerSchedulesRoutes(ctx) {
           console.warn(`[OCR Error] GEMINI_API_KEY is not configured`);
           return res.status(500).json({ error: lang === "zh" ? "\u672A\u914D\uFFFD? AI \u670D\u52A1\u3002\u8BF7\u5728\u7CFB\u7EDF\u8BBE\u7F6E\u4E2D\u6DFB\u52A0 AI Provider \u6216\u914D\uFFFD? GEMINI_API_KEY\uFFFD?" : "No AI provider configured. Please add an AI Provider in settings or set GEMINI_API_KEY." });
         }
-        const ai = new import_genai4.GoogleGenAI({ apiKey: geminiKey });
+        const ai = new import_genai5.GoogleGenAI({ apiKey: geminiKey });
         const response = await ai.models.generateContent({
           model: "gemini-2.5-flash",
           contents: [{
@@ -21886,7 +22531,7 @@ function registerSchedulesRoutes(ctx) {
 
 // server/routes/grading.ts
 init_interfaces();
-var import_genai5 = require("@google/genai");
+var import_genai6 = require("@google/genai");
 function registerGradingRoutes(ctx) {
   const {
     app,
@@ -22454,7 +23099,7 @@ ${examsText}
         if (!geminiKey) {
           return res.status(500).json({ error: "AI provider is not configured and GEMINI_API_KEY is missing." });
         }
-        const ai = new import_genai5.GoogleGenAI({ apiKey: geminiKey });
+        const ai = new import_genai6.GoogleGenAI({ apiKey: geminiKey });
         const response = await ai.models.generateContent({
           model: "gemini-2.5-flash",
           contents: [{ role: "user", parts: [{ text: prompt }] }],
@@ -22809,798 +23454,411 @@ function registerPluginsRoutes(ctx) {
         const zipPath = import_path13.default.resolve(process.cwd(), "v2_plugins/research-workflow/aymwoo-plugin-research-workflow.zip");
         if (import_fs12.default.existsSync(zipPath)) {
           zipBuffer = import_fs12.default.readFileSync(zipPath);
-        } else {
-          return res.status(404).json({ success: false, error: "\u672A\u627E\u5230\u66F4\u65B0\u5B89\u88C5\u5305" });
-        }
-      }
-      const result = await kernelContainer.pluginDistributionManager.updateFromZip(zipBuffer, {
-        targetPluginId,
-        allowDowngrade: false
-      });
-      res.json({
-        success: true,
-        updated: true,
-        pluginId: result.pluginId,
-        manifest: result.manifest,
-        oldVersion: result.oldVersion,
-        newVersion: result.newVersion || "1.2.0",
-        wasActive: result.wasActive
-      });
-    } catch (err) {
-      console.error(err);
-      res.status(500).json({ success: false, error: err.message });
-    }
-  });
-  app.get("/api/plugins/:id(*)/contributions", (req, res) => {
-    try {
-      const rawId = decodeURIComponent(req.params.id);
-      const summary = kernelContainer.pluginHost.listContributions(rawId);
-      res.json({ success: true, result: summary });
-    } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
-    }
-  });
-  app.get("/api/plugins/:id(*)/config", (req, res) => {
-    try {
-      const rawId = decodeURIComponent(req.params.id);
-      const pluginId = kernelContainer.pluginHost.resolvePluginUuid(rawId);
-      const row = kernelContainer.db.prepare("SELECT manifest FROM plugins WHERE id = ?").get(pluginId);
-      if (!row) {
-        return res.status(404).json({ success: false, error: "Plugin not found" });
-      }
-      const manifest = JSON.parse(row.manifest);
-      res.json({
-        success: true,
-        result: {
-          schema: manifest.configuration?.properties ?? {},
-          values: kernelContainer.pluginHost.getPluginConfig(pluginId, manifest)
-        }
-      });
-    } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
-    }
-  });
-  app.post("/api/plugins/:id(*)/config", (req, res) => {
-    try {
-      const rawId = decodeURIComponent(req.params.id);
-      const pluginId = kernelContainer.pluginHost.resolvePluginUuid(rawId);
-      const updates = req.body;
-      if (!updates || typeof updates !== "object") {
-        return res.status(400).json({ success: false, error: "Body must be an object of key-value pairs" });
-      }
-      const row = kernelContainer.db.prepare("SELECT manifest FROM plugins WHERE id = ?").get(pluginId);
-      if (!row) {
-        return res.status(404).json({ success: false, error: "Plugin not found" });
-      }
-      const manifest = JSON.parse(row.manifest);
-      kernelContainer.pluginHost.setPluginConfig(pluginId, manifest, updates);
-      res.json({ success: true });
-    } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
-    }
-  });
-  app.post("/api/plugins/:id(*)/toggle", async (req, res) => {
-    try {
-      const rawId = decodeURIComponent(req.params.id);
-      const cmd = kernelContainer.commandBus.createCommand(
-        "plugin.toggle",
-        { pluginId: rawId },
-        getActorId(req)
-      );
-      const result = await kernelContainer.commandBus.execute(cmd);
-      res.json(result);
-    } catch (err) {
-      res.status(500).json({ success: false, error: err.message });
-    }
-  });
-  app.delete("/api/plugins/:id(*)", async (req, res) => {
-    try {
-      const rawId = decodeURIComponent(req.params.id);
-      const cmd = kernelContainer.commandBus.createCommand(
-        "plugin.uninstall",
-        { pluginId: rawId },
-        getActorId(req)
-      );
-      const result = await kernelContainer.commandBus.execute(cmd);
-      res.json(result);
-    } catch (err) {
-      res.status(500).json({ success: false, error: err.message });
-    }
-  });
-  app.get("/api/plugins/:id(*)", async (req, res) => {
-    try {
-      const rawId = decodeURIComponent(req.params.id);
-      const cmd = kernelContainer.commandBus.createCommand(
-        "plugin.info",
-        { pluginId: rawId },
-        getActorId(req)
-      );
-      const result = await kernelContainer.commandBus.execute(cmd);
-      res.json(result);
-    } catch (err) {
-      res.status(404).json({ success: false, error: err.message });
-    }
-  });
-  app.post("/api/plugins", async (req, res) => {
-    try {
-      const { sourceCode } = req.body;
-      const cmd = kernelContainer.commandBus.createCommand(
-        "plugin.install",
-        { sourceCode },
-        getActorId(req)
-      );
-      const result = await kernelContainer.commandBus.execute(cmd);
-      res.json(result);
-    } catch (err) {
-      console.error(err);
-      res.status(500).json({ success: false, error: err.message });
-    }
-  });
-  app.post("/api/plugins/upload-zip", async (req, res) => {
-    try {
-      const { base64Data, filename, executionMode } = req.body;
-      const cmd = kernelContainer.commandBus.createCommand(
-        "plugin.install_zip",
-        { base64Data, filename, executionMode },
-        getActorId(req)
-      );
-      const result = await kernelContainer.commandBus.execute(cmd);
-      res.json(result);
-    } catch (err) {
-      console.error(err);
-      res.status(500).json({ success: false, error: err.message });
-    }
-  });
-  app.post("/api/plugins/upload-zip-raw", import_express2.default.raw({ type: "application/octet-stream", limit: "400mb" }), async (req, res) => {
-    try {
-      const zipBuffer = req.body;
-      const filename = req.headers["x-filename"] ? decodeURIComponent(req.headers["x-filename"]) : "plugin.zip";
-      const executionModeHeader = String(req.headers["x-execution-mode"] || "").toLowerCase();
-      const executionMode = executionModeHeader === "worker" || executionModeHeader === "inline" ? executionModeHeader : void 0;
-      const modeHeader = String(req.headers["x-install-mode"] || "install").toLowerCase();
-      const allowDowngrade = String(req.headers["x-allow-downgrade"] || "").toLowerCase() === "true";
-      const targetPluginId = req.headers["x-target-plugin-id"] ? decodeURIComponent(String(req.headers["x-target-plugin-id"])) : void 0;
-      if (!Buffer.isBuffer(zipBuffer) || zipBuffer.length === 0) {
-        return res.status(400).json({ success: false, error: "Empty or invalid zip file" });
-      }
-      if (modeHeader === "update") {
-        const result2 = await kernelContainer.pluginDistributionManager.updateFromZip(zipBuffer, {
-          targetPluginId,
-          executionMode,
