openlearn-next 0.7.10 → 0.7.13

package/dist/server.cjs

@@ -3304,6 +3304,95 @@ var init_ai_event_bus = __esm({
   }
 });
 
+// packages/core/di/ai-provider-resolver.ts
+function hasOwnerColumns(db2) {
+  try {
+    const cols = db2.prepare("PRAGMA table_info(ai_providers)").all();
+    return cols.some((c) => c.name === "owner_id");
+  } catch {
+    return false;
+  }
+}
+function resolveAccessibleAiProvider(db2, options = {}) {
+  const { providerId, userId, lang = "zh" } = options;
+  const supportsOwner = hasOwnerColumns(db2);
+  let provider;
+  if (providerId) {
+    const row = supportsOwner ? db2.prepare(
+      "SELECT id, name, api_url, api_key, model_name, owner_id, is_shared, created_at, updated_at FROM ai_providers WHERE id = ?"
+    ).get(providerId) : db2.prepare("SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE id = ?").get(providerId);
+    if (!row) {
+      throw new AiProviderError(
+        lang === "zh" ? "\u672A\u627E\u5230\u6307\u5B9A\u7684 AI \u63D0\u4F9B\u5546" : "Specified AI Provider not found",
+        404,
+        "PROVIDER_NOT_FOUND"
+      );
+    }
+    if (supportsOwner) {
+      const isShared = Number(row.is_shared) === 1 || row.owner_id === null;
+      const isOwner = Boolean(userId && row.owner_id === userId);
+      if (!isShared && !isOwner) {
+        throw new AiProviderError(
+          lang === "zh" ? "\u65E0\u6743\u4F7F\u7528\u8BE5 AI \u63D0\u4F9B\u5546\uFF08\u975E\u672C\u4EBA\u79C1\u6709\u4E14\u672A\u5171\u4EAB\uFF09" : "Forbidden: You do not have access to this private AI provider",
+          403,
+          "PROVIDER_ACCESS_DENIED"
+        );
+      }
+    }
+    provider = row;
+  } else {
+    if (!supportsOwner) {
+      provider = db2.prepare(
+        "SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE api_key IS NOT NULL AND api_key != '' ORDER BY created_at DESC LIMIT 1"
+      ).get();
+    } else if (userId) {
+      provider = db2.prepare(
+        `SELECT id, name, api_url, api_key, model_name, owner_id, is_shared, created_at, updated_at
+           FROM ai_providers
+           WHERE (owner_id = ? OR is_shared = 1 OR owner_id IS NULL)
+             AND api_key IS NOT NULL AND api_key != ''
+           ORDER BY (CASE WHEN owner_id = ? THEN 0 WHEN is_shared = 1 THEN 1 ELSE 2 END), created_at DESC
+           LIMIT 1`
+      ).get(userId, userId);
+    } else {
+      provider = db2.prepare(
+        `SELECT id, name, api_url, api_key, model_name, owner_id, is_shared, created_at, updated_at
+           FROM ai_providers
+           WHERE (is_shared = 1 OR owner_id IS NULL)
+             AND api_key IS NOT NULL AND api_key != ''
+           ORDER BY (CASE WHEN is_shared = 1 THEN 0 ELSE 1 END), created_at DESC
+           LIMIT 1`
+      ).get();
+    }
+  }
+  if (provider?.api_key) {
+    provider.api_key = decryptApiKey(provider.api_key);
+  }
+  if (!provider || !provider.api_key || !provider.api_key.trim()) {
+    throw new AiProviderError(
+      lang === "zh" ? "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002" : "No active AI Provider configured. Please add and configure an AI Provider in settings.",
+      400,
+      "NO_AI_PROVIDER"
+    );
+  }
+  return provider;
+}
+var AiProviderError;
+var init_ai_provider_resolver = __esm({
+  "packages/core/di/ai-provider-resolver.ts"() {
+    "use strict";
+    init_api_key_crypto();
+    AiProviderError = class extends Error {
+      constructor(message, status = 400, code = "AI_PROVIDER_ERROR") {
+        super(message);
+        this.name = "AiProviderError";
+        this.status = status;
+        this.code = code;
+      }
+    };
+  }
+});
+
 // packages/core/di/ai-service.ts
 var AIService;
 var init_ai_service = __esm({
@@ -3312,6 +3401,7 @@ var init_ai_service = __esm({
     init_provider_gateway();
     init_ai_event_bus();
     init_api_key_crypto();
+    init_ai_provider_resolver();
     AIService = class {
       constructor(db2) {
         this.db = db2;
@@ -3359,16 +3449,11 @@ var init_ai_service = __esm({
         this._contextDelegates.unregister?.(id);
       }
       async generateText(prompt, options) {
-        const provider = this.db.prepare(
-          "SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE api_key IS NOT NULL AND api_key != '' LIMIT 1"
-        ).get();
-        if (!provider || !provider.api_key) {
-          throw new Error("\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u6DFB\u52A0\u5E76\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002");
-        }
-        const apiKey = decryptApiKey(provider.api_key);
-        if (!apiKey || !apiKey.trim()) {
-          throw new Error("AI Provider API Key \u89E3\u5BC6\u4E3A\u7A7A\uFF0C\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u91CD\u65B0\u4FDD\u5B58\u5BC6\u94A5\u3002");
-        }
+        const provider = resolveAccessibleAiProvider(this.db, {
+          userId: options?.userId,
+          providerId: options?.providerId
+        });
+        const apiKey = provider.api_key;
         if (looksLikeCiphertext(apiKey)) {
           throw new Error(
             "AI Provider API Key \u89E3\u5BC6\u5931\u8D25\uFF1AENCRYPTION_KEY \u4E0E\u52A0\u5BC6\u65F6\u4E0D\u4E00\u81F4\uFF08\u5E38\u89C1\u4E8E PM2 \u5C06 ENCRYPTION_KEY \u7F6E\u7A7A\u6216\u5BC6\u94A5\u88AB\u8F6E\u6362\uFF09\u3002\u8BF7\u6062\u590D\u539F ENCRYPTION_KEY\uFF0C\u6216\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u91CD\u65B0\u4FDD\u5B58 API Key\u3002"
@@ -9211,6 +9296,7 @@ var init_di = __esm({
     init_storage_service();
     init_ai_service();
     init_courseware_runtime_script_registry();
+    init_ai_provider_resolver();
     init_container();
   }
 });
@@ -13409,8 +13495,8 @@ var ManagementPlugin = {
     });
     await commandBus.registerHandler(classTemplateDownloadCmd, {
       async execute() {
-        const headers = "Class Name,Class Desc,Student Name,Student Email";
-        const sampleRow = "Class 101,Introduction to English,John Doe,john@example.com\nClass 101,Introduction to English,Jane Smith,jane@example.com";
+        const headers = "Class Name,Class Desc,Student Number,Student Name,Student Email,Initial Password,Student Notes,Gender";
+        const sampleRow = "Class 101,Introduction to English,20260101,John Doe,john@example.com,,,Male\nClass 101,Introduction to English,20260102,Jane Smith,jane@example.com,,,Female";
         const content = `${headers}
 ${sampleRow}`;
         const fileId = (0, import_uuid4.v7)();
@@ -13442,8 +13528,8 @@ ${sampleRow}`;
     });
     await commandBus.registerHandler(studentTemplateDownloadCmd, {
       async execute() {
-        const headers = "Student Name,Student Email";
-        const sampleRow = "Alice Cooper,alice@example.com\nBob Dylan,bob@example.com";
+        const headers = "Student Number,Student Name,Student Email,Initial Password,Student Notes,Gender";
+        const sampleRow = "20260101,Alice Cooper,alice@example.com,,,Male\n20260102,Bob Dylan,bob@example.com,,,Female";
         const content = `${headers}
 ${sampleRow}`;
         const fileId = (0, import_uuid4.v7)();
@@ -21204,7 +21290,7 @@ var import_node_fs11 = __toESM(require("node:fs"), 1);
 var import_node_path13 = __toESM(require("node:path"), 1);
 var import_node_url5 = require("node:url");
 var import_meta7 = {};
-var FALLBACK_VERSION = "0.7.10";
+var FALLBACK_VERSION = "0.7.13";
 function readPlatformVersion() {
   const bases = [];
   if (typeof __dirname !== "undefined") bases.push(__dirname);
@@ -29897,1298 +29983,366 @@ var ServiceRegistryKernel = class {
   }
 };
 
-// packages/core/bootstrap/composition/composition-validator.ts
-var CompositionValidator = class {
-  static validate(options, pipeline, modules) {
-    const errors = [];
-    const warnings = [];
-    if (options.config && options.config.port !== void 0) {
-      if (options.config.port <= 0 || options.config.port > 65535) {
-        errors.push({
-          code: "INVALID_PORT",
-          message: `Port must be a valid number between 1 and 65535. Received: ${options.config.port}`,
-          target: "config.port"
-        });
-      }
-    }
-    if (!pipeline || pipeline.stages.length === 0) {
-      errors.push({
-        code: "EMPTY_PIPELINE",
-        message: "Bootstrap pipeline is missing or contains zero stages.",
-        target: "pipeline"
-      });
+// packages/core/kernel/index.ts
+var import_path12 = __toESM(require("path"), 1);
+var Kernel = class {
+  /**
+   * @param opts.pluginsDir - 插件产物目录。生产默认 `<cwd>/plugins`；
+   *   测试**必须**显式传入临时目录，否则插件产物会落进工作树。
+   *
+   * ## 为什么要开这个口子（H-1）
+   *
+   * 原本这里硬编码 `path.resolve(process.cwd(), 'plugins')` 且不可覆盖。
+   * 后果不只是「测试会弄脏工作树」，更根本的是 **Kernel 在这个维度上不可测** ——
+   * 没有任何办法在测试里把插件产物引到别处，于是污染一直无人察觉：
+   * 实测仓库 `plugins/` 下积累了 **1705 个孤儿目录 / 24MB**，且每次 `pnpm test` 继续增长。
+   * 该目录被 `.gitignore` 忽略，所以 `git status` 完全看不见。
+   *
+   * 加可选参数后，生产行为**逐字节不变**（默认值相同），而测试可把产物引到
+   * `os.tmpdir()`。`vitest.setup.ts` 的全局守卫会把「仍写工作树」变成硬失败，
+   * 防止将来有人再引入同类调用。
+   */
+  constructor(opts) {
+    this.db = db;
+    this.readPool = readPool;
+    this.getReadDb = getReadDb;
+    this.queryRead = queryRead;
+    this.queryReadOne = queryReadOne;
+    this.checkpoint = checkpoint;
+    this.eventBus = new EventBus();
+    this.capabilityGuard = new CapabilityGuard();
+    this.serviceRegistry = new ServiceRegistry();
+    this.storageService = new StorageService(this.db);
+    this.aiService = new AIService(this.db);
+    this.aiRuntime = new AIRuntimeKernel();
+    this.aiCapability = new AICapabilityKernel(this.aiRuntime);
+    this.capabilityFrameworkRuntime = new CapabilityRuntimeKernel(this.aiCapability);
+    this.capabilityGovernance = new CapabilityGovernanceKernel();
+    this.platformServiceRegistryKernel = new ServiceRegistryKernel();
+    this.analyticsEngine = new AnalyticsEngineKernel();
+    this.collaborationEngine = new CollaborationEngineKernel();
+    this.presenceEngine = new PresenceEngineKernel();
+    this.classroomRuntime = new ClassroomRuntimeKernel();
+    this.lessonRuntime = new LessonRuntime({ eventBus: this.eventBus });
+    this.lessonRuntime.aiInterface.setAIService(this.aiService);
+    this.commandBus = new CommandBus(this.eventBus);
+    this.actionRegistry = new ActionRegistry();
+    this.processManager = new ProcessManager(this);
+    this.esmLoader = new NodeEsmLoader();
+    const pluginsDir = opts?.pluginsDir ?? import_path12.default.resolve(process.cwd(), "plugins");
+    try {
+      import_fs13.default.mkdirSync(pluginsDir, { recursive: true });
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      throw new Error(
+        `[Kernel] FATAL: \u65E0\u6CD5\u521B\u5EFA\u63D2\u4EF6\u76EE\u5F55 ${pluginsDir}\uFF08${detail}\uFF09\u3002\u5BB9\u5668\u8BF7\u628A OPENLEARN_DATA_DIR \u6216 OPENLEARN_PLUGINS_DIR \u6307\u5230\u53EF\u5199\u5377\uFF0C\u4F8B\u5982 /data/plugins\u3002`
+      );
     }
-    const moduleIds = /* @__PURE__ */ new Set();
-    for (const mod of modules) {
-      if (!mod.id) {
-        errors.push({
-          code: "INVALID_MODULE",
-          message: `Module '${mod.name}' has no unique ID.`,
-          target: "module.id"
-        });
-      } else if (moduleIds.has(mod.id)) {
-        errors.push({
-          code: "DUPLICATE_MODULE",
-          message: `Duplicate composition module detected: '${mod.id}'.`,
-          target: "module.id"
-        });
+    this.pluginHost = new PluginHost(this.serviceRegistry, this.esmLoader, this.db, pluginsDir);
+    setPluginNamespaceResolver((namespace) => this.pluginHost.findByManifestId(namespace) ? namespace : void 0);
+    this.workerManager = new WorkerManager(this.serviceRegistry, this.capabilityGuard, this.db);
+    this.pluginHost.setWorkerManager(this.workerManager);
+    const capabilityRegistry = this.aiCapability.registry;
+    this.pluginRuntimeComposition = new PluginRuntimeComposition(this.pluginHost, this.workerManager);
+    this.pluginLifecycleManager = new PluginLifecycleManager(this.pluginHost);
+    this.pluginDistributionManager = new PluginDistributionManager(this.pluginHost);
+    this.unifiedExtensionRegistry = new UnifiedExtensionRegistry();
+    this.capabilityRegistry = capabilityRegistry;
+    this.pluginCapabilityGateway = new PluginCapabilityGateway(capabilityRegistry);
+    this.serviceRegistry.register(IEventBusServiceToken3, this.eventBus);
+    this.serviceRegistry.register(ICapabilityServiceToken, this.capabilityGuard);
+    this.serviceRegistry.register(IStorageServiceToken, this.storageService);
+    this.serviceRegistry.register(ICommandBusServiceToken4, this.commandBus);
+    this.serviceRegistry.register(IActionRegistryServiceToken4, this.actionRegistry);
+    this.serviceRegistry.register(IProcessServiceToken2, this.processManager);
+    this.serviceRegistry.register(IAIServiceToken, this.aiService);
+    this.serviceRegistry.register(IDatabaseToken4, this.db);
+    this.serviceRegistry.register(IPluginHostToken, this.pluginHost);
+    this.serviceRegistry.register(IPluginLifecycleManagerToken, this.pluginLifecycleManager);
+    this.serviceRegistry.register(IPluginDistributionManagerToken, this.pluginDistributionManager);
+    this.serviceRegistry.register(IPluginRuntimeCompositionToken, this.pluginRuntimeComposition);
+    this.serviceRegistry.register(IUnifiedExtensionRegistryToken, this.unifiedExtensionRegistry);
+    this.serviceRegistry.register(IPluginCapabilityGatewayToken, this.pluginCapabilityGateway);
+    this.serviceRegistry.register(ICapabilityRegistryToken, this.capabilityRegistry);
+    this.serviceRegistry.register(ISemesterGradeServiceToken, new SemesterGradeService(this.db));
+    this.serviceRegistry.register(IPointsDimensionRegistryToken, new PointsDimensionRegistry());
+    this.serviceRegistry.register(IPointsLedgerServiceToken, new PointsLedgerService(this.db));
+    this.serviceRegistry.register(IClassRosterServiceToken, new ClassRosterService(this.db));
+    this.serviceRegistry.register(ILessonEngineServiceToken, { getRuntime: async () => this.lessonRuntime });
+    this.serviceRegistry.register(IClassroomRuntimeServiceToken, {
+      getRuntimeKernel: async () => this.classroomRuntime
+    });
+    this.serviceRegistry.register(IPresenceEngineServiceToken, {
+      getPresenceEngine: async () => this.presenceEngine
+    });
+    this.serviceRegistry.register(ITeachingCollaborationServiceToken, {
+      getCollaborationEngine: async () => this.collaborationEngine
+    });
+    this.serviceRegistry.register(ILearningAnalyticsServiceToken, {
+      getAnalyticsEngine: async () => this.analyticsEngine
+    });
+    this.serviceRegistry.register(IAICapabilityServiceToken, {
+      getCapabilityKernel: async () => this.aiCapability
+    });
+    this.serviceRegistry.register(ICapabilityRuntimeServiceToken, {
+      getRuntimeKernel: async () => this.capabilityFrameworkRuntime
+    });
+    this.serviceRegistry.register(ICapabilityGovernanceServiceToken, {
+      getGovernanceKernel: async () => this.capabilityGovernance
+    });
+    this.serviceRegistry.register(IPlatformServiceRegistryToken, {
+      getServiceRegistryKernel: async () => this.platformServiceRegistryKernel
+    });
+    this.serviceRegistry.register(IAuthSessionBridgeToken, new AuthSessionBridgeService(this.db));
+    this.serviceRegistry.register(ICoursewareRuntimeScriptRegistryToken, new CoursewareRuntimeScriptRegistry());
+    this.serviceRegistry.register(IStageGuardServiceToken, defaultStageGuardPipeline);
+    this.serviceRegistry.register(IAssessmentGraderRegistryToken, assessmentGraderRegistry);
+    this.commandBus.setInterceptor(async (command) => {
+      const action = this.actionRegistry.getActionByCommandType(command.type);
+      if (action) {
+        if (action.inputSchema) {
+          const errors = validateJsonSchema(command.payload, action.inputSchema);
+          if (errors.length > 0) {
+            throw new Error(
+              `[PayloadValidationError] Invalid command payload for ${command.type}: ${errors.join("; ")}`
+            );
+          }
+        }
+        const isAdmin = command.actorId === "role:administrator" || command.actorId === "admin" || command.actorId === "usr_admin" || command.actorId === "admin-demo" || typeof command.actorId === "string" && command.actorId.startsWith("user:") && (command.actorId.endsWith(":administrator") || command.actorId.endsWith(":admin"));
+        if (action.capabilityRequired && !isAdmin) {
+          const allowed = this.capabilityGuard.check(command.actorId, action.capabilityRequired);
+          if (!allowed) {
+            const err = new Error(
+              `[CapabilityGuard] Access Denied: Actor ${command.actorId} missing capability ${action.capabilityRequired} for ${command.type}`
+            );
+            err.status = 403;
+            err.code = "COMMAND_CAPABILITY_DENIED";
+            throw err;
+          }
+        }
+        const pluginSuppliedApproval = typeof command.actorId === "string" && command.actorId.startsWith("plugin:");
+        if (action.isHighRisk && (command.metadata?.approved !== true || pluginSuppliedApproval)) {
+          if (isAdmin && !pluginSuppliedApproval) {
+            console.log(
+              `[Security] Command ${command.type} initiated by Administrator (${command.actorId}). Bypassing human approval.`
+            );
+          } else {
+            const stmt = this.db.prepare(
+              "INSERT INTO pending_commands (id, command_type, payload, actor_id, created_at) VALUES (?, ?, ?, ?, ?)"
