openlearn-next 0.3.20 → 0.3.22

package/dist/server.cjs

@@ -343,7 +343,7 @@ var init_token = __esm({
 });
 
 // packages/core/di/interfaces.ts
-var ICommandBusServiceToken4, IEventBusServiceToken3, IActionRegistryServiceToken4, ICapabilityServiceToken, IProcessServiceToken2, IStorageServiceToken, IAIServiceToken, IDatabaseToken4, IPluginHostToken, IPluginLifecycleManagerToken, IPluginDistributionManagerToken, IPluginRuntimeCompositionToken, IUnifiedExtensionRegistryToken, IPluginCapabilityGatewayToken, ICapabilityRegistryToken, IAuthSessionBridgeToken, ISemesterGradeServiceToken, IPointsDimensionRegistryToken, IPointsLedgerServiceToken, ILessonEngineServiceToken, IClassroomRuntimeServiceToken, IPresenceEngineServiceToken, ITeachingCollaborationServiceToken, ILearningAnalyticsServiceToken, IAICapabilityServiceToken, ICapabilityRuntimeServiceToken, ICapabilityGovernanceServiceToken, IPlatformServiceRegistryToken;
+var ICommandBusServiceToken4, IEventBusServiceToken3, IActionRegistryServiceToken4, ICapabilityServiceToken, IProcessServiceToken2, IStorageServiceToken, IAIServiceToken, IDatabaseToken4, IPluginHostToken, IPluginLifecycleManagerToken, IPluginDistributionManagerToken, IPluginRuntimeCompositionToken, IUnifiedExtensionRegistryToken, IPluginCapabilityGatewayToken, ICapabilityRegistryToken, IAuthSessionBridgeToken, ISemesterGradeServiceToken, IPointsDimensionRegistryToken, IPointsLedgerServiceToken, ILessonEngineServiceToken, IClassroomRuntimeServiceToken, IPresenceEngineServiceToken, ITeachingCollaborationServiceToken, ILearningAnalyticsServiceToken, IAICapabilityServiceToken, ICapabilityRuntimeServiceToken, ICapabilityGovernanceServiceToken, IPlatformServiceRegistryToken, ICoursewareRuntimeScriptRegistryToken;
 var init_interfaces = __esm({
   "packages/core/di/interfaces.ts"() {
     init_token();
@@ -402,6 +402,9 @@ var init_interfaces = __esm({
     IPlatformServiceRegistryToken = new Token(
       "@openlearn/core:IPlatformServiceRegistryService"
     );
+    ICoursewareRuntimeScriptRegistryToken = new Token(
+      "@openlearn/core:ICoursewareRuntimeScriptRegistry"
+    );
   }
 });
 
@@ -682,6 +685,93 @@ var init_ai_service = __esm({
   }
 });
 
+// packages/core/di/courseware-runtime-script-registry.ts
+var DEFAULT_PRIORITY, DEFAULT_POSITION, CoursewareRuntimeScriptRegistry;
+var init_courseware_runtime_script_registry = __esm({
+  "packages/core/di/courseware-runtime-script-registry.ts"() {
+    DEFAULT_PRIORITY = 100;
+    DEFAULT_POSITION = "body-end";
+    CoursewareRuntimeScriptRegistry = class _CoursewareRuntimeScriptRegistry {
+      constructor() {
+        /** key = `${owner}::${id}`，保证不同插件可以使用相同的脚本 id */
+        this.scripts = /* @__PURE__ */ new Map();
+      }
+      static key(owner, id) {
+        return `${owner}::${id}`;
+      }
+      /**
+       * 注册（或覆盖）一个课件运行时脚本。
+       *
+       * @param owner - 注册方，通常是 `ctx.pluginId`
+       * @param script - 脚本描述；同一 owner 下相同 id 视为覆盖
+       */
+      register(owner, script) {
+        if (!owner) throw new Error("CoursewareRuntimeScriptRegistry.register: owner is required");
+        if (!script || !script.id) throw new Error("CoursewareRuntimeScriptRegistry.register: script.id is required");
+        if (typeof script.source !== "string" || !script.source.trim()) {
+          throw new Error("CoursewareRuntimeScriptRegistry.register: script.source must be a non-empty string");
+        }
+        this.scripts.set(_CoursewareRuntimeScriptRegistry.key(owner, script.id), {
+          ...script,
+          owner,
+          priority: typeof script.priority === "number" ? script.priority : DEFAULT_PRIORITY,
+          position: script.position === "head" ? "head" : DEFAULT_POSITION
+        });
+      }
+      /** 注销某个 owner 下的单个脚本 */
+      unregister(owner, id) {
+        this.scripts.delete(_CoursewareRuntimeScriptRegistry.key(owner, id));
+      }
+      /**
+       * 清理脚本。
+       *
+       * @param owner - 省略时清空所有 owner（谨慎使用，仅用于测试或平台重置）
+       */
+      clear(owner) {
+        if (!owner) {
+          this.scripts.clear();
+          return;
+        }
+        const prefix = `${owner}::`;
+        for (const key of [...this.scripts.keys()]) {
+          if (key.startsWith(prefix)) this.scripts.delete(key);
+        }
+      }
+      /**
+       * 列出对目标课件生效的脚本（已按 priority 升序排序）。
+       *
+       * @param courseware - 目标课件的 `id` / `uuid`；省略时只返回「全局脚本」（两者均未限定者）
+       */
+      list(courseware) {
+        const matched = [];
+        for (const entry of this.scripts.values()) {
+          if (this.matches(entry, courseware)) matched.push(entry);
+        }
+        return matched.map((entry, index) => ({ entry, index })).sort((a, b) => a.entry.priority - b.entry.priority || a.index - b.index).map((item) => item.entry);
+      }
+      /** 列出当前所有注册方（便于诊断与测试） */
+      listOwners() {
+        return [...new Set([...this.scripts.values()].map((entry) => entry.owner))];
+      }
+      /**
+       * 判定脚本是否对目标课件生效。
+       *
+       * - 未限定 `coursewareId` 也未限定 `coursewareUuid` → 全局脚本，对所有课件生效；
+       * - 限定了任一者 → 需要与传入的 `courseware` 对应字段精确相等（两者都命中任一即算命中）。
+       */
+      matches(entry, courseware) {
+        const scopedById = typeof entry.coursewareId === "string" && entry.coursewareId.length > 0;
+        const scopedByUuid = typeof entry.coursewareUuid === "string" && entry.coursewareUuid.length > 0;
+        if (!scopedById && !scopedByUuid) return true;
+        if (!courseware) return false;
+        if (scopedById && courseware.id && entry.coursewareId === courseware.id) return true;
+        if (scopedByUuid && courseware.uuid && entry.coursewareUuid === courseware.uuid) return true;
+        return false;
+      }
+    };
+  }
+});
+
 // packages/core/plugin-host/types.ts
 var PLUGIN_SHARED_MODULES;
 var init_types = __esm({
@@ -873,9 +963,9 @@ var init_http_router = __esm({
       /**
        * 注册指定动词与路径的 Handler
        */
-      route(method, path21, handler) {
+      route(method, path24, handler) {
         const upperMethod = method.toUpperCase();
-        const normalized = path21.startsWith("/") ? path21 : "/" + path21;
+        const normalized = path24.startsWith("/") ? path24 : "/" + path24;
         const { regex, paramNames } = compileRoutePattern(normalized);
         this.routes.push({
           method: upperMethod,
@@ -886,36 +976,36 @@ var init_http_router = __esm({
           isStream: false
         });
       }
-      get(path21, handler) {
-        this.route("GET", path21, handler);
+      get(path24, handler) {
+        this.route("GET", path24, handler);
       }
-      post(path21, handler) {
-        this.route("POST", path21, handler);
+      post(path24, handler) {
+        this.route("POST", path24, handler);
       }
-      put(path21, handler) {
-        this.route("PUT", path21, handler);
+      put(path24, handler) {
+        this.route("PUT", path24, handler);
       }
-      patch(path21, handler) {
-        this.route("PATCH", path21, handler);
+      patch(path24, handler) {
+        this.route("PATCH", path24, handler);
       }
-      delete(path21, handler) {
-        this.route("DELETE", path21, handler);
+      delete(path24, handler) {
+        this.route("DELETE", path24, handler);
       }
       stream(methodOrPath, pathOrHandler, maybeHandler) {
         if (typeof pathOrHandler === "function") {
-          const path21 = methodOrPath;
+          const path24 = methodOrPath;
           const handler = pathOrHandler;
-          this.registerStream("GET", path21, handler);
-          this.registerStream("POST", path21, handler);
+          this.registerStream("GET", path24, handler);
+          this.registerStream("POST", path24, handler);
         } else {
           const method = methodOrPath.toUpperCase();
-          const path21 = pathOrHandler;
+          const path24 = pathOrHandler;
           const handler = maybeHandler;
-          this.registerStream(method, path21, handler);
+          this.registerStream(method, path24, handler);
         }
       }
-      registerStream(method, path21, handler) {
-        const normalized = path21.startsWith("/") ? path21 : "/" + path21;
+      registerStream(method, path24, handler) {
+        const normalized = path24.startsWith("/") ? path24 : "/" + path24;
         const { regex, paramNames } = compileRoutePattern(normalized);
         this.routes.push({
           method: method.toUpperCase(),
@@ -929,9 +1019,9 @@ var init_http_router = __esm({
       /**
        * 检查指定动词与路径是否为流式路由
        */
-      isStream(method, path21) {
+      isStream(method, path24) {
         const upperMethod = method.toUpperCase();
-        const normalized = path21.startsWith("/") ? path21 : "/" + path21;
+        const normalized = path24.startsWith("/") ? path24 : "/" + path24;
         for (const entry of this.routes) {
           if (entry.method !== upperMethod) continue;
           if (entry.regex.test(normalized)) {
@@ -943,9 +1033,9 @@ var init_http_router = __esm({
       /**
        * 匹配路由并提取路由参数
        */
-      match(method, path21) {
+      match(method, path24) {
         const upperMethod = method.toUpperCase();
-        const normalized = path21.startsWith("/") ? path21 : "/" + path21;
+        const normalized = path24.startsWith("/") ? path24 : "/" + path24;
         for (const entry of this.routes) {
           if (entry.method !== upperMethod) continue;
           const match = normalized.match(entry.regex);
@@ -1122,6 +1212,21 @@ __export(context_builder_exports, {
   createSafeFunction: () => createSafeFunction,
   registerSharedModule: () => registerSharedModule
 });
+function assertSafeSqlIdentifier(value, label) {
+  if (typeof value !== "string" || !SQL_IDENTIFIER_PATTERN.test(value)) {
+    throw new Error(`[SEC] Invalid SQL identifier for ${label}: ${JSON.stringify(value)}`);
+  }
+  return value;
+}
+function assertSafeCreateTableSchema(schema) {
+  if (typeof schema !== "string" || schema.length === 0 || schema.length > 4e3) {
+    throw new Error("[SEC] createTable schema must be a non-empty string (max 4000 chars)");
+  }
+  if (schema.includes(";")) {
+    throw new Error('[SEC] createTable schema must not contain ";" (multiple statements are not allowed)');
+  }
+  return schema;
+}
 function registerSharedModule(name, mod) {
   sharedModules[name] = mod;
 }
@@ -1452,15 +1557,19 @@ async function buildContext(serviceRegistry, tracker, pluginId, manifest, db2, s
   const tablePrefix = `plugin_${pluginId.replace(/[^a-zA-Z0-9_]/g, "_")}_`;
   const dbApi = {
     async ensureTable(tableName, schema) {
+      assertSafeSqlIdentifier(tableName, "ensureTable(tableName)");
+      assertSafeCreateTableSchema(schema);
       const fullName = tablePrefix + tableName;
       db2.exec(`CREATE TABLE IF NOT EXISTS ${fullName} (${schema})`);
     },
     table(tableName) {
+      assertSafeSqlIdentifier(tableName, "table(tableName)");
       return tablePrefix + tableName;
     },
     async dropAllTables() {
       const tables = db2.prepare(`SELECT name FROM sqlite_master WHERE type='table' AND name LIKE ?`).all(tablePrefix + "%");
       for (const t of tables) {
+        if (!/^plugin_[A-Za-z0-9_]+$/.test(t.name)) continue;
         db2.exec(`DROP TABLE IF EXISTS ${t.name}`);
       }
     },
@@ -1558,7 +1667,7 @@ async function buildContext(serviceRegistry, tracker, pluginId, manifest, db2, s
     }
   };
 }
-var sharedModules;
+var SQL_IDENTIFIER_PATTERN, sharedModules;
 var init_context_builder = __esm({
   "packages/core/plugin-host/context-builder.ts"() {
     init_types();
@@ -1567,6 +1676,7 @@ var init_context_builder = __esm({
     init_logger();
     init_interfaces();
     init_plugin_namespace();
+    SQL_IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
     sharedModules = {};
   }
 });
@@ -2842,6 +2952,7 @@ var init_di = __esm({
     init_interfaces();
     init_storage_service();
     init_ai_service();
+    init_courseware_runtime_script_registry();
     init_container();
   }
 });
@@ -3387,15 +3498,29 @@ parentPort.on('message', async function(msg) {
       var dbService = rawServices['@openlearn/core:IDatabase'];
       var dbApi = dbService ? {
         ensureTable: function(tableName, schema) {
+          // SEC: tableName / schema \u7531\u63D2\u4EF6\u63D0\u4F9B\uFF0C\u5C5E\u4E0D\u53EF\u4FE1\u8F93\u5165\u3002\u76F4\u63A5\u62FC\u63A5\u4F1A\u5BFC\u81F4 SQL \u6CE8\u5165
+          // \uFF08\u4F8B\u5982 tableName = "t (x); DROP TABLE events; --"\uFF09\u3002\u6B64\u5904\u5F3A\u5236\u6807\u8BC6\u7B26\u767D\u540D\u5355
+          // \u5E76\u7981\u6B62 schema \u4E2D\u7684\u5206\u53F7\uFF0C\u907F\u514D\u591A\u8BED\u53E5\u6CE8\u5165\u3002\u4E0E inline \u6A21\u5F0F\u4FDD\u6301\u4E00\u81F4\u3002
+          if (!/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(String(tableName))) {
+            throw new Error("[SEC] Invalid SQL identifier for ensureTable: " + String(tableName));
+          }
+          if (typeof schema !== "string" || schema.length === 0 || schema.length > 4000 || schema.indexOf(";") !== -1) {
+            throw new Error("[SEC] Invalid CREATE TABLE schema fragment: must be non-empty and contain no semicolon");
+          }
           var fullName = tablePrefix + tableName;
           return dbService.prepareAndRun('CREATE TABLE IF NOT EXISTS ' + fullName + ' (' + schema + ')', []);
         },
         table: function(tableName) {
+          if (!/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(String(tableName))) {
+            throw new Error("[SEC] Invalid SQL identifier for table(): " + String(tableName));
+          }
           return tablePrefix + tableName;
         },
         dropAllTables: async function() {
           var tables = await dbService.prepareAndAll("SELECT name FROM sqlite_master WHERE type='table' AND name LIKE ?", [tablePrefix + '%']);
           for (var i = 0; i < tables.length; i++) {
+            // SEC: \u8868\u540D\u6765\u81EA sqlite_master\uFF0C\u4ECD\u4E8C\u6B21\u6821\u9A8C\u540E\u518D\u62FC\u8FDB DDL
+            if (!/^plugin_[A-Za-z0-9_]+$/.test(String(tables[i].name))) continue;
             await dbService.prepareAndRun('DROP TABLE IF EXISTS ' + tables[i].name, []);
           }
         },
@@ -3592,12 +3717,12 @@ parentPort.on('message', async function(msg) {
 });
 `;
 }
-var import_node_worker_threads, import_fs4, import_node_path3, import_uuid12, ALL_SERVICE_TOKENS, MAX_WORKERS, ACTIVATE_TIMEOUT_MS, ACTIVATE_PROGRESS_SLIDE_MS, WorkerRegistry, WorkerManager;
+var import_node_worker_threads, import_fs4, import_node_path4, import_uuid12, ALL_SERVICE_TOKENS, MAX_WORKERS, ACTIVATE_TIMEOUT_MS, ACTIVATE_PROGRESS_SLIDE_MS, WorkerRegistry, WorkerManager;
 var init_worker_manager = __esm({
   "packages/core/worker-runtime/worker-manager.ts"() {
     import_node_worker_threads = require("node:worker_threads");
     import_fs4 = __toESM(require("fs"), 1);
-    import_node_path3 = __toESM(require("node:path"), 1);
+    import_node_path4 = __toESM(require("node:path"), 1);
     init_transport();
     init_service_host();
     init_logger();
@@ -3885,7 +4010,7 @@ var init_worker_manager = __esm({
         const bootstrapDataUrl = `data:text/javascript;base64,${encodedBootstrap}`;
         let worker;
         try {
-          const resolvedPluginDir = pluginDir && import_fs4.default.existsSync(import_node_path3.default.join(pluginDir, "index.js")) ? pluginDir : void 0;
+          const resolvedPluginDir = pluginDir && import_fs4.default.existsSync(import_node_path4.default.join(pluginDir, "index.js")) ? pluginDir : void 0;
           worker = new import_node_worker_threads.Worker(new URL(bootstrapDataUrl), {
             // Pass both the DB id (`pluginId` — used as the actor/registry key)
             // and `manifestId` (used as the namespace prefix for command types).
@@ -4129,8 +4254,8 @@ __export(server_exports, {
   startServer: () => startServer
 });
 module.exports = __toCommonJS(server_exports);
-var import_express3 = __toESM(require("express"), 1);
-var import_path15 = __toESM(require("path"), 1);
+var import_express4 = __toESM(require("express"), 1);
+var import_path17 = __toESM(require("path"), 1);
 var import_dotenv = __toESM(require("dotenv"), 1);
 var import_os2 = __toESM(require("os"), 1);
 var import_child_process3 = require("child_process");
@@ -4172,6 +4297,14 @@ var EventBus = class {
 
 // packages/core/command-bus/index.ts
 var import_uuid = require("uuid");
+var DEFAULT_QUIET_COMMANDS = /* @__PURE__ */ new Set([
+  "courseware.list",
+  "courseware.get_attempt_raw_data",
+  "whiteboard.query",
+  "whiteboard.get_element",
+  "vfs.read_path",
+  "vfs.list_dir"
+]);
 var CommandBus = class {
   constructor(eventBus) {
     this.eventBus = eventBus;
@@ -4215,9 +4348,12 @@ var CommandBus = class {
     if (!handler) {
       throw new Error(`No handler registered for command: ${normalizedCommand.type}`);
     }
-    console.log(
-      `[CommandBus] Executing: ${normalizedCommand.type} (ID: ${normalizedCommand.id}) by ${normalizedCommand.actorId}`
-    );
+    const isQuiet = normalizedCommand.metadata?.silent === true || DEFAULT_QUIET_COMMANDS.has(normalizedCommand.type);
+    if (!isQuiet || process.env.DEBUG?.includes("commandbus") || process.env.DEBUG_COMMAND_BUS === "true") {
+      console.log(
+        `[CommandBus] Executing: ${normalizedCommand.type} (ID: ${normalizedCommand.id}) by ${normalizedCommand.actorId}`
+      );
+    }
     try {
       const result = await handler.execute(normalizedCommand);
       return result;
@@ -4281,7 +4417,7 @@ var ActionRegistry = class {
 };
 
 // packages/core/capability-system/index.ts
-var CapabilityGuard = class {
+var CapabilityGuard = class _CapabilityGuard {
   constructor() {
     this.actorCapabilities = /* @__PURE__ */ new Map();
     this.actorCapabilities.set("user-demo", ["*:*:*"]);
@@ -4321,11 +4457,33 @@ var CapabilityGuard = class {
   revokeAll(actorId) {
     this.actorCapabilities.delete(actorId);
   }
+  static extractRole(actorId) {
+    if (!actorId || typeof actorId !== "string") return null;
+    const lastColon = actorId.lastIndexOf(":");
+    if (lastColon === -1) return null;
+    const role = actorId.slice(lastColon + 1);
+    if (["administrator", "admin", "teacher", "student", "anonymous"].includes(role)) return role;
+    return null;
+  }
   check(actorId, requiredCap) {
-    const isAdmin = actorId === "role:administrator" || actorId?.endsWith(":administrator") || actorId === "admin" || actorId === "usr_admin" || actorId === "admin-demo";
+    const role = _CapabilityGuard.extractRole(actorId);
+    const isAdmin = actorId === "role:administrator" || actorId === "admin" || actorId === "usr_admin" || actorId === "admin-demo" || role === "administrator" || role === "admin";
     if (isAdmin) return true;
-    if (actorId?.endsWith(":teacher")) {
-      const teacherCaps = ["lesson:*", "whiteboard:*", "management:*", "quiz:*", "vfs:*", "process:*", "plugin:*"];
+    if (role === "teacher") {
+      const teacherCaps = [
+        "lesson:*",
+        "whiteboard:*",
+        "management:*",
+        "quiz:*",
+        "vfs:*",
+        "process:*",
+        "plugin:*",
+        "student:write",
+        "assignment:read",
+        "assignment:submit",
+        "assignment:review",
+        "assignment:manage"
+      ];
       const [reqRes2, reqAct2] = requiredCap.split(":");
       if (teacherCaps.some((c) => {
         const [res, act] = c.split(":");
@@ -4334,8 +4492,15 @@ var CapabilityGuard = class {
         return true;
       }
     }
-    if (actorId?.endsWith(":student")) {
-      const studentCaps = ["student:write", "lesson:read", "whiteboard:read"];
+    if (role === "student") {
+      const studentCaps = [
+        "student:write",
+        "lesson:read",
+        "whiteboard:read",
+        "assignment:read",
+        "assignment:submit",
+        "assignment:review"
+      ];
       const [reqRes2, reqAct2] = requiredCap.split(":");
       if (studentCaps.some((c) => {
         const [res, act] = c.split(":");
@@ -5061,15 +5226,89 @@ db.exec(`
     updated_at TEXT DEFAULT (datetime('now'))
   );
 
+  -- \u2500\u2500 \u4F5C\u4E1A\u4E2D\u5FC3\uFF08Assignment Hub\uFF09\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  -- plugin_assignments \u662F\u4F5C\u4E1A\u5B9E\u4F53\uFF1A\u767D\u677F\u4E0A\u7684\u300C\u8BFE\u5802\u4F5C\u4E1A\u4EFB\u52A1\u300D\u6559\u5B66\u5BF9\u8C61\u53EA\u662F\u5B83\u7684
+  -- \u4E00\u4E2A\u6295\u5F71\u7247\u6BB5\uFF08element_id\uFF09\uFF0Cclass_id \u8BA9\u5B83\u540C\u65F6\u51FA\u73B0\u5728\u73ED\u7EA7\u4F5C\u4E1A\u6210\u7EE9\u9875\u3002
+  CREATE TABLE IF NOT EXISTS plugin_assignments (
+    id TEXT PRIMARY KEY,
+    class_id TEXT,
+    lesson_id TEXT,
+    element_id TEXT,
+    title TEXT NOT NULL,
+    description TEXT,
+    instructions TEXT,
+    due_at INTEGER,
+    allow_late INTEGER NOT NULL DEFAULT 1,
+    allow_text INTEGER NOT NULL DEFAULT 1,
+    allow_link INTEGER NOT NULL DEFAULT 0,
+    max_files INTEGER NOT NULL DEFAULT 10,
+    max_file_size INTEGER NOT NULL DEFAULT 20971520,
+    allowed_ext TEXT NOT NULL DEFAULT '',
+    peer_review_mode TEXT NOT NULL DEFAULT 'assigned',
+    peer_review_count INTEGER NOT NULL DEFAULT 2,
+    peer_review_due_at INTEGER,
+    teacher_weight REAL NOT NULL DEFAULT 0.6,
+    peer_weight REAL NOT NULL DEFAULT 0.4,
+    status TEXT NOT NULL DEFAULT 'published',
+    created_by TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+
+  -- \u4E00\u4E2A\u4F5C\u4E1A\u4E00\u4E2A\u5B66\u751F\u4E00\u884C\uFF08assignment_id \u975E\u7A7A\u65F6\uFF09\uFF1B\u4FDD\u7559 lesson_id \u5217\u4EE5\u517C\u5BB9\u65E7\u6570\u636E
   CREATE TABLE IF NOT EXISTS plugin_submissions (
     id TEXT PRIMARY KEY,
-    lesson_id TEXT NOT NULL,
+    assignment_id TEXT,
+    lesson_id TEXT,
     student_id TEXT NOT NULL,
-    file_path TEXT NOT NULL,
+    file_path TEXT,
     version INTEGER NOT NULL DEFAULT 1,
     created_at INTEGER NOT NULL,
-    updated_at INTEGER NOT NULL,
-    UNIQUE(lesson_id, student_id)
+    updated_at INTEGER NOT NULL
+  );
+
+  -- \u6BCF\u6B21\u63D0\u4EA4\u90FD\u7559\u6863\uFF08\u91CD\u4EA4\u4E0D\u8986\u76D6\u5386\u53F2\uFF09
+  CREATE TABLE IF NOT EXISTS plugin_submission_versions (
+    id TEXT PRIMARY KEY,
+    submission_id TEXT NOT NULL,
+    assignment_id TEXT,
+    student_id TEXT NOT NULL,
+    version INTEGER NOT NULL,
+    files_json TEXT NOT NULL DEFAULT '[]',
+    text_content TEXT,
+    link_url TEXT,
+    is_late INTEGER NOT NULL DEFAULT 0,
+    submitted_at INTEGER NOT NULL,
+    UNIQUE(submission_id, version)
+  );
+
+  -- \u4E0A\u4F20\u7684\u5B9E\u4F53\u6587\u4EF6\uFF08\u78C1\u76D8\u5B58\u50A8 + \u5143\u6570\u636E\uFF09\uFF0C\u4E0B\u8F7D\u7AEF\u70B9\u6309\u6B64\u8868\u9274\u6743
+  CREATE TABLE IF NOT EXISTS plugin_assignment_files (
+    id TEXT PRIMARY KEY,
+    assignment_id TEXT NOT NULL,
+    submission_id TEXT,
+    version_id TEXT,
+    student_id TEXT NOT NULL,
+    original_name TEXT NOT NULL,
+    stored_path TEXT NOT NULL,
+    size INTEGER NOT NULL DEFAULT 0,
+    mime TEXT,
+    sha256 TEXT,
+    uploaded_at INTEGER NOT NULL,
+    deleted_at INTEGER
+  );
+
+  -- \u4E92\u8BC4\u4EFB\u52A1\uFF08\u8C01\u8BC4\u8C01 / \u533F\u540D / \u622A\u6B62\uFF09\uFF0C\u7531\u5206\u914D\u7B56\u7565\u751F\u6210
+  CREATE TABLE IF NOT EXISTS plugin_peer_review_tasks (
+    id TEXT PRIMARY KEY,
+    assignment_id TEXT NOT NULL,
+    submission_id TEXT NOT NULL,
+    reviewer_id TEXT NOT NULL,
+    anonymous INTEGER NOT NULL DEFAULT 1,
+    status TEXT NOT NULL DEFAULT 'pending',
+    due_at INTEGER,
+    created_at INTEGER NOT NULL,
+    UNIQUE(submission_id, reviewer_id)
   );
 
