openlearn-next 0.2.9 → 0.3.1

package/dist/server.cjs

@@ -1557,7 +1557,7 @@ var init_service_host = __esm({
     init_plugin_namespace();
     STACK_CAP = 4096;
     ServiceHost = class {
-      constructor(serviceRegistry, capabilityGuard, pluginActorId, manifestCapabilities, eventBus, eventForwarder, pluginId) {
+      constructor(serviceRegistry, capabilityGuard, pluginActorId, manifestCapabilities, eventBus, eventForwarder, pluginId, dbPluginId) {
         this.serviceRegistry = serviceRegistry;
         this.capabilityGuard = capabilityGuard;
         this.pluginActorId = pluginActorId;
@@ -1565,6 +1565,7 @@ var init_service_host = __esm({
         this.eventBus = eventBus;
         this.eventForwarder = eventForwarder;
         this.pluginId = pluginId;
+        this.dbPluginId = dbPluginId;
         /**
          * @param serviceRegistry - DI container for resolving service instances
          * @param capabilityGuard - CapabilityGuard instance (sync access, NOT async ICapabilityService wrapper)
@@ -1974,13 +1975,30 @@ var init_service_host = __esm({
       /**
        * Security barrier for Worker plugin IDatabase RPC access.
        *
-       * 1. Blocks access to core security tables (auth/session/plugin/admin).
-       * 2. Restricts DDL (CREATE/DROP/ALTER TABLE) to the plugin's own namespace
-       *    (`plugin_<id>_` prefix).
+       * 1. Blocks dangerous SQLite low-level operations (ATTACH, DETACH, PRAGMA, TRIGGERS, VIEWS, VACUUM).
+       * 2. Blocks access to all platform core tables (auth, sessions, roster, grading, lessons, etc.).
+       * 3. Restricts DDL (CREATE/DROP/ALTER TABLE) strictly to the plugin's own namespace (`plugin_<id>_` prefix).
        */
       assertDatabaseAccessAllowed(sql) {
         if (typeof sql !== "string" || sql.trim() === "") return;
         const pluginId = this.pluginId || this.pluginActorId.replace(/^plugin:/, "");
+        const FORBIDDEN_OPERATIONS = [
+          /\bATTACH(?:\s+DATABASE)?\b/i,
+          /\bDETACH(?:\s+DATABASE)?\b/i,
+          /\bPRAGMA\b/i,
+          /\bVACUUM\b/i,
+          /\bCREATE\s+(?:TEMP(?:ORARY)?\s+)?(?:TRIGGER|VIEW)\b/i,
+          /\bDROP\s+(?:TEMP(?:ORARY)?\s+)?(?:TRIGGER|VIEW)\b/i
+        ];
+        for (const opRegex of FORBIDDEN_OPERATIONS) {
+          if (opRegex.test(sql)) {
+            throw new WorkerCapabilityError(
+              this.pluginActorId,
+              "@openlearn/core:IDatabase",
+              `Worker plugin "${pluginId}" is forbidden from executing dangerous statement "${sql.trim()}"`
+            );
+          }
+        }
         const FORBIDDEN_CORE_TABLES = [
           "users",
           "client_sessions",
@@ -1988,26 +2006,54 @@ var init_service_host = __esm({
           "plugin_storage",
           "ai_providers",
           "processes",
-          "pending_commands"
+          "pending_commands",
+          "classes",
+          "students",
+          "class_students",
+          "lessons",
+          "assignments",
+          "assignment_submissions",
+          "attendance",
+          "schedules",
+          "class_grade_weights",
+          "exams",
+          "exam_scores",
+          "student_semester_reports",
+          "student_rollcalls",
+          "student_seats",
+          "student_read_notifications",
+          "student_lesson_progress",
+          "courseware",
+          "courseware_attempt",
+          "system_resources",
+          "events",
+          "_migrations"
         ];
-        for (const table of FORBIDDEN_CORE_TABLES) {
-          if (new RegExp(`\\b${table}\\b`, "i").test(sql)) {
+        const ddlMatch = /^\s*(CREATE|DROP|ALTER)\s+TABLE\s+(?:IF\s+(?:NOT\s+)?EXISTS\s+)?["'`]?([a-zA-Z_][\w]*)["'`]?/i.exec(sql);
+        if (ddlMatch) {
+          const table = ddlMatch[2];
+          const validNamespaces = [];
+          if (this.dbPluginId) {
+            validNamespaces.push(`plugin_${this.dbPluginId.replace(/[^a-zA-Z0-9_]/g, "_")}_`);
+          }
+          if (pluginId) {
+            validNamespaces.push(`plugin_${pluginId.replace(/[^a-zA-Z0-9_]/g, "_")}_`);
+          }
+          const isAllowed = validNamespaces.some((ns) => table.startsWith(ns));
+          if (!isAllowed) {
             throw new WorkerCapabilityError(
               this.pluginActorId,
               "@openlearn/core:IDatabase",
-              `Worker plugin "${pluginId}" is forbidden from accessing core security table "${table}"`
+              `Worker plugin "${pluginId}" is not permitted to perform DDL on table "${table}"`
             );
           }
         }
-        const ddlMatch = /^\s*(CREATE|DROP|ALTER)\s+TABLE\s+(?:IF\s+(?:NOT\s+)?EXISTS\s+)?["'`]?([a-zA-Z_][\w]*)["'`]?/i.exec(sql);
-        if (ddlMatch) {
-          const table = ddlMatch[2];
-          const namespace = `plugin_${pluginId.replace(/-/g, "_")}_`;
-          if (!table.startsWith(namespace)) {
+        for (const table of FORBIDDEN_CORE_TABLES) {
+          if (new RegExp(`\\b${table}\\b`, "i").test(sql)) {
             throw new WorkerCapabilityError(
               this.pluginActorId,
               "@openlearn/core:IDatabase",
-              `Worker plugin "${pluginId}" is not permitted to perform DDL on table "${table}"`
+              `Worker plugin "${pluginId}" is forbidden from accessing core security table "${table}"`
             );
           }
         }
@@ -3078,7 +3124,11 @@ var init_worker_manager = __esm({
             workerData: { pluginId, manifestId: manifest.id, serviceTokens, pluginDir },
             eval: false,
             stdout: true,
-            stderr: true
+            stderr: true,
+            resourceLimits: {
+              maxOldGenerationSizeMb: 128,
+              maxYoungGenerationSizeMb: 32
+            }
           });
           const pluginLogger = createLogger(`Plugin:${manifest.id || pluginId}`);
           worker.stdout.on("data", (chunk) => {
@@ -3110,7 +3160,8 @@ var init_worker_manager = __esm({
           // `manifest.id` (NOT the DB UUID `pluginId`) so the prefix
           // matches what the frontend `ctx.invokeCommand` produces —
           // see packages/core/plugin-host/plugin-namespace.ts.
-          manifest.id
+          manifest.id,
+          pluginId
         );
         const createdAt = Date.now();
         this.registry.register(pluginId, {
@@ -3283,8 +3334,8 @@ __export(server_exports, {
 });
 module.exports = __toCommonJS(server_exports);
 var import_express3 = __toESM(require("express"), 1);
-var import_path14 = __toESM(require("path"), 1);
-var import_fs13 = __toESM(require("fs"), 1);
+var import_path15 = __toESM(require("path"), 1);
+var import_fs14 = __toESM(require("fs"), 1);
 var import_dotenv = __toESM(require("dotenv"), 1);
 var import_vite = require("vite");
 var import_http = require("http");
@@ -3831,6 +3882,7 @@ function parseRequiresEntry(entry) {
 // packages/core/db/index.ts
 var import_better_sqlite3 = __toESM(require("better-sqlite3"), 1);
 var import_path = __toESM(require("path"), 1);
+var import_os = __toESM(require("os"), 1);
 var import_fs = require("fs");
 var import_url = require("url");
 var import_crypto = __toESM(require("crypto"), 1);
@@ -3854,6 +3906,11 @@ var dbPath;
 if (process.env.OPENLEARN_DB_PATH) {
   dbPath = process.env.OPENLEARN_DB_PATH;
   (0, import_fs.mkdirSync)(import_path.default.dirname(dbPath), { recursive: true });
+} else if (process.env.VITEST) {
+  const poolId = process.env.VITEST_POOL_ID || process.pid;
+  const testDbDir = import_path.default.join(import_os.default.tmpdir(), "openlearn_test_dbs");
+  (0, import_fs.mkdirSync)(testDbDir, { recursive: true });
+  dbPath = import_path.default.join(testDbDir, `openlearn_test_${poolId}.db`);
 } else {
   if (typeof import_meta !== "undefined" && import_meta.url) {
     const __filename2 = (0, import_url.fileURLToPath)(import_meta.url);
@@ -3884,6 +3941,7 @@ db.exec(`
     timeline TEXT,
     progress_mode TEXT DEFAULT 'manual',
     progress_conditions TEXT,
+    creator_id TEXT,
     created_at INTEGER NOT NULL,
     updated_at INTEGER NOT NULL
   );
@@ -4221,6 +4279,10 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_assignments_class ON assignments(class_id);
   CREATE INDEX IF NOT EXISTS idx_attendance_schedule ON attendance(schedule_id);
 `);
+try {
+  db.exec("ALTER TABLE lessons ADD COLUMN creator_id TEXT");
+} catch {
+}
 try {
   db.exec(`ALTER TABLE plugins ADD COLUMN execution_mode TEXT DEFAULT 'inline'`);
 } catch {
@@ -4317,6 +4379,9 @@ try {
     const insertStmt = db.prepare("INSERT INTO users (id, username, password_hash, role, name, created_at) VALUES (?, ?, ?, ?, ?, ?)");
     insertStmt.run("usr_admin", "admin", hashPassword("admin"), "administrator", "System Admin", Date.now());
     insertStmt.run("usr_teacher", "teacher", hashPassword("teacher"), "teacher", "Regular Teacher", Date.now());
+    console.warn(
+      "[SECURITY WARNING] Default users initialized (admin/admin, teacher/teacher). In production environments, immediately change these passwords via POST /api/auth/change-password!"
+    );
   }
 } catch (e) {
   console.error("Failed to seed default users:", e);
@@ -5671,13 +5736,15 @@ var BuiltinPlugin = {
       async execute(command) {
         const payload = command.payload;
         const lessonId = (0, import_uuid6.v7)();
-        const stmt = db2.prepare("INSERT INTO lessons (id, title, content, created_at, updated_at) VALUES (?, ?, ?, ?, ?)");
-        stmt.run(lessonId, payload.title, payload.content || "", Date.now(), Date.now());
+        const rawCreatorId = payload.creatorId || command.actorId || "admin";
+        const creatorId = typeof rawCreatorId === "string" && rawCreatorId.startsWith("user:") ? rawCreatorId.split(":")[1] : rawCreatorId;
+        const stmt = db2.prepare("INSERT INTO lessons (id, title, content, creator_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)");
+        stmt.run(lessonId, payload.title, payload.content || "", creatorId, Date.now(), Date.now());
         await eventBus.publish({
           id: (0, import_uuid6.v7)(),
           type: "lesson.created",
           source: "builtin.lesson",
-          payload: { id: lessonId, title: payload.title },
+          payload: { id: lessonId, title: payload.title, creatorId },
           timestamp: Date.now(),
           correlationId: command.id
         });
@@ -6650,12 +6717,27 @@ var BuiltinPlugin = {
         const base64Content = base64Data.replace(/^data:[^;]+;base64,/, "");
         const fileBuffer = Buffer.from(base64Content, "base64");
         if (ext === ".html" || ext === ".htm") {
-          const entryName = filename;
-          import_fs3.default.writeFileSync(import_path3.default.join(storageDir, entryName), fileBuffer);
+          const entryName = import_path3.default.basename(filename.replace(/\\/g, "/"));
+          if (!entryName || entryName === "." || entryName === "..") {
+            throw new Error("Invalid courseware filename");
+          }
+          const destPath = import_path3.default.resolve(storageDir, entryName);
+          if (!destPath.startsWith(storageDir)) {
+            throw new Error(`Path traversal attempt in HTML courseware upload: ${filename}`);
+          }
+          import_fs3.default.writeFileSync(destPath, fileBuffer);
           const coursewareId = "cw_" + import_crypto3.default.randomBytes(8).toString("hex");
           db2.prepare(
             "INSERT INTO courseware (id, uuid, name, type, entry, created_at) VALUES (?, ?, ?, ?, ?, ?)"
           ).run(coursewareId, uuid, name, "html", entryName, Date.now());
+          try {
+            const resId = "res_" + import_crypto3.default.randomBytes(8).toString("hex");
+            db2.prepare(
+              "INSERT INTO system_resources (id, name, type, content, created_at) VALUES (?, ?, ?, ?, ?)"
+            ).run(resId, name, "html", fileBuffer.toString("utf-8"), Date.now());
+          } catch (resErr) {
+            console.error("[builtin.courseware] \u767B\u8BB0 system_resources \u5931\u8D25:", resErr);
+          }
           await eventBus.publish({
             id: (0, import_uuid6.v7)(),
             type: "courseware.uploaded",
@@ -6744,6 +6826,23 @@ var BuiltinPlugin = {
             db2.prepare(
               "INSERT INTO courseware (id, uuid, name, type, entry, created_at) VALUES (?, ?, ?, ?, ?, ?)"
             ).run(coursewareId, uuid, name, "folder", entry, Date.now());
+            try {
+              const resFiles = [];
+              for (const [relativePath, file] of Object.entries(loadedZip.files)) {
+                const fileObj = file;
+                if (!fileObj.dir) {
+                  const buf = await fileObj.async("nodebuffer");
+                  const isBinary = /\.(png|jpe?g|gif|webp|ico|mp3|wav|mp4|woff2?|ttf|otf|eot)$/i.test(relativePath);
+                  resFiles.push({ path: relativePath, content: isBinary ? buf.toString("base64") : buf.toString("utf-8") });
+                }
+              }
+              const resId = "res_" + import_crypto3.default.randomBytes(8).toString("hex");
+              db2.prepare(
+                "INSERT INTO system_resources (id, name, type, content, created_at) VALUES (?, ?, ?, ?, ?)"
+              ).run(resId, name, "folder", JSON.stringify(resFiles), Date.now());
+            } catch (resErr) {
+              console.error("[builtin.courseware] \u767B\u8BB0 system_resources \u5931\u8D25:", resErr);
+            }
             await eventBus.publish({
               id: (0, import_uuid6.v7)(),
               type: "courseware.uploaded",
@@ -7582,7 +7681,7 @@ var import_node_url = require("node:url");
 var esbuild = __toESM(require("esbuild"), 1);
 var import_jszip = __toESM(require("jszip"), 1);
 var fs3 = __toESM(require("fs"), 1);
-var os = __toESM(require("os"), 1);
+var os2 = __toESM(require("os"), 1);
 var path4 = __toESM(require("path"), 1);
 var import_uuid10 = require("uuid");
 var MAX_UNCOMPRESSED_SIZE = 300 * 1024 * 1024;
@@ -7670,7 +7769,7 @@ async function validateAndBundleZip(zipBuffer) {
     );
   }
   const entryCode = await entryFile.async("string");
-  const tmpDir = path4.join(os.tmpdir(), `plugin-build-${(0, import_uuid10.v7)()}`);
+  const tmpDir = path4.join(os2.tmpdir(), `plugin-build-${(0, import_uuid10.v7)()}`);
   try {
     fs3.mkdirSync(tmpDir, { recursive: true });
     for (const [name, file] of Object.entries(zip.files)) {
@@ -8460,11 +8559,11 @@ var PluginDistributionManager = class {
       return;
     }
     const filePath = this.pluginHost.getPluginFilePath(this.pluginHost.resolvePluginUuid(pluginId));
-    const fs15 = await import("node:fs");
-    if (!fs15.existsSync(filePath)) {
+    const fs16 = await import("node:fs");
+    if (!fs16.existsSync(filePath)) {
       throw new Error(`Cannot reload plugin "${pluginId}": source file missing at ${filePath}`);
     }
-    const code = fs15.readFileSync(filePath, "utf-8");
+    const code = fs16.readFileSync(filePath, "utf-8");
     await this.pluginHost.reloadPlugin(pluginId, code);
   }
   async updateFromZip(zipBuffer, options = {}) {
@@ -8511,6 +8610,16 @@ function validatePluginStateTransition(currentState, nextState, pluginId) {
 var ACTIVATION_TIMEOUT_MS = 5e3;
 var DEACTIVATION_TIMEOUT_MS = 5e3;
 var OPENLEARN_VERSION = "0.2.5";
+function createPluginStaticMiddleware(absDir) {
+  return [
+    (_req, res, next) => {
+      res.setHeader("Content-Security-Policy", "sandbox allow-scripts allow-forms allow-downloads; default-src 'self' 'unsafe-inline' blob: data:");
+      res.setHeader("X-Content-Type-Options", "nosniff");
+      next();
+    },
+    import_express.default.static(absDir)
+  ];
+}
 var PluginHost = class {
   constructor(serviceRegistry, esmLoader, db2, pluginsDir) {
     this.serviceRegistry = serviceRegistry;
@@ -8556,7 +8665,7 @@ var PluginHost = class {
           const pluginDir = this.getPluginDir(p.id);
           const absDir = import_path4.default.join(pluginDir, m.deploy.staticDir);
           if (import_fs5.default.existsSync(absDir)) {
-            this.expressApp.use(m.deploy.staticRoute, import_express.default.static(absDir));
+            this.expressApp.use(m.deploy.staticRoute, ...createPluginStaticMiddleware(absDir));
             this._registeredRoutes.set(m.id, m.deploy.staticRoute);
             console.log(`[PluginHost] Restored static route "${m.deploy.staticRoute}" for plugin "${m.id}"`);
           }
@@ -9766,10 +9875,15 @@ var PluginHost = class {
         import_fs5.default.writeFileSync(import_path4.default.join(pluginDir, "frontend.js"), frontendCode, "utf-8");
       }
       if (manifest.deploy?.script) {
+        const rawScript = manifest.deploy.script.replace(/\\/g, "/");
+        const resolvedScript = import_path4.default.resolve(pluginDir, rawScript);
+        if (rawScript.includes("..") || !resolvedScript.startsWith(pluginDir + import_path4.default.sep)) {
+          throw new Error(`Security Violation: Zip Slip detected in deploy script path "${manifest.deploy.script}"`);
+        }
         const deployFile = zip.file(manifest.deploy.script);
         if (deployFile) {
           const deployCode = await deployFile.async("string");
-          import_fs5.default.writeFileSync(import_path4.default.join(pluginDir, manifest.deploy.script), deployCode, "utf-8");
+          import_fs5.default.writeFileSync(resolvedScript, deployCode, "utf-8");
         }
       }
       this.emitProgress(manifest.id, "extracting", "Extracting assets...");
@@ -9779,20 +9893,29 @@ var PluginHost = class {
       if (storageEntries.length > 0) {
         console.log(`[PluginHost] Extracting ${storageEntries.length} static asset files for plugin "${manifest.id}"...`);
         const dirs = /* @__PURE__ */ new Set();
-        for (const name of storageEntries) {
-          dirs.add(import_path4.default.dirname(name));
+        for (const rawName of storageEntries) {
+          const normalized = rawName.replace(/\\/g, "/");
+          const destPath = import_path4.default.resolve(pluginDir, normalized);
+          if (normalized.includes("..") || !destPath.startsWith(pluginDir + import_path4.default.sep)) {
+            throw new Error(`Security Violation: Zip Slip detected in asset path "${rawName}"`);
+          }
+          dirs.add(import_path4.default.dirname(destPath));
         }
         for (const dir of dirs) {
-          import_fs5.default.mkdirSync(import_path4.default.join(pluginDir, dir), { recursive: true });
+          import_fs5.default.mkdirSync(dir, { recursive: true });
         }
         const BATCH_SIZE = 10;
         for (let i = 0; i < storageEntries.length; i += BATCH_SIZE) {
           const batch = storageEntries.slice(i, i + BATCH_SIZE);
           await Promise.all(batch.map(async (name) => {
+            const normalized = name.replace(/\\/g, "/");
+            const destPath = import_path4.default.resolve(pluginDir, normalized);
+            if (normalized.includes("..") || !destPath.startsWith(pluginDir + import_path4.default.sep)) {
+              throw new Error(`Security Violation: Zip Slip detected in asset path "${name}"`);
+            }
             const file = zip.file(name);
             if (file) {
               const content = await file.async("nodebuffer");
-              const destPath = import_path4.default.join(pluginDir, name);
               import_fs5.default.writeFileSync(destPath, content);
             }
           }));
@@ -9810,7 +9933,7 @@ var PluginHost = class {
           };
           import_fs5.default.writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2), "utf-8");
           const { execSync: execSync2 } = await import("node:child_process");
-          execSync2("npm install --production --no-audit --no-fund --legacy-peer-deps --registry=https://registry.npmmirror.com", {
+          execSync2("npm install --production --no-audit --no-fund --legacy-peer-deps --ignore-scripts --registry=https://registry.npmmirror.com", {
             cwd: pluginDir,
             stdio: "ignore"
           });
@@ -9820,30 +9943,36 @@ var PluginHost = class {
         }
       }
       if (manifest.deploy?.script) {
-        let deployScriptPath = import_path4.default.join(pluginDir, manifest.deploy.script);
-        if (!import_fs5.default.existsSync(deployScriptPath)) {
-          const altPath = import_path4.default.join(process.cwd(), "v2_plugins", "scratch-editor-deploy", manifest.deploy.script);
-          if (import_fs5.default.existsSync(altPath)) deployScriptPath = altPath;
-        }
-        if (import_fs5.default.existsSync(deployScriptPath)) {
-          console.log(`[PluginHost] Running deploy script: node ${deployScriptPath}`);
-          try {
-            const { execSync: execSync2 } = await import("node:child_process");
-            execSync2(`node "${deployScriptPath}" "${process.cwd()}"`, { timeout: 12e4 });
-            console.log(`[PluginHost] Deploy script completed for plugin "${manifest.id}"`);
-          } catch (deployErr) {
-            console.error(`[PluginHost] Deploy script failed for plugin "${manifest.id}":`, deployErr.message);
-            throw new Error(`Deploy script "${manifest.deploy.script}" failed: ${deployErr.message}`);
-          }
+        if (process.env.ALLOW_UNSAFE_PLUGIN_SCRIPTS !== "true") {
+          console.warn(
+            `[SECURITY WARNING] Deploy script "${manifest.deploy.script}" for plugin "${manifest.id}" blocked by default security policy. Set ALLOW_UNSAFE_PLUGIN_SCRIPTS=true to enable.`
+          );
         } else {
-          console.warn(`[PluginHost] Deploy script "${manifest.deploy.script}" not found for plugin "${manifest.id}"`);
+          let deployScriptPath = import_path4.default.join(pluginDir, manifest.deploy.script);
+          if (!import_fs5.default.existsSync(deployScriptPath)) {
+            const altPath = import_path4.default.join(process.cwd(), "v2_plugins", "scratch-editor-deploy", manifest.deploy.script);
+            if (import_fs5.default.existsSync(altPath)) deployScriptPath = altPath;
+          }
+          if (import_fs5.default.existsSync(deployScriptPath)) {
+            console.log(`[PluginHost] Running deploy script: node ${deployScriptPath}`);
+            try {
+              const { execSync: execSync2 } = await import("node:child_process");
+              execSync2(`node "${deployScriptPath}" "${process.cwd()}"`, { timeout: 12e4 });
+              console.log(`[PluginHost] Deploy script completed for plugin "${manifest.id}"`);
+            } catch (deployErr) {
+              console.error(`[PluginHost] Deploy script failed for plugin "${manifest.id}":`, deployErr.message);
+              throw new Error(`Deploy script "${manifest.deploy.script}" failed: ${deployErr.message}`);
+            }
+          } else {
+            console.warn(`[PluginHost] Deploy script "${manifest.deploy.script}" not found for plugin "${manifest.id}"`);
+          }
         }
       }
       if (manifest.deploy?.staticRoute && manifest.deploy?.staticDir && this.expressApp) {
         const route = manifest.deploy.staticRoute;
         const absDir = import_path4.default.join(pluginDir, manifest.deploy.staticDir);
         if (import_fs5.default.existsSync(absDir)) {
-          this.expressApp.use(route, import_express.default.static(absDir));
+          this.expressApp.use(route, ...createPluginStaticMiddleware(absDir));
           this._registeredRoutes.set(manifest.id, route);
           console.log(`[PluginHost] Registered static route "${route}" for plugin "${manifest.id}"`);
         } else {
@@ -10580,8 +10709,8 @@ var HotReloadController = class {
     const timer = setTimeout(async () => {
       this.debounceTimers.delete(pluginId);
       try {
-        const fs15 = await import("fs/promises");
-        const newSourceCode = await fs15.readFile(filePath, "utf-8");
+        const fs16 = await import("fs/promises");
+        const newSourceCode = await fs16.readFile(filePath, "utf-8");
         console.log(
           `[HotReload] File changed: ${filePath} \u2192 triggering reload for "${pluginId}"`
         );
@@ -17372,13 +17501,22 @@ function setupPresence({ io, eventBus }) {
   };
   io.on("connection", (socket) => {
     let registeredStudentId = null;
+    const session = socket.data?.session;
+    const isTeacherOrAdmin = session?.role === "teacher" || session?.role === "administrator";
     socket.on("register-student", (data) => {
+      if (session && !isTeacherOrAdmin && session.userId !== data.studentId) {
+        console.warn(`[Presence Security] Student ${session.userId} attempted to impersonate ${data.studentId}`);
+        return socket.emit("error", { message: "Forbidden: Cannot register presence for another student" });
+      }
       registeredStudentId = data.studentId;
       onlineStudents.set(data.studentId, { socketId: socket.id, name: data.name });
       console.log(`[Presence] Student online: ${data.name} (${data.studentId})`);
       broadcastPresence();
     });
     socket.on("enter-lesson", (data) => {
+      if (session && !isTeacherOrAdmin && session.userId !== data.studentId) {
+        return socket.emit("error", { message: "Forbidden: Cannot enter lesson for another student" });
+      }
       activeStudentLessons.set(data.studentId, data.lessonId);
       socket.join(data.lessonId);
       console.log(`[Presence] Student ${data.studentId} entered lesson ${data.lessonId}`);
@@ -17392,6 +17530,9 @@ function setupPresence({ io, eventBus }) {
       }
     });
     socket.on("leave-lesson", (data) => {
+      if (session && !isTeacherOrAdmin && session.userId !== data.studentId) {
+        return socket.emit("error", { message: "Forbidden: Cannot leave lesson for another student" });
+      }
       const oldRoom = activeStudentLessons.get(data.studentId);
       if (oldRoom) {
         socket.leave(oldRoom);
@@ -17428,10 +17569,18 @@ function setupPresence({ io, eventBus }) {
       }
     );
     socket.on("teacher-broadcast-segment", (data) => {
+      if (session && !isTeacherOrAdmin) {
+        console.warn(`[Presence Security] Unauthorized teacher-broadcast-segment by ${session?.userId}`);
+        return socket.emit("error", { message: "Forbidden: Only teachers or administrators can broadcast segments" });
+      }
       lessonActiveSegments.set(data.lessonId, data.activeSegmentId);
       io.to(data.lessonId).emit("student-active-segment-changed", data);
     });
     socket.on("teacher-ping-student", (data) => {
+      if (session && !isTeacherOrAdmin) {
+        console.warn(`[Presence Security] Unauthorized teacher-ping-student by ${session?.userId}`);
+        return socket.emit("error", { message: "Forbidden: Only teachers or administrators can ping students" });
+      }
       console.log(`[Ping] Teacher pinged student ${data.studentId} for lesson ${data.lessonId}`);
       const studentOnlineInfo = onlineStudents.get(data.studentId);
       if (studentOnlineInfo) {
@@ -17539,6 +17688,83 @@ async function runStartupMigrations(db2) {
   }
 }
 