+            );
+            stmt.run(command.id, command.type, JSON.stringify(command.payload), command.actorId, Date.now());
+            this.eventBus.publish({
+              id: (0, import_uuid15.v7)(),
+              type: "approval.requested",
+              source: "kernel.security",
+              payload: { commandId: command.id, commandType: command.type },
+              timestamp: Date.now(),
+              correlationId: command.id
+            });
+            throw new Error(
+              `[Security] Command ${command.type} requires human approval. It has been queued to pending actions.`
+            );
+          }
+        }
       } else {
-        moduleIds.add(mod.id);
+        const err = new Error(
+          `[Security] Command "${command.type}" has no registered action descriptor and is denied by default. Only commands registered via actionRegistry.register() may be dispatched. If you own this command, register an ActionDescriptor (capabilityRequired + inputSchema).`
+        );
+        err.status = 403;
+        err.code = "COMMAND_NOT_REGISTERED";
+        throw err;
+      }
+    });
+    Promise.resolve().then(() => (init_context_builder(), context_builder_exports)).then((m) => m.bootstrapSharedModules()).catch((err) => {
+      console.warn("[Kernel] Failed to bootstrap shared modules:", err.message);
+    });
+    this.ready = this.bootstrapSystemPlugins().catch((err) => {
+      console.error("[Kernel] Critical system plugin bootstrap failed:", err);
+      process.exit(1);
+    });
+    if (process.env.NODE_ENV === "development") {
+      const watchDir = this.pluginHost.getPluginsDir();
+      try {
+        const hotReload = new HotReloadController(this.pluginHost, watchDir);
+        this.pluginHost.setHotReloadController(hotReload);
+        hotReload.start().catch((err) => {
+          console.warn("[Kernel] Hot reload initialization failed:", err.message);
+        });
+      } catch (err) {
+        console.warn("[Kernel] Hot reload initialization failed:", err.message);
       }
     }
-    return {
-      isValid: errors.length === 0,
-      errors: Object.freeze(errors),
-      warnings: Object.freeze(warnings)
-    };
   }
-};
-
-// packages/core/bootstrap/builder/builder-validation-engine.ts
-var BuilderValidationEngine = class {
-  static validate(config, environment, stages) {
-    const errors = [];
-    const warnings = [];
-    if (!["development", "production", "test"].includes(environment)) {
-      errors.push({
-        code: "INVALID_ENVIRONMENT",
-        message: `Environment must be one of 'development', 'production', 'test'. Received: '${environment}'`,
-        field: "environment"
-      });
+  async bootstrapSystemPlugins() {
+    await this.migratePluginsToFilesystem();
+    const systemPlugins = [
+      { id: "@openlearn/plugin-vfs", mod: VfsPlugin, name: "Virtual File System Plugin", critical: true },
+      { id: "@openlearn/plugin-process", mod: ProcessPlugin, name: "Background Process Plugin", critical: true },
+      { id: "@openlearn/plugin-management", mod: ManagementPlugin, name: "LMS Management Plugin", critical: true },
+      { id: "@openlearn/plugin-builtin", mod: BuiltinPlugin, name: "Classroom Builtin Plugin", critical: true },
+      { id: "@openlearn/plugin-ai-planner", mod: AiPlannerPlugin, name: "AI Planner Plugin", critical: false },
+      {
+        id: "@openlearn/plugin-ai-submit-injector",
+        mod: AiSubmitInjectorPlugin,
+        name: "AI Submit Injector Plugin",
+        critical: false
+      },
+      {
+        id: "@openlearn/plugin-assignment-eval",
+        mod: AssignmentEvalPlugin,
+        name: "Assignment Evaluation and Peer Review Plugin",
+        critical: false
+      }
+    ];
+    for (const plugin of systemPlugins) {
+      try {
+        let row = this.db.prepare("SELECT id FROM plugins WHERE id = ?").get(plugin.id);
+        if (!row) {
+          this.db.prepare(
+            "INSERT INTO plugins (id, name, manifest, source_code, file_path, status, created_at, loader_version, execution_mode) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
+          ).run(
+            plugin.id,
+            plugin.name,
+            JSON.stringify(plugin.mod.manifest),
+            "",
+            // source_code: system plugins are preloaded in-memory
+            null,
+            // file_path: system plugins have no file
+            "installed",
+            Date.now(),
+            "esm",
+            "inline"
+          );
+        }
+        this.pluginHost.registerPreloadedPlugin(
+          plugin.id,
+          plugin.mod
+        );
+        await this.pluginHost.activatePlugin(plugin.id);
+      } catch (err) {
+        if (plugin.critical) {
+          console.error(`[Kernel] Failed to bootstrap critical system plugin ${plugin.name}:`, err);
+          throw err;
+        } else {
+          console.warn(`[Kernel] Soft-fail: Failed to bootstrap AI system plugin ${plugin.name}:`, err);
+        }
+      }
     }
-    if (!config.port || config.port <= 0 || config.port > 65535) {
-      errors.push({
-        code: "INVALID_PORT",
-        message: `Port must be a valid number between 1 and 65535. Received: ${config.port}`,
-        field: "port"
-      });
+    try {
+      await this.pluginHost.restoreActivePlugins();
+    } catch (err) {
+      console.error("[Kernel] Failed to restore active plugins:", err);
     }
-    if (!stages || stages.length === 0) {
-      errors.push({
-        code: "MISSING_STAGES",
-        message: "Bootstrap pipeline contains no registered stages.",
-        field: "stages"
-      });
-    } else {
-      const stageIds = /* @__PURE__ */ new Set();
-      for (const stage of stages) {
-        if (!stage.id) {
-          errors.push({
-            code: "INVALID_STAGE",
-            message: `Stage '${stage.name}' has no unique ID.`
-          });
-        } else if (stageIds.has(stage.id)) {
-          errors.push({
-            code: "DUPLICATE_STAGE",
-            message: `Duplicate stage registration detected for stage ID '${stage.id}'.`,
-            field: "stage.id"
-          });
-        } else {
-          stageIds.add(stage.id);
+  }
+  /**
+   * Phase 7: 将 DB 中存有 source_code 的旧插件迁移到文件系统（幂等）
+   */
+  async migratePluginsToFilesystem() {
+    const plugins = this.db.prepare("SELECT id, source_code, manifest FROM plugins WHERE source_code != '' AND source_code IS NOT NULL").all();
+    if (plugins.length === 0) return;
+    console.log(`[Migration] Found ${plugins.length} plugin(s) to migrate to filesystem`);
+    const pluginsDir = this.pluginHost.getPluginsDir();
+    for (const p of plugins) {
+      const pluginDir = import_path12.default.join(pluginsDir, p.id);
+      const indexPath = import_path12.default.join(pluginDir, "index.js");
+      const manifestPath = import_path12.default.join(pluginDir, "manifest.json");
+      if (import_fs13.default.existsSync(indexPath)) {
+        this.db.prepare("UPDATE plugins SET source_code = ?, file_path = ? WHERE id = ?").run("", indexPath, p.id);
+        continue;
+      }
+      try {
+        import_fs13.default.mkdirSync(pluginDir, { recursive: true });
+        import_fs13.default.writeFileSync(indexPath, p.source_code, "utf-8");
+        if (!import_fs13.default.existsSync(manifestPath)) {
+          import_fs13.default.writeFileSync(manifestPath, p.manifest, "utf-8");
         }
+        this.db.prepare("UPDATE plugins SET source_code = ?, file_path = ? WHERE id = ?").run("", indexPath, p.id);
+        console.log(`[Migration] Plugin "${p.id}" migrated to ${indexPath}`);
+      } catch (err) {
+        console.error(`[Migration] Failed to migrate plugin "${p.id}":`, err);
       }
     }
-    return {
-      isValid: errors.length === 0,
-      errors: Object.freeze(errors),
-      warnings: Object.freeze(warnings)
-    };
+    console.log("[Migration] Plugin migration complete");
   }
-};
-
-// packages/core/bootstrap/types/index.ts
-var PlatformBootstrapError = class extends Error {
-  constructor(message, stage, cause) {
-    super(`[PlatformBootstrapError${stage ? `:${stage}` : ""}] ${message}`);
-    this.stage = stage;
-    this.cause = cause;
-    this.name = "PlatformBootstrapError";
+  // Subscribe to all events and log them to DB
+  initAuditLog() {
+    let stmt = null;
+    let hasLessonIdColumn = null;
+    this.eventBus.subscribe("*", (event) => {
+      const values = [
+        event.id,
+        event.type,
+        event.source,
+        JSON.stringify(redactPasscodeMaterial(event.payload)),
+        event.timestamp,
+        event.correlationId || null
+      ];
+      if (hasLessonIdColumn === null) {
+        const columns = this.db.prepare("PRAGMA table_info(events)").all();
+        hasLessonIdColumn = columns.some((c) => c.name === "lesson_id");
+        stmt = this.db.prepare(hasLessonIdColumn ? INSERT_EVENT_WITH_LESSON : INSERT_EVENT_LEGACY);
+      }
+      if (hasLessonIdColumn) {
+        stmt.run(...values, extractEventLessonId(event.payload));
+      } else {
+        stmt.run(...values);
+      }
+    });
   }
 };
-var ConfigurationError = class extends PlatformBootstrapError {
-  constructor(message, cause) {
-    super(message, "Configuring" /* Configuring */, cause);
-    this.name = "ConfigurationError";
+var INSERT_EVENT_WITH_LESSON = "INSERT INTO events (id, type, source, payload, timestamp, correlationId, lesson_id) VALUES (?, ?, ?, ?, ?, ?, ?)";
+var INSERT_EVENT_LEGACY = "INSERT INTO events (id, type, source, payload, timestamp, correlationId) VALUES (?, ?, ?, ?, ?, ?)";
+function extractEventLessonId(payload) {
+  if (!payload || typeof payload !== "object") return null;
+  const record = payload;
+  for (const key of ["lessonId", "lesson_id"]) {
+    const value = record[key];
+    if (typeof value === "string" && value.length > 0) return value;
   }
-};
-var StartupTimeoutError = class extends PlatformBootstrapError {
-  constructor(message, stage, cause) {
-    super(message, stage, cause);
-    this.name = "StartupTimeoutError";
+  return null;
+}
+function resolvePluginsDirOverride() {
+  const raw = process.env.OPENLEARN_PLUGINS_DIR;
+  if (typeof raw === "string" && raw.length > 0) return raw;
+  const dataDir = process.env.OPENLEARN_DATA_DIR?.trim();
+  if (dataDir) return import_path12.default.join(import_path12.default.resolve(dataDir), "plugins");
+  if (process.env.VITEST) {
+    throw new Error(
+      "[H-1] \u6D4B\u8BD5\u73AF\u5883\u4E0B\u672A\u80FD\u786E\u5B9A\u63D2\u4EF6\u76EE\u5F55\uFF0C\u62D2\u7EDD\u56DE\u9000\u5230 process.cwd()/plugins\u3002\n  \u539F\u56E0\uFF1A\u56DE\u9000\u4F1A\u628A\u63D2\u4EF6\u4EA7\u7269\u5199\u8FDB\u4ED3\u5E93\u5DE5\u4F5C\u6811\uFF1B\u8BE5\u76EE\u5F55\u88AB .gitignore \u5FFD\u7565\uFF0C\u6C61\u67D3\u5B8C\u5168\u9690\u5F62\u3002\n  \u4FEE\u6CD5\uFF08\u62E9\u4E00\uFF09\uFF1A\n    1. \u8BE5\u6D4B\u8BD5\u81EA\u5DF1 new Kernel({ pluginsDir })\uFF0C\u7528 __tests__/helpers/plugins-dir \u7684\n       createPluginsDir('\u7528\u9014') \u53D6\u5F97\uFF0C\u5E76\u5728 afterEach \u91CC cleanupPluginsDir\uFF1B\n    2. \u82E5\u7528\u7684\u662F kernelContainer \u5355\u4F8B\uFF0C\u786E\u8BA4\u5B83\u662F\u5728 vitest.setup.ts \u8D4B\u503C\n       OPENLEARN_PLUGINS_DIR \u4E4B\u540E\u624D\u88AB\u9996\u6B21\u8BBF\u95EE\u3002"
+    );
   }
-};
-var PLATFORM_VERSION2 = PLATFORM_VERSION;
-var BOOTSTRAP_STAGE_NAMES = Object.freeze([
-  "Created" /* Created */,
-  "Configuring" /* Configuring */,
-  "Registering" /* Registering */,
-  "Initializing" /* Initializing */,
-  "Activating" /* Activating */,
-  "Ready" /* Ready */,
-  "ShuttingDown" /* ShuttingDown */,
-  "Disposed" /* Disposed */
-]);
-var DEFAULT_BOOTSTRAP_CONFIG = Object.freeze({
-  environment: "development",
-  mode: "standalone",
-  port: 9e3,
-  debug: false,
-  pluginsDir: "./plugins",
-  dbPath: "./packages/core/db/educational_os.db"
-});
-
-// packages/core/bootstrap/pipeline/pipeline-executor.ts
-var PipelineExecutor = class {
-  constructor() {
-    this.listeners = /* @__PURE__ */ new Set();
+  return void 0;
+}
+var _kernelContainer;
+function ensureKernelContainer() {
+  if (!_kernelContainer) {
+    _kernelContainer = new Kernel({ pluginsDir: resolvePluginsDirOverride() });
+    _kernelContainer.initAuditLog();
   }
-  addListener(listener) {
-    this.listeners.add(listener);
-    return () => {
-      this.listeners.delete(listener);
-    };
+  return _kernelContainer;
+}
+var kernelContainer = new Proxy({}, {
+  get(target, prop, receiver) {
+    return Reflect.get(ensureKernelContainer(), prop, receiver);
+  },
+  set(target, prop, value, receiver) {
+    return Reflect.set(ensureKernelContainer(), prop, value, receiver);
   }
-  emit(event) {
-    for (const listener of Array.from(this.listeners)) {
-      try {
-        listener(event);
-      } catch (err) {
-        console.error("[PipelineExecutor] Listener error:", err);
-      }
-    }
-  }
-  async execute(stages, context) {
-    const startTime = Date.now();
-    const results = [];
-    const executedStages = [];
-    this.emit({ type: "PipelineStarted", timestamp: startTime });
-    console.log("[Platform] Starting Bootstrap Pipeline execution...");
-    for (const stage of stages) {
-      if (context.isCancelled) {
-        console.warn(`[Platform] Pipeline cancelled before stage ${stage.name}`);
-        const totalDurationMs2 = Date.now() - startTime;
-        return {
-          totalDurationMs: totalDurationMs2,
-          status: "Aborted",
-          stageResults: Object.freeze(results)
-        };
-      }
-      console.log(`[Platform] Entering ${stage.name}`);
-      this.emit({
-        type: "StageStarted",
-        timestamp: Date.now(),
-        stageId: stage.id,
-        stageName: String(stage.name)
-      });
-      const stageStart = Date.now();
-      try {
-        if (stage.timeoutMs && stage.timeoutMs > 0) {
-          await this.executeWithTimeout(stage, context, stage.timeoutMs);
-        } else {
-          await stage.execute(context);
-        }
-        const durationMs = Date.now() - stageStart;
-        console.log(`[Platform] Completed ${stage.name} (${durationMs} ms)`);
-        results.push({
-          stageId: stage.id,
-          stageName: String(stage.name),
-          durationMs,
-          status: "Success"
-        });
-        executedStages.push(stage);
-        this.emit({
-          type: "StageCompleted",
-          timestamp: Date.now(),
-          stageId: stage.id,
-          stageName: String(stage.name),
-          durationMs
-        });
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        const durationMs = Date.now() - stageStart;
-        console.error(`[Platform] Failed ${stage.name} (${durationMs} ms): ${error.message}`);
-        results.push({
-          stageId: stage.id,
-          stageName: String(stage.name),
-          durationMs,
-          status: "Failed",
-          error
-        });
-        this.emit({
-          type: "StageFailed",
-          timestamp: Date.now(),
-          stageId: stage.id,
-          stageName: String(stage.name),
-          durationMs,
-          error
-        });
-        await this.rollbackExecutedStages(executedStages, context);
-        const totalDurationMs2 = Date.now() - startTime;
-        const pipelineResult = {
-          totalDurationMs: totalDurationMs2,
-          status: "Failed",
-          stageResults: Object.freeze(results),
-          failedStage: stage.id,
-          error
-        };
-        this.emit({
-          type: "PipelineCompleted",
-          timestamp: Date.now(),
-          durationMs: totalDurationMs2,
-          error
-        });
-        return pipelineResult;
-      }
-    }
-    const totalDurationMs = Date.now() - startTime;
-    console.log(`[Platform] Ready. Total startup duration: ${totalDurationMs} ms.`);
-    const finalResult = {
-      totalDurationMs,
-      status: "Success",
-      stageResults: Object.freeze(results)
-    };
-    this.emit({
-      type: "PipelineCompleted",
-      timestamp: Date.now(),
-      durationMs: totalDurationMs
-    });
-    return finalResult;
-  }
-  async executeWithTimeout(stage, context, timeoutMs) {
-    let timer;
-    const timeoutPromise = new Promise((_, reject) => {
-      timer = setTimeout(() => {
-        reject(new StartupTimeoutError(`Stage execution timed out after ${timeoutMs} ms`));
-      }, timeoutMs);
-    });
-    try {
-      await Promise.race([stage.execute(context), timeoutPromise]);
-    } finally {
-      if (timer) {
-        clearTimeout(timer);
-      }
-    }
-  }
-  async rollbackExecutedStages(executedStages, context) {
-    console.log("[Platform] Triggering stage rollbacks...");
-    for (let i = executedStages.length - 1; i >= 0; i--) {
-      const stage = executedStages[i];
-      if (stage.rollback) {
-        try {
-          console.log(`[Platform] Rolling back ${stage.name}`);
-          await stage.rollback(context);
-        } catch (rbErr) {
-          console.error(`[Platform] Error during rollback of ${stage.name}:`, rbErr);
-        }
-      }
-    }
-  }
-};
-
-// packages/core/bootstrap/pipeline/stages/standard-stages.ts
-var StartupStageImpl = class {
-  constructor() {
-    this.id = "stage_startup";
-    this.name = "Created" /* Created */;
-    this.description = "Environment & configuration validation";
-  }
-  async execute(context) {
-    context.setStage("Configuring" /* Configuring */);
-  }
-};
-var RegistrationStageImpl = class {
-  constructor() {
-    this.id = "stage_registration";
-    this.name = "Registering" /* Registering */;
-    this.description = "Core Service Contracts & DI Tokens registration";
-  }
-  async execute(context) {
-    context.setStage("Registering" /* Registering */);
-  }
-};
-var InitializationStageImpl = class {
-  constructor() {
-    this.id = "stage_initialization";
-    this.name = "Initializing" /* Initializing */;
-    this.description = "Subsystem Kernels initialization";
-  }
-  async execute(context) {
-    context.setStage("Initializing" /* Initializing */);
-  }
-};
-var ActivationStageImpl = class {
-  constructor() {
-    this.id = "stage_activation";
-    this.name = "Activating" /* Activating */;
-    this.description = "Plugin Host discovery & ESM plugins activation";
-  }
-  async execute(context) {
-    context.setStage("Activating" /* Activating */);
-  }
-};
-var ReadyStageImpl = class {
-  constructor() {
-    this.id = "stage_ready";
-    this.name = "Ready" /* Ready */;
-    this.description = "HTTP & Socket.IO server readiness";
-  }
-  async execute(context) {
-    context.setStage("Ready" /* Ready */);
-  }
-};
-
-// packages/core/bootstrap/pipeline/bootstrap-pipeline.ts
-var BootstrapPipeline = class {
-  constructor(stages) {
-    this._stages = [];
-    this.executor = new PipelineExecutor();
-    if (stages && stages.length > 0) {
-      this._stages = [...stages];
-    } else {
-      this._stages = [
-        new StartupStageImpl(),
-        new RegistrationStageImpl(),
-        new InitializationStageImpl(),
-        new ActivationStageImpl(),
-        new ReadyStageImpl()
-      ];
-    }
-  }
-  get stages() {
-    return Object.freeze(this._stages);
-  }
-  addStage(stage) {
-    this._stages.push(stage);
-    return this;
-  }
-  addListener(listener) {
-    return this.executor.addListener(listener);
-  }