   CREATE TABLE IF NOT EXISTS plugin_peer_reviews (
@@ -5079,6 +5318,11 @@ db.exec(`
     score INTEGER NOT NULL,
     comment TEXT,
     created_at INTEGER NOT NULL,
+    assignment_id TEXT,
+    task_id TEXT,
+    anonymous INTEGER NOT NULL DEFAULT 1,
+    status TEXT NOT NULL DEFAULT 'submitted',
+    updated_at INTEGER,
     UNIQUE(submission_id, reviewer_id)
   );
 
@@ -5091,7 +5335,12 @@ db.exec(`
     peer_weight REAL NOT NULL DEFAULT 0.4,
     calculated_final_score INTEGER,
     status TEXT NOT NULL DEFAULT 'draft',
-    graded_at INTEGER
+    graded_at INTEGER,
+    assignment_id TEXT,
+    peer_average_score REAL,
+    source TEXT NOT NULL DEFAULT 'teacher',
+    published_at INTEGER,
+    graded_by TEXT
   );
 
   -- Performance Indexes
@@ -5104,7 +5353,22 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_events_type_time ON events(type, timestamp);
   CREATE INDEX IF NOT EXISTS idx_assignments_class ON assignments(class_id);
   CREATE INDEX IF NOT EXISTS idx_attendance_schedule ON attendance(schedule_id);
+
+  -- \u4F5C\u4E1A\u4E2D\u5FC3\u7D22\u5F15
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_plugin_assignments_element ON plugin_assignments(element_id);
+  CREATE INDEX IF NOT EXISTS idx_plugin_assignments_lesson ON plugin_assignments(lesson_id);
+  CREATE INDEX IF NOT EXISTS idx_plugin_assignments_class ON plugin_assignments(class_id);
+  CREATE INDEX IF NOT EXISTS idx_plugin_submission_versions_submission ON plugin_submission_versions(submission_id);
+  CREATE INDEX IF NOT EXISTS idx_plugin_assignment_files_owner ON plugin_assignment_files(assignment_id, student_id);
+  CREATE INDEX IF NOT EXISTS idx_plugin_peer_review_tasks_reviewer ON plugin_peer_review_tasks(reviewer_id, status);
 `);
+try {
+  db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_plugin_submissions_assignment_student ON plugin_submissions(assignment_id, student_id)");
+  db.exec(
+    "CREATE UNIQUE INDEX IF NOT EXISTS idx_plugin_submissions_legacy ON plugin_submissions(lesson_id, student_id) WHERE assignment_id IS NULL"
+  );
+} catch {
+}
 try {
   db.exec("ALTER TABLE lessons ADD COLUMN creator_id TEXT");
 } catch {
@@ -6606,7 +6870,632 @@ ${htmlContent}
   }
 };
 
+// packages/plugins/score-monitor-script.ts
+var SCORE_MONITOR_SCRIPT_ID = "score-variable-monitor";
+var SCORE_MONITOR_SCRIPT_OWNER = "@openlearn/plugin-builtin";
+var SCORE_MONITOR_SCRIPT = `(function () {
+  'use strict';
+  if (typeof window === 'undefined' || typeof document === 'undefined') return;
+  if (window.__LMS_WATCH_DISABLED__ === true) return;
+  if (window.__LMS_WATCH__ === false) return;
+  if (window.__LMS_SCORE_WATCHER_READY__ === true) return;
+  window.__LMS_SCORE_WATCHER_READY__ = true;
+
+  var INTERVAL_MS = 800;
+  var SILENCE_MS = 1200;
+  var MAX_SUBMITS = 60;
+  var KEY_RE = /score|point|grade|mark|correct|right/i;
+  var SKIP_RE = /^_|^on[A-Z]|^webkit|^moz|^ms/;
+  var NUM_RE = /[0-9]+(?:[.][0-9]+)?/;
+  var RATIO_RE = /([0-9]+(?:[.][0-9]+)?)[^0-9]*[/\uFF0F|\u4E4B][^0-9]*([0-9]+)/;
+  var DOM_SELECTORS = [
+    '#score', '#points', '#grade', '#finalScore', '#totalScore', '#scoreDisplay', '#score-num',
+    '.score', '.points', '.grade', '.final-score',
+    '[id*="score" i]', '[id*="point" i]', '[id*="grade" i]'
+  ];
+
+  var state = { snapshot: null, pendingChanged: null, timer: null, submitted: 0, stopped: false };
+  var seenElements = [];
+
+  function num(value) {
+    if (typeof value === 'number') return isFinite(value) ? value : null;
+    if (typeof value !== 'string') return null;
+    var match = value.match(RATIO_RE);
+    if (match) {
+      var part = parseFloat(match[1]);
+      var whole = parseFloat(match[2]);
+      if (whole > 0) return Math.round((part / whole) * 10000) / 100;
+    }
+    var found = value.match(NUM_RE);
+    if (!found) return null;
+    var parsed = parseFloat(found[0]);
+    return isFinite(parsed) ? parsed : null;
+  }
+
+  function selectorKey(selector) {
+    return 'dom_' + selector.replace(/[^A-Za-z0-9_-]+/g, '_');
+  }
+
+  function isShown(el) {
+    if (!el || !el.getBoundingClientRect) return false;
+    var rect = el.getBoundingClientRect();
+    if (rect.width <= 0 || rect.height <= 0) return false;
+    var node = el;
+    while (node && node.nodeType === 1) {
+      var style = null;
+      try { style = window.getComputedStyle(node); } catch (err) { style = null; }
+      if (style && (style.display === 'none' || style.visibility === 'hidden' || style.opacity === '0')) return false;
+      node = node.parentNode;
+    }
+    return true;
+  }
+
+  function resolvePath(path) {
+    try {
+      var node = window;
+      var parts = String(path).split('.');
+      for (var i = 0; i < parts.length; i++) {
+        if (node === null || typeof node === 'undefined') return null;
+        node = node[parts[i]];
+      }
+      return node;
+    } catch (err) {
+      return null;
+    }
+  }
+
+  function snapshot() {
+    var result = {};
+    var explicit = window.__LMS_WATCH__;
+    var names = [];
+    if (typeof explicit === 'string' && explicit) names.push(explicit);
+    else if (Object.prototype.toString.call(explicit) === '[object Array]') {
+      for (var i = 0; i < explicit.length; i++) if (typeof explicit[i] === 'string') names.push(explicit[i]);
+    }
+    if (names.length) {
+      for (var n = 0; n < names.length; n++) {
+        var value = num(resolvePath(names[n]));
+        if (value !== null) result[names[n]] = value;
+      }
+    } else {
+      var keys = Object.keys(window);
+      for (var k = 0; k < keys.length; k++) {
+        var key = keys[k];
+        if (SKIP_RE.test(key) || !KEY_RE.test(key)) continue;
+        var raw = null;
+        try { raw = window[key]; } catch (err) { continue; }
+        if (typeof raw !== 'number' && typeof raw !== 'string') continue;
+        var numValue = num(raw);
+        if (numValue !== null) result[key] = numValue;
+      }
+    }
+    seenElements = [];
+    for (var s = 0; s < DOM_SELECTORS.length; s++) {
+      var selector = DOM_SELECTORS[s];
+      var nodes = [];
+      try { nodes = document.querySelectorAll(selector); } catch (err) { nodes = []; }
+      for (var t = 0; t < nodes.length; t++) {
+        var el = nodes[t];
+        if (seenElements.indexOf(el) !== -1) continue;
+        seenElements.push(el);
+        if (!isShown(el)) continue;
+        var text = (el.textContent || '').trim();
+        if (!text || text.length > 40) continue;
+        var domValue = num(text);
+        if (domValue === null) continue;
+        if (typeof result[selectorKey(selector)] === 'undefined') result[selectorKey(selector)] = domValue;
+      }
+    }
+    return result;
+  }
+
+  function diff(prev, next) {
+    var changed = {};
+    var keys = Object.keys(next);
+    for (var i = 0; i < keys.length; i++) {
+      var key = keys[i];
+      if (!prev || prev[key] !== next[key]) changed[key] = next[key];
+    }
+    return changed;
+  }
+
+  function report(payload) {
+    try {
+      if (window.LMS && typeof window.LMS.saveProgress === 'function') {
+        window.LMS.saveProgress(payload);
+        return true;
+      }
+    } catch (err) { /* \u5FFD\u7565\u5E76\u5C1D\u8BD5\u515C\u5E95\u901A\u9053 */ }
+    try {
+      var student = window.__LMS_STUDENT__ || {};
+      var courseware = window.__LMS_COURSEWARE__ || {};
+      window.parent.postMessage(
+        { type: 'LMS_SAVE_PROGRESS', uuid: courseware.uuid, attempt_id: student.attempt_id, payload: payload },
+        '*'
+      );
+      return true;
+    } catch (err) {
+      return false;
+    }
+  }
+
+  function flush() {
+    if (state.stopped) return;
+    if (window.__LMS_WATCH_DISABLED__ === true) { state.stopped = true; return; }
+    var changed = state.pendingChanged || {};
+    state.pendingChanged = null;
+    var keys = Object.keys(changed);
+    if (!keys.length) return;
+    if (state.submitted >= MAX_SUBMITS) return;
+    var best = null;
+    for (var i = 0; i < keys.length; i++) {
+      var value = changed[keys[i]];
+      if (typeof value !== 'number') continue;
+      if (best === null || value > best) best = value;
+    }
+    if (best === null) return;
+    var snap = {};
+    var all = state.snapshot || {};
+    var allKeys = Object.keys(all);
+    for (var j = 0; j < allKeys.length; j++) snap[allKeys[j]] = all[allKeys[j]];
+    snap._changed = keys;
+    snap._at = Date.now();
+    try { console.warn('Score variable changed (' + keys.join(', ') + ') -> ' + best); } catch (err) { /* noop */ }
+    var ok = report({ score: best, watch: snap });
+    if (ok) state.submitted = state.submitted + 1;
+  }
+
+  function tick() {
+    if (state.stopped) return;
+    if (window.__LMS_WATCH_DISABLED__ === true) { state.stopped = true; return; }
+    if (state.submitted >= MAX_SUBMITS) { state.stopped = true; return; }
+    var student = window.__LMS_STUDENT__;
+    if (!student || !student.attempt_id) return;
+    var next = snapshot();
+    var changed = diff(state.snapshot, next);
+    state.snapshot = next;
+    if (!Object.keys(changed).length) return;
+    state.pendingChanged = Object.assign(state.pendingChanged || {}, changed);
+    if (state.timer) clearTimeout(state.timer);
+    state.timer = setTimeout(function () { state.timer = null; flush(); }, SILENCE_MS);
+  }
+
+  function init() {
+    state.snapshot = snapshot();
+    setInterval(tick, INTERVAL_MS);
+    try {
+      if (!window.__LMS_SCORE_WATCHERS__ || Object.prototype.toString.call(window.__LMS_SCORE_WATCHERS__) !== '[object Array]') {
+        window.__LMS_SCORE_WATCHERS__ = [];
+      }
+      window.__LMS_SCORE_WATCHERS__.push({
+        stop: function () {
+          state.stopped = true;
+          if (state.timer) { clearTimeout(state.timer); state.timer = null; }
+        }
+      });
+    } catch (err) { /* noop */ }
+    if (typeof MutationObserver === 'function' && document.documentElement) {
+      var scheduled = false;
+      var observer = new MutationObserver(function () {
+        if (scheduled) return;
+        scheduled = true;
+        setTimeout(function () { scheduled = false; tick(); }, 300);
+      });
+      try {
+        observer.observe(document.documentElement, { childList: true, subtree: true, characterData: true });
+      } catch (err) { /* noop */ }
+    }
+    try { console.warn('[native] score monitor armed, watching score-like variables'); } catch (err) { /* noop */ }
+  }
+
+  if (document.body) init();
+  else document.addEventListener('DOMContentLoaded', init);
+})();`;
+
+// packages/plugins/courseware-score.ts
+var DEFAULT_SCORE_POLICY = "LATEST";
+var GLOBAL_SCORE_CONFIG_KEY = "*";
+var SCORE_CONFIG_TABLE = "courseware_score_config";
+var DEFAULT_SCORE_CONFIG = {
+  courseware_id: GLOBAL_SCORE_CONFIG_KEY,
+  courseware_name: null,
+  score_policy: DEFAULT_SCORE_POLICY,
+  score_fields: "",
+  raw_full_score: 100,
+  target_full_score: 100,
+  weight_percentage: 100,
+  lesson_id: null,
+  updated_at: 0
+};
+var BUILTIN_SCORE_CONFIG = { ...DEFAULT_SCORE_CONFIG };
+function toNumber(value) {
+  if (typeof value === "number") return Number.isFinite(value) ? value : null;
+  if (typeof value === "boolean") return null;
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (!trimmed) return null;
+    const cleaned = trimmed.endsWith("%") ? trimmed.slice(0, -1).trim() : trimmed;
+    if (!cleaned || !/^[+-]?(\d+\.?\d*|\.\d+)([eE][+-]?\d+)?$/.test(cleaned)) return null;
+    const num = Number(cleaned);
+    return Number.isFinite(num) ? num : null;
+  }
+  return null;
+}
+function clamp(value, min, max) {
+  if (!Number.isFinite(value)) return min;
+  if (value < min) return min;
+  if (value > max) return max;
+  return value;
+}
+function round2(value) {
+  if (!Number.isFinite(value)) return value;
+  return Math.round(value * 100) / 100;
+}
+function isKnownScorePolicy(value) {
+  if (typeof value !== "string") return false;
+  const raw = value.trim().toUpperCase().replace(/[\s-]+/g, "_");
+  return KNOWN_POLICY_ALIASES.has(raw);
+}
+var KNOWN_POLICY_ALIASES = /* @__PURE__ */ new Set([
+  "LATEST",
+  "LAST",
+  "LATEST_SCORE",
+  "\u6700\u65B0",
+  "\u6700\u8FD1",
+  "MAX",
+  "MAXIMUM",
+  "HIGHEST",
+  "MAX_SCORE",
+  "\u6700\u9AD8",
+  "\u6700\u9AD8\u5206",
+  "AVERAGE",
+  "AVG",
+  "MEAN",
+  "\u5E73\u5747",
+  "\u5E73\u5747\u5206",
+  "FIRST",
+  "EARLIEST",
+  "\u9996\u4E2A",
+  "\u6700\u65E9"
+]);
+function normalizeScorePolicy(value) {
+  const raw = typeof value === "string" ? value.trim().toUpperCase().replace(/[\s-]+/g, "_") : "";
+  if (["MAX", "MAXIMUM", "HIGHEST", "MAX_SCORE", "\u6700\u9AD8", "\u6700\u9AD8\u5206"].includes(raw)) return "MAX";
+  if (["AVERAGE", "AVG", "MEAN", "\u5E73\u5747", "\u5E73\u5747\u5206"].includes(raw)) return "AVERAGE";
+  if (["FIRST", "EARLIEST", "\u9996\u4E2A", "\u6700\u65E9"].includes(raw)) return "FIRST";
+  return "LATEST";
+}
+function parseScoreFields(fields) {
+  if (Array.isArray(fields)) {
+    return fields.map((f) => String(f ?? "").trim()).filter(Boolean);
+  }
+  if (typeof fields !== "string" || !fields.trim()) return [];
+  return fields.split(/[\n\r,，;；|]+/).map((f) => f.trim()).filter(Boolean);
+}
+function getNested(raw, path24) {
+  if (raw === null || raw === void 0) return void 0;
+  if (!path24) return void 0;
+  const parts = String(path24).split(".").map((p) => p.trim()).filter(Boolean);
+  let cursor = raw;
+  for (let i = 0; i < parts.length; i += 1) {
+    if (cursor === null || cursor === void 0) return void 0;
+    const part = parts[i];
+    if (/^\d+$/.test(part)) {
+      const idx = Number(part);
+      cursor = Array.isArray(cursor) ? cursor[idx] : cursor[part];
+    } else {
+      cursor = cursor[part];
+    }
+    if (i < parts.length - 1 && typeof cursor === "string" && /^[[{]/.test(cursor.trim())) {
+      try {
+        cursor = JSON.parse(cursor);
+      } catch (e) {
+      }
+    }
+  }
+  return cursor;
+}
+var COMMON_SCORE_KEYS = [
+  "score",
+  "points",
+  "point",
+  "grade",
+  "mark",
+  "correct",
+  "right",
+  "userScore",
+  "totalScore",
+  "finalScore",
+  "rawScore"
+];
+var COMMON_SCORE_CONTAINERS = ["data", "body", "payload", "detail", "summary", "progress"];
+var SCAN_MAX_DEPTH = 4;
+var SCAN_MAX_NODES = 300;
+function scanForScore(node, depth, budget) {
+  if (node === null || node === void 0) return null;
+  budget.count += 1;
+  if (budget.count > SCAN_MAX_NODES || depth > SCAN_MAX_DEPTH) return null;
+  if (typeof node === "string") {
+    const trimmed = node.trim();
+    if (!trimmed) return null;
+    if (/^[[{]/.test(trimmed)) {
+      try {
+        return scanForScore(JSON.parse(trimmed), depth + 1, budget);
+      } catch (e) {
+        return null;
+      }
+    }
+    const keyValue = /(?:^|[?&\s,;])(?:score|point|points|grade|mark|correct|right)=([+-]?\d+(?:\.\d+)?)/i.exec(trimmed);
+    if (keyValue) return Number(keyValue[1]);
+    const ratio = /^([+-]?\d+(?:\.\d+)?)\s*\/\s*([+-]?\d+(?:\.\d+)?)$/.exec(trimmed);
+    if (ratio) return Number(ratio[1]);
+    return null;
+  }
+  if (typeof node !== "object") return null;
+  for (const key of COMMON_SCORE_KEYS) {
+    const value = toNumber(node[key]);
+    if (value !== null) return value;
+  }
+  for (const key of Object.keys(node)) {
+    const child = node[key];
+    if (child === null || child === void 0) continue;
+    if (typeof child !== "object" && typeof child !== "string") continue;
+    const value = scanForScore(child, depth + 1, budget);
+    if (value !== null) return value;
+  }
+  return null;
+}
+function extractScoreFromFields(raw, fields) {
+  for (const field of parseScoreFields(fields)) {
+    const value = toNumber(getNested(raw, field));
+    if (value !== null) return value;
+  }
+  return null;
+}
+function pickScoreFromPayload(payload, fields) {
+  const byFields = extractScoreFromFields(payload, fields);
+  if (byFields !== null) return byFields;
+  if (typeof payload === "string") return scanForScore(payload, 0, { count: 0 });
+  if (payload === null || typeof payload !== "object") return null;
+  for (const key of COMMON_SCORE_KEYS) {
+    const value = toNumber(payload[key]);
+    if (value !== null) return value;
+  }
+  for (const container of COMMON_SCORE_CONTAINERS) {
+    const nested = payload[container];
+    if (nested === null || typeof nested !== "object") continue;
+    for (const key of COMMON_SCORE_KEYS) {
+      const value = toNumber(nested[key]);
+      if (value !== null) return value;
+    }
+  }
+  return scanForScore(payload, 0, { count: 0 });
+}
+function aggregateScores(scores, policy) {
+  const list = (Array.isArray(scores) ? scores : []).map((s) => toNumber(s)).filter((n) => n !== null);
+  if (list.length === 0) return null;
+  const resolved = normalizeScorePolicy(policy);
+  if (resolved === "MAX") return list.reduce((a, b) => b > a ? b : a, list[0]);
+  if (resolved === "AVERAGE") return list.reduce((a, b) => a + b, 0) / list.length;
+  if (resolved === "FIRST") return list[0];
+  return list[list.length - 1];
+}
+function normalizeScoreConfig(row) {
+  if (!row || typeof row !== "object") return { ...BUILTIN_SCORE_CONFIG };
+  const positive = (value, fallback) => {
+    const num = toNumber(value);
+    return num !== null && num > 0 ? num : fallback;
+  };
+  const weight = toNumber(row.weight_percentage);
+  const updatedAt = toNumber(row.updated_at);
+  return {
+    courseware_id: String(row.courseware_id ?? GLOBAL_SCORE_CONFIG_KEY),
+    courseware_name: row.courseware_name === void 0 || row.courseware_name === null ? null : String(row.courseware_name),
+    score_policy: normalizeScorePolicy(row.score_policy),
+    score_fields: typeof row.score_fields === "string" ? row.score_fields : "",
+    raw_full_score: positive(row.raw_full_score, 100),
+    target_full_score: positive(row.target_full_score, 100),
+    weight_percentage: weight === null ? 100 : clamp(weight, 0, 1e3),
+    lesson_id: row.lesson_id === void 0 || row.lesson_id === null ? null : String(row.lesson_id),
+    updated_at: updatedAt ?? 0
+  };
+}
+function resolveScoreConfig(db2, coursewareId) {
+  const id = coursewareId === null || coursewareId === void 0 ? "" : String(coursewareId).trim();
+  if (id && id !== GLOBAL_SCORE_CONFIG_KEY) {
+    try {
+      const row = db2.prepare(`SELECT * FROM ${SCORE_CONFIG_TABLE} WHERE courseware_id = ?`).get(id);
+      if (row) return { config: normalizeScoreConfig(row), source: "courseware" };
+    } catch (e) {
+    }
+  }
+  try {
+    const global = db2.prepare(`SELECT * FROM ${SCORE_CONFIG_TABLE} WHERE courseware_id = ?`).get(GLOBAL_SCORE_CONFIG_KEY);
+    if (global) return { config: normalizeScoreConfig(global), source: "global" };
+  } catch (e) {
+  }
+  return { config: { ...BUILTIN_SCORE_CONFIG }, source: "builtin" };
+}
+function listScoreConfigs(db2) {
+  try {
+    const rows = db2.prepare(
+      `SELECT * FROM ${SCORE_CONFIG_TABLE} ORDER BY CASE WHEN courseware_id = '${GLOBAL_SCORE_CONFIG_KEY}' THEN 0 ELSE 1 END, updated_at DESC`
+    ).all();
+    return (rows || []).map(normalizeScoreConfig);
+  } catch (e) {
+    return [];
+  }
+}
+function pickInput(input, camel, snake) {
+  if (input[camel] !== void 0) return input[camel];
+  if (input[snake] !== void 0) return input[snake];
+  return void 0;
+}
+function saveScoreConfig(db2, input) {
+  if (!input || typeof input !== "object") throw new Error("save_score_config: invalid payload");
+  const coursewareId = String(
+    pickInput(input, "coursewareId", "courseware_id") ?? ""
+  ).trim();
+  if (!coursewareId) throw new Error("save_score_config: coursewareId is required");
+  if (coursewareId.length > 128) throw new Error("save_score_config: coursewareId is too long");
+  const policyRaw = pickInput(input, "scorePolicy", "score_policy");
+  if (policyRaw !== void 0 && policyRaw !== null && String(policyRaw).trim() !== "" && !isKnownScorePolicy(String(policyRaw))) {
+    throw new Error(
+      `save_score_config: unknown scorePolicy "${policyRaw}" (expected one of LATEST / MAX / AVERAGE / FIRST)`
+    );
+  }
+  const fieldsRaw = pickInput(input, "scoreFields", "score_fields");
+  const fields = Array.isArray(fieldsRaw) ? parseScoreFields(fieldsRaw).join(",") : parseScoreFields(fieldsRaw ?? "").join(",");
+  if (fields.length > 2e3) throw new Error("save_score_config: scoreFields is too long");
+  const nameRaw = pickInput(input, "coursewareName", "courseware_name");
+  const lessonRaw = pickInput(input, "lessonId", "lesson_id");
+  let existing = null;
+  try {
+    const row = db2.prepare(`SELECT * FROM ${SCORE_CONFIG_TABLE} WHERE courseware_id = ?`).get(coursewareId);
+    if (row) existing = normalizeScoreConfig(row);
+  } catch (e) {
+    throw new Error("save_score_config: courseware_score_config table is missing (migration 004 not applied)");
+  }
+  const rawFull = toNumber(pickInput(input, "rawFullScore", "raw_full_score"));
+  const targetFull = toNumber(pickInput(input, "targetFullScore", "target_full_score"));
+  const weight = toNumber(pickInput(input, "weightPercentage", "weight_percentage"));
+  if (rawFull !== void 0 && rawFull !== null && rawFull <= 0) throw new Error("save_score_config: rawFullScore must be > 0");
+  if (targetFull !== void 0 && targetFull !== null && targetFull <= 0)
+    throw new Error("save_score_config: targetFullScore must be > 0");
+  if (weight !== void 0 && weight !== null && (weight < 0 || weight > 1e3))
+    throw new Error("save_score_config: weightPercentage must be within [0, 1000]");
+  const next = {
+    courseware_id: coursewareId,
+    courseware_name: nameRaw === void 0 ? existing?.courseware_name ?? (coursewareId === GLOBAL_SCORE_CONFIG_KEY ? "\u5168\u5C40\u9ED8\u8BA4\u7B56\u7565" : null) : nameRaw === null ? null : String(nameRaw).slice(0, 200),
+    score_policy: policyRaw === void 0 || policyRaw === null || String(policyRaw).trim() === "" ? existing?.score_policy ?? DEFAULT_SCORE_POLICY : normalizeScorePolicy(policyRaw),
+    score_fields: fields || (fieldsRaw === void 0 ? existing?.score_fields ?? "" : ""),
+    raw_full_score: rawFull ?? existing?.raw_full_score ?? 100,
+    target_full_score: targetFull ?? existing?.target_full_score ?? 100,
+    weight_percentage: weight ?? existing?.weight_percentage ?? 100,
+    lesson_id: lessonRaw === void 0 ? existing?.lesson_id ?? null : lessonRaw === null ? null : String(lessonRaw).slice(0, 128),
+    updated_at: Date.now()
+  };
+  db2.prepare(
+    `INSERT INTO ${SCORE_CONFIG_TABLE}
+       (courseware_id, courseware_name, score_policy, score_fields, raw_full_score, target_full_score, weight_percentage, lesson_id, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(courseware_id) DO UPDATE SET
+       courseware_name = excluded.courseware_name,
+       score_policy = excluded.score_policy,
+       score_fields = excluded.score_fields,
+       raw_full_score = excluded.raw_full_score,
+       target_full_score = excluded.target_full_score,
+       weight_percentage = excluded.weight_percentage,
+       lesson_id = excluded.lesson_id,
+       updated_at = excluded.updated_at`
+  ).run(
+    next.courseware_id,
+    next.courseware_name,
+    next.score_policy,
+    next.score_fields,
+    next.raw_full_score,
+    next.target_full_score,
+    next.weight_percentage,
+    next.lesson_id,
+    next.updated_at
+  );
+  return next;
+}
+function resolveCoursewareIdFromAttempt(db2, attemptId) {
+  if (!attemptId) return null;
+  try {
+    const row = db2.prepare("SELECT courseware_id FROM courseware_attempt WHERE id = ?").get(attemptId);
+    return row && row.courseware_id ? String(row.courseware_id) : null;
+  } catch (e) {
+    return null;
+  }
+}
+function collectScoreSamples(db2, attemptId, fields) {
+  if (!attemptId) return [];
+  let rows = [];
+  try {
+    rows = db2.prepare("SELECT event_type, payload_json, created_at FROM submission_raw WHERE attempt_id = ? ORDER BY created_at ASC").all(attemptId) || [];
+  } catch (e) {
+    return [];
+  }
+  const samples = [];
+  for (const row of rows) {
+    let payload = null;
+    try {
+      payload = JSON.parse(row?.payload_json ?? "null");
+    } catch (e) {
+      payload = null;
+    }
+    if (payload === null || payload === void 0) continue;
+    const value = pickScoreFromPayload(payload, fields);
+    if (value === null) continue;
+    samples.push({
+      value,
+      at: toNumber(row?.created_at) ?? 0,
+      eventType: String(row?.event_type ?? "")
+    });
+  }
+  return samples;
+}
+function aggregateAttemptScore(db2, attemptId, options = {}) {
+  const coursewareId = options.coursewareId === void 0 ? resolveCoursewareIdFromAttempt(db2, attemptId) : options.coursewareId;
+  const resolved = resolveScoreConfig(db2, coursewareId);
+  const hasExplicitConfig = resolved.source !== "builtin";
+  const policyOverride = options.policy;
+  const policy = policyOverride === void 0 || policyOverride === null || String(policyOverride).trim() === "" ? resolved.config.score_policy : normalizeScorePolicy(policyOverride);
+  const scoreFields = options.scoreFields === void 0 ? resolved.config.score_fields : options.scoreFields;
+  const rawFull = toNumber(options.rawFullScore);
+  const targetFull = toNumber(options.targetFullScore);
+  const weight = toNumber(options.weightPercentage);
+  const config = {
+    ...resolved.config,
+    score_policy: policy,
+    score_fields: typeof scoreFields === "string" ? scoreFields : parseScoreFields(scoreFields).join(","),
+    raw_full_score: rawFull !== null && rawFull > 0 ? rawFull : resolved.config.raw_full_score,
+    target_full_score: targetFull !== null && targetFull > 0 ? targetFull : resolved.config.target_full_score,
+    weight_percentage: weight !== null ? clamp(weight, 0, 1e3) : resolved.config.weight_percentage
+  };
+  const sampleDetails = collectScoreSamples(db2, attemptId, scoreFields);
+  const samples = sampleDetails.map((s) => s.value);
+  const rawAggregate = aggregateScores(samples, policy);
+  let normalized = null;
+  if (rawAggregate !== null) {
+    if (!hasExplicitConfig) {
+      normalized = rawAggregate;
+    } else {
+      const scaled = rawAggregate / config.raw_full_score * config.target_full_score;
+      normalized = round2(clamp(scaled, 0, config.target_full_score));
+    }
+  }
+  return {
+    policy,
+    config,
+    hasExplicitConfig,
+    samples,
+    sampleDetails,
+    rawAggregate,
+    normalized,
+    finalScore: normalized,
+    weightPercentage: config.weight_percentage
+  };
+}
+function describeAggregation(aggregation) {
+  return {
+    policy: aggregation.policy,
+    sample_count: aggregation.samples.length,
+    samples: aggregation.samples.slice(-50),
+    raw_aggregate: aggregation.rawAggregate,
+    normalized: aggregation.normalized,
+    raw_full_score: aggregation.config.raw_full_score,
+    target_full_score: aggregation.config.target_full_score,
+    weight_percentage: aggregation.weightPercentage,
+    configured: aggregation.hasExplicitConfig,
+    aggregated_at: Date.now()
+  };
+}
+
 // packages/plugins/builtin.ts
+var nativeRuntimeScriptRegistry = null;
 function copyFolderSync(src, dest) {
   if (import_fs3.default.cpSync) {
     import_fs3.default.cpSync(src, dest, { recursive: true });
@@ -6647,6 +7536,21 @@ var BuiltinPlugin = {
     const pluginHost = await ctx.resolve(IPluginHostToken);
     const lifecycleManager = await ctx.resolve(IPluginLifecycleManagerToken);
     const distributionManager = await ctx.resolve(IPluginDistributionManagerToken);
+    try {
+      const runtimeScriptRegistry = await ctx.resolve(ICoursewareRuntimeScriptRegistryToken);
+      if (runtimeScriptRegistry && typeof runtimeScriptRegistry.register === "function") {
+        runtimeScriptRegistry.register(SCORE_MONITOR_SCRIPT_OWNER, {
+          id: SCORE_MONITOR_SCRIPT_ID,
+          description: "\u5E73\u53F0\u539F\u751F\u5206\u6570\u53D8\u91CF\u76D1\u89C6\u5668\uFF1A\u91C7\u96C6\u8BFE\u4EF6\u5185\u4EE3\u8868\u5206\u6570\u7684\u53D8\u91CF\u5E76\u6301\u7EED\u4E0A\u62A5\u4E3A\u6210\u7EE9\u6837\u672C",
+          source: SCORE_MONITOR_SCRIPT,
+          position: "body-end",
+          priority: 200
+        });
+        nativeRuntimeScriptRegistry = runtimeScriptRegistry;
+      }
+    } catch (err) {
+      console.warn("[builtin] \u6CE8\u518C\u539F\u751F\u5206\u6570\u53D8\u91CF\u76D1\u89C6\u5668\u5931\u8D25\uFF08\u5DF2\u5FFD\u7565\uFF09:", err.message);
+    }
     const createLessonCmdType = "lesson.create";
     await actionRegistry.register({
       id: "core-lesson-create",
@@ -7975,6 +8879,17 @@ var BuiltinPlugin = {
             attemptId
           );
         }
+        let aggregation = null;
+        try {
+          const attemptRow = db2.prepare("SELECT courseware_id FROM courseware_attempt WHERE id = ?").get(attemptId);
+          aggregation = aggregateAttemptScore(db2, attemptId, {
+            coursewareId: attemptRow?.courseware_id ?? null
+          });
+        } catch (aggErr) {
+          console.warn("[courseware.submit_attempt] score aggregation failed, fallback to latest score:", aggErr);
+        }
+        const aggregatedScore = aggregation && aggregation.finalScore !== null ? aggregation.finalScore : null;
+        const aggregationExtra = aggregation ? { score_aggregation: describeAggregation(aggregation) } : {};
         const existing = db2.prepare("SELECT * FROM submission_result WHERE attempt_id = ?").get(attemptId);
         if (!existing) {
           db2.prepare(
@@ -7982,13 +8897,13 @@ var BuiltinPlugin = {
           ).run(
             "res_" + import_crypto3.default.randomBytes(8).toString("hex"),
             attemptId,
-            score !== void 0 ? score : null,
+            aggregatedScore !== null ? aggregatedScore : score !== void 0 ? score : null,
             comment || null,
             completion !== void 0 ? completion : null,
-            JSON.stringify(extra)
+            JSON.stringify({ ...extra, ...aggregationExtra })
           );
         } else {
-          const finalScore = score !== void 0 ? score : existing.score;
+          const finalScore = aggregatedScore !== null ? aggregatedScore : score !== void 0 ? score : existing.score;
           const finalComment = comment || existing.comment;
           const finalCompletion = completion !== void 0 ? completion : existing.completion;
           let mergedExtra = {};
@@ -7996,7 +8911,7 @@ var BuiltinPlugin = {
             mergedExtra = JSON.parse(existing.extra_json || "{}");
           } catch (e) {
           }
-          mergedExtra = { ...mergedExtra, ...extra };
+          mergedExtra = { ...mergedExtra, ...extra, ...aggregationExtra };
           db2.prepare(
             "UPDATE submission_result SET score = ?, comment = ?, completion = ?, extra_json = ? WHERE attempt_id = ?"
           ).run(finalScore, finalComment, finalCompletion, JSON.stringify(mergedExtra), attemptId);
@@ -8012,31 +8927,158 @@ var BuiltinPlugin = {
         return { success: true };
       }
     });
-    const getAttemptRawDataCmdType = "courseware.get_attempt_raw_data";
+    const getScoreConfigCmdType = "courseware.get_score_config";
     await actionRegistry.register({
-      id: "core-courseware-get-attempt-raw-data",
-      commandType: getAttemptRawDataCmdType,
-      description: "Get all captured raw events/submits for a student attempt",
+      id: "core-courseware-get-score-config",
+      commandType: getScoreConfigCmdType,
+      description: "\u8BFB\u53D6\u4E92\u52A8\u8BFE\u4EF6\u7684\u6210\u7EE9\u5F52\u96C6\u914D\u7F6E\uFF08\u7B56\u7565 / \u5B57\u6BB5 / \u6EE1\u5206 / \u6743\u91CD\uFF09",
       capabilityRequired: "lesson:read",
       inputSchema: {
         type: "OBJECT",
         properties: {
-          attemptId: { type: "STRING", description: "ID of the attempt to query" }
-        },
-        required: ["attemptId"]
+          coursewareId: { type: "STRING", description: "\u8BFE\u4EF6 ID\uFF08\u7701\u7565\u6216\u4F20 '*' \u65F6\u8BFB\u53D6\u5168\u5C40\u9ED8\u8BA4\u914D\u7F6E\uFF09" }
+        }
       }
     });
-    await commandBus.registerHandler(getAttemptRawDataCmdType, {
+    await commandBus.registerHandler(getScoreConfigCmdType, {
       async execute(command) {
-        const payload = command.payload;
-        const { attemptId } = payload;
-        const rows = db2.prepare("SELECT * FROM submission_raw WHERE attempt_id = ? ORDER BY created_at ASC").all(attemptId);
-        return rows;
+        const payload = command.payload || {};
+        const resolved = resolveScoreConfig(db2, payload.coursewareId ?? payload.courseware_id ?? null);
+        return { success: true, source: resolved.source, ...resolved.config };
       }
     });
-    const listCoursewareCmdType = "courseware.list";
+    const saveScoreConfigCmdType = "courseware.save_score_config";
     await actionRegistry.register({
-      id: "core-courseware-list",
+      id: "core-courseware-save-score-config",
+      commandType: saveScoreConfigCmdType,
+      description: "\u4FDD\u5B58\u4E92\u52A8\u8BFE\u4EF6\u7684\u6210\u7EE9\u5F52\u96C6\u914D\u7F6E",
+      capabilityRequired: "lesson:write",
+      inputSchema: {
+        type: "OBJECT",
+        properties: {
+          coursewareId: { type: "STRING", description: "\u8BFE\u4EF6 ID\uFF08\u4F20 '*' \u8868\u793A\u5168\u5C40\u9ED8\u8BA4\u7B56\u7565\uFF09" },
+          coursewareName: { type: "STRING", description: "\u8BFE\u4EF6\u540D\u79F0\uFF08\u4FBF\u4E8E\u8BC6\u522B\uFF09" },
+          scorePolicy: { type: "STRING", description: "LATEST | MAX | AVERAGE | FIRST" },
+          scoreFields: { type: "STRING", description: "\u5206\u6570\u6240\u5728\u5B57\u6BB5\u8DEF\u5F84\uFF0C\u9017\u53F7\u5206\u9694\uFF0C\u5982 score,data.points" },
+          rawFullScore: { type: "NUMBER", description: "\u8BFE\u4EF6\u539F\u59CB\u6EE1\u5206" },
+          targetFullScore: { type: "NUMBER", description: "\u5F52\u96C6\u540E\u7684\u76EE\u6807\u6EE1\u5206" },
+          weightPercentage: { type: "NUMBER", description: "\u8BE5\u8BFE\u4EF6\u5728\u603B\u8BC4\u4E2D\u7684\u6743\u91CD\uFF08\u767E\u5206\u6BD4\uFF09" },
+          lessonId: { type: "STRING", description: "\u5173\u8054\u8BFE\u65F6 ID\uFF08\u53EF\u9009\uFF09" }
+        },
+        required: ["coursewareId"]
+      }
+    });
+    await commandBus.registerHandler(saveScoreConfigCmdType, {
+      async execute(command) {
+        const saved = saveScoreConfig(db2, command.payload || {});
+        await eventBus.publish({
+          id: (0, import_uuid6.v7)(),
+          type: "courseware.score_config_saved",
+          source: "builtin.courseware",
+          payload: { ...saved },
+          timestamp: Date.now(),
+          correlationId: command.id
+        });
+        return { success: true, ...saved };
+      }
+    });
+    const listScoreConfigsCmdType = "courseware.list_score_configs";
+    await actionRegistry.register({
+      id: "core-courseware-list-score-configs",
+      commandType: listScoreConfigsCmdType,
+      description: "\u5217\u51FA\u6240\u6709\u5DF2\u914D\u7F6E\u7684\u8BFE\u4EF6\u6210\u7EE9\u5F52\u96C6\u7B56\u7565",
+      capabilityRequired: "lesson:read",
+      inputSchema: { type: "OBJECT", properties: {} }
+    });
+    await commandBus.registerHandler(listScoreConfigsCmdType, {
+      async execute() {
+        return { success: true, configs: listScoreConfigs(db2) };
+      }
+    });
+    const regradeCmdType = "courseware.regrade_attempts";
+    await actionRegistry.register({
+      id: "core-courseware-regrade-attempts",
+      commandType: regradeCmdType,
+      description: "\u6309\u5F53\u524D\u6210\u7EE9\u5F52\u96C6\u7B56\u7565\u91CD\u7B97\u65E2\u6709 attempt \u7684\u5B98\u65B9\u6210\u7EE9\uFF08\u6539\u914D\u7F6E\u540E\u56DE\u586B\uFF09",
+      capabilityRequired: "lesson:write",
+      inputSchema: {
+        type: "OBJECT",
+        properties: {
+          attemptId: { type: "STRING", description: "\u5355\u4E2A attempt ID\uFF08\u4E0E coursewareId \u4E8C\u9009\u4E00\uFF09" },
+          coursewareId: { type: "STRING", description: "\u6309\u8BFE\u4EF6\u6279\u91CF\u91CD\u7B97\uFF08\u6700\u591A 2000 \u4E2A attempt\uFF09" },
+          limit: { type: "NUMBER", description: "\u6279\u91CF\u91CD\u7B97\u4E0A\u9650\uFF0C\u9ED8\u8BA4 500" }
+        }
+      }
+    });
+    await commandBus.registerHandler(regradeCmdType, {
+      async execute(command) {
+        const payload = command.payload || {};
+        const attemptId = typeof payload.attemptId === "string" ? payload.attemptId.trim() : "";
+        const coursewareId = typeof payload.coursewareId === "string" ? payload.coursewareId.trim() : "";
+        if (!attemptId && !coursewareId) {
+          throw new Error("courseware.regrade_attempts: attemptId or coursewareId is required");
+        }
+        const requestedLimit = Number(payload.limit);
+        const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, 2e3) : 500;
+        let attemptIds = [];
+        if (attemptId) {
+          attemptIds = [attemptId];
+        } else {
+          const rows = db2.prepare("SELECT id FROM courseware_attempt WHERE courseware_id = ? ORDER BY started_at DESC LIMIT ?").all(coursewareId, limit);
+          attemptIds = (rows || []).map((r) => String(r.id));
+        }
+        const regraded = [];
+        let failed = 0;
+        for (const id of attemptIds) {
+          try {
+            const agg = aggregateAttemptScore(db2, id, { coursewareId: coursewareId || null });
+            if (agg.finalScore === null) continue;
+            const current = db2.prepare("SELECT * FROM submission_result WHERE attempt_id = ?").get(id);
+            if (!current) continue;
+            let mergedExtra = {};
+            try {
+              mergedExtra = JSON.parse(current.extra_json || "{}");
+            } catch (e) {
+            }
+            mergedExtra = { ...mergedExtra, score_aggregation: describeAggregation(agg) };
+            db2.prepare("UPDATE submission_result SET score = ?, extra_json = ? WHERE attempt_id = ?").run(
+              agg.finalScore,
+              JSON.stringify(mergedExtra),
+              id
+            );
+            regraded.push({ attemptId: id, score: agg.finalScore, samples: agg.samples.length, policy: agg.policy });
+          } catch (e) {
+            failed += 1;
+          }
+        }
+        return { success: true, scanned: attemptIds.length, regraded: regraded.length, failed, results: regraded };
+      }
+    });
+    const getAttemptRawDataCmdType = "courseware.get_attempt_raw_data";
+    await actionRegistry.register({
+      id: "core-courseware-get-attempt-raw-data",
+      commandType: getAttemptRawDataCmdType,
+      description: "Get all captured raw events/submits for a student attempt",
+      capabilityRequired: "lesson:read",
+      inputSchema: {
+        type: "OBJECT",
+        properties: {
+          attemptId: { type: "STRING", description: "ID of the attempt to query" }
+        },
+        required: ["attemptId"]
+      }
+    });
+    await commandBus.registerHandler(getAttemptRawDataCmdType, {
+      async execute(command) {
+        const payload = command.payload;
+        const { attemptId } = payload;
+        const rows = db2.prepare("SELECT * FROM submission_raw WHERE attempt_id = ? ORDER BY created_at ASC").all(attemptId);
+        return rows;
+      }
+    });
+    const listCoursewareCmdType = "courseware.list";
+    await actionRegistry.register({
+      id: "core-courseware-list",
       commandType: listCoursewareCmdType,
       description: "List all uploaded interactive coursewares",
       capabilityRequired: "lesson:read",
@@ -8090,6 +9132,14 @@ var BuiltinPlugin = {
     });
   },
   deactivate: async () => {
+    try {
+      if (nativeRuntimeScriptRegistry && typeof nativeRuntimeScriptRegistry.clear === "function") {
+        nativeRuntimeScriptRegistry.clear(SCORE_MONITOR_SCRIPT_OWNER);
+        nativeRuntimeScriptRegistry = null;
+      }
+    } catch (err) {
+      console.warn("[builtin] \u56DE\u6536\u539F\u751F\u5206\u6570\u53D8\u91CF\u76D1\u89C6\u5668\u5931\u8D25\uFF08\u5DF2\u5FFD\u7565\uFF09:", err.message);
+    }
   }
 };
 
