openlearn-next 0.3.18 → 0.3.19

package/dist/server.cjs

@@ -549,15 +549,77 @@ var init_ai_event_bus = __esm({
   }
 });
 
-// packages/core/di/ai-service.ts
-function decryptKeyIfNeeded(encrypted) {
+// packages/core/di/api-key-crypto.ts
+function getEncryptionKey() {
+  if (_encryptionKey) return _encryptionKey;
+  const envPath = import_node_path.default.resolve(process.cwd(), ".env");
+  const keyHex = process.env.ENCRYPTION_KEY;
+  if (keyHex && keyHex.trim() !== "") {
+    _encryptionKey = Buffer.from(keyHex.trim(), "hex");
+    return _encryptionKey;
+  }
+  if (import_node_fs.default.existsSync(envPath)) {
+    try {
+      const content = import_node_fs.default.readFileSync(envPath, "utf-8");
+      const match = content.match(/^ENCRYPTION_KEY=(.+)$/m);
+      if (match && match[1].trim() !== "") {
+        const fileKeyHex = match[1].trim();
+        _encryptionKey = Buffer.from(fileKeyHex, "hex");
+        process.env.ENCRYPTION_KEY = fileKeyHex;
+        console.log("[Crypto] ENCRYPTION_KEY loaded from .env file");
+        return _encryptionKey;
+      }
+    } catch {
+    }
+  }
+  const newKey = import_node_crypto.default.randomBytes(32).toString("hex");
+  try {
+    if (import_node_fs.default.existsSync(envPath)) {
+      const existingContent = import_node_fs.default.readFileSync(envPath, "utf-8");
+      if (/^ENCRYPTION_KEY=/m.test(existingContent)) {
+        console.warn(
+          "[Crypto] ENCRYPTION_KEY missing/empty in .env; NOT overwriting existing entry. Generating ephemeral in-memory key \u2014 please set ENCRYPTION_KEY manually before relying on encrypted storage."
+        );
+        process.env.ENCRYPTION_KEY = newKey;
+        _encryptionKey = Buffer.from(newKey, "hex");
+        return _encryptionKey;
+      }
+      import_node_fs.default.appendFileSync(envPath, `
+ENCRYPTION_KEY=${newKey}
+`);
+      console.log("[Crypto] ENCRYPTION_KEY auto-generated and persisted to .env");
+    } else {
+      import_node_fs.default.writeFileSync(envPath, `ENCRYPTION_KEY=${newKey}
+`);
+      console.log("[Crypto] .env created with auto-generated ENCRYPTION_KEY");
+    }
+  } catch {
+    console.warn("[Crypto] Could not persist ENCRYPTION_KEY, using in-memory fallback");
+  }
+  process.env.ENCRYPTION_KEY = newKey;
+  _encryptionKey = Buffer.from(newKey, "hex");
+  return _encryptionKey;
+}
+function encryptApiKey(plaintext) {
+  if (!plaintext) return "";
+  const key = getEncryptionKey();
+  const iv = import_node_crypto.default.randomBytes(16);
+  const cipher = import_node_crypto.default.createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
+}
+function looksLikeCiphertext(value) {
+  const parts = (value || "").split(":");
+  if (parts.length !== 3) return false;
+  return parts.every((p) => p.length > 0 && /^[0-9a-fA-F]+$/.test(p));
+}
+function decryptApiKey(encrypted) {
   if (!encrypted) return "";
   const parts = encrypted.split(":");
   if (parts.length !== 3) return encrypted;
   try {
-    const rawKey = process.env.ENCRYPTION_KEY;
-    if (!rawKey) return encrypted;
-    const key = rawKey.length === 64 ? Buffer.from(rawKey, "hex") : import_node_crypto.default.createHash("sha256").update(rawKey).digest();
+    const key = getEncryptionKey();
     const iv = Buffer.from(parts[0], "hex");
     const authTag = Buffer.from(parts[1], "hex");
     const ciphertext = Buffer.from(parts[2], "hex");
@@ -565,15 +627,27 @@ function decryptKeyIfNeeded(encrypted) {
     decipher.setAuthTag(authTag);
     return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf-8");
   } catch {
+    console.warn("[Crypto] Failed to decrypt API key, treating as plaintext");
     return encrypted;
   }
 }
-var import_node_crypto, AIService;
+var import_node_crypto, import_node_fs, import_node_path, _encryptionKey;
+var init_api_key_crypto = __esm({
+  "packages/core/di/api-key-crypto.ts"() {
+    import_node_crypto = __toESM(require("node:crypto"), 1);
+    import_node_fs = __toESM(require("node:fs"), 1);
+    import_node_path = __toESM(require("node:path"), 1);
+    _encryptionKey = null;
+  }
+});
+
+// packages/core/di/ai-service.ts
+var AIService;
 var init_ai_service = __esm({
   "packages/core/di/ai-service.ts"() {
-    import_node_crypto = __toESM(require("node:crypto"), 1);
     init_provider_gateway();
     init_ai_event_bus();
+    init_api_key_crypto();
     AIService = class {
       constructor(db2) {
         this.db = db2;
@@ -586,11 +660,20 @@ var init_ai_service = __esm({
         if (!provider || !provider.api_key) {
           throw new Error("\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u6DFB\u52A0\u5E76\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002");
         }
+        const apiKey = decryptApiKey(provider.api_key);
+        if (!apiKey || !apiKey.trim()) {
+          throw new Error("AI Provider API Key \u89E3\u5BC6\u4E3A\u7A7A\uFF0C\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u91CD\u65B0\u4FDD\u5B58\u5BC6\u94A5\u3002");
+        }
+        if (looksLikeCiphertext(apiKey)) {
+          throw new Error(
+            "AI Provider API Key \u89E3\u5BC6\u5931\u8D25\uFF1AENCRYPTION_KEY \u4E0E\u52A0\u5BC6\u65F6\u4E0D\u4E00\u81F4\uFF08\u5E38\u89C1\u4E8E PM2 \u5C06 ENCRYPTION_KEY \u7F6E\u7A7A\u6216\u5BC6\u94A5\u88AB\u8F6E\u6362\uFF09\u3002\u8BF7\u6062\u590D\u539F ENCRYPTION_KEY\uFF0C\u6216\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u91CD\u65B0\u4FDD\u5B58 API Key\u3002"
+          );
+        }
         const config = {
           id: provider.id,
           name: provider.name,
           apiUrl: provider.api_url,
-          apiKey: decryptKeyIfNeeded(provider.api_key),
+          apiKey,
           modelName: provider.model_name
         };
         return this.gateway.generateText(prompt, options, config);
@@ -969,18 +1052,18 @@ var init_http_router = __esm({
 function createLogger(component) {
   return logger.child({ component });
 }
-var import_pino, import_node_fs, import_node_path, level, logDir, logFile, streams, logger;
+var import_pino, import_node_fs2, import_node_path2, level, logDir, logFile, streams, logger;
 var init_logger = __esm({
   "server/utils/logger.ts"() {
     import_pino = __toESM(require("pino"), 1);
-    import_node_fs = __toESM(require("node:fs"), 1);
-    import_node_path = __toESM(require("node:path"), 1);
+    import_node_fs2 = __toESM(require("node:fs"), 1);
+    import_node_path2 = __toESM(require("node:path"), 1);
     level = process.env.LOG_LEVEL || (process.env.NODE_ENV === "production" ? "info" : "debug");
-    logDir = import_node_path.default.resolve(process.cwd(), "logs");
-    if (!import_node_fs.default.existsSync(logDir)) {
-      import_node_fs.default.mkdirSync(logDir, { recursive: true });
+    logDir = import_node_path2.default.resolve(process.cwd(), "logs");
+    if (!import_node_fs2.default.existsSync(logDir)) {
+      import_node_fs2.default.mkdirSync(logDir, { recursive: true });
     }
-    logFile = import_node_path.default.join(logDir, "openlearn.log");
+    logFile = import_node_path2.default.join(logDir, "openlearn.log");
     streams = [];
     if (process.env.NODE_ENV !== "production") {
       streams.push({
@@ -1002,7 +1085,7 @@ var init_logger = __esm({
     }
     streams.push({
       level,
-      stream: import_node_fs.default.createWriteStream(logFile, { flags: "a" })
+      stream: import_node_fs2.default.createWriteStream(logFile, { flags: "a" })
     });
     logger = (0, import_pino.default)({ level }, import_pino.default.multistream(streams));
   }
@@ -3509,12 +3592,12 @@ parentPort.on('message', async function(msg) {
 });
 `;
 }
-var import_node_worker_threads, import_fs4, import_node_path2, import_uuid12, ALL_SERVICE_TOKENS, MAX_WORKERS, ACTIVATE_TIMEOUT_MS, ACTIVATE_PROGRESS_SLIDE_MS, WorkerRegistry, WorkerManager;
+var import_node_worker_threads, import_fs4, import_node_path3, import_uuid12, ALL_SERVICE_TOKENS, MAX_WORKERS, ACTIVATE_TIMEOUT_MS, ACTIVATE_PROGRESS_SLIDE_MS, WorkerRegistry, WorkerManager;
 var init_worker_manager = __esm({
   "packages/core/worker-runtime/worker-manager.ts"() {
     import_node_worker_threads = require("node:worker_threads");
     import_fs4 = __toESM(require("fs"), 1);
-    import_node_path2 = __toESM(require("node:path"), 1);
+    import_node_path3 = __toESM(require("node:path"), 1);
     init_transport();
     init_service_host();
     init_logger();
@@ -3802,7 +3885,7 @@ var init_worker_manager = __esm({
         const bootstrapDataUrl = `data:text/javascript;base64,${encodedBootstrap}`;
         let worker;
         try {
-          const resolvedPluginDir = pluginDir && import_fs4.default.existsSync(import_node_path2.default.join(pluginDir, "index.js")) ? pluginDir : void 0;
+          const resolvedPluginDir = pluginDir && import_fs4.default.existsSync(import_node_path3.default.join(pluginDir, "index.js")) ? pluginDir : void 0;
           worker = new import_node_worker_threads.Worker(new URL(bootstrapDataUrl), {
             // Pass both the DB id (`pluginId` — used as the actor/registry key)
             // and `manifestId` (used as the namespace prefix for command types).
@@ -4047,7 +4130,7 @@ __export(server_exports, {
 });
 module.exports = __toCommonJS(server_exports);
 var import_express3 = __toESM(require("express"), 1);
-var import_path16 = __toESM(require("path"), 1);
+var import_path15 = __toESM(require("path"), 1);
 var import_dotenv = __toESM(require("dotenv"), 1);
 var import_os2 = __toESM(require("os"), 1);
 var import_child_process3 = require("child_process");
@@ -8702,9 +8785,9 @@ var import_node_url = require("node:url");
 