-  async run(context) {
-    const result = await this.execute(context);
-    if (result.status === "Failed") {
-      throw result.error || new Error(`Bootstrap Pipeline failed at stage: ${result.failedStage}`);
-    }
-  }
-  async execute(context) {
-    return this.executor.execute(this._stages, context);
-  }
-};
-
-// packages/core/bootstrap/builder/platform-builder.ts
-var DefaultPlatformLogger = class {
-  info(message, ...args) {
-    console.log(`[PlatformBuilder:INFO] ${message}`, ...args);
-  }
-  warn(message, ...args) {
-    console.warn(`[PlatformBuilder:WARN] ${message}`, ...args);
-  }
-  error(message, ...args) {
-    console.error(`[PlatformBuilder:ERROR] ${message}`, ...args);
-  }
-  debug(message, ...args) {
-    console.debug(`[PlatformBuilder:DEBUG] ${message}`, ...args);
-  }
-};
-var PlatformBuilder = class _PlatformBuilder {
-  constructor(options) {
-    this._state = "Created";
-    this._config = { ...DEFAULT_BOOTSTRAP_CONFIG };
-    this._logger = new DefaultPlatformLogger();
-    this._environment = "development";
-    this._metadata = /* @__PURE__ */ new Map();
-    this._services = /* @__PURE__ */ new Map();
-    this._capabilities = /* @__PURE__ */ new Map();
-    this._extensions = /* @__PURE__ */ new Map();
-    this._pipeline = new BootstrapPipeline();
-    this._state = "Created";
-    this._logger.info("Builder Started");
-    if (options) {
-      if (options.config) this.withConfiguration(options.config);
-      if (options.logger) this.withLogger(options.logger);
-      if (options.environment) this.withEnvironment(options.environment);
-      if (options.metadata) {
-        for (const [k, v] of Object.entries(options.metadata)) {
-          this.withMetadata(k, v);
-        }
-      }
-    }
-  }
-  static create(options) {
-    return new _PlatformBuilder(options);
-  }
-  get state() {
-    return this._state;
-  }
-  transitionTo(newState) {
-    if (this._state === "Disposed") {
-      throw new Error("PlatformBuilder has been disposed and cannot accept further transitions.");
-    }
-    if (this._state === "Built" && newState !== "Disposed") {
-      throw new Error(`Invalid state transition from Built to ${newState}. Builder is already built.`);
-    }
-    this._state = newState;
-  }
-  withConfiguration(config) {
-    this.transitionTo("Configuring");
-    this._config = { ...this._config, ...config };
-    if (config.environment) {
-      this._environment = config.environment;
-    }
-    this._logger.info("Configuration Loaded");
-    return this;
-  }
-  withLogger(logger2) {
-    this.transitionTo("Configuring");
-    this._logger = logger2;
-    return this;
-  }
-  withEnvironment(env) {
-    this.transitionTo("Configuring");
-    this._environment = env;
-    this._config = { ...this._config, environment: env };
-    return this;
-  }
-  withMetadata(key, value) {
-    this.transitionTo("Configuring");
-    this._metadata.set(key, value);
-    return this;
-  }
-  addBootstrapStage(stage) {
-    this.transitionTo("Configuring");
-    this._pipeline.addStage(stage);
-    return this;
-  }
-  addService(serviceId, instance) {
-    this.transitionTo("Configuring");
-    this._services.set(serviceId, instance);
-    return this;
-  }
-  addCapability(capabilityId, descriptor) {
-    this.transitionTo("Configuring");
-    this._capabilities.set(capabilityId, descriptor);
-    return this;
-  }
-  addExtension(extensionId, extensionSpec) {
-    this.transitionTo("Configuring");
-    this._extensions.set(extensionId, extensionSpec);
-    return this;
-  }
-  buildResult() {
-    const buildStart = Date.now();
-    this.transitionTo("Validating");
-    this._logger.info("Validation Started");
-    const validation = BuilderValidationEngine.validate(this._config, this._environment, this._pipeline.stages);
-    this._logger.info("Validation Completed");
-    if (!validation.isValid) {
-      this._logger.error(`Validation Failed with ${validation.errors.length} errors.`);
-      throw new ConfigurationError(
-        `PlatformBuilder validation failed: ${validation.errors.map((e) => e.message).join("; ")}`
-      );
-    }
-    this.transitionTo("Building");
-    this._logger.info("Build Started");
-    const platformContext = {
-      platformId: `plt_${globalThis.crypto.randomUUID()}`,
-      version: PLATFORM_VERSION2,
-      namespace: "openlearn.core",
-      mode: this._config.mode,
-      environment: {
-        type: this._environment,
-        isDevelopment: this._environment === "development",
-        isProduction: this._environment === "production",
-        isTest: this._environment === "test",
-        isPluginSandbox: false
-      },
-      config: this._config,
-      featureFlags: {
-        isEnabled: () => true,
-        getFlag: (_, def) => def,
-        getAllFlags: () => ({})
-      },
-      runtimeMetadata: {
-        os: process.platform,
-        nodeVersion: process.version,
-        arch: process.arch,
-        processId: process.pid,
-        memoryUsage: process.memoryUsage(),
-        buildVersion: PLATFORM_VERSION2
-      },
-      bootstrapState: "Bootstrapping",
-      logger: this._logger,
-      diagnostics: {
-        getMetrics: () => ({ uptime: 0 }),
-        getSystemStatus: () => ({ isHealthy: true, activeServicesCount: this._services.size, uptimeSeconds: 0 })
-      },
-      serviceLocator: {
-        hasService: (id) => this._services.has(id),
-        getService: (id) => this._services.get(id)
-      },
-      capabilityCatalog: {
-        hasCapability: (id) => this._capabilities.has(id),
-        getCapability: (id) => this._capabilities.get(id)
-      },
-      extensionCatalog: {
-        hasExtension: (id) => this._extensions.has(id),
-        getExtension: (id) => this._extensions.get(id)
-      },
-      eventDispatcher: {
-        dispatch: async () => {
-        }
-      },
-      shutdownToken: {
-        isRequested: false,
-        onShutdown: () => {
-        }
-      }
-    };
-    const buildDurationMs = Date.now() - buildStart;
-    this.transitionTo("Built");
-    this._logger.info(`Build Completed in ${buildDurationMs} ms`);
-    const result = {
-      platformContext,
-      pipeline: this._pipeline,
-      buildDurationMs,
-      validation,
-      metadata: Object.fromEntries(this._metadata.entries()),
-      builderVersion: PLATFORM_VERSION2
-    };
-    return result;
-  }
-  async build() {
-    const res = this.buildResult();
-    return {
-      currentStage: "Created" /* Created */,
-      context: res.platformContext,
-      pipeline: res.pipeline,
-      start: async () => {
-      },
-      shutdown: async () => {
-      },
-      dispose: async () => {
-      }
-    };
-  }
-  async start() {
-    const kernel = await this.build();
-    await kernel.start();
-    return kernel;
-  }
-  async shutdown() {
-    this.transitionTo("Disposed");
-  }
-  dispose() {
-    this._state = "Disposed";
-    this._services.clear();
-    this._capabilities.clear();
-    this._extensions.clear();
-    this._metadata.clear();
-  }
-};
-
-// packages/core/bootstrap/composition/platform-composition-root.ts
-var PlatformCompositionRoot = class _PlatformCompositionRoot {
-  constructor() {
-    this._state = "Created";
-    this._modules = [];
-    this._state = "Created";
-  }
-  static create() {
-    return new _PlatformCompositionRoot();
-  }
-  get state() {
-    return this._state;
-  }
-  registerModule(module2) {
-    if (this._state === "Disposed" || this._state === "Composed") {
-      throw new Error(`Cannot register composition module in state: ${this._state}`);
-    }
-    this._modules.push(module2);
-    return this;
-  }
-  compose(options) {
-    const startTime = Date.now();
-    this._state = "Validating";
-    const opts = options || {};
-    const builder = PlatformBuilder.create();
-    if (opts.config) builder.withConfiguration(opts.config);
-    if (opts.logger) builder.withLogger(opts.logger);
-    if (opts.environment) builder.withEnvironment(opts.environment);
-    const builderResult = builder.buildResult();
-    const validation = CompositionValidator.validate(opts, builderResult.pipeline, this._modules);
-    if (!validation.isValid) {
-      throw new ConfigurationError(
-        `CompositionRoot validation failed: ${validation.errors.map((e) => e.message).join("; ")}`
-      );
-    }
-    this._state = "Composing";
-    for (const mod of this._modules) {
-      mod.compose(opts);
-    }
-    const durationMs = Date.now() - startTime;
-    this._state = "Composed";
-    return {
-      context: builderResult.platformContext,
-      pipeline: builderResult.pipeline,
-      durationMs,
-      validation
-    };
-  }
-  dispose() {
-    this._state = "Disposed";
-    this._modules = [];
-  }
-};
-
-// packages/core/bootstrap/permission/permission-registry.ts
-var PermissionRegistry = class {
-  constructor() {
-    this.descriptors = /* @__PURE__ */ new Map();
-  }
-  register(descriptor) {
-    if (!descriptor || !descriptor.id) {
-      throw new Error("PermissionRegistry Error: PermissionDescriptor must have a valid ID.");
-    }
-    if (this.descriptors.has(descriptor.id)) {
-      throw new Error(`PermissionRegistry Collision: Permission '${descriptor.id}' is already registered.`);
-    }
-    this.descriptors.set(descriptor.id, Object.freeze({ ...descriptor }));
-  }
-  unregister(permissionId) {
-    return this.descriptors.delete(permissionId);
-  }
-  get(permissionId) {
-    return this.descriptors.get(permissionId);
-  }
-  exists(permissionId) {
-    return this.descriptors.has(permissionId);
-  }
-  list() {
-    return Object.freeze(Array.from(this.descriptors.values()));
-  }
-  clear() {
-    this.descriptors.clear();
-  }
-};
-
-// packages/core/bootstrap/permission/permission-evaluator.ts
-var PermissionEvaluator = class {
-  static async evaluate(subject, permission, explicitGrants, descriptor, providers) {
-    const evaluatedAt = Date.now();
-    const grantKey = `${subject}::${permission}`;
-    if (explicitGrants.has(grantKey)) {
-      const policy = explicitGrants.get(grantKey);
-      if (policy === "Allow") {
-        return { allowed: true, policy: "Allow", reason: "Explicitly granted to subject", evaluatedAt };
-      }
-      if (policy === "Deny") {
-        return { allowed: false, policy: "Deny", reason: "Explicitly denied to subject", evaluatedAt };
-      }
-    }
-    if (providers && providers.length > 0) {
-      for (const provider of providers) {
-        const policy = await provider.getPolicy(subject, permission);
-        if (policy === "Allow") {
-          return { allowed: true, policy: "Allow", reason: `Granted by provider '${provider.id}'`, evaluatedAt };
-        }
-        if (policy === "Deny") {
-          return { allowed: false, policy: "Deny", reason: `Denied by provider '${provider.id}'`, evaluatedAt };
-        }
-      }
-    }
-    if (descriptor && descriptor.defaultPolicy) {
-      const defaultPol = descriptor.defaultPolicy;
-      if (defaultPol === "Allow") {
-        return { allowed: true, policy: "Allow", reason: "Allowed by descriptor default policy", evaluatedAt };
-      }
-      if (defaultPol === "Deny") {
-        return { allowed: false, policy: "Deny", reason: "Denied by descriptor default policy", evaluatedAt };
-      }
-    }
-    return {
-      allowed: false,
-      policy: "Default",
-      reason: "No explicit allow policy resolved; default deny",
-      evaluatedAt
-    };
-  }
-};
-
-// packages/core/bootstrap/permission/permission-manager.ts
-var PermissionManager = class {
-  constructor() {
-    this.registry = new PermissionRegistry();
-    this.grants = /* @__PURE__ */ new Map();
-    this.providers = [];
-  }
-  register(descriptor) {
-    this.registry.register(descriptor);
-  }
-  unregister(permissionId) {
-    return this.registry.unregister(permissionId);
-  }
-  grant(subject, permissionId, policy = "Allow") {
-    const key = `${subject}::${permissionId}`;
-    this.grants.set(key, policy);
-  }
-  revoke(subject, permissionId) {
-    const key = `${subject}::${permissionId}`;
-    this.grants.delete(key);
-  }
-  addProvider(provider) {
-    if (!this.providers.some((p) => p.id === provider.id)) {
-      this.providers.push(provider);
-    }
-  }
-  removeProvider(providerId) {
-    this.providers = this.providers.filter((p) => p.id !== providerId);
-  }
-  exists(permissionId) {
-    return this.registry.exists(permissionId);
-  }
-  list() {
-    return this.registry.list();
-  }
-  async check(subject, target, permissionId, metadata) {
-    const timestamp = Date.now();
-    const descriptor = this.registry.get(permissionId);
-    const result = await PermissionEvaluator.evaluate(subject, permissionId, this.grants, descriptor, this.providers);
-    const context = {
-      subject,
-      target,
-      permission: permissionId,
-      metadata,
-      timestamp,
-      result
-    };
-    return context;
-  }
-  async require(subject, target, permissionId, metadata) {
-    const context = await this.check(subject, target, permissionId, metadata);
-    if (!context.result || !context.result.allowed) {
-      const reason = context.result?.reason || "Permission Denied";
-      throw new Error(
-        `Infrastructure Permission Exception: Subject '${subject}' is denied '${permissionId}' on target '${target}'. Reason: ${reason}`
-      );
-    }
-    return context;
-  }
-  clear() {
-    this.registry.clear();
-    this.grants.clear();
-    this.providers = [];
-  }
-};
-
-// packages/core/bootstrap/composition/plugin-composition-module.ts
-var _sharedPlatformRegistry;
-function getPlatformServiceRegistry() {
-  if (!_sharedPlatformRegistry) {
-    _sharedPlatformRegistry = new PlatformServiceRegistry();
-  }
-  return _sharedPlatformRegistry;
-}
-var PluginCompositionModule = class {
-  constructor() {
-    this.id = "mod_plugin_composition";
-    this.name = "PluginCompositionModule";
-  }
-  compose(options) {
-    const serviceRegistry = getPlatformServiceRegistry();
-    const registerOrReplace = (config) => {
-      const { id, instance } = config;
-      if (serviceRegistry.has(id)) {
-        serviceRegistry.replace(id, instance);
-      } else {
-        serviceRegistry.register({ id }, instance);
-      }
-    };
-    const capabilityRegistry = new CapabilityRegistry();
-    const permissionManager = new PermissionManager();
-    const eventBus = new EventBus();
-    const realPluginHost = options?.infrastructureRefs?.get("pluginHost") ?? {
-      name: "PluginHostService",
-      isReady: true,
-      pluginsCount: 0
-    };
-    const realContributionRegistry = options?.infrastructureRefs?.get("contributionRegistry") ?? {
-      name: "ContributionRegistry",
-      slotsCount: 0
-    };
-    const realRuntimeComposition = options?.infrastructureRefs?.get("runtimeComposition") ?? {
-      name: "PluginRuntimeComposition",
-      isStarted: true
-    };
-    const realLifecycleManager = options?.infrastructureRefs?.get("lifecycleManager") ?? {
-      name: "PluginLifecycleManager",
-      version: PLATFORM_VERSION
-    };
-    const realCapabilityGateway = options?.infrastructureRefs?.get("capabilityGateway") ?? {
-      name: "PluginCapabilityGateway",
-      version: PLATFORM_VERSION
-    };
-    const realExtensionRegistry = options?.infrastructureRefs?.get("extensionRegistry") ?? {
-      name: "UnifiedExtensionRegistry",
-      version: PLATFORM_VERSION
-    };
-    const realDistributionManager = options?.infrastructureRefs?.get("distributionManager") ?? {
-      name: "PluginDistributionManager",
-      version: PLATFORM_VERSION
-    };
-    registerOrReplace({
-      id: "srv_plugin_host",
-      lifetime: "Singleton",
-      description: "OpenLearn Plugin Host Service Engine",
-      instance: realPluginHost
-    });
-    registerOrReplace({
-      id: "srv_plugin_contribution_registry",
-      lifetime: "Singleton",
-      description: "Plugin UI & Slot Contribution Registry",
-      instance: realContributionRegistry
-    });
-    registerOrReplace({
-      id: "srv_plugin_runtime_composition",
-      lifetime: "Singleton",
-      description: "OpenLearn Plugin Runtime Composition Facade",
-      instance: realRuntimeComposition
-    });
-    registerOrReplace({
-      id: "srv_plugin_lifecycle_manager",
-      lifetime: "Singleton",
-      description: "OpenLearn Unified Plugin Lifecycle Manager",
-      instance: realLifecycleManager
-    });
-    registerOrReplace({
-      id: "srv_plugin_capability_gateway",
-      lifetime: "Singleton",
-      description: "OpenLearn Unified Plugin Capability Gateway",
-      instance: realCapabilityGateway
-    });
-    registerOrReplace({
-      id: "srv_unified_extension_registry",
-      lifetime: "Singleton",
-      description: "OpenLearn Unified Extension Registry Foundation",
-      instance: realExtensionRegistry
-    });
-    registerOrReplace({
-      id: "srv_plugin_distribution_manager",
-      lifetime: "Singleton",
-      description: "OpenLearn Plugin Distribution Manager Foundation",
-      instance: realDistributionManager
-    });
-    permissionManager.register({
-      id: "perm_plugin_execute",
-      name: "Plugin Execution Permission",
-      category: "Infrastructure",
-      description: "Allows plugin sandbox execution within Platform",
-      defaultPolicy: "Allow"
-    });
-    permissionManager.register({
-      id: "perm_plugin_install",
-      name: "Plugin Installation Permission",
-      category: "Infrastructure",
-      description: "Allows installing new plugin packages into storage",
-      defaultPolicy: "Allow"
-    });
-    eventBus.publish({
-      id: `evt_${globalThis.crypto.randomUUID()}`,
-      type: "PluginHostInitialized",
-      source: "PluginCompositionModule",
-      payload: { timestamp: Date.now(), status: "Ready" },
-      timestamp: Date.now()
-    });
-    eventBus.publish({
-      id: `evt_${globalThis.crypto.randomUUID()}`,
-      type: "PluginLoaded",
-      source: "PluginCompositionModule",
-      payload: { timestamp: Date.now(), pluginsLoaded: 0 },
-      timestamp: Date.now()
-    });
-    eventBus.publish({
-      id: `evt_${globalThis.crypto.randomUUID()}`,
-      type: "PluginActivated",
-      source: "PluginCompositionModule",
-      payload: { timestamp: Date.now(), activePlugins: [] },
-      timestamp: Date.now()
-    });
-  }
-};
-
-// packages/core/kernel/index.ts
-var import_path12 = __toESM(require("path"), 1);
-var Kernel = class {
-  /**
-   * @param opts.pluginsDir - 插件产物目录。生产默认 `<cwd>/plugins`；
-   *   测试**必须**显式传入临时目录，否则插件产物会落进工作树。
-   *
-   * ## 为什么要开这个口子（H-1）
-   *
-   * 原本这里硬编码 `path.resolve(process.cwd(), 'plugins')` 且不可覆盖。
-   * 后果不只是「测试会弄脏工作树」，更根本的是 **Kernel 在这个维度上不可测** ——
-   * 没有任何办法在测试里把插件产物引到别处，于是污染一直无人察觉：
-   * 实测仓库 `plugins/` 下积累了 **1705 个孤儿目录 / 24MB**，且每次 `pnpm test` 继续增长。
-   * 该目录被 `.gitignore` 忽略，所以 `git status` 完全看不见。
-   *
-   * 加可选参数后，生产行为**逐字节不变**（默认值相同），而测试可把产物引到
-   * `os.tmpdir()`。`vitest.setup.ts` 的全局守卫会把「仍写工作树」变成硬失败，
-   * 防止将来有人再引入同类调用。
-   */
-  constructor(opts) {
-    this.db = db;
-    this.readPool = readPool;
-    this.getReadDb = getReadDb;
-    this.queryRead = queryRead;
-    this.queryReadOne = queryReadOne;
-    this.checkpoint = checkpoint;
-    this.eventBus = new EventBus();
-    this.capabilityGuard = new CapabilityGuard();