@@ -8295,6 +9345,27 @@ var AiPlannerPlugin = {
 // packages/plugins/assignment-eval.ts
 var import_uuid8 = require("uuid");
 var import_plugin_sdk6 = require("@openlearn/plugin-sdk");
+var PRIVILEGED_ROLES = ["teacher", "administrator", "admin"];
+function parseActorId(actorId) {
+  const match = /^user:([^:]+):(.+)$/.exec(String(actorId || ""));
+  if (!match) return null;
+  return { userId: match[1], role: match[2] };
+}
+function isPrivilegedActor(actorId) {
+  const actor = parseActorId(actorId);
+  if (!actor) return true;
+  return PRIVILEGED_ROLES.includes(actor.role);
+}
+function actorUserId(actorId) {
+  return parseActorId(actorId)?.userId ?? actorId ?? null;
+}
+function assertStudentOwnership(actorId, studentId, action) {
+  if (isPrivilegedActor(actorId)) return;
+  const actor = parseActorId(actorId);
+  if (!actor || actor.userId !== studentId) {
+    throw new Error(`Access Denied: Students can only ${action} their own assignment`);
+  }
+}
 var AssignmentEvalPlugin = {
   manifest: {
     id: "@openlearn/plugin-assignment-eval",
@@ -8305,140 +9376,632 @@ var AssignmentEvalPlugin = {
       "@openlearn/core:ICommandBusService@^1.0.0",
       "@openlearn/core:IActionRegistryService@^1.0.0",
       "@openlearn/core:IDatabase@^1.0.0",
-      "@openlearn/core:ISemesterGradeService@^1.0.0"
+      "@openlearn/core:ISemesterGradeService@^1.0.0",
+      "@openlearn/core:IEventBusService@^1.0.0"
     ],
-    capabilitiesProposed: ["lesson:read", "lesson:write"],
+    capabilitiesProposed: ["assignment:read", "assignment:submit", "assignment:review", "assignment:manage"],
     engines: { openlearn: ">=0.2.5" }
   },
   activate: async (ctx) => {
     const commandBus = ctx.services.commandBus;
     const actionRegistry = ctx.services.actionRegistry;
+    const eventBus = ctx.services.eventBus;
     const db2 = await ctx.resolve(import_plugin_sdk6.IDatabaseToken);
     const gradeService = await ctx.resolve(import_plugin_sdk6.ISemesterGradeServiceToken);
+    const OWNED_COMMAND_TYPES = [
+      "assignment.create",
+      "assignment.list",
+      "assignment.get",
+      "assignment.submit",
+      "assignment.peer_review",
+      "assignment.assign_peer_reviews",
+      "assignment.grade"
+    ];
+    const OWNED_ACTION_IDS = [
+      "eval-assignment-create",
+      "eval-assignment-list",
+      "eval-assignment-get",
+      "eval-assignment-submit",
+      "eval-assignment-peer-review",
+      "eval-assignment-assign-peer-reviews",
+      "eval-assignment-grade"
+    ];
+    for (const type of OWNED_COMMAND_TYPES) {
+      commandBus.unregisterHandler(type);
+    }
+    for (const id of OWNED_ACTION_IDS) {
+      actionRegistry.unregister(id);
+    }
     commandBus.unregisterHandler("assignment.submit");
     commandBus.unregisterHandler("assignment.grade");
+    actionRegistry.unregister("core-assignment-create");
     actionRegistry.unregister("core-assignment-submit");
     actionRegistry.unregister("core-assignment-grade");
-    const submitCmd = "assignment.submit";
+    const loadAssignment = (assignmentId) => db2.prepare("SELECT * FROM plugin_assignments WHERE id = ?").get(assignmentId);
+    const resolveAssignment = (assignmentId, lessonId) => {
+      if (assignmentId) {
+        const row = loadAssignment(assignmentId);
+        if (!row) throw new Error(`Assignment not found: ${assignmentId}`);
+        return row;
+      }
+      if (lessonId) {
+        const existing = db2.prepare("SELECT * FROM plugin_assignments WHERE lesson_id = ? ORDER BY created_at ASC LIMIT 1").get(lessonId);
+        if (existing) return existing;
+        const now = Date.now();
+        const autoId = "asg-" + (0, import_uuid8.v7)();
+        db2.prepare(
+          `INSERT INTO plugin_assignments
+             (id, class_id, lesson_id, element_id, title, description, status, created_by, created_at, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?, 'published', ?, ?, ?)`
+        ).run(autoId, null, lessonId, null, "\u672C\u8BFE\u4F5C\u4E1A", "\u7531\u8BFE\u65F6\u4F5C\u4E1A\u5165\u53E3\u81EA\u52A8\u521B\u5EFA", null, now, now);
+        return loadAssignment(autoId);
+      }
+      throw new Error("Missing required params: assignmentId or lessonId");
+    };
+    const latestVersionOfSubmission = (submissionId) => db2.prepare(
+      "SELECT id, version, text_content, link_url, submitted_at, is_late FROM plugin_submission_versions WHERE submission_id = ? ORDER BY version DESC LIMIT 1"
+    ).get(submissionId);
+    const filesOfVersion = (versionId) => db2.prepare(
+      "SELECT id, original_name, size, mime FROM plugin_assignment_files WHERE version_id = ? AND deleted_at IS NULL ORDER BY uploaded_at ASC"
+    ).all(versionId);
+    const buildPeerReviewTasks = (assignmentId, reviewerId) => {
+      const tasks = db2.prepare(
+        "SELECT id, submission_id, anonymous, status, due_at, created_at FROM plugin_peer_review_tasks WHERE assignment_id = ? AND reviewer_id = ? ORDER BY created_at ASC"
+      ).all(assignmentId, reviewerId);
+      return tasks.map((task) => {
+        const version = latestVersionOfSubmission(task.submission_id);
+        const review = db2.prepare(
+          "SELECT score, comment, status, updated_at FROM plugin_peer_reviews WHERE submission_id = ? AND reviewer_id = ?"
+        ).get(task.submission_id, reviewerId);
+        const submissionUpdatedAt = db2.prepare("SELECT updated_at FROM plugin_submissions WHERE id = ?").get(task.submission_id)?.updated_at ?? null;
+        return {
+          taskId: task.id,
+          submissionId: task.submission_id,
+          status: task.status,
+          anonymous: Number(task.anonymous) === 1,
+          dueAt: task.due_at ?? null,
+          createdAt: task.created_at,
+          // 我评完之后作者又改过提交 → 提醒复核
+          stale: Boolean(
+            review?.status === "submitted" && submissionUpdatedAt && Number(review.updated_at || 0) < Number(submissionUpdatedAt)
+          ),
+          review: review ? { score: review.score, comment: review.comment || "", submittedAt: review.updated_at ?? null } : null,
+          submission: version ? {
+            version: version.version,
+            textContent: version.text_content || "",
+            linkUrl: version.link_url || "",
+            submittedAt: version.submitted_at,
+            isLate: Number(version.is_late) === 1,
+            files: filesOfVersion(version.id)
+          } : null
+        };
+      });
+    };
+    const buildPeerProgress = (assignmentId) => {
+      const nameOf = (studentId) => {
+        try {
+          const row = db2.prepare("SELECT name FROM students WHERE id = ?").get(studentId);
+          return row?.name || studentId;
+        } catch {
+          return studentId;
+        }
+      };
+      const tasks = db2.prepare("SELECT reviewer_id, status FROM plugin_peer_review_tasks WHERE assignment_id = ?").all(assignmentId);
+      const byReviewer = /* @__PURE__ */ new Map();
+      for (const task of tasks) {
+        const entry = byReviewer.get(task.reviewer_id) || { studentId: task.reviewer_id, name: nameOf(task.reviewer_id), pending: 0, submitted: 0 };
+        if (task.status === "submitted") entry.submitted += 1;
+        else entry.pending += 1;
+        byReviewer.set(task.reviewer_id, entry);
+      }
+      const flags = [];
+      for (const entry of byReviewer.values()) {
+        if (entry.pending > 0) {
+          flags.push({
+            type: "peer_review_pending",
+            reviewerId: entry.studentId,
+            detail: `${entry.name} \u8FD8\u6709 ${entry.pending} \u4EFD\u4E92\u8BC4\u672A\u5B8C\u6210`
+          });
+        }
+        if (entry.submitted >= 2) {
+          const full = db2.prepare(
+            "SELECT COUNT(*) AS c FROM plugin_peer_reviews WHERE assignment_id = ? AND reviewer_id = ? AND score >= 100"
+          ).get(assignmentId, entry.studentId).c;
+          if (full >= entry.submitted) {
+            flags.push({
+              type: "all_full_marks",
+              reviewerId: entry.studentId,
+              detail: `${entry.name} \u7684 ${entry.submitted} \u4EFD\u4E92\u8BC4\u5168\u90E8\u7ED9\u4E86\u6EE1\u5206\uFF0C\u5EFA\u8BAE\u590D\u6838`
+            });
+          }
+        }
+      }
+      const gaps = db2.prepare(
+        `SELECT r.reviewer_id AS reviewerId, r.score AS peerScore, g.teacher_score AS teacherScore, s.student_id AS authorId
+             FROM plugin_peer_reviews r
+             JOIN plugin_grades g ON g.submission_id = r.submission_id
+             JOIN plugin_submissions s ON s.id = r.submission_id
+            WHERE r.assignment_id = ? AND g.teacher_score IS NOT NULL`
+      ).all(assignmentId);
+      for (const gap of gaps) {
+        if (Math.abs(Number(gap.peerScore) - Number(gap.teacherScore)) <= 25) continue;
+        flags.push({
+          type: "score_gap",
+          reviewerId: gap.reviewerId,
+          detail: `${nameOf(gap.reviewerId)} \u7ED9 ${nameOf(gap.authorId)} \u7684\u4E92\u8BC4\u5206 ${gap.peerScore}\uFF0C\u4E0E\u6559\u5E08\u8BC4\u5206 ${gap.teacherScore} \u76F8\u5DEE\u8F83\u5927`
+        });
+      }
+      const submissionCount = db2.prepare("SELECT COUNT(*) AS c FROM plugin_submissions WHERE assignment_id = ?").get(assignmentId).c;
+      const completed = tasks.filter((t) => t.status === "submitted").length;
+      return {
+        submissions: submissionCount,
+        tasks: tasks.length,
+        completed,
+        pending: tasks.length - completed,
+        reviewers: Array.from(byReviewer.values()).sort((a, b) => b.pending - a.pending),
+        flags
+      };
+    };
+    const publishEvent2 = async (type, payload, correlationId) => {
+      if (!eventBus || typeof eventBus.publish !== "function") return;
+      try {
+        await eventBus.publish({
+          id: (0, import_uuid8.v7)(),
+          type,
+          source: "assignment-eval",
+          payload,
+          timestamp: Date.now(),
+          correlationId
+        });
+      } catch (err) {
+        ctx.log?.warn?.(`[assignment-eval] \u53D1\u5E03\u4E8B\u4EF6 ${type} \u5931\u8D25: ${err?.message}`);
+      }
+    };
+    await actionRegistry.register({
+      id: "eval-assignment-create",
+      commandType: "assignment.create",
+      description: "\u521B\u5EFA\u6216\u66F4\u65B0\u4F5C\u4E1A\u5B9E\u4F53\uFF08\u53EF\u540C\u65F6\u7ED1\u5B9A\u8BFE\u65F6\u3001\u73ED\u7EA7\u4E0E\u767D\u677F\u5143\u7D20\uFF09",
+      capabilityRequired: "assignment:manage",
+      inputSchema: {
+        type: "OBJECT",
+        properties: {
+          assignmentId: { type: "STRING", description: "\u5DF2\u5B58\u5728\u5219\u66F4\u65B0\uFF0C\u7F3A\u7701\u4E3A\u65B0\u5EFA" },
+          title: { type: "STRING", description: "\u4F5C\u4E1A\u6807\u9898" },
+          description: { type: "STRING", description: "\u4F5C\u4E1A\u8BF4\u660E" },
+          instructions: { type: "STRING", description: "\u4F5C\u7B54\u8981\u6C42" },
+          lessonId: { type: "STRING", description: "\u5173\u8054\u8BFE\u65F6 ID" },
+          classId: { type: "STRING", description: "\u5173\u8054\u73ED\u7EA7 ID" },
+          elementId: { type: "STRING", description: "\u767D\u677F\u6559\u5B66\u5BF9\u8C61 ID" },
+          dueAt: { type: "NUMBER", description: "\u622A\u6B62\u65F6\u95F4\uFF08\u6BEB\u79D2\u65F6\u95F4\u6233\uFF09" },
+          allowLate: { type: "BOOLEAN", description: "\u662F\u5426\u5141\u8BB8\u8FDF\u4EA4" },
+          allowText: { type: "BOOLEAN", description: "\u662F\u5426\u5141\u8BB8\u6587\u672C\u4F5C\u7B54" },
+          allowLink: { type: "BOOLEAN", description: "\u662F\u5426\u5141\u8BB8\u94FE\u63A5\u4F5C\u7B54" },
+          maxFiles: { type: "NUMBER", description: "\u6700\u591A\u6587\u4EF6\u6570" },
+          maxFileSize: { type: "NUMBER", description: "\u5355\u6587\u4EF6\u5927\u5C0F\u4E0A\u9650\uFF08\u5B57\u8282\uFF09" },
+          peerReviewCount: { type: "NUMBER", description: "\u6BCF\u4EBA\u9700\u8981\u4E92\u8BC4\u7684\u4EFD\u6570" },
+          teacherWeight: { type: "NUMBER", description: "\u6559\u5E08\u8BC4\u5206\u6743\u91CD" },
+          peerWeight: { type: "NUMBER", description: "\u4E92\u8BC4\u5E73\u5747\u5206\u6743\u91CD" },
+          status: { type: "STRING", description: "published / draft / archived" }
+        },
+        required: ["title"]
+      }
+    });
+    await commandBus.registerHandler("assignment.create", {
+      async execute(command) {
+        const payload = command.payload;
+        const now = Date.now();
+        const teacherWeight = payload.teacherWeight === void 0 ? 0.6 : Number(payload.teacherWeight);
+        const peerWeight = payload.peerWeight === void 0 ? 0.4 : Number(payload.peerWeight);
+        if (Math.abs(teacherWeight + peerWeight - 1) > 1e-3) {
+          throw new Error("Access Denied: The sum of teacherWeight and peerWeight must equal 1.0");
+        }
+        const assignmentId = payload.assignmentId || "asg-" + (0, import_uuid8.v7)();
+        const existing = loadAssignment(assignmentId);
+        if (existing) {
+          db2.prepare(
+            `UPDATE plugin_assignments SET
+               class_id = ?, lesson_id = ?, element_id = ?, title = ?, description = ?, instructions = ?,
+               due_at = ?, allow_late = ?, allow_text = ?, allow_link = ?, max_files = ?, max_file_size = ?,
+               peer_review_count = ?, teacher_weight = ?, peer_weight = ?, status = ?, updated_at = ?
+             WHERE id = ?`
+          ).run(
+            payload.classId ?? existing.class_id,
+            payload.lessonId ?? existing.lesson_id,
+            payload.elementId ?? existing.element_id,
+            payload.title ?? existing.title,
+            payload.description ?? null,
+            payload.instructions ?? null,
+            payload.dueAt ?? existing.due_at,
+            payload.allowLate === void 0 ? existing.allow_late : payload.allowLate ? 1 : 0,
+            payload.allowText === void 0 ? existing.allow_text : payload.allowText ? 1 : 0,
+            payload.allowLink === void 0 ? existing.allow_link : payload.allowLink ? 1 : 0,
+            payload.maxFiles ?? existing.max_files,
+            payload.maxFileSize ?? existing.max_file_size,
+            payload.peerReviewCount ?? existing.peer_review_count,
+            teacherWeight,
+            peerWeight,
+            payload.status ?? existing.status,
+            now,
+            assignmentId
+          );
+        } else {
+          db2.prepare(
+            `INSERT INTO plugin_assignments
+               (id, class_id, lesson_id, element_id, title, description, instructions, due_at, allow_late, allow_text,
+                allow_link, max_files, max_file_size, peer_review_count, teacher_weight, peer_weight, status,
+                created_by, created_at, updated_at)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+          ).run(
+            assignmentId,
+            payload.classId ?? null,
+            payload.lessonId ?? null,
+            payload.elementId ?? null,
+            payload.title,
+            payload.description ?? null,
+            payload.instructions ?? null,
+            payload.dueAt ?? null,
+            payload.allowLate === false ? 0 : 1,
+            payload.allowText === false ? 0 : 1,
+            payload.allowLink ? 1 : 0,
+            payload.maxFiles ?? 10,
+            payload.maxFileSize ?? 20971520,
+            payload.peerReviewCount ?? 2,
+            teacherWeight,
+            peerWeight,
+            payload.status ?? "published",
+            actorUserId(command.actorId),
+            now,
+            now
+          );
+        }
+        return { success: true, assignmentId, created: !existing };
+      }
+    });
+    await actionRegistry.register({
+      id: "eval-assignment-list",
+      commandType: "assignment.list",
+      description: "\u6309\u8BFE\u65F6 / \u73ED\u7EA7 / \u767D\u677F\u5143\u7D20 / \u5B66\u751F\u5217\u51FA\u4F5C\u4E1A",
+      capabilityRequired: "assignment:read",
+      inputSchema: {
+        type: "OBJECT",
+        properties: {
+          lessonId: { type: "STRING" },
+          classId: { type: "STRING" },
+          elementId: { type: "STRING" },
+          studentId: { type: "STRING", description: "\u9644\u5E26\u8BE5\u5B66\u751F\u7684\u63D0\u4EA4\u6982\u8981" },
+          includeArchived: { type: "BOOLEAN" }
+        }
+      }
+    });
+    await commandBus.registerHandler("assignment.list", {
+      async execute(command) {
+        const payload = command.payload;
+        const where = [];
+        const params = [];
+        if (payload.lessonId) {
+          where.push("lesson_id = ?");
+          params.push(payload.lessonId);
+        }
+        if (payload.classId) {
+          where.push("class_id = ?");
+          params.push(payload.classId);
+        }
+        if (payload.elementId) {
+          where.push("element_id = ?");
+          params.push(payload.elementId);
+        }
+        if (!payload.includeArchived) {
+          where.push("status != 'archived'");
+        }
+        const clause = where.length ? `WHERE ${where.join(" AND ")}` : "";
+        const rows = db2.prepare(`SELECT * FROM plugin_assignments ${clause} ORDER BY created_at DESC LIMIT 200`).all(...params);
+        const studentId = payload.studentId;
+        if (!studentId) return { success: true, assignments: rows };
+        const assignments = rows.map((row) => {
+          const submission = db2.prepare("SELECT id, version, file_path, updated_at FROM plugin_submissions WHERE assignment_id = ? AND student_id = ?").get(row.id, studentId);
+          const grade = submission ? db2.prepare("SELECT calculated_final_score, status FROM plugin_grades WHERE submission_id = ?").get(submission.id) : void 0;
+          return { ...row, submission: submission || null, grade: grade || null };
+        });
+        return { success: true, assignments };
+      }
+    });
+    await actionRegistry.register({
+      id: "eval-assignment-get",
+      commandType: "assignment.get",
+      description: "\u8BFB\u53D6\u5355\u4E2A\u4F5C\u4E1A\u8BE6\u60C5\uFF08\u542B\u63D0\u4EA4\u7248\u672C\u4E0E\u7EDF\u8BA1\uFF09",
+      capabilityRequired: "assignment:read",
+      inputSchema: {
+        type: "OBJECT",
+        properties: {
+          assignmentId: { type: "STRING" },
+          studentId: { type: "STRING", description: "\u9644\u5E26\u8BE5\u5B66\u751F\u7684\u63D0\u4EA4\u4E0E\u7248\u672C\u5386\u53F2" }
+        },
+        required: ["assignmentId"]
+      }
+    });
+    await commandBus.registerHandler("assignment.get", {
+      async execute(command) {
+        const { assignmentId, studentId } = command.payload;
+        const assignment = loadAssignment(assignmentId);
+        if (!assignment) throw new Error(`Assignment not found: ${assignmentId}`);
+        const submissions = db2.prepare("SELECT id, student_id, version, updated_at FROM plugin_submissions WHERE assignment_id = ?").all(assignmentId);
+        const grades = db2.prepare("SELECT submission_id, calculated_final_score, status FROM plugin_grades WHERE assignment_id = ?").all(assignmentId);
+        const gradedIds = new Set(grades.filter((g) => g.status === "confirmed").map((g) => g.submission_id));
+        const result = {
+          success: true,
+          assignment,
+          stats: {
+            submissionCount: submissions.length,
+            gradedCount: gradedIds.size,
+            pendingPeerReviews: db2.prepare("SELECT COUNT(*) AS c FROM plugin_peer_review_tasks WHERE assignment_id = ? AND status = 'pending'").get(assignmentId).c
+          }
+        };
+        if (studentId) {
+          const submission = db2.prepare("SELECT * FROM plugin_submissions WHERE assignment_id = ? AND student_id = ?").get(assignmentId, studentId);
+          if (submission) {
+            result.submission = submission;
+            result.versions = db2.prepare("SELECT * FROM plugin_submission_versions WHERE submission_id = ? ORDER BY version DESC").all(submission.id);
+            result.grade = db2.prepare("SELECT * FROM plugin_grades WHERE submission_id = ?").get(submission.id) || null;
+          } else {
+            result.submission = null;
+            result.versions = [];
+            result.grade = null;
+          }
+          result.myPeerReviewTasks = db2.prepare("SELECT * FROM plugin_peer_review_tasks WHERE assignment_id = ? AND reviewer_id = ?").all(assignmentId, studentId);
+          result.peerReviewTasks = buildPeerReviewTasks(assignmentId, studentId);
+        }
+        if (command.payload.includePeerProgress) {
+          result.peerProgress = buildPeerProgress(assignmentId);
+        }
+        return result;
+      }
+    });
     await actionRegistry.register({
       id: "eval-assignment-submit",
-      commandType: submitCmd,
-      description: "\u5B66\u751F\u63D0\u4EA4\u4F5C\u4E1A\u4F5C\u54C1\uFF0C\u652F\u6301\u591A\u6B21\u8986\u76D6\u4E0A\u4F20",
-      capabilityRequired: "lesson:write",
+      commandType: "assignment.submit",
+      description: "\u5B66\u751F\u63D0\u4EA4\u4F5C\u4E1A\u4F5C\u54C1\uFF0C\u652F\u6301\u591A\u6B21\u63D0\u4EA4\u5E76\u4FDD\u7559\u7248\u672C\u5386\u53F2",
+      capabilityRequired: "assignment:submit",
       inputSchema: {
         type: "OBJECT",
         properties: {
-          lessonId: { type: "STRING", description: "\u5173\u8054\u7684\u8BFE\u65F6 ID" },
+          assignmentId: { type: "STRING", description: "\u4F5C\u4E1A\u5B9E\u4F53 ID\uFF08\u63A8\u8350\uFF09" },
+          lessonId: { type: "STRING", description: "\u65E7\u7248\u8BFE\u65F6\u4F5C\u4E1A\u5165\u53E3\uFF1A\u4EC5\u4F20\u8BFE\u65F6 ID \u65F6\u81EA\u52A8\u5F52\u5C5E\u5230\u8BE5\u8BFE\u65F6\u7684\u4F5C\u4E1A" },
           studentId: { type: "STRING", description: "\u63D0\u4EA4\u4F5C\u54C1\u7684\u5B66\u751F ID" },
-          filePath: { type: "STRING", description: "\u6587\u4EF6\u76F8\u5BF9\u865A\u62DF\u6587\u4EF6\u7CFB\u7EDF\u7684\u5B58\u50A8\u8DEF\u5F84" }
+          filePath: { type: "STRING", description: "\u65E7\u7248\u517C\u5BB9\uFF1A\u6587\u672C\u5F62\u5F0F\u7684\u6587\u4EF6\u8DEF\u5F84\u63CF\u8FF0" },
+          fileIds: { type: "ARRAY", items: { type: "STRING" }, description: "\u5DF2\u4E0A\u4F20\u6587\u4EF6\u7684\u5143\u6570\u636E ID \u5217\u8868" },