-          allowDowngrade
-        });
-        return res.json({
-          success: true,
-          updated: true,
-          pluginId: result2.pluginId,
-          manifest: result2.manifest,
-          oldVersion: result2.oldVersion,
-          newVersion: result2.newVersion,
-          wasActive: result2.wasActive,
-          filename
-        });
-      }
-      const result = await kernelContainer.pluginDistributionManager.installFromZip(zipBuffer, executionMode);
-      res.json({
-        success: true,
-        updated: false,
-        pluginId: result.pluginId,
-        manifest: result.manifest,
-        filename
-      });
-    } catch (err) {
-      console.error(err);
-      res.status(500).json({ success: false, error: err.message });
-    }
-  });
-  app.post(
-    "/api/plugins/:id(*)/update-zip-raw",
-    import_express2.default.raw({ type: "application/octet-stream", limit: "400mb" }),
-    async (req, res) => {
-      try {
-        const targetPluginId = decodeURIComponent(req.params.id);
-        const zipBuffer = req.body;
-        const executionModeHeader = String(req.headers["x-execution-mode"] || "").toLowerCase();
-        const executionMode = executionModeHeader === "worker" || executionModeHeader === "inline" ? executionModeHeader : void 0;
-        const allowDowngrade = String(req.headers["x-allow-downgrade"] || "").toLowerCase() === "true";
-        if (!Buffer.isBuffer(zipBuffer) || zipBuffer.length === 0) {
-          return res.status(400).json({ success: false, error: "Empty or invalid zip file" });
-        }
-        const result = await kernelContainer.pluginDistributionManager.updateFromZip(zipBuffer, {
-          targetPluginId,
-          executionMode,
-          allowDowngrade
-        });
-        res.json({
-          success: true,
-          updated: true,
-          pluginId: result.pluginId,
-          manifest: result.manifest,
-          oldVersion: result.oldVersion,
-          newVersion: result.newVersion,
-          wasActive: result.wasActive
-        });
-      } catch (err) {
-        console.error(err);
-        res.status(500).json({ success: false, error: err.message });
-      }
-    }
-  );
-  app.post("/api/plugins/execute-command", async (req, res) => {
-    try {
-      const { type, payload } = req.body;
-      if (!type) {
-        return res.status(400).json({ success: false, error: "Missing command type" });
-      }
-      let resolvedType = type;
-      const bus = kernelContainer.commandBus;
-      const handlersMap = bus.handlers;
-      const legacyMap = bus.legacyHandlers;
-      if (!handlersMap?.has?.(resolvedType) && !legacyMap?.has?.(resolvedType)) {
-        for (const map of [handlersMap, legacyMap]) {
-          if (!map) continue;
-          for (const [key] of map) {
-            if (key.endsWith(":" + resolvedType) || key.endsWith("." + resolvedType)) {
-              resolvedType = key;
-              break;
-            }
-          }
-          if (resolvedType !== type) break;
-        }
-      }
-      if (!handlersMap?.has?.(resolvedType) && !legacyMap?.has?.(resolvedType)) {
-        console.error("[execute-command] Handler NOT FOUND for type:", resolvedType);
-        console.error(
-          "[execute-command] Registered handlers:",
-          [...handlersMap?.keys?.() ?? []].join(", ") || "(none)"
-        );
-        const matching = [...handlersMap?.keys?.() ?? []].filter((k) => k.includes("courseware"));
-        console.error("[execute-command] Matching courseware keys:", matching.join(", ") || "(none)");
-      }
-      const cmd = await kernelContainer.commandBus.createCommand(
-        resolvedType,
-        payload ?? {},
-        getActorId(req)
-      );
-      const result = await kernelContainer.commandBus.execute(cmd);
-      res.json({ success: true, result });
+        } else {
+          return res.status(404).json({ success: false, error: "\u672A\u627E\u5230\u66F4\u65B0\u5B89\u88C5\u5305" });
+        }
+      }
+      const result = await kernelContainer.pluginDistributionManager.updateFromZip(zipBuffer, {
+        targetPluginId,
+        allowDowngrade: false
+      });
+      res.json({
+        success: true,
+        updated: true,
+        pluginId: result.pluginId,
+        manifest: result.manifest,
+        oldVersion: result.oldVersion,
+        newVersion: result.newVersion || "1.2.0",
+        wasActive: result.wasActive
+      });
     } catch (err) {
-      console.error("[execute-command]", err.message);
+      console.error(err);
       res.status(500).json({ success: false, error: err.message });
     }
   });
-  app.get("/api/ai-providers", (req, res) => {
+  app.get("/api/plugins/:id(*)/contributions", (req, res) => {
     try {
-      const providers = kernelContainer.db.prepare("SELECT * FROM ai_providers ORDER BY created_at DESC").all();
-      const masked = providers.map((p) => ({
-        ...p,
-        api_key: maskApiKey(decryptApiKey(p.api_key || ""))
-      }));
-      res.json(masked);
+      const rawId = decodeURIComponent(req.params.id);
+      const summary = kernelContainer.pluginHost.listContributions(rawId);
+      res.json({ success: true, result: summary });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      res.status(500).json({ success: false, error: e.message });
     }
   });
-  app.post("/api/ai-providers", (req, res) => {
+  app.get("/api/plugins/:id(*)/config", (req, res) => {
     try {
-      const { name, api_url, api_key, model_name } = req.body;
-      if (!name || !api_url || !model_name) {
-        return res.status(400).json({ error: "Missing name, api_url or model_name" });
+      const rawId = decodeURIComponent(req.params.id);
+      const pluginId = kernelContainer.pluginHost.resolvePluginUuid(rawId);
+      const row = kernelContainer.db.prepare("SELECT manifest FROM plugins WHERE id = ?").get(pluginId);
+      if (!row) {
+        return res.status(404).json({ success: false, error: "Plugin not found" });
       }
-      const id = "prov_" + Date.now();
-      const now = Date.now();
-      const encryptedKey = api_key ? encryptApiKey(api_key) : "";
-      kernelContainer.db.prepare("INSERT INTO ai_providers (id, name, api_url, api_key, model_name, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)").run(id, name, api_url, encryptedKey, model_name, now, now);
-      res.json({ success: true, id });
+      const manifest = JSON.parse(row.manifest);
+      res.json({
+        success: true,
+        result: {
+          schema: manifest.configuration?.properties ?? {},
+          values: kernelContainer.pluginHost.getPluginConfig(pluginId, manifest)
+        }
+      });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      res.status(500).json({ success: false, error: e.message });
     }
   });
-  app.put("/api/ai-providers/:id", (req, res) => {
+  app.post("/api/plugins/:id(*)/config", (req, res) => {
     try {
-      const { name, api_url, api_key, model_name } = req.body;
-      if (!name || !api_url || !model_name) {
-        return res.status(400).json({ error: "Missing name, api_url or model_name" });
+      const rawId = decodeURIComponent(req.params.id);
+      const pluginId = kernelContainer.pluginHost.resolvePluginUuid(rawId);
+      const updates = req.body;
+      if (!updates || typeof updates !== "object") {
+        return res.status(400).json({ success: false, error: "Body must be an object of key-value pairs" });
       }
-      const now = Date.now();
-      let finalKey;
-      if (api_key && api_key.trim() !== "" && !api_key.includes("****")) {
-        finalKey = encryptApiKey(api_key);
-      } else {
-        const existing = kernelContainer.db.prepare("SELECT api_key FROM ai_providers WHERE id = ?").get(req.params.id);
-        finalKey = existing?.api_key || "";
+      const row = kernelContainer.db.prepare("SELECT manifest FROM plugins WHERE id = ?").get(pluginId);
+      if (!row) {
+        return res.status(404).json({ success: false, error: "Plugin not found" });
       }