+// server/utils/migrate.ts
+var import_fs7 = __toESM(require("fs"), 1);
+var import_path6 = __toESM(require("path"), 1);
+function splitSqlStatements(sql) {
+  return sql.split(";").map((s) => s.trim()).filter((s) => {
+    const content = s.replace(/--.*$/gm, "").trim();
+    return content.length > 0;
+  });
+}
+function parseMigrationSql(name, content) {
+  const upMatch = content.match(/--\s*UP([\s\S]*?)(?=--\s*DOWN|$)/i);
+  const downMatch = content.match(/--\s*DOWN([\s\S]*)$/i);
+  const up = upMatch ? upMatch[1].trim() : content.trim();
+  const down = downMatch ? downMatch[1].trim() : "";
+  return { name, up, down };
+}
+function loadMigrationsFromDirectory(dirPath) {
+  if (!import_fs7.default.existsSync(dirPath)) {
+    return [];
+  }
+  const files = import_fs7.default.readdirSync(dirPath).filter((f) => f.endsWith(".sql")).sort((a, b) => a.localeCompare(b, void 0, { numeric: true, sensitivity: "base" }));
+  return files.map((file) => {
+    const fullPath = import_path6.default.join(dirPath, file);
+    const content = import_fs7.default.readFileSync(fullPath, "utf8");
+    const name = import_path6.default.basename(file, ".sql");
+    return parseMigrationSql(name, content);
+  });
+}
+function executeSqlStatements(db2, sql) {
+  const statements = splitSqlStatements(sql);
+  for (const stmt of statements) {
+    try {
+      db2.exec(stmt);
+    } catch (err) {
+      if (err?.message && err.message.includes("duplicate column name")) {
+        console.warn(`[Migration] Column already exists, safely continuing: ${stmt.slice(0, 60)}...`);
+        continue;
+      }
+      throw err;
+    }
+  }
+}
+function runMigrations(db2, migrations) {
+  db2.exec(`
+    CREATE TABLE IF NOT EXISTS _migrations (
+      name TEXT PRIMARY KEY,
+      applied_at INTEGER NOT NULL,
+      checksum TEXT NOT NULL
+    );
+  `);
+  const applied = new Set(
+    db2.prepare("SELECT name FROM _migrations").all().map((r) => r.name)
+  );
+  for (const migration of migrations) {
+    if (applied.has(migration.name)) continue;
+    console.log(`[Migration] Applying: ${migration.name}`);
+    try {
+      executeSqlStatements(db2, migration.up);
+      const checksum = simpleChecksum(migration.up);
+      db2.prepare("INSERT INTO _migrations (name, applied_at, checksum) VALUES (?, ?, ?)").run(migration.name, Date.now(), checksum);
+      console.log(`[Migration] Applied: ${migration.name}`);
+    } catch (err) {
+      console.error(`[Migration] FAILED: ${migration.name}`, err);
+      throw err;
+    }
+  }
+}
+function simpleChecksum(text) {
+  let hash = 0;
+  for (let i = 0; i < text.length; i++) {
+    const char = text.charCodeAt(i);
+    hash = (hash << 5) - hash + char;
+    hash |= 0;
+  }
+  return hash.toString(16);
+}
+
 // server/ai-agent.ts
 var import_genai2 = require("@google/genai");
 var import_crypto4 = __toESM(require("crypto"), 1);
@@ -17850,6 +18076,90 @@ var runOpenAIAgentChat = async (provider, request) => {
   };
 };
 