+          textContent: { type: "STRING", description: "\u6587\u672C\u4F5C\u7B54\u5185\u5BB9" },
+          linkUrl: { type: "STRING", description: "\u94FE\u63A5\u4F5C\u7B54\u5185\u5BB9" }
         },
-        required: ["lessonId", "studentId", "filePath"]
+        required: ["studentId"]
       }
     });
-    await commandBus.registerHandler(submitCmd, {
+    await commandBus.registerHandler("assignment.submit", {
       async execute(command) {
-        const { lessonId, studentId, filePath } = command.payload;
-        if (!lessonId || !studentId || !filePath) {
-          throw new Error("Missing required params: lessonId, studentId, filePath");
+        const payload = command.payload;
+        const { studentId, textContent, linkUrl, filePath } = payload;
+        if (!studentId) {
+          throw new Error("Missing required params: studentId");
         }
-        const existing = db2.prepare("SELECT id, version FROM plugin_submissions WHERE lesson_id = ? AND student_id = ?").get(lessonId, studentId);
-        let submissionId;
-        let version = 1;
+        assertStudentOwnership(command.actorId, studentId, "submit");
+        const assignment = resolveAssignment(payload.assignmentId, payload.lessonId);
+        const now = Date.now();
+        const isLate = assignment.due_at !== null && now > Number(assignment.due_at) ? 1 : 0;
+        if (isLate && !assignment.allow_late) {
+          throw new Error("Access Denied: Assignment is closed (late submission is not allowed)");
+        }
+        if (textContent && !assignment.allow_text) {
+          throw new Error("Access Denied: Text answers are not allowed for this assignment");
+        }
+        if (linkUrl && !assignment.allow_link) {
+          throw new Error("Access Denied: Link answers are not allowed for this assignment");
+        }
+        const fileIds = Array.isArray(payload.fileIds) ? payload.fileIds.filter((f) => typeof f === "string") : [];
+        if (fileIds.length > Number(assignment.max_files)) {
+          throw new Error(`Access Denied: At most ${assignment.max_files} files are allowed`);
+        }
+        const existing = db2.prepare("SELECT id, version FROM plugin_submissions WHERE assignment_id = ? AND student_id = ?").get(assignment.id, studentId);
+        const submissionId = existing?.id || "sub-" + (0, import_uuid8.v7)();
+        const version = existing ? existing.version + 1 : 1;
+        const versionId = "sv-" + (0, import_uuid8.v7)();
         if (existing) {
-          submissionId = existing.id;
-          version = existing.version + 1;
-          db2.prepare("UPDATE plugin_submissions SET file_path = ?, version = ?, updated_at = ? WHERE id = ?").run(
-            filePath,
-            version,
-            Date.now(),
-            submissionId
-          );
+          db2.prepare(
+            "UPDATE plugin_submissions SET lesson_id = ?, file_path = ?, version = ?, updated_at = ? WHERE id = ?"
+          ).run(assignment.lesson_id ?? null, filePath ?? null, version, now, submissionId);
         } else {
-          submissionId = "sub-" + (0, import_uuid8.v7)();
           db2.prepare(
-            "INSERT INTO plugin_submissions (id, lesson_id, student_id, file_path, version, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)"
-          ).run(submissionId, lessonId, studentId, filePath, version, Date.now(), Date.now());
+            `INSERT INTO plugin_submissions (id, assignment_id, lesson_id, student_id, file_path, version, created_at, updated_at)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+          ).run(submissionId, assignment.id, assignment.lesson_id ?? null, studentId, filePath ?? null, version, now, now);
         }
-        return { success: true, submissionId, version };
+        if (fileIds.length > 0) {
+          const placeholders = fileIds.map(() => "?").join(", ");
+          db2.prepare(
+            `UPDATE plugin_assignment_files SET submission_id = ?, version_id = ?
+             WHERE assignment_id = ? AND student_id = ? AND id IN (${placeholders})`
+          ).run(submissionId, versionId, assignment.id, studentId, ...fileIds);
+        }
+        const attached = db2.prepare("SELECT id, original_name, size, mime FROM plugin_assignment_files WHERE version_id = ?").all(versionId);
+        const filesJson = JSON.stringify(
+          attached.length > 0 ? attached.map((f) => ({ fileId: f.id, name: f.original_name, size: f.size, mime: f.mime })) : filePath ? [{ name: String(filePath), path: String(filePath) }] : []
+        );
+        db2.prepare(
+          `INSERT INTO plugin_submission_versions
+             (id, submission_id, assignment_id, student_id, version, files_json, text_content, link_url, is_late, submitted_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+        ).run(versionId, submissionId, assignment.id, studentId, version, filesJson, textContent ?? null, linkUrl ?? null, isLate, now);
+        await publishEvent2(
+          "assignment.submitted",
+          {
+            assignmentId: assignment.id,
+            lessonId: assignment.lesson_id,
+            classId: assignment.class_id,
+            studentId,
+            submissionId,
+            version,
+            isLate: isLate === 1
+          },
+          command.id
+        );
+        return { success: true, submissionId, version, versionId, assignmentId: assignment.id, isLate: isLate === 1 };
       }
     });
-    const peerReviewCmd = "assignment.peer_review";
     await actionRegistry.register({
       id: "eval-assignment-peer-review",
-      commandType: peerReviewCmd,
-      description: "\u5B66\u751F\u5BF9\u540C\u5B66\u5DF2\u63D0\u4EA4\u7684\u4F5C\u4E1A\u4F5C\u54C1\u8FDB\u884C\u516C\u5F00\u4E92\u8BC4\u8BC4\u5206",
-      capabilityRequired: "lesson:read",
+      commandType: "assignment.peer_review",
+      description: "\u5B66\u751F\u5BF9\u5206\u914D\u5230\u7684\u540C\u5B66\u4F5C\u4E1A\u8FDB\u884C\u4E92\u8BC4\u8BC4\u5206",
+      capabilityRequired: "assignment:review",
       inputSchema: {
         type: "OBJECT",
         properties: {
           submissionId: { type: "STRING", description: "\u88AB\u8BC4\u4EF7\u7684\u4F5C\u4E1A\u63D0\u4EA4\u7269 ID" },
           reviewerId: { type: "STRING", description: "\u6267\u884C\u8BC4\u4EF7\u7684\u5B66\u751F ID" },
           score: { type: "INTEGER", description: "\u4E92\u8BC4\u5206\u6570 (0-100)" },
-          comment: { type: "STRING", description: "\u4E92\u8BC4\u610F\u89C1" }
+          comment: { type: "STRING", description: "\u4E92\u8BC4\u610F\u89C1" },
+          taskId: { type: "STRING", description: "\u4E92\u8BC4\u4EFB\u52A1 ID\uFF08\u5206\u914D\u5F0F\u4E92\u8BC4\u65F6\u63D0\u4F9B\uFF09" }
         },
         required: ["submissionId", "reviewerId", "score"]
       }
     });
-    await commandBus.registerHandler(peerReviewCmd, {
+    await commandBus.registerHandler("assignment.peer_review", {
       async execute(command) {
-        const { submissionId, reviewerId, score, comment } = command.payload;
+        const { submissionId, reviewerId, score, comment, taskId } = command.payload;
         if (!submissionId || !reviewerId || score === void 0) {
           throw new Error("Missing required params: submissionId, reviewerId, score");
         }
+        assertStudentOwnership(command.actorId, reviewerId, "review");
         const parsedScore = Math.round(Number(score));
         if (isNaN(parsedScore) || parsedScore < 0 || parsedScore > 100) {
           throw new Error("Access Denied: Score must be between 0 and 100");
         }
-        const submission = db2.prepare("SELECT student_id FROM plugin_submissions WHERE id = ?").get(submissionId);
+        const submission = db2.prepare("SELECT id, assignment_id, student_id FROM plugin_submissions WHERE id = ?").get(submissionId);
         if (!submission) {
           throw new Error(`Submission not found: ${submissionId}`);
         }
         if (submission.student_id === reviewerId) {
           throw new Error("Access Denied: Students are not allowed to evaluate their own assignments");
         }
+        const task = db2.prepare("SELECT id, due_at, status FROM plugin_peer_review_tasks WHERE submission_id = ? AND reviewer_id = ?").get(submissionId, reviewerId);
+        if (!task && submission.assignment_id) {
+          const taskCount = db2.prepare("SELECT COUNT(*) AS c FROM plugin_peer_review_tasks WHERE assignment_id = ?").get(submission.assignment_id).c;
+          if (taskCount > 0) {
+            throw new Error("Access Denied: This submission is not assigned to you for peer review");
+          }
+        }
+        const assignmentRow = submission.assignment_id ? loadAssignment(submission.assignment_id) : void 0;
+        const resolvedTaskId = taskId || task?.id || null;
+        const dueAt = task?.due_at ?? assignmentRow?.peer_review_due_at ?? null;
+        if (dueAt !== null && dueAt !== void 0 && Date.now() > Number(dueAt)) {
+          throw new Error("Access Denied: The peer review deadline has passed");
+        }
+        const now = Date.now();
         const reviewId = "rev-" + (0, import_uuid8.v7)();
         db2.prepare(
           `
-          INSERT INTO plugin_peer_reviews (id, submission_id, reviewer_id, score, comment, created_at)
-          VALUES (?, ?, ?, ?, ?, ?)
+          INSERT INTO plugin_peer_reviews
+            (id, submission_id, reviewer_id, score, comment, created_at, assignment_id, task_id, anonymous, status, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1, 'submitted', ?)
           ON CONFLICT(submission_id, reviewer_id) DO UPDATE SET
             score = excluded.score,
             comment = excluded.comment,
-            created_at = excluded.created_at
+            created_at = excluded.created_at,
+            assignment_id = excluded.assignment_id,
+            task_id = excluded.task_id,
+            status = 'submitted',
+            updated_at = excluded.updated_at
         `
-        ).run(reviewId, submissionId, reviewerId, parsedScore, comment || "", Date.now());
+        ).run(
+          reviewId,
+          submissionId,
+          reviewerId,
+          parsedScore,
+          comment || "",
+          now,
+          submission.assignment_id,
+          resolvedTaskId,
+          now
+        );
+        if (task) {
+          db2.prepare("UPDATE plugin_peer_review_tasks SET status = 'submitted' WHERE id = ?").run(task.id);
+        }
         return { success: true, reviewId };
       }
     });
-    const gradeCmd = "assignment.grade";
+    await actionRegistry.register({
+      id: "eval-assignment-assign-peer-reviews",
+      commandType: "assignment.assign_peer_reviews",
+      description: "\u4E3A\u4F5C\u4E1A\u7684\u6BCF\u4EFD\u63D0\u4EA4\u968F\u673A\u5206\u914D\u4E92\u8BC4\u4EBA\uFF08\u53CC\u76F2\uFF0C\u6392\u9664\u672C\u4EBA\uFF09",
+      capabilityRequired: "assignment:manage",
+      inputSchema: {
+        type: "OBJECT",
+        properties: {
+          assignmentId: { type: "STRING", description: "\u4F5C\u4E1A\u5B9E\u4F53 ID" },
+          reviewerCount: { type: "NUMBER", description: "\u6BCF\u4EFD\u63D0\u4EA4\u5206\u914D\u51E0\u540D\u4E92\u8BC4\u4EBA\uFF08\u9ED8\u8BA4\u53D6\u4F5C\u4E1A\u914D\u7F6E\uFF09" },
+          dueAt: { type: "NUMBER", description: "\u4E92\u8BC4\u622A\u6B62\u65F6\u95F4\uFF08\u6BEB\u79D2\u65F6\u95F4\u6233\uFF09" }
+        },
+        required: ["assignmentId"]
+      }
+    });
+    await commandBus.registerHandler("assignment.assign_peer_reviews", {
+      async execute(command) {
+        const { assignmentId, dueAt } = command.payload;
+        const assignment = loadAssignment(assignmentId);
+        if (!assignment) throw new Error(`Assignment not found: ${assignmentId}`);
+        const reviewerCount = Math.max(1, Math.min(10, Number(command.payload.reviewerCount ?? assignment.peer_review_count) || 1));
+        const submissions = db2.prepare("SELECT id, student_id FROM plugin_submissions WHERE assignment_id = ? ORDER BY created_at ASC").all(assignmentId);
+        const pools = /* @__PURE__ */ new Map();
+        let created = 0;
+        const now = Date.now();
+        for (const submission of submissions) {
+          const candidates = submissions.filter((s) => s.student_id !== submission.student_id);
+          if (candidates.length === 0) continue;
+          candidates.sort((a, b) => (pools.get(a.student_id) || 0) - (pools.get(b.student_id) || 0));
+          const picked = candidates.slice(0, Math.min(reviewerCount, candidates.length));
+          for (const candidate of picked) {
+            const taskId = "prt-" + (0, import_uuid8.v7)();
+            const result = db2.prepare(
+              `INSERT INTO plugin_peer_review_tasks
+                   (id, assignment_id, submission_id, reviewer_id, anonymous, status, due_at, created_at)
+                 VALUES (?, ?, ?, ?, 1, 'pending', ?, ?)
+                 ON CONFLICT(submission_id, reviewer_id) DO NOTHING`
+            ).run(taskId, assignmentId, submission.id, candidate.student_id, dueAt ?? assignment.peer_review_due_at ?? null, now);
+            if (result.changes > 0) {
+              created += 1;
+              pools.set(candidate.student_id, (pools.get(candidate.student_id) || 0) + 1);
+            }
+          }
+        }
+        if (dueAt !== void 0 && dueAt !== null) {
+          db2.prepare("UPDATE plugin_assignments SET peer_review_due_at = ?, updated_at = ? WHERE id = ?").run(
+            Number(dueAt),
+            now,
+            assignmentId
+          );
+        }
+        return { success: true, created, submissions: submissions.length };
+      }
+    });
     await actionRegistry.register({
       id: "eval-assignment-grade",
-      commandType: gradeCmd,
+      commandType: "assignment.grade",
       description: "\u6559\u5E08\u5BF9\u5DF2\u63D0\u4EA4\u7684\u4F5C\u4E1A\u8FDB\u884C\u7EC8\u8BC4\u6253\u5206\uFF0C\u5E76\u53EF\u52A8\u6001\u8BBE\u5B9A\u6298\u7B97\u6743\u91CD\u4E0E\u53D1\u5E03\u6210\u7EE9",
-      capabilityRequired: "lesson:write",
+      capabilityRequired: "assignment:manage",
       inputSchema: {
         type: "OBJECT",
         properties: {
           submissionId: { type: "STRING", description: "\u88AB\u8BC4\u4EF7\u7684\u4F5C\u4E1A\u63D0\u4EA4\u7269 ID" },
           teacherScore: { type: "INTEGER", description: "\u6559\u5E08\u7ED9\u51FA\u7684\u5E73\u65F6\u5206 (0-100)" },
           teacherComment: { type: "STRING", description: "\u6559\u5E08\u8BC4\u8BED\u53CD\u9988" },
-          teacherWeight: { type: "NUMBER", description: "\u6559\u5E08\u6253\u5206\u6743\u91CD (\u9ED8\u8BA4 0.6)" },
-          peerWeight: { type: "NUMBER", description: "\u5B66\u751F\u4E92\u8BC4\u5E73\u5747\u5206\u6743\u91CD (\u9ED8\u8BA4 0.4)" },
+          teacherWeight: { type: "NUMBER", description: "\u6559\u5E08\u6253\u5206\u6743\u91CD (\u9ED8\u8BA4\u53D6\u4F5C\u4E1A\u914D\u7F6E)" },
+          peerWeight: { type: "NUMBER", description: "\u5B66\u751F\u4E92\u8BC4\u5E73\u5747\u5206\u6743\u91CD (\u9ED8\u8BA4\u53D6\u4F5C\u4E1A\u914D\u7F6E)" },
           status: { type: "STRING", description: "\u72B6\u6001\uFF0Cconfirmed \u4E3A\u786E\u8BA4\u5E76\u540C\u6B65\uFF0Cdraft \u4E3A\u8349\u7A3F" }
         },
         required: ["submissionId", "teacherScore"]
       }
     });
-    await commandBus.registerHandler(gradeCmd, {
+    await commandBus.registerHandler("assignment.grade", {
       async execute(command) {
-        const {
-          submissionId,
-          teacherScore,
-          teacherComment,
-          teacherWeight = 0.6,
-          peerWeight = 0.4,
-          status = "draft"
-        } = command.payload;
+        const payload = command.payload;
+        const { submissionId, teacherScore, teacherComment, status = "draft" } = payload;
         if (!submissionId || teacherScore === void 0) {
           throw new Error("Missing required params: submissionId, teacherScore");
         }
@@ -8446,29 +10009,34 @@ var AssignmentEvalPlugin = {
         if (isNaN(parsedTeacherScore) || parsedTeacherScore < 0 || parsedTeacherScore > 100) {
           throw new Error("Access Denied: Teacher score must be between 0 and 100");
         }
-        const totalWeight = Number(teacherWeight) + Number(peerWeight);
-        if (Math.abs(totalWeight - 1) > 1e-3) {
-          throw new Error("Access Denied: The sum of teacherWeight and peerWeight must equal 1.0");
-        }
-        const submission = db2.prepare("SELECT lesson_id, student_id FROM plugin_submissions WHERE id = ?").get(submissionId);
+        const submission = db2.prepare("SELECT id, assignment_id, lesson_id, student_id FROM plugin_submissions WHERE id = ?").get(submissionId);
         if (!submission) {
           throw new Error(`Submission not found: ${submissionId}`);
         }
+        const assignment = submission.assignment_id ? loadAssignment(submission.assignment_id) : void 0;
+        const teacherWeight = payload.teacherWeight === void 0 ? Number(assignment?.teacher_weight ?? 0.6) : Number(payload.teacherWeight);
+        const peerWeight = payload.peerWeight === void 0 ? Number(assignment?.peer_weight ?? 0.4) : Number(payload.peerWeight);
+        const totalWeight = teacherWeight + peerWeight;
+        if (Math.abs(totalWeight - 1) > 1e-3) {
+          throw new Error("Access Denied: The sum of teacherWeight and peerWeight must equal 1.0");
+        }
         const reviews = db2.prepare("SELECT score FROM plugin_peer_reviews WHERE submission_id = ?").all(submissionId);
-        let peerAverageScore = 0;
+        let peerAverageScore = null;
         let calculatedFinalScore = parsedTeacherScore;
         if (reviews.length > 0) {
           const sum = reviews.reduce((acc, r) => acc + r.score, 0);
           peerAverageScore = sum / reviews.length;
           calculatedFinalScore = Math.round(parsedTeacherScore * teacherWeight + peerAverageScore * peerWeight);
         }
+        const now = Date.now();
         const gradeId = "grd-" + (0, import_uuid8.v7)();
         db2.prepare(
           `
           INSERT INTO plugin_grades (
-            id, submission_id, teacher_score, teacher_comment, teacher_weight, peer_weight, calculated_final_score, status, graded_at
+            id, submission_id, teacher_score, teacher_comment, teacher_weight, peer_weight,
+            calculated_final_score, status, graded_at, assignment_id, peer_average_score, source, published_at, graded_by
           )
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'teacher', ?, ?)
           ON CONFLICT(submission_id) DO UPDATE SET
             teacher_score = excluded.teacher_score,
             teacher_comment = excluded.teacher_comment,
@@ -8476,7 +10044,11 @@ var AssignmentEvalPlugin = {
             peer_weight = excluded.peer_weight,
             calculated_final_score = excluded.calculated_final_score,
             status = excluded.status,
-            graded_at = excluded.graded_at
+            graded_at = excluded.graded_at,
+            assignment_id = excluded.assignment_id,
+            peer_average_score = excluded.peer_average_score,
+            published_at = excluded.published_at,
+            graded_by = excluded.graded_by
         `
         ).run(
           gradeId,
@@ -8487,12 +10059,74 @@ var AssignmentEvalPlugin = {
           peerWeight,
           calculatedFinalScore,
           status,
-          Date.now()
+          now,
+          submission.assignment_id,
+          peerAverageScore,
+          status === "confirmed" ? now : null,
+          actorUserId(command.actorId)
         );
         if (status === "confirmed") {
-          await gradeService.saveSemesterGrade(submission.lesson_id, submission.student_id, calculatedFinalScore);
+          let projectedByHost = false;
+          if (submission.lesson_id) {
+            try {
+              await gradeService.saveSemesterGrade(submission.lesson_id, submission.student_id, calculatedFinalScore);
+              projectedByHost = true;
+            } catch (err) {
+              ctx.log?.warn?.(`[assignment-eval] \u540C\u6B65\u5B66\u671F\u6210\u7EE9\u5931\u8D25: ${err?.message}`);
+            }
+          }
+          if (!projectedByHost && assignment && assignment.class_id) {
+            db2.prepare(
+              `INSERT INTO assignments (id, class_id, lesson_id, title, description, content, created_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?)
+               ON CONFLICT(id) DO UPDATE SET
+                 class_id = excluded.class_id,
+                 lesson_id = excluded.lesson_id,
+                 title = excluded.title,
+                 description = excluded.description`
+            ).run(assignment.id, assignment.class_id, assignment.lesson_id, assignment.title, "", "", now);
+            db2.prepare(
+              `INSERT INTO assignment_submissions
+                 (assignment_id, student_id, content, score, feedback, submitted_at, graded_at, status)
+               VALUES (?, ?, ?, ?, ?, ?, ?, 'graded')
+               ON CONFLICT(assignment_id, student_id) DO UPDATE SET
+                 score = excluded.score,
+                 feedback = excluded.feedback,
+                 graded_at = excluded.graded_at,
+                 status = 'graded'`
+            ).run(
+              assignment.id,
+              submission.student_id,
+              "",
+              calculatedFinalScore,
+              teacherComment || "",
+              now,
+              now
+            );
+          }
+          await publishEvent2(
+            "assignment.graded",
+            {
+              assignmentId: submission.assignment_id,
+              lessonId: submission.lesson_id,
+              studentId: submission.student_id,
+              submissionId,
+              score: calculatedFinalScore,
+              teacherScore: parsedTeacherScore,
+              peerAverageScore,
+              feedback: teacherComment || ""
+            },
+            command.id
+          );
         }
-        return { success: true, calculatedFinalScore };
+        return {
+          success: true,
+          calculatedFinalScore,
+          peerAverageScore,
+          teacherWeight,
+          peerWeight,
+          status
+        };
       }
     });
   },
@@ -8775,6 +10409,9 @@ var AuthSessionBridgeService = class {
   }
 };
 