-      kernelContainer.db.prepare("UPDATE ai_providers SET name = ?, api_url = ?, api_key = ?, model_name = ?, updated_at = ? WHERE id = ?").run(name, api_url, finalKey, model_name, now, req.params.id);
+      const manifest = JSON.parse(row.manifest);
+      kernelContainer.pluginHost.setPluginConfig(pluginId, manifest, updates);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      res.status(500).json({ success: false, error: e.message });
     }
   });
-  app.delete("/api/ai-providers/:id", (req, res) => {
+  app.post("/api/plugins/:id(*)/toggle", async (req, res) => {
     try {
-      kernelContainer.db.prepare("DELETE FROM ai_providers WHERE id = ?").run(req.params.id);
-      res.json({ success: true });
-    } catch (e) {
-      res.status(500).json({ error: e.message });
+      const rawId = decodeURIComponent(req.params.id);
+      const cmd = kernelContainer.commandBus.createCommand(
+        "plugin.toggle",
+        { pluginId: rawId },
+        getActorId(req)
+      );
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
+    } catch (err) {
+      res.status(500).json({ success: false, error: err.message });
     }
   });
-  app.get("/api/site-settings", (req, res) => {
+  app.delete("/api/plugins/:id(*)", async (req, res) => {
     try {
-      const row = kernelContainer.db.prepare("SELECT site_name, slogan, logo_url FROM site_settings WHERE id = ?").get("global");
-      res.json({
-        siteName: row?.site_name || "",
-        slogan: row?.slogan || "",
-        logoUrl: row?.logo_url || null
-      });
-    } catch (e) {
-      res.status(500).json({ error: e.message });
+      const rawId = decodeURIComponent(req.params.id);
+      const cmd = kernelContainer.commandBus.createCommand(
+        "plugin.uninstall",
+        { pluginId: rawId },
+        getActorId(req)
+      );
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
+    } catch (err) {
+      res.status(500).json({ success: false, error: err.message });
     }
   });
-  app.put("/api/site-settings", (req, res) => {
+  app.get("/api/plugins/:id(*)", async (req, res) => {
     try {
-      const { siteName, slogan, logoUrl } = req.body || {};
-      kernelContainer.db.prepare(
-        `INSERT INTO site_settings (id, site_name, slogan, logo_url) VALUES ('global', ?, ?, ?)
-           ON CONFLICT(id) DO UPDATE SET site_name = excluded.site_name, slogan = excluded.slogan, logo_url = excluded.logo_url`
-      ).run(siteName || "", slogan || "", logoUrl || null);
-      res.json({
-        success: true,
-        siteInfo: { siteName: siteName || "", slogan: slogan || "", logoUrl: logoUrl || null }
-      });
-    } catch (e) {
-      res.status(500).json({ error: e.message });
+      const rawId = decodeURIComponent(req.params.id);
+      const cmd = kernelContainer.commandBus.createCommand(
+        "plugin.info",
+        { pluginId: rawId },
+        getActorId(req)
+      );
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
+    } catch (err) {
+      res.status(404).json({ success: false, error: err.message });
     }
   });
-  app.post("/api/ai-providers/test", async (req, res) => {
+  app.post("/api/plugins", async (req, res) => {
     try {
-      const { api_url, api_key: providedKey, model_name } = req.body;
-      if (!api_url || !model_name) {
-        return res.status(400).json({ error: "api_url and model_name are required" });
-      }
-      let api_key = "";
-      if (providedKey && providedKey.includes("****")) {
-        const existing = kernelContainer.db.prepare(
-          "SELECT api_key FROM ai_providers WHERE api_url = ? AND model_name = ? LIMIT 1"
-        ).get(api_url, model_name);
-        api_key = existing ? decryptApiKey(existing.api_key) : "";
-      } else if (providedKey) {
-        api_key = providedKey.includes(":") ? decryptApiKey(providedKey) : providedKey;
-      }
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), 1e4);
-      let cleanUrl = api_url.trim();
-      if (!cleanUrl.endsWith("/chat/completions")) {
-        cleanUrl = cleanUrl.endsWith("/") ? cleanUrl + "chat/completions" : cleanUrl + "/chat/completions";
-      }
-      const response = await fetch(cleanUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "Authorization": `Bearer ${api_key || ""}`
-        },
-        body: JSON.stringify({
-          model: model_name,
-          messages: [{ role: "user", content: "Say connected" }],
-          max_tokens: 5
-        }),
-        signal: controller.signal
-      });
-      clearTimeout(timeoutId);
-      const responseText = await response.text();
-      if (response.ok) {
-        res.json({ success: true, message: "Successfully connected and received response." });
-      } else {
-        res.status(response.status).json({ success: false, error: `API responded with status ${response.status}: ${responseText.slice(0, 200)}` });
-      }
-    } catch (e) {
-      res.status(500).json({ success: false, error: `Connection failed: ${e.message}` });
-    }
-  });
-}
-
-// server.ts
-import_dotenv.default.config();
-if (!process.env.NODE_ENV) {
-  const isCjs = typeof __filename !== "undefined" && __filename.endsWith(".cjs");
-  const isDist = process.cwd().endsWith("/dist") || typeof __dirname !== "undefined" && __dirname.includes("/dist") || typeof __filename !== "undefined" && __filename.includes("/dist");
-  if (isCjs || isDist) {
-    process.env.NODE_ENV = "production";
-  }
-}
-var MF_REMOTE_CACHE = /* @__PURE__ */ new Map();
-var lessonActiveSegments = /* @__PURE__ */ new Map();
-var buildAgentSystemInstruction = (lang, currentLessonId) => {
-  let systemInstruction = lang === "zh" ? "\u4F60\u662F\u4E00\u4E2A\u6559\u80B2\u7CFB\u7EDF\u5E95\u5C42\u7684 OS Agent\u3002\u4F60\u9700\u8981\u7406\u89E3\u8001\u5E08\u7684\u6307\u4EE4\uFF0C\u5E76\u8C03\u7528\u53EF\u7528\u7684\u5DE5\u5177\uFF08\u547D\u4EE4\uFF09\u53BB\u6267\u884C\u8FD9\u4E9B\u64CD\u4F5C\u3002\u5982\u679C\u8001\u5E08\u8BA9\u4F60\u521B\u5EFA\u4E00\u8282\u8BFE\uFF0C\u8BF7\u52A1\u5FC5\u5229\u7528\u5DE5\u5177\u751F\u6210\u8BE6\u7EC6\u7684\u521D\u59CB\u8BFE\u7A0B\u5185\u5BB9\u3002\u5982\u679C\u8001\u5E08\u8981\u6C42\u7BA1\u7406\u8FDB\u7A0B/\u4EFB\u52A1\uFF0C\u8BF7\u4F7F\u7528 process.spawn, process.kill, process.list\u3002\u5982\u679C\u9700\u5B58\u50A8\u6587\u4EF6\u3001\u7D20\u6750\u6216\u521B\u5EFA\u76EE\u5F55\uFF0C\u8BF7\u4F7F\u7528 vfs.* \u5E76\u5728\u9700\u8981\u65F6\u7BA1\u7406\u73ED\u7EA7\u548C\u5B66\u751F\u3002\u4F60\u652F\u6301\u901A\u8FC7 class_create \u521B\u5EFA\u73ED\u7EA7, student_create \u521B\u5EFA\u5B66\u751F, class_add_student \u5C06\u5B66\u751F\u52A0\u5165\u73ED\u7EA7\u3002\u5F53\u8001\u5E08\u8981\u6C42\u4ECE\u63D0\u4F9B\u7684\u6570\u636E\uFF08\u5982CSV\u3001JSON\u3001Markdown\u6216\u5BF9\u8BDD\u4E2D\uFF09\u521B\u5EFA\u73ED\u7EA7\u6216\u5B66\u751F\u65F6\uFF0C\u8BF7\u4F9D\u6B21\u53D1\u51FA\u8FD9\u4E9B\u6307\u4EE4\u3002\u5982\u679C\u4E0A\u4E00\u9636\u6BB5\u8FD4\u56DE\u4E86\u521B\u5EFA\u6210\u529F\u7684\u73ED\u7EA7ID\u6216\u5B66\u751FID\uFF0C\u4F60\u9700\u8981\u5728\u540E\u7EED\uFFFD? functionCall \u4E2D\u5F15\u7528\u8FD9\u4E9BID\uFF08\u4F8B\u5982\uFF1A\u628A\u521A\u521B\u5EFA\u7684\u5B66\u751FID\u52A0\u5165\u5230\u521A\u521B\u5EFA\u7684\u73ED\u7EA7ID\u4E2D\uFF09\u3002\u901A\u8FC7\u5F80\u590D\u7684\u5DE5\u5177\u8C03\u7528\uFF0C\u4F60\u53EF\u4EE5\u81EA\u52A8\u5B8C\u6210\u5B8C\u6574\u7684\u6D41\u7A0B\uFFFD?" : "You are an educational OS kernel agent. You interpret teacher instructions and use your available tools (commands) to execute them. If the teacher asks to create a lesson, always generate some detailed initial content for it. If the teacher asks to spawn or kill processes, use process tools. Use vfs tools to store assets, and manage classes/students as necessary. You support class_create, student_create, class_add_student. Always use tool chaining if you need to create a class and enroll students: first call class_create/student_create, receive their returned IDs, and then call class_add_student in the next turn. Always answer with a helpful summary.";
-  if (currentLessonId) {
-    systemInstruction += `
-[Context] The current selected lesson ID is "${currentLessonId}". Use this ID if the teacher's instruction is about modifying or adding to the current lesson.