+// server/middleware/auth.ts
+function getValidSession(token) {
+  let sessionRow;
+  try {
+    sessionRow = kernelContainer.db.prepare("SELECT * FROM client_sessions WHERE id = ?").get(token);
+  } catch {
+    return null;
+  }
+  if (!sessionRow) return null;
+  const now = Date.now();
+  if (sessionRow.expires_at && sessionRow.expires_at < now) {
+    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
+    return null;
+  }
+  const idleTimeout = 24 * 60 * 60 * 1e3;
+  if (sessionRow.updated_at && now - sessionRow.updated_at > idleTimeout) {
+    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
+    return null;
+  }
+  kernelContainer.db.prepare("UPDATE client_sessions SET updated_at = ? WHERE id = ?").run(now, token);
+  return JSON.parse(sessionRow.session_data);
+}
+function getCookieToken(req) {
+  const rc = req.headers.cookie;
+  if (!rc) return null;
+  const parts = rc.split(";");
+  for (const part of parts) {
+    const trimmed = part.trim();
+    if (trimmed.startsWith("edu_os_token=")) {
+      return trimmed.substring("edu_os_token=".length);
+    }
+  }
+  return null;
+}
+function getActorId(req) {
+  const token = getCookieToken(req);
+  if (!token) return "anonymous";
+  try {
+    const session = getValidSession(token);
+    if (!session) return "anonymous";
+    let role = session.subRole || session.role;
+    if (session.username === "admin" || session.userId === "usr_admin" || role === "admin" || role === "administrator") {
+      role = "administrator";
+    }
+    if (role) {
+      return `user:${session.userId || "demo"}:${role}`;
+    }
+    return "anonymous";
+  } catch {
+    return "anonymous";
+  }
+}
+function requireAuth(...roles) {
+  return (req, res, next) => {
+    const token = getCookieToken(req);
+    if (!token) return res.status(401).json({ success: false, error: "Authentication required" });
+    const session = getValidSession(token);
+    if (!session) return res.status(401).json({ success: false, error: "Session expired or invalid" });
+    if (roles.length > 0) {
+      let userRole = session.role;
+      if (session.username === "admin" || session.userId === "usr_admin" || userRole === "admin") {
+        userRole = "administrator";
+      }
+      const effectiveRoles = roles.map((r) => r === "admin" ? "administrator" : r);
+      if (!effectiveRoles.includes(userRole)) {
+        return res.status(403).json({ success: false, error: `Role ${session.role} not allowed. Required: ${roles.join(", ")}` });
+      }
+    }
+    req.session = session;
+    next();
+  };
+}
+function checkIsTeacherOrAdmin(req) {
+  const token = getCookieToken(req);
+  if (!token) return false;
+  try {
+    const session = getValidSession(token);
+    if (!session) return false;
+    return session.role === "teacher" || session.role === "administrator";
+  } catch {
+    return false;
+  }
+}
+
 // packages/core/bootstrap/adapter/bootstrap-registration.ts
 var BootstrapRegistration = class {
   static registerConfiguration(builder, context) {
@@ -18334,28 +18644,28 @@ var IActivityRegistryToken = new Token(
 );
 
 // server/routes/os.ts
-var import_path8 = __toESM(require("path"), 1);
-var import_fs8 = __toESM(require("fs"), 1);
+var import_path9 = __toESM(require("path"), 1);
+var import_fs9 = __toESM(require("fs"), 1);
 var import_child_process = require("child_process");
 var import_crypto7 = __toESM(require("crypto"), 1);
 var import_xss = require("xss");
 
 // server/utils/crypto.ts
 var import_crypto5 = __toESM(require("crypto"), 1);
-var import_fs7 = __toESM(require("fs"), 1);
-var import_path6 = __toESM(require("path"), 1);
+var import_fs8 = __toESM(require("fs"), 1);
+var import_path7 = __toESM(require("path"), 1);
 var _encryptionKey = null;
 function getEncryptionKey() {
   if (_encryptionKey) return _encryptionKey;
-  const envPath = import_path6.default.resolve(process.cwd(), ".env");
+  const envPath = import_path7.default.resolve(process.cwd(), ".env");
   const keyHex = process.env.ENCRYPTION_KEY;
   if (keyHex && keyHex.trim() !== "") {
     _encryptionKey = Buffer.from(keyHex.trim(), "hex");
     return _encryptionKey;
   }
-  if (import_fs7.default.existsSync(envPath)) {
+  if (import_fs8.default.existsSync(envPath)) {
     try {
-      const content = import_fs7.default.readFileSync(envPath, "utf-8");
+      const content = import_fs8.default.readFileSync(envPath, "utf-8");
       const match = content.match(/^ENCRYPTION_KEY=(.+)$/m);
       if (match && match[1].trim() !== "") {
         const fileKeyHex = match[1].trim();
@@ -18369,8 +18679,8 @@ function getEncryptionKey() {
   }
   const newKey = import_crypto5.default.randomBytes(32).toString("hex");
   try {
-    if (import_fs7.default.existsSync(envPath)) {
-      const existingContent = import_fs7.default.readFileSync(envPath, "utf-8");
+    if (import_fs8.default.existsSync(envPath)) {
+      const existingContent = import_fs8.default.readFileSync(envPath, "utf-8");
       if (/^ENCRYPTION_KEY=/m.test(existingContent)) {
         console.warn(
           "[Crypto] ENCRYPTION_KEY missing/empty in .env; NOT overwriting existing entry. Generating ephemeral in-memory key \u2014 please set ENCRYPTION_KEY manually before relying on encrypted storage."
@@ -18379,12 +18689,12 @@ function getEncryptionKey() {
         _encryptionKey = Buffer.from(newKey, "hex");
         return _encryptionKey;
       }
-      import_fs7.default.appendFileSync(envPath, `
+      import_fs8.default.appendFileSync(envPath, `
 ENCRYPTION_KEY=${newKey}
 `);
       console.log("[Crypto] ENCRYPTION_KEY auto-generated and persisted to .env");
     } else {
-      import_fs7.default.writeFileSync(envPath, `ENCRYPTION_KEY=${newKey}
+      import_fs8.default.writeFileSync(envPath, `ENCRYPTION_KEY=${newKey}
 `);
       console.log("[Crypto] .env created with auto-generated ENCRYPTION_KEY");
     }
@@ -18437,142 +18747,58 @@ function detectPromptInjection(input) {
   return PROMPT_INJECTION_PATTERNS.some((p) => p.test(input));
 }
 
-// server/middleware/auth.ts
-function getValidSession(token) {
-  let sessionRow;
+// server/routes/shared.ts
+var import_path8 = __toESM(require("path"), 1);
+var import_crypto6 = __toESM(require("crypto"), 1);
+
+// server/utils/bridge-sdk.ts
+var BRIDGE_SDK_CODE = `(function() {
+  // Mock document.cookie to prevent SecurityError in sandboxed iframes lacking 'allow-same-origin'
   try {
-    sessionRow = kernelContainer.db.prepare("SELECT * FROM client_sessions WHERE id = ?").get(token);
-  } catch {
-    return null;
-  }
-  if (!sessionRow) return null;
-  const now = Date.now();
-  if (sessionRow.expires_at && sessionRow.expires_at < now) {
-    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
-    return null;
+    Object.defineProperty(document, 'cookie', {
+      get: function() { return ""; },
+      set: function(val) {},
+      configurable: true
+    });
+  } catch (e) {
+    try {
+      Object.defineProperty(Document.prototype, 'cookie', {
+        get: function() { return ""; },
+        set: function(val) {},
+        configurable: true
+      });
+    } catch (err) {}
   }
-  const idleTimeout = 24 * 60 * 60 * 1e3;
-  if (sessionRow.updated_at && now - sessionRow.updated_at > idleTimeout) {
-    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
-    return null;
-  }
-  kernelContainer.db.prepare("UPDATE client_sessions SET updated_at = ? WHERE id = ?").run(now, token);
-  return JSON.parse(sessionRow.session_data);
-}
-function getCookieToken(req) {
-  const rc = req.headers.cookie;
-  if (!rc) return null;
-  const parts = rc.split(";");
-  for (const part of parts) {
-    const trimmed = part.trim();
-    if (trimmed.startsWith("edu_os_token=")) {
-      return trimmed.substring("edu_os_token=".length);
-    }
-  }
-  return null;
-}
-function getActorId(req) {
-  const token = getCookieToken(req);
-  if (!token) return "anonymous";
-  try {
-    const session = getValidSession(token);
-    if (!session) return "anonymous";
-    let role = session.subRole || session.role;
-    if (session.username === "admin" || session.userId === "usr_admin" || role === "admin" || role === "administrator") {
-      role = "administrator";
-    }
-    if (role) {
-      return `user:${session.userId || "demo"}:${role}`;
-    }
-    return "anonymous";
-  } catch {
-    return "anonymous";
-  }
-}
-function requireAuth(...roles) {
-  return (req, res, next) => {
-    const token = getCookieToken(req);
-    if (!token) return res.status(401).json({ success: false, error: "Authentication required" });
-    const session = getValidSession(token);
-    if (!session) return res.status(401).json({ success: false, error: "Session expired or invalid" });
-    if (roles.length > 0) {
-      let userRole = session.role;
-      if (session.username === "admin" || session.userId === "usr_admin" || userRole === "admin") {
-        userRole = "administrator";
-      }
-      const effectiveRoles = roles.map((r) => r === "admin" ? "administrator" : r);
-      if (!effectiveRoles.includes(userRole)) {
-        return res.status(403).json({ success: false, error: `Role ${session.role} not allowed. Required: ${roles.join(", ")}` });
-      }
-    }
-    req.session = session;
-    next();
-  };
-}
-function checkIsTeacherOrAdmin(req) {
-  const token = getCookieToken(req);
-  if (!token) return false;
-  try {
-    const session = getValidSession(token);
-    if (!session) return false;
-    return session.role === "teacher" || session.role === "administrator";
-  } catch {
-    return false;
-  }
-}
-
-// server/routes/shared.ts
-var import_path7 = __toESM(require("path"), 1);
-var import_crypto6 = __toESM(require("crypto"), 1);
-
-// server/utils/bridge-sdk.ts
-var BRIDGE_SDK_CODE = `(function() {
-  // Mock document.cookie to prevent SecurityError in sandboxed iframes lacking 'allow-same-origin'
-  try {
-    Object.defineProperty(document, 'cookie', {
-      get: function() { return ""; },
-      set: function(val) {},
-      configurable: true
-    });
-  } catch (e) {
-    try {
-      Object.defineProperty(Document.prototype, 'cookie', {
-        get: function() { return ""; },
-        set: function(val) {},
-        configurable: true
-      });
-    } catch (err) {}
-  }
-
-  // \u2500\u2500 Helper: create a safe postMessage wrapper that normalises 'null' \u2192 '*' \u2500\u2500
-  function __makeSafePostMessage(realTarget, label) {
-    return function(message, targetOrigin, transfer) {
-      try {
-        if (message && typeof message === 'object') {
-          if (!message.attempt_id && window.__LMS_STUDENT__?.attempt_id) {
-            message.attempt_id = window.__LMS_STUDENT__.attempt_id;
-          }
-          if (!message.uuid && window.__LMS_COURSEWARE__?.uuid) {
-            message.uuid = window.__LMS_COURSEWARE__.uuid;
-          }
-        }
-      } catch (e) {}
-
-      var origin = targetOrigin;
-      if (origin === 'null' || origin === null || origin === undefined) {
-        console.warn('[LMS Bridge Notice] Normalized invalid targetOrigin "' + origin + '" to "*" for ' + label);
-        origin = '*';
-      }
-      try {
-        return realTarget.postMessage.call(realTarget, message, origin, transfer);
-      } catch (err) {
-        if (err.name === 'SyntaxError' && origin !== '*') {
-          console.warn('[LMS Bridge Notice] Recovered SyntaxError on ' + label + ', fallback to "*"', err);
-          return realTarget.postMessage.call(realTarget, message, '*', transfer);
-        }
-        throw err;
-      }
-    };
+
+  // \u2500\u2500 Helper: create a safe postMessage wrapper that normalises 'null' \u2192 '*' \u2500\u2500
+  function __makeSafePostMessage(realTarget, label) {
+    return function(message, targetOrigin, transfer) {
+      try {
+        if (message && typeof message === 'object') {
+          if (!message.attempt_id && window.__LMS_STUDENT__?.attempt_id) {
+            message.attempt_id = window.__LMS_STUDENT__.attempt_id;
+          }
+          if (!message.uuid && window.__LMS_COURSEWARE__?.uuid) {
+            message.uuid = window.__LMS_COURSEWARE__.uuid;
+          }
+        }
+      } catch (e) {}
+
+      var origin = targetOrigin;
+      if (origin === 'null' || origin === null || origin === undefined) {
+        console.warn('[LMS Bridge Notice] Normalized invalid targetOrigin "' + origin + '" to "*" for ' + label);
+        origin = '*';
+      }
+      try {
+        return realTarget.postMessage.call(realTarget, message, origin, transfer);
+      } catch (err) {
+        if (err.name === 'SyntaxError' && origin !== '*') {
+          console.warn('[LMS Bridge Notice] Recovered SyntaxError on ' + label + ', fallback to "*"', err);
+          return realTarget.postMessage.call(realTarget, message, '*', transfer);
+        }
+        throw err;
+      }
+    };
   }
 
   // \u2500\u2500 Helper: create a Proxy wrapper around a cross-origin WindowProxy \u2500\u2500
@@ -18683,17 +18909,51 @@ var BRIDGE_SDK_CODE = `(function() {
     }
   } catch (e) {}
 
-  // \u2500\u2500 Bidirectional host\u2192courseware command bus \u2500\u2500
+  // \u2500\u2500 Bidirectional host\u2192courseware command bus & Theme Bridge \u2500\u2500
   var __lmsHandlers = {};
   var __lmsPendingRequests = {};
+
+  function __applyThemeTokens(themeData) {
+    if (!themeData || typeof themeData !== 'object') return;
+    try {
+      window.__LMS_THEME__ = themeData;
+      var docEl = document.documentElement;
+      if (docEl) {
+        if (themeData.theme) {
+          docEl.setAttribute('data-theme', themeData.theme);
+        }
+        if (themeData.tokens && typeof themeData.tokens === 'object') {
+          for (var k in themeData.tokens) {
+            if (Object.prototype.hasOwnProperty.call(themeData.tokens, k)) {
+              docEl.style.setProperty(k, themeData.tokens[k]);
+            }
+          }
+        }
+      }
+    } catch (e) {}
+  }
+
+  if (window.__LMS_THEME__) {
+    __applyThemeTokens(window.__LMS_THEME__);
+  }
+
   window.addEventListener('message', function(event) {
     var d = event.data;
     if (!d || typeof d !== 'object') return;
     if (d.type === 'LMS_HOST_COMMAND' && d.event) {
+      if (d.event === 'theme:changed' && d.payload) {
+        __applyThemeTokens(d.payload);
+      }
       var cbs = __lmsHandlers[d.event] || [];
       for (var i = 0; i < cbs.length; i++) {
         try { cbs[i](d.payload); } catch (e) {}
       }
+    } else if (d.type === 'LMS_THEME_CHANGED' && (d.theme || d.tokens)) {
+      __applyThemeTokens(d);
+      var themeCbs = __lmsHandlers['theme:changed'] || [];
+      for (var j = 0; j < themeCbs.length; j++) {
+        try { themeCbs[j](d); } catch (e) {}
+      }
     } else if (d.type === 'LMS_PROGRESS_RESPONSE' && d.requestId) {
       var pending = __lmsPendingRequests[d.requestId];
       if (pending) {
@@ -18735,6 +18995,9 @@ var BRIDGE_SDK_CODE = `(function() {
     getCourseware() {
       return window.__LMS_COURSEWARE__;
     },
+    getTheme() {
+      return window.__LMS_THEME__ || null;
+    },
     log(event, data) {
       window.parent.postMessage({
         type: "LMS_LOG",
@@ -19147,7 +19410,7 @@ function validateMagicBytes(buffer, fileName) {
     ".webp": [[82, 73, 70, 70]]
     // RIFF
   };
-  const ext = import_path7.default.extname(fileName || "").toLowerCase();
+  const ext = import_path8.default.extname(fileName || "").toLowerCase();
   const signatures = MAGIC_BYTES[ext];
   if (!signatures) return true;
   return signatures.some(
@@ -19250,20 +19513,21 @@ var generateStudentNumber = (db2) => {
   return `S${nextSeq.toString().padStart(3, "0")}`;
 };
 