-    this.serviceRegistry = new ServiceRegistry();
-    this.storageService = new StorageService(this.db);
-    this.aiService = new AIService(this.db);
-    this.aiRuntime = new AIRuntimeKernel();
-    this.aiCapability = new AICapabilityKernel(this.aiRuntime);
-    this.capabilityFrameworkRuntime = new CapabilityRuntimeKernel(this.aiCapability);
-    this.capabilityGovernance = new CapabilityGovernanceKernel();
-    this.platformServiceRegistryKernel = new ServiceRegistryKernel();
-    this.analyticsEngine = new AnalyticsEngineKernel();
-    this.collaborationEngine = new CollaborationEngineKernel();
-    this.presenceEngine = new PresenceEngineKernel();
-    this.classroomRuntime = new ClassroomRuntimeKernel();
-    this.lessonRuntime = new LessonRuntime({ eventBus: this.eventBus });
-    this.lessonRuntime.aiInterface.setAIService(this.aiService);
-    this.commandBus = new CommandBus(this.eventBus);
-    this.actionRegistry = new ActionRegistry();
-    this.processManager = new ProcessManager(this);
-    this.esmLoader = new NodeEsmLoader();
-    const pluginsDir = opts?.pluginsDir ?? import_path12.default.resolve(process.cwd(), "plugins");
-    try {
-      import_fs13.default.mkdirSync(pluginsDir, { recursive: true });
-    } catch (err) {
-      const detail = err instanceof Error ? err.message : String(err);
-      throw new Error(
-        `[Kernel] FATAL: \u65E0\u6CD5\u521B\u5EFA\u63D2\u4EF6\u76EE\u5F55 ${pluginsDir}\uFF08${detail}\uFF09\u3002\u5BB9\u5668\u8BF7\u628A OPENLEARN_DATA_DIR \u6216 OPENLEARN_PLUGINS_DIR \u6307\u5230\u53EF\u5199\u5377\uFF0C\u4F8B\u5982 /data/plugins\u3002`
-      );
-    }
-    this.pluginHost = new PluginHost(this.serviceRegistry, this.esmLoader, this.db, pluginsDir);
-    setPluginNamespaceResolver((namespace) => this.pluginHost.findByManifestId(namespace) ? namespace : void 0);
-    this.workerManager = new WorkerManager(this.serviceRegistry, this.capabilityGuard, this.db);
-    this.pluginHost.setWorkerManager(this.workerManager);
-    const capabilityRegistry = this.aiCapability.registry;
-    this.pluginRuntimeComposition = new PluginRuntimeComposition(this.pluginHost, this.workerManager);
-    this.pluginLifecycleManager = new PluginLifecycleManager(this.pluginHost);
-    this.pluginDistributionManager = new PluginDistributionManager(this.pluginHost);
-    this.unifiedExtensionRegistry = new UnifiedExtensionRegistry();
-    this.capabilityRegistry = capabilityRegistry;
-    this.pluginCapabilityGateway = new PluginCapabilityGateway(capabilityRegistry);
-    const infrastructureRefs = /* @__PURE__ */ new Map([
-      ["pluginHost", this.pluginHost],
-      ["contributionRegistry", this.pluginHost.getContributionRegistry()],
-      ["runtimeComposition", this.pluginRuntimeComposition],
-      ["lifecycleManager", this.pluginLifecycleManager],
-      ["capabilityGateway", this.pluginCapabilityGateway],
-      ["extensionRegistry", this.unifiedExtensionRegistry],
-      ["distributionManager", this.pluginDistributionManager]
-    ]);
-    try {
-      PlatformCompositionRoot.create().registerModule(new PluginCompositionModule()).compose({ infrastructureRefs });
-    } catch (e) {
-      console.warn("[P7-A2] Plugin composition failed (non-fatal):", e.message);
-    }
-    this.serviceRegistry.register(IEventBusServiceToken3, this.eventBus);
-    this.serviceRegistry.register(ICapabilityServiceToken, this.capabilityGuard);
-    this.serviceRegistry.register(IStorageServiceToken, this.storageService);
-    this.serviceRegistry.register(ICommandBusServiceToken4, this.commandBus);
-    this.serviceRegistry.register(IActionRegistryServiceToken4, this.actionRegistry);
-    this.serviceRegistry.register(IProcessServiceToken2, this.processManager);
-    this.serviceRegistry.register(IAIServiceToken, this.aiService);
-    this.serviceRegistry.register(IDatabaseToken4, this.db);
-    this.serviceRegistry.register(IPluginHostToken, this.pluginHost);
-    this.serviceRegistry.register(IPluginLifecycleManagerToken, this.pluginLifecycleManager);
-    this.serviceRegistry.register(IPluginDistributionManagerToken, this.pluginDistributionManager);
-    this.serviceRegistry.register(IPluginRuntimeCompositionToken, this.pluginRuntimeComposition);
-    this.serviceRegistry.register(IUnifiedExtensionRegistryToken, this.unifiedExtensionRegistry);
-    this.serviceRegistry.register(IPluginCapabilityGatewayToken, this.pluginCapabilityGateway);
-    this.serviceRegistry.register(ICapabilityRegistryToken, this.capabilityRegistry);
-    this.serviceRegistry.register(ISemesterGradeServiceToken, new SemesterGradeService(this.db));
-    this.serviceRegistry.register(IPointsDimensionRegistryToken, new PointsDimensionRegistry());
-    this.serviceRegistry.register(IPointsLedgerServiceToken, new PointsLedgerService(this.db));
-    this.serviceRegistry.register(IClassRosterServiceToken, new ClassRosterService(this.db));
-    this.serviceRegistry.register(ILessonEngineServiceToken, { getRuntime: async () => this.lessonRuntime });
-    this.serviceRegistry.register(IClassroomRuntimeServiceToken, {
-      getRuntimeKernel: async () => this.classroomRuntime
-    });
-    this.serviceRegistry.register(IPresenceEngineServiceToken, {
-      getPresenceEngine: async () => this.presenceEngine
-    });
-    this.serviceRegistry.register(ITeachingCollaborationServiceToken, {
-      getCollaborationEngine: async () => this.collaborationEngine
-    });
-    this.serviceRegistry.register(ILearningAnalyticsServiceToken, {
-      getAnalyticsEngine: async () => this.analyticsEngine
-    });
-    this.serviceRegistry.register(IAICapabilityServiceToken, {
-      getCapabilityKernel: async () => this.aiCapability
-    });
-    this.serviceRegistry.register(ICapabilityRuntimeServiceToken, {
-      getRuntimeKernel: async () => this.capabilityFrameworkRuntime
-    });
-    this.serviceRegistry.register(ICapabilityGovernanceServiceToken, {
-      getGovernanceKernel: async () => this.capabilityGovernance
-    });
-    this.serviceRegistry.register(IPlatformServiceRegistryToken, {
-      getServiceRegistryKernel: async () => this.platformServiceRegistryKernel
-    });
-    this.serviceRegistry.register(IAuthSessionBridgeToken, new AuthSessionBridgeService(this.db));
-    this.serviceRegistry.register(ICoursewareRuntimeScriptRegistryToken, new CoursewareRuntimeScriptRegistry());
-    this.serviceRegistry.register(IStageGuardServiceToken, defaultStageGuardPipeline);
-    this.serviceRegistry.register(IAssessmentGraderRegistryToken, assessmentGraderRegistry);
-    this.commandBus.setInterceptor(async (command) => {
-      const action = this.actionRegistry.getActionByCommandType(command.type);
-      if (action) {
-        if (action.inputSchema) {
-          const errors = validateJsonSchema(command.payload, action.inputSchema);
-          if (errors.length > 0) {
-            throw new Error(
-              `[PayloadValidationError] Invalid command payload for ${command.type}: ${errors.join("; ")}`
-            );
-          }
-        }
-        const isAdmin = command.actorId === "role:administrator" || command.actorId === "admin" || command.actorId === "usr_admin" || command.actorId === "admin-demo" || typeof command.actorId === "string" && command.actorId.startsWith("user:") && (command.actorId.endsWith(":administrator") || command.actorId.endsWith(":admin"));
-        if (action.capabilityRequired && !isAdmin) {
-          const allowed = this.capabilityGuard.check(command.actorId, action.capabilityRequired);
-          if (!allowed) {
-            const err = new Error(
-              `[CapabilityGuard] Access Denied: Actor ${command.actorId} missing capability ${action.capabilityRequired} for ${command.type}`
-            );
-            err.status = 403;
-            err.code = "COMMAND_CAPABILITY_DENIED";
-            throw err;
-          }
-        }
-        const pluginSuppliedApproval = typeof command.actorId === "string" && command.actorId.startsWith("plugin:");
-        if (action.isHighRisk && (command.metadata?.approved !== true || pluginSuppliedApproval)) {
-          if (isAdmin && !pluginSuppliedApproval) {
-            console.log(
-              `[Security] Command ${command.type} initiated by Administrator (${command.actorId}). Bypassing human approval.`
-            );
-          } else {
-            const stmt = this.db.prepare(
-              "INSERT INTO pending_commands (id, command_type, payload, actor_id, created_at) VALUES (?, ?, ?, ?, ?)"
-            );
-            stmt.run(command.id, command.type, JSON.stringify(command.payload), command.actorId, Date.now());
-            this.eventBus.publish({
-              id: (0, import_uuid15.v7)(),
-              type: "approval.requested",
-              source: "kernel.security",
-              payload: { commandId: command.id, commandType: command.type },
-              timestamp: Date.now(),
-              correlationId: command.id
-            });
-            throw new Error(
-              `[Security] Command ${command.type} requires human approval. It has been queued to pending actions.`
-            );
-          }
-        }
-      } else {
-        const err = new Error(
-          `[Security] Command "${command.type}" has no registered action descriptor and is denied by default. Only commands registered via actionRegistry.register() may be dispatched. If you own this command, register an ActionDescriptor (capabilityRequired + inputSchema).`
-        );
-        err.status = 403;
-        err.code = "COMMAND_NOT_REGISTERED";
-        throw err;
-      }
-    });
-    Promise.resolve().then(() => (init_context_builder(), context_builder_exports)).then((m) => m.bootstrapSharedModules()).catch((err) => {
-      console.warn("[Kernel] Failed to bootstrap shared modules:", err.message);
-    });
-    this.ready = this.bootstrapSystemPlugins().catch((err) => {
-      console.error("[Kernel] Critical system plugin bootstrap failed:", err);
-      process.exit(1);
-    });
-    if (process.env.NODE_ENV === "development") {
-      const watchDir = this.pluginHost.getPluginsDir();
-      try {
-        const hotReload = new HotReloadController(this.pluginHost, watchDir);
-        this.pluginHost.setHotReloadController(hotReload);
-        hotReload.start().catch((err) => {
-          console.warn("[Kernel] Hot reload initialization failed:", err.message);
-        });
-      } catch (err) {
-        console.warn("[Kernel] Hot reload initialization failed:", err.message);
-      }
-    }
-  }
-  async bootstrapSystemPlugins() {
-    await this.migratePluginsToFilesystem();
-    const systemPlugins = [
-      { id: "@openlearn/plugin-vfs", mod: VfsPlugin, name: "Virtual File System Plugin", critical: true },
-      { id: "@openlearn/plugin-process", mod: ProcessPlugin, name: "Background Process Plugin", critical: true },
-      { id: "@openlearn/plugin-management", mod: ManagementPlugin, name: "LMS Management Plugin", critical: true },
-      { id: "@openlearn/plugin-builtin", mod: BuiltinPlugin, name: "Classroom Builtin Plugin", critical: true },
-      { id: "@openlearn/plugin-ai-planner", mod: AiPlannerPlugin, name: "AI Planner Plugin", critical: false },
-      {
-        id: "@openlearn/plugin-ai-submit-injector",
-        mod: AiSubmitInjectorPlugin,
-        name: "AI Submit Injector Plugin",
-        critical: false
-      },
-      {
-        id: "@openlearn/plugin-assignment-eval",
-        mod: AssignmentEvalPlugin,
-        name: "Assignment Evaluation and Peer Review Plugin",
-        critical: false
-      }
-    ];
-    for (const plugin of systemPlugins) {
-      try {
-        let row = this.db.prepare("SELECT id FROM plugins WHERE id = ?").get(plugin.id);
-        if (!row) {
-          this.db.prepare(
-            "INSERT INTO plugins (id, name, manifest, source_code, file_path, status, created_at, loader_version, execution_mode) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
-          ).run(
-            plugin.id,
-            plugin.name,
-            JSON.stringify(plugin.mod.manifest),
-            "",
-            // source_code: system plugins are preloaded in-memory
-            null,
-            // file_path: system plugins have no file
-            "installed",
-            Date.now(),
-            "esm",
-            "inline"
-          );
-        }
-        this.pluginHost.registerPreloadedPlugin(
-          plugin.id,
-          plugin.mod
-        );
-        await this.pluginHost.activatePlugin(plugin.id);
-      } catch (err) {
-        if (plugin.critical) {
-          console.error(`[Kernel] Failed to bootstrap critical system plugin ${plugin.name}:`, err);
-          throw err;
-        } else {
-          console.warn(`[Kernel] Soft-fail: Failed to bootstrap AI system plugin ${plugin.name}:`, err);
-        }
-      }
-    }
-    try {
-      await this.pluginHost.restoreActivePlugins();
-    } catch (err) {
-      console.error("[Kernel] Failed to restore active plugins:", err);
-    }
-  }
-  /**
-   * Phase 7: 将 DB 中存有 source_code 的旧插件迁移到文件系统（幂等）
-   */
-  async migratePluginsToFilesystem() {
-    const plugins = this.db.prepare("SELECT id, source_code, manifest FROM plugins WHERE source_code != '' AND source_code IS NOT NULL").all();
-    if (plugins.length === 0) return;
-    console.log(`[Migration] Found ${plugins.length} plugin(s) to migrate to filesystem`);
-    const pluginsDir = this.pluginHost.getPluginsDir();
-    for (const p of plugins) {
-      const pluginDir = import_path12.default.join(pluginsDir, p.id);
-      const indexPath = import_path12.default.join(pluginDir, "index.js");
-      const manifestPath = import_path12.default.join(pluginDir, "manifest.json");
-      if (import_fs13.default.existsSync(indexPath)) {
-        this.db.prepare("UPDATE plugins SET source_code = ?, file_path = ? WHERE id = ?").run("", indexPath, p.id);
-        continue;
-      }
-      try {
-        import_fs13.default.mkdirSync(pluginDir, { recursive: true });
-        import_fs13.default.writeFileSync(indexPath, p.source_code, "utf-8");
-        if (!import_fs13.default.existsSync(manifestPath)) {
-          import_fs13.default.writeFileSync(manifestPath, p.manifest, "utf-8");
-        }
-        this.db.prepare("UPDATE plugins SET source_code = ?, file_path = ? WHERE id = ?").run("", indexPath, p.id);
-        console.log(`[Migration] Plugin "${p.id}" migrated to ${indexPath}`);
-      } catch (err) {
-        console.error(`[Migration] Failed to migrate plugin "${p.id}":`, err);
-      }
-    }
-    console.log("[Migration] Plugin migration complete");
-  }
-  // Subscribe to all events and log them to DB
-  initAuditLog() {
-    let stmt = null;
-    let hasLessonIdColumn = null;
-    this.eventBus.subscribe("*", (event) => {
-      const values = [
-        event.id,
-        event.type,
-        event.source,
-        JSON.stringify(redactPasscodeMaterial(event.payload)),
-        event.timestamp,
-        event.correlationId || null
-      ];
-      if (hasLessonIdColumn === null) {
-        const columns = this.db.prepare("PRAGMA table_info(events)").all();
-        hasLessonIdColumn = columns.some((c) => c.name === "lesson_id");
-        stmt = this.db.prepare(hasLessonIdColumn ? INSERT_EVENT_WITH_LESSON : INSERT_EVENT_LEGACY);
-      }
-      if (hasLessonIdColumn) {
-        stmt.run(...values, extractEventLessonId(event.payload));
-      } else {
-        stmt.run(...values);
-      }
-    });
-  }
-};
-var INSERT_EVENT_WITH_LESSON = "INSERT INTO events (id, type, source, payload, timestamp, correlationId, lesson_id) VALUES (?, ?, ?, ?, ?, ?, ?)";
-var INSERT_EVENT_LEGACY = "INSERT INTO events (id, type, source, payload, timestamp, correlationId) VALUES (?, ?, ?, ?, ?, ?)";
-function extractEventLessonId(payload) {
-  if (!payload || typeof payload !== "object") return null;
-  const record = payload;
-  for (const key of ["lessonId", "lesson_id"]) {
-    const value = record[key];
-    if (typeof value === "string" && value.length > 0) return value;
-  }
-  return null;
-}
-function resolvePluginsDirOverride() {
-  const raw = process.env.OPENLEARN_PLUGINS_DIR;
-  if (typeof raw === "string" && raw.length > 0) return raw;
-  const dataDir = process.env.OPENLEARN_DATA_DIR?.trim();
-  if (dataDir) return import_path12.default.join(import_path12.default.resolve(dataDir), "plugins");
-  if (process.env.VITEST) {
-    throw new Error(
-      "[H-1] \u6D4B\u8BD5\u73AF\u5883\u4E0B\u672A\u80FD\u786E\u5B9A\u63D2\u4EF6\u76EE\u5F55\uFF0C\u62D2\u7EDD\u56DE\u9000\u5230 process.cwd()/plugins\u3002\n  \u539F\u56E0\uFF1A\u56DE\u9000\u4F1A\u628A\u63D2\u4EF6\u4EA7\u7269\u5199\u8FDB\u4ED3\u5E93\u5DE5\u4F5C\u6811\uFF1B\u8BE5\u76EE\u5F55\u88AB .gitignore \u5FFD\u7565\uFF0C\u6C61\u67D3\u5B8C\u5168\u9690\u5F62\u3002\n  \u4FEE\u6CD5\uFF08\u62E9\u4E00\uFF09\uFF1A\n    1. \u8BE5\u6D4B\u8BD5\u81EA\u5DF1 new Kernel({ pluginsDir })\uFF0C\u7528 __tests__/helpers/plugins-dir \u7684\n       createPluginsDir('\u7528\u9014') \u53D6\u5F97\uFF0C\u5E76\u5728 afterEach \u91CC cleanupPluginsDir\uFF1B\n    2. \u82E5\u7528\u7684\u662F kernelContainer \u5355\u4F8B\uFF0C\u786E\u8BA4\u5B83\u662F\u5728 vitest.setup.ts \u8D4B\u503C\n       OPENLEARN_PLUGINS_DIR \u4E4B\u540E\u624D\u88AB\u9996\u6B21\u8BBF\u95EE\u3002"
-    );
-  }
-  return void 0;
-}
-var _kernelContainer;
-function ensureKernelContainer() {
-  if (!_kernelContainer) {
-    _kernelContainer = new Kernel({ pluginsDir: resolvePluginsDirOverride() });
-    _kernelContainer.initAuditLog();
-  }
-  return _kernelContainer;
-}
-var kernelContainer = new Proxy({}, {
-  get(target, prop, receiver) {
-    return Reflect.get(ensureKernelContainer(), prop, receiver);
-  },
-  set(target, prop, value, receiver) {
-    return Reflect.set(ensureKernelContainer(), prop, value, receiver);
-  }
-});
-function validateJsonSchema(data, schema) {
-  if (!schema) return [];
-  const errors = [];
-  const type = schema.type;
-  if (type === "OBJECT") {
-    if (typeof data !== "object" || data === null || Array.isArray(data)) {
-      errors.push(`Expected object, got ${typeof data}`);
-      return errors;
-    }
-    if (schema.required && Array.isArray(schema.required)) {
-      for (const req of schema.required) {
-        if (!(req in data) || data[req] === void 0) {
-          errors.push(`Missing required property "${req}"`);
-        }
+});
+function validateJsonSchema(data, schema) {
+  if (!schema) return [];
+  const errors = [];
+  const type = schema.type;
+  if (type === "OBJECT") {
+    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+      errors.push(`Expected object, got ${typeof data}`);
+      return errors;
+    }
+    if (schema.required && Array.isArray(schema.required)) {
+      for (const req of schema.required) {
+        if (!(req in data) || data[req] === void 0) {
+          errors.push(`Missing required property "${req}"`);
+        }
       }
     }
     if (schema.properties && typeof schema.properties === "object") {
@@ -32769,6 +31923,299 @@ var import_helmet = __toESM(require("helmet"), 1);
 
 // server/security/rate-limit.ts
 var import_express_rate_limit = __toESM(require("express-rate-limit"), 1);
+
+// server/security/route-scope.ts
+var AUTH_MIDDLEWARE_MARKER = Symbol.for("openlearn.routeScope.authMiddleware");
+var DATA_SCOPE_MARKER = Symbol.for("openlearn.routeScope.dataScope");