+// packages/core/kernel/index.ts
+init_courseware_runtime_script_registry();
+
 // packages/core/plugin-host/index.ts
 var import_uuid13 = require("uuid");
 var import_fs5 = __toESM(require("fs"), 1);
@@ -8782,7 +10419,7 @@ var import_jszip2 = __toESM(require("jszip"), 1);
 var import_path4 = __toESM(require("path"), 1);
 var import_express = __toESM(require("express"), 1);
 var import_node_module = require("node:module");
-var import_node_url = require("node:url");
+var import_node_url2 = require("node:url");
 
 // packages/core/esm-loader/install-utils.ts
 var import_jszip = __toESM(require("jszip"), 1);
@@ -8867,7 +10504,19 @@ async function validateAndBundleZip(zipBuffer) {
   const rawManifest = JSON.parse(manifestJson);
   rawManifest.main ||= "index.js";
   const manifest = manifestSchema.parse(rawManifest);
-  const entryFile = zip.file(manifest.main);
+  let entryFile = zip.file(manifest.main);
+  let resolvedMain = manifest.main;
+  if (!entryFile && manifest.main.startsWith("dist/")) {
+    const fallback = manifest.main.slice("dist/".length);
+    const fallbackEntry = zip.file(fallback);
+    if (fallbackEntry) {
+      console.warn(
+        `[install-utils] manifest.main "${manifest.main}" not found in ZIP; falling back to "${fallback}". Plugin author should update build script to drop the dist/ prefix.`
+      );
+      entryFile = fallbackEntry;
+      resolvedMain = fallback;
+    }
+  }
   if (!entryFile) {
     throw new Error(`Entry file "${manifest.main}" specified in manifest not found in ZIP package`);
   }
@@ -8884,7 +10533,7 @@ async function validateAndBundleZip(zipBuffer) {
       fs4.writeFileSync(filePath, content);
     }
     const bundledCode = await bundlePlugin(entryCode, tmpDir);
-    return { manifest, bundledCode, entryFileName: manifest.main };
+    return { manifest, bundledCode, entryFileName: resolvedMain };
   } finally {
     try {
       fs4.rmSync(tmpDir, { recursive: true, force: true });
@@ -9350,7 +10999,34 @@ var HotReloadActivationError = class extends HotReloadError {
 init_interfaces();
 
 // packages/core/version.ts
-var PLATFORM_VERSION = "0.3.18";
+var import_node_fs3 = __toESM(require("node:fs"), 1);
+var import_node_path3 = __toESM(require("node:path"), 1);
+var import_node_url = require("node:url");
+var import_meta2 = {};
+var FALLBACK_VERSION = "0.3.21";
+function readPlatformVersion() {
+  const bases = [];
+  if (typeof __dirname !== "undefined") bases.push(__dirname);
+  try {
+    bases.push(import_node_path3.default.dirname((0, import_node_url.fileURLToPath)(import_meta2.url)));
+  } catch {
+  }
+  for (const base of bases) {
+    let dir = base;
+    for (; ; ) {
+      try {
+        const pkg = JSON.parse(import_node_fs3.default.readFileSync(import_node_path3.default.join(dir, "package.json"), "utf-8"));
+        if (pkg.name === "openlearn-next" && typeof pkg.version === "string") return pkg.version;
+      } catch {
+      }
+      const parent = import_node_path3.default.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  return FALLBACK_VERSION;
+}
+var PLATFORM_VERSION = readPlatformVersion();
 var OPENLEARN_VERSION = PLATFORM_VERSION;
 
 // packages/core/plugin-host/plugin-runtime-composition.ts
@@ -9655,11 +11331,11 @@ var PluginDistributionManager = class {
       return;
     }
     const filePath = this.pluginHost.getPluginFilePath(this.pluginHost.resolvePluginUuid(pluginId));
-    const fs16 = await import("node:fs");
-    if (!fs16.existsSync(filePath)) {
+    const fs18 = await import("node:fs");
+    if (!fs18.existsSync(filePath)) {
       throw new Error(`Cannot reload plugin "${pluginId}": source file missing at ${filePath}`);
     }
-    const code = fs16.readFileSync(filePath, "utf-8");
+    const code = fs18.readFileSync(filePath, "utf-8");
     await this.pluginHost.reloadPlugin(pluginId, code);
   }
   async updateFromZip(zipBuffer, options = {}) {
@@ -9689,7 +11365,7 @@ var PluginDistributionManager = class {
 
 // packages/core/plugin-host/index.ts
 init_http_router();
-var import_meta2 = {};
+var import_meta3 = {};
 var VALID_TRANSITIONS = {
   ["installed" /* INSTALLED */]: ["activating" /* ACTIVATING */, "uninstalled" /* UNINSTALLED */],
   ["activating" /* ACTIVATING */]: ["active" /* ACTIVE */, "error" /* ERROR */],
@@ -9724,7 +11400,7 @@ function resolveHostSdkDir() {
   const bases = [];
   if (typeof __dirname !== "undefined") bases.push(__dirname);
   try {
-    bases.push(import_path4.default.dirname((0, import_node_url.fileURLToPath)(import_meta2.url)));
+    bases.push(import_path4.default.dirname((0, import_node_url2.fileURLToPath)(import_meta3.url)));
   } catch {
   }
   for (const base of bases) {
@@ -9883,7 +11559,7 @@ var PluginHost = class {
   /**
    * 判断指定插件的某个请求路径是否为流式路由 (SSE)
    */
-  isStreamRoute(pluginIdOrManifestId, method, path21) {
+  isStreamRoute(pluginIdOrManifestId, method, path24) {
     const upperMethod = method.toUpperCase();
     const resolvedId = this.resolvePluginUuid(pluginIdOrManifestId);
     const instance = this.pluginInstances.get(resolvedId) ?? this.pluginInstances.get(pluginIdOrManifestId);
@@ -9892,7 +11568,7 @@ var PluginHost = class {
       for (const r of manifest.api.routes) {
         if (r.method.toUpperCase() === upperMethod && r.streaming === true) {
           const compiled = compileRoutePattern(r.path);
-          if (compiled.regex.test(path21)) {
+          if (compiled.regex.test(path24)) {
             return true;
           }
         }
@@ -9900,14 +11576,14 @@ var PluginHost = class {
     }
     if (!instance) return false;
     if (instance.context?.http) {
-      return instance.context.http.isStream(upperMethod, path21);
+      return instance.context.http.isStream(upperMethod, path24);
     }
     if (instance.workerRef) {
       const routes = instance.workerRef.serviceHost.getRegisteredRoutes();
       for (const r of routes) {
         if (r.method === upperMethod && r.isStream) {
           const compiled = compileRoutePattern(r.pattern);
-          if (compiled.regex.test(path21)) {
+          if (compiled.regex.test(path24)) {
             return true;
           }
         }
@@ -10550,7 +12226,7 @@ var PluginHost = class {
       let mod;
       if (process.env.NODE_ENV !== "test" && row.file_path && import_fs5.default.existsSync(row.file_path)) {
         this.ensureHostSdkResolution();
-        const fileUrl = (0, import_node_url.pathToFileURL)(row.file_path);
+        const fileUrl = (0, import_node_url2.pathToFileURL)(row.file_path);
         mod = await import(`${fileUrl.href}?t=${Date.now()}`);
       } else {
         let sourceCode = "";
@@ -10885,6 +12561,7 @@ var PluginHost = class {
     } catch (termErr) {
       console.error(`[PluginHost] Worker termination error for "${pluginId}":`, termErr);
     } finally {
+      this.resourceTracker.disposeAll(pluginId);
       this.pluginStates.set(pluginId, "inactive" /* INACTIVE */);
       this.pluginInstances.delete(pluginId);
       this.db.prepare("UPDATE plugins SET status = ? WHERE id = ?").run("inactive", pluginId);
@@ -10971,6 +12648,7 @@ var PluginHost = class {
         await this.deactivatePlugin(pluginId);
       }
     }
+    this.resourceTracker.disposeAll(pluginId);
     const state = this.pluginStates.get(pluginId) ?? "installed" /* INSTALLED */;
     const row = this.db.prepare("SELECT manifest, file_path FROM plugins WHERE id = ?").get(pluginId);
     if (state === "uninstalled" /* UNINSTALLED */ && !row) {
@@ -11004,6 +12682,12 @@ var PluginHost = class {
     } catch (e) {
       console.warn(`[PluginHost] Failed to drop plugin tables for "${pluginId}":`, e);
     }
+    try {
+      const capService = await this.serviceRegistry.resolve(ICapabilityServiceToken);
+      await capService.revokeAll(`plugin:${manifestId}`);
+    } catch (capErr) {
+      console.warn(`[PluginHost] Failed to revoke capabilities for "${pluginId}":`, capErr);
+    }
     if (this.expressApp && this._registeredRoutes.has(manifestId)) {
       try {
         const route = this._registeredRoutes.get(manifestId);
@@ -11159,8 +12843,8 @@ var PluginHost = class {
             dependencies: manifest.dependencies
           };
           import_fs5.default.writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2), "utf-8");
-          const { execSync: execSync2 } = await import("node:child_process");
-          execSync2(
+          const { execSync } = await import("node:child_process");
+          execSync(
             "npm install --production --no-audit --no-fund --legacy-peer-deps --ignore-scripts --registry=https://registry.npmmirror.com",
             {
               cwd: pluginDir,
@@ -11186,8 +12870,8 @@ var PluginHost = class {
           if (import_fs5.default.existsSync(deployScriptPath)) {
             console.log(`[PluginHost] Running deploy script: node ${deployScriptPath}`);
             try {
-              const { execSync: execSync2 } = await import("node:child_process");
-              execSync2(`node "${deployScriptPath}" "${process.cwd()}"`, { timeout: 12e4 });
+              const { execSync } = await import("node:child_process");
+              execSync(`node "${deployScriptPath}" "${process.cwd()}"`, { timeout: 12e4 });
               console.log(`[PluginHost] Deploy script completed for plugin "${manifest.id}"`);
             } catch (deployErr) {
               console.error(`[PluginHost] Deploy script failed for plugin "${manifest.id}":`, deployErr.message);
@@ -11408,8 +13092,8 @@ var PluginHost = class {
             ),
             "utf-8"
           );
-          const { execSync: execSync2 } = await import("node:child_process");
-          execSync2(
+          const { execSync } = await import("node:child_process");
+          execSync(
             "npm install --production --no-audit --no-fund --legacy-peer-deps --registry=https://registry.npmmirror.com",
             {
               cwd: pluginDir,
@@ -11917,8 +13601,8 @@ var HotReloadController = class {
     const timer = setTimeout(async () => {
       this.debounceTimers.delete(pluginId);
       try {
-        const fs16 = await import("fs/promises");
-        const newSourceCode = await fs16.readFile(filePath, "utf-8");
+        const fs18 = await import("fs/promises");
+        const newSourceCode = await fs18.readFile(filePath, "utf-8");
         console.log(`[HotReload] File changed: ${filePath} \u2192 triggering reload for "${pluginId}"`);
         await this.pluginHost.reloadPlugin(pluginId, newSourceCode);
       } catch (err) {
@@ -18358,6 +20042,7 @@ var Kernel = class {
       getServiceRegistryKernel: async () => this.platformServiceRegistryKernel
     });
     this.serviceRegistry.register(IAuthSessionBridgeToken, new AuthSessionBridgeService(this.db));
+    this.serviceRegistry.register(ICoursewareRuntimeScriptRegistryToken, new CoursewareRuntimeScriptRegistry());
     this.commandBus.setInterceptor(async (command) => {
       const action = this.actionRegistry.getActionByCommandType(command.type);
       if (action) {
@@ -18840,6 +20525,43 @@ function setupPresence({ io, eventBus, lookupStudentClassIds }) {
         }
       }
     );
+    socket.on(
+      "student-client-error",
+      (data) => {
+        if (!data || !data.studentId || !data.error) return;
+        if (session && !isTeacherOrAdmin && session.userId !== data.studentId) {
+          console.warn(`[Presence Security] Student ${session.userId} attempted to report error as ${data.studentId}`);
+          return;
+        }
+        const studentName = data.studentName || onlineStudents.get(data.studentId)?.name || data.studentId;
+        const lessonId = data.lessonId || activeStudentLessons.get(data.studentId) || null;
+        const classId = data.classId || null;
+        console.warn(
+          `[Client Diagnostics] Student ${data.studentId} (${studentName}) reported error [${data.error.type || "runtime"}]: ${data.error.message || data.error.title} (Lesson: ${lessonId || "N/A"})`
+        );
+        eventBus.publish({
+          id: `evt_err_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`,
+          type: "student.client_error",
+          source: "student_client",
+          payload: {
+            studentId: data.studentId,
+            studentName,
+            lessonId,
+            classId,
+            error: data.error
+          },
+          timestamp: data.error.timestamp || Date.now(),
+          correlationId: lessonId || void 0
+        });
+        io.emit("student-error-alert", {
+          studentId: data.studentId,
+          studentName,
+          lessonId,
+          classId,
+          error: data.error
+        });
+      }
+    );
     socket.on(
       "teacher-broadcast-fullscreen",
       (data) => {
@@ -19311,6 +21033,7 @@ var runOpenAIAgentChat = async (provider, request) => {
 };
 