+// server/utils/error-handler.ts
+function sendSafeError(res, err, status = 500, fallbackMessage = "Internal server error") {
+  const message = err instanceof Error ? err.message : String(err);
+  if (process.env.NODE_ENV !== "test") {
+    console.error(`[API Error ${status}]:`, err);
+  }
+  const isProd = process.env.NODE_ENV === "production";
+  const exposedMessage = isProd ? fallbackMessage : message;
+  return res.status(status).json({ success: false, error: exposedMessage });
+}
+
 // server/routes/os.ts
 function registerOsRoutes(ctx) {
   const {
     app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
     runGeminiAgentChat: runGeminiAgentChat2,
     runOpenAIAgentChat: runOpenAIAgentChat2,
     activityRegistry
@@ -19274,7 +19538,7 @@ function registerOsRoutes(ctx) {
       if (!filename || !base64Data) {
         return res.status(400).json({ error: "Filename and base64Data are required" });
       }
-      const ext = import_path8.default.extname(filename).toLowerCase();
+      const ext = import_path9.default.extname(filename).toLowerCase();
       if (BLOCKED_EXTENSIONS.includes(ext)) {
         return res.status(400).json({ error: `File type ${ext} is not allowed for security reasons.` });
       }
@@ -19286,13 +19550,13 @@ function registerOsRoutes(ctx) {
       if (!validateMagicBytes(fileBuffer, filename)) {
         return res.status(400).json({ error: "File content does not match the declared file type." });
       }
-      const uploadsDir = import_path8.default.join(process.cwd(), "uploads");
-      if (!import_fs8.default.existsSync(uploadsDir)) {
-        import_fs8.default.mkdirSync(uploadsDir, { recursive: true });
+      const uploadsDir = import_path9.default.join(process.cwd(), "uploads");
+      if (!import_fs9.default.existsSync(uploadsDir)) {
+        import_fs9.default.mkdirSync(uploadsDir, { recursive: true });
       }
       const uniqueName = `${Date.now()}-${import_crypto7.default.randomBytes(4).toString("hex")}${ext}`;
-      const filePath = import_path8.default.join(uploadsDir, uniqueName);
-      import_fs8.default.writeFileSync(filePath, fileBuffer);
+      const filePath = import_path9.default.join(uploadsDir, uniqueName);
+      import_fs9.default.writeFileSync(filePath, fileBuffer);
       let slideCount = 1;
       if (ext === ".pdf") {
         try {
@@ -19326,7 +19590,7 @@ function registerOsRoutes(ctx) {
       });
     } catch (e) {
       console.error("Upload error:", e);
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/commands", requireAuth(), async (req, res) => {
@@ -19340,7 +19604,7 @@ function registerOsRoutes(ctx) {
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json({ success: true, result });
     } catch (err) {
-      res.status(500).json({ success: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.get("/api/commands/registered", (req, res) => {
@@ -19348,7 +19612,7 @@ function registerOsRoutes(ctx) {
       const actions = kernelContainer.actionRegistry.getAllActions();
       res.json(actions);
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.get("/api/activities", async (req, res) => {
@@ -19357,7 +19621,7 @@ function registerOsRoutes(ctx) {
       const list = role === "all" ? activityRegistry.listDescriptors() : activityRegistry.listByRole(role).map((p) => p.descriptor);
       res.json({ activities: list });
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.post("/api/activities/:id/start", async (req, res) => {
@@ -19379,7 +19643,7 @@ function registerOsRoutes(ctx) {
       res.json({ ok: true, ...result });
     } catch (err) {
       const status = err?.code === "PERMISSION_DENIED" ? 403 : 500;
-      res.status(status).json({ ok: false, error: err.message });
+      sendSafeError(res, err, status);
     }
   });
   app.get("/api/activities/running", (_req, res) => {
@@ -19395,7 +19659,7 @@ function registerOsRoutes(ctx) {
       }));
       res.json({ activities });
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.post("/api/activities/:id/finish", async (req, res) => {
@@ -19414,7 +19678,7 @@ function registerOsRoutes(ctx) {
       await provider.finish(context);
       res.json({ ok: true });
     } catch (err) {
-      res.status(500).json({ ok: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.post("/api/activities/:id/pause", async (req, res) => {
@@ -19433,7 +19697,7 @@ function registerOsRoutes(ctx) {
       await provider.pause(context);
       res.json({ ok: true });
     } catch (err) {
-      res.status(500).json({ ok: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.post("/api/activities/:id/resume", async (req, res) => {
@@ -19452,7 +19716,7 @@ function registerOsRoutes(ctx) {
       await provider.resume(context);
       res.json({ ok: true });
     } catch (err) {
-      res.status(500).json({ ok: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.post("/api/agent/chat", async (req, res) => {
@@ -19510,7 +19774,7 @@ function registerOsRoutes(ctx) {
       });
     } catch (err) {
       console.error(err);
-      res.status(500).json({ success: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.get("/api/agent/conversations", (req, res) => {
@@ -19530,7 +19794,7 @@ function registerOsRoutes(ctx) {
         messages: rows.map((r) => ({ role: r.role, content: r.content, createdAt: r.created_at }))
       });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.delete("/api/agent/conversations", (req, res) => {
@@ -19546,34 +19810,20 @@ function registerOsRoutes(ctx) {
       kernelContainer.db.prepare("DELETE FROM agent_conversations WHERE conv_key = ?").run(convKey);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
 }
 
 // server/routes/resources.ts
 function registerResourcesRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
+  const { app } = ctx;
   app.get("/api/resources", (req, res) => {
     try {
       const resources = kernelContainer.db.prepare("SELECT id, name, type, created_at FROM system_resources ORDER BY created_at DESC").all();
       res.json(resources);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/resources/:id", (req, res) => {
@@ -19588,6 +19838,7 @@ function registerResourcesRoutes(ctx) {
           ).run(resource.id, resource.id, resource.name, "html", "index.html", resource.created_at || Date.now());
         }
         res.setHeader("Content-Type", "text/html; charset=utf-8");
+        res.setHeader("Content-Security-Policy", "sandbox allow-scripts allow-forms allow-downloads; default-src 'self' 'unsafe-inline' data: blob: https:;");
         let html2 = resource.content || "";
         const baseTag2 = `<base href="/api/resources/${req.params.id}/">`;
         if (html2.toLowerCase().includes("<head>")) {
@@ -19632,7 +19883,7 @@ function registerResourcesRoutes(ctx) {
       html = injectLmsSdk(html, req, { id: resource.id, name: resource.name, uuid: resource.id });
       return res.send(html);
     } catch (e) {
-      res.status(500).send(e.message);
+      sendSafeError(res, e);
     }
   });
   app.get("/api/resources/:id/*", (req, res) => {
@@ -19718,15 +19969,16 @@ function registerResourcesRoutes(ctx) {
       } else {
         let content = fileObj.content;
         if (contentType.startsWith("text/html")) {
+          res.setHeader("Content-Security-Policy", "sandbox allow-scripts allow-forms allow-downloads; default-src 'self' 'unsafe-inline' data: blob: https:;");
           content = injectLmsSdk(content, req, { id: resource.id, name: resource.name, uuid: resource.id });
         }
         return res.send(content);
       }
     } catch (e) {
-      res.status(500).send(e.message);
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/resources", async (req, res) => {
+  app.post("/api/resources", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { name, type, content } = req.body;
       if (!name || !type) {
@@ -19783,15 +20035,15 @@ function registerResourcesRoutes(ctx) {
       }
       res.json({ success: true, id, name, type });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.delete("/api/resources/:id", (req, res) => {
+  app.delete("/api/resources/:id", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       kernelContainer.db.prepare("DELETE FROM system_resources WHERE id = ?").run(req.params.id);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   const RESOURCE_HANDLERS = {
@@ -19841,61 +20093,51 @@ function registerResourcesRoutes(ctx) {
 }
 
 // server/routes/courseware.ts
-var import_path9 = __toESM(require("path"), 1);
-var import_fs9 = __toESM(require("fs"), 1);
+var import_path10 = __toESM(require("path"), 1);
+var import_fs10 = __toESM(require("fs"), 1);
 var import_crypto9 = __toESM(require("crypto"), 1);
 function registerCoursewareRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
-  app.post("/api/courseware/upload", async (req, res) => {
+  const { app, io } = ctx;
+  app.post("/api/courseware/upload", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { name, filename, base64Data } = req.body;
-      const cmd = kernelContainer.commandBus.createCommand("courseware.upload", { name, filename, base64Data }, "teacher-demo");
+      const actorId = getActorId(req) || "teacher";
+      const cmd = kernelContainer.commandBus.createCommand("courseware.upload", { name, filename, base64Data }, actorId);
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/courseware/confirm", async (req, res) => {
+  app.post("/api/courseware/confirm", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { uuid, name, entry } = req.body;
-      const cmd = kernelContainer.commandBus.createCommand("courseware.confirm", { uuid, name, entry }, "teacher-demo");
+      const actorId = getActorId(req) || "teacher";
+      const cmd = kernelContainer.commandBus.createCommand("courseware.confirm", { uuid, name, entry }, actorId);
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/courseware", async (req, res) => {
+  app.get("/api/courseware", requireAuth(), async (req, res) => {
     try {
-      const cmd = kernelContainer.commandBus.createCommand("courseware.list", {}, "teacher-demo");
+      const actorId = getActorId(req) || "system";
+      const cmd = kernelContainer.commandBus.createCommand("courseware.list", {}, actorId);
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.delete("/api/courseware/:id", async (req, res) => {
+  app.delete("/api/courseware/:id", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
-      const cmd = kernelContainer.commandBus.createCommand("courseware.delete", { id: req.params.id }, "teacher-demo");
+      const actorId = getActorId(req) || "teacher";
+      const cmd = kernelContainer.commandBus.createCommand("courseware.delete", { id: req.params.id }, actorId);
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   function extractScoreCommentCompletion(payload) {
@@ -19988,6 +20230,19 @@ function registerCoursewareRoutes(ctx) {
     try {
       const { attemptId } = req.params;
       const { eventType, payload } = req.body;
+      const token = getCookieToken(req);
+      const session = req.session || (token ? getValidSession(token) : null);
+      if (!session) {
+        return res.status(401).json({ error: "Authentication required" });
+      }
+      if (session.role !== "teacher" && session.role !== "administrator") {
+        const attemptRow = kernelContainer.db.prepare(
+          "SELECT student_id FROM courseware_attempt WHERE id = ?"
+        ).get(attemptId);
+        if (attemptRow && attemptRow.student_id !== session.userId) {
+          return res.status(403).json({ error: "Forbidden: Cannot modify logs for another student" });
+        }
+      }
       const rawId = "raw_" + import_crypto9.default.randomBytes(8).toString("hex");
       kernelContainer.db.prepare(
         "INSERT INTO submission_raw (id, attempt_id, event_type, payload_json, created_at) VALUES (?, ?, ?, ?, ?)"
@@ -20051,13 +20306,26 @@ function registerCoursewareRoutes(ctx) {
       });
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/courseware/attempts/:attemptId/submit", async (req, res) => {
     try {
       const { attemptId } = req.params;
       let { score, comment, completion, status, extra = {} } = req.body;
+      const token = getCookieToken(req);
+      const session = req.session || (token ? getValidSession(token) : null);
+      if (!session) {
+        return res.status(401).json({ error: "Authentication required to submit attempt scores" });
+      }
+      if (session.role !== "teacher" && session.role !== "administrator") {
+        const attemptRow = kernelContainer.db.prepare(
+          "SELECT student_id FROM courseware_attempt WHERE id = ?"
+        ).get(attemptId);
+        if (attemptRow && attemptRow.student_id !== session.userId) {
+          return res.status(403).json({ error: "Forbidden: Cannot submit scores for another student" });
+        }
+      }
       const extracted = extractScoreCommentCompletion({ ...req.body, ...extra });
       if (score === void 0 || score === null) score = extracted.score;
       if (comment === void 0 || comment === null) comment = extracted.comment;
@@ -20076,6 +20344,7 @@ function registerCoursewareRoutes(ctx) {
           parsedCompletion = num;
         }
       }
+      const actorId = session.userId || getActorId(req) || "student";
       const cmd = kernelContainer.commandBus.createCommand("courseware.submit_attempt", {
         attemptId,
         score: parsedScore,
@@ -20083,12 +20352,12 @@ function registerCoursewareRoutes(ctx) {
         completion: parsedCompletion,
         status,
         extra
-      }, "student-demo");
+      }, actorId);
       const result = await kernelContainer.commandBus.execute(cmd);
       io.emit("courseware-attempt-updated", { attemptId, type: "submit" });
       res.json(result);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/courseware/attempts", (req, res) => {
@@ -20113,7 +20382,7 @@ function registerCoursewareRoutes(ctx) {
       `).all();
       res.json(rows);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/courseware/debug", (req, res) => {
@@ -20121,12 +20390,12 @@ function registerCoursewareRoutes(ctx) {
       const { msg, url, student, courseware } = req.body;
       const logMsg = `[CLIENT DEBUG] ${msg} | URL: ${url} | Student: ${JSON.stringify(student)} | Courseware: ${JSON.stringify(courseware)}`;
       console.log(`\x1B[35m[CLIENT DEBUG]\x1B[0m ${msg}`);
-      const logFile2 = import_path9.default.join(process.cwd(), "client_debug.log");
-      import_fs9.default.appendFileSync(logFile2, `${(/* @__PURE__ */ new Date()).toISOString()} - ${logMsg}
+      const logFile2 = import_path10.default.join(process.cwd(), "client_debug.log");
+      import_fs10.default.appendFileSync(logFile2, `${(/* @__PURE__ */ new Date()).toISOString()} - ${logMsg}
 `);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/courseware/attempts/:attemptId/raw", async (req, res) => {
@@ -20136,7 +20405,7 @@ function registerCoursewareRoutes(ctx) {
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/courseware/attempts/:attemptId/progress", (req, res) => {
@@ -20157,7 +20426,7 @@ function registerCoursewareRoutes(ctx) {
         progress: { score: result.score, comment: result.comment, completion: result.completion, extra }
       });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/courseware/attempts/:attemptId/promote", async (req, res) => {
@@ -20248,7 +20517,7 @@ function registerCoursewareRoutes(ctx) {
       });
       res.json({ success: true, assignmentId, score: finalScore });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/courseware/:id", (req, res) => {
@@ -20265,30 +20534,16 @@ function registerCoursewareRoutes(ctx) {
       const html = injectLmsSdk(node.content || "", req, { id: node.id, name: node.name, uuid: node.id });
       res.send(html);
     } catch (e) {
-      res.status(500).send(e.message);
+      sendSafeError(res, e);
     }
   });
 }
 