-
-Available tools (functions) can be used multiple times in sequence if needed.`;
-  }
-  return systemInstruction;
-};
-var buildAgentFinalMessage = (message, attachments) => {
-  let finalMessage = message;
-  if (attachments && Array.isArray(attachments) && attachments.length > 0) {
-    finalMessage += "\n\n[Attached Reference Files]";
-    attachments.forEach((file, index) => {
-      if (file.name.endsWith(".zip") || file.content.startsWith("data:application/zip") || file.content.length > 5e3) {
-        finalMessage += `
-
-Filename: "${file.name}"
-Content: "ATTACHMENT_BASE64:${index}"`;
-      } else {
-        finalMessage += `
-
-Filename: "${file.name}"
-Content:
-"""
-${file.content}
-"""`;
-      }
-    });
-  }
-  return finalMessage;
-};
-var normalizeToolSchema = (schema) => {
-  if (!schema || typeof schema !== "object") return schema;
-  if (Array.isArray(schema)) return schema.map(normalizeToolSchema);
-  const normalized = {};
-  for (const [key, value] of Object.entries(schema)) {
-    if (key === "type" && typeof value === "string") {
-      const typeMap = {
-        OBJECT: "object",
-        STRING: "string",
-        ARRAY: "array",
-        INTEGER: "integer",
-        NUMBER: "number",
-        BOOLEAN: "boolean"
-      };
-      normalized.type = typeMap[value.toUpperCase()] || value.toLowerCase();
-      continue;
-    }
-    if (key === "properties" && value && typeof value === "object" && !Array.isArray(value)) {
-      normalized.properties = Object.fromEntries(
-        Object.entries(value).map(([propKey, propSchema]) => [propKey, normalizeToolSchema(propSchema)])
+      const { sourceCode } = req.body;
+      const cmd = kernelContainer.commandBus.createCommand(
+        "plugin.install",
+        { sourceCode },
+        getActorId(req)
       );
-      continue;
-    }
-    if (key === "items") {
-      normalized.items = normalizeToolSchema(value);
-      continue;
-    }
-    normalized[key] = value;
-  }
-  return normalized;
-};
-var buildOpenAITools = () => {
-  const actions = kernelContainer.actionRegistry.getAllActions();
-  return actions.map((action) => ({
-    type: "function",
-    function: {
-      name: action.commandType.replace(/[^a-zA-Z0-9_\-]/g, "_"),
-      description: action.description,
-      parameters: normalizeToolSchema(action.inputSchema)
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
+    } catch (err) {
+      console.error(err);
+      res.status(500).json({ success: false, error: err.message });
     }
-  }));
-};
-var executeAgentToolCall = async (toolName, args, allExecutedTools, callerRole, currentLessonId) => {
-  const actionDesc = kernelContainer.actionRegistry.getActionByToolName(toolName);
-  let actionResult;
-  const isAdmin = callerRole === "administrator";
-  const actorId = isAdmin ? "user-frontend" : "agent-system-0";
-  const metadata = isAdmin ? { approved: true } : void 0;
-  if (actionDesc) {
-    const cmd = kernelContainer.commandBus.createCommand(
-      actionDesc.commandType,
-      args,
-      actorId,
-      metadata
-    );
+  });
+  app.post("/api/plugins/upload-zip", async (req, res) => {
     try {
-      const cmdResult = await kernelContainer.commandBus.execute(cmd);
-      actionResult = cmdResult;
-      allExecutedTools.push({ callName: toolName, success: true, result: cmdResult });
-      if (cmdResult && cmdResult.elementId && currentLessonId) {
-        const activeSeg = lessonActiveSegments.get(currentLessonId);
-        if (activeSeg) {
-          const row = kernelContainer.db.prepare("SELECT data FROM whiteboard_elements WHERE id = ?").get(cmdResult.elementId);
-          if (row) {
-            try {
-              const dataObj = JSON.parse(row.data);
-              if (!dataObj.segmentId) {
-                dataObj.segmentId = activeSeg;
-                kernelContainer.db.prepare("UPDATE whiteboard_elements SET data = ? WHERE id = ?").run(JSON.stringify(dataObj), cmdResult.elementId);
-                console.log(`[Agent Tool Sync] Injected active segment "${activeSeg}" into element "${cmdResult.elementId}"`);
-                kernelContainer.eventBus.publish({
-                  id: import_crypto13.default.randomUUID(),
-                  type: "whiteboard.element_updated",
-                  source: "agent-tool-sync",
-                  payload: { elementId: cmdResult.elementId, lessonId: currentLessonId },
-                  timestamp: Date.now(),
-                  correlationId: cmd.id
-                }).catch((e) => console.error("[Agent Tool Sync] Failed to publish element_updated event:", e));
-              }
-            } catch (e) {
-              console.error("[Agent Tool Sync] Failed to parse/update element data:", e);
-            }
-          }
-        }
-      }
+      const { base64Data, filename, executionMode } = req.body;
+      const cmd = kernelContainer.commandBus.createCommand(
+        "plugin.install_zip",
+        { base64Data, filename, executionMode },
+        getActorId(req)
+      );
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
     } catch (err) {
-      actionResult = { error: err.message };
-      allExecutedTools.push({ callName: toolName, success: false, error: err.message });
+      console.error(err);
+      res.status(500).json({ success: false, error: err.message });
     }
-  } else {
-    actionResult = { error: `Command / Tool not found: ${toolName}` };
-    allExecutedTools.push({ callName: toolName, success: false, error: "Command not registered" });
-  }
-  return actionResult;
-};
-var buildOpenAIChatUrl = (apiUrl) => {
-  let cleanUrl = apiUrl.trim();
-  if (!cleanUrl.endsWith("/chat/completions")) {
-    cleanUrl = cleanUrl.endsWith("/") ? cleanUrl + "chat/completions" : cleanUrl + "/chat/completions";
-  }
-  return cleanUrl;
-};
-var runGeminiAgentChat = async (request) => {
-  const { message, lang = "zh", currentLessonId, attachments, callerRole, history } = request;
-  const apiKey = process.env.GEMINI_API_KEY;
-  if (!apiKey || apiKey.trim() === "" || apiKey.trim() === "MY_GEMINI_API_KEY") {
-    throw new Error(
-      lang === "zh" ? "\u672A\u914D\u7F6E\u53EF\u7528\u7684 AI \u670D\u52A1\u3002\u8BF7\u5728\u7BA1\u7406\u540E\u53F0\u7684\u300CAI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u4E2D\u6DFB\u52A0\u4E00\u4E2A AI \u63D0\u4F9B\u5546\uFF08\u6216\u8BBE\u7F6E GEMINI_API_KEY \u4F5C\u4E3A\u517C\u5BB9\u56DE\u9000\uFF09\u3002" : 'No AI service is configured. Please add an AI Provider in the admin dashboard\'s "AI Provider Management" (or set `GEMINI_API_KEY` as a compatible fallback).'