+function markAuthMiddleware(middleware, roles) {
+  Object.defineProperty(middleware, AUTH_MIDDLEWARE_MARKER, {
+    value: { roles: [...roles] },
+    enumerable: false,
+    configurable: true
+  });
+  return middleware;
+}
+function markDataScopeMiddleware(middleware, scope) {
+  Object.defineProperty(middleware, DATA_SCOPE_MARKER, {
+    value: scope,
+    enumerable: false,
+    configurable: true
+  });
+  return middleware;
+}
+function readMarker(handle, marker) {
+  if (typeof handle !== "function") return void 0;
+  return handle[marker];
+}
+function collectAuthRoutes(app) {
+  const router = app._router ?? app.router;
+  const stack = router?.stack ?? [];
+  const result = [];
+  for (const layer of stack) {
+    const route = layer?.route;
+    if (!route) continue;
+    const handles = (route.stack ?? []).map((entry) => entry.handle);
+    const authMeta = handles.map((handle) => readMarker(handle, AUTH_MIDDLEWARE_MARKER)).find(Boolean);
+    if (!authMeta) continue;
+    const scope = handles.map((handle) => readMarker(handle, DATA_SCOPE_MARKER)).find(Boolean);
+    const methods = Object.keys(route.methods ?? {}).filter((method) => method !== "_all" && route.methods[method]).map((method) => method.toUpperCase());
+    for (const method of methods) {
+      result.push({
+        method,
+        path: String(route.path),
+        scope,
+        roles: [...authMeta.roles]
+      });
+    }
+  }
+  return result;
+}
+function isWhitelisted(route, whitelist) {
+  return whitelist.some(
+    (entry) => entry.method.toUpperCase() === route.method && normalizePath2(entry.path) === normalizePath2(route.path)
+  );
+}
+function normalizePath2(path48) {
+  if (!path48) return "/";
+  return path48.endsWith("/") && path48.length > 1 ? path48.slice(0, -1) : path48;
+}
+function auditRouteScopes(app, whitelist = []) {
+  const declared = [];
+  const roleGated = [];
+  const undeclared = [];
+  for (const route of collectAuthRoutes(app)) {
+    if (route.scope) {
+      declared.push(route);
+      continue;
+    }
+    if (route.roles.length > 0) {
+      roleGated.push(route);
+      continue;
+    }
+    if (isWhitelisted(route, whitelist)) continue;
+    undeclared.push(route);
+  }
+  return { declared, roleGated, undeclared };
+}
+function formatRouteScopeViolation(route) {
+  return `${route.method} ${route.path}`;
+}
+function assertRouteDataScopes(app, options = {}) {
+  const logger2 = options.logger ?? console;
+  const audit = auditRouteScopes(app, options.whitelist ?? []);
+  if (audit.undeclared.length > 0) {
+    const lines = audit.undeclared.map(formatRouteScopeViolation);
+    const message = `[RouteScope] ${audit.undeclared.length} \u4E2A\u5DF2\u8BA4\u8BC1\u8DEF\u7531\u672A\u58F0\u660E\u6570\u636E\u8303\u56F4\uFF08requireScopedAuth\uFF09\uFF1A
+  - ${lines.join("\n  - ")}`;
+    if (options.enforce) {
+      logger2.error(message);
+      throw new Error(message);
+    }
+    logger2.warn(message);
+  }
+  if (audit.declared.length > 0) {
+    logger2.info?.(
+      `[RouteScope] \u5DF2\u58F0\u660E\u6570\u636E\u8303\u56F4 ${audit.declared.length} \u6761\uFF0C\u89D2\u8272\u95E8\u7981\u8DEF\u7531 ${audit.roleGated.length} \u6761\uFF0C\u672A\u58F0\u660E ${audit.undeclared.length} \u6761\uFF08\u767D\u540D\u5355 ${options.whitelist?.length ?? 0} \u6761\uFF09\u3002`
+    );
+  }
+  return audit;
+}
+
+// server/utils/password-gate.ts
+var PASSWORD_GATE_SKIP_ENV = "OPENLEARN_SKIP_PASSWORD_CHANGE_GATE";
+var PASSWORD_GATE_SKIP_ENV_ALIAS = "DEV_BYPASS_PASSWORD_CHANGE_GATE";
+var productionWarningEmitted = false;
+function isTruthyFlag2(value) {
+  if (typeof value !== "string") return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "1" || normalized === "true";
+}
+function isPasswordChangeGateSkipped(env = process.env) {
+  const requested = isTruthyFlag2(env[PASSWORD_GATE_SKIP_ENV]) || isTruthyFlag2(env[PASSWORD_GATE_SKIP_ENV_ALIAS]);
+  if (!requested) return false;
+  if ((env.NODE_ENV ?? "") === "production") {
+    if (!productionWarningEmitted) {
+      productionWarningEmitted = true;
+      console.warn(
+        `[SECURITY] ${PASSWORD_GATE_SKIP_ENV}/${PASSWORD_GATE_SKIP_ENV_ALIAS} \u5DF2\u914D\u7F6E\uFF0C\u4F46\u751F\u4EA7\u73AF\u5883\uFF08NODE_ENV=production\uFF09\u4E25\u683C\u5FFD\u7565\u8BE5\u5F00\u5173\uFF1A\u5F3A\u5236\u6539\u5BC6\u9632\u7EBF\u4E0D\u5931\u6548\u3002\u8BF7\u7ACB\u5373\u4ECE\u751F\u4EA7\u73AF\u5883\u79FB\u9664\u8BE5\u53D8\u91CF\u3002`
+      );
+    }
+    return false;
+  }
+  return true;
+}
+
+// server/services/session-role.ts
+var SESSION_ROLE_WHITELIST = /* @__PURE__ */ new Set(["administrator", "teacher", "student", "anonymous"]);
+function resolveSessionRole(session) {
+  if (!session) return "anonymous";
+  for (const candidate of [session.subRole, session.role]) {
+    if (typeof candidate !== "string" || candidate.length === 0) continue;
+    const normalized = candidate === "admin" ? "administrator" : candidate;
+    if (SESSION_ROLE_WHITELIST.has(normalized)) return normalized;
+  }
+  return "anonymous";
+}
+function isAdministrator(session) {
+  return resolveSessionRole(session) === "administrator";
+}
+
+// server/middleware/auth.ts
+var SESSION_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
+function getValidSession(token) {
+  let sessionRow;
+  try {
+    sessionRow = kernelContainer.db.prepare("SELECT * FROM client_sessions WHERE id = ?").get(token);
+  } catch {
+    return null;
+  }
+  if (!sessionRow) return null;
+  const now = Date.now();
+  if (sessionRow.expires_at && sessionRow.expires_at < now) {
+    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
+    return null;
+  }
+  const idleTimeout = 24 * 60 * 60 * 1e3;
+  if (sessionRow.updated_at && now - sessionRow.updated_at > idleTimeout) {
+    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
+    return null;
+  }
+  if (!sessionRow.updated_at || now - sessionRow.updated_at > SESSION_REFRESH_INTERVAL_MS) {
+    kernelContainer.db.prepare("UPDATE client_sessions SET updated_at = ? WHERE id = ?").run(now, token);
+  }
+  let session;
+  try {
+    session = JSON.parse(sessionRow.session_data);
+  } catch {
+    return null;
+  }
+  if (session && !session.userId && session.studentId) {
+    session.userId = session.studentId;
+  }
+  if (session.role && !["teacher", "student", "administrator", "admin"].includes(session.role)) {
+    session.role = "anonymous";
+  }
+  return session;
+}
+function getCookieToken(req) {
+  const rc = req.headers.cookie;
+  if (!rc) return null;
+  const parts = rc.split(";");
+  for (const part of parts) {
+    const trimmed2 = part.trim();
+    if (trimmed2.startsWith("edu_os_token=")) {
+      return trimmed2.substring("edu_os_token=".length);
+    }
+  }
+  return null;
+}
+function getActorId(req) {
+  const token = getCookieToken(req);
+  if (!token) return "anonymous";
+  try {
+    const session = getValidSession(token);
+    if (!session) return "anonymous";
+    const role = resolveSessionRole(session);
+    const rawUserId = session.userId || session.studentId || "demo";
+    const safeUserId = String(rawUserId).replace(/[:\s]/g, "_").slice(0, 64);
+    return `user:${safeUserId}:${role}`;
+  } catch {
+    return "anonymous";
+  }
+}
+function requireAuth(...roles) {
+  const middleware = (req, res, next) => {
+    const token = getCookieToken(req);
+    if (!token) return res.status(401).json({ success: false, error: "Authentication required" });
+    const session = getValidSession(token);
+    if (!session) return res.status(401).json({ success: false, error: "Session expired or invalid" });
+    if (roles.length > 0) {
+      const userRole = resolveSessionRole(session);
+      const effectiveRoles = roles.map((r) => r === "admin" ? "administrator" : r);
+      if (!effectiveRoles.includes(userRole)) {
+        return res.status(403).json({ success: false, error: `Role ${session.role} not allowed. Required: ${roles.join(", ")}` });
+      }
+    }
+    req.session = session;
+    next();
+  };
+  return markAuthMiddleware(middleware, roles);
+}
+var PASSWORD_CHANGE_EXEMPT_PATHS = /* @__PURE__ */ new Set([
+  "/api/auth/change-password",
+  "/api/auth/logout",
+  "/api/auth/session",
+  "/api/auth/me",
+  "/api/client-errors"
+]);
+function enforcePasswordChanged(req, res, next) {
+  if (process.env.PLAYWRIGHT_TEST) {
+    return next();
+  }
+  if (isPasswordChangeGateSkipped()) {
+    return next();
+  }
+  const path48 = req.path || "";
+  if (!path48.startsWith("/api/")) {
+    return next();
+  }
+  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path48)) {
+    return next();
+  }
+  const token = getCookieToken(req);
+  if (token) {
+    const session = getValidSession(token);
+    if (session && session.mustChangePassword) {
+      res.status(403).json({
+        success: false,
+        code: "FORBIDDEN_DEFAULT_PASSWORD",
+        error: "Default password must be changed first"
+      });
+      return;
+    }
+  }
+  next();
+}
+function socketAuthMiddleware(socket, next) {
+  try {
+    const cookieHeader = socket.handshake.headers.cookie;
+    let token = null;
+    if (cookieHeader) {
+      const parts = cookieHeader.split(";");
+      for (const part of parts) {
+        const trimmed2 = part.trim();
+        if (trimmed2.startsWith("edu_os_token=")) {
+          token = trimmed2.substring("edu_os_token=".length);
+          break;
+        }
+      }
+    }
+    if (!token && socket.handshake.auth?.token) {
+      token = socket.handshake.auth.token;
+    }
+    if (process.env.NODE_ENV === "test" && !token) {
+      return next();
+    }
+    if (!token) {
+      return next(new Error("Authentication required: missing edu_os_token"));
+    }
+    const session = getValidSession(token);
+    if (!session) {
+      return next(new Error("Authentication required: session expired or invalid"));
+    }
+    if (session.mustChangePassword && !isPasswordChangeGateSkipped()) {
+      return next(new Error("FORBIDDEN_DEFAULT_PASSWORD"));
+    }
+    socket.data.session = session;
+    socket.data.userId = session.userId;
+    socket.data.role = session.role;
+    next();
+  } catch (err) {
+    next(new Error(`Authentication error: ${err.message}`));
+  }
+}
+
+// server/security/rate-limit.ts
 function loginRateLimitKey(req) {
   const body = req.body ?? {};
   const raw = body.username ?? body.studentId ?? body.studentName ?? "";
@@ -32785,6 +32232,18 @@ function writeRateLimitKey(req) {
     return ip;
   }
 }
+function sessionRateLimitKey(req) {
+  try {
+    const token = getCookieToken(req);
+    const session = token ? getValidSession(token) : null;
+    if (session) {
+      const identity = String(session.userId || session.studentId || session.username || "").trim();
+      if (identity) return `session:${identity.slice(0, 64)}`;
+    }
+  } catch {
+  }
+  return `ip:${writeRateLimitKey(req)}`;
+}
 var limiterValidation = {
   xForwardedForHeader: false,
   trustProxy: false,
@@ -32823,6 +32282,17 @@ function createAiLimiter(max) {
     validate: limiterValidation
   });
 }
+function createSessionWriteLimiter(max) {
+  return (0, import_express_rate_limit.default)({
+    windowMs: 60 * 1e3,
+    max,
+    keyGenerator: sessionRateLimitKey,
+    message: { error: "\u8BF7\u6C42\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5\u3002Too many requests, please try again later." },
+    standardHeaders: true,
+    legacyHeaders: false,
+    validate: limiterValidation
+  });
+}
 
 // server/security/trust-proxy.ts
 function resolveTrustProxy(raw) {
@@ -34199,297 +33669,6 @@ function startBackupScheduler(deps) {
   };
 }
 
-// server/security/route-scope.ts
-var AUTH_MIDDLEWARE_MARKER = Symbol.for("openlearn.routeScope.authMiddleware");
-var DATA_SCOPE_MARKER = Symbol.for("openlearn.routeScope.dataScope");
-function markAuthMiddleware(middleware, roles) {
-  Object.defineProperty(middleware, AUTH_MIDDLEWARE_MARKER, {
-    value: { roles: [...roles] },
-    enumerable: false,
-    configurable: true
-  });
-  return middleware;
-}
-function markDataScopeMiddleware(middleware, scope) {
-  Object.defineProperty(middleware, DATA_SCOPE_MARKER, {
-    value: scope,
-    enumerable: false,
-    configurable: true
-  });
-  return middleware;
-}
-function readMarker(handle, marker) {
-  if (typeof handle !== "function") return void 0;
-  return handle[marker];
-}
-function collectAuthRoutes(app) {
-  const router = app._router ?? app.router;
-  const stack = router?.stack ?? [];
-  const result = [];
-  for (const layer of stack) {
-    const route = layer?.route;
-    if (!route) continue;
-    const handles = (route.stack ?? []).map((entry) => entry.handle);
-    const authMeta = handles.map((handle) => readMarker(handle, AUTH_MIDDLEWARE_MARKER)).find(Boolean);
-    if (!authMeta) continue;
-    const scope = handles.map((handle) => readMarker(handle, DATA_SCOPE_MARKER)).find(Boolean);
-    const methods = Object.keys(route.methods ?? {}).filter((method) => method !== "_all" && route.methods[method]).map((method) => method.toUpperCase());
-    for (const method of methods) {
-      result.push({
-        method,
-        path: String(route.path),
-        scope,
-        roles: [...authMeta.roles]
-      });
-    }
-  }
-  return result;
-}
-function isWhitelisted(route, whitelist) {
-  return whitelist.some(
-    (entry) => entry.method.toUpperCase() === route.method && normalizePath2(entry.path) === normalizePath2(route.path)
-  );
-}
-function normalizePath2(path48) {
-  if (!path48) return "/";
-  return path48.endsWith("/") && path48.length > 1 ? path48.slice(0, -1) : path48;
-}
-function auditRouteScopes(app, whitelist = []) {
-  const declared = [];
-  const roleGated = [];
-  const undeclared = [];
-  for (const route of collectAuthRoutes(app)) {
-    if (route.scope) {
-      declared.push(route);
-      continue;
-    }
-    if (route.roles.length > 0) {
-      roleGated.push(route);
-      continue;
-    }
-    if (isWhitelisted(route, whitelist)) continue;
-    undeclared.push(route);
-  }
-  return { declared, roleGated, undeclared };
-}
-function formatRouteScopeViolation(route) {
-  return `${route.method} ${route.path}`;
-}
-function assertRouteDataScopes(app, options = {}) {
-  const logger2 = options.logger ?? console;
-  const audit = auditRouteScopes(app, options.whitelist ?? []);
-  if (audit.undeclared.length > 0) {
-    const lines = audit.undeclared.map(formatRouteScopeViolation);
-    const message = `[RouteScope] ${audit.undeclared.length} \u4E2A\u5DF2\u8BA4\u8BC1\u8DEF\u7531\u672A\u58F0\u660E\u6570\u636E\u8303\u56F4\uFF08requireScopedAuth\uFF09\uFF1A
-  - ${lines.join("\n  - ")}`;
-    if (options.enforce) {
-      logger2.error(message);
-      throw new Error(message);
-    }
-    logger2.warn(message);
-  }
-  if (audit.declared.length > 0) {
-    logger2.info?.(
-      `[RouteScope] \u5DF2\u58F0\u660E\u6570\u636E\u8303\u56F4 ${audit.declared.length} \u6761\uFF0C\u89D2\u8272\u95E8\u7981\u8DEF\u7531 ${audit.roleGated.length} \u6761\uFF0C\u672A\u58F0\u660E ${audit.undeclared.length} \u6761\uFF08\u767D\u540D\u5355 ${options.whitelist?.length ?? 0} \u6761\uFF09\u3002`
-    );
-  }
-  return audit;
-}
-
-// server/utils/password-gate.ts
-var PASSWORD_GATE_SKIP_ENV = "OPENLEARN_SKIP_PASSWORD_CHANGE_GATE";
-var PASSWORD_GATE_SKIP_ENV_ALIAS = "DEV_BYPASS_PASSWORD_CHANGE_GATE";
-var productionWarningEmitted = false;
-function isTruthyFlag2(value) {
-  if (typeof value !== "string") return false;
-  const normalized = value.trim().toLowerCase();
-  return normalized === "1" || normalized === "true";
-}
-function isPasswordChangeGateSkipped(env = process.env) {
-  const requested = isTruthyFlag2(env[PASSWORD_GATE_SKIP_ENV]) || isTruthyFlag2(env[PASSWORD_GATE_SKIP_ENV_ALIAS]);
-  if (!requested) return false;
-  if ((env.NODE_ENV ?? "") === "production") {
-    if (!productionWarningEmitted) {
-      productionWarningEmitted = true;
-      console.warn(
-        `[SECURITY] ${PASSWORD_GATE_SKIP_ENV}/${PASSWORD_GATE_SKIP_ENV_ALIAS} \u5DF2\u914D\u7F6E\uFF0C\u4F46\u751F\u4EA7\u73AF\u5883\uFF08NODE_ENV=production\uFF09\u4E25\u683C\u5FFD\u7565\u8BE5\u5F00\u5173\uFF1A\u5F3A\u5236\u6539\u5BC6\u9632\u7EBF\u4E0D\u5931\u6548\u3002\u8BF7\u7ACB\u5373\u4ECE\u751F\u4EA7\u73AF\u5883\u79FB\u9664\u8BE5\u53D8\u91CF\u3002`
-      );
-    }
-    return false;
-  }
-  return true;
-}
-
-// server/services/session-role.ts
-var SESSION_ROLE_WHITELIST = /* @__PURE__ */ new Set(["administrator", "teacher", "student", "anonymous"]);
-function resolveSessionRole(session) {
-  if (!session) return "anonymous";
-  for (const candidate of [session.subRole, session.role]) {
-    if (typeof candidate !== "string" || candidate.length === 0) continue;
-    const normalized = candidate === "admin" ? "administrator" : candidate;
-    if (SESSION_ROLE_WHITELIST.has(normalized)) return normalized;
-  }
-  return "anonymous";
-}
-function isAdministrator(session) {
-  return resolveSessionRole(session) === "administrator";
-}
-
-// server/middleware/auth.ts
-var SESSION_REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
-function getValidSession(token) {
-  let sessionRow;
-  try {
-    sessionRow = kernelContainer.db.prepare("SELECT * FROM client_sessions WHERE id = ?").get(token);
-  } catch {
-    return null;
-  }
-  if (!sessionRow) return null;
-  const now = Date.now();
-  if (sessionRow.expires_at && sessionRow.expires_at < now) {
-    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
-    return null;
-  }
-  const idleTimeout = 24 * 60 * 60 * 1e3;
-  if (sessionRow.updated_at && now - sessionRow.updated_at > idleTimeout) {
-    kernelContainer.db.prepare("DELETE FROM client_sessions WHERE id = ?").run(token);
-    return null;
-  }
-  if (!sessionRow.updated_at || now - sessionRow.updated_at > SESSION_REFRESH_INTERVAL_MS) {
-    kernelContainer.db.prepare("UPDATE client_sessions SET updated_at = ? WHERE id = ?").run(now, token);
-  }
-  let session;
-  try {
-    session = JSON.parse(sessionRow.session_data);
-  } catch {
-    return null;
-  }
-  if (session && !session.userId && session.studentId) {
-    session.userId = session.studentId;
-  }
-  if (session.role && !["teacher", "student", "administrator", "admin"].includes(session.role)) {
-    session.role = "anonymous";
-  }
-  return session;
-}
-function getCookieToken(req) {
-  const rc = req.headers.cookie;
-  if (!rc) return null;
-  const parts = rc.split(";");
-  for (const part of parts) {
-    const trimmed2 = part.trim();
-    if (trimmed2.startsWith("edu_os_token=")) {
-      return trimmed2.substring("edu_os_token=".length);
-    }
-  }
-  return null;
-}
-function getActorId(req) {
-  const token = getCookieToken(req);
-  if (!token) return "anonymous";
-  try {
-    const session = getValidSession(token);
-    if (!session) return "anonymous";
-    const role = resolveSessionRole(session);
-    const rawUserId = session.userId || session.studentId || "demo";
-    const safeUserId = String(rawUserId).replace(/[:\s]/g, "_").slice(0, 64);
-    return `user:${safeUserId}:${role}`;
-  } catch {
-    return "anonymous";
-  }
-}
-function requireAuth(...roles) {
-  const middleware = (req, res, next) => {
-    const token = getCookieToken(req);
-    if (!token) return res.status(401).json({ success: false, error: "Authentication required" });
-    const session = getValidSession(token);