 // server/middleware/auth.ts
+var SESSION_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
 function getValidSession(token) {
   let sessionRow;
   try {
@@ -19329,11 +21052,21 @@ function getValidSession(token) {
     kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
     return null;
   }
-  kernelContainer.db.prepare("UPDATE client_sessions SET updated_at = ? WHERE id = ?").run(now, token);
-  const session = JSON.parse(sessionRow.session_data);
+  if (!sessionRow.updated_at || now - sessionRow.updated_at > SESSION_REFRESH_INTERVAL_MS) {
+    kernelContainer.db.prepare("UPDATE client_sessions SET updated_at = ? WHERE id = ?").run(now, token);
+  }
+  let session;
+  try {
+    session = JSON.parse(sessionRow.session_data);
+  } catch {
+    return null;
+  }
   if (session && !session.userId && session.studentId) {
     session.userId = session.studentId;
   }
+  if (session.role && !["teacher", "student", "administrator", "admin"].includes(session.role)) {
+    session.role = "anonymous";
+  }
   return session;
 }
 function getCookieToken(req) {
@@ -19358,8 +21091,10 @@ function getActorId(req) {
     if (session.username === "admin" || session.userId === "usr_admin" || role === "admin" || role === "administrator") {
       role = "administrator";
     }
+    const rawUserId = session.userId || session.studentId || "demo";
+    const safeUserId = String(rawUserId).replace(/[:\s]/g, "_").slice(0, 64);
     if (role) {
-      return `user:${session.userId || session.studentId || "demo"}:${role}`;
+      return `user:${safeUserId}:${role}`;
     }
     return "anonymous";
   } catch {
@@ -19905,6 +21640,7 @@ function detectPromptInjection(input) {
 // server/routes/shared.ts
 var import_path7 = __toESM(require("path"), 1);
 var import_crypto5 = __toESM(require("crypto"), 1);
+init_interfaces();
 
 // server/utils/bridge-sdk.ts
 var BRIDGE_SDK_CODE = `(function() {
@@ -20684,7 +22420,7 @@ var BRIDGE_SDK_CODE = `(function() {
 
 // server/routes/shared.ts
 function validateMagicBytes(buffer, fileName) {
-  const MAGIC_BYTES = {
+  const MAGIC_BYTES2 = {
     ".pdf": [[37, 80, 68, 70]],
     // %PDF
     ".pptx": [[80, 75, 3, 4]],
@@ -20700,11 +22436,34 @@ function validateMagicBytes(buffer, fileName) {
     // RIFF
   };
   const ext = import_path7.default.extname(fileName || "").toLowerCase();
-  const signatures = MAGIC_BYTES[ext];
+  const signatures = MAGIC_BYTES2[ext];
   if (!signatures) return true;
   return signatures.some((sig) => sig.every((byte, i) => buffer[i] === byte));
 }
 var BLOCKED_EXTENSIONS = [".exe", ".sh", ".bat", ".cmd", ".dll", ".so", ".dylib", ".scr", ".msi", ".ps1"];
+function collectCoursewareRuntimeScripts(cwInfo) {
+  const empty = { head: "", bodyEnd: "" };
+  try {
+    const registry = kernelContainer?.serviceRegistry?.resolve?.(ICoursewareRuntimeScriptRegistryToken);
+    if (!registry || typeof registry.list !== "function") return empty;
+    const scripts = registry.list({ id: cwInfo.id, uuid: cwInfo.uuid }) || [];
+    if (!scripts.length) return empty;
+    let head = "";
+    let bodyEnd = "";
+    for (const script of scripts) {
+      if (!script || typeof script.source !== "string" || !script.source.trim()) continue;
+      const tag = `
+<!-- Courseware Runtime Script (${script.owner}/${script.id}) -->
+<script>${script.source}</script>`;
+      if (script.position === "head") head += tag;
+      else bodyEnd += tag;
+    }
+    return { head, bodyEnd };
+  } catch (err) {
+    console.warn("[injectLmsSdk] \u8BFB\u53D6\u8BFE\u4EF6\u8FD0\u884C\u65F6\u811A\u672C\u6269\u5C55\u70B9\u5931\u8D25\uFF08\u5DF2\u5FFD\u7565\uFF09:", err.message);
+    return empty;
+  }
+}
 function injectLmsSdk(htmlContent, req, cwInfo) {
   const token = getCookieToken(req);
   let studentInfo = {
@@ -20762,6 +22521,7 @@ function injectLmsSdk(htmlContent, req, cwInfo) {
     }
     studentInfo.attempt_id = attempt.id;
   }
+  const runtimeScripts = collectCoursewareRuntimeScripts(cwInfo);
   const injection = `
 <!-- LMS Courseware SDK Inject -->
 <script>
@@ -20771,7 +22531,7 @@ window.__LMS_COURSEWARE__ = {
   name: ${JSON.stringify(cwInfo.name)}
 };
 </script>
-<script>${BRIDGE_SDK_CODE}</script>
+<script>${BRIDGE_SDK_CODE}</script>${runtimeScripts.head}
 `;
   let html = htmlContent;
   html = html.replace(
@@ -20799,6 +22559,13 @@ window.__LMS_COURSEWARE__ = {
   } else {
     html = injection + html;
   }
+  if (runtimeScripts.bodyEnd) {
+    if (/<\/body>/i.test(html)) {
+      html = html.replace(/<\/body>/i, `${runtimeScripts.bodyEnd}</body>`);
+    } else {
+      html += runtimeScripts.bodyEnd;
+    }
+  }
   return html;
 }
 var generateStudentNumber = (db2) => {
@@ -21123,7 +22890,7 @@ var import_path9 = __toESM(require("path"), 1);
 var import_fs9 = __toESM(require("fs"), 1);
 function registerResourcesRoutes(ctx) {
   const { app } = ctx;
-  app.get("/api/resources", (req, res) => {
+  app.get("/api/resources", requireAuth(), (req, res) => {
     try {
       const resources = kernelContainer.db.prepare("SELECT id, name, type, created_at FROM system_resources ORDER BY created_at DESC").all();
       res.json(resources);
@@ -21131,7 +22898,7 @@ function registerResourcesRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/resources/:id", (req, res) => {
+  app.get("/api/resources/:id", requireAuth(), (req, res) => {
     try {
       const resource = kernelContainer.db.prepare("SELECT * FROM system_resources WHERE id = ?").get(req.params.id);
       if (!resource) return res.status(404).send("Resource not found");
@@ -21231,7 +22998,7 @@ function registerResourcesRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/resources/:id/*", (req, res) => {
+  app.get("/api/resources/:id/*", requireAuth(), (req, res) => {
     try {
       const resource = kernelContainer.db.prepare("SELECT * FROM system_resources WHERE id = ?").get(req.params.id);
       if (!resource) return res.status(404).send("Resource not found");
@@ -21463,7 +23230,7 @@ function registerCoursewareRoutes(ctx) {
   app.get("/api/courseware", requireAuth(), async (req, res) => {
     try {
       const actorId = getActorId(req) || "system";
-      const cmd = kernelContainer.commandBus.createCommand("courseware.list", {}, actorId);
+      const cmd = kernelContainer.commandBus.createCommand("courseware.list", {}, actorId, { silent: true });
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
     } catch (e) {
@@ -21586,13 +23353,21 @@ function registerCoursewareRoutes(ctx) {
         "INSERT INTO submission_raw (id, attempt_id, event_type, payload_json, created_at) VALUES (?, ?, ?, ?, ?)"
       ).run(rawId, attemptId, eventType, JSON.stringify(payload), Date.now());
       const extracted = extractScoreCommentCompletion(payload);
-      const score = extracted.score;
       const comment = extracted.comment;
       const completion = extracted.completion;
-      if (score !== void 0 || comment !== void 0 || completion !== void 0) {
+      let aggregatedScore = null;
+      let aggregationExtra = {};
+      try {
+        const aggregation = aggregateAttemptScore(kernelContainer.db, attemptId);
+        if (aggregation.finalScore !== null) aggregatedScore = aggregation.finalScore;
+        aggregationExtra = { score_aggregation: describeAggregation(aggregation) };
+      } catch (aggErr) {
+        console.warn("[courseware.log] score aggregation failed, fallback to latest score:", aggErr);
+      }
+      if (aggregatedScore !== null || comment !== void 0 || completion !== void 0) {
         let parsedScore = null;
-        if (score !== void 0 && score !== null) {
-          const num = parseFloat(score);
+        if (extracted.score !== void 0 && extracted.score !== null) {
+          const num = parseFloat(extracted.score);
           if (!isNaN(num)) {
             parsedScore = num;
           }
@@ -21611,13 +23386,16 @@ function registerCoursewareRoutes(ctx) {
           ).run(
             "res_" + import_crypto8.default.randomBytes(8).toString("hex"),
             attemptId,
-            parsedScore,
+            aggregatedScore !== null ? aggregatedScore : parsedScore,
             comment || null,
             parsedCompletion,
-            JSON.stringify(payload)
+            JSON.stringify({
+              ...payload && typeof payload === "object" ? payload : {},
+              ...aggregationExtra
+            })
           );
         } else {
-          const finalScore = parsedScore !== null ? parsedScore : existing.score;
+          const finalScore = aggregatedScore !== null ? aggregatedScore : parsedScore !== null ? parsedScore : existing.score;
           const finalComment = comment || existing.comment;
           const finalCompletion = parsedCompletion !== null ? parsedCompletion : existing.completion;
           let mergedExtra = {};
@@ -21628,6 +23406,7 @@ function registerCoursewareRoutes(ctx) {
           if (payload && typeof payload === "object") {
             mergedExtra = { ...mergedExtra, ...payload };
           }
+          mergedExtra = { ...mergedExtra, ...aggregationExtra };
           kernelContainer.db.prepare(
             "UPDATE submission_result SET score = ?, comment = ?, completion = ?, extra_json = ? WHERE attempt_id = ?"
           ).run(finalScore, finalComment, finalCompletion, JSON.stringify(mergedExtra), attemptId);
@@ -21680,17 +23459,17 @@ function registerCoursewareRoutes(ctx) {
           parsedCompletion = num;
         }
       }
-      const actorId = session.userId || getActorId(req) || "student";
+      const normalizedActorId = getActorId(req);
+      const actorId = normalizedActorId && normalizedActorId !== "anonymous" ? normalizedActorId : `user:${session.userId || session.studentId || "student"}:${session.role || "student"}`;
+      const payload = { attemptId };
+      if (parsedScore !== null) payload.score = parsedScore;
+      if (parsedCompletion !== null) payload.completion = parsedCompletion;
+      if (comment !== void 0 && comment !== null) payload.comment = comment;
+      if (status !== void 0 && status !== null) payload.status = status;
+      if (extra && typeof extra === "object" && !Array.isArray(extra)) payload.extra = extra;
       const cmd = kernelContainer.commandBus.createCommand(
         "courseware.submit_attempt",
-        {
-          attemptId,
-          score: parsedScore,
-          comment,
-          completion: parsedCompletion,
-          status,
-          extra
-        },
+        payload,
         actorId
       );
       const result = await kernelContainer.commandBus.execute(cmd);
@@ -21700,11 +23479,65 @@ function registerCoursewareRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/courseware/attempts", (req, res) => {
+  app.post("/api/courseware/attempts/:attemptId/adopt", (req, res) => {
     try {
-      const rows = kernelContainer.db.prepare(
-        `
-        SELECT a.id as attemptId, a.started_at, a.finished_at, a.status, 
+      const { attemptId } = req.params;
+      const token = getCookieToken(req);
+      const session = req.session || (token ? getValidSession(token) : null);
+      if (!session) {
+        return res.status(401).json({ error: "Authentication required to adopt an attempt" });
+      }
+      const db2 = kernelContainer.db;
+      const attemptRow = db2.prepare("SELECT id, courseware_id, student_id, status FROM courseware_attempt WHERE id = ?").get(attemptId);
+      if (!attemptRow) {
+        return res.status(404).json({ error: "Attempt not found" });
+      }
+      if (session.role === "teacher" || session.role === "administrator") {
+        return res.json({ attemptId, adopted: false, reused: true, role: session.role });
+      }
+      const studentId = session.userId || session.studentId;
+      if (!studentId) {
+        return res.status(400).json({ error: "Session has no student identity" });
+      }
+      if (attemptRow.student_id === studentId) {
+        return res.json({ attemptId, adopted: false, reused: true });
+      }
+      const UNOWNED_OWNERS = ["guest", "teacher", "teacher_preview", ""];
+      if (UNOWNED_OWNERS.includes(attemptRow.student_id)) {
+        const info = db2.prepare(
+          "UPDATE courseware_attempt SET student_id = ? WHERE id = ? AND student_id IN ('guest','teacher','teacher_preview','')"
+        ).run(studentId, attemptId);
+        if (info.changes > 0) {
+          io.emit("courseware-attempt-updated", { attemptId, type: "adopt" });
+          return res.json({ attemptId, adopted: true, reused: true });
+        }
+      }
+      let own = db2.prepare("SELECT id FROM courseware_attempt WHERE courseware_id = ? AND student_id = ? AND status = ?").get(attemptRow.courseware_id, studentId, "active");
+      if (!own) {
+        const newId = "att_" + import_crypto8.default.randomBytes(8).toString("hex");
+        db2.prepare(
+          "INSERT INTO courseware_attempt (id, courseware_id, student_id, started_at, status) VALUES (?, ?, ?, ?, ?)"
+        ).run(newId, attemptRow.courseware_id, studentId, Date.now(), "active");
+        own = { id: newId };
+      }
+      io.emit("courseware-attempt-updated", { attemptId: own.id, type: "adopt" });
+      return res.json({
+        attemptId: own.id,
+        adopted: false,
+        reused: true,
+        reason: "attempt-owned-by-another-student"
+      });
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
+  app.get("/api/courseware/attempts", requireAuth(), (req, res) => {
+    try {
+      const session = req.session;
+      const isStaff = session?.role === "teacher" || session?.role === "administrator" || session?.subRole === "administrator";
+      const coursewareUuid = typeof req.query.coursewareUuid === "string" ? req.query.coursewareUuid.trim() : "";
+      const baseSql = `
+        SELECT a.id as attemptId, a.started_at, a.finished_at, a.status,
                cw.name as coursewareName, cw.uuid as coursewareUuid,
                COALESCE(s.name, CASE WHEN a.student_id = 'teacher' THEN 'Teacher (Test)' WHEN a.student_id = 'guest' THEN 'Guest Student' ELSE a.student_id END) as studentName,
                a.student_id as studentId,
@@ -21712,26 +23545,40 @@ function registerCoursewareRoutes(ctx) {
                (
                  SELECT COUNT(*) FROM assignment_submissions sub
                  JOIN assignments ast ON sub.assignment_id = ast.id
-                 WHERE sub.student_id = a.student_id 
+                 WHERE sub.student_id = a.student_id
                    AND ast.title = '\u4E92\u52A8\u8BFE\u4EF6: ' || cw.name
                ) as isPromoted
         FROM courseware_attempt a
         JOIN courseware cw ON a.courseware_id = cw.id
         LEFT JOIN students s ON a.student_id = s.id
         LEFT JOIN submission_result r ON a.id = r.attempt_id
-        ORDER BY a.started_at DESC
-      `
-      ).all();
-      res.json(rows);
+      `;
+      const sql = coursewareUuid ? `${baseSql} WHERE cw.uuid = ? ORDER BY a.started_at DESC` : `${baseSql} ORDER BY a.started_at DESC`;
+      const stmt = kernelContainer.db.prepare(sql);
+      const rows = coursewareUuid ? stmt.all(coursewareUuid) : stmt.all();
+      if (isStaff) {
+        res.json(rows);
+        return;
+      }
+      res.json(
+        rows.map((row) => {
+          const sanitized = { ...row };
+          delete sanitized.extra_json;
+          delete sanitized.comment;
+          return sanitized;
+        })
+      );
     } catch (e) {
       sendSafeError(res, e);
     }
   });
-  app.post("/api/courseware/debug", (req, res) => {
+  app.post("/api/courseware/debug", requireAuth(), (req, res) => {
     try {
       const { msg, url, student, courseware } = req.body;
-      const logMsg = `[CLIENT DEBUG] ${msg} | URL: ${url} | Student: ${JSON.stringify(student)} | Courseware: ${JSON.stringify(courseware)}`;
-      console.log(`\x1B[35m[CLIENT DEBUG]\x1B[0m ${msg}`);
+      const safeMsg = typeof msg === "string" ? msg.slice(0, 2e3) : String(msg).slice(0, 2e3);
+      const safeUrl = typeof url === "string" ? url.slice(0, 1e3) : String(url).slice(0, 1e3);
+      const logMsg = `[CLIENT DEBUG] ${safeMsg} | URL: ${safeUrl} | Student: ${JSON.stringify(student)?.slice(0, 1e3)} | Courseware: ${JSON.stringify(courseware)?.slice(0, 1e3)}`;
+      console.log(`\x1B[35m[CLIENT DEBUG]\x1B[0m ${safeMsg}`);
       const logFile2 = import_path10.default.join(process.cwd(), "client_debug.log");
       import_fs10.default.appendFileSync(logFile2, `${(/* @__PURE__ */ new Date()).toISOString()} - ${logMsg}
 `);
@@ -21740,13 +23587,20 @@ function registerCoursewareRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/courseware/attempts/:attemptId/raw", async (req, res) => {
+  app.get("/api/courseware/attempts/:attemptId/raw", requireAuth(), async (req, res) => {
     try {
       const { attemptId } = req.params;
+      const session = req.session;
+      if (session.role !== "teacher" && session.role !== "administrator") {
+        const owner = kernelContainer.db.prepare("SELECT student_id FROM courseware_attempt WHERE id = ?").get(attemptId);
+        if (!owner || owner.student_id !== (session.userId || session.studentId)) {
+          return res.status(403).json({ error: "Forbidden: Cannot read another student attempt" });
+        }
+      }
       const cmd = kernelContainer.commandBus.createCommand(
         "courseware.get_attempt_raw_data",
         { attemptId },
-        "teacher-demo"
+        getActorId(req)
       );
       const result = await kernelContainer.commandBus.execute(cmd);
       res.json(result);
@@ -21754,9 +23608,16 @@ function registerCoursewareRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/courseware/attempts/:attemptId/progress", (req, res) => {
+  app.get("/api/courseware/attempts/:attemptId/progress", requireAuth(), (req, res) => {
     try {
       const { attemptId } = req.params;
+      const session = req.session;
+      if (session && session.role !== "teacher" && session.role !== "administrator" && session.subRole !== "administrator") {
+        const owner = kernelContainer.db.prepare("SELECT student_id FROM courseware_attempt WHERE id = ?").get(attemptId);
+        if (!owner || owner.student_id !== (session.userId || session.studentId)) {
+          return res.status(403).json({ success: false, error: "Forbidden: Cannot read another student attempt" });
+        }
+      }
       const result = kernelContainer.db.prepare("SELECT score, comment, completion, extra_json FROM submission_result WHERE attempt_id = ?").get(attemptId);
       if (!result) {
         return res.json({ progress: null });
@@ -21773,7 +23634,7 @@ function registerCoursewareRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.post("/api/courseware/attempts/:attemptId/promote", async (req, res) => {
+  app.post("/api/courseware/attempts/:attemptId/promote", requireAuth("teacher", "administrator"), async (req, res) => {
     try {
       const { attemptId } = req.params;
       const { lessonId, classId } = req.body;
@@ -21806,24 +23667,25 @@ function registerCoursewareRoutes(ctx) {
         }
       }
       const assignmentTitle = `\u4E92\u52A8\u8BFE\u4EF6: ${coursewareName}`;
-      let assignment = kernelContainer.db.prepare("SELECT id FROM assignments WHERE class_id = ? AND lesson_id = ? AND title = ?").get(classId, lessonId, assignmentTitle);
-      let assignmentId = assignment?.id;
-      if (!assignmentId) {
-        assignmentId = "ast-cw-" + import_crypto8.default.randomBytes(8).toString("hex");
+      const promoteTx = kernelContainer.db.transaction(() => {
+        let assignment = kernelContainer.db.prepare("SELECT id FROM assignments WHERE class_id = ? AND lesson_id = ? AND title = ?").get(classId, lessonId, assignmentTitle);
+        let assignmentId2 = assignment?.id;
+        if (!assignmentId2) {
+          assignmentId2 = "ast-cw-" + import_crypto8.default.randomBytes(8).toString("hex");
+          kernelContainer.db.prepare(
+            "INSERT INTO assignments (id, class_id, lesson_id, title, description, content, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)"
+          ).run(
+            assignmentId2,
+            classId,
+            lessonId,
+            assignmentTitle,
+            `\u6765\u81EA\u4E92\u52A8\u8BFE\u4EF6 [${coursewareName}] \u7684\u968F\u5802\u5B66\u4E60\u63D0\u4EA4\u6570\u636E\u8BB0\u5F55`,
+            JSON.stringify({ type: "interactive_courseware", attemptId, coursewareUuid: attempt.courseware_uuid }),
+            Date.now()
+          );
+        }
         kernelContainer.db.prepare(
-          "INSERT INTO assignments (id, class_id, lesson_id, title, description, content, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)"
-        ).run(
-          assignmentId,
-          classId,
-          lessonId,
-          assignmentTitle,
-          `\u6765\u81EA\u4E92\u52A8\u8BFE\u4EF6 [${coursewareName}] \u7684\u968F\u5802\u5B66\u4E60\u63D0\u4EA4\u6570\u636E\u8BB0\u5F55`,
-          JSON.stringify({ type: "interactive_courseware", attemptId, coursewareUuid: attempt.courseware_uuid }),
-          Date.now()
-        );
-      }
-      kernelContainer.db.prepare(
-        `
+          `
         INSERT INTO assignment_submissions (assignment_id, student_id, content, score, feedback, submitted_at, graded_at, status)
         VALUES (?, ?, ?, ?, ?, ?, ?, 'graded')
         ON CONFLICT(assignment_id, student_id) DO UPDATE SET
@@ -21834,24 +23696,27 @@ function registerCoursewareRoutes(ctx) {
           graded_at = excluded.graded_at,
           status = 'graded'
       `
-      ).run(
-        assignmentId,
-        studentId,
-        attempt.extra_json || "{}",
-        finalScore,
-        `\u7531\u6559\u5E08\u5728\u8BFE\u5802\u4E2D\u4FDD\u5B58\u5F55\u5165\u3002\u8BFE\u4EF6\u5B8C\u6210\u5EA6: ${Math.round(completion * 100)}%\u3002\u8BFE\u4EF6\u539F\u59CB\u53CD\uFFFD?: ${attempt.comment || "\uFFFD?"}`,
-        Date.now(),
-        Date.now()
-      );
-      kernelContainer.db.prepare(
-        `
+        ).run(
+          assignmentId2,
+          studentId,
+          attempt.extra_json || "{}",
+          finalScore,
+          `\u7531\u6559\u5E08\u5728\u8BFE\u5802\u4E2D\u4FDD\u5B58\u5F55\u5165\u3002\u8BFE\u4EF6\u5B8C\u6210\u5EA6: ${Math.round(completion * 100)}%\u3002\u8BFE\u4EF6\u539F\u59CB\u53CD\uFFFD?: ${attempt.comment || "\uFFFD?"}`,
+          Date.now(),
+          Date.now()
+        );
+        kernelContainer.db.prepare(
+          `
         INSERT INTO student_lesson_progress (student_id, lesson_id, completed, progress_percent, completed_segments, assigned_at)
         VALUES (?, ?, 1, 100, '[]', ?)
         ON CONFLICT(student_id, lesson_id) DO UPDATE SET
           completed = 1,
           progress_percent = 100
       `
-      ).run(studentId, lessonId, Date.now());
+        ).run(studentId, lessonId, Date.now());
+        return assignmentId2;
+      });
+      const assignmentId = promoteTx();
       io.emit("student-progress-updated", {
         studentId,
         lessonId,
@@ -21886,10 +23751,20 @@ var import_path11 = __toESM(require("path"), 1);
 var import_fs11 = __toESM(require("fs"), 1);
 function registerBridgeRoutes(ctx) {
   const { app } = ctx;
-  app.get("/bridge.js", (_req, res) => {
+  app.get("/bridge.js", (req, res) => {
     res.setHeader("Content-Type", "application/javascript; charset=utf-8");
     res.setHeader("Access-Control-Allow-Origin", "*");
-    res.send(BRIDGE_SDK_CODE);
+    const cw = typeof req.query.cw === "string" ? req.query.cw : "";
+    const cwName = typeof req.query.name === "string" ? req.query.name : "";
+    let runtimeScripts = "";
+    try {
+      const scripts = collectCoursewareRuntimeScripts({ id: cw, name: cwName, uuid: cw });
+      runtimeScripts = scripts.head + scripts.bodyEnd;
+    } catch (e) {
+      runtimeScripts = "";
+    }
+    res.send(runtimeScripts ? `${BRIDGE_SDK_CODE}
+${runtimeScripts}` : BRIDGE_SDK_CODE);
   });
   app.get("/runtime/:uuid", (req, res, next) => {
     if (req.path.endsWith("/")) return next();
@@ -22139,7 +24014,7 @@ function requireWhiteboardWriteAccess() {
 }
 function registerLessonsRoutes(ctx) {
   const { app, io } = ctx;
-  app.get("/api/lessons", (req, res) => {
+  app.get("/api/lessons", requireAuth(), (req, res) => {
     const lessons = kernelContainer.db.prepare(
       `
       SELECT l.*, u.name as creator_name,
@@ -22151,7 +24026,7 @@ function registerLessonsRoutes(ctx) {
     ).all();
     res.json(lessons);
   });
-  app.get("/api/lessons/:lessonId/eval-submissions", (req, res) => {
+  app.get("/api/lessons/:lessonId/eval-submissions", requireAuth(), (req, res) => {
     try {
       const { lessonId } = req.params;
       const rows = kernelContainer.db.prepare(
@@ -22167,7 +24042,7 @@ function registerLessonsRoutes(ctx) {
       sendSafeError(res, err);
     }
   });
-  app.get("/api/lessons/:lessonId/eval-grades", (req, res) => {
+  app.get("/api/lessons/:lessonId/eval-grades", requireAuth("teacher", "administrator"), (req, res) => {
     try {
       const { lessonId } = req.params;
       const submissions = kernelContainer.db.prepare(
@@ -22217,7 +24092,7 @@ function registerLessonsRoutes(ctx) {
       sendSafeError(res, err);
     }
   });
-  app.get("/api/eval-submissions/:submissionId/reviews", (req, res) => {
+  app.get("/api/eval-submissions/:submissionId/reviews", requireAuth(), (req, res) => {
     try {
       const { submissionId } = req.params;
       const rows = kernelContainer.db.prepare(
@@ -22233,7 +24108,7 @@ function registerLessonsRoutes(ctx) {
       sendSafeError(res, err);
     }
   });
-  app.get("/api/lessons/:lessonId/students/:studentId/eval-status", (req, res) => {
+  app.get("/api/lessons/:lessonId/students/:studentId/eval-status", requireAuth(), (req, res) => {
     try {
       const { lessonId, studentId } = req.params;
       const submission = kernelContainer.db.prepare(
@@ -22334,7 +24209,7 @@ function registerLessonsRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/lessons/:id/whiteboard", (req, res) => {
+  app.get("/api/lessons/:id/whiteboard", requireAuth(), (req, res) => {
     const id = req.params.id;
     const elements = kernelContainer.db.prepare("SELECT * FROM whiteboard_elements WHERE lesson_id = ?").all(id);
     if (!id.startsWith("assignment-") && !id.startsWith("snapshot-")) {
@@ -22492,6 +24367,18 @@ function registerLessonsRoutes(ctx) {
       dataObj.submissions[studentId] = { answer, score, time: Date.now() };
       kernelContainer.db.prepare("UPDATE whiteboard_elements SET data = ? WHERE id = ?").run(JSON.stringify(dataObj), elementId);
       io.to(`lesson-${lessonId}`).emit("whiteboard-sync", { type: "element-updated", elementId });
+      io.emit("whiteboard-quiz-answered", {
+        lessonId,
+        elementId,
+        studentId,
+        studentName: session.studentName || session.name || null,
+        answer,
+        score,
+        isCorrect,
+        time: Date.now(),
+        correctAnswer: dataObj.correctAnswer || null,
+        question: dataObj.question || null
+      });
       res.json({ success: true, isCorrect, score, studentId });
     } catch (e) {
       sendSafeError(res, e);
@@ -22565,11 +24452,14 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
       if (!ownership.allowed) {
         return res.status(ownership.status).json({ success: false, error: ownership.error });
       }
-      kernelContainer.db.prepare("DELETE FROM whiteboard_elements WHERE lesson_id = ?").run(id);
-      kernelContainer.db.prepare("DELETE FROM student_lesson_progress WHERE lesson_id = ?").run(id);
-      kernelContainer.db.prepare("DELETE FROM schedules WHERE lesson_id = ?").run(id);
-      kernelContainer.db.prepare("DELETE FROM assignments WHERE lesson_id = ?").run(id);
-      const result = kernelContainer.db.prepare("DELETE FROM lessons WHERE id = ?").run(id);
+      const delTx = kernelContainer.db.transaction(() => {
+        kernelContainer.db.prepare("DELETE FROM whiteboard_elements WHERE lesson_id = ?").run(id);
+        kernelContainer.db.prepare("DELETE FROM student_lesson_progress WHERE lesson_id = ?").run(id);
+        kernelContainer.db.prepare("DELETE FROM schedules WHERE lesson_id = ?").run(id);
+        kernelContainer.db.prepare("DELETE FROM assignments WHERE lesson_id = ?").run(id);
+        return kernelContainer.db.prepare("DELETE FROM lessons WHERE id = ?").run(id);
+      });
+      const result = delTx();
       if (result.changes === 0) {
         return res.status(404).json({ error: "Lesson not found" });
       }
@@ -22578,7 +24468,7 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
       sendSafeError(res, e);
     }
   });
-  app.get("/api/lessons/:id/stats", (req, res) => {
+  app.get("/api/lessons/:id/stats", requireAuth(), (req, res) => {
     try {
       const { id } = req.params;
       const whiteboardCount = kernelContainer.db.prepare("SELECT COUNT(*) as count FROM whiteboard_elements WHERE lesson_id = ?").get(id).count;
@@ -22602,26 +24492,29 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
       const newId = (0, import_uuid16.v7)();
       const now = Date.now();
       const newTitle = `\u526F\u672C-${original.title}`;
-      kernelContainer.db.prepare(
-        "INSERT INTO lessons (id, title, content, timeline, progress_mode, progress_conditions, creator_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
-      ).run(
-        newId,
-        newTitle,
-        original.content,
-        original.timeline,
-        original.progress_mode,
-        original.progress_conditions,
-        creatorId,
-        now,
-        now
-      );
-      const whiteboardElements = kernelContainer.db.prepare("SELECT * FROM whiteboard_elements WHERE lesson_id = ?").all(id);
-      const insertElement = kernelContainer.db.prepare(
-        "INSERT INTO whiteboard_elements (id, lesson_id, type, data, created_at) VALUES (?, ?, ?, ?, ?)"
-      );
-      for (const el of whiteboardElements) {
-        insertElement.run((0, import_uuid16.v7)(), newId, el.type, el.data, now);
-      }
+      const cloneTx = kernelContainer.db.transaction(() => {
+        kernelContainer.db.prepare(
+          "INSERT INTO lessons (id, title, content, timeline, progress_mode, progress_conditions, creator_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
+        ).run(
+          newId,
+          newTitle,
+          original.content,
+          original.timeline,
+          original.progress_mode,
+          original.progress_conditions,
+          creatorId,
+          now,
+          now
+        );
+        const whiteboardElements = kernelContainer.db.prepare("SELECT * FROM whiteboard_elements WHERE lesson_id = ?").all(id);
+        const insertElement = kernelContainer.db.prepare(
+          "INSERT INTO whiteboard_elements (id, lesson_id, type, data, created_at) VALUES (?, ?, ?, ?, ?)"
+        );
+        for (const el of whiteboardElements) {
+          insertElement.run((0, import_uuid16.v7)(), newId, el.type, el.data, now);
+        }
+      });
+      cloneTx();
       const cloned = kernelContainer.db.prepare(
         `
         SELECT l.*, u.name as creator_name, 0 as enrollment_count 
@@ -22639,9 +24532,11 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
 