-    );
-  }
-  const ai = new import_genai6.GoogleGenAI({ apiKey: apiKey.trim() });
-  const tools = kernelContainer.actionRegistry.getAgentTools();
-  const systemInstruction = buildAgentSystemInstruction(lang, currentLessonId);
-  const finalMessage = buildAgentFinalMessage(message, attachments);
-  const historyContents = (history || []).map((h) => ({
-    role: h.role === "assistant" ? "model" : "user",
-    parts: [{ text: h.content }]
-  }));
-  const contents = [...historyContents, { role: "user", parts: [{ text: finalMessage }] }];
-  let loopCount = 0;
-  const MAX_LOOPS = 5;
-  let finalResponseText = "";
-  const allExecutedTools = [];
-  while (loopCount < MAX_LOOPS) {
-    const response = await ai.models.generateContent({
-      model: "gemini-3.5-flash",
-      contents,
-      config: {
-        systemInstruction,
-        tools,
-        temperature: 0.1
+  });
+  app.post("/api/plugins/upload-zip-raw", import_express2.default.raw({ type: "application/octet-stream", limit: "400mb" }), async (req, res) => {
+    try {
+      const zipBuffer = req.body;
+      const filename = req.headers["x-filename"] ? decodeURIComponent(req.headers["x-filename"]) : "plugin.zip";
+      const executionModeHeader = String(req.headers["x-execution-mode"] || "").toLowerCase();
+      const executionMode = executionModeHeader === "worker" || executionModeHeader === "inline" ? executionModeHeader : void 0;
+      const modeHeader = String(req.headers["x-install-mode"] || "install").toLowerCase();
+      const allowDowngrade = String(req.headers["x-allow-downgrade"] || "").toLowerCase() === "true";
+      const targetPluginId = req.headers["x-target-plugin-id"] ? decodeURIComponent(String(req.headers["x-target-plugin-id"])) : void 0;
+      if (!Buffer.isBuffer(zipBuffer) || zipBuffer.length === 0) {
+        return res.status(400).json({ success: false, error: "Empty or invalid zip file" });
       }
-    });
-    const candidate = response.candidates?.[0];
-    const contentParts = candidate?.content?.parts || [];
-    const functionCalls = contentParts.filter((p) => "functionCall" in p);
-    if (functionCalls.length === 0) {
-      finalResponseText = response.text || "";
-      break;
-    }
-    contents.push({
-      role: "model",
-      parts: contentParts
-    });
-    const toolParts = [];
-    for (const part of contentParts) {
-      if ("functionCall" in part && part.functionCall) {
-        const call = part.functionCall;
-        if (call.args && typeof call.args === "object" && attachments) {
-          for (const key of Object.keys(call.args)) {
-            const val = call.args[key];
-            if (typeof val === "string" && val.startsWith("ATTACHMENT_BASE64:")) {
-              const idx = parseInt(val.split(":")[1]);
-              if (attachments[idx]) {
-                call.args[key] = attachments[idx].content;
-              }
-            }
-          }
-        }
-        const actionResult = await executeAgentToolCall(call.name, call.args, allExecutedTools, callerRole, currentLessonId);
-        toolParts.push({
-          functionResponse: {
-            name: call.name,
-            response: typeof actionResult === "object" && actionResult !== null ? actionResult : { value: actionResult }
-          }
+      if (modeHeader === "update") {
+        const result2 = await kernelContainer.pluginDistributionManager.updateFromZip(zipBuffer, {
+          targetPluginId,
+          executionMode,
+          allowDowngrade
+        });
+        return res.json({
+          success: true,
+          updated: true,
+          pluginId: result2.pluginId,
+          manifest: result2.manifest,
+          oldVersion: result2.oldVersion,
+          newVersion: result2.newVersion,
+          wasActive: result2.wasActive,
+          filename
         });
       }
+      const result = await kernelContainer.pluginDistributionManager.installFromZip(zipBuffer, executionMode);
+      res.json({
+        success: true,
+        updated: false,
+        pluginId: result.pluginId,
+        manifest: result.manifest,
+        filename
+      });
+    } catch (err) {
+      console.error(err);
+      res.status(500).json({ success: false, error: err.message });
     }
-    contents.push({
-      role: "tool",
-      parts: toolParts
-    });
-    loopCount++;
-  }
-  if (loopCount >= MAX_LOOPS && !finalResponseText) {
-    finalResponseText = "I have executed several internal commands to create or link resources, but reached the iteration limit. Please double-check the interface to confirm.";
-  }
-  return {
-    agentText: finalResponseText,
-    toolResults: allExecutedTools
-  };
-};
-var runOpenAIAgentChat = async (provider, request) => {
-  const { message, lang = "zh", currentLessonId, attachments, callerRole, history } = request;
-  const systemInstruction = buildAgentSystemInstruction(lang, currentLessonId);
-  const finalMessage = buildAgentFinalMessage(message, attachments);
-  const tools = buildOpenAITools();
-  const chatUrl = buildOpenAIChatUrl(provider.api_url);
-  const headers = {
-    "Content-Type": "application/json"
-  };
-  if (provider.api_key && provider.api_key.trim()) {
-    headers.Authorization = `Bearer ${provider.api_key.trim()}`;
-  }
-  const historyMessages = (history || []).map((h) => ({ role: h.role, content: h.content }));
-  const messages = [
-    { role: "system", content: systemInstruction },
-    ...historyMessages,
-    { role: "user", content: finalMessage }
-  ];
-  const allExecutedTools = [];
-  let finalResponseText = "";
-  const MAX_LOOPS = 5;
-  let loopCount = 0;
-  while (loopCount < MAX_LOOPS) {
-    const response = await fetch(chatUrl, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        model: provider.model_name,
-        messages,
-        tools,
-        tool_choice: tools.length > 0 ? "auto" : void 0,
-        temperature: 0.1
-      })
-    });
-    if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`AI provider request failed (${response.status}): ${errorText || response.statusText}`);
-    }
-    const data = await response.json();
-    const assistantMessage = data.choices?.[0]?.message;
-    if (!assistantMessage) {
-      throw new Error("AI provider returned no assistant message");
-    }
-    finalResponseText = typeof assistantMessage.content === "string" ? assistantMessage.content.trim() : "";
-    const toolCalls = Array.isArray(assistantMessage.tool_calls) ? assistantMessage.tool_calls : [];
-    messages.push({
-      role: "assistant",
-      content: assistantMessage.content ?? "",
-      tool_calls: toolCalls
-    });
-    if (toolCalls.length === 0) {
-      break;
-    }
-    for (const call of toolCalls) {
-      const toolName = call?.function?.name;
-      if (!toolName) continue;
-      let parsedArgs = {};
-      if (typeof call?.function?.arguments === "string" && call.function.arguments.trim()) {
-        try {
-          parsedArgs = JSON.parse(call.function.arguments);
-        } catch (err) {
-          parsedArgs = {};
+  });
+  app.post(
+    "/api/plugins/:id(*)/update-zip-raw",
+    import_express2.default.raw({ type: "application/octet-stream", limit: "400mb" }),
+    async (req, res) => {
+      try {
+        const targetPluginId = decodeURIComponent(req.params.id);
+        const zipBuffer = req.body;
+        const executionModeHeader = String(req.headers["x-execution-mode"] || "").toLowerCase();
+        const executionMode = executionModeHeader === "worker" || executionModeHeader === "inline" ? executionModeHeader : void 0;
+        const allowDowngrade = String(req.headers["x-allow-downgrade"] || "").toLowerCase() === "true";
+        if (!Buffer.isBuffer(zipBuffer) || zipBuffer.length === 0) {