 // packages/core/esm-loader/install-utils.ts
 var import_jszip = __toESM(require("jszip"), 1);
-var fs3 = __toESM(require("fs"), 1);
+var fs4 = __toESM(require("fs"), 1);
 var os2 = __toESM(require("os"), 1);
-var path4 = __toESM(require("path"), 1);
+var path5 = __toESM(require("path"), 1);
 var import_uuid10 = require("uuid");
 var MAX_UNCOMPRESSED_SIZE = 300 * 1024 * 1024;
 async function bundlePlugin(entryCode, resolveDir) {
@@ -8727,12 +8810,12 @@ async function bundlePlugin(entryCode, resolveDir) {
         setup(build) {
           build.onResolve({ filter: /.*/ }, (args) => {
             if (args.path.includes("core/di/interfaces")) {
-              const tsPath = path4.resolve(process.cwd(), "packages/core/di/interfaces.ts");
-              if (fs3.existsSync(tsPath)) {
+              const tsPath = path5.resolve(process.cwd(), "packages/core/di/interfaces.ts");
+              if (fs4.existsSync(tsPath)) {
                 return { path: tsPath };
               }
-              const jsPath = path4.resolve(process.cwd(), "packages/core/di/interfaces.js");
-              if (fs3.existsSync(jsPath)) {
+              const jsPath = path5.resolve(process.cwd(), "packages/core/di/interfaces.js");
+              if (fs4.existsSync(jsPath)) {
                 return { path: jsPath };
               }
             }
@@ -8788,22 +8871,22 @@ async function validateAndBundleZip(zipBuffer) {
     throw new Error(`Entry file "${manifest.main}" specified in manifest not found in ZIP package`);
   }
   const entryCode = await entryFile.async("string");
-  const tmpDir = path4.join(os2.tmpdir(), `plugin-build-${(0, import_uuid10.v7)()}`);
+  const tmpDir = path5.join(os2.tmpdir(), `plugin-build-${(0, import_uuid10.v7)()}`);
   try {
-    fs3.mkdirSync(tmpDir, { recursive: true });
+    fs4.mkdirSync(tmpDir, { recursive: true });
     for (const [name, file] of Object.entries(zip.files)) {
       if (file.dir) continue;
-      const filePath = path4.join(tmpDir, name);
-      const fileDir = path4.dirname(filePath);
-      fs3.mkdirSync(fileDir, { recursive: true });
+      const filePath = path5.join(tmpDir, name);
+      const fileDir = path5.dirname(filePath);
+      fs4.mkdirSync(fileDir, { recursive: true });
       const content = await file.async("nodebuffer");
-      fs3.writeFileSync(filePath, content);
+      fs4.writeFileSync(filePath, content);
     }
     const bundledCode = await bundlePlugin(entryCode, tmpDir);
     return { manifest, bundledCode, entryFileName: manifest.main };
   } finally {
     try {
-      fs3.rmSync(tmpDir, { recursive: true, force: true });
+      fs4.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -19743,93 +19826,14 @@ function registerOfficialActivities(registry, actionRegistry) {
 var IActivityRegistryToken = new Token("@openlearn/activity-ecosystem:IActivityRegistry");
 
 // server/routes/os.ts
-var import_path9 = __toESM(require("path"), 1);
-var import_fs9 = __toESM(require("fs"), 1);
+var import_path8 = __toESM(require("path"), 1);
+var import_fs8 = __toESM(require("fs"), 1);
 var import_child_process = require("child_process");
-var import_crypto7 = __toESM(require("crypto"), 1);
+var import_crypto6 = __toESM(require("crypto"), 1);
 var import_xss = require("xss");
 
 // server/utils/crypto.ts
-var import_crypto5 = __toESM(require("crypto"), 1);
-var import_fs8 = __toESM(require("fs"), 1);
-var import_path7 = __toESM(require("path"), 1);
-var _encryptionKey = null;
-function getEncryptionKey() {
-  if (_encryptionKey) return _encryptionKey;
-  const envPath = import_path7.default.resolve(process.cwd(), ".env");
-  const keyHex = process.env.ENCRYPTION_KEY;
-  if (keyHex && keyHex.trim() !== "") {
-    _encryptionKey = Buffer.from(keyHex.trim(), "hex");
-    return _encryptionKey;
-  }
-  if (import_fs8.default.existsSync(envPath)) {
-    try {
-      const content = import_fs8.default.readFileSync(envPath, "utf-8");
-      const match = content.match(/^ENCRYPTION_KEY=(.+)$/m);
-      if (match && match[1].trim() !== "") {
-        const fileKeyHex = match[1].trim();
-        _encryptionKey = Buffer.from(fileKeyHex, "hex");
-        process.env.ENCRYPTION_KEY = fileKeyHex;
-        console.log("[Crypto] ENCRYPTION_KEY loaded from .env file");
-        return _encryptionKey;
-      }
-    } catch {
-    }
-  }
-  const newKey = import_crypto5.default.randomBytes(32).toString("hex");
-  try {
-    if (import_fs8.default.existsSync(envPath)) {
-      const existingContent = import_fs8.default.readFileSync(envPath, "utf-8");
-      if (/^ENCRYPTION_KEY=/m.test(existingContent)) {
-        console.warn(
-          "[Crypto] ENCRYPTION_KEY missing/empty in .env; NOT overwriting existing entry. Generating ephemeral in-memory key \u2014 please set ENCRYPTION_KEY manually before relying on encrypted storage."
-        );
-        process.env.ENCRYPTION_KEY = newKey;
-        _encryptionKey = Buffer.from(newKey, "hex");
-        return _encryptionKey;
-      }
-      import_fs8.default.appendFileSync(envPath, `
-ENCRYPTION_KEY=${newKey}
-`);
-      console.log("[Crypto] ENCRYPTION_KEY auto-generated and persisted to .env");
-    } else {
-      import_fs8.default.writeFileSync(envPath, `ENCRYPTION_KEY=${newKey}
-`);
-      console.log("[Crypto] .env created with auto-generated ENCRYPTION_KEY");
-    }
-  } catch (e) {
-    console.warn("[Crypto] Could not persist ENCRYPTION_KEY, using in-memory fallback");
-  }
-  process.env.ENCRYPTION_KEY = newKey;
-  _encryptionKey = Buffer.from(newKey, "hex");
-  return _encryptionKey;
-}
-function encryptApiKey(plaintext) {
-  if (!plaintext) return "";
-  const key = getEncryptionKey();
-  const iv = import_crypto5.default.randomBytes(16);
-  const cipher = import_crypto5.default.createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-  const authTag = cipher.getAuthTag();
-  return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
-}
-function decryptApiKey(encrypted) {
-  if (!encrypted) return "";
-  const parts = encrypted.split(":");
-  if (parts.length !== 3) return encrypted;
-  try {
-    const key = getEncryptionKey();
-    const iv = Buffer.from(parts[0], "hex");
-    const authTag = Buffer.from(parts[1], "hex");
-    const ciphertext = Buffer.from(parts[2], "hex");
-    const decipher = import_crypto5.default.createDecipheriv("aes-256-gcm", key, iv);
-    decipher.setAuthTag(authTag);
-    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf-8");
-  } catch {
-    console.warn("[Crypto] Failed to decrypt API key, treating as plaintext");
-    return encrypted;
-  }
-}
+init_api_key_crypto();
 function maskApiKey(key) {
   if (!key || key.length <= 8) return key ? "****" : "";
   return key.substring(0, 4) + "****" + key.substring(key.length - 4);
@@ -19847,8 +19851,8 @@ function detectPromptInjection(input) {
 }
 
