openlearn-next 0.7.4 → 0.7.6

package/dist/server.cjs

@@ -944,6 +944,9 @@ var init_manifest_schema = __esm({
       "stage.display.overlay": import_zod.z.array(frontendSlotEntrySchema).optional(),
       "stage.display.action": import_zod.z.array(frontendSlotEntrySchema).optional(),
       "assignment.submission.preview": import_zod.z.array(frontendSlotEntrySchema).optional(),
+      // 作业**附件**预览：插件声明自己能处理的文件类型（extensions / mimeTypes），
+      // 宿主在预览对话框里按类型匹配后给出入口。数据型贡献（远程插件可用）。
+      "assignment.file.preview": import_zod.z.array(frontendSlotEntrySchema).optional(),
       "student.classroom.overlay": import_zod.z.array(frontendSlotEntrySchema).optional(),
       "student.profile.tab": import_zod.z.array(frontendSlotEntrySchema).optional(),
       "whiteboard.renderer": import_zod.z.array(frontendSlotEntrySchema).optional(),
@@ -1188,12 +1191,12 @@ var init_manifest_schema = __esm({
 // packages/core/di/api-key-crypto.ts
 function resolveEncryptionKeyStorageDir(env = process.env, cwd = process.cwd()) {
   if (env.OPENLEARN_DATA_DIR?.trim()) {
-    return import_node_path4.default.join(import_node_path4.default.resolve(env.OPENLEARN_DATA_DIR.trim()), "storage");
+    return import_node_path5.default.join(import_node_path5.default.resolve(env.OPENLEARN_DATA_DIR.trim()), "storage");
   }
   if (env.OPENLEARN_DB_PATH?.trim()) {
-    return import_node_path4.default.join(import_node_path4.default.dirname(import_node_path4.default.resolve(env.OPENLEARN_DB_PATH.trim())), "storage");
+    return import_node_path5.default.join(import_node_path5.default.dirname(import_node_path5.default.resolve(env.OPENLEARN_DB_PATH.trim())), "storage");
   }
-  return import_node_path4.default.join(cwd, "storage");
+  return import_node_path5.default.join(cwd, "storage");
 }
 function normalizeKeyHex(raw) {
   let value = raw.trim();
@@ -1214,7 +1217,7 @@ function readProcessEnvKey(env) {
   return normalizeKeyHex(raw);
 }
 function readDotEnvKey(cwd) {
-  const envPath = import_node_path4.default.resolve(cwd, ".env");
+  const envPath = import_node_path5.default.resolve(cwd, ".env");
   if (!import_node_fs4.default.existsSync(envPath)) return null;
   let content = "";
   try {
@@ -1227,7 +1230,7 @@ function readDotEnvKey(cwd) {
   return normalizeKeyHex(match[1] ?? "");
 }
 function keyFilePath(storageDir) {
-  return import_node_path4.default.join(storageDir, ENCRYPTION_KEY_FILE_NAME);
+  return import_node_path5.default.join(storageDir, ENCRYPTION_KEY_FILE_NAME);
 }
 function chmodKeyFile(filePath) {
   try {
@@ -1253,7 +1256,7 @@ function keysEqual(left, right) {
   return import_node_crypto.default.timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
 }
 function persistGeneratedKey(filePath, generated) {
-  import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(filePath), { recursive: true });
+  import_node_fs4.default.mkdirSync(import_node_path5.default.dirname(filePath), { recursive: true });
   try {
     import_node_fs4.default.writeFileSync(filePath, `${generated}
 `, { mode: 384, flag: "wx" });
@@ -1400,13 +1403,13 @@ function encryptStoredPlaintextApiKeys(db2) {
   }
   return { updated, skipped };
 }
-var import_node_crypto, import_node_fs4, import_node_path4, ENCRYPTION_KEY_FILE_NAME, AUTO_GENERATED_KEY_WARNING, HEX_64, EncryptionKeyInvalidError, EncryptionKeyMismatchError, cached;
+var import_node_crypto, import_node_fs4, import_node_path5, ENCRYPTION_KEY_FILE_NAME, AUTO_GENERATED_KEY_WARNING, HEX_64, EncryptionKeyInvalidError, EncryptionKeyMismatchError, cached;
 var init_api_key_crypto = __esm({
   "packages/core/di/api-key-crypto.ts"() {
     "use strict";
     import_node_crypto = __toESM(require("node:crypto"), 1);
     import_node_fs4 = __toESM(require("node:fs"), 1);
-    import_node_path4 = __toESM(require("node:path"), 1);
+    import_node_path5 = __toESM(require("node:path"), 1);
     ENCRYPTION_KEY_FILE_NAME = "encryption-key";
     AUTO_GENERATED_KEY_WARNING = "\u6B63\u5728\u4F7F\u7528\u81EA\u52A8\u751F\u6210\u7684\u52A0\u5BC6\u5BC6\u94A5\uFF08storage/encryption-key