+          return res.status(400).json({ success: false, error: "Empty or invalid zip file" });
         }
+        const result = await kernelContainer.pluginDistributionManager.updateFromZip(zipBuffer, {
+          targetPluginId,
+          executionMode,
+          allowDowngrade
+        });
+        res.json({
+          success: true,
+          updated: true,
+          pluginId: result.pluginId,
+          manifest: result.manifest,
+          oldVersion: result.oldVersion,
+          newVersion: result.newVersion,
+          wasActive: result.wasActive
+        });
+      } catch (err) {
+        console.error(err);
+        res.status(500).json({ success: false, error: err.message });
       }
-      if (parsedArgs && typeof parsedArgs === "object" && attachments) {
-        for (const key of Object.keys(parsedArgs)) {
-          const val = parsedArgs[key];
-          if (typeof val === "string" && val.startsWith("ATTACHMENT_BASE64:")) {
-            const idx = parseInt(val.split(":")[1]);
-            if (attachments[idx]) {
-              parsedArgs[key] = attachments[idx].content;
+    }
+  );
+  app.post("/api/plugins/execute-command", async (req, res) => {
+    try {
+      const { type, payload } = req.body;
+      if (!type) {
+        return res.status(400).json({ success: false, error: "Missing command type" });
+      }
+      let resolvedType = type;
+      const bus = kernelContainer.commandBus;
+      const handlersMap = bus.handlers;
+      const legacyMap = bus.legacyHandlers;
+      if (!handlersMap?.has?.(resolvedType) && !legacyMap?.has?.(resolvedType)) {
+        for (const map of [handlersMap, legacyMap]) {
+          if (!map) continue;
+          for (const [key] of map) {
+            if (key.endsWith(":" + resolvedType) || key.endsWith("." + resolvedType)) {
+              resolvedType = key;
+              break;
             }
           }
+          if (resolvedType !== type) break;
         }
       }
-      const actionResult = await executeAgentToolCall(toolName, parsedArgs, allExecutedTools, callerRole, currentLessonId);
-      messages.push({
-        role: "tool",
-        tool_call_id: call.id,
-        content: JSON.stringify(actionResult)
-      });
+      if (!handlersMap?.has?.(resolvedType) && !legacyMap?.has?.(resolvedType)) {
+        console.error("[execute-command] Handler NOT FOUND for type:", resolvedType);
+        console.error(
+          "[execute-command] Registered handlers:",
+          [...handlersMap?.keys?.() ?? []].join(", ") || "(none)"
+        );
+        const matching = [...handlersMap?.keys?.() ?? []].filter((k) => k.includes("courseware"));
+        console.error("[execute-command] Matching courseware keys:", matching.join(", ") || "(none)");
+      }
+      const cmd = await kernelContainer.commandBus.createCommand(
+        resolvedType,
+        payload ?? {},
+        getActorId(req)
+      );
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json({ success: true, result });
+    } catch (err) {
+      console.error("[execute-command]", err.message);
+      res.status(500).json({ success: false, error: err.message });
     }
-    loopCount++;
-  }
-  if (loopCount >= MAX_LOOPS && !finalResponseText) {
-    finalResponseText = "I have executed several internal commands, but reached the iteration limit. Please review the assistant panel for the latest state.";
-  }
-  return {
-    agentText: finalResponseText,
-    toolResults: allExecutedTools
-  };
-};
-async function startServer() {
-  await ServerBootstrapAdapter.bootstrap({
-    kernelContainer,
-    environment: process.env.NODE_ENV || "development",
-    config: { port: Number(process.env.PORT) || 9e3 }
   });
-  try {
-    const existingQuiz = kernelContainer.db.prepare("SELECT id, manifest, source_code FROM plugins WHERE name = ?").get("Quiz Component Plugin");
-    if (existingQuiz && (!existingQuiz.manifest || !existingQuiz.manifest.includes("classroomTools") || !existingQuiz.source_code.includes("actorId:"))) {
-      console.log("Upgrading old Quiz Component Plugin to add classroomTools and fix Actor...");
-      kernelContainer.db.prepare("DELETE FROM plugins WHERE id = ?").run(existingQuiz.id);
+  app.get("/api/ai-providers", (req, res) => {
+    try {
+      const providers = kernelContainer.db.prepare("SELECT * FROM ai_providers ORDER BY created_at DESC").all();
+      const masked = providers.map((p) => ({
+        ...p,
+        api_key: maskApiKey(decryptApiKey(p.api_key || ""))
+      }));
+      res.json(masked);
+    } catch (e) {
+      res.status(500).json({ error: e.message });
     }
-    const existingRollCall = kernelContainer.db.prepare("SELECT id, manifest FROM plugins WHERE name = ?").get("Random Student Picker (\u968F\u673A\u70B9\u540D\u5C0F\u5DE5\uFFFD?)");
-    if (existingRollCall && (!existingRollCall.manifest || !existingRollCall.manifest.includes("classroomTools"))) {
-      console.log("Upgrading old Random Student Picker Plugin to add classroomTools...");
-      kernelContainer.db.prepare("DELETE FROM plugins WHERE id = ?").run(existingRollCall.id);
+  });
+  app.post("/api/ai-providers", (req, res) => {
+    try {
+      const { name, api_url, api_key, model_name } = req.body;
+      if (!name || !api_url || !model_name) {
+        return res.status(400).json({ error: "Missing name, api_url or model_name" });
+      }
+      const id = "prov_" + Date.now();
+      const now = Date.now();
+      const encryptedKey = api_key ? encryptApiKey(api_key) : "";
+      kernelContainer.db.prepare("INSERT INTO ai_providers (id, name, api_url, api_key, model_name, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)").run(id, name, api_url, encryptedKey, model_name, now, now);
+      res.json({ success: true, id });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
     }
-  } catch (e) {
-    console.error("Error upgrading old default plugins:", e);
-  }
-  try {
-    kernelContainer.db.exec(`
-      CREATE TABLE IF NOT EXISTS student_rollcalls (
-        id TEXT PRIMARY KEY,
-        student_id TEXT NOT NULL,
-        class_id TEXT,
-        lesson_id TEXT,
-        picked_time INTEGER NOT NULL
-      );
-    `);
-    console.log("student_rollcalls table successfully ensured.");
-  } catch (e) {
-    console.error("Error creating student_rollcalls table:", e);
-  }
-  try {
-    kernelContainer.db.exec(`
-      CREATE TABLE IF NOT EXISTS site_settings (
-        id TEXT PRIMARY KEY,
-        site_name TEXT,
-        slogan TEXT,
-        logo_url TEXT
-      );
-    `);
-    console.log("site_settings table successfully ensured.");
-  } catch (e) {
-    console.error("Error creating site_settings table:", e);
-  }
-  try {
-    kernelContainer.db.exec(`
-      CREATE TABLE IF NOT EXISTS agent_conversations (
-        id TEXT PRIMARY KEY,
-        conv_key TEXT NOT NULL,
-        role TEXT NOT NULL,
-        content TEXT NOT NULL,
-        created_at INTEGER NOT NULL
-      );
-    `);
-    kernelContainer.db.exec(
-      `CREATE INDEX IF NOT EXISTS idx_agent_conv_key ON agent_conversations(conv_key, created_at);`
-    );
-    console.log("agent_conversations table successfully ensured.");
-  } catch (e) {
-    console.error("Error creating agent_conversations table:", e);
-  }
-  try {
-    kernelContainer.db.exec(`ALTER TABLE client_sessions ADD COLUMN expires_at INTEGER`);
-    console.log("client_sessions.expires_at column ensured.");
-  } catch {
-  }
-  try {
-    const now = Date.now();
-    const idleTimeout = 24 * 60 * 60 * 1e3;
-    const deletedExpired = kernelContainer.db.prepare(
-      "DELETE FROM client_sessions WHERE expires_at IS NOT NULL AND expires_at < ?"