 // server/routes/shared.ts
-var import_path8 = __toESM(require("path"), 1);
-var import_crypto6 = __toESM(require("crypto"), 1);
+var import_path7 = __toESM(require("path"), 1);
+var import_crypto5 = __toESM(require("crypto"), 1);
 
 // server/utils/bridge-sdk.ts
 var BRIDGE_SDK_CODE = `(function() {
@@ -20315,7 +20319,7 @@ var BRIDGE_SDK_CODE = `(function() {
               const text = (el.textContent || el.innerText || '').trim();
               if (text) {
                 logData.push("Selector '" + selector + "' matched text: '" + text + "'");
-                const fractionMatch = text.match(/(\\\\d+(\\\\.\\\\d+)?)\\\\s*[\\\\/|\u4E4B]\\\\s*(\\\\d+)/);
+                const fractionMatch = text.match(/(\\d+(\\.\\d+)?)\\s*[\\/|\u4E4B]\\s*(\\d+)/);
                 if (fractionMatch) {
                   const num = parseFloat(fractionMatch[1]);
                   const den = parseFloat(fractionMatch[3]);
@@ -20325,7 +20329,7 @@ var BRIDGE_SDK_CODE = `(function() {
                     return { score: pct, log: logData };
                   }
                 }
-                const match = text.match(/\\\\d+(\\\\.\\\\d+)?/);
+                const match = text.match(/\\d+(\\.\\d+)?/);
                 if (match) {
                   const num = parseFloat(match[0]);
                   if (!isNaN(num)) {
@@ -20366,7 +20370,7 @@ var BRIDGE_SDK_CODE = `(function() {
               if (txt) {
                 const hasKey = txt.includes('\u5F97\u5206') || txt.includes('\u5206\u6570') || txt.includes('\u6210\u7EE9') || txt.toLowerCase().includes('score') || txt.toLowerCase().includes('points');
                 if (hasKey) {
-                  const m = txt.match(/\\\\d+(\\\\.\\\\d+)?/);
+                  const m = txt.match(/\\d+(\\.\\d+)?/);
                   if (m) {
                     const val = parseFloat(m[0]);
                     logData.push("Fallback leaf <" + el.tagName + "> '" + txt + "' parsed: " + val);
@@ -20384,6 +20388,139 @@ var BRIDGE_SDK_CODE = `(function() {
       return { score: null, log: logData };
     }
 