-    if (!session) return res.status(401).json({ success: false, error: "Session expired or invalid" });
-    if (roles.length > 0) {
-      const userRole = resolveSessionRole(session);
-      const effectiveRoles = roles.map((r) => r === "admin" ? "administrator" : r);
-      if (!effectiveRoles.includes(userRole)) {
-        return res.status(403).json({ success: false, error: `Role ${session.role} not allowed. Required: ${roles.join(", ")}` });
-      }
-    }
-    req.session = session;
-    next();
-  };
-  return markAuthMiddleware(middleware, roles);
-}
-var PASSWORD_CHANGE_EXEMPT_PATHS = /* @__PURE__ */ new Set([
-  "/api/auth/change-password",
-  "/api/auth/logout",
-  "/api/auth/session",
-  "/api/auth/me",
-  "/api/client-errors"
-]);
-function enforcePasswordChanged(req, res, next) {
-  if (process.env.PLAYWRIGHT_TEST) {
-    return next();
-  }
-  if (isPasswordChangeGateSkipped()) {
-    return next();
-  }
-  const path48 = req.path || "";
-  if (!path48.startsWith("/api/")) {
-    return next();
-  }
-  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path48)) {
-    return next();
-  }
-  const token = getCookieToken(req);
-  if (token) {
-    const session = getValidSession(token);
-    if (session && session.mustChangePassword) {
-      res.status(403).json({
-        success: false,
-        code: "FORBIDDEN_DEFAULT_PASSWORD",
-        error: "Default password must be changed first"
-      });
-      return;
-    }
-  }
-  next();
-}
-function socketAuthMiddleware(socket, next) {
-  try {
-    const cookieHeader = socket.handshake.headers.cookie;
-    let token = null;
-    if (cookieHeader) {
-      const parts = cookieHeader.split(";");
-      for (const part of parts) {
-        const trimmed2 = part.trim();
-        if (trimmed2.startsWith("edu_os_token=")) {
-          token = trimmed2.substring("edu_os_token=".length);
-          break;
-        }
-      }
-    }
-    if (!token && socket.handshake.auth?.token) {
-      token = socket.handshake.auth.token;
-    }
-    if (process.env.NODE_ENV === "test" && !token) {
-      return next();
-    }
-    if (!token) {
-      return next(new Error("Authentication required: missing edu_os_token"));
-    }
-    const session = getValidSession(token);
-    if (!session) {
-      return next(new Error("Authentication required: session expired or invalid"));
-    }
-    if (session.mustChangePassword && !isPasswordChangeGateSkipped()) {
-      return next(new Error("FORBIDDEN_DEFAULT_PASSWORD"));
-    }
-    socket.data.session = session;
-    socket.data.userId = session.userId;
-    socket.data.role = session.role;
-    next();
-  } catch (err) {
-    next(new Error(`Authentication error: ${err.message}`));
-  }
-}
-
 // server/middleware/csrf.ts
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var EXEMPT_PREFIXES = [
@@ -34712,7 +33891,7 @@ function sendSafeError(res, err, status = 500, fallbackMessage = "Internal serve
   }
   const isProd = process.env.NODE_ENV === "production";
   const exposedMessage = isProd && effectiveStatus >= 500 ? fallbackMessage : message;
-  const rawCode = err && typeof err === "object" && typeof err.code === "string" ? err.code : void 0;
+  const rawCode = err && typeof err === "object" && typeof err.code === "string" ? err.code : err && typeof err === "object" && err.type === "entity.too.large" ? "PAYLOAD_TOO_LARGE" : void 0;
   const errorCode = effectiveStatus >= 400 && effectiveStatus < 500 && rawCode ? rawCode : void 0;
   return res.status(effectiveStatus).json({ success: false, ...errorCode ? { code: errorCode } : {}, error: exposedMessage });
 }
@@ -36170,15 +35349,28 @@ var LARGE_UPLOAD_ENDPOINTS = [
   "/api/upload",
   "/api/courseware/upload",
   "/api/courseware/inline",
-  "/api/plugins/upload-zip"
+  "/api/plugins/upload-zip",
+  "/api/resources"
 ];
 var LARGE_UPLOAD_LIMIT = "110mb";
+var MEDIUM_UPLOAD_ENDPOINTS = [
+  "/api/auth/avatar",
+  "/api/timetable/ocr",
+  "/api/site-settings",
+  "/api/agent/chat"
+];
+var MEDIUM_UPLOAD_LIMIT = "30mb";
 function mountLargeBodyParsers(app) {
   app.use(
     LARGE_UPLOAD_ENDPOINTS,
     import_express2.default.json({ limit: LARGE_UPLOAD_LIMIT }),
     import_express2.default.urlencoded({ limit: LARGE_UPLOAD_LIMIT, extended: true })
   );
+  app.use(
+    MEDIUM_UPLOAD_ENDPOINTS,
+    import_express2.default.json({ limit: MEDIUM_UPLOAD_LIMIT }),
+    import_express2.default.urlencoded({ limit: MEDIUM_UPLOAD_LIMIT, extended: true })
+  );
   app.use(
     COURSE_PACKAGE_IMPORT_PATH,
     import_express2.default.json({ limit: COURSE_PACKAGE_IMPORT_BODY_LIMIT_BYTES }),
@@ -36262,164 +35454,706 @@ window.addEventListener('message', async function (event) {
     post({ type: 'deactivated', id: data.id });
     return;
   }
-  if (data.type !== 'load') return;
-  targetOrigin = event.origin && event.origin !== 'null' ? event.origin : '*';
-  try {
-    const blob = new Blob([data.source], { type: 'text/javascript' });
-    const url = URL.createObjectURL(blob);
-    let mod;
-    try { mod = await import(url); } finally { URL.revokeObjectURL(url); }
-    const plugin = mod.default || mod;
-    if (typeof plugin.activate !== 'function') throw new Error('missing activate function');
-    activePlugin = plugin;
-    await Promise.race([
-      plugin.activate(makeCtx(data.pluginId, data.manifest)),
-      new Promise(function (_, reject) { setTimeout(function () { reject(new Error('Activation timeout (5000ms)')); }, 5000); })
-    ]);
-    post({ type: 'activated', id: data.id });
-  } catch (error) {
-    post({ type: 'activate-error', id: data.id, error: error && error.message ? error.message : String(error) });
+  if (data.type !== 'load') return;
+  targetOrigin = event.origin && event.origin !== 'null' ? event.origin : '*';
+  try {
+    const blob = new Blob([data.source], { type: 'text/javascript' });
+    const url = URL.createObjectURL(blob);
+    let mod;
+    try { mod = await import(url); } finally { URL.revokeObjectURL(url); }
+    const plugin = mod.default || mod;
+    if (typeof plugin.activate !== 'function') throw new Error('missing activate function');
+    activePlugin = plugin;
+    await Promise.race([
+      plugin.activate(makeCtx(data.pluginId, data.manifest)),
+      new Promise(function (_, reject) { setTimeout(function () { reject(new Error('Activation timeout (5000ms)')); }, 5000); })
+    ]);
+    post({ type: 'activated', id: data.id });
+  } catch (error) {
+    post({ type: 'activate-error', id: data.id, error: error && error.message ? error.message : String(error) });
+  }
+});
+post({ type: 'ready' });
+</script>
+</body></html>`;
+
+// server/utils/plugin-view-bridge.ts
+var PLUGIN_VIEW_CSP = "sandbox allow-scripts allow-forms allow-downloads; frame-ancestors 'self'; default-src 'self' 'unsafe-inline' data: blob: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: https:; script-src-attr 'unsafe-inline'; style-src 'self' 'unsafe-inline' data: blob: https:; style-src-attr 'unsafe-inline'; connect-src 'self' blob: data: https:;";
+var PLUGIN_VIEW_BRIDGE_JS = `(function () {
+  'use strict';
+  const CHANNEL = 'ol-plugin-view';
+  let targetOrigin = '*';
+  const pending = new Map();
+  const initCallbacks = [];
+  const contextUpdateCallbacks = [];
+  let currentContext = null;
+
+  function post(msg) {
+    if (window.parent && window.parent !== window) {
+      window.parent.postMessage(Object.assign({ channel: CHANNEL }, msg), targetOrigin);
+    }
+  }
+
+  function call(op, args) {
+    const callId = Math.random().toString(16).slice(2) + Date.now().toString(16);
+    return new Promise(function (resolve, reject) {
+      pending.set(callId, { resolve: resolve, reject: reject });
+      post({ type: 'call', callId: callId, op: op, args: args || [] });
+    });
+  }
+
+  window.addEventListener('message', function (event) {
+    const data = event.data;
+    if (!data || data.channel !== CHANNEL) return;
+    if (event.source !== window.parent) return;
+
+    if (data.type === 'init') {
+      currentContext = data.payload || {};
+      targetOrigin = event.origin && event.origin !== 'null' ? event.origin : '*';
+      for (let i = 0; i < initCallbacks.length; i++) {
+        try {
+          initCallbacks[i](currentContext);
+        } catch (e) {
+          console.error('[OpenLearnPluginBridge] init callback error:', e);
+        }
+      }
+      return;
+    }
+
+    if (data.type === 'context-update') {
+      currentContext = Object.assign({}, currentContext, data.payload || {});
+      for (let i = 0; i < contextUpdateCallbacks.length; i++) {
+        try {
+          contextUpdateCallbacks[i](currentContext);
+        } catch (e) {
+          console.error('[OpenLearnPluginBridge] contextUpdate callback error:', e);
+        }
+      }
+      return;
+    }
+
+    if (data.type === 'reply') {
+      const waiter = pending.get(data.callId);
+      if (!waiter) return;
+      pending.delete(data.callId);
+      if (data.ok) {
+        waiter.resolve(data.value);
+      } else {
+        waiter.reject(new Error(data.error || 'bridge call failed'));
+      }
+      return;
+    }
+  });
+
+  const bridge = {
+    CHANNEL: CHANNEL,
+    onInit: function (callback) {
+      if (typeof callback === 'function') {
+        if (currentContext) {
+          try {
+            callback(currentContext);
+          } catch (e) {
+            console.error('[OpenLearnPluginBridge] onInit callback error:', e);
+          }
+        }
+        initCallbacks.push(callback);
+      }
+      return bridge;
+    },
+    onContextUpdate: function (callback) {
+      if (typeof callback === 'function') {
+        contextUpdateCallbacks.push(callback);
+      }
+      return bridge;
+    },
+    getContext: function () {
+      return currentContext;
+    },
+    ui: {
+      toast: function (message, type) {
+        return call('ui.toast', [message, type || 'info']);
+      },
+      showToast: function (message, type) {
+        return call('ui.toast', [message, type || 'info']);
+      },
+      resize: function (height) {
+        post({ type: 'resize', height: Number(height) || 0 });
+      },
+    },
+    invokeCommand: function (type, payload) {
+      return call('command.invoke', [type, payload]);
+    },
+    api: {
+      get: function (path) {
+        return call('api.get', [path]);
+      },
+      post: function (path, body) {
+        return call('api.post', [path, body]);
+      },
+      del: function (path) {
+        return call('api.del', [path]);
+      },
+    },
+    storage: {
+      get: function (key) {
+        return call('storage.get', [key]);
+      },
+      set: function (key, value) {
+        return call('storage.set', [key, value]);
+      },
+      delete: function (key) {
+        return call('storage.delete', [key]);
+      },
+    },
+  };
+
+  window.OpenLearnPluginBridge = bridge;
+  // \u901A\u77E5\u5BBF\u4E3B\u89C6\u56FE\u6C99\u7BB1 iframe \u5DF2\u5C31\u7EEA
+  post({ type: 'ready' });
+})();
+`;
+
+// packages/core/bootstrap/types/index.ts
+var PlatformBootstrapError = class extends Error {
+  constructor(message, stage, cause) {
+    super(`[PlatformBootstrapError${stage ? `:${stage}` : ""}] ${message}`);
+    this.stage = stage;
+    this.cause = cause;
+    this.name = "PlatformBootstrapError";
+  }
+};
+var ConfigurationError = class extends PlatformBootstrapError {
+  constructor(message, cause) {
+    super(message, "Configuring" /* Configuring */, cause);
+    this.name = "ConfigurationError";
+  }
+};
+var StartupTimeoutError = class extends PlatformBootstrapError {
+  constructor(message, stage, cause) {
+    super(message, stage, cause);
+    this.name = "StartupTimeoutError";
+  }
+};
+var PLATFORM_VERSION2 = PLATFORM_VERSION;
+var BOOTSTRAP_STAGE_NAMES = Object.freeze([
+  "Created" /* Created */,
+  "Configuring" /* Configuring */,
+  "Registering" /* Registering */,
+  "Initializing" /* Initializing */,
+  "Activating" /* Activating */,
+  "Ready" /* Ready */,
+  "ShuttingDown" /* ShuttingDown */,
+  "Disposed" /* Disposed */
+]);
+var DEFAULT_BOOTSTRAP_CONFIG = Object.freeze({
+  environment: "development",
+  mode: "standalone",
+  port: 9e3,
+  debug: false,
+  pluginsDir: "./plugins",
+  dbPath: "./packages/core/db/educational_os.db"
+});
+
+// packages/core/bootstrap/pipeline/pipeline-executor.ts
+var PipelineExecutor = class {
+  constructor() {
+    this.listeners = /* @__PURE__ */ new Set();
+  }
+  addListener(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  emit(event) {
+    for (const listener of Array.from(this.listeners)) {
+      try {
+        listener(event);
+      } catch (err) {
+        console.error("[PipelineExecutor] Listener error:", err);
+      }
+    }
+  }
+  async execute(stages, context) {
+    const startTime = Date.now();
+    const results = [];
+    const executedStages = [];
+    this.emit({ type: "PipelineStarted", timestamp: startTime });
+    console.log("[Platform] Starting Bootstrap Pipeline execution...");
+    for (const stage of stages) {
+      if (context.isCancelled) {
+        console.warn(`[Platform] Pipeline cancelled before stage ${stage.name}`);
+        const totalDurationMs2 = Date.now() - startTime;
+        return {
+          totalDurationMs: totalDurationMs2,
+          status: "Aborted",
+          stageResults: Object.freeze(results)
+        };
+      }
+      console.log(`[Platform] Entering ${stage.name}`);
+      this.emit({
+        type: "StageStarted",
+        timestamp: Date.now(),
+        stageId: stage.id,
+        stageName: String(stage.name)
+      });
+      const stageStart = Date.now();
+      try {
+        if (stage.timeoutMs && stage.timeoutMs > 0) {
+          await this.executeWithTimeout(stage, context, stage.timeoutMs);
+        } else {
+          await stage.execute(context);
+        }
+        const durationMs = Date.now() - stageStart;
+        console.log(`[Platform] Completed ${stage.name} (${durationMs} ms)`);
+        results.push({
+          stageId: stage.id,
+          stageName: String(stage.name),
+          durationMs,
+          status: "Success"
+        });
+        executedStages.push(stage);
+        this.emit({
+          type: "StageCompleted",
+          timestamp: Date.now(),
+          stageId: stage.id,
+          stageName: String(stage.name),
+          durationMs
+        });
+      } catch (err) {
+        const error = err instanceof Error ? err : new Error(String(err));
+        const durationMs = Date.now() - stageStart;
+        console.error(`[Platform] Failed ${stage.name} (${durationMs} ms): ${error.message}`);
+        results.push({
+          stageId: stage.id,
+          stageName: String(stage.name),
+          durationMs,
+          status: "Failed",
+          error
+        });
+        this.emit({
+          type: "StageFailed",
+          timestamp: Date.now(),
+          stageId: stage.id,
+          stageName: String(stage.name),
+          durationMs,
+          error
+        });
+        await this.rollbackExecutedStages(executedStages, context);
+        const totalDurationMs2 = Date.now() - startTime;
+        const pipelineResult = {
+          totalDurationMs: totalDurationMs2,
+          status: "Failed",
+          stageResults: Object.freeze(results),
+          failedStage: stage.id,
+          error
+        };
+        this.emit({
+          type: "PipelineCompleted",
+          timestamp: Date.now(),
+          durationMs: totalDurationMs2,
+          error
+        });
+        return pipelineResult;
+      }
+    }
+    const totalDurationMs = Date.now() - startTime;
+    console.log(`[Platform] Ready. Total startup duration: ${totalDurationMs} ms.`);
+    const finalResult = {
+      totalDurationMs,
+      status: "Success",
+      stageResults: Object.freeze(results)
+    };
+    this.emit({
+      type: "PipelineCompleted",
+      timestamp: Date.now(),
+      durationMs: totalDurationMs
+    });
+    return finalResult;
+  }
+  async executeWithTimeout(stage, context, timeoutMs) {
+    let timer;
+    const timeoutPromise = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        reject(new StartupTimeoutError(`Stage execution timed out after ${timeoutMs} ms`));
+      }, timeoutMs);
+    });
+    try {
+      await Promise.race([stage.execute(context), timeoutPromise]);
+    } finally {
+      if (timer) {
+        clearTimeout(timer);
+      }
+    }
+  }
+  async rollbackExecutedStages(executedStages, context) {
+    console.log("[Platform] Triggering stage rollbacks...");
+    for (let i = executedStages.length - 1; i >= 0; i--) {
+      const stage = executedStages[i];
+      if (stage.rollback) {
+        try {
+          console.log(`[Platform] Rolling back ${stage.name}`);
+          await stage.rollback(context);
+        } catch (rbErr) {
+          console.error(`[Platform] Error during rollback of ${stage.name}:`, rbErr);
+        }
+      }
+    }
+  }
+};
+
+// packages/core/bootstrap/pipeline/stages/standard-stages.ts
+var StartupStageImpl = class {
+  constructor() {
+    this.id = "stage_startup";
+    this.name = "Created" /* Created */;
+    this.description = "Environment & configuration validation";
+  }
+  async execute(context) {
+    context.setStage("Configuring" /* Configuring */);
+  }
+};
+var RegistrationStageImpl = class {
+  constructor() {
+    this.id = "stage_registration";
+    this.name = "Registering" /* Registering */;
+    this.description = "Core Service Contracts & DI Tokens registration";
+  }
+  async execute(context) {
+    context.setStage("Registering" /* Registering */);
+  }
+};
+var InitializationStageImpl = class {
+  constructor() {
+    this.id = "stage_initialization";
+    this.name = "Initializing" /* Initializing */;
+    this.description = "Subsystem Kernels initialization";
+  }
+  async execute(context) {
+    context.setStage("Initializing" /* Initializing */);
+  }
+};
+var ActivationStageImpl = class {
+  constructor() {
+    this.id = "stage_activation";
+    this.name = "Activating" /* Activating */;
+    this.description = "Plugin Host discovery & ESM plugins activation";
+  }
+  async execute(context) {
+    context.setStage("Activating" /* Activating */);
+  }
+};
+var ReadyStageImpl = class {
+  constructor() {
+    this.id = "stage_ready";
+    this.name = "Ready" /* Ready */;
+    this.description = "HTTP & Socket.IO server readiness";
+  }
+  async execute(context) {
+    context.setStage("Ready" /* Ready */);
+  }
+};
+
+// packages/core/bootstrap/pipeline/bootstrap-pipeline.ts
+var BootstrapPipeline = class {
+  constructor(stages) {
+    this._stages = [];
+    this.executor = new PipelineExecutor();
+    if (stages && stages.length > 0) {
+      this._stages = [...stages];
+    } else {
+      this._stages = [
+        new StartupStageImpl(),
+        new RegistrationStageImpl(),
+        new InitializationStageImpl(),
+        new ActivationStageImpl(),
+        new ReadyStageImpl()
+      ];
+    }
+  }
+  get stages() {
+    return Object.freeze(this._stages);
+  }
+  addStage(stage) {
+    this._stages.push(stage);
+    return this;
   }
-});
-post({ type: 'ready' });
-</script>
-</body></html>`;
-
-// server/utils/plugin-view-bridge.ts