-    ).run(now);
-    const deletedIdle = kernelContainer.db.prepare(
-      "DELETE FROM client_sessions WHERE updated_at IS NOT NULL AND (? - updated_at) > ?"
-    ).run(now, idleTimeout);
-    const totalDeleted = (deletedExpired.changes || 0) + (deletedIdle.changes || 0);
-    if (totalDeleted > 0) {
-      console.log(`[Session] Cleaned up ${totalDeleted} expired sessions on startup.`);
+  });
+  app.put("/api/ai-providers/:id", (req, res) => {
+    try {
+      const { name, api_url, api_key, model_name } = req.body;
+      if (!name || !api_url || !model_name) {
+        return res.status(400).json({ error: "Missing name, api_url or model_name" });
+      }
+      const now = Date.now();
+      let finalKey;
+      if (api_key && api_key.trim() !== "" && !api_key.includes("****")) {
+        finalKey = encryptApiKey(api_key);
+      } else {
+        const existing = kernelContainer.db.prepare("SELECT api_key FROM ai_providers WHERE id = ?").get(req.params.id);
+        finalKey = existing?.api_key || "";
+      }
+      kernelContainer.db.prepare("UPDATE ai_providers SET name = ?, api_url = ?, api_key = ?, model_name = ?, updated_at = ? WHERE id = ?").run(name, api_url, finalKey, model_name, now, req.params.id);
+      res.json({ success: true });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+  app.delete("/api/ai-providers/:id", (req, res) => {
+    try {
+      kernelContainer.db.prepare("DELETE FROM ai_providers WHERE id = ?").run(req.params.id);
+      res.json({ success: true });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+  app.get("/api/site-settings", (req, res) => {
+    try {
+      const row = kernelContainer.db.prepare("SELECT site_name, slogan, logo_url FROM site_settings WHERE id = ?").get("global");
+      res.json({
+        siteName: row?.site_name || "",
+        slogan: row?.slogan || "",
+        logoUrl: row?.logo_url || null
+      });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+  app.put("/api/site-settings", (req, res) => {
+    try {
+      const { siteName, slogan, logoUrl } = req.body || {};
+      kernelContainer.db.prepare(
+        `INSERT INTO site_settings (id, site_name, slogan, logo_url) VALUES ('global', ?, ?, ?)
+           ON CONFLICT(id) DO UPDATE SET site_name = excluded.site_name, slogan = excluded.slogan, logo_url = excluded.logo_url`
+      ).run(siteName || "", slogan || "", logoUrl || null);
+      res.json({
+        success: true,
+        siteInfo: { siteName: siteName || "", slogan: slogan || "", logoUrl: logoUrl || null }
+      });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+  app.post("/api/ai-providers/test", async (req, res) => {
+    try {
+      const { api_url, api_key: providedKey, model_name } = req.body;
+      if (!api_url || !model_name) {
+        return res.status(400).json({ error: "api_url and model_name are required" });
+      }
+      let api_key = "";
+      if (providedKey && providedKey.includes("****")) {
+        const existing = kernelContainer.db.prepare(
+          "SELECT api_key FROM ai_providers WHERE api_url = ? AND model_name = ? LIMIT 1"
+        ).get(api_url, model_name);
+        api_key = existing ? decryptApiKey(existing.api_key) : "";
+      } else if (providedKey) {
+        api_key = providedKey.includes(":") ? decryptApiKey(providedKey) : providedKey;
+      }
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 1e4);
+      let cleanUrl = api_url.trim();
+      if (!cleanUrl.endsWith("/chat/completions")) {
+        cleanUrl = cleanUrl.endsWith("/") ? cleanUrl + "chat/completions" : cleanUrl + "/chat/completions";
+      }
+      const response = await fetch(cleanUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${api_key || ""}`
+        },
+        body: JSON.stringify({
+          model: model_name,
+          messages: [{ role: "user", content: "Say connected" }],
+          max_tokens: 5
+        }),
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      const responseText = await response.text();
+      if (response.ok) {
+        res.json({ success: true, message: "Successfully connected and received response." });
+      } else {
+        res.status(response.status).json({ success: false, error: `API responded with status ${response.status}: ${responseText.slice(0, 200)}` });
+      }
+    } catch (e) {
+      res.status(500).json({ success: false, error: `Connection failed: ${e.message}` });
     }
-  } catch (e) {
-    console.warn("[Session] Could not clean up expired sessions:", e);
+  });
+}
+
+// server.ts
+import_dotenv.default.config();
+if (!process.env.NODE_ENV) {
+  const isCjs = typeof __filename !== "undefined" && __filename.endsWith(".cjs");
+  const isDist = process.cwd().endsWith("/dist") || typeof __dirname !== "undefined" && __dirname.includes("/dist") || typeof __filename !== "undefined" && __filename.includes("/dist");
+  if (isCjs || isDist) {
+    process.env.NODE_ENV = "production";
   }
+}
+async function startServer() {
+  await ServerBootstrapAdapter.bootstrap({
+    kernelContainer,
+    environment: process.env.NODE_ENV || "development",
+    config: { port: Number(process.env.PORT) || 9e3 }
+  });
+  await runStartupMigrations(kernelContainer.db);
   await kernelContainer.ready;
   const activityRegistry = new ActivityRegistry2();
   registerOfficialActivities(activityRegistry, kernelContainer.actionRegistry);
@@ -23695,230 +23953,8 @@ async function startServer() {
   registerSchedulesRoutes(ctx);
   registerGradingRoutes(ctx);
   registerPluginsRoutes(ctx);
-  kernelContainer.eventBus.subscribe("assignment.graded", (event) => {
-    try {
-      const payload = event.payload;
-      const assignment = kernelContainer.db.prepare("SELECT title FROM assignments WHERE id = ?").get(payload.assignmentId);
-      const assignmentTitle = assignment ? assignment.title : "Assignment";
-      console.log(`[EventBus -> Socket.IO] Broadcasting assignment-graded-toast to student ${payload.studentId}`);
-      io.emit("assignment-graded-toast", {
-        assignmentId: payload.assignmentId,
-        assignmentTitle,
-        studentId: payload.studentId,
-        score: payload.score,
-        feedback: payload.feedback || ""
-      });
-    } catch (e) {
-      console.error("[EventBus -> Socket.IO] Error dispatching assignment graded notification:", e);
-    }
-  });
-  const handleRollcallElement = (elementId) => {
-    try {
-      const el = kernelContainer.db.prepare("SELECT * FROM whiteboard_elements WHERE id = ?").get(elementId);
-      if (el && el.type === "rollcall") {
-        const elData = JSON.parse(el.data);
-        if (elData && elData.selectedStudent && elData.status === "picked") {
-          const studentId = elData.selectedStudent.id;
-          const studentName = elData.selectedStudent.name;
-          let classId = elData.classId || "";
-          const lessonId = el.lesson_id;
-          if (!classId && lessonId) {
-            const sched = kernelContainer.db.prepare("SELECT class_id FROM schedules WHERE lesson_id = ? LIMIT 1").get(lessonId);
-            if (sched) {
-              classId = sched.class_id;
-            }
-          }
-          const pickedTimeStr = elData.pickedTime || (/* @__PURE__ */ new Date()).toISOString();
-          const pickedTime = new Date(pickedTimeStr).getTime();
-          const rollcallId = `rollcall-${elementId}-${pickedTime}`;
-          const exists = kernelContainer.db.prepare("SELECT id FROM student_rollcalls WHERE id = ?").get(rollcallId);
-          if (!exists) {
-            kernelContainer.db.prepare(
-              "INSERT INTO student_rollcalls (id, student_id, class_id, lesson_id, picked_time) VALUES (?, ?, ?, ?, ?)"