+    // --- RESULT-SCREEN AUTO SUBMIT ---------------------------------------
+    // \u90E8\u5206\u8BFE\u4EF6\u7B54\u5B8C\u9898\u540E\u76F4\u63A5\u5207\u5230\u300C\u7ED3\u7B97 / \u7ED3\u679C\u9875\u300D\uFF0C\u5E76\u4E0D\u70B9\u51FB\u4EFB\u4F55\u63D0\u4EA4\u6309\u94AE\u3002
+    // \u8FD9\u91CC\u76D1\u542C\u7ED3\u7B97\u9875\u51FA\u73B0\uFF0C\u81EA\u52A8\u6293\u53D6\u5206\u6570\u5E76\u4E0A\u62A5\u4E00\u6B21\u3002
+    // \u53E3\u5F84\u4F18\u5148\u300C\u6B63\u786E\u9898\u6570 X/Y\u300D\u2192 \u767E\u5206\u5236\uFF0C\u5426\u5219\u56DE\u843D\u53EF\u89C1\u7684\u5206\u6570\u5143\u7D20\u3002
+    var __lmsResultSubmitted = false;
+    var __lmsResultScheduled = false;
+    var __lmsResultPolling = false;
+
+    // \u5F3A\u7ED3\u675F\u4FE1\u53F7\uFF1A\u53EA\u8BA4\u7ED3\u7B97/\u7ED3\u679C\u9875\u6587\u6848\uFF0C\u907F\u514D\u7B54\u9898\u8FC7\u7A0B\u4E2D\u8BEF\u89E6\u53D1
+    var __LMS_DONE_RE = /(\u95EF\u5173|\u6311\u6218|\u7B54\u9898|\u6D4B\u8BD5|\u6E38\u620F|\u672C\u8F6E|\u672C\u5173)(\u7ED3\u675F|\u5B8C\u6210|\u6210\u529F)|\u901A\u5173|\u7ED3\u7B97|\u67E5\u770B\u89E3\u6790|\u6B63\u786E\u7387|\u6700\u7EC8\u5F97\u5206|\u603B\u5F97\u5206|\u5168\u90E8\u7B54\u5B8C|\u7B54\u9898\u5B8C\u6BD5/;
+    // \u7528 [0-9] / [^0-9] \u4EE3\u66FF \\d / \\s\uFF0C\u89C4\u907F\u6A21\u677F\u5B57\u7B26\u4E32\u7684\u8F6C\u4E49\u9677\u9631
+    var __LMS_RATIO_RE = /([0-9]+(?:[.][0-9]+)?)[^0-9]*[/\uFF0F|\u4E4B][^0-9]*([0-9]+)/;
+    var __LMS_NUM_RE = /[0-9]+(?:[.][0-9]+)?/;
+
+    function __lmsVisibleText() {
+      try {
+        if (!document.body) return '';
+        if (typeof document.body.innerText === 'string') return document.body.innerText;
+        return document.body.textContent || '';
+      } catch (e) { return ''; }
+    }
+
+    function __lmsIsShown(el) {
+      try {
+        if (!el || !el.getBoundingClientRect) return false;
+        var rect = el.getBoundingClientRect();
+        if (rect.width <= 0 && rect.height <= 0) return false;
+        var node = el;
+        while (node && node.nodeType === 1) {
+          var st = window.getComputedStyle ? window.getComputedStyle(node) : null;
+          if (st && (st.display === 'none' || st.visibility === 'hidden')) return false;
+          node = node.parentElement;
+        }
+        return true;
+      } catch (e) { return false; }
+    }
+
+    // \u4EC5\u4ECE\u300C\u53EF\u89C1\u300D\u7684\u5206\u6570\u5143\u7D20\u53D6\u503C\uFF0C\u907F\u514D\u7ED3\u7B97\u9875\u5C1A\u672A\u5C55\u5F00\u65F6\u8BFB\u5230\u9690\u85CF\u7684\u521D\u59CB\u503C 0
+    function __lmsFindVisibleScore() {
+      var selectors = [
+        '#finalScore', '#score', '#scoreDisplay', '.score', '.final-score',
+        '[id*="score" i]', '[id*="point" i]', '[id*="grade" i]'
+      ];
+      for (var i = 0; i < selectors.length; i++) {
+        var nodes = [];
+        try { nodes = document.querySelectorAll(selectors[i]); } catch (e) { nodes = []; }
+        for (var j = 0; j < nodes.length; j++) {
+          if (!__lmsIsShown(nodes[j])) continue;
+          var txt = (nodes[j].textContent || '').trim();
+          if (!txt) continue;
+          var frac = txt.match(__LMS_RATIO_RE);
+          if (frac) {
+            var fn = parseFloat(frac[1]);
+            var fd = parseFloat(frac[2]);
+            if (fd > 0 && fn >= 0 && fn <= fd) return Math.round((fn / fd) * 10000) / 100;
+          }
+          var num = txt.match(__LMS_NUM_RE);
+          if (num) return parseFloat(num[0]);
+        }
+      }
+      return null;
+    }
+
+    function __lmsExtractResultScore() {
+      // 1) \u6B63\u786E\u9898\u6570 X/Y \u2192 \u767E\u5206\u5236\uFF08\u53E3\u5F84\u6700\u7A33\u5B9A\uFF09
+      var ratioSelectors = [
+        '#correctCount', '[id*="correct" i]', '[id*="accuracy" i]',
+        '[class*="correct" i]', '[class*="accuracy" i]', '[id*="ratio" i]'
+      ];
+      for (var i = 0; i < ratioSelectors.length; i++) {
+        var nodes = [];
+        try { nodes = document.querySelectorAll(ratioSelectors[i]); } catch (e) { nodes = []; }
+        for (var j = 0; j < nodes.length; j++) {
+          if (!__lmsIsShown(nodes[j])) continue;
+          var m = (nodes[j].textContent || '').trim().match(__LMS_RATIO_RE);
+          if (m) {
+            var num = parseFloat(m[1]);
+            var den = parseFloat(m[2]);
+            if (den > 0 && num >= 0 && num <= den) return Math.round((num / den) * 10000) / 100;
+          }
+        }
+      }
+      // 2) \u56DE\u843D\uFF1A\u53EF\u89C1\u5206\u6570\u5143\u7D20
+      return __lmsFindVisibleScore();
+    }
+
+    function __lmsMaybeSubmitResult() {
+      if (__lmsResultSubmitted || __lmsResultPolling) return;
+      if (!__LMS_DONE_RE.test(__lmsVisibleText())) return;
+
+      __lmsResultPolling = true;
+      // \u7ED3\u7B97\u9875 DOM \u53EF\u80FD\u5206\u6B65\u6E32\u67D3\uFF0C\u77ED\u8F6E\u8BE2\u53D6\u6700\u540E\u4E00\u6B21\u6709\u6548\u5206\u6570
+      var tries = 0;
+      var delays = [0, 120, 250, 400, 700, 1100];
+      var latest = null;
+
+      function poll() {
+        var s = __lmsExtractResultScore();
+        if (s !== null && !isNaN(s)) latest = s;
+        tries++;
+        if (tries < delays.length) {
+          setTimeout(poll, delays[tries]);
+          return;
+        }
+        __lmsResultPolling = false;
+        if (latest !== null && !__lmsResultSubmitted) {
+          __lmsResultSubmitted = true;
+          logToServer('Result screen detected, auto-submitting score: ' + latest);
+          window.LMS.submit({ score: latest, completion: 1.0, comment: '\u7ED3\u7B97\u9875\u81EA\u52A8\u63D0\u53D6\u5F97\u5206' });
+        }
+      }
+      poll();
+    }
+
+    function initResultWatcher() {
+      try {
+        if (!document.body) return;
+        var observer = new MutationObserver(function() {
+          if (__lmsResultSubmitted || __lmsResultScheduled) return;
+          __lmsResultScheduled = true;
+          setTimeout(function() {
+            __lmsResultScheduled = false;
+            __lmsMaybeSubmitResult();
+          }, 600);
+        });
+        observer.observe(document.body, { childList: true, subtree: true, characterData: true });
+        // \u5C11\u6570\u8BFE\u4EF6\u9996\u5C4F\u5373\u7ED3\u7B97
+        setTimeout(__lmsMaybeSubmitResult, 800);
+      } catch (e) {
+        logToServer('Error in initResultWatcher: ' + e.message);
+      }
+    }
+
     function attachListeners() {
       try {
         const buttons = document.querySelectorAll('button, input[type="button"], input[type="submit"], .btn, .button');
@@ -20477,6 +20614,7 @@ var BRIDGE_SDK_CODE = `(function() {
         });
         observer.observe(document.body, { childList: true, subtree: true });
         attachListeners();
+        initResultWatcher();
       } catch (e) {
         logToServer("Error in initAutoSubmit: " + e.message);
       }
@@ -20509,7 +20647,7 @@ function validateMagicBytes(buffer, fileName) {
     ".webp": [[82, 73, 70, 70]]
     // RIFF
   };
-  const ext = import_path8.default.extname(fileName || "").toLowerCase();
+  const ext = import_path7.default.extname(fileName || "").toLowerCase();
   const signatures = MAGIC_BYTES[ext];
   if (!signatures) return true;
   return signatures.some((sig) => sig.every((byte, i) => buffer[i] === byte));
@@ -20531,7 +20669,7 @@ function injectLmsSdk(htmlContent, req, cwInfo) {
         const classRow = kernelContainer.db.prepare("SELECT class_id FROM class_students WHERE student_id = ? LIMIT 1").get(session.studentId);
         let attempt = kernelContainer.db.prepare("SELECT id FROM courseware_attempt WHERE courseware_id = ? AND student_id = ? AND status = ?").get(cwInfo.id, session.studentId, "active");
         if (!attempt) {
-          const attemptId = "att_" + import_crypto6.default.randomBytes(8).toString("hex");
+          const attemptId = "att_" + import_crypto5.default.randomBytes(8).toString("hex");
           kernelContainer.db.prepare(
             "INSERT INTO courseware_attempt (id, courseware_id, student_id, started_at, status) VALUES (?, ?, ?, ?, ?)"
           ).run(attemptId, cwInfo.id, session.studentId, Date.now(), "active");
@@ -20546,7 +20684,7 @@ function injectLmsSdk(htmlContent, req, cwInfo) {
       } else if (session.role === "teacher" || session.role === "administrator") {
         let attempt = kernelContainer.db.prepare("SELECT id FROM courseware_attempt WHERE courseware_id = ? AND student_id = ? AND status = ?").get(cwInfo.id, "teacher", "active");
         if (!attempt) {
-          const attemptId = "att_teacher_" + import_crypto6.default.randomBytes(8).toString("hex");
+          const attemptId = "att_teacher_" + import_crypto5.default.randomBytes(8).toString("hex");
           kernelContainer.db.prepare(
             "INSERT INTO courseware_attempt (id, courseware_id, student_id, started_at, status) VALUES (?, ?, ?, ?, ?)"
           ).run(attemptId, cwInfo.id, "teacher", Date.now(), "active");
@@ -20564,7 +20702,7 @@ function injectLmsSdk(htmlContent, req, cwInfo) {
   if (studentInfo.attempt_id === "guest-attempt") {
     let attempt = kernelContainer.db.prepare("SELECT id FROM courseware_attempt WHERE courseware_id = ? AND student_id = ? AND status = ?").get(cwInfo.id, "guest", "active");
     if (!attempt) {
-      const attemptId = "att_guest_" + import_crypto6.default.randomBytes(8).toString("hex");
+      const attemptId = "att_guest_" + import_crypto5.default.randomBytes(8).toString("hex");
       kernelContainer.db.prepare(
         "INSERT INTO courseware_attempt (id, courseware_id, student_id, started_at, status) VALUES (?, ?, ?, ?, ?)"
       ).run(attemptId, cwInfo.id, "guest", Date.now(), "active");
@@ -20648,7 +20786,7 @@ function registerOsRoutes(ctx) {
       if (!filename || !base64Data) {
         return res.status(400).json({ error: "Filename and base64Data are required" });
       }
-      const ext = import_path9.default.extname(filename).toLowerCase();
+      const ext = import_path8.default.extname(filename).toLowerCase();
       if (BLOCKED_EXTENSIONS.includes(ext)) {
         return res.status(400).json({ error: `File type ${ext} is not allowed for security reasons.` });
       }
@@ -20660,13 +20798,13 @@ function registerOsRoutes(ctx) {
       if (!validateMagicBytes(fileBuffer, filename)) {
         return res.status(400).json({ error: "File content does not match the declared file type." });
       }
-      const uploadsDir = import_path9.default.join(process.cwd(), "uploads");
-      if (!import_fs9.default.existsSync(uploadsDir)) {
-        import_fs9.default.mkdirSync(uploadsDir, { recursive: true });
+      const uploadsDir = import_path8.default.join(process.cwd(), "uploads");
+      if (!import_fs8.default.existsSync(uploadsDir)) {
+        import_fs8.default.mkdirSync(uploadsDir, { recursive: true });
       }
-      const uniqueName = `${Date.now()}-${import_crypto7.default.randomBytes(4).toString("hex")}${ext}`;
-      const filePath = import_path9.default.join(uploadsDir, uniqueName);
-      import_fs9.default.writeFileSync(filePath, fileBuffer);
+      const uniqueName = `${Date.now()}-${import_crypto6.default.randomBytes(4).toString("hex")}${ext}`;
+      const filePath = import_path8.default.join(uploadsDir, uniqueName);
+      import_fs8.default.writeFileSync(filePath, fileBuffer);
       let slideCount = 1;
       if (ext === ".pdf") {
         try {
@@ -20879,8 +21017,8 @@ function registerOsRoutes(ctx) {
       });
       if (result && typeof result.agentText === "string") {
         const now = Date.now();
-        kernelContainer.db.prepare("INSERT INTO agent_conversations (id, conv_key, role, content, created_at) VALUES (?, ?, ?, ?, ?)").run("ac_" + import_crypto7.default.randomUUID(), convKey, "user", message, now);
-        kernelContainer.db.prepare("INSERT INTO agent_conversations (id, conv_key, role, content, created_at) VALUES (?, ?, ?, ?, ?)").run("ac_" + import_crypto7.default.randomUUID(), convKey, "assistant", result.agentText, now + 1);
+        kernelContainer.db.prepare("INSERT INTO agent_conversations (id, conv_key, role, content, created_at) VALUES (?, ?, ?, ?, ?)").run("ac_" + import_crypto6.default.randomUUID(), convKey, "user", message, now);
+        kernelContainer.db.prepare("INSERT INTO agent_conversations (id, conv_key, role, content, created_at) VALUES (?, ?, ?, ?, ?)").run("ac_" + import_crypto6.default.randomUUID(), convKey, "assistant", result.agentText, now + 1);
       }
       res.json({
         success: true,
@@ -20929,8 +21067,8 @@ function registerOsRoutes(ctx) {
 }
 