 // server/routes/bridge.ts
-var import_path10 = __toESM(require("path"), 1);
-var import_fs10 = __toESM(require("fs"), 1);
+var import_path11 = __toESM(require("path"), 1);
+var import_fs11 = __toESM(require("fs"), 1);
 function registerBridgeRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
+  const { app } = ctx;
   app.get("/bridge.js", (_req, res) => {
     res.setHeader("Content-Type", "application/javascript; charset=utf-8");
     res.setHeader("Access-Control-Allow-Origin", "*");
@@ -20309,23 +20564,23 @@ function registerBridgeRoutes(ctx) {
       if (!subpath || subpath === "") {
         subpath = courseware.entry;
       }
-      const storageDir = import_path10.default.resolve(process.cwd(), "storage", "courseware", uuid);
-      const filePath = import_path10.default.resolve(storageDir, subpath);
+      const storageDir = import_path11.default.resolve(process.cwd(), "storage", "courseware", uuid);
+      const filePath = import_path11.default.resolve(storageDir, subpath);
       if (!filePath.startsWith(storageDir)) {
         return res.status(403).send("Access denied");
       }
-      if (!import_fs10.default.existsSync(filePath)) {
+      if (!import_fs11.default.existsSync(filePath)) {
         return res.status(404).send(`File not found: ${subpath}`);
       }
-      const stat = import_fs10.default.statSync(filePath);
+      const stat = import_fs11.default.statSync(filePath);
       if (stat.isDirectory()) {
-        const indexHtml = import_path10.default.join(filePath, "index.html");
-        if (import_fs10.default.existsSync(indexHtml)) {
+        const indexHtml = import_path11.default.join(filePath, "index.html");
+        if (import_fs11.default.existsSync(indexHtml)) {
           return res.redirect(`/runtime/${uuid}/${subpath.endsWith("/") ? subpath : subpath + "/"}index.html`);
         }
         return res.status(404).send("Directory index not found");
       }
-      const ext = import_path10.default.extname(filePath).toLowerCase();
+      const ext = import_path11.default.extname(filePath).toLowerCase();
       let contentType = "text/plain; charset=utf-8";
       if (ext === ".html" || ext === ".htm") contentType = "text/html; charset=utf-8";
       else if (ext === ".css") contentType = "text/css; charset=utf-8";
@@ -20341,14 +20596,14 @@ function registerBridgeRoutes(ctx) {
       res.setHeader("Access-Control-Allow-Origin", "*");
       const isHtml = ext === ".html" || ext === ".htm";
       if (isHtml) {
-        let html = import_fs10.default.readFileSync(filePath, "utf8");
+        let html = import_fs11.default.readFileSync(filePath, "utf8");
         html = injectLmsSdk(html, req, { id: courseware.id, name: courseware.name, uuid: courseware.uuid });
         return res.send(html);
       } else {
         return res.sendFile(filePath);
       }
     } catch (e) {
-      res.status(500).send(e.message);
+      sendSafeError(res, e, 500, "Failed to load courseware runtime file");
     }
   });
 }
@@ -20356,27 +20611,89 @@ function registerBridgeRoutes(ctx) {
 // server/routes/lessons.ts
 var import_genai3 = require("@google/genai");
 var import_uuid16 = require("uuid");
+function checkLessonOwnership(req, lessonId) {
+  const token = getCookieToken(req);
+  const session = req.session || (token ? getValidSession(token) : null);
+  if (!session) {
+    return { allowed: false, status: 401, error: "Authentication required" };
+  }
+  const isAdmin = session.username === "admin" || session.userId === "usr_admin" || session.role === "admin" || session.role === "administrator";
+  const isTeacherOrAdmin = isAdmin || session.role === "teacher";
+  if (!isTeacherOrAdmin) {
+    return { allowed: false, status: 403, error: "Forbidden: Only teachers or administrators can modify lessons" };
+  }
+  const lesson = kernelContainer.db.prepare("SELECT * FROM lessons WHERE id = ?").get(lessonId);
+  if (!lesson) {
+    return { allowed: false, status: 404, error: "Lesson not found" };
+  }
+  if (isAdmin) {
+    return { allowed: true, status: 200, lesson };
+  }
+  if (!lesson.creator_id || lesson.creator_id === session.userId || lesson.creator_id === session.username) {
+    return { allowed: true, status: 200, lesson };
+  }
+  return {
+    allowed: false,
+    status: 403,
+    error: "Forbidden: You do not have permission to modify this lesson because it was created by another teacher"
+  };
+}
+function requireWhiteboardWriteAccess() {
+  return (req, res, next) => {
+    const { id } = req.params;
+    const token = getCookieToken(req);
+    const session = req.session || (token ? getValidSession(token) : null);
+    if (!session) {
+      return res.status(401).json({ success: false, error: "Authentication required" });
+    }
+    req.session = session;
+    const isAdmin = session.username === "admin" || session.userId === "usr_admin" || session.role === "admin" || session.role === "administrator";
+    if (id.startsWith("assignment-")) {
+      if (isAdmin || session.role === "teacher") {
+        return next();
+      }
+      if (session.role === "student") {
+        const studentMatch = id.match(/-student-([^-]+)$/);
+        const targetStudentId = studentMatch ? studentMatch[1] : null;
+        const currentStudentId = session.studentId || session.userId;
+        if (targetStudentId && currentStudentId && targetStudentId === currentStudentId) {
+          return next();
+        }
+        return res.status(403).json({
+          success: false,
+          error: "Forbidden: You do not have permission to modify another student's assignment whiteboard"
+        });
+      }
+      return res.status(403).json({ success: false, error: "Forbidden: Invalid role for whiteboard write" });
+    }
+    const isTeacherOrAdmin = isAdmin || session.role === "teacher";
+    if (!isTeacherOrAdmin) {
+      return res.status(403).json({
+        success: false,
+        error: "Forbidden: Students cannot modify classroom whiteboards"
+      });
+    }
+    const lesson = kernelContainer.db.prepare("SELECT * FROM lessons WHERE id = ?").get(id);
+    if (!lesson) {
+      return res.status(404).json({ success: false, error: "Lesson not found" });
+    }
+    if (isAdmin || !lesson.creator_id || lesson.creator_id === session.userId || lesson.creator_id === session.username) {
+      return next();
+    }
+    return res.status(403).json({
+      success: false,
+      error: "Forbidden: You do not have permission to modify this lesson whiteboard because it was created by another teacher"
+    });
+  };
+}
 function registerLessonsRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
+  const { app, io } = ctx;
   app.get("/api/lessons", (req, res) => {
     const lessons = kernelContainer.db.prepare(`
-      SELECT l.*, 
+      SELECT l.*, u.name as creator_name,
         (SELECT COUNT(*) FROM student_lesson_progress WHERE lesson_id = l.id) as enrollment_count
       FROM lessons l
+      LEFT JOIN users u ON l.creator_id = u.id
       ORDER BY l.created_at DESC
     `).all();
     res.json(lessons);
@@ -20392,7 +20709,7 @@ function registerLessonsRoutes(ctx) {
       `).all(lessonId);
       res.json(rows);
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.get("/api/lessons/:lessonId/eval-grades", (req, res) => {
@@ -20436,7 +20753,7 @@ function registerLessonsRoutes(ctx) {
       }
       res.json(result);
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.get("/api/eval-submissions/:submissionId/reviews", (req, res) => {
@@ -20450,7 +20767,7 @@ function registerLessonsRoutes(ctx) {
       `).all(submissionId);
       res.json(rows);
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.get("/api/lessons/:lessonId/students/:studentId/eval-status", (req, res) => {
@@ -20487,43 +20804,55 @@ function registerLessonsRoutes(ctx) {
         grade
       });
     } catch (err) {
-      res.status(500).json({ error: err.message });
+      sendSafeError(res, err);
     }
   });
-  app.post("/api/lessons", async (req, res) => {
+  app.post("/api/lessons", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { title, content } = req.body;
+      const session = req.session;
+      const creatorId = session?.userId || session?.username || "usr_teacher";
+      const actorId = getActorId(req) || "teacher";
       const cmd = kernelContainer.commandBus.createCommand(
         "lesson.create",
-        { title, content },
-        "user-frontend",
+        { title, content, creatorId },
+        actorId,
         { approved: true }
       );
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json({ success: true, result });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.put("/api/lessons/:id/timeline", async (req, res) => {
+  app.put("/api/lessons/:id/timeline", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { id } = req.params;
+      const ownership = checkLessonOwnership(req, id);
+      if (!ownership.allowed) {
+        return res.status(ownership.status).json({ success: false, error: ownership.error });
+      }
       const { timeline } = req.body;
+      const actorId = getActorId(req) || "teacher";
       const cmd = kernelContainer.commandBus.createCommand(
         "lesson.update_timeline",
         { lessonId: id, timeline },
-        "user-frontend",
+        actorId,
         { approved: true }
       );
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json({ success: true, result });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.put("/api/lessons/:id/progress-mode", async (req, res) => {
+  app.put("/api/lessons/:id/progress-mode", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { id } = req.params;
+      const ownership = checkLessonOwnership(req, id);
+      if (!ownership.allowed) {
+        return res.status(ownership.status).json({ success: false, error: ownership.error });
+      }
       const { progressMode, progressConditions } = req.body;
       const conditionsStr = typeof progressConditions === "string" ? progressConditions : JSON.stringify(progressConditions || null);
       kernelContainer.db.prepare("UPDATE lessons SET progress_mode = ?, progress_conditions = ?, updated_at = ? WHERE id = ?").run(progressMode || "manual", conditionsStr, Date.now(), id);
@@ -20534,7 +20863,7 @@ function registerLessonsRoutes(ctx) {
       });
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/lessons/:id/whiteboard", (req, res) => {
@@ -20560,14 +20889,13 @@ function registerLessonsRoutes(ctx) {
     }
     res.json(elements);
   });
-  app.post("/api/lessons/:id/whiteboard/reset", async (req, res) => {
+  app.post("/api/lessons/:id/whiteboard/reset", requireWhiteboardWriteAccess(), async (req, res) => {
     try {
       const id = req.params.id;
       if (id.startsWith("assignment-")) {
         const deleteStmt = kernelContainer.db.prepare("DELETE FROM whiteboard_elements WHERE lesson_id = ?");
         deleteStmt.run(id);
-        res.json({ success: true, message: "Assignment whiteboard reset to empty" });
-        return;
+        return res.json({ success: true, message: "Assignment whiteboard reset to empty" });
       }
       const snapshotId = `snapshot-${id}`;
       const hasSnapshot = kernelContainer.db.prepare("SELECT count(*) as count FROM whiteboard_elements WHERE lesson_id = ?").get(snapshotId);
@@ -20590,94 +20918,77 @@ function registerLessonsRoutes(ctx) {
         res.json({ success: true, message: "Lesson whiteboard cleared (no snapshot)" });
       }
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/lessons/:id/whiteboard", async (req, res) => {
+  app.post("/api/lessons/:id/whiteboard", requireWhiteboardWriteAccess(), async (req, res) => {
     try {
       const { id } = req.params;
-      if (!id.startsWith("assignment-") && !checkIsTeacherOrAdmin(req)) {
-        return res.status(403).json({ error: "Forbidden: Only teachers can draw on classroom whiteboards" });
-      }
       const { type, data } = req.body;
+      const actorId = getActorId(req) || "user-frontend";
       const cmd = kernelContainer.commandBus.createCommand("whiteboard.draw", {
         lessonId: id,
         type,
         data: JSON.stringify(data)
-      }, "user-frontend", { approved: true });
+      }, actorId, { approved: true });
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.put("/api/lessons/:id/whiteboard/:elementId", async (req, res) => {
+  app.put("/api/lessons/:id/whiteboard/:elementId", requireWhiteboardWriteAccess(), async (req, res) => {
     try {
-      const { id } = req.params;
-      if (!id.startsWith("assignment-") && !checkIsTeacherOrAdmin(req)) {
-        return res.status(403).json({ error: "Forbidden: Only teachers can update elements on classroom whiteboards" });
-      }
+      const { id, elementId } = req.params;
       const { data } = req.body;
+      const actorId = getActorId(req) || "user-frontend";
       const cmd = kernelContainer.commandBus.createCommand("whiteboard.update", {
         lessonId: id,
-        elementId: req.params.elementId,
+        elementId,
         data: JSON.stringify(data)
-      }, "user-frontend", { approved: true });
+      }, actorId, { approved: true });
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.delete("/api/lessons/:id/whiteboard", async (req, res) => {
+  app.delete("/api/lessons/:id/whiteboard", requireWhiteboardWriteAccess(), async (req, res) => {
     try {
       const { id } = req.params;
-      if (!id.startsWith("assignment-") && !checkIsTeacherOrAdmin(req)) {
-        return res.status(403).json({ error: "Forbidden: Only teachers can clear the classroom whiteboard" });
-      }
+      const actorId = getActorId(req) || "user-frontend";
       const cmd = kernelContainer.commandBus.createCommand("whiteboard.clear", {
         lessonId: id
-      }, "user-frontend", { approved: true });
+      }, actorId, { approved: true });
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.delete("/api/lessons/:id/whiteboard/:elementId", async (req, res) => {
+  app.delete("/api/lessons/:id/whiteboard/:elementId", requireWhiteboardWriteAccess(), async (req, res) => {
     try {
-      const { id } = req.params;
-      if (!id.startsWith("assignment-") && !checkIsTeacherOrAdmin(req)) {
-        return res.status(403).json({ error: "Forbidden: Only teachers can delete elements from classroom whiteboards" });
-      }
+      const { id, elementId } = req.params;
+      const actorId = getActorId(req) || "user-frontend";
       const cmd = kernelContainer.commandBus.createCommand("whiteboard.delete", {
         lessonId: id,
-        elementId: req.params.elementId
-      }, "user-frontend", { approved: true });
+        elementId
+      }, actorId, { approved: true });
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/lessons/:id/quiz-submit", async (req, res) => {
+  app.post("/api/lessons/:id/quiz-submit", requireAuth("student", "teacher", "administrator"), async (req, res) => {
     try {
       const { id: lessonId } = req.params;
       const { elementId, answer } = req.body;
       if (!elementId || answer === void 0) {
         return res.status(400).json({ error: "Missing elementId or answer" });
       }
-      const token = getCookieToken(req);
-      let studentId = "guest";
-      if (token) {
-        const sessionRow = kernelContainer.db.prepare("SELECT * FROM client_sessions WHERE id = ?").get(token);
-        if (sessionRow) {
-          const session = JSON.parse(sessionRow.session_data);
-          if (session.role === "student") {
-            studentId = session.studentId || session.userId || "guest";
-          }
-        }
-      }
+      const session = req.session;
+      const studentId = session.studentId || session.userId || "guest";
       const row = kernelContainer.db.prepare(
         "SELECT data FROM whiteboard_elements WHERE id = ? AND lesson_id = ?"
       ).get(elementId, lessonId);
@@ -20701,15 +21012,12 @@ function registerLessonsRoutes(ctx) {
       io.to(`lesson-${lessonId}`).emit("whiteboard-sync", { type: "element-updated", elementId });
       res.json({ success: true, isCorrect, score, studentId });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/lessons/:id/quiz-submissions", (req, res) => {
+  app.get("/api/lessons/:id/quiz-submissions", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { id: lessonId } = req.params;
-      if (!checkIsTeacherOrAdmin(req)) {
-        return res.status(403).json({ error: "Forbidden" });
-      }
       const elements = kernelContainer.db.prepare(
         "SELECT id, type, data FROM whiteboard_elements WHERE lesson_id = ? AND type = ?"
       ).all(lessonId, "quiz");
@@ -20730,10 +21038,10 @@ function registerLessonsRoutes(ctx) {
       });
       res.json({ success: true, quizzes });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/lessons/:id/ai-tutor", async (req, res) => {
+  app.post("/api/lessons/:id/ai-tutor", requireAuth("student", "teacher", "administrator"), async (req, res) => {
     try {
       const { elements } = req.body;
       const ai = new import_genai3.GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });
@@ -20762,12 +21070,16 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
       res.json({ success: true, hint });
     } catch (e) {
       console.error("AI Tutor error:", e);
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.delete("/api/lessons/:id", async (req, res) => {
+  app.delete("/api/lessons/:id", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { id } = req.params;
+      const ownership = checkLessonOwnership(req, id);
+      if (!ownership.allowed) {
+        return res.status(ownership.status).json({ success: false, error: ownership.error });
+      }
       kernelContainer.db.prepare("DELETE FROM whiteboard_elements WHERE lesson_id = ?").run(id);
       kernelContainer.db.prepare("DELETE FROM student_lesson_progress WHERE lesson_id = ?").run(id);
       kernelContainer.db.prepare("DELETE FROM schedules WHERE lesson_id = ?").run(id);
@@ -20778,7 +21090,7 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
       }
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/lessons/:id/stats", (req, res) => {
@@ -20798,22 +21110,24 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
       ).get(id).count;
       res.json({ whiteboardCount, scheduleCount, enrollmentCount, assignmentCount });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/lessons/:id/clone", async (req, res) => {
+  app.post("/api/lessons/:id/clone", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { id } = req.params;
       const original = kernelContainer.db.prepare("SELECT * FROM lessons WHERE id = ?").get(id);
       if (!original) {
         return res.status(404).json({ error: "Lesson not found" });
       }
+      const session = req.session;
+      const creatorId = session?.userId || session?.username || "usr_teacher";
       const newId = (0, import_uuid16.v7)();
       const now = Date.now();
       const newTitle = `\u526F\u672C-${original.title}`;
       kernelContainer.db.prepare(
-        "INSERT INTO lessons (id, title, content, timeline, progress_mode, progress_conditions, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
-      ).run(newId, newTitle, original.content, original.timeline, original.progress_mode, original.progress_conditions, now, now);
+        "INSERT INTO lessons (id, title, content, timeline, progress_mode, progress_conditions, creator_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
+      ).run(newId, newTitle, original.content, original.timeline, original.progress_mode, original.progress_conditions, creatorId, now, now);
       const whiteboardElements = kernelContainer.db.prepare(
         "SELECT * FROM whiteboard_elements WHERE lesson_id = ?"
       ).all(id);
@@ -20823,40 +21137,29 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
       for (const el of whiteboardElements) {
         insertElement.run((0, import_uuid16.v7)(), newId, el.type, el.data, now);
       }
-      const cloned = kernelContainer.db.prepare(
-        "SELECT l.*, 0 as enrollment_count FROM lessons l WHERE l.id = ?"
-      ).get(newId);
+      const cloned = kernelContainer.db.prepare(`
+        SELECT l.*, u.name as creator_name, 0 as enrollment_count 
+        FROM lessons l 
+        LEFT JOIN users u ON l.creator_id = u.id
+        WHERE l.id = ?
+      `).get(newId);
       res.json({ success: true, lesson: cloned });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
 }
 