-            ).run(rollcallId, studentId, classId, lessonId, pickedTime);
-            console.log(`[Rollcall] Saved rollcall for student ${studentId} (${studentName})`);
-            io.emit("student-picked", {
-              rollcallId,
-              studentId,
-              studentName,
-              classId,
-              lessonId,
-              pickedTime
-            });
-          }
-        }
-      }
-    } catch (e) {
-      console.error("Error handling rollcall element:", e);
-    }
-  };
-  kernelContainer.eventBus.subscribe("whiteboard.element_drawn", (event) => {
-    try {
-      const payload = event.payload;
-      if (payload.type === "rollcall") {
-        handleRollcallElement(payload.elementId);
-      }
-      if (payload.lessonId) {
-        const syncMsg = { roomId: payload.lessonId, type: "refresh" };
-        io.to(payload.lessonId).emit("whiteboard-sync", syncMsg);
-        io.to("whiteboard-broadcast").emit("whiteboard-sync", syncMsg);
-        console.log(`[EventBus -> Socket.IO] Broadcast whiteboard refresh for lesson "${payload.lessonId}" (element: "${payload.elementId}", type: "${payload.type}")`);
-      }
-    } catch (e) {
-      console.error("[EventBus -> Socket.IO] Error processing whiteboard.element_drawn:", e);
-    }
-  });
-  kernelContainer.eventBus.subscribe("whiteboard.element_updated", (event) => {
-    try {
-      const payload = event.payload;
-      handleRollcallElement(payload.elementId);
-    } catch (e) {
-      console.error("[EventBus -> Socket.IO] Error processing whiteboard.element_updated for rollcall:", e);
-    }
-  });
-  kernelContainer.eventBus.subscribe("whiteboard.batch_drawn", (event) => {
-    try {
-      const payload = event.payload;
-      if (payload.lessonId) {
-        io.to(payload.lessonId).emit("whiteboard-sync", {
-          roomId: payload.lessonId,
-          type: "refresh"
-        });
-        console.log(`[EventBus -> Socket.IO] Broadcast refresh after batch_draw (${payload.count} elements) for lesson "${payload.lessonId}"`);
-      }
-    } catch (e) {
-      console.error("[EventBus -> Socket.IO] Error processing whiteboard.batch_drawn:", e);
-    }
-  });
-  kernelContainer.eventBus.subscribe("whiteboard.element_deleted", (event) => {
-    try {
-      const payload = event.payload;
-      if (payload.lessonId) {
-        io.to(payload.lessonId).emit("whiteboard-sync", {
-          roomId: payload.lessonId,
-          type: "refresh"
-        });
-      }
-    } catch (e) {
-      console.error("[EventBus -> Socket.IO] Error processing whiteboard.element_deleted:", e);
-    }
-  });
-  kernelContainer.eventBus.subscribe("whiteboard.cleared", (event) => {
-    try {
-      const payload = event.payload;
-      if (payload.lessonId) {
-        io.to(payload.lessonId).emit("whiteboard-sync", {
-          roomId: payload.lessonId,
-          type: "refresh"
-        });
-      }
-    } catch (e) {
-      console.error("[EventBus -> Socket.IO] Error processing whiteboard.cleared:", e);
-    }
-  });
-  kernelContainer.eventBus.subscribe("spotlight:state_updated", (event) => {
-    try {
-      io.emit("spotlight:state_updated", event.payload);
-    } catch (e) {
-      console.error("[EventBus -> Socket.IO] Error processing spotlight:state_updated:", e);
-    }
-  });
-  kernelContainer.eventBus.subscribe("spotlight.state_updated", (event) => {
-    try {
-      io.emit("spotlight:state_updated", event.payload);
-    } catch (e) {
-      console.error("[EventBus -> Socket.IO] Error processing spotlight.state_updated:", e);
-    }
-  });
-  const onlineStudents = /* @__PURE__ */ new Map();
-  const activeStudentLessons = /* @__PURE__ */ new Map();
-  const broadcastPresence = () => {
-    io.emit("presence-update", {
-      onlineStudentIds: Array.from(onlineStudents.keys()),
-      activeStudentLessons: Object.fromEntries(activeStudentLessons.entries())
-    });
-  };
-  io.on("connection", (socket) => {
-    let registeredStudentId = null;
-    socket.on("register-student", (data) => {
-      registeredStudentId = data.studentId;
-      onlineStudents.set(data.studentId, { socketId: socket.id, name: data.name });
-      console.log(`[Presence] Student online: ${data.name} (${data.studentId})`);
-      broadcastPresence();
-    });
-    socket.on("enter-lesson", (data) => {
-      activeStudentLessons.set(data.studentId, data.lessonId);
-      socket.join(data.lessonId);
-      console.log(`[Presence] Student ${data.studentId} entered lesson ${data.lessonId}`);
-      broadcastPresence();
-      const activeSeg = lessonActiveSegments.get(data.lessonId);
-      if (activeSeg) {
-        socket.emit("student-active-segment-changed", {
-          lessonId: data.lessonId,
-          activeSegmentId: activeSeg
-        });
-      }
-    });
-    socket.on("leave-lesson", (data) => {
-      const oldRoom = activeStudentLessons.get(data.studentId);
-      if (oldRoom) {
-        socket.leave(oldRoom);
-      }
-      activeStudentLessons.delete(data.studentId);
-      console.log(`[Presence] Student ${data.studentId} left lesson`);
-      broadcastPresence();
-    });
-    socket.on("join-room", (roomId) => {
-      socket.join(roomId);
-    });
-    socket.on("whiteboard-update", (data) => {
-      socket.to(data.roomId).emit("whiteboard-sync", data);
-    });
-    socket.on("whiteboard-event", (data) => {
-      kernelContainer.eventBus.publish({
-        id: data.id,
-        type: data.type,
-        source: "whiteboard",
-        payload: data.payload,
-        timestamp: data.timestamp,
-        correlationId: data.payload.lessonId
-      });
-      const lessonId = data.payload.lessonId;
-      if (lessonId) {
-        const roomName = lessonId.startsWith("assignment-") ? lessonId : `lesson-${lessonId}`;
-        socket.to(data.payload.lessonId).emit("whiteboard-sync", {
-          type: "refresh",
-          sourceEvent: data.type
-        });
-      }
-    });
-    socket.on("teacher-broadcast-segment", (data) => {
-      lessonActiveSegments.set(data.lessonId, data.activeSegmentId);
-      io.to(data.lessonId).emit("student-active-segment-changed", data);
-    });
-    socket.on("teacher-ping-student", (data) => {
-      console.log(`[Ping] Teacher pinged student ${data.studentId} for lesson ${data.lessonId}`);
-      const studentOnlineInfo = onlineStudents.get(data.studentId);
-      if (studentOnlineInfo) {
-        io.to(studentOnlineInfo.socketId).emit("student-pinged", {
-          lessonId: data.lessonId,
-          message: data.message
-        });
-      }
-    });
-    socket.on("disconnect", () => {
-      if (registeredStudentId) {
-        onlineStudents.delete(registeredStudentId);
-        activeStudentLessons.delete(registeredStudentId);
-        console.log(`[Presence] Student offline: ${registeredStudentId}`);
-        broadcastPresence();
-      }
-    });
-    socket.emit("presence-update", {
-      onlineStudentIds: Array.from(onlineStudents.keys()),
-      activeStudentLessons: Object.fromEntries(activeStudentLessons.entries())
-    });
-  });
+  setupRealtimeBridge({ eventBus: kernelContainer.eventBus, io, db: kernelContainer.db });
+  setupPresence({ io, eventBus: kernelContainer.eventBus });
   if (process.env.NODE_ENV !== "production") {
     const vite = await (0, import_vite.createServer)({
       server: {