 // server/routes/resources.ts
-var import_path10 = __toESM(require("path"), 1);
-var import_fs10 = __toESM(require("fs"), 1);
+var import_path9 = __toESM(require("path"), 1);
+var import_fs9 = __toESM(require("fs"), 1);
 function registerResourcesRoutes(ctx) {
   const { app } = ctx;
   app.get("/api/resources", (req, res) => {
@@ -20946,23 +21084,23 @@ function registerResourcesRoutes(ctx) {
       const resource = kernelContainer.db.prepare("SELECT * FROM system_resources WHERE id = ?").get(req.params.id);
       if (!resource) return res.status(404).send("Resource not found");
       if (resource.type === "html") {
-        const entryName = resource.name && (resource.name.endsWith(".html") || resource.name.endsWith(".htm")) ? import_path10.default.basename(resource.name.replace(/\\/g, "/")) : "index.html";
+        const entryName = resource.name && (resource.name.endsWith(".html") || resource.name.endsWith(".htm")) ? import_path9.default.basename(resource.name.replace(/\\/g, "/")) : "index.html";
         const existingCw2 = kernelContainer.db.prepare("SELECT id FROM courseware WHERE id = ?").get(resource.id);
         if (!existingCw2) {
           kernelContainer.db.prepare("INSERT INTO courseware (id, uuid, name, type, entry, created_at) VALUES (?, ?, ?, ?, ?, ?)").run(resource.id, resource.id, resource.name, "html", entryName, resource.created_at || Date.now());
         }
         try {
-          const storageDir = import_path10.default.resolve(process.cwd(), "storage", "courseware", resource.id);
-          if (!import_fs10.default.existsSync(storageDir)) {
-            import_fs10.default.mkdirSync(storageDir, { recursive: true });
+          const storageDir = import_path9.default.resolve(process.cwd(), "storage", "courseware", resource.id);
+          if (!import_fs9.default.existsSync(storageDir)) {
+            import_fs9.default.mkdirSync(storageDir, { recursive: true });
           }
-          const namedPath = import_path10.default.resolve(storageDir, entryName);
-          if (!import_fs10.default.existsSync(namedPath)) {
-            import_fs10.default.writeFileSync(namedPath, resource.content || "", "utf8");
+          const namedPath = import_path9.default.resolve(storageDir, entryName);
+          if (!import_fs9.default.existsSync(namedPath)) {
+            import_fs9.default.writeFileSync(namedPath, resource.content || "", "utf8");
           }
-          const indexHtmlPath = import_path10.default.resolve(storageDir, "index.html");
-          if (!import_fs10.default.existsSync(indexHtmlPath)) {
-            import_fs10.default.writeFileSync(indexHtmlPath, resource.content || "", "utf8");
+          const indexHtmlPath = import_path9.default.resolve(storageDir, "index.html");
+          if (!import_fs9.default.existsSync(indexHtmlPath)) {
+            import_fs9.default.writeFileSync(indexHtmlPath, resource.content || "", "utf8");
           }
         } catch (storageErr) {
           console.warn("[resources] Failed to write courseware storage cache:", storageErr);
@@ -21002,21 +21140,21 @@ function registerResourcesRoutes(ctx) {
         kernelContainer.db.prepare("INSERT INTO courseware (id, uuid, name, type, entry, created_at) VALUES (?, ?, ?, ?, ?, ?)").run(resource.id, resource.id, resource.name, "folder", indexFile.path, resource.created_at || Date.now());
       }
       try {
-        const storageDir = import_path10.default.resolve(process.cwd(), "storage", "courseware", resource.id);
-        if (!import_fs10.default.existsSync(storageDir)) {
-          import_fs10.default.mkdirSync(storageDir, { recursive: true });
+        const storageDir = import_path9.default.resolve(process.cwd(), "storage", "courseware", resource.id);
+        if (!import_fs9.default.existsSync(storageDir)) {
+          import_fs9.default.mkdirSync(storageDir, { recursive: true });
           for (const f of files) {
             if (f.path && f.content !== void 0) {
               const cleanRel = f.path.replace(/\\/g, "/").replace(/^\/+/, "");
-              const target = import_path10.default.resolve(storageDir, cleanRel);
+              const target = import_path9.default.resolve(storageDir, cleanRel);
               if (target.startsWith(storageDir)) {
-                import_fs10.default.mkdirSync(import_path10.default.dirname(target), { recursive: true });
+                import_fs9.default.mkdirSync(import_path9.default.dirname(target), { recursive: true });
                 const isBin = /\.(png|jpe?g|gif|webp|ico)$/i.test(cleanRel);
                 if (isBin) {
                   const cleanBase64 = f.content.replace(/^data:[^;]+;base64,/, "");
-                  import_fs10.default.writeFileSync(target, Buffer.from(cleanBase64, "base64"));
+                  import_fs9.default.writeFileSync(target, Buffer.from(cleanBase64, "base64"));
                 } else {
-                  import_fs10.default.writeFileSync(target, f.content, "utf8");
+                  import_fs9.default.writeFileSync(target, f.content, "utf8");
                 }
               }
             }
@@ -21239,9 +21377,9 @@ function registerResourcesRoutes(ctx) {
 }
 
 // server/routes/courseware.ts
-var import_path11 = __toESM(require("path"), 1);
-var import_fs11 = __toESM(require("fs"), 1);
-var import_crypto9 = __toESM(require("crypto"), 1);
+var import_path10 = __toESM(require("path"), 1);
+var import_fs10 = __toESM(require("fs"), 1);
+var import_crypto8 = __toESM(require("crypto"), 1);
 function registerCoursewareRoutes(ctx) {
   const { app, io } = ctx;
   app.post("/api/courseware/upload", requireAuth("teacher", "administrator"), async (req, res) => {
@@ -21391,7 +21529,7 @@ function registerCoursewareRoutes(ctx) {
           return res.status(403).json({ error: "Forbidden: Cannot modify logs for another student" });
         }
       }
-      const rawId = "raw_" + import_crypto9.default.randomBytes(8).toString("hex");
+      const rawId = "raw_" + import_crypto8.default.randomBytes(8).toString("hex");
       kernelContainer.db.prepare(
         "INSERT INTO submission_raw (id, attempt_id, event_type, payload_json, created_at) VALUES (?, ?, ?, ?, ?)"
       ).run(rawId, attemptId, eventType, JSON.stringify(payload), Date.now());
@@ -21419,7 +21557,7 @@ function registerCoursewareRoutes(ctx) {
           kernelContainer.db.prepare(
             "INSERT INTO submission_result (id, attempt_id, score, comment, completion, extra_json) VALUES (?, ?, ?, ?, ?, ?)"
           ).run(
-            "res_" + import_crypto9.default.randomBytes(8).toString("hex"),
+            "res_" + import_crypto8.default.randomBytes(8).toString("hex"),
             attemptId,
             parsedScore,
             comment || null,
@@ -21445,7 +21583,7 @@ function registerCoursewareRoutes(ctx) {
       }
       io.emit("courseware-attempt-updated", { attemptId, type: "log" });
       void kernelContainer.eventBus.publish({
-        id: "evt_" + import_crypto9.default.randomBytes(8).toString("hex"),
+        id: "evt_" + import_crypto8.default.randomBytes(8).toString("hex"),
         type: "courseware.event_logged",
         source: "builtin.courseware",
         payload: { attemptId, eventType, payload },
@@ -21542,8 +21680,8 @@ function registerCoursewareRoutes(ctx) {
       const { msg, url, student, courseware } = req.body;
       const logMsg = `[CLIENT DEBUG] ${msg} | URL: ${url} | Student: ${JSON.stringify(student)} | Courseware: ${JSON.stringify(courseware)}`;
       console.log(`\x1B[35m[CLIENT DEBUG]\x1B[0m ${msg}`);
-      const logFile2 = import_path11.default.join(process.cwd(), "client_debug.log");
-      import_fs11.default.appendFileSync(logFile2, `${(/* @__PURE__ */ new Date()).toISOString()} - ${logMsg}
+      const logFile2 = import_path10.default.join(process.cwd(), "client_debug.log");
+      import_fs10.default.appendFileSync(logFile2, `${(/* @__PURE__ */ new Date()).toISOString()} - ${logMsg}
 `);
       res.json({ success: true });
     } catch (e) {
@@ -21619,7 +21757,7 @@ function registerCoursewareRoutes(ctx) {
       let assignment = kernelContainer.db.prepare("SELECT id FROM assignments WHERE class_id = ? AND lesson_id = ? AND title = ?").get(classId, lessonId, assignmentTitle);
       let assignmentId = assignment?.id;
       if (!assignmentId) {
-        assignmentId = "ast-cw-" + import_crypto9.default.randomBytes(8).toString("hex");
+        assignmentId = "ast-cw-" + import_crypto8.default.randomBytes(8).toString("hex");
         kernelContainer.db.prepare(
           "INSERT INTO assignments (id, class_id, lesson_id, title, description, content, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)"
         ).run(
@@ -21692,8 +21830,8 @@ function registerCoursewareRoutes(ctx) {
 }
 