-var PLUGIN_VIEW_CSP = "sandbox allow-scripts allow-forms allow-downloads; frame-ancestors 'self'; default-src 'self' 'unsafe-inline' data: blob: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: https:; script-src-attr 'unsafe-inline'; style-src 'self' 'unsafe-inline' data: blob: https:; style-src-attr 'unsafe-inline'; connect-src 'self' blob: data: https:;";
-var PLUGIN_VIEW_BRIDGE_JS = `(function () {
-  'use strict';
-  const CHANNEL = 'ol-plugin-view';
-  let targetOrigin = '*';
-  const pending = new Map();
-  const initCallbacks = [];
-  const contextUpdateCallbacks = [];
-  let currentContext = null;
-
-  function post(msg) {
-    if (window.parent && window.parent !== window) {
-      window.parent.postMessage(Object.assign({ channel: CHANNEL }, msg), targetOrigin);
+  addListener(listener) {
+    return this.executor.addListener(listener);
+  }
+  async run(context) {
+    const result = await this.execute(context);
+    if (result.status === "Failed") {
+      throw result.error || new Error(`Bootstrap Pipeline failed at stage: ${result.failedStage}`);
     }
   }
-
-  function call(op, args) {
-    const callId = Math.random().toString(16).slice(2) + Date.now().toString(16);
-    return new Promise(function (resolve, reject) {
-      pending.set(callId, { resolve: resolve, reject: reject });
-      post({ type: 'call', callId: callId, op: op, args: args || [] });
-    });
+  async execute(context) {
+    return this.executor.execute(this._stages, context);
   }
+};
 
-  window.addEventListener('message', function (event) {
-    const data = event.data;
-    if (!data || data.channel !== CHANNEL) return;
-    if (event.source !== window.parent) return;
-
-    if (data.type === 'init') {
-      currentContext = data.payload || {};
-      targetOrigin = event.origin && event.origin !== 'null' ? event.origin : '*';
-      for (let i = 0; i < initCallbacks.length; i++) {
-        try {
-          initCallbacks[i](currentContext);
-        } catch (e) {
-          console.error('[OpenLearnPluginBridge] init callback error:', e);
+// packages/core/bootstrap/builder/builder-validation-engine.ts
+var BuilderValidationEngine = class {
+  static validate(config, environment, stages) {
+    const errors = [];
+    const warnings = [];
+    if (!["development", "production", "test"].includes(environment)) {
+      errors.push({
+        code: "INVALID_ENVIRONMENT",
+        message: `Environment must be one of 'development', 'production', 'test'. Received: '${environment}'`,
+        field: "environment"
+      });
+    }
+    if (!config.port || config.port <= 0 || config.port > 65535) {
+      errors.push({
+        code: "INVALID_PORT",
+        message: `Port must be a valid number between 1 and 65535. Received: ${config.port}`,
+        field: "port"
+      });
+    }
+    if (!stages || stages.length === 0) {
+      errors.push({
+        code: "MISSING_STAGES",
+        message: "Bootstrap pipeline contains no registered stages.",
+        field: "stages"
+      });
+    } else {
+      const stageIds = /* @__PURE__ */ new Set();
+      for (const stage of stages) {
+        if (!stage.id) {
+          errors.push({
+            code: "INVALID_STAGE",
+            message: `Stage '${stage.name}' has no unique ID.`
+          });
+        } else if (stageIds.has(stage.id)) {
+          errors.push({
+            code: "DUPLICATE_STAGE",
+            message: `Duplicate stage registration detected for stage ID '${stage.id}'.`,
+            field: "stage.id"
+          });
+        } else {
+          stageIds.add(stage.id);
         }
       }
-      return;
     }
+    return {
+      isValid: errors.length === 0,
+      errors: Object.freeze(errors),
+      warnings: Object.freeze(warnings)
+    };
+  }
+};
 
-    if (data.type === 'context-update') {
-      currentContext = Object.assign({}, currentContext, data.payload || {});
-      for (let i = 0; i < contextUpdateCallbacks.length; i++) {
-        try {
-          contextUpdateCallbacks[i](currentContext);
-        } catch (e) {
-          console.error('[OpenLearnPluginBridge] contextUpdate callback error:', e);
+// packages/core/bootstrap/builder/platform-builder.ts
+var DefaultPlatformLogger = class {
+  info(message, ...args) {
+    console.log(`[PlatformBuilder:INFO] ${message}`, ...args);
+  }
+  warn(message, ...args) {
+    console.warn(`[PlatformBuilder:WARN] ${message}`, ...args);
+  }
+  error(message, ...args) {
+    console.error(`[PlatformBuilder:ERROR] ${message}`, ...args);
+  }
+  debug(message, ...args) {
+    console.debug(`[PlatformBuilder:DEBUG] ${message}`, ...args);
+  }
+};
+var PlatformBuilder = class _PlatformBuilder {
+  constructor(options) {
+    this._state = "Created";
+    this._config = { ...DEFAULT_BOOTSTRAP_CONFIG };
+    this._logger = new DefaultPlatformLogger();
+    this._environment = "development";
+    this._metadata = /* @__PURE__ */ new Map();
+    this._services = /* @__PURE__ */ new Map();
+    this._capabilities = /* @__PURE__ */ new Map();
+    this._extensions = /* @__PURE__ */ new Map();
+    this._pipeline = new BootstrapPipeline();
+    this._state = "Created";
+    this._logger.info("Builder Started");
+    if (options) {
+      if (options.config) this.withConfiguration(options.config);
+      if (options.logger) this.withLogger(options.logger);
+      if (options.environment) this.withEnvironment(options.environment);
+      if (options.metadata) {
+        for (const [k, v] of Object.entries(options.metadata)) {
+          this.withMetadata(k, v);
         }
       }
-      return;
     }
-
-    if (data.type === 'reply') {
-      const waiter = pending.get(data.callId);
-      if (!waiter) return;
-      pending.delete(data.callId);
-      if (data.ok) {
-        waiter.resolve(data.value);
-      } else {
-        waiter.reject(new Error(data.error || 'bridge call failed'));
-      }
-      return;
+  }
+  static create(options) {
+    return new _PlatformBuilder(options);
+  }
+  get state() {
+    return this._state;
+  }
+  transitionTo(newState) {
+    if (this._state === "Disposed") {
+      throw new Error("PlatformBuilder has been disposed and cannot accept further transitions.");
     }
-  });
-
-  const bridge = {
-    CHANNEL: CHANNEL,
-    onInit: function (callback) {
-      if (typeof callback === 'function') {
-        if (currentContext) {
-          try {
-            callback(currentContext);
-          } catch (e) {
-            console.error('[OpenLearnPluginBridge] onInit callback error:', e);
-          }
-        }
-        initCallbacks.push(callback);
-      }
-      return bridge;
-    },
-    onContextUpdate: function (callback) {
-      if (typeof callback === 'function') {
-        contextUpdateCallbacks.push(callback);
-      }
-      return bridge;
-    },
-    getContext: function () {
-      return currentContext;
-    },
-    ui: {
-      toast: function (message, type) {
-        return call('ui.toast', [message, type || 'info']);
+    if (this._state === "Built" && newState !== "Disposed") {
+      throw new Error(`Invalid state transition from Built to ${newState}. Builder is already built.`);
+    }
+    this._state = newState;
+  }
+  withConfiguration(config) {
+    this.transitionTo("Configuring");
+    this._config = { ...this._config, ...config };
+    if (config.environment) {
+      this._environment = config.environment;
+    }
+    this._logger.info("Configuration Loaded");
+    return this;
+  }
+  withLogger(logger2) {
+    this.transitionTo("Configuring");
+    this._logger = logger2;
+    return this;
+  }
+  withEnvironment(env) {
+    this.transitionTo("Configuring");
+    this._environment = env;
+    this._config = { ...this._config, environment: env };
+    return this;
+  }
+  withMetadata(key, value) {
+    this.transitionTo("Configuring");
+    this._metadata.set(key, value);
+    return this;
+  }
+  addBootstrapStage(stage) {
+    this.transitionTo("Configuring");
+    this._pipeline.addStage(stage);
+    return this;
+  }
+  addService(serviceId, instance) {
+    this.transitionTo("Configuring");
+    this._services.set(serviceId, instance);
+    return this;
+  }
+  addCapability(capabilityId, descriptor) {
+    this.transitionTo("Configuring");
+    this._capabilities.set(capabilityId, descriptor);
+    return this;
+  }
+  addExtension(extensionId, extensionSpec) {
+    this.transitionTo("Configuring");
+    this._extensions.set(extensionId, extensionSpec);
+    return this;
+  }
+  buildResult() {
+    const buildStart = Date.now();
+    this.transitionTo("Validating");
+    this._logger.info("Validation Started");
+    const validation = BuilderValidationEngine.validate(this._config, this._environment, this._pipeline.stages);
+    this._logger.info("Validation Completed");
+    if (!validation.isValid) {
+      this._logger.error(`Validation Failed with ${validation.errors.length} errors.`);
+      throw new ConfigurationError(
+        `PlatformBuilder validation failed: ${validation.errors.map((e) => e.message).join("; ")}`
+      );
+    }
+    this.transitionTo("Building");
+    this._logger.info("Build Started");
+    const platformContext = {
+      platformId: `plt_${globalThis.crypto.randomUUID()}`,
+      version: PLATFORM_VERSION2,
+      namespace: "openlearn.core",
+      mode: this._config.mode,
+      environment: {
+        type: this._environment,
+        isDevelopment: this._environment === "development",
+        isProduction: this._environment === "production",
+        isTest: this._environment === "test",
+        isPluginSandbox: false
       },
-      showToast: function (message, type) {
-        return call('ui.toast', [message, type || 'info']);
+      config: this._config,
+      featureFlags: {
+        isEnabled: () => true,
+        getFlag: (_, def) => def,
+        getAllFlags: () => ({})
       },
-      resize: function (height) {
-        post({ type: 'resize', height: Number(height) || 0 });
+      runtimeMetadata: {
+        os: process.platform,
+        nodeVersion: process.version,
+        arch: process.arch,
+        processId: process.pid,
+        memoryUsage: process.memoryUsage(),
+        buildVersion: PLATFORM_VERSION2
       },
-    },
-    invokeCommand: function (type, payload) {
-      return call('command.invoke', [type, payload]);
-    },
-    api: {
-      get: function (path) {
-        return call('api.get', [path]);
+      bootstrapState: "Bootstrapping",
+      logger: this._logger,
+      diagnostics: {
+        getMetrics: () => ({ uptime: 0 }),
+        getSystemStatus: () => ({ isHealthy: true, activeServicesCount: this._services.size, uptimeSeconds: 0 })
       },
-      post: function (path, body) {
-        return call('api.post', [path, body]);
+      serviceLocator: {
+        hasService: (id) => this._services.has(id),
+        getService: (id) => this._services.get(id)
       },
-      del: function (path) {
-        return call('api.del', [path]);
+      capabilityCatalog: {
+        hasCapability: (id) => this._capabilities.has(id),
+        getCapability: (id) => this._capabilities.get(id)
       },
-    },
-    storage: {
-      get: function (key) {
-        return call('storage.get', [key]);
+      extensionCatalog: {
+        hasExtension: (id) => this._extensions.has(id),
+        getExtension: (id) => this._extensions.get(id)
       },
-      set: function (key, value) {
-        return call('storage.set', [key, value]);
+      eventDispatcher: {
+        dispatch: async () => {
+        }
       },
-      delete: function (key) {
-        return call('storage.delete', [key]);
+      shutdownToken: {
+        isRequested: false,
+        onShutdown: () => {
+        }
+      }
+    };
+    const buildDurationMs = Date.now() - buildStart;
+    this.transitionTo("Built");
+    this._logger.info(`Build Completed in ${buildDurationMs} ms`);
+    const result = {
+      platformContext,
+      pipeline: this._pipeline,
+      buildDurationMs,
+      validation,
+      metadata: Object.fromEntries(this._metadata.entries()),
+      builderVersion: PLATFORM_VERSION2
+    };
+    return result;
+  }
+  async build() {
+    const res = this.buildResult();
+    return {
+      currentStage: "Created" /* Created */,
+      context: res.platformContext,
+      pipeline: res.pipeline,
+      start: async () => {
       },
-    },
-  };
-
-  window.OpenLearnPluginBridge = bridge;
-  // \u901A\u77E5\u5BBF\u4E3B\u89C6\u56FE\u6C99\u7BB1 iframe \u5DF2\u5C31\u7EEA
-  post({ type: 'ready' });
-})();
-`;
+      shutdown: async () => {
+      },
+      dispose: async () => {
+      }
+    };
+  }
+  async start() {
+    const kernel = await this.build();
+    await kernel.start();
+    return kernel;
+  }
+  async shutdown() {
+    this.transitionTo("Disposed");
+  }
+  dispose() {
+    this._state = "Disposed";
+    this._services.clear();
+    this._capabilities.clear();
+    this._extensions.clear();
+    this._metadata.clear();
+  }
+};
 
 // packages/core/bootstrap/adapter/bootstrap-registration.ts
 var BootstrapRegistration = class {
@@ -38406,9 +38140,12 @@ var generateStudentNumber = (db2) => {
   return `S${nextSeq.toString().padStart(3, "0")}`;
 };
 
+// server/services/ai-provider-resolver.ts
+init_ai_provider_resolver();
+
 // server/routes/os.ts
 function registerOsRoutes(ctx) {
-  const { app, runGeminiAgentChat: runGeminiAgentChat2, runOpenAIAgentChat: runOpenAIAgentChat2, activityRegistry, aiLimiter } = ctx;
+  const { app, runOpenAIAgentChat: runOpenAIAgentChat2, activityRegistry, aiLimiter } = ctx;
   app.get("/api/ping", (_req, res) => {
     res.json({ ok: true, ts: Date.now() });
   });
@@ -38627,13 +38364,10 @@ function registerOsRoutes(ctx) {
       }
       let callerRole;
       let userId;
-      const token = getCookieToken(req);
-      if (token) {
-        const session = getValidSession(token);
-        if (session) {
-          callerRole = session.role;
-          userId = session.userId;
-        }
+      const session = req.session || (getCookieToken(req) ? getValidSession(getCookieToken(req)) : null);
+      if (session) {
+        callerRole = session.role;
+        userId = session.userId || session.username;
       }
       const convKey = `agent:${userId || "anonymous"}:${currentLessonId || "global"}`;
       const MEMORY_TURNS = 20;
@@ -38643,19 +38377,17 @@ function registerOsRoutes(ctx) {
         content: r.content
       }));
       let provider;
-      if (providerId) {
-        provider = kernelContainer.db.prepare("SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE id = ?").get(providerId);
-      } else {
-        provider = kernelContainer.db.prepare(
-          "SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE api_key IS NOT NULL AND api_key != '' LIMIT 1"
-        ).get();
-      }
-      if (provider?.api_key) provider.api_key = decryptApiKey(provider.api_key);
-      if (!provider || !provider.api_key || !provider.api_key.trim()) {
-        return res.status(400).json({
+      try {
+        provider = resolveAccessibleAiProvider(kernelContainer.db, {
+          providerId,
+          userId,
+          lang
+        });
+      } catch (err) {
+        return res.status(err.status || 400).json({
           success: false,
-          error: "NO_AI_PROVIDER",
-          message: lang === "zh" ? "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u6DFB\u52A0\u5E76\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002" : 'No active AI Provider configured. Please add and configure an AI Provider in "System Management -> AI Provider Management".'
+          error: err.code || "NO_AI_PROVIDER",
+          message: err.message
         });
       }
       const actorId = getActorId(req);
@@ -42119,7 +41851,7 @@ Provide a short, friendly, and helpful hint (1-2 sentences) directly related to
    * 的按学科硬编码字符串拼接，与课题内容无关。此方法用真实的 LLM 调用取代它。
    */
   async generateOutlineWithAi(params) {
-    const { title, category, description, timeline, lang = "zh" } = params;
+    const { title, category, description, timeline, lang = "zh", providerId, userId } = params;
     const trimmedTitle = (title || "").trim();
     if (!trimmedTitle) {
       const err = new Error(lang === "zh" ? "\u8BFE\u7A0B\u8BFE\u9898\u4E0D\u80FD\u4E3A\u7A7A" : "Course title is required");
@@ -42159,7 +41891,12 @@ ${timelineText}` : "- \u8BFE\u5802\u65F6\u95F4\u8F74\u73AF\u8282\uFF1A\uFF08\u65
    - \`## \u{1F4E5} \u8BFE\u540E\u4F5C\u4E1A\`\uFF1A\u4E00\u4EFD\u660E\u786E\u7684\u8BFE\u540E\u4EFB\u52A1\u4E0E\u63D0\u4EA4\u8981\u6C42\u3002
 4. \u5185\u5BB9\u5FC5\u987B\u7D27\u6263\u8BFE\u9898\u672C\u8EAB\uFF0C\u7981\u6B62\u4F7F\u7528"\u516C\u5F0F A""\u6A21\u5757 1"\u4E4B\u7C7B\u7684\u5360\u4F4D\u7B26\u6216\u4E0E\u8BFE\u9898\u65E0\u5173\u7684\u901A\u7528\u5957\u8BDD\u3002
 5. \u7BC7\u5E45\u63A7\u5236\u5728 600-1000 \u5B57\uFF0C\u8BED\u8A00${lang === "zh" ? "\u4F7F\u7528\u7B80\u4F53\u4E2D\u6587" : "use English"}\u3002`;
-    const raw = await this.aiService.generateText(prompt, { temperature: 0.6, maxTokens: 2048 });
+    const raw = await this.aiService.generateText(prompt, {
+      temperature: 0.6,
+      maxTokens: 2048,
+      userId,
+      providerId
+    });
     const outline = stripReasoningArtifacts(stripOuterCodeFence(String(raw || "").trim()));
     if (!outline) {
       const err = new Error(
@@ -42423,13 +42160,17 @@ function registerLessonsRoutes(ctx) {
     safeAiLimiter,
     async (req, res) => {
       try {
-        const { title, category, description, timeline, lang } = req.body || {};
+        const { title, category, description, timeline, lang, providerId } = req.body || {};
+        const session = req.session;
+        const userId = session?.userId || session?.username;
         const content = await lessonService.generateOutlineWithAi({
           title,
           category,
           description,
           timeline,
-          lang
+          lang,
+          providerId,
+          userId
         });
         res.json({ success: true, content });
       } catch (e) {
@@ -48515,7 +48256,7 @@ var ScheduleService = class {
    * Timetable OCR 课表图像识别与数据清洗
    */
   async processTimetableOcr(imageBase64, options = {}) {
-    const { lang = "zh", providerId } = options;
+    const { lang = "zh", providerId, userId } = options;
     if (!imageBase64) {
       throw new Error("imageBase64 is required");
     }
@@ -48546,21 +48287,11 @@ var ScheduleService = class {
 
 \u8FD4\u56DE\u683C\u5F0F\u793A\u4F8B\uFF1A
 [{"dayOfWeek":1,"periodNumber":1,"className":"\u9AD8\u4E00(13)","subject":"\u4FE1\u606F","timeSlot":"08:00-08:40","location":"312","teacherName":""}]`;
-    let provider;
-    if (providerId) {
-      provider = this.db.prepare("SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE id = ?").get(providerId);
-    }
-    if (!provider) {
-      provider = this.db.prepare(
-        "SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE api_key IS NOT NULL AND api_key != '' ORDER BY created_at DESC LIMIT 1"
-      ).get();
-    }
-    if (provider?.api_key) provider.api_key = decryptApiKey(provider.api_key);
-    if (!provider || !provider.api_key || !provider.api_key.trim()) {
-      throw new Error(
-        lang === "zh" ? "\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u6DFB\u52A0\u5E76\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002" : 'No AI provider configured. Please add and configure an AI Provider in "System Management -> AI Provider Management".'