 // server/routes/workspace.ts
 var import_path12 = __toESM(require("path"), 1);
+var DIAGNOSTIC_MIN_INTERVAL_MS = 1e3;
+var diagnosticLastReportAt = /* @__PURE__ */ new Map();
 function registerWorkspaceRoutes(ctx) {
   const { app, MF_REMOTE_CACHE: MF_REMOTE_CACHE2 } = ctx;
-  app.get("/api/events", requireAuth("administrator"), (req, res) => {
+  app.get("/api/events", requireAuth("administrator", "teacher"), (req, res) => {
     try {
       const events = kernelContainer.db.prepare("SELECT * FROM events ORDER BY timestamp DESC LIMIT 50").all();
       res.json(events);
@@ -22649,6 +24544,69 @@ function registerWorkspaceRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
+  app.post("/api/diagnostics/report", requireAuth(), (req, res) => {
+    try {
+      const data = req.body || {};
+      const session = req.session || {};
+      const actorId = session.userId || session.studentId || "unknown";
+      if (!data.studentId || !data.error) {
+        return res.json({ success: true });
+      }
+      const isTeacherOrAdmin = session.role === "teacher" || session.role === "administrator";
+      if (!isTeacherOrAdmin && actorId !== data.studentId) {
+        console.warn(`[Diagnostics Security] ${actorId} attempted to report error as ${data.studentId}`);
+        return res.status(403).json({ success: false, error: "Forbidden: studentId mismatch" });
+      }
+      const now = Date.now();
+      const last = diagnosticLastReportAt.get(actorId) || 0;
+      if (now - last < DIAGNOSTIC_MIN_INTERVAL_MS) {
+        return res.status(429).json({ success: false, error: "Too many diagnostic reports" });
+      }
+      diagnosticLastReportAt.set(actorId, now);
+      if (diagnosticLastReportAt.size > 5e3) {
+        for (const [k, v] of diagnosticLastReportAt) {
+          if (now - v > 6e4) diagnosticLastReportAt.delete(k);
+        }
+      }
+      const studentId = String(data.studentId).slice(0, 64);
+      const studentName = isTeacherOrAdmin ? String(data.studentName || studentId).slice(0, 100) : String(session.username || session.studentId || studentId).slice(0, 100);
+      const errorPayload = {
+        type: typeof data.error?.type === "string" ? data.error.type.slice(0, 64) : "runtime",
+        message: typeof data.error?.message === "string" ? data.error.message.slice(0, 2e3) : void 0,
+        title: typeof data.error?.title === "string" ? data.error.title.slice(0, 200) : void 0,
+        timestamp: Number(data.error?.timestamp) || now
+      };
+      console.warn(
+        `[Client Diagnostics HTTP] Student ${studentId} (${studentName}) reported error [${errorPayload.type}]: ${errorPayload.message || errorPayload.title || ""}`
+      );
+      kernelContainer.eventBus.publish({
+        id: `evt_err_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`,
+        type: "student.client_error",
+        source: "student_client",
+        payload: {
+          studentId,
+          studentName,
+          lessonId: data.lessonId || null,
+          classId: data.classId || null,
+          error: errorPayload
+        },
+        timestamp: errorPayload.timestamp,
+        correlationId: data.lessonId || void 0
+      });
+      if (ctx.io) {
+        ctx.io.emit("student-error-alert", {
+          studentId,
+          studentName,
+          lessonId: data.lessonId || null,
+          classId: data.classId || null,
+          error: errorPayload
+        });
+      }
+      res.json({ success: true });
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
   app.get("/api/mfe/remotes", (req, res) => {
     try {
       const name = req.query.name;
@@ -23035,7 +24993,7 @@ var import_crypto9 = __toESM(require("crypto"), 1);
 var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
 function registerRosterRoutes(ctx) {
   const { app, io, loginLimiter } = ctx;
-  app.get("/api/classes", (req, res) => {
+  app.get("/api/classes", requireAuth(), (req, res) => {
     try {
       const classes = kernelContainer.db.prepare(
         `
@@ -23049,22 +25007,25 @@ function registerRosterRoutes(ctx) {
       ).all();
       res.json(classes);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/students", (req, res) => {
+  app.get("/api/students", requireAuth(), (req, res) => {
     try {
-      const students = kernelContainer.db.prepare("SELECT * FROM students ORDER BY created_at DESC").all();
+      const students = kernelContainer.db.prepare(
+        "SELECT id, student_number, name, email, avatar, locked_lesson_id, private_notes, created_at FROM students ORDER BY created_at DESC"
+      ).all();
       res.json(students);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/classes/:id/students", (req, res) => {
+  app.get("/api/classes/:id/students", requireAuth(), (req, res) => {
     try {
       const students = kernelContainer.db.prepare(
         `
-        SELECT s.* FROM students s
+        SELECT s.id, s.student_number, s.name, s.email, s.avatar, s.locked_lesson_id, s.private_notes, s.created_at, cs.joined_at
+        FROM students s
         INNER JOIN class_students cs ON s.id = cs.student_id
         WHERE cs.class_id = ?
         ORDER BY cs.joined_at DESC
@@ -23541,7 +25502,7 @@ function registerRosterRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/students/:id/read_notifications", (req, res) => {
+  app.get("/api/students/:id/read_notifications", requireAuth(), (req, res) => {
     try {
       const rows = kernelContainer.db.prepare("SELECT notification_id FROM student_read_notifications WHERE student_id = ?").all(req.params.id);
       res.json(rows.map((r) => r.notification_id));
@@ -23663,7 +25624,7 @@ function registerRosterRoutes(ctx) {
       res.status(550).json({ error: e.message });
     }
   });
-  app.get("/api/labs", (req, res) => {
+  app.get("/api/labs", requireAuth(), (req, res) => {
     try {
       const labs = kernelContainer.db.prepare("SELECT * FROM computer_labs ORDER BY created_at DESC").all();
       res.json(labs);
@@ -23699,7 +25660,7 @@ function registerRosterRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/classes/:classId/seats", (req, res) => {
+  app.get("/api/classes/:classId/seats", requireAuth(), (req, res) => {
     try {
       const classInfo = kernelContainer.db.prepare("SELECT lab_id FROM classes WHERE id = ?").get(req.params.classId);
       const labId = classInfo ? classInfo.lab_id : null;
@@ -23784,11 +25745,8 @@ function registerRosterRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/students/:id/export", (req, res) => {
+  app.get("/api/students/:id/export", requireAuth("teacher", "administrator"), (req, res) => {
     try {
-      if (!checkIsTeacherOrAdmin(req)) {
-        return res.status(403).json({ error: "Only teachers and administrators can export student data" });
-      }
       const studentId = req.params.id;
       const student = kernelContainer.db.prepare("SELECT * FROM students WHERE id = ?").get(studentId);
       if (!student) return res.status(404).json({ error: "Student not found" });
@@ -23848,10 +25806,16 @@ function registerRosterRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/students/:id/progress", (req, res) => {
+  app.get("/api/students/:id/progress", requireAuth(), (req, res) => {
     try {
+      const session = req.session;
+      const isPrivileged = session && (session.role === "teacher" || session.role === "administrator");
+      const currentUserId = session?.userId || session?.studentId;
       const studentRow = kernelContainer.db.prepare("SELECT id, student_number FROM students WHERE id = ? OR student_number = ?").get(req.params.id, req.params.id);
       const studentId = studentRow ? studentRow.id : req.params.id;
+      if (!isPrivileged && currentUserId !== studentId && currentUserId !== (studentRow?.student_number ?? null)) {
+        return res.status(403).json({ error: "Forbidden: Cannot read another student progress" });
+      }
       const progress = kernelContainer.db.prepare(
         `
         SELECT slp.*, l.title as lesson_title
@@ -23961,7 +25925,7 @@ function registerRosterRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/classes/:id/progress", (req, res) => {
+  app.get("/api/classes/:id/progress", requireAuth(), (req, res) => {
     try {
       const progress = kernelContainer.db.prepare(
         `
@@ -23978,7 +25942,7 @@ function registerRosterRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/classes/:classId/lessons/:lessonId/progress", (req, res) => {
+  app.get("/api/classes/:classId/lessons/:lessonId/progress", requireAuth(), (req, res) => {
     try {
       const progress = kernelContainer.db.prepare(
         `
@@ -24008,7 +25972,7 @@ function registerRosterRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/classes/:classId/dashboard", (req, res) => {
+  app.get("/api/classes/:classId/dashboard", requireAuth(), (req, res) => {
     try {
       const assignments = kernelContainer.db.prepare("SELECT * FROM assignments WHERE class_id = ? ORDER BY created_at DESC").all(req.params.classId);
       const recentSubmissions = kernelContainer.db.prepare(
@@ -24161,7 +26125,7 @@ function registerRosterRoutes(ctx) {
 // server/routes/assignments.ts
 function registerAssignmentsRoutes(ctx) {
   const { app } = ctx;
-  app.get("/api/classes/:classId/assignments", (req, res) => {
+  app.get("/api/classes/:classId/assignments", requireAuth(), (req, res) => {
     try {
       const assignments = kernelContainer.db.prepare("SELECT * FROM assignments WHERE class_id = ? ORDER BY created_at DESC").all(req.params.classId);
       res.json(assignments);
@@ -24299,7 +26263,7 @@ Output pure JSON only without markdown code blocks, matching this structure:
       sendSafeError(res, e);
     }
   });
-  app.get("/api/assignments/:id/submissions", (req, res) => {
+  app.get("/api/assignments/:id/submissions", requireAuth(), (req, res) => {
     try {
       const submissions = kernelContainer.db.prepare(
         `
@@ -24414,10 +26378,389 @@ Provide a grade score (0-100) and brief feedback. Ensure you output in this exac
   );
 }
 