 // server/routes/bridge.ts
-var import_path12 = __toESM(require("path"), 1);
-var import_fs12 = __toESM(require("fs"), 1);
+var import_path11 = __toESM(require("path"), 1);
+var import_fs11 = __toESM(require("fs"), 1);
 function registerBridgeRoutes(ctx) {
   const { app } = ctx;
   app.get("/bridge.js", (_req, res) => {
@@ -21713,7 +21851,7 @@ function registerBridgeRoutes(ctx) {
       if (!courseware) {
         const resRow = kernelContainer.db.prepare("SELECT * FROM system_resources WHERE id = ?").get(uuid);
         if (resRow) {
-          const entryName = resRow.name && (resRow.name.endsWith(".html") || resRow.name.endsWith(".htm")) ? import_path12.default.basename(resRow.name.replace(/\\/g, "/")) : "index.html";
+          const entryName = resRow.name && (resRow.name.endsWith(".html") || resRow.name.endsWith(".htm")) ? import_path11.default.basename(resRow.name.replace(/\\/g, "/")) : "index.html";
           const createdAt = resRow.created_at || Date.now();
           kernelContainer.db.prepare("INSERT INTO courseware (id, uuid, name, type, entry, created_at) VALUES (?, ?, ?, ?, ?, ?)").run(resRow.id, resRow.id, resRow.name, resRow.type || "html", entryName, createdAt);
           courseware = {
@@ -21729,21 +21867,21 @@ function registerBridgeRoutes(ctx) {
       if (!courseware) {
         return res.status(404).send("Courseware not found");
       }
-      const storageDir = import_path12.default.resolve(process.cwd(), "storage", "courseware", courseware.uuid);
-      if (!import_fs12.default.existsSync(storageDir) || import_fs12.default.readdirSync(storageDir).length === 0) {
+      const storageDir = import_path11.default.resolve(process.cwd(), "storage", "courseware", courseware.uuid);
+      if (!import_fs11.default.existsSync(storageDir) || import_fs11.default.readdirSync(storageDir).length === 0) {
         let resRow = kernelContainer.db.prepare("SELECT * FROM system_resources WHERE id = ? OR id = ?").get(courseware.uuid, courseware.id);
         if (!resRow && courseware.name) {
           const nameCandidate = courseware.name.endsWith(".html") ? courseware.name : `${courseware.name}.html`;
           resRow = kernelContainer.db.prepare("SELECT * FROM system_resources WHERE name = ? OR name = ?").get(courseware.name, nameCandidate);
         }
         if (resRow && resRow.content) {
-          import_fs12.default.mkdirSync(storageDir, { recursive: true });
+          import_fs11.default.mkdirSync(storageDir, { recursive: true });
           if (resRow.type === "html") {
-            const originalName = resRow.name && (resRow.name.endsWith(".html") || resRow.name.endsWith(".htm")) ? import_path12.default.basename(resRow.name.replace(/\\/g, "/")) : courseware.entry || "index.html";
-            const safeEntry = import_path12.default.basename(originalName.replace(/\\/g, "/"));
-            import_fs12.default.writeFileSync(import_path12.default.resolve(storageDir, safeEntry), resRow.content, "utf8");
+            const originalName = resRow.name && (resRow.name.endsWith(".html") || resRow.name.endsWith(".htm")) ? import_path11.default.basename(resRow.name.replace(/\\/g, "/")) : courseware.entry || "index.html";
+            const safeEntry = import_path11.default.basename(originalName.replace(/\\/g, "/"));
+            import_fs11.default.writeFileSync(import_path11.default.resolve(storageDir, safeEntry), resRow.content, "utf8");
             if (safeEntry !== "index.html") {
-              import_fs12.default.writeFileSync(import_path12.default.resolve(storageDir, "index.html"), resRow.content, "utf8");
+              import_fs11.default.writeFileSync(import_path11.default.resolve(storageDir, "index.html"), resRow.content, "utf8");
             }
           } else if (resRow.type === "folder") {
             try {
@@ -21751,15 +21889,15 @@ function registerBridgeRoutes(ctx) {
               for (const f of files) {
                 if (f.path && f.content !== void 0) {
                   const cleanRel = f.path.replace(/\\/g, "/").replace(/^\/+/, "");
-                  const target = import_path12.default.resolve(storageDir, cleanRel);
+                  const target = import_path11.default.resolve(storageDir, cleanRel);
                   if (target.startsWith(storageDir)) {
-                    import_fs12.default.mkdirSync(import_path12.default.dirname(target), { recursive: true });
+                    import_fs11.default.mkdirSync(import_path11.default.dirname(target), { recursive: true });
                     const isBin = /\.(png|jpe?g|gif|webp|ico)$/i.test(cleanRel);
                     if (isBin) {
                       const cleanBase64 = f.content.replace(/^data:[^;]+;base64,/, "");
-                      import_fs12.default.writeFileSync(target, Buffer.from(cleanBase64, "base64"));
+                      import_fs11.default.writeFileSync(target, Buffer.from(cleanBase64, "base64"));
                     } else {
-                      import_fs12.default.writeFileSync(target, f.content, "utf8");
+                      import_fs11.default.writeFileSync(target, f.content, "utf8");
                     }
                   }
                 }
@@ -21773,35 +21911,35 @@ function registerBridgeRoutes(ctx) {
       if (!subpath || subpath === "") {
         subpath = courseware.entry || "index.html";
       }
-      let filePath = import_path12.default.resolve(storageDir, subpath);
+      let filePath = import_path11.default.resolve(storageDir, subpath);
       if (!filePath.startsWith(storageDir)) {
         return res.status(403).send("Access denied");
       }
-      if (!import_fs12.default.existsSync(filePath) && import_fs12.default.existsSync(storageDir)) {
-        const dirEntries = import_fs12.default.readdirSync(storageDir);
+      if (!import_fs11.default.existsSync(filePath) && import_fs11.default.existsSync(storageDir)) {
+        const dirEntries = import_fs11.default.readdirSync(storageDir);
         const isLookingForEntry = !subpath || subpath === "" || subpath === "index.html" || subpath === "index.htm" || subpath === courseware.entry;
         if (isLookingForEntry) {
           let candidate = dirEntries.find(
-            (f) => f === courseware.entry && import_fs12.default.statSync(import_path12.default.join(storageDir, f)).isFile()
+            (f) => f === courseware.entry && import_fs11.default.statSync(import_path11.default.join(storageDir, f)).isFile()
           );
           if (!candidate && courseware.name) {
             const nameCandidate = courseware.name.endsWith(".html") ? courseware.name : `${courseware.name}.html`;
             candidate = dirEntries.find(
-              (f) => (f === nameCandidate || f.toLowerCase() === nameCandidate.toLowerCase()) && import_fs12.default.statSync(import_path12.default.join(storageDir, f)).isFile()
+              (f) => (f === nameCandidate || f.toLowerCase() === nameCandidate.toLowerCase()) && import_fs11.default.statSync(import_path11.default.join(storageDir, f)).isFile()
             );
           }
           if (!candidate) {
             candidate = dirEntries.find((f) => {
               const lower = f.toLowerCase();
-              return (lower.endsWith(".html") || lower.endsWith(".htm")) && import_fs12.default.statSync(import_path12.default.join(storageDir, f)).isFile();
+              return (lower.endsWith(".html") || lower.endsWith(".htm")) && import_fs11.default.statSync(import_path11.default.join(storageDir, f)).isFile();
             });
           }
           if (candidate) {
-            filePath = import_path12.default.resolve(storageDir, candidate);
+            filePath = import_path11.default.resolve(storageDir, candidate);
             try {
-              const indexHtmlPath = import_path12.default.resolve(storageDir, "index.html");
-              if (!import_fs12.default.existsSync(indexHtmlPath)) {
-                import_fs12.default.copyFileSync(filePath, indexHtmlPath);
+              const indexHtmlPath = import_path11.default.resolve(storageDir, "index.html");
+              if (!import_fs11.default.existsSync(indexHtmlPath)) {
+                import_fs11.default.copyFileSync(filePath, indexHtmlPath);
               }
               if (courseware.entry !== candidate) {
                 kernelContainer.db.prepare("UPDATE courseware SET entry = ? WHERE id = ?").run(candidate, courseware.id);
@@ -21812,9 +21950,9 @@ function registerBridgeRoutes(ctx) {
             }
           } else {
             for (const entry of dirEntries) {
-              const subDirPath = import_path12.default.join(storageDir, entry);
-              if (import_fs12.default.statSync(subDirPath).isDirectory()) {
-                const subEntries = import_fs12.default.readdirSync(subDirPath);
+              const subDirPath = import_path11.default.join(storageDir, entry);
+              if (import_fs11.default.statSync(subDirPath).isDirectory()) {
+                const subEntries = import_fs11.default.readdirSync(subDirPath);
                 const subCandidate = subEntries.find((f) => f.toLowerCase() === "index.html" || f.toLowerCase() === "index.htm") || subEntries.find((f) => f.toLowerCase().endsWith(".html") || f.toLowerCase().endsWith(".htm"));
                 if (subCandidate) {
                   const redirectPath = `${entry}/${subCandidate}`;
@@ -21825,12 +21963,12 @@ function registerBridgeRoutes(ctx) {
           }
         }
       }
-      if (!import_fs12.default.existsSync(filePath)) {
+      if (!import_fs11.default.existsSync(filePath)) {
         return res.status(404).send(`File not found: ${subpath}`);
       }
-      const stat = import_fs12.default.statSync(filePath);
+      const stat = import_fs11.default.statSync(filePath);
       if (stat.isDirectory()) {
-        const dirFiles = import_fs12.default.readdirSync(filePath);
+        const dirFiles = import_fs11.default.readdirSync(filePath);
         const htmlFile = dirFiles.find((f) => f.toLowerCase() === "index.html" || f.toLowerCase() === "index.htm") || dirFiles.find((f) => f.toLowerCase().endsWith(".html") || f.toLowerCase().endsWith(".htm"));
         if (htmlFile) {
           const base = subpath ? subpath.endsWith("/") ? subpath : subpath + "/" : "";
@@ -21838,7 +21976,7 @@ function registerBridgeRoutes(ctx) {
         }
         return res.status(404).send("Directory index not found");
       }
-      const ext = import_path12.default.extname(filePath).toLowerCase();
+      const ext = import_path11.default.extname(filePath).toLowerCase();
       let contentType = "text/plain; charset=utf-8";
       if (ext === ".html" || ext === ".htm") contentType = "text/html; charset=utf-8";
       else if (ext === ".css") contentType = "text/css; charset=utf-8";
@@ -21858,7 +21996,7 @@ function registerBridgeRoutes(ctx) {
           "Content-Security-Policy",
           "sandbox allow-scripts allow-forms allow-downloads; default-src 'self' 'unsafe-inline' data: blob: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: https:; script-src-attr 'unsafe-inline'; style-src-attr 'unsafe-inline';"
         );
-        let html = import_fs12.default.readFileSync(filePath, "utf8");
+        let html = import_fs11.default.readFileSync(filePath, "utf8");
         html = injectLmsSdk(html, req, { id: courseware.id, name: courseware.name, uuid: courseware.uuid });
         return res.send(html);
       } else {
@@ -22448,7 +22586,7 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
 }
 