-      );
-    }
+    const provider = resolveAccessibleAiProvider(this.db, {
+      providerId,
+      userId,
+      lang
+    });
     let chatUrl = provider.api_url.trim();
     if (!chatUrl.endsWith("/chat/completions")) {
       chatUrl = chatUrl.endsWith("/") ? chatUrl + "chat/completions" : chatUrl + "/chat/completions";
@@ -48776,7 +48507,9 @@ function registerSchedulesRoutes(ctx) {
     const startTime = Date.now();
     try {
       const { imageBase64, lang = "zh", providerId } = req.body;
-      const result = await scheduleService.processTimetableOcr(imageBase64, { lang, providerId });
+      const session = req.session;
+      const userId = session?.userId || session?.username;
+      const result = await scheduleService.processTimetableOcr(imageBase64, { lang, providerId, userId });
       res.json({
         success: true,
         entries: result.entries,
@@ -49162,7 +48895,7 @@ var GradingService = class {
   }
   // ── 6. AI 学期综合总评评语生成 ────────────────────────────────────────────────
   async generateSemesterAiEvaluation(params) {
-    const { classId, studentId, semesterName = "2026\u5E74\u6625\u5B63\u5B66\u671F", providerId } = params;
+    const { classId, studentId, semesterName = "2026\u5E74\u6625\u5B63\u5B66\u671F", providerId, userId } = params;
     const student = this.db.prepare("SELECT name FROM students WHERE id = ?").get(studentId);
     if (!student) {
       throw new Error("Student not found");
@@ -49220,13 +48953,10 @@ ${examsText}
    - \u6307\u51FA\u5176\u53EF\u4EE5\u6539\u8FDB\u7684\u5730\u65B9\uFF08\u5982\u8FDB\u5EA6\u843D\u540E\u3001\u8003\u8BD5\u53D1\u6325\u4E0D\u4F73\u7B49\uFF09\uFF0C\u8BED\u6C14\u8981\u975E\u5E38\u6E29\u67D4\u3001\u59D4\u5A49\uFF0C\u7ED9\u4E88\u5176\u4FE1\u5FC3\u3002
    - \u5BF9\u672A\u6765\u7684\u671F\u8BB8\uFF0C\u6FC0\u52B1\u5B66\u751F\u5728\u4E0B\u5B66\u671F\u7EE7\u7EED\u52AA\u529B\u3002
 3. \u957F\u5EA6\u63A7\u5236\u5728 150-250 \u5B57\u4E4B\u95F4\u3002\u4E0D\u8981\u5305\u542B\u4EFB\u4F55 Markdown \u683C\u5F0F\uFF0C\u53EA\u8FD4\u56DE\u7EAF\u6587\u672C\u8BC4\u8BED\u3002`;
-    const provider = providerId ? this.db.prepare("SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE id = ?").get(providerId) : this.db.prepare(
-      "SELECT id, name, api_url, api_key, model_name FROM ai_providers WHERE api_key IS NOT NULL AND api_key != '' LIMIT 1"
-    ).get();
-    if (provider?.api_key) provider.api_key = decryptApiKey(provider.api_key);
-    if (!provider || !provider.api_key || !provider.api_key.trim()) {
-      throw new Error("\u672A\u68C0\u6D4B\u5230\u53EF\u7528\u7684 AI \u63D0\u4F9B\u5546\u3002\u8BF7\u524D\u5F80\u300C\u7CFB\u7EDF\u7BA1\u7406 -> AI \u63D0\u4F9B\u5546\u7BA1\u7406\u300D\u6DFB\u52A0\u5E76\u914D\u7F6E\u5927\u6A21\u578B\u670D\u52A1\u3002");
-    }
+    const provider = resolveAccessibleAiProvider(this.db, {
+      providerId,
+      userId
+    });
     let chatUrl = provider.api_url.trim();
     if (!chatUrl.endsWith("/chat/completions")) {
       chatUrl = chatUrl.endsWith("/") ? chatUrl + "chat/completions" : chatUrl + "/chat/completions";
@@ -49499,11 +49229,14 @@ function registerGradingRoutes(ctx) {
         const { classId, studentId } = req.params;
         if (gate(req, res, classId, "staff")) return;
         const { semesterName = "2026\u5E74\u6625\u5B63\u5B66\u671F", providerId } = req.body;
+        const session = req.session;
+        const userId = session?.userId || session?.username;
         const aiEvaluation = await gradingService.generateSemesterAiEvaluation({
           classId,
           studentId,
           semesterName,
-          providerId
+          providerId,
+          userId
         });
         res.json({ success: true, aiEvaluation });
       } catch (e) {
@@ -49931,7 +49664,8 @@ async function pluginApiGatewayMiddleware(req, res, next) {
     }
   }
   const clientIp = req.ip || req.socket?.remoteAddress || "unknown-ip";
-  const rateLimitKey = `${clientIp}:${resolvedUuid || pluginId}:${method}:${normalizedSubPath}`;
+  const identityKey = auth.isAuthenticated ? `u:${String(auth.userId || auth.username || auth.actorId).slice(0, 64)}` : `ip:${clientIp}`;
+  const rateLimitKey = `${identityKey}:${resolvedUuid || pluginId}:${method}:${normalizedSubPath}`;
   const windowMs = matchedRule?.rateLimit?.windowMs ?? 60 * 1e3;
   const maxRequests = matchedRule?.rateLimit?.max ?? 120;
   if (!rateLimiter.consume(rateLimitKey, maxRequests, windowMs)) {
@@ -50920,16 +50654,9 @@ function listInstalledManifestVersions() {
   return installed;
 }
 function registerPluginsRoutes(ctx) {
-  const {
-    app,
-    aiLimiter,
-    buildOpenAITools: buildOpenAITools2,
-    executeAgentToolCall: executeAgentToolCall2,
-    buildOpenAIChatUrl: buildOpenAIChatUrl2,
-    runGeminiAgentChat: runGeminiAgentChat2,
-    runOpenAIAgentChat: runOpenAIAgentChat2
-  } = ctx;
-  const safeAiLimiter = typeof aiLimiter === "function" ? aiLimiter : (_req, _res, next) => next();
+  const { app, aiLimiter } = ctx;
+  const noopMiddleware = (_req, _res, next) => next();
+  const safeAiLimiter = typeof aiLimiter === "function" ? aiLimiter : noopMiddleware;
   app.get("/api/docs/plugin-guide", (req, res) => {
     try {
       const docPath = import_path22.default.join(process.cwd(), "docs_plugin_guide.md");
@@ -51965,9 +51692,13 @@ function registerPluginsRoutes(ctx) {
     }
   });
   app.all("/api/plugins/:pluginId/*", pluginApiGatewayMiddleware);
-  app.get("/api/ai-providers", requireAuth("teacher", "administrator"), (req, res) => {
+  app.get("/api/ai-providers", requireScopedAuth("self", "teacher", "administrator"), (req, res) => {
     try {
-      const providers = kernelContainer.db.prepare("SELECT * FROM ai_providers ORDER BY created_at DESC").all();
+      const session = req.session;
+      const currentUserId = session?.userId || session?.username;
+      const providers = kernelContainer.db.prepare(
+        "SELECT id, name, api_url, api_key, model_name, owner_id, is_shared, created_at, updated_at FROM ai_providers WHERE (owner_id = ? OR is_shared = 1) ORDER BY created_at DESC"
+      ).all(currentUserId);
       const masked = providers.map((p) => {
         let apiKey;
         try {
@@ -51975,54 +51706,122 @@ function registerPluginsRoutes(ctx) {
         } catch {
           apiKey = "[UNDECRYPTABLE]";
         }
-        return { ...p, api_key: apiKey };
+        return {
+          ...p,
+          api_key: apiKey,
+          is_shared: Number(p.is_shared) === 1
+        };
       });
       res.json(masked);
     } catch (e) {
       sendSafeError(res, e);
     }
   });
-  app.post("/api/ai-providers", requireAuth("administrator"), (req, res) => {
+  app.post("/api/ai-providers", requireScopedAuth("self", "teacher", "administrator"), (req, res) => {
     try {
-      const { name, api_url, api_key, model_name } = req.body;
+      const session = req.session;
+      const currentUserId = session?.userId || session?.username;
+      const isAdmin = isAdministrator2(session);
+      const { name, api_url, api_key, model_name, is_shared } = req.body;
       if (!name || !api_url || !model_name) {
         return res.status(400).json({ error: "Missing name, api_url or model_name" });
       }
+      const wantsShared = is_shared === 1 || is_shared === true || is_shared === "1";
+      if (wantsShared && !isAdmin) {
+        return res.status(403).json({ error: "Only administrators can create platform shared providers" });
+      }
       const id = "prov_" + Date.now();
       const now = Date.now();
       const encryptedKey = api_key ? encryptApiKey(api_key) : "";
       kernelContainer.db.prepare(
-        "INSERT INTO ai_providers (id, name, api_url, api_key, model_name, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)"
-      ).run(id, name, api_url, encryptedKey, model_name, now, now);
+        "INSERT INTO ai_providers (id, name, api_url, api_key, model_name, owner_id, is_shared, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
+      ).run(
+        id,
+        name.trim(),
+        api_url.trim(),
+        encryptedKey,
+        model_name.trim(),
+        currentUserId,
+        wantsShared && isAdmin ? 1 : 0,
+        now,
+        now
+      );
       res.json({ success: true, id });
     } catch (e) {
       sendSafeError(res, e);
     }
   });
-  app.put("/api/ai-providers/:id", requireAuth("administrator"), (req, res) => {
+  app.put("/api/ai-providers/:id", requireScopedAuth("self", "teacher", "administrator"), (req, res) => {
     try {
-      const { name, api_url, api_key, model_name } = req.body;
+      const session = req.session;
+      const currentUserId = session?.userId || session?.username;
+      const isAdmin = isAdministrator2(session);
+      const { name, api_url, api_key, model_name, is_shared } = req.body;
       if (!name || !api_url || !model_name) {
         return res.status(400).json({ error: "Missing name, api_url or model_name" });
       }
+      const existing = kernelContainer.db.prepare("SELECT id, api_key, owner_id, is_shared FROM ai_providers WHERE id = ?").get(req.params.id);
+      if (!existing) {
+        return res.status(404).json({ error: "AI provider not found" });
+      }
+      const isExistingShared = Number(existing.is_shared) === 1;
+      if (isExistingShared) {
+        if (!isAdmin) {
+          return res.status(403).json({ error: "Forbidden: Only administrators can modify platform shared providers" });
+        }
+      } else {
+        if (existing.owner_id !== currentUserId) {
+          return res.status(403).json({
+            error: "Forbidden: You do not have permission to modify another user's private AI provider"
+          });
+        }
+      }
+      let nextShared = existing.is_shared ?? 0;
+      if (is_shared !== void 0) {
+        const wantsShared = is_shared === 1 || is_shared === true || is_shared === "1";
+        if (wantsShared !== (Number(existing.is_shared) === 1)) {
+          if (!isAdmin) {
+            return res.status(403).json({ error: "Forbidden: Only administrators can change platform shared status" });
+          }
+          nextShared = wantsShared ? 1 : 0;
+        }
+      }
       const now = Date.now();
       let finalKey;
       if (api_key && api_key.trim() !== "" && !api_key.includes("****")) {
         finalKey = encryptApiKey(api_key);
       } else {
-        const existing = kernelContainer.db.prepare("SELECT api_key FROM ai_providers WHERE id = ?").get(req.params.id);
         finalKey = existing?.api_key || "";
       }
       kernelContainer.db.prepare(
-        "UPDATE ai_providers SET name = ?, api_url = ?, api_key = ?, model_name = ?, updated_at = ? WHERE id = ?"
-      ).run(name, api_url, finalKey, model_name, now, req.params.id);
+        "UPDATE ai_providers SET name = ?, api_url = ?, api_key = ?, model_name = ?, is_shared = ?, updated_at = ? WHERE id = ?"
+      ).run(name.trim(), api_url.trim(), finalKey, model_name.trim(), nextShared, now, req.params.id);
       res.json({ success: true });
     } catch (e) {
       sendSafeError(res, e);
     }
   });
-  app.delete("/api/ai-providers/:id", requireAuth("administrator"), (req, res) => {
+  app.delete("/api/ai-providers/:id", requireScopedAuth("self", "teacher", "administrator"), (req, res) => {
     try {
+      const session = req.session;
+      const currentUserId = session?.userId || session?.username;
+      const isAdmin = isAdministrator2(session);
+      const existing = kernelContainer.db.prepare("SELECT id, owner_id, is_shared FROM ai_providers WHERE id = ?").get(req.params.id);
+      if (!existing) {
+        return res.status(404).json({ error: "AI provider not found" });
+      }
+      const isExistingShared = Number(existing.is_shared) === 1;
+      if (isExistingShared) {
+        if (!isAdmin) {
+          return res.status(403).json({ error: "Forbidden: Only administrators can delete platform shared providers" });
+        }
+      } else {
+        if (existing.owner_id !== currentUserId) {
+          return res.status(403).json({
+            error: "Forbidden: You do not have permission to delete another user's private AI provider"
+          });
+        }
+      }
       kernelContainer.db.prepare("DELETE FROM ai_providers WHERE id = ?").run(req.params.id);
       res.json({ success: true });
     } catch (e) {
@@ -52105,65 +51904,82 @@ function registerPluginsRoutes(ctx) {
       sendSafeError(res, e);
     }
   });
-  app.post("/api/ai-providers/test", requireAuth("administrator"), safeAiLimiter, async (req, res) => {
-    try {
-      const { api_url, api_key: providedKey, model_name } = req.body;
-      if (!api_url || !model_name) {
-        return res.status(400).json({ error: "api_url and model_name are required" });
-      }
-      let api_key = "";
-      if (providedKey && providedKey.includes("****")) {
-        const existing = kernelContainer.db.prepare("SELECT api_key FROM ai_providers WHERE api_url = ? AND model_name = ? LIMIT 1").get(api_url, model_name);
-        api_key = existing ? decryptApiKey(existing.api_key) : "";
-      } else if (providedKey) {
-        api_key = providedKey.includes(":") ? decryptApiKey(providedKey) : providedKey;
-      }
-      let cleanUrl = api_url.trim();
-      if (!cleanUrl.endsWith("/chat/completions")) {
-        cleanUrl = cleanUrl.endsWith("/") ? cleanUrl + "chat/completions" : cleanUrl + "/chat/completions";
-      }
-      const urlSafety = isSafeExternalUrl(cleanUrl);
-      if (!urlSafety.safe) {
-        return res.status(400).json({ error: `Blocked unsafe AI provider URL: ${urlSafety.reason}` });
-      }
-      let response;
+  app.post(
+    "/api/ai-providers/test",
+    requireScopedAuth("self", "teacher", "administrator"),
+    safeAiLimiter,
+    async (req, res) => {
       try {
-        response = await fetchWithSafeRedirects(cleanUrl, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${api_key || ""}`
-          },
-          body: JSON.stringify({
-            model: model_name,
-            messages: [{ role: "user", content: "Say connected" }],
-            max_tokens: 5
-          }),
-          timeoutMs: 1e4
-        });
-      } catch (err) {
-        const isTimeout = err instanceof AIFetchTimeoutError || err?.name === "TimeoutError" || err?.name === "AbortError" || /abort|timeout/i.test(err?.message ?? "");
-        if (isTimeout) {
-          return res.status(504).json({
+        const session = req.session;
+        const currentUserId = session?.userId || session?.username;
+        const { api_url, api_key: providedKey, model_name, id } = req.body;
+        if (!api_url || !model_name) {
+          return res.status(400).json({ error: "api_url and model_name are required" });
+        }
+        let api_key = "";
+        if (providedKey && providedKey.includes("****")) {
+          let existing;
+          if (id) {
+            existing = kernelContainer.db.prepare("SELECT api_key FROM ai_providers WHERE id = ? AND (owner_id = ? OR is_shared = 1)").get(id, currentUserId);
+          } else {
+            existing = kernelContainer.db.prepare(
+              "SELECT api_key FROM ai_providers WHERE api_url = ? AND model_name = ? AND (owner_id = ? OR is_shared = 1) LIMIT 1"
+            ).get(api_url, model_name, currentUserId);
+          }
+          if (!existing) {
+            return res.status(403).json({ error: "Forbidden: Cannot access key for this provider" });
+          }
+          api_key = decryptApiKey(existing.api_key);
+        } else if (providedKey) {
+          api_key = providedKey.includes(":") ? decryptApiKey(providedKey) : providedKey;
+        }
+        let cleanUrl = api_url.trim();
+        if (!cleanUrl.endsWith("/chat/completions")) {
+          cleanUrl = cleanUrl.endsWith("/") ? cleanUrl + "chat/completions" : cleanUrl + "/chat/completions";
+        }
+        const urlSafety = isSafeExternalUrl(cleanUrl);
+        if (!urlSafety.safe) {
+          return res.status(400).json({ error: `Blocked unsafe AI provider URL: ${urlSafety.reason}` });
+        }
+        let response;
+        try {
+          response = await fetchWithSafeRedirects(cleanUrl, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Authorization: `Bearer ${api_key || ""}`
+            },
+            body: JSON.stringify({
+              model: model_name,
+              messages: [{ role: "user", content: "Say connected" }],
+              max_tokens: 5
+            }),
+            timeoutMs: 1e4
+          });
+        } catch (err) {
+          const isTimeout = err instanceof AIFetchTimeoutError || err?.name === "TimeoutError" || err?.name === "AbortError" || /abort|timeout/i.test(err?.message ?? "");
+          if (isTimeout) {
+            return res.status(504).json({
+              success: false,
+              error: "AI Provider request timed out after 10000ms. Please verify the URL or provider availability."
+            });
+          }
+          throw err;
+        }
+        const responseText = await response.text();
+        if (response.ok) {
+          res.json({ success: true, message: "Successfully connected and received response." });
+        } else {
+          res.status(response.status).json({
             success: false,
-            error: "AI Provider request timed out after 10000ms. Please verify the URL or provider availability."
+            error: `API responded with status ${response.status}: ${responseText.slice(0, 200)}`
           });
         }
-        throw err;
-      }
-      const responseText = await response.text();
-      if (response.ok) {
-        res.json({ success: true, message: "Successfully connected and received response." });
-      } else {
-        res.status(response.status).json({
-          success: false,
-          error: `API responded with status ${response.status}: ${responseText.slice(0, 200)}`
-        });
+      } catch (e) {
+        sendSafeError(res, e, 500, "Connection failed");
       }
-    } catch (e) {
-      sendSafeError(res, e, 500, "Connection failed");
     }
-  });
+  );
 }
 
 // server/services/assessment-service.ts
@@ -58608,12 +58424,16 @@ async function startServer() {
   const defaultWriteLimit = process.env.PLAYWRIGHT_TEST ? 1e4 : isDev ? 600 : 180;
   const writeLimiter = createWriteLimiter(defaultWriteLimit);
   const viewStateLimiter = createWriteLimiter(process.env.PLAYWRIGHT_TEST ? 1e4 : isDev ? 600 : 120);
+  const pluginApiLimiter = createSessionWriteLimiter(process.env.PLAYWRIGHT_TEST ? 1e4 : 600);
   const aiLimiter = createAiLimiter(process.env.PLAYWRIGHT_TEST ? 1e3 : 10);
   app.use((req, res, next) => {
     if (req.method === "POST" || req.method === "PUT" || req.method === "DELETE") {
       if (/^\/api\/classroom\/sessions\/[^/]+\/view-state\/?$/.test(req.path)) {
         return viewStateLimiter(req, res, next);
       }
+      if (req.path.startsWith("/api/plugins/")) {
+        return pluginApiLimiter(req, res, next);
+      }
       return writeLimiter(req, res, next);
     }
     next();