 // server/routes/workspace.ts
-var import_path11 = __toESM(require("path"), 1);
+var import_path12 = __toESM(require("path"), 1);
 function registerWorkspaceRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
-  app.get("/api/events", (req, res) => {
+  const { app, MF_REMOTE_CACHE: MF_REMOTE_CACHE2 } = ctx;
+  app.get("/api/events", requireAuth("administrator"), (req, res) => {
     try {
       const events = kernelContainer.db.prepare("SELECT * FROM events ORDER BY timestamp DESC LIMIT 50").all();
       res.json(events);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/mfe/remotes", (req, res) => {
@@ -20888,12 +21191,15 @@ function registerWorkspaceRoutes(ctx) {
       MF_REMOTE_CACHE2.set(name, result);
       res.json({ success: true, result });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/vfs", (req, res) => {
+  app.get("/api/vfs", requireAuth(), (req, res) => {
     try {
       const parentId = req.query.parentId === "null" ? null : req.query.parentId || null;
+      const isStaff = checkIsTeacherOrAdmin(req);
+      const token = getCookieToken(req);
+      const session = req.session || (token ? getValidSession(token) : null);
       let nodes = [];
       if (parentId === "virtual-lessons") {
         const lessons = kernelContainer.db.prepare("SELECT id, title, content FROM lessons").all();
@@ -20902,12 +21208,23 @@ function registerWorkspaceRoutes(ctx) {
         const assignments = kernelContainer.db.prepare("SELECT a.id, a.title, c.name as cname, a.content FROM assignments a JOIN classes c ON a.class_id = c.id").all();
         nodes = assignments.map((a) => ({ id: `assgn-${a.id}`, parent_id: "virtual-assignments", type: "file", name: `[${a.cname}] ${a.title}.md`, content: a.content }));
       } else if (parentId === "virtual-submissions") {
-        const submissions = kernelContainer.db.prepare(`
-          SELECT sub.id, sub.content, a.title, s.name as sname, sub.score
-          FROM assignment_submissions sub
-          JOIN assignments a ON sub.assignment_id = a.id
-          JOIN students s ON sub.student_id = s.id
-        `).all();
+        let submissions = [];
+        if (isStaff) {
+          submissions = kernelContainer.db.prepare(`
+            SELECT sub.id, sub.content, a.title, s.name as sname, sub.score
+            FROM assignment_submissions sub
+            JOIN assignments a ON sub.assignment_id = a.id
+            JOIN students s ON sub.student_id = s.id
+          `).all();
+        } else if (session?.userId) {
+          submissions = kernelContainer.db.prepare(`
+            SELECT sub.id, sub.content, a.title, s.name as sname, sub.score
+            FROM assignment_submissions sub
+            JOIN assignments a ON sub.assignment_id = a.id
+            JOIN students s ON sub.student_id = s.id
+            WHERE sub.student_id = ?
+          `).all(session.userId);
+        }
         nodes = submissions.map((sub) => ({
           id: `sub-${sub.id}`,
           parent_id: "virtual-submissions",
@@ -20934,7 +21251,7 @@ ${sub.content}`
       }
       res.json(nodes);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/files/*", (req, res) => {
@@ -20968,7 +21285,7 @@ ${sub.content}`
       }
       const filename = parts[parts.length - 1];
       res.setHeader("Content-Disposition", `attachment; filename="${encodeURIComponent(filename)}"`);
-      const ext = import_path11.default.extname(filename).toLowerCase();
+      const ext = import_path12.default.extname(filename).toLowerCase();
       const binaryExtensions = [".pdf", ".xlsx", ".xls", ".zip", ".png", ".jpg", ".jpeg", ".gif", ".mp4", ".mp3"];
       const content = foundNode.content || "";
       if (binaryExtensions.includes(ext)) {
@@ -20980,29 +21297,15 @@ ${sub.content}`
       }
       res.send(content);
     } catch (e) {
-      res.status(500).send(e.message);
+      sendSafeError(res, e);
     }
   });
 }
 
 // server/routes/processes.ts
 function registerProcessesRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
-  app.get("/api/approvals", (req, res) => {
+  const { app } = ctx;
+  app.get("/api/approvals", requireAuth("administrator"), (req, res) => {
     try {
       const list = kernelContainer.db.prepare("SELECT * FROM pending_commands ORDER BY created_at DESC").all();
       res.json(list);
@@ -21010,71 +21313,54 @@ function registerProcessesRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/approvals/:id/approve", async (req, res) => {
+  app.post("/api/approvals/:id/approve", requireAuth("administrator"), async (req, res) => {
     try {
       const pending = kernelContainer.db.prepare("SELECT * FROM pending_commands WHERE id = ?").get(req.params.id);
       if (!pending) return res.status(404).json({ error: "Not found" });
-      let payload = JSON.parse(pending.payload);
-      if (req.body && req.body.payloadOverride) {
-        payload = { ...payload, ...req.body.payloadOverride };
-      }
+      const payload = JSON.parse(pending.payload);
+      const approverId = getActorId(req) || "admin";
       const cmd = kernelContainer.commandBus.createCommand(
         pending.command_type,
         payload,
-        pending.actor_id,
+        approverId,
         { approved: true }
-        // Bypass high risk check now
       );
       const result = await kernelContainer.commandBus.execute(cmd);
       kernelContainer.db.prepare("DELETE FROM pending_commands WHERE id = ?").run(pending.id);
       res.json({ success: true, result });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/approvals/:id/reject", async (req, res) => {
+  app.post("/api/approvals/:id/reject", requireAuth("administrator"), async (req, res) => {
     try {
       kernelContainer.db.prepare("DELETE FROM pending_commands WHERE id = ?").run(req.params.id);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/processes", (req, res) => {
+  app.get("/api/processes", requireAuth("administrator"), (req, res) => {
     try {
       const list = kernelContainer.db.prepare("SELECT id, name, status, created_at, updated_at FROM processes WHERE status = 'running' ORDER BY created_at DESC").all();
       res.json(list);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/processes/:id/logs", (req, res) => {
+  app.get("/api/processes/:id/logs", requireAuth("administrator"), (req, res) => {
     try {
       const dbRow = kernelContainer.db.prepare("SELECT logs FROM processes WHERE id = ?").get(req.params.id);
       res.json(dbRow || { logs: "" });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
 }
 
 // server/routes/admin.ts
 function registerAdminRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
+  const { app } = ctx;
   app.post("/api/admin/seed-demo", requireAuth("administrator"), (req, res) => {
     try {
       const db2 = kernelContainer.db;
@@ -21138,7 +21424,7 @@ function registerAdminRoutes(ctx) {
       }
       res.json({ success: true, classId: DEMO_CLASS_ID, scheduleId: DEMO_SCHEDULE_ID, lessonId });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/classes/import", requireAuth("teacher", "administrator"), (req, res) => {
@@ -21188,7 +21474,7 @@ function registerAdminRoutes(ctx) {
       }
       res.json({ success: true, imported });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/students/import", requireAuth("teacher", "administrator"), (req, res) => {
@@ -21224,32 +21510,18 @@ function registerAdminRoutes(ctx) {
       }
       res.json({ success: true, imported });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
 }
 