 // server/routes/workspace.ts
-var import_path13 = __toESM(require("path"), 1);
+var import_path12 = __toESM(require("path"), 1);
 function registerWorkspaceRoutes(ctx) {
   const { app, MF_REMOTE_CACHE: MF_REMOTE_CACHE2 } = ctx;
   app.get("/api/events", requireAuth("administrator"), (req, res) => {
@@ -22597,7 +22735,7 @@ ${sub.content}`
       }
       const filename = parts[parts.length - 1];
       res.setHeader("Content-Disposition", `attachment; filename="${encodeURIComponent(filename)}"`);
-      const ext = import_path13.default.extname(filename).toLowerCase();
+      const ext = import_path12.default.extname(filename).toLowerCase();
       const binaryExtensions = [".pdf", ".xlsx", ".xls", ".zip", ".png", ".jpg", ".jpeg", ".gif", ".mp4", ".mp3"];
       const content = foundNode.content || "";
       if (binaryExtensions.includes(ext)) {
@@ -22839,9 +22977,9 @@ function registerAdminRoutes(ctx) {
 }
 
 // server/routes/roster.ts
-var import_path14 = __toESM(require("path"), 1);
-var import_fs13 = __toESM(require("fs"), 1);
-var import_crypto10 = __toESM(require("crypto"), 1);
+var import_path13 = __toESM(require("path"), 1);
+var import_fs12 = __toESM(require("fs"), 1);
+var import_crypto9 = __toESM(require("crypto"), 1);
 var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
 function registerRosterRoutes(ctx) {
   const { app, io, loginLimiter } = ctx;
@@ -23095,7 +23233,7 @@ function registerRosterRoutes(ctx) {
         if (storedPwd.startsWith("$2")) {
           matches = import_bcryptjs2.default.compareSync(oldPassword, storedPwd);
         } else if (/^[a-f0-9]{64}$/.test(storedPwd)) {
-          matches = import_crypto10.default.createHash("sha256").update(oldPassword).digest("hex") === storedPwd;
+          matches = import_crypto9.default.createHash("sha256").update(oldPassword).digest("hex") === storedPwd;
         } else {
           matches = storedPwd === oldPassword;
         }
@@ -23152,7 +23290,7 @@ function registerRosterRoutes(ctx) {
       if (!filename || !base64Data) {
         return res.status(400).json({ error: "Filename and base64Data are required" });
       }
-      const ext = import_path14.default.extname(filename).toLowerCase();
+      const ext = import_path13.default.extname(filename).toLowerCase();
       const ALLOWED_IMG = [".jpg", ".jpeg", ".png", ".gif", ".webp"];
       if (BLOCKED_EXTENSIONS.includes(ext) || !ALLOWED_IMG.includes(ext)) {
         return res.status(400).json({ error: "Only image files (jpg / png / gif / webp) are allowed" });
@@ -23165,11 +23303,11 @@ function registerRosterRoutes(ctx) {
       if (!validateMagicBytes(fileBuffer, filename)) {
         return res.status(400).json({ error: "File content does not match the declared image type" });
       }
-      const avatarDir = import_path14.default.join(process.cwd(), "uploads", "avatars");
-      import_fs13.default.mkdirSync(avatarDir, { recursive: true });
-      const uniqueName = `${Date.now()}-${import_crypto10.default.randomBytes(4).toString("hex")}${ext}`;
-      const filePath = import_path14.default.join(avatarDir, uniqueName);
-      import_fs13.default.writeFileSync(filePath, fileBuffer);
+      const avatarDir = import_path13.default.join(process.cwd(), "uploads", "avatars");
+      import_fs12.default.mkdirSync(avatarDir, { recursive: true });
+      const uniqueName = `${Date.now()}-${import_crypto9.default.randomBytes(4).toString("hex")}${ext}`;
+      const filePath = import_path13.default.join(avatarDir, uniqueName);
+      import_fs12.default.writeFileSync(filePath, fileBuffer);
       const avatarUrl = `/uploads/avatars/${uniqueName}`;
       let oldAvatar = null;
       if (session.role === "student") {
@@ -23183,7 +23321,7 @@ function registerRosterRoutes(ctx) {
       }
       if (oldAvatar && oldAvatar.startsWith("/uploads/avatars/")) {
         try {
-          import_fs13.default.unlinkSync(import_path14.default.join(process.cwd(), oldAvatar));
+          import_fs12.default.unlinkSync(import_path13.default.join(process.cwd(), oldAvatar));
         } catch {
         }
       }
@@ -23219,7 +23357,7 @@ function registerRosterRoutes(ctx) {
       }
       if (oldAvatar && oldAvatar.startsWith("/uploads/avatars/")) {
         try {
-          import_fs13.default.unlinkSync(import_path14.default.join(process.cwd(), oldAvatar));
+          import_fs12.default.unlinkSync(import_path13.default.join(process.cwd(), oldAvatar));
         } catch {
         }
       }
@@ -23286,7 +23424,7 @@ function registerRosterRoutes(ctx) {
         if (storedPwd.startsWith("$2")) {
           matchesOwnPassword = import_bcryptjs2.default.compareSync(providedPassword, storedPwd);
         } else if (/^[a-f0-9]{64}$/.test(storedPwd)) {
-          const sha256Hash = import_crypto10.default.createHash("sha256").update(providedPassword).digest("hex");
+          const sha256Hash = import_crypto9.default.createHash("sha256").update(providedPassword).digest("hex");
           if (sha256Hash === storedPwd) {
             matchesOwnPassword = true;
             kernelContainer.db.prepare("UPDATE students SET password = ? WHERE id = ?").run(hashPassword(providedPassword), studentObj.id);
@@ -23330,7 +23468,7 @@ function registerRosterRoutes(ctx) {
         };
       }
       if (sessionData) {
-        const sessionToken = "token_" + import_crypto10.default.randomBytes(16).toString("hex");
+        const sessionToken = "token_" + import_crypto9.default.randomBytes(16).toString("hex");
         const now = Date.now();
         const expiresAt = now + 7 * 24 * 60 * 60 * 1e3;
         kernelContainer.db.prepare("INSERT INTO client_sessions (id, session_data, updated_at, expires_at) VALUES (?, ?, ?, ?)").run(sessionToken, JSON.stringify(sessionData), now, expiresAt);
@@ -25168,8 +25306,8 @@ ${examsText}
 