+// server/routes/assignment-hub.ts
+var import_path15 = __toESM(require("path"), 1);
+var import_fs13 = __toESM(require("fs"), 1);
+var import_crypto10 = __toESM(require("crypto"), 1);
+var import_express2 = __toESM(require("express"), 1);
+
+// server/utils/upload.ts
+var import_path14 = __toESM(require("path"), 1);
+var MAGIC_BYTES = {
+  ".pdf": [[37, 80, 68, 70]],
+  ".pptx": [[80, 75, 3, 4]],
+  ".zip": [[80, 75, 3, 4]],
+  ".jpg": [[255, 216, 255]],
+  ".jpeg": [[255, 216, 255]],
+  ".png": [[137, 80, 78, 71]],
+  ".gif": [[71, 73, 70, 56]],
+  ".webp": [[82, 73, 70, 70]]
+};
+var BLOCKED_EXTENSIONS2 = [".exe", ".sh", ".bat", ".cmd", ".dll", ".so", ".dylib", ".scr", ".msi", ".ps1"];
+function validateMagicBytes2(buffer, fileName) {
+  const ext = import_path14.default.extname(fileName || "").toLowerCase();
+  const signatures = MAGIC_BYTES[ext];
+  if (!signatures) return true;
+  return signatures.some((sig) => sig.every((byte, i) => buffer[i] === byte));
+}
+var SIZE_LIMITS = {
+  courseware: 50 * 1024 * 1024,
+  plugin: 10 * 1024 * 1024,
+  assignment: 20 * 1024 * 1024,
+  generic: 10 * 1024 * 1024
+};
+
+// server/routes/assignment-hub.ts
+var ALLOWED_ASSIGNMENT_EXT = /* @__PURE__ */ new Set([
+  ".pdf",
+  ".doc",
+  ".docx",
+  ".ppt",
+  ".pptx",
+  ".xls",
+  ".xlsx",
+  ".csv",
+  ".txt",
+  ".md",
+  ".rtf",
+  ".odt",
+  ".odp",
+  ".ods",
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".bmp",
+  ".svg",
+  ".heic",
+  ".zip",
+  ".py",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".ts",
+  ".tsx",
+  ".jsx",
+  ".java",
+  ".c",
+  ".h",
+  ".cpp",
+  ".cs",
+  ".go",
+  ".rs",
+  ".rb",
+  ".php",
+  ".sql",
+  ".json",
+  ".xml",
+  ".html",
+  ".css",
+  ".ino"
+]);
+var ZIP_CONTAINER_EXT = /* @__PURE__ */ new Set([".zip", ".pptx", ".docx", ".xlsx", ".odt", ".odp", ".ods", ".epub"]);
+var MAX_FILE_SIZE = 50 * 1024 * 1024;
+function safeSegment(value) {
+  const cleaned = String(value || "").replace(/[^A-Za-z0-9._-]/g, "");
+  return cleaned.length > 0 ? cleaned.slice(0, 96) : "unknown";
+}
+function decodeFileName(raw) {
+  const text = String(raw ?? "").trim();
+  if (!text) return "";
+  try {
+    return decodeURIComponent(text);
+  } catch {
+    return text;
+  }
+}
+function assignmentStorageDir(assignmentId, studentId) {
+  return import_path15.default.join(process.cwd(), "storage", "assignments", safeSegment(assignmentId), safeSegment(studentId));
+}
+function registerAssignmentHubRoutes(ctx) {
+  const { app } = ctx;
+  const describeRequester = (req) => {
+    const session = req.session;
+    const role = session?.role;
+    const isPrivileged = role === "teacher" || role === "administrator" || role === "admin";
+    const studentId = session?.userId || session?.studentId || null;
+    return { isPrivileged, studentId: studentId ? String(studentId) : null };
+  };
+  app.post("/api/assignments", requireAuth("teacher", "administrator"), async (req, res) => {
+    try {
+      const cmd = kernelContainer.commandBus.createCommand("assignment.create", req.body || {}, getActorId(req));
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
+  app.get("/api/assignments", requireAuth(), async (req, res) => {
+    try {
+      const payload = {
+        lessonId: req.query.lessonId,
+        classId: req.query.classId,
+        elementId: req.query.elementId,
+        includeArchived: req.query.includeArchived === "1" || req.query.includeArchived === "true"
+      };
+      const { isPrivileged, studentId } = describeRequester(req);
+      const requestedStudent = typeof req.query.studentId === "string" ? req.query.studentId : void 0;
+      if (isPrivileged && requestedStudent) {
+        payload.studentId = requestedStudent;
+      } else if (!isPrivileged && studentId) {
+        payload.studentId = studentId;
+      }
+      const cmd = kernelContainer.commandBus.createCommand("assignment.list", payload, getActorId(req), {
+        silent: true
+      });
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
+  app.get("/api/assignments/:assignmentId", requireAuth(), async (req, res) => {
+    try {
+      const { isPrivileged, studentId } = describeRequester(req);
+      const payload = { assignmentId: req.params.assignmentId };
+      const requestedStudent = typeof req.query.studentId === "string" ? req.query.studentId : void 0;
+      if (isPrivileged && requestedStudent) {
+        payload.studentId = requestedStudent;
+      } else if (!isPrivileged && studentId) {
+        payload.studentId = studentId;
+      }
+      if (isPrivileged) {
+        payload.includePeerProgress = true;
+      }
+      const cmd = kernelContainer.commandBus.createCommand("assignment.get", payload, getActorId(req), { silent: true });
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
+  app.post(
+    "/api/assignments/:assignmentId/files",
+    requireAuth(),
+    import_express2.default.raw({ type: () => true, limit: MAX_FILE_SIZE + 1024 * 1024 }),
+    async (req, res) => {
+      try {
+        const assignmentId = req.params.assignmentId;
+        const { isPrivileged, studentId: sessionStudentId } = describeRequester(req);
+        const headerStudent = decodeFileName(req.header("x-student-id") || "");
+        const ownerStudentId = isPrivileged ? headerStudent || sessionStudentId : sessionStudentId;
+        if (!ownerStudentId) {
+          return res.status(400).json({ success: false, error: "Missing studentId" });
+        }
+        const assignment = kernelContainer.db.prepare("SELECT id, max_files, max_file_size, status FROM plugin_assignments WHERE id = ?").get(assignmentId);
+        if (!assignment) {
+          return res.status(404).json({ success: false, error: `Assignment not found: ${assignmentId}` });
+        }
+        const fileName = decodeFileName(req.header("x-file-name") || "");
+        if (!fileName) {
+          return res.status(400).json({ success: false, error: "Missing X-File-Name header" });
+        }
+        const ext = import_path15.default.extname(fileName).toLowerCase();
+        if (!ALLOWED_ASSIGNMENT_EXT.has(ext)) {
+          return res.status(400).json({ success: false, error: `File type not allowed: ${ext || "(none)"}` });
+        }
+        if (BLOCKED_EXTENSIONS2.includes(ext)) {
+          return res.status(400).json({ success: false, error: `File type blocked: ${ext}` });
+        }
+        const buffer = Buffer.isBuffer(req.body) ? req.body : Buffer.alloc(0);
+        if (buffer.length === 0) {
+          return res.status(400).json({ success: false, error: "Empty file body" });
+        }
+        const sizeLimit = Math.min(Number(assignment.max_file_size) || SIZE_LIMITS.assignment, MAX_FILE_SIZE);
+        if (buffer.length > sizeLimit) {
+          return res.status(413).json({ success: false, error: `File too large (limit ${sizeLimit} bytes)` });
+        }
+        if (ZIP_CONTAINER_EXT.has(ext) && !(buffer[0] === 80 && buffer[1] === 75)) {
+          return res.status(400).json({ success: false, error: "File content does not match its extension" });
+        }
+        if (!validateMagicBytes2(buffer, fileName)) {
+          return res.status(400).json({ success: false, error: "File content does not match its extension" });
+        }
+        const existingCount = kernelContainer.db.prepare(
+          "SELECT COUNT(*) AS c FROM plugin_assignment_files WHERE assignment_id = ? AND student_id = ? AND deleted_at IS NULL"
+        ).get(assignmentId, ownerStudentId).c;
+        if (existingCount >= (Number(assignment.max_files) || 10)) {
+          return res.status(409).json({ success: false, error: `At most ${assignment.max_files} files are allowed` });
+        }
+        const dir = assignmentStorageDir(assignmentId, ownerStudentId);
+        import_fs13.default.mkdirSync(dir, { recursive: true });
+        const storedName = `${import_crypto10.default.randomUUID()}${ext}`;
+        const storedPath = import_path15.default.join(dir, storedName);
+        import_fs13.default.writeFileSync(storedPath, buffer);
+        const fileId = "af-" + import_crypto10.default.randomUUID();
+        const sha256 = import_crypto10.default.createHash("sha256").update(buffer).digest("hex");
+        kernelContainer.db.prepare(
+          `INSERT INTO plugin_assignment_files
+               (id, assignment_id, submission_id, version_id, student_id, original_name, stored_path, size, mime, sha256, uploaded_at)
+             VALUES (?, ?, NULL, NULL, ?, ?, ?, ?, ?, ?, ?)`
+        ).run(
+          fileId,
+          assignmentId,
+          ownerStudentId,
+          fileName,
+          import_path15.default.relative(process.cwd(), storedPath),
+          buffer.length,
+          req.header("content-type") || null,
+          sha256,
+          Date.now()
+        );
+        res.json({
+          success: true,
+          file: { id: fileId, name: fileName, size: buffer.length, sha256, studentId: ownerStudentId }
+        });
+      } catch (e) {
+        sendSafeError(res, e);
+      }
+    }
+  );
+  app.get("/api/assignments/:assignmentId/files", requireAuth(), async (req, res) => {
+    try {
+      const { isPrivileged, studentId } = describeRequester(req);
+      const rows = kernelContainer.db.prepare(
+        `SELECT id, student_id, original_name, size, mime, sha256, uploaded_at, version_id
+             FROM plugin_assignment_files
+            WHERE assignment_id = ? AND deleted_at IS NULL
+            ORDER BY uploaded_at DESC`
+      ).all(req.params.assignmentId);
+      const files = isPrivileged ? rows : rows.filter((r) => r.student_id === studentId);
+      res.json({ success: true, files });
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
+  app.get("/api/assignments/:assignmentId/files/:fileId", requireAuth(), async (req, res) => {
+    try {
+      const file = kernelContainer.db.prepare(
+        `SELECT id, student_id, original_name, stored_path, mime, deleted_at
+             FROM plugin_assignment_files WHERE id = ? AND assignment_id = ?`
+      ).get(req.params.fileId, req.params.assignmentId);
+      const { isPrivileged, studentId } = describeRequester(req);
+      if (!file || file.deleted_at) {
+        return res.status(404).json({ success: false, error: "File not found" });
+      }
+      if (!isPrivileged && file.student_id !== studentId) {
+        const assigned = kernelContainer.db.prepare(
+          `SELECT 1 AS ok FROM plugin_assignment_files f
+               JOIN plugin_submission_versions v ON v.id = f.version_id
+               JOIN plugin_peer_review_tasks t ON t.submission_id = v.submission_id
+              WHERE f.id = ? AND t.reviewer_id = ? LIMIT 1`
+        ).get(req.params.fileId, studentId);
+        if (!assigned) {
+          return res.status(403).json({ success: false, error: "Forbidden: Cannot read another student file" });
+        }
+      }
+      const absPath = import_path15.default.resolve(process.cwd(), file.stored_path);
+      const root = import_path15.default.join(process.cwd(), "storage", "assignments");
+      if (!absPath.startsWith(root) || !import_fs13.default.existsSync(absPath)) {
+        return res.status(404).json({ success: false, error: "File not found on disk" });
+      }
+      res.setHeader("X-Content-Type-Options", "nosniff");
+      res.setHeader("Cache-Control", "private, no-store");
+      res.download(absPath, file.original_name);
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
+  app.delete("/api/assignments/:assignmentId/files/:fileId", requireAuth(), async (req, res) => {
+    try {
+      const file = kernelContainer.db.prepare(
+        `SELECT id, student_id, version_id, deleted_at FROM plugin_assignment_files
+            WHERE id = ? AND assignment_id = ?`
+      ).get(req.params.fileId, req.params.assignmentId);
+      const { isPrivileged, studentId } = describeRequester(req);
+      if (!file || file.deleted_at) {
+        return res.status(404).json({ success: false, error: "File not found" });
+      }
+      if (!isPrivileged && file.student_id !== studentId) {
+        return res.status(403).json({ success: false, error: "Forbidden: Cannot delete another student file" });
+      }
+      if (file.version_id) {
+        return res.status(409).json({ success: false, error: "File already attached to a submission version" });
+      }
+      kernelContainer.db.prepare("UPDATE plugin_assignment_files SET deleted_at = ? WHERE id = ?").run(Date.now(), req.params.fileId);
+      res.json({ success: true });
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
+  app.post("/api/assignments/:assignmentId/submit", requireAuth(), async (req, res) => {
+    try {
+      const { isPrivileged, studentId } = describeRequester(req);
+      const body = req.body || {};
+      const targetStudentId = isPrivileged ? String(body.studentId || "") : String(studentId || "");
+      if (!targetStudentId) {
+        return res.status(400).json({ success: false, error: "Missing studentId" });
+      }
+      const cmd = kernelContainer.commandBus.createCommand(
+        "assignment.submit",
+        {
+          assignmentId: req.params.assignmentId,
+          studentId: targetStudentId,
+          fileIds: Array.isArray(body.fileIds) ? body.fileIds : [],
+          textContent: body.textContent,
+          linkUrl: body.linkUrl
+        },
+        getActorId(req)
+      );
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
+  app.post("/api/assignments/:assignmentId/peer-review", requireAuth(), async (req, res) => {
+    try {
+      const { isPrivileged, studentId } = describeRequester(req);
+      const body = req.body || {};
+      const reviewerId = isPrivileged ? String(body.reviewerId || body.studentId || "") : String(studentId || "");
+      if (!reviewerId) {
+        return res.status(400).json({ success: false, error: "Missing reviewerId" });
+      }
+      const submissionId = String(body.submissionId || "");
+      if (!submissionId) {
+        return res.status(400).json({ success: false, error: "Missing submissionId" });
+      }
+      const cmd = kernelContainer.commandBus.createCommand(
+        "assignment.peer_review",
+        {
+          submissionId,
+          reviewerId,
+          score: body.score,
+          comment: body.comment,
+          taskId: body.taskId
+        },
+        getActorId(req)
+      );
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
+  app.post("/api/assignments/:assignmentId/assign-peer-reviews", requireAuth("teacher", "administrator"), async (req, res) => {
+    try {
+      const body = req.body || {};
+      const cmd = kernelContainer.commandBus.createCommand(
+        "assignment.assign_peer_reviews",
+        { assignmentId: req.params.assignmentId, reviewerCount: body.reviewerCount, dueAt: body.dueAt },
+        getActorId(req)
+      );
+      const result = await kernelContainer.commandBus.execute(cmd);
+      res.json(result);
+    } catch (e) {
+      sendSafeError(res, e);
+    }
+  });
+}
+
 // server/routes/schedules.ts
 function registerSchedulesRoutes(ctx) {
   const { app } = ctx;
-  app.get("/api/schedules/today", (req, res) => {
+  app.get("/api/schedules/today", requireAuth(), (req, res) => {
     try {
       const clientDate = req.query.date || (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
       const schedules = kernelContainer.db.prepare(
@@ -24442,10 +26785,10 @@ function registerSchedulesRoutes(ctx) {
       ).all(clientDate, clientDate);
       res.json({ success: true, schedules });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/schedules", (req, res) => {
+  app.get("/api/schedules", requireAuth(), (req, res) => {
     try {
       const schedules = kernelContainer.db.prepare(
         `
@@ -24458,10 +26801,10 @@ function registerSchedulesRoutes(ctx) {
       ).all();
       res.json(schedules);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/classes/:classId/schedules", (req, res) => {
+  app.get("/api/classes/:classId/schedules", requireAuth(), (req, res) => {
     try {
       const schedules = kernelContainer.db.prepare(
         `
@@ -24474,7 +26817,7 @@ function registerSchedulesRoutes(ctx) {
       ).all(req.params.classId);
       res.json(schedules);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/classes/:classId/schedules", requireAuth("teacher", "administrator"), (req, res) => {
@@ -24509,7 +26852,7 @@ function registerSchedulesRoutes(ctx) {
         }
       });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.put("/api/classes/:classId/schedules/:scheduleId", requireAuth("teacher", "administrator"), (req, res) => {
@@ -24532,7 +26875,7 @@ function registerSchedulesRoutes(ctx) {
       );
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.delete("/api/classes/:classId/schedules/:scheduleId", requireAuth("teacher", "administrator"), (req, res) => {
@@ -24541,7 +26884,7 @@ function registerSchedulesRoutes(ctx) {
       kernelContainer.db.prepare("DELETE FROM attendance WHERE schedule_id = ?").run(req.params.scheduleId);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/classes/:classId/schedules/batch", requireAuth("teacher", "administrator"), (req, res) => {
@@ -24570,7 +26913,7 @@ function registerSchedulesRoutes(ctx) {
       transaction(schedules);
       res.json({ success: true, count: schedules.length });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/timetable/ocr", requireAuth("teacher", "administrator"), async (req, res) => {
@@ -24733,7 +27076,7 @@ function registerSchedulesRoutes(ctx) {
         stack: e.stack,
         cause: e.cause
       });
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
 }
@@ -24742,7 +27085,7 @@ function registerSchedulesRoutes(ctx) {
 init_interfaces();
 function registerGradingRoutes(ctx) {
   const { app } = ctx;
-  app.get("/api/classes/:classId/attendance-summary", (req, res) => {
+  app.get("/api/classes/:classId/attendance-summary", requireAuth(), (req, res) => {
     try {
       const classId = req.params.classId;
       const db2 = kernelContainer.db;
@@ -24853,10 +27196,10 @@ function registerGradingRoutes(ctx) {
       }).sort((a, b) => a.date.localeCompare(b.date));
       res.json(filtered);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/schedules/:scheduleId/attendance", (req, res) => {
+  app.get("/api/schedules/:scheduleId/attendance", requireAuth(), (req, res) => {
     try {
       const attendance = kernelContainer.db.prepare(
         `
@@ -24868,7 +27211,7 @@ function registerGradingRoutes(ctx) {
       ).all(req.params.scheduleId);
       res.json(attendance);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/schedules/:scheduleId/attendance", requireAuth("teacher", "administrator"), (req, res) => {
@@ -24883,10 +27226,10 @@ function registerGradingRoutes(ctx) {
       ).run(req.params.scheduleId, studentId, status, Date.now());
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/classes/:classId/grade-weights", (req, res) => {
+  app.get("/api/classes/:classId/grade-weights", requireAuth(), (req, res) => {
     try {
       const weights = kernelContainer.db.prepare("SELECT * FROM class_grade_weights WHERE class_id = ?").get(req.params.classId);
       if (!weights) {
@@ -24900,7 +27243,7 @@ function registerGradingRoutes(ctx) {
       }
       res.json(weights);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/classes/:classId/grade-weights", requireAuth("teacher", "administrator"), (req, res) => {
@@ -24928,15 +27271,15 @@ function registerGradingRoutes(ctx) {
       ).run(req.params.classId, att, prog, assign, ex, Date.now());
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/classes/:classId/exams", (req, res) => {
+  app.get("/api/classes/:classId/exams", requireAuth(), (req, res) => {
     try {
       const exams = kernelContainer.db.prepare("SELECT * FROM exams WHERE class_id = ? ORDER BY created_at DESC").all(req.params.classId);
       res.json(exams);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/classes/:classId/exams", requireAuth("teacher", "administrator"), (req, res) => {
@@ -24952,15 +27295,15 @@ function registerGradingRoutes(ctx) {
       ).run(examId, req.params.classId, title, description || "", max_score || 100, Date.now());
       res.json({ success: true, examId });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/exams/:examId/scores", (req, res) => {
+  app.get("/api/exams/:examId/scores", requireAuth(), (req, res) => {
     try {
       const scores = kernelContainer.db.prepare("SELECT * FROM exam_scores WHERE exam_id = ?").all(req.params.examId);
       res.json(scores);
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/exams/:examId/scores", requireAuth("teacher", "administrator"), (req, res) => {
@@ -24989,10 +27332,10 @@ function registerGradingRoutes(ctx) {
       transaction(scores);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/classes/:classId/semester-grades", (req, res) => {
+  app.get("/api/classes/:classId/semester-grades", requireAuth(), (req, res) => {
     try {
       const classId = req.params.classId;
       const semesterName = req.query.semesterName || "2026\u5E74\u6625\u5B63\u5B66\uFFFD?";
@@ -25134,7 +27477,7 @@ function registerGradingRoutes(ctx) {
       });
       res.json({ success: true, weights, students: result });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/grade-sync", requireAuth("teacher", "administrator"), async (req, res) => {
@@ -25147,16 +27490,16 @@ function registerGradingRoutes(ctx) {
       await gradeService.saveSemesterGrade(lessonId, studentId, Math.round(Number(grade)));
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/classes/:classId/points-dimensions", async (req, res) => {
+  app.get("/api/classes/:classId/points-dimensions", requireAuth(), async (req, res) => {
     try {
       const dimensionRegistry = await kernelContainer.serviceRegistry.resolve(IPointsDimensionRegistryToken);
       const dimensions = dimensionRegistry.listDimensions();
       res.json({ success: true, dimensions });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/students/:studentId/points", requireAuth("teacher", "administrator"), async (req, res) => {
@@ -25184,10 +27527,10 @@ function registerGradingRoutes(ctx) {
       });
       res.json({ success: true, logItem });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
-  app.get("/api/students/:studentId/points-logs", async (req, res) => {
+  app.get("/api/students/:studentId/points-logs", requireAuth(), async (req, res) => {
     try {
       const { studentId } = req.params;
       const { classId } = req.query;
@@ -25196,7 +27539,7 @@ function registerGradingRoutes(ctx) {
       const summary = await ledgerService.getStudentDimensionSummary(studentId, classId || "");
       res.json({ success: true, logs, summary });
     } catch (e) {
-      res.status(500).json({ success: false, error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post("/api/classes/:classId/semester-reports/archive", requireAuth("teacher", "administrator"), (req, res) => {
@@ -25249,7 +27592,7 @@ function registerGradingRoutes(ctx) {
       transaction(reports);
       res.json({ success: true });
     } catch (e) {
-      res.status(500).json({ error: e.message });
+      sendSafeError(res, e);
     }
   });
   app.post(
@@ -25350,16 +27693,16 @@ ${examsText}
         res.json({ success: true, aiEvaluation: text });
       } catch (e) {
         console.error("AI Semester Evaluation error:", e);
-        res.status(500).json({ error: e.message });
+        sendSafeError(res, e);
       }
     }
   );
 }
 
 // server/routes/plugins.ts
-var import_express2 = __toESM(require("express"), 1);
-var import_path14 = __toESM(require("path"), 1);
-var import_fs13 = __toESM(require("fs"), 1);
+var import_express3 = __toESM(require("express"), 1);
+var import_path16 = __toESM(require("path"), 1);
+var import_fs14 = __toESM(require("fs"), 1);
 var import_semver3 = __toESM(require("semver"), 1);
 
 // server/services/version-fetcher.ts
@@ -25380,6 +27723,14 @@ function cached(key) {
 function setCache(key, result) {
   cache.set(key, { result, timestamp: Date.now() });
 }
+var REPO_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function normalizeSource(source) {
+  if (!source) return null;
+  if (source.type !== "github-release" && source.type !== "gitee-release") return null;
+  if (typeof source.repo !== "string" || source.repo.length > 140) return null;
+  if (!REPO_PATTERN.test(source.repo)) return null;
+  return { type: source.type, repo: source.repo };
+}
 function repoUrl(source) {
   if (source.type === "github-release") {
     return `https://github.com/${source.repo}.git`;
@@ -25456,9 +27807,6 @@ function latestFromReleases(releases, installed, source) {
   return { version: null, isPrerelease: false, downloadUrl: null, changelog: null };
 }
 async function checkVersion(source, installedVersion) {
-  const key = cacheKey(source);
-  const hit = cached(key);
-  if (hit) return { ...hit, installedVersion };
   const base = {
     hasUpdate: false,
     installedVersion,
@@ -25467,9 +27815,16 @@ async function checkVersion(source, installedVersion) {
     downloadUrl: null,
     changelog: null
   };
+  const safeSource = normalizeSource(source);
+  if (!safeSource) {
+    return { ...base, error: "\u65E0\u6548\u7684\u66F4\u65B0\u6E90\uFF1A\u4EC5\u652F\u6301 owner/name \u5F62\u5F0F\u7684 GitHub / Gitee \u4ED3\u5E93" };
+  }
+  const key = cacheKey(safeSource);
+  const hit = cached(key);
+  if (hit) return { ...hit, installedVersion };
   try {
-    const url = repoUrl(source);
-    const stdout = (0, import_child_process2.execSync)(`git ls-remote --tags "${url}"`, {
+    const url = repoUrl(safeSource);
+    const stdout = (0, import_child_process2.execFileSync)("git", ["ls-remote", "--tags", url], {
       timeout: 8e3,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -25490,7 +27845,7 @@ async function checkVersion(source, installedVersion) {
   } catch {
   }
   try {
-    const apiUrl = apiReleasesUrl(source);
+    const apiUrl = apiReleasesUrl(safeSource);
     const resp = await fetch(apiUrl, {
       headers: { "User-Agent": "OpenLearnV2-PluginUpdater/1.0" },
       signal: AbortSignal.timeout(1e4)
@@ -25499,7 +27854,11 @@ async function checkVersion(source, installedVersion) {
       return { ...base, error: `\u66F4\u65B0\u6E90\u54CD\u5E94\u5F02\u5E38: HTTP ${resp.status}` };
     }
     const releases = await resp.json();
-    const { version, isPrerelease, downloadUrl, changelog } = latestFromReleases(releases, installedVersion, source);
+    const { version, isPrerelease, downloadUrl, changelog } = latestFromReleases(
+      releases,
+      installedVersion,
+      safeSource
+    );
     const result = {
       ...base,
       hasUpdate: version !== null,
@@ -25517,7 +27876,7 @@ async function checkVersion(source, installedVersion) {
 }
 
 // server/routes/plugin-api-gateway.ts
-var import_node_path4 = __toESM(require("node:path"), 1);
+var import_node_path5 = __toESM(require("node:path"), 1);
 init_http_router();
 var RESERVED_ACTIONS = /* @__PURE__ */ new Set(["config", "toggle", "contributions", "check-update", "one-click-update"]);
 var FORBIDDEN_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
@@ -25651,7 +28010,7 @@ async function pluginApiGatewayMiddleware(req, res, next) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
   }
-  const normalizedSubPath = import_node_path4.default.posix.normalize("/" + rawSubPath);
+  const normalizedSubPath = import_node_path5.default.posix.normalize("/" + rawSubPath);
   if (normalizedSubPath.includes("..")) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
@@ -25871,16 +28230,16 @@ data: ${JSON.stringify({ error: msg })}
 
 // server/routes/plugins.ts
 function findLocalPluginSource(manifestId) {
-  const root = import_path14.default.resolve(process.cwd(), "v2_plugins");
-  if (!import_fs13.default.existsSync(root)) return null;
+  const root = import_path16.default.resolve(process.cwd(), "v2_plugins");
+  if (!import_fs14.default.existsSync(root)) return null;
   let best = null;
   try {
-    for (const entry of import_fs13.default.readdirSync(root, { withFileTypes: true })) {
+    for (const entry of import_fs14.default.readdirSync(root, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      const manifestPath = import_path14.default.join(root, entry.name, "manifest.json");
-      if (!import_fs13.default.existsSync(manifestPath)) continue;
+      const manifestPath = import_path16.default.join(root, entry.name, "manifest.json");
+      if (!import_fs14.default.existsSync(manifestPath)) continue;
       try {
-        const m = JSON.parse(import_fs13.default.readFileSync(manifestPath, "utf-8"));
+        const m = JSON.parse(import_fs14.default.readFileSync(manifestPath, "utf-8"));
         if (m?.id !== manifestId || !m?.version) continue;
         if (!best || import_semver3.default.gt(m.version, best.version)) best = { dir: entry.name, version: m.version };
       } catch {
@@ -25916,11 +28275,11 @@ function registerPluginsRoutes(ctx) {
   const { app, buildOpenAITools: buildOpenAITools2, executeAgentToolCall: executeAgentToolCall2, buildOpenAIChatUrl: buildOpenAIChatUrl2, runGeminiAgentChat: runGeminiAgentChat2, runOpenAIAgentChat: runOpenAIAgentChat2 } = ctx;
   app.get("/api/docs/plugin-guide", (req, res) => {
     try {
-      const docPath = import_path14.default.join(process.cwd(), "docs_plugin_guide.md");
-      if (!import_fs13.default.existsSync(docPath)) {
+      const docPath = import_path16.default.join(process.cwd(), "docs_plugin_guide.md");
+      if (!import_fs14.default.existsSync(docPath)) {
         return res.status(404).json({ success: false, error: "Document not found" });
       }
-      const content = import_fs13.default.readFileSync(docPath, "utf-8");
+      const content = import_fs14.default.readFileSync(docPath, "utf-8");
       res.json({ success: true, content });
     } catch (e) {
       sendSafeError(res, e);
@@ -25931,11 +28290,11 @@ function registerPluginsRoutes(ctx) {
       const limit = parseInt(req.query.limit) || 200;
       const component = req.query.component;
       const levelFilter = req.query.level;
-      const logFile2 = import_path14.default.resolve(process.cwd(), "logs", "openlearn.log");
-      if (!import_fs13.default.existsSync(logFile2)) {
+      const logFile2 = import_path16.default.resolve(process.cwd(), "logs", "openlearn.log");
+      if (!import_fs14.default.existsSync(logFile2)) {
         return res.json({ success: true, logs: [] });
       }
-      const content = import_fs13.default.readFileSync(logFile2, "utf-8");
+      const content = import_fs14.default.readFileSync(logFile2, "utf-8");
       const lines = content.split("\n").filter(Boolean);
       let parsedLogs = lines.map((line) => {
         try {
@@ -25996,7 +28355,7 @@ function registerPluginsRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.get("/api/plugins/market", async (req, res) => {
+  app.get("/api/plugins/market", requireAuth(), async (req, res) => {
     try {
       const plugins = kernelContainer.db.prepare("SELECT id, manifest FROM plugins WHERE manifest LIKE '%updateSource%'").all();
       const results = [];
@@ -26022,7 +28381,7 @@ function registerPluginsRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.post("/api/plugins/:id(*)/check-update", async (req, res) => {
+  app.post("/api/plugins/:id(*)/check-update", requireAuth(), async (req, res) => {
     try {
       const rawId = decodeURIComponent(req.params.id);
       const pluginId = kernelContainer.pluginHost.resolvePluginUuid(rawId);
@@ -26225,7 +28584,7 @@ function registerPluginsRoutes(ctx) {
   app.post(
     "/api/plugins/upload-zip-raw",
     requireAuth("administrator"),
-    import_express2.default.raw({ type: "application/octet-stream", limit: "400mb" }),
+    import_express3.default.raw({ type: "application/octet-stream", limit: "400mb" }),
     async (req, res) => {
       try {
         const zipBuffer = req.body;
@@ -26272,7 +28631,7 @@ function registerPluginsRoutes(ctx) {
   app.post(
     "/api/plugins/:id(*)/update-zip-raw",
     requireAuth("administrator"),
-    import_express2.default.raw({ type: "application/octet-stream", limit: "400mb" }),
+    import_express3.default.raw({ type: "application/octet-stream", limit: "400mb" }),
     async (req, res) => {
       try {
         const targetPluginId = decodeURIComponent(req.params.id);
@@ -26303,7 +28662,7 @@ function registerPluginsRoutes(ctx) {
       }
     }
   );
-  app.post("/api/plugins/execute-command", async (req, res) => {
+  app.post("/api/plugins/execute-command", requireAuth(), async (req, res) => {
     try {
       const { type, payload } = req.body;
       if (!type) {
@@ -26497,7 +28856,7 @@ async function startServer() {
     config: { port: Number(process.env.PORT) || 9e3 }
   });
   try {
-    const migrationsDir = import_path15.default.join(process.cwd(), "migrations");
+    const migrationsDir = import_path17.default.join(process.cwd(), "migrations");
     const migrations = loadMigrationsFromDirectory(migrationsDir);
     if (migrations.length > 0) {
       runMigrations(kernelContainer.db, migrations);
@@ -26511,7 +28870,7 @@ async function startServer() {
   registerOfficialActivities(activityRegistry, kernelContainer.actionRegistry);
   await kernelContainer.serviceRegistry.register(IActivityRegistryToken, activityRegistry);
   console.log(`[ActivityEcosystem] Registered ${activityRegistry.listProviders().length} official activity providers.`);
-  const app = (0, import_express3.default)();
+  const app = (0, import_express4.default)();
   kernelContainer.pluginHost.setExpressApp(app);
   const PORT = parseInt(process.env.PORT || "9000", 10);
   app.set("trust proxy", 1);
@@ -26559,10 +28918,25 @@ async function startServer() {
     standardHeaders: true,
     legacyHeaders: false
   });
-  app.use(import_express3.default.json({ limit: "10mb" }));
-  app.use(import_express3.default.urlencoded({ limit: "10mb", extended: true }));
-  app.use("/uploads", import_express3.default.static(import_path15.default.join(process.cwd(), "uploads")));
-  app.use("/plugins", import_express3.default.static(import_path15.default.join(process.cwd(), "plugins")));
+  app.use(import_express4.default.json({ limit: "10mb" }));
+  app.use(import_express4.default.urlencoded({ limit: "10mb", extended: true }));
+  app.use(
+    "/uploads",
+    (req, res, next) => {
+      const token = req.headers.cookie?.match?.(/edu_os_token=([^;]+)/)?.[1];
+      if (!token) {
+      }
+      next();
+    },
+    import_express4.default.static(import_path17.default.join(process.cwd(), "uploads"), {
+      // 禁用目录索引与隐藏文件
+      index: false,
+      dotfiles: "ignore",
+      // 缓存控制：静态资源可缓存 1h，接口不受影响
+      maxAge: "1h"
+    })
+  );
+  app.use("/plugins", import_express4.default.static(import_path17.default.join(process.cwd(), "plugins"), { index: false, dotfiles: "ignore" }));
   const configuredOrigins = process.env.ALLOWED_ORIGINS ? process.env.ALLOWED_ORIGINS.split(",").map((s) => s.trim()).filter(Boolean) : [];
   const isOriginAllowed = (origin, hostHeader) => {
     if (!origin) return true;
@@ -26687,6 +29061,7 @@ async function startServer() {
   registerAdminRoutes(ctx);
   registerRosterRoutes(ctx);
   registerAssignmentsRoutes(ctx);
+  registerAssignmentHubRoutes(ctx);
   registerSchedulesRoutes(ctx);
   registerGradingRoutes(ctx);
   registerPluginsRoutes(ctx);
@@ -26735,10 +29110,10 @@ async function startServer() {
     });
     app.use(vite.middlewares);
   } else {
-    const distPath = __dirname || import_path15.default.join(process.cwd(), "dist");
-    app.use(import_express3.default.static(distPath));
+    const distPath = __dirname || import_path17.default.join(process.cwd(), "dist");
+    app.use(import_express4.default.static(distPath));
     app.get("*", (req, res) => {
-      res.sendFile(import_path15.default.join(distPath, "index.html"));
+      res.sendFile(import_path17.default.join(distPath, "index.html"));
     });
   }
   const HOST = process.env.HOST || "0.0.0.0";
@@ -26795,24 +29170,22 @@ async function startServer() {
     const green = "\x1B[32m";
     const cyan = "\x1B[36m";
     const dim = "\x1B[2m";
+    const hyperlink = Boolean(process.stdout.isTTY) && process.env.TERM !== "dumb";
+    const link = (url) => hyperlink ? `${OSC}${url}${ST}${url}${OSC}${ST}` : url;
     console.log(`
-  ${bold}${green}Educational OS Kernel${reset} v${PLATFORM_VERSION} ready:
+  ${bold}${green}OpenLearn Next${reset} v${PLATFORM_VERSION} ready:
 `);
-    console.log(
-      `  ${dim}\u279C${reset}  ${bold}Local:${reset}   ${bold}${cyan}${OSC}${localUrl}${ST}${localUrl}${OSC}${ST}${reset}`
-    );
+    console.log(`  ${dim}\u279C${reset}  ${bold}Local:${reset}   ${bold}${cyan}${link(localUrl)}${reset}`);
     if (isAnyHost) {
       const netIps = getNetworkIps();
       for (const ip of netIps) {
         const netUrl = `http://${ip}:${PORT}`;
-        console.log(
-          `  ${dim}\u279C${reset}  ${bold}Network:${reset} ${bold}${cyan}${OSC}${netUrl}${ST}${netUrl}${OSC}${ST}${reset}`
-        );
+        console.log(`  ${dim}\u279C${reset}  ${bold}Network:${reset} ${bold}${cyan}${link(netUrl)}${reset}`);
       }
     }
     console.log("");
     if (process.env.OPEN_BROWSER === "true") {
-      console.log(`  ${dim}\u279C  Auto-opening browser: ${primaryUrl}${reset}
+      console.log(`  ${dim}\u279C  Auto-opening browser: ${cyan}${link(primaryUrl)}${reset}
 `);
       openBrowser(primaryUrl);
     }