 // server/routes/roster.ts
-var import_path12 = __toESM(require("path"), 1);
-var import_fs11 = __toESM(require("fs"), 1);
+var import_path13 = __toESM(require("path"), 1);
+var import_fs12 = __toESM(require("fs"), 1);
 var import_crypto10 = __toESM(require("crypto"), 1);
 var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
 function registerRosterRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
+  const { app, io, loginLimiter } = ctx;
   app.get("/api/classes", (req, res) => {
     try {
       const classes = kernelContainer.db.prepare(`
@@ -21283,10 +21555,10 @@ function registerRosterRoutes(ctx) {
       `).all(req.params.id);
       res.json(students);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/classes", (req, res) => {
+  app.post("/api/classes", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { name, description } = req.body;
       const classId = Math.random().toString(36).slice(2);
@@ -21298,10 +21570,10 @@ function registerRosterRoutes(ctx) {
       );
       res.json({ success: true, id: classId });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.put("/api/classes/:id", (req, res) => {
+  app.put("/api/classes/:id", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { name, description, class_passcode } = req.body;
       if (name) kernelContainer.db.prepare("UPDATE classes SET name = ? WHERE id = ?").run(name, req.params.id);
@@ -21309,10 +21581,10 @@ function registerRosterRoutes(ctx) {
       if (class_passcode !== void 0) kernelContainer.db.prepare("UPDATE classes SET class_passcode = ? WHERE id = ?").run(class_passcode, req.params.id);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.delete("/api/classes/:id", (req, res) => {
+  app.delete("/api/classes/:id", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const classId = req.params.id;
       const db2 = kernelContainer.db;
@@ -21354,7 +21626,7 @@ function registerRosterRoutes(ctx) {
       deleteTransaction();
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/db-status", (req, res) => {
@@ -21419,7 +21691,8 @@ function registerRosterRoutes(ctx) {
       }
       return res.status(500).json({ status: "disconnected", error: "Unexpected response from SQLite" });
     } catch (e) {
-      return res.status(500).json({ status: "disconnected", error: e.message });
+      const exposed = process.env.NODE_ENV === "production" ? "Database connection error" : e.message;
+      return res.status(500).json({ status: "disconnected", error: exposed });
     }
   });
   app.get("/api/auth/session", (req, res) => {
@@ -21434,7 +21707,7 @@ function registerRosterRoutes(ctx) {
       }
       res.json({ session });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/auth/logout", (req, res) => {
@@ -21443,10 +21716,12 @@ function registerRosterRoutes(ctx) {
       if (token) {
         kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
       }
-      res.setHeader("Set-Cookie", `edu_os_token=; Path=/; HttpOnly; Max-Age=0; SameSite=Lax`);
+      const isSecure = req.secure || req.headers["x-forwarded-proto"] === "https" || process.env.NODE_ENV === "production" && process.env.ENABLE_HTTPS === "true";
+      const secureFlag = isSecure ? "; Secure" : "";
+      res.setHeader("Set-Cookie", `edu_os_token=; Path=/; HttpOnly; Max-Age=0; SameSite=Lax${secureFlag}`);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/auth/change-password", (req, res) => {
@@ -21505,7 +21780,7 @@ function registerRosterRoutes(ctx) {
       }
       res.status(400).json({ error: "Unsupported role" });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/auth/profile", (req, res) => {
@@ -21536,7 +21811,7 @@ function registerRosterRoutes(ctx) {
       }
       res.json({ success: true, name });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/auth/avatar", (req, res) => {
@@ -21549,7 +21824,7 @@ function registerRosterRoutes(ctx) {
       if (!filename || !base64Data) {
         return res.status(400).json({ error: "Filename and base64Data are required" });
       }
-      const ext = import_path12.default.extname(filename).toLowerCase();
+      const ext = import_path13.default.extname(filename).toLowerCase();
       const ALLOWED_IMG = [".jpg", ".jpeg", ".png", ".gif", ".webp"];
       if (BLOCKED_EXTENSIONS.includes(ext) || !ALLOWED_IMG.includes(ext)) {
         return res.status(400).json({ error: "Only image files (jpg / png / gif / webp) are allowed" });
@@ -21562,11 +21837,11 @@ function registerRosterRoutes(ctx) {
       if (!validateMagicBytes(fileBuffer, filename)) {
         return res.status(400).json({ error: "File content does not match the declared image type" });
       }
-      const avatarDir = import_path12.default.join(process.cwd(), "uploads", "avatars");
-      import_fs11.default.mkdirSync(avatarDir, { recursive: true });
+      const avatarDir = import_path13.default.join(process.cwd(), "uploads", "avatars");
+      import_fs12.default.mkdirSync(avatarDir, { recursive: true });
       const uniqueName = `${Date.now()}-${import_crypto10.default.randomBytes(4).toString("hex")}${ext}`;
-      const filePath = import_path12.default.join(avatarDir, uniqueName);
-      import_fs11.default.writeFileSync(filePath, fileBuffer);
+      const filePath = import_path13.default.join(avatarDir, uniqueName);
+      import_fs12.default.writeFileSync(filePath, fileBuffer);
       const avatarUrl = `/uploads/avatars/${uniqueName}`;
       let oldAvatar = null;
       if (session.role === "student") {
@@ -21580,7 +21855,7 @@ function registerRosterRoutes(ctx) {
       }
       if (oldAvatar && oldAvatar.startsWith("/uploads/avatars/")) {
         try {
-          import_fs11.default.unlinkSync(import_path12.default.join(process.cwd(), oldAvatar));
+          import_fs12.default.unlinkSync(import_path13.default.join(process.cwd(), oldAvatar));
         } catch {
         }
       }
@@ -21595,7 +21870,7 @@ function registerRosterRoutes(ctx) {
       }
       res.json({ success: true, avatar: avatarUrl });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.delete("/api/auth/avatar", (req, res) => {
@@ -21616,7 +21891,7 @@ function registerRosterRoutes(ctx) {
       }
       if (oldAvatar && oldAvatar.startsWith("/uploads/avatars/")) {
         try {
-          import_fs11.default.unlinkSync(import_path12.default.join(process.cwd(), oldAvatar));
+          import_fs12.default.unlinkSync(import_path13.default.join(process.cwd(), oldAvatar));
         } catch {
         }
       }
@@ -21631,7 +21906,7 @@ function registerRosterRoutes(ctx) {
       }
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/auth/login", loginLimiter, (req, res) => {
@@ -21726,7 +22001,10 @@ function registerRosterRoutes(ctx) {
         const now = Date.now();
         const expiresAt = now + 7 * 24 * 60 * 60 * 1e3;
         kernelContainer.db.prepare("INSERT INTO client_sessions (id, session_data, updated_at, expires_at) VALUES (?, ?, ?, ?)").run(sessionToken, JSON.stringify(sessionData), now, expiresAt);
-        res.setHeader("Set-Cookie", `edu_os_token=${sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000`);
+        const isSecure = req.secure || req.headers["x-forwarded-proto"] === "https" || process.env.NODE_ENV === "production" && process.env.ENABLE_HTTPS === "true";
+        const secureFlag = isSecure ? "; Secure" : "";
+        const maxAgeSeconds = 7 * 24 * 60 * 60;
+        res.setHeader("Set-Cookie", `edu_os_token=${sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSeconds}${secureFlag}`);
         return res.json({
           success: true,
           session: sessionData
@@ -21734,7 +22012,7 @@ function registerRosterRoutes(ctx) {
       }
       res.status(400).json({ error: "Unsupported entry type" });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/students/:id/read_notifications", (req, res) => {
@@ -21742,10 +22020,10 @@ function registerRosterRoutes(ctx) {
       const rows = kernelContainer.db.prepare("SELECT notification_id FROM student_read_notifications WHERE student_id = ?").all(req.params.id);
       res.json(rows.map((r) => r.notification_id));
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/students/:id/read_notifications", (req, res) => {
+  app.post("/api/students/:id/read_notifications", requireAuth(), (req, res) => {
     try {
       const { notificationId } = req.body;
       if (!notificationId) {
@@ -21758,10 +22036,10 @@ function registerRosterRoutes(ctx) {
       });
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/classes/:classId/lock_lesson", (req, res) => {
+  app.post("/api/classes/:classId/lock_lesson", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { lessonId } = req.body;
       if (!lessonId) {
@@ -21778,7 +22056,7 @@ function registerRosterRoutes(ctx) {
       res.status(550).json({ error: e.message });
     }
   });
-  app.post("/api/classes/:classId/unlock_lesson", (req, res) => {
+  app.post("/api/classes/:classId/unlock_lesson", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       kernelContainer.db.prepare("UPDATE students SET locked_lesson_id = NULL WHERE id IN (SELECT student_id FROM class_students WHERE class_id = ?)").run(req.params.classId);
       io.emit("class-lock-status-changed", {
@@ -21848,7 +22126,7 @@ function registerRosterRoutes(ctx) {
       const labs = kernelContainer.db.prepare("SELECT * FROM computer_labs ORDER BY created_at DESC").all();
       res.json(labs);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/labs", requireAuth("teacher", "administrator"), (req, res) => {
@@ -21860,7 +22138,7 @@ function registerRosterRoutes(ctx) {
       ).run(id, room_number, parseInt(rows), parseInt(cols), Date.now());
       res.json({ success: true, id, room_number, rows, cols });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.put("/api/labs/:id", requireAuth("teacher", "administrator"), (req, res) => {
@@ -21871,7 +22149,7 @@ function registerRosterRoutes(ctx) {
       ).run(room_number, parseInt(rows), parseInt(cols), req.params.id);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.delete("/api/labs/:id", requireAuth("teacher", "administrator"), (req, res) => {
@@ -21880,7 +22158,7 @@ function registerRosterRoutes(ctx) {
       kernelContainer.db.prepare("DELETE FROM student_seats WHERE lab_id = ?").run(req.params.id);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/classes/:classId/seats", (req, res) => {
@@ -21890,7 +22168,7 @@ function registerRosterRoutes(ctx) {
       const seats = kernelContainer.db.prepare("SELECT * FROM student_seats WHERE class_id = ?").all(req.params.classId);
       res.json({ lab_id: labId, seats });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/classes/:classId/seats", requireAuth("teacher", "administrator"), (req, res) => {
@@ -21908,10 +22186,10 @@ function registerRosterRoutes(ctx) {
       }
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/students", (req, res) => {
+  app.post("/api/students", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { name, email, password, student_number } = req.body;
       const studentId = Math.random().toString(36).slice(2);
@@ -21930,10 +22208,10 @@ function registerRosterRoutes(ctx) {
       );
       res.json({ success: true, id: studentId, student_number: finalNum, tempPassword: password || "123456" });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.put("/api/students/:id", (req, res) => {
+  app.put("/api/students/:id", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { name, email, password, locked_lesson_id, private_notes, student_number } = req.body;
       if (name) kernelContainer.db.prepare("UPDATE students SET name = ? WHERE id = ?").run(name, req.params.id);
@@ -21947,10 +22225,10 @@ function registerRosterRoutes(ctx) {
       if (student_number !== void 0) kernelContainer.db.prepare("UPDATE students SET student_number = ? WHERE id = ?").run(student_number, req.params.id);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.delete("/api/students/:id", (req, res) => {
+  app.delete("/api/students/:id", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       kernelContainer.db.prepare("DELETE FROM class_students WHERE student_id = ?").run(req.params.id);
       kernelContainer.db.prepare("DELETE FROM student_lesson_progress WHERE student_id = ?").run(req.params.id);
@@ -21966,7 +22244,7 @@ function registerRosterRoutes(ctx) {
       kernelContainer.db.prepare("DELETE FROM students WHERE id = ?").run(req.params.id);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/students/:id/export", (req, res) => {
@@ -22003,14 +22281,11 @@ function registerRosterRoutes(ctx) {
         exportedAt: (/* @__PURE__ */ new Date()).toISOString()
       });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.delete("/api/students/:id/gdpr-delete", (req, res) => {
+  app.delete("/api/students/:id/gdpr-delete", requireAuth("teacher", "administrator"), (req, res) => {
     try {
-      if (!checkIsTeacherOrAdmin(req)) {
-        return res.status(403).json({ error: "Only teachers and administrators can perform GDPR deletion" });
-      }
       const studentId = req.params.id;
       const { confirm } = req.body;
       if (confirm !== true) {
@@ -22031,7 +22306,7 @@ function registerRosterRoutes(ctx) {
       console.log(`[GDPR] Complete data deletion for student ${studentId}`);
       res.json({ success: true, message: "All student data has been permanently deleted." });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/students/:id/progress", (req, res) => {
@@ -22044,11 +22319,16 @@ function registerRosterRoutes(ctx) {
       `).all(req.params.id);
       res.json(progress);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/students/:id/progress", (req, res) => {
+  app.post("/api/students/:id/progress", requireAuth(), (req, res) => {
     try {
+      const session = req.session;
+      const isPrivileged = session && (session.role === "teacher" || session.role === "administrator");
+      if (!isPrivileged && session?.userId !== req.params.id) {
+        return res.status(403).json({ error: "Cannot update progress for another student" });
+      }
       const { lessonId, completed, progressPercent, completedSegments } = req.body;
       const completedSegmentsStr = typeof completedSegments === "string" ? completedSegments : JSON.stringify(completedSegments || []);
       kernelContainer.db.prepare(`
@@ -22075,10 +22355,10 @@ function registerRosterRoutes(ctx) {
       });
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/classes/:id/students", (req, res) => {
+  app.post("/api/classes/:id/students", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { studentId } = req.body;
       kernelContainer.db.prepare("INSERT OR IGNORE INTO class_students (class_id, student_id, joined_at) VALUES (?, ?, ?)").run(
@@ -22088,7 +22368,7 @@ function registerRosterRoutes(ctx) {
       );
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/classes/:id/students/bulk-enroll", requireAuth("teacher", "administrator"), (req, res) => {
@@ -22130,7 +22410,7 @@ function registerRosterRoutes(ctx) {
       }
       res.json({ success: true, count: results.length, results });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/classes/:id/progress", (req, res) => {
@@ -22145,7 +22425,7 @@ function registerRosterRoutes(ctx) {
       `).all(req.params.id);
       res.json(progress);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/classes/:classId/lessons/:lessonId/progress", (req, res) => {
@@ -22165,15 +22445,15 @@ function registerRosterRoutes(ctx) {
       `).all(req.params.lessonId, req.params.lessonId, req.params.classId);
       res.json(progress);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.delete("/api/classes/:classId/students/:studentId", (req, res) => {
+  app.delete("/api/classes/:classId/students/:studentId", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       kernelContainer.db.prepare("DELETE FROM class_students WHERE class_id = ? AND student_id = ?").run(req.params.classId, req.params.studentId);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/classes/:classId/dashboard", (req, res) => {
@@ -22216,11 +22496,16 @@ function registerRosterRoutes(ctx) {
       `).all(req.params.classId, req.params.classId);
       res.json({ assignments, recentSubmissions, performance: performance2, rollcallStats });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/students/:id/dashboard", (req, res) => {
+  app.get("/api/students/:id/dashboard", requireAuth(), (req, res) => {
     try {
+      const session = req.session;
+      const isPrivileged = session && (session.role === "teacher" || session.role === "administrator");
+      if (!isPrivileged && session?.userId !== req.params.id) {
+        return res.status(403).json({ error: "Cannot access another student dashboard" });
+      }
       const studentId = req.params.id;
       const studentClasses = kernelContainer.db.prepare(`
         SELECT c.*
@@ -22295,7 +22580,7 @@ function registerRosterRoutes(ctx) {
       `).get(studentId);
       res.json({ classes: studentClasses, schedules, assignments, progress, rollcalls, profile });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
 }
@@ -22303,30 +22588,16 @@ function registerRosterRoutes(ctx) {
 // server/routes/assignments.ts
 var import_genai4 = require("@google/genai");
 function registerAssignmentsRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
+  const { app } = ctx;
   app.get("/api/classes/:classId/assignments", (req, res) => {
     try {
       const assignments = kernelContainer.db.prepare("SELECT * FROM assignments WHERE class_id = ? ORDER BY created_at DESC").all(req.params.classId);
       res.json(assignments);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/classes/:classId/assignments/generate", async (req, res) => {
+  app.post("/api/classes/:classId/assignments/generate", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { topic, lessonId } = req.body;
       const ai = new import_genai4.GoogleGenAI({ apiKey: process.env.GEMINI_API_KEY });
@@ -22351,10 +22622,10 @@ function registerAssignmentsRoutes(ctx) {
       );
       res.json({ success: true, assignment: { id, class_id: req.params.classId, lesson_id: lessonId || null, title: gen.title, description: gen.description, content: gen.content } });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/classes/:classId/assignments/suggest", async (req, res) => {
+  app.post("/api/classes/:classId/assignments/suggest", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { lessonId } = req.body;
       const lesson = kernelContainer.db.prepare("SELECT * FROM lessons WHERE id = ?").get(lessonId);
@@ -22418,10 +22689,10 @@ Generate the response in the specified JSON schema.`;
       const text = response.text || "{}";
       res.json(JSON.parse(text));
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/classes/:classId/assignments/create-suggested-quiz", async (req, res) => {
+  app.post("/api/classes/:classId/assignments/create-suggested-quiz", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { title, description, questions, learningObjectives, timeLimit, lessonId } = req.body;
       const id = "ast-" + Date.now().toString(36);
@@ -22442,12 +22713,17 @@ Generate the response in the specified JSON schema.`;
       );
       res.json({ success: true, assignmentId: id });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/assignments/:id/submissions", (req, res) => {
+  app.post("/api/assignments/:id/submissions", requireAuth(), (req, res) => {
     try {
       const { studentId, content } = req.body;
+      const session = req.session;
+      const isPrivileged = session && (session.role === "teacher" || session.role === "administrator");
+      if (!isPrivileged && session?.userId !== studentId) {
+        return res.status(403).json({ error: "Cannot submit assignment on behalf of another student" });
+      }
       kernelContainer.db.prepare(`
         INSERT INTO assignment_submissions (assignment_id, student_id, content, submitted_at, status)
         VALUES (?, ?, ?, ?, 'submitted')
@@ -22455,7 +22731,7 @@ Generate the response in the specified JSON schema.`;
       `).run(req.params.id, studentId, content, Date.now());
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/assignments/:id/submissions", (req, res) => {
@@ -22469,10 +22745,10 @@ Generate the response in the specified JSON schema.`;
       `).all(req.params.id);
       res.json(submissions);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.post("/api/assignments/:id/submissions/:studentId/grade", async (req, res) => {
+  app.post("/api/assignments/:id/submissions/:studentId/grade", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const asb = kernelContainer.db.prepare("SELECT * FROM assignment_submissions WHERE assignment_id = ? AND student_id = ?").get(req.params.id, req.params.studentId);
       const ast = kernelContainer.db.prepare("SELECT * FROM assignments WHERE id = ?").get(req.params.id);
@@ -22554,7 +22830,7 @@ Provide a grade score (0-100) and brief feedback. Ensure you output in this exac
       });
       res.json({ success: true, pendingApproval: true, message: "Grade generated and sent for approval.", score: grade.score, feedback: grade.feedback });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
 }
@@ -22562,21 +22838,7 @@ Provide a grade score (0-100) and brief feedback. Ensure you output in this exac
 // server/routes/schedules.ts
 var import_genai5 = require("@google/genai");
 function registerSchedulesRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
+  const { app } = ctx;
   app.get("/api/schedules/today", (req, res) => {
     try {
       const clientDate = req.query.date || (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
@@ -22631,7 +22893,7 @@ function registerSchedulesRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/classes/:classId/schedules", (req, res) => {
+  app.post("/api/classes/:classId/schedules", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { lessonId, scheduledDate, timeSlot, status, notes } = req.body;
       const id = "sch-" + Date.now().toString(36);
@@ -22664,7 +22926,7 @@ function registerSchedulesRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.put("/api/classes/:classId/schedules/:scheduleId", (req, res) => {
+  app.put("/api/classes/:classId/schedules/:scheduleId", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { lessonId, scheduledDate, timeSlot, status, notes } = req.body;
       kernelContainer.db.prepare(`
@@ -22685,7 +22947,7 @@ function registerSchedulesRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.delete("/api/classes/:classId/schedules/:scheduleId", (req, res) => {
+  app.delete("/api/classes/:classId/schedules/:scheduleId", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       kernelContainer.db.prepare("DELETE FROM schedules WHERE id = ? AND class_id = ?").run(req.params.scheduleId, req.params.classId);
       kernelContainer.db.prepare("DELETE FROM attendance WHERE schedule_id = ?").run(req.params.scheduleId);
@@ -22694,7 +22956,7 @@ function registerSchedulesRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/classes/:classId/schedules/batch", (req, res) => {
+  app.post("/api/classes/:classId/schedules/batch", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { schedules } = req.body;
       const db2 = kernelContainer.db;
@@ -22723,7 +22985,7 @@ function registerSchedulesRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/timetable/ocr", async (req, res) => {
+  app.post("/api/timetable/ocr", requireAuth("teacher", "administrator"), async (req, res) => {
     const startTime = Date.now();
     console.log(`[OCR Start] Starting timetable OCR. Payload size: ${req.body.imageBase64?.length || 0} bytes. Lang: ${req.body.lang || "zh"}`);
     try {
@@ -22891,24 +23153,10 @@ function registerSchedulesRoutes(ctx) {
 }
 
 // server/routes/grading.ts
-init_interfaces();
 var import_genai6 = require("@google/genai");
+init_interfaces();
 function registerGradingRoutes(ctx) {
-  const {
-    app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
+  const { app } = ctx;
   app.get("/api/classes/:classId/attendance-summary", (req, res) => {
     try {
       const classId = req.params.classId;
@@ -23022,7 +23270,7 @@ function registerGradingRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/schedules/:scheduleId/attendance", (req, res) => {
+  app.post("/api/schedules/:scheduleId/attendance", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { studentId, status } = req.body;
       kernelContainer.db.prepare(`
@@ -23052,7 +23300,7 @@ function registerGradingRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/classes/:classId/grade-weights", (req, res) => {
+  app.post("/api/classes/:classId/grade-weights", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { attendance_weight, progress_weight, assignment_weight, exam_weight } = req.body;
       const total = Number(attendance_weight) + Number(progress_weight) + Number(assignment_weight) + Number(exam_weight);
@@ -23086,7 +23334,7 @@ function registerGradingRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/classes/:classId/exams", (req, res) => {
+  app.post("/api/classes/:classId/exams", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { title, description, max_score } = req.body;
       if (!title) return res.status(400).json({ error: "Title is required" });
@@ -23108,7 +23356,7 @@ function registerGradingRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/exams/:examId/scores", (req, res) => {
+  app.post("/api/exams/:examId/scores", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { scores } = req.body;
       if (!Array.isArray(scores)) return res.status(400).json({ error: "Scores array is required" });
@@ -23264,11 +23512,8 @@ function registerGradingRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/grade-sync", async (req, res) => {
+  app.post("/api/grade-sync", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
-      if (!checkIsTeacherOrAdmin(req)) {
-        return res.status(403).json({ success: false, error: "Access Denied: Teachers or Administrators only" });
-      }
       const { lessonId, studentId, grade } = req.body;
       if (!lessonId || !studentId || grade === void 0) {
         return res.status(400).json({ success: false, error: "lessonId, studentId, and grade are required" });
@@ -23289,11 +23534,8 @@ function registerGradingRoutes(ctx) {
       res.status(500).json({ success: false, error: e.message });
     }
   });
-  app.post("/api/students/:studentId/points", async (req, res) => {
+  app.post("/api/students/:studentId/points", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
-      if (!checkIsTeacherOrAdmin(req)) {
-        return res.status(403).json({ success: false, error: "Access Denied: Teachers or Administrators only" });
-      }
       const { studentId } = req.params;
       const { classId, dimensionId, deltaPoints, reason, pluginId } = req.body;
       if (!classId || !dimensionId || deltaPoints === void 0 || !reason) {
@@ -23325,7 +23567,7 @@ function registerGradingRoutes(ctx) {
       res.status(500).json({ success: false, error: e.message });
     }
   });
-  app.post("/api/classes/:classId/semester-reports/archive", (req, res) => {
+  app.post("/api/classes/:classId/semester-reports/archive", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { semesterName, reports } = req.body;
       if (!semesterName) return res.status(400).json({ error: "semesterName is required" });
@@ -23378,7 +23620,7 @@ function registerGradingRoutes(ctx) {
       res.status(500).json({ error: e.message });
     }
   });
-  app.post("/api/classes/:classId/students/:studentId/semester-ai-evaluation", async (req, res) => {
+  app.post("/api/classes/:classId/students/:studentId/semester-ai-evaluation", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { classId, studentId } = req.params;
       const { semesterName = "2026\u5E74\u6625\u5B63\u5B66\uFFFD?", providerId } = req.body;
@@ -23478,8 +23720,8 @@ ${examsText}
 
 // server/routes/plugins.ts
 var import_express2 = __toESM(require("express"), 1);
-var import_path13 = __toESM(require("path"), 1);
-var import_fs12 = __toESM(require("fs"), 1);
+var import_path14 = __toESM(require("path"), 1);
+var import_fs13 = __toESM(require("fs"), 1);
 
 // server/services/version-fetcher.ts
 var import_child_process2 = require("child_process");
@@ -23661,13 +23903,6 @@ function isSafeExternalUrl(urlStr) {
 function registerPluginsRoutes(ctx) {
   const {
     app,
-    io,
-    loginLimiter,
-    MF_REMOTE_CACHE: MF_REMOTE_CACHE2,
-    lessonActiveSegments: lessonActiveSegments2,
-    buildAgentSystemInstruction: buildAgentSystemInstruction2,
-    buildAgentFinalMessage: buildAgentFinalMessage2,
-    normalizeToolSchema: normalizeToolSchema2,
     buildOpenAITools: buildOpenAITools2,
     executeAgentToolCall: executeAgentToolCall2,
     buildOpenAIChatUrl: buildOpenAIChatUrl2,
@@ -23676,29 +23911,26 @@ function registerPluginsRoutes(ctx) {
   } = ctx;
   app.get("/api/docs/plugin-guide", (req, res) => {
     try {
-      const docPath = import_path13.default.join(process.cwd(), "docs_plugin_guide.md");
-      if (!import_fs12.default.existsSync(docPath)) {
+      const docPath = import_path14.default.join(process.cwd(), "docs_plugin_guide.md");
+      if (!import_fs13.default.existsSync(docPath)) {
         return res.status(404).json({ success: false, error: "Document not found" });
       }
-      const content = import_fs12.default.readFileSync(docPath, "utf-8");
+      const content = import_fs13.default.readFileSync(docPath, "utf-8");
       res.json({ success: true, content });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/admin/logs", (req, res) => {
-    if (!checkIsTeacherOrAdmin(req)) {
-      return res.status(403).json({ success: false, error: "Access denied: teachers or admins only" });
-    }
+  app.get("/api/admin/logs", requireAuth("administrator"), (req, res) => {
     try {
       const limit = parseInt(req.query.limit) || 200;
       const component = req.query.component;
       const levelFilter = req.query.level;
-      const logFile2 = import_path13.default.resolve(process.cwd(), "logs", "openlearn.log");
-      if (!import_fs12.default.existsSync(logFile2)) {
+      const logFile2 = import_path14.default.resolve(process.cwd(), "logs", "openlearn.log");
+      if (!import_fs13.default.existsSync(logFile2)) {
         return res.json({ success: true, logs: [] });
       }
-      const content = import_fs12.default.readFileSync(logFile2, "utf-8");
+      const content = import_fs13.default.readFileSync(logFile2, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       let parsedLogs = lines.map((line) => {
         try {
@@ -23729,7 +23961,7 @@ function registerPluginsRoutes(ctx) {
       const sliceStart = Math.max(0, parsedLogs.length - limit);
       res.json({ success: true, logs: parsedLogs.slice(sliceStart) });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/plugins", (req, res) => {
@@ -23754,7 +23986,7 @@ function registerPluginsRoutes(ctx) {
         isSystem: manifestId.startsWith("@openlearn/") || found.pluginId.startsWith("@openlearn/")
       });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/plugins/market", async (req, res) => {
@@ -23780,7 +24012,7 @@ function registerPluginsRoutes(ctx) {
       }
       res.json({ success: true, market: results });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/plugins/:id(*)/check-update", async (req, res) => {
@@ -23802,7 +24034,7 @@ function registerPluginsRoutes(ctx) {
       const result = await checkVersion(src, manifest.version || "0.0.0");
       res.json({ success: true, ...result });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/plugins/:id(*)/one-click-update", requireAuth("administrator"), async (req, res) => {
@@ -23841,9 +24073,9 @@ function registerPluginsRoutes(ctx) {
           });
         }
       } else {
-        const zipPath = import_path13.default.resolve(process.cwd(), "v2_plugins/research-workflow/aymwoo-plugin-research-workflow.zip");
-        if (import_fs12.default.existsSync(zipPath)) {
-          zipBuffer = import_fs12.default.readFileSync(zipPath);
+        const zipPath = import_path14.default.resolve(process.cwd(), "v2_plugins/research-workflow/aymwoo-plugin-research-workflow.zip");
+        if (import_fs13.default.existsSync(zipPath)) {
+          zipBuffer = import_fs13.default.readFileSync(zipPath);
         } else {
           return res.status(404).json({ success: false, error: "\u672A\u627E\u5230\u66F4\u65B0\u5B89\u88C5\u5305" });
         }
@@ -23863,7 +24095,7 @@ function registerPluginsRoutes(ctx) {
       });
     } catch (err) {
       console.error(err);
-      res.status(500).json({ success: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.get("/api/plugins/:id(*)/contributions", (req, res) => {
@@ -23872,7 +24104,7 @@ function registerPluginsRoutes(ctx) {
       const summary = kernelContainer.pluginHost.listContributions(rawId);
       res.json({ success: true, result: summary });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/plugins/:id(*)/config", (req, res) => {
@@ -23892,7 +24124,7 @@ function registerPluginsRoutes(ctx) {
         }
       });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/plugins/:id(*)/config", requireAuth("administrator"), (req, res) => {
@@ -23911,7 +24143,7 @@ function registerPluginsRoutes(ctx) {
       kernelContainer.pluginHost.setPluginConfig(pluginId, manifest, updates);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/plugins/:id(*)/toggle", requireAuth("administrator"), async (req, res) => {
@@ -23925,7 +24157,7 @@ function registerPluginsRoutes(ctx) {
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (err) {
-      res.status(500).json({ success: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.delete("/api/plugins/:id(*)", requireAuth("administrator"), async (req, res) => {
@@ -23939,7 +24171,7 @@ function registerPluginsRoutes(ctx) {
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (err) {
-      res.status(500).json({ success: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.get("/api/plugins/:id(*)", async (req, res) => {
@@ -23968,7 +24200,7 @@ function registerPluginsRoutes(ctx) {
       res.json(result);
     } catch (err) {
       console.error(err);
-      res.status(500).json({ success: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.post("/api/plugins/upload-zip", requireAuth("administrator"), async (req, res) => {
@@ -23983,7 +24215,7 @@ function registerPluginsRoutes(ctx) {
       res.json(result);
     } catch (err) {
       console.error(err);
-      res.status(500).json({ success: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.post("/api/plugins/upload-zip-raw", requireAuth("administrator"), import_express2.default.raw({ type: "application/octet-stream", limit: "400mb" }), async (req, res) => {
@@ -24025,7 +24257,7 @@ function registerPluginsRoutes(ctx) {
       });
     } catch (err) {
       console.error(err);
-      res.status(500).json({ success: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
   app.post(
@@ -24058,7 +24290,7 @@ function registerPluginsRoutes(ctx) {
         });
       } catch (err) {
         console.error(err);
-        res.status(500).json({ success: false, error: err.message });
+        sendSafeError(res, err);
       }
     }
   );
@@ -24102,10 +24334,10 @@ function registerPluginsRoutes(ctx) {
       res.json({ success: true, result });
     } catch (err) {
       console.error("[execute-command]", err.message);
-      res.status(500).json({ success: false, error: err.message });
+      sendSafeError(res, err);
     }
   });
-  app.get("/api/ai-providers", (req, res) => {
+  app.get("/api/ai-providers", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const providers = kernelContainer.db.prepare("SELECT * FROM ai_providers ORDER BY created_at DESC").all();
       const masked = providers.map((p) => ({
@@ -24114,7 +24346,7 @@ function registerPluginsRoutes(ctx) {
       }));
       res.json(masked);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/ai-providers", requireAuth("administrator"), (req, res) => {
@@ -24129,7 +24361,7 @@ function registerPluginsRoutes(ctx) {
       kernelContainer.db.prepare("INSERT INTO ai_providers (id, name, api_url, api_key, model_name, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)").run(id, name, api_url, encryptedKey, model_name, now, now);
       res.json({ success: true, id });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.put("/api/ai-providers/:id", requireAuth("administrator"), (req, res) => {
@@ -24149,7 +24381,7 @@ function registerPluginsRoutes(ctx) {
       kernelContainer.db.prepare("UPDATE ai_providers SET name = ?, api_url = ?, api_key = ?, model_name = ?, updated_at = ? WHERE id = ?").run(name, api_url, finalKey, model_name, now, req.params.id);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.delete("/api/ai-providers/:id", requireAuth("administrator"), (req, res) => {
@@ -24157,7 +24389,7 @@ function registerPluginsRoutes(ctx) {
       kernelContainer.db.prepare("DELETE FROM ai_providers WHERE id = ?").run(req.params.id);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.get("/api/site-settings", (req, res) => {
@@ -24169,7 +24401,7 @@ function registerPluginsRoutes(ctx) {
         logoUrl: row?.logo_url || null
       });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.put("/api/site-settings", requireAuth("administrator"), (req, res) => {
@@ -24184,7 +24416,7 @@ function registerPluginsRoutes(ctx) {
         siteInfo: { siteName: siteName || "", slogan: slogan || "", logoUrl: logoUrl || null }
       });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/ai-providers/test", requireAuth("administrator"), async (req, res) => {
@@ -24233,7 +24465,7 @@ function registerPluginsRoutes(ctx) {
         res.status(response.status).json({ success: false, error: `API responded with status ${response.status}: ${responseText.slice(0, 200)}` });
       }
     } catch (e) {
-      res.status(500).json({ success: false, error: `Connection failed: ${e.message}` });
+      sendSafeError(res, e, 500, "Connection failed");
     }
   });
 }
@@ -24253,6 +24485,15 @@ async function startServer() {
     environment: process.env.NODE_ENV || "development",
     config: { port: Number(process.env.PORT) || 9e3 }
   });
+  try {
+    const migrationsDir = import_path15.default.join(process.cwd(), "migrations");
+    const migrations = loadMigrationsFromDirectory(migrationsDir);
+    if (migrations.length > 0) {
+      runMigrations(kernelContainer.db, migrations);
+    }
+  } catch (err) {
+    console.error("[Migration] Failed to run database migrations:", err);
+  }
   await runStartupMigrations(kernelContainer.db);
   await kernelContainer.ready;
   const activityRegistry = new ActivityRegistry2();
@@ -24263,23 +24504,27 @@ async function startServer() {
   kernelContainer.pluginHost.setExpressApp(app);
   const PORT = parseInt(process.env.PORT || "9000", 10);
   app.set("trust proxy", 1);
+  const frameAllowedOrigins = process.env.ALLOWED_FRAME_ORIGINS ? process.env.ALLOWED_FRAME_ORIGINS.split(",").map((s) => s.trim()) : ["http://localhost:*", "http://127.0.0.1:*"];
   app.use((0, import_helmet.default)({
     contentSecurityPolicy: {
       directives: {
         defaultSrc: ["'self'"],
-        scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'", "https:", "blob:", "data:"],
-        styleSrc: ["'self'", "'unsafe-inline'", "https:", "https://fonts.googleapis.com"],
+        // 移除通配 https: 与 data:，禁止加载全网任意第三方未授权脚本
+        scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'", "blob:"],
+        styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
         imgSrc: ["'self'", "data:", "blob:", "https:"],
         connectSrc: ["'self'", "ws:", "wss:", "https:"],
-        fontSrc: ["'self'", "data:", "https:", "https://fonts.gstatic.com"],
-        frameSrc: ["'self'", "blob:", "data:", "http://localhost", "http://127.0.0.1", "http:", "https:"],
-        objectSrc: ["'none'"]
+        fontSrc: ["'self'", "data:", "https://fonts.gstatic.com"],
+        // 移除通配 http: 和 https:，限制 iframe 仅能加载本地、沙箱或受信任课件源
+        frameSrc: ["'self'", "blob:", "data:", ...frameAllowedOrigins],
+        objectSrc: ["'none'"],
+        baseUri: ["'self'"]
       }
     },
     crossOriginOpenerPolicy: false,
     crossOriginEmbedderPolicy: false,
     crossOriginResourcePolicy: { policy: "cross-origin" },
-    // 允许沙箱 iframe（opaque origin）加载静态资�?
+    // 允许沙箱 iframe（opaque origin）加载静态资?
     originAgentCluster: false,
     strictTransportSecurity: false
     // �? HTTP 部署，禁�? HSTS（否则浏览器缓存后强�? HTTPS，导�? ERR_CONNECTION_REFUSED�?
@@ -24294,8 +24539,8 @@ async function startServer() {
   });
   app.use(import_express3.default.json({ limit: "10mb" }));
   app.use(import_express3.default.urlencoded({ limit: "10mb", extended: true }));
-  app.use("/uploads", import_express3.default.static(import_path14.default.join(process.cwd(), "uploads")));
-  app.use("/plugins", import_express3.default.static(import_path14.default.join(process.cwd(), "plugins")));
+  app.use("/uploads", import_express3.default.static(import_path15.default.join(process.cwd(), "uploads")));
+  app.use("/plugins", import_express3.default.static(import_path15.default.join(process.cwd(), "plugins")));
   app.use((req, res, next) => {
     const origin = req.headers.origin;
     if (origin === "null" || origin === void 0) {
@@ -24325,14 +24570,58 @@ async function startServer() {
     activityRegistry
   };
   const httpServer = (0, import_http.createServer)(app);
-  const allowedOrigins = process.env.ALLOWED_ORIGINS ? process.env.ALLOWED_ORIGINS.split(",") : process.env.NODE_ENV === "production" ? [] : ["http://localhost:5173", "http://localhost:9000", "http://localhost:4173"];
+  const allowedOrigins = process.env.ALLOWED_ORIGINS ? process.env.ALLOWED_ORIGINS.split(",").map((s) => s.trim()) : process.env.NODE_ENV === "production" ? [] : ["http://localhost:5173", "http://localhost:9000", "http://localhost:4173"];
   const io = new import_socket.Server(httpServer, {
     cors: {
-      origin: allowedOrigins.length > 0 ? allowedOrigins : "*",
+      origin: (origin, callback) => {
+        if (!origin) return callback(null, true);
+        if (allowedOrigins.length === 0) {
+          return callback(new Error("CORS not allowed"));
+        }
+        if (allowedOrigins.includes(origin) || allowedOrigins.includes("*")) {
+          return callback(null, true);
+        }
+        return callback(new Error("Not allowed by CORS"));
+      },
       methods: ["GET", "POST"],
       credentials: true
     }
   });
+  io.use((socket, next) => {
+    try {
+      const cookieHeader = socket.handshake.headers.cookie;
+      let token = null;
+      if (cookieHeader) {
+        const parts = cookieHeader.split(";");
+        for (const part of parts) {
+          const trimmed = part.trim();
+          if (trimmed.startsWith("edu_os_token=")) {
+            token = trimmed.substring("edu_os_token=".length);
+            break;
+          }
+        }
+      }
+      if (!token && socket.handshake.auth?.token) {
+        token = socket.handshake.auth.token;
+      }
+      if (process.env.NODE_ENV === "test" && !token) {
+        return next();
+      }
+      if (!token) {
+        return next(new Error("Authentication required: missing edu_os_token"));
+      }
+      const session = getValidSession(token);
+      if (!session) {
+        return next(new Error("Authentication required: session expired or invalid"));
+      }
+      socket.data.session = session;
+      socket.data.userId = session.userId;
+      socket.data.role = session.role;
+      next();
+    } catch (err) {
+      next(new Error(`Authentication error: ${err.message}`));
+    }
+  });
   kernelContainer.pluginHost.setSocketIO(io);
   ctx.io = io;
   registerOsRoutes(ctx);
@@ -24361,10 +24650,10 @@ async function startServer() {
     });
     app.use(vite.middlewares);
   } else {
-    const distPath = __dirname || import_path14.default.join(process.cwd(), "dist");
+    const distPath = __dirname || import_path15.default.join(process.cwd(), "dist");
     app.use(import_express3.default.static(distPath));
     app.get("*", (req, res) => {
-      res.sendFile(import_path14.default.join(distPath, "index.html"));
+      res.sendFile(import_path15.default.join(distPath, "index.html"));
     });
   }
   httpServer.on("error", (err) => {
@@ -24384,8 +24673,8 @@ async function startServer() {
   const startTime = Date.now();
   let platformVersion = "0.0.0";
   try {
-    const pkgPath = import_path14.default.join(process.cwd(), "package.json");
-    const pkg = JSON.parse(import_fs13.default.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = import_path15.default.join(process.cwd(), "package.json");
+    const pkg = JSON.parse(import_fs14.default.readFileSync(pkgPath, "utf-8"));
     platformVersion = pkg.version ?? platformVersion;
   } catch {
   }
@@ -24401,7 +24690,7 @@ async function startServer() {
       res.status(503).json({ status: "not_ready", error: e.message });
     }
   });
-  app.get("/metrics", (_req, res) => {
+  app.get("/metrics", requireAuth("administrator"), (_req, res) => {
     const mem = process.memoryUsage();
     res.json({
       uptime: Math.floor((Date.now() - startTime) / 1e3),