 // server/routes/plugins.ts
 var import_express2 = __toESM(require("express"), 1);
-var import_path15 = __toESM(require("path"), 1);
-var import_fs14 = __toESM(require("fs"), 1);
+var import_path14 = __toESM(require("path"), 1);
+var import_fs13 = __toESM(require("fs"), 1);
 var import_semver3 = __toESM(require("semver"), 1);
 
 // server/services/version-fetcher.ts
@@ -25327,7 +25465,7 @@ async function checkVersion(source, installedVersion) {
 }
 
 // server/routes/plugin-api-gateway.ts
-var import_node_path3 = __toESM(require("node:path"), 1);
+var import_node_path4 = __toESM(require("node:path"), 1);
 init_http_router();
 var RESERVED_ACTIONS = /* @__PURE__ */ new Set(["config", "toggle", "contributions", "check-update", "one-click-update"]);
 var FORBIDDEN_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
@@ -25461,7 +25599,7 @@ async function pluginApiGatewayMiddleware(req, res, next) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
   }
-  const normalizedSubPath = import_node_path3.default.posix.normalize("/" + rawSubPath);
+  const normalizedSubPath = import_node_path4.default.posix.normalize("/" + rawSubPath);
   if (normalizedSubPath.includes("..")) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
@@ -25681,16 +25819,16 @@ data: ${JSON.stringify({ error: msg })}
 
 // server/routes/plugins.ts
 function findLocalPluginSource(manifestId) {
-  const root = import_path15.default.resolve(process.cwd(), "v2_plugins");
-  if (!import_fs14.default.existsSync(root)) return null;
+  const root = import_path14.default.resolve(process.cwd(), "v2_plugins");
+  if (!import_fs13.default.existsSync(root)) return null;
   let best = null;
   try {
-    for (const entry of import_fs14.default.readdirSync(root, { withFileTypes: true })) {
+    for (const entry of import_fs13.default.readdirSync(root, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      const manifestPath = import_path15.default.join(root, entry.name, "manifest.json");
-      if (!import_fs14.default.existsSync(manifestPath)) continue;
+      const manifestPath = import_path14.default.join(root, entry.name, "manifest.json");
+      if (!import_fs13.default.existsSync(manifestPath)) continue;
       try {
-        const m = JSON.parse(import_fs14.default.readFileSync(manifestPath, "utf-8"));
+        const m = JSON.parse(import_fs13.default.readFileSync(manifestPath, "utf-8"));
         if (m?.id !== manifestId || !m?.version) continue;
         if (!best || import_semver3.default.gt(m.version, best.version)) best = { dir: entry.name, version: m.version };
       } catch {
@@ -25726,11 +25864,11 @@ function registerPluginsRoutes(ctx) {
   const { app, buildOpenAITools: buildOpenAITools2, executeAgentToolCall: executeAgentToolCall2, buildOpenAIChatUrl: buildOpenAIChatUrl2, runGeminiAgentChat: runGeminiAgentChat2, runOpenAIAgentChat: runOpenAIAgentChat2 } = ctx;
   app.get("/api/docs/plugin-guide", (req, res) => {
     try {
-      const docPath = import_path15.default.join(process.cwd(), "docs_plugin_guide.md");
-      if (!import_fs14.default.existsSync(docPath)) {
+      const docPath = import_path14.default.join(process.cwd(), "docs_plugin_guide.md");
+      if (!import_fs13.default.existsSync(docPath)) {
         return res.status(404).json({ success: false, error: "Document not found" });
       }
-      const content = import_fs14.default.readFileSync(docPath, "utf-8");
+      const content = import_fs13.default.readFileSync(docPath, "utf-8");
       res.json({ success: true, content });
     } catch (e) {
       sendSafeError(res, e);
@@ -25741,11 +25879,11 @@ function registerPluginsRoutes(ctx) {
       const limit = parseInt(req.query.limit) || 200;
       const component = req.query.component;
       const levelFilter = req.query.level;
-      const logFile2 = import_path15.default.resolve(process.cwd(), "logs", "openlearn.log");
-      if (!import_fs14.default.existsSync(logFile2)) {
+      const logFile2 = import_path14.default.resolve(process.cwd(), "logs", "openlearn.log");
+      if (!import_fs13.default.existsSync(logFile2)) {
         return res.json({ success: true, logs: [] });
       }
-      const content = import_fs14.default.readFileSync(logFile2, "utf-8");
+      const content = import_fs13.default.readFileSync(logFile2, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       let parsedLogs = lines.map((line) => {
         try {
@@ -26307,7 +26445,7 @@ async function startServer() {
     config: { port: Number(process.env.PORT) || 9e3 }
   });
   try {
-    const migrationsDir = import_path16.default.join(process.cwd(), "migrations");
+    const migrationsDir = import_path15.default.join(process.cwd(), "migrations");
     const migrations = loadMigrationsFromDirectory(migrationsDir);
     if (migrations.length > 0) {
       runMigrations(kernelContainer.db, migrations);
@@ -26371,8 +26509,8 @@ async function startServer() {
   });
   app.use(import_express3.default.json({ limit: "10mb" }));
   app.use(import_express3.default.urlencoded({ limit: "10mb", extended: true }));
-  app.use("/uploads", import_express3.default.static(import_path16.default.join(process.cwd(), "uploads")));
-  app.use("/plugins", import_express3.default.static(import_path16.default.join(process.cwd(), "plugins")));
+  app.use("/uploads", import_express3.default.static(import_path15.default.join(process.cwd(), "uploads")));
+  app.use("/plugins", import_express3.default.static(import_path15.default.join(process.cwd(), "plugins")));
   const configuredOrigins = process.env.ALLOWED_ORIGINS ? process.env.ALLOWED_ORIGINS.split(",").map((s) => s.trim()).filter(Boolean) : [];
   const isOriginAllowed = (origin, hostHeader) => {
     if (!origin) return true;
@@ -26545,10 +26683,10 @@ async function startServer() {
     });
     app.use(vite.middlewares);
   } else {
-    const distPath = __dirname || import_path16.default.join(process.cwd(), "dist");
+    const distPath = __dirname || import_path15.default.join(process.cwd(), "dist");
     app.use(import_express3.default.static(distPath));
     app.get("*", (req, res) => {
-      res.sendFile(import_path16.default.join(distPath, "index.html"));
+      res.sendFile(import_path15.default.join(distPath, "index.html"));
     });
   }
   const HOST = process.env.HOST || "0.0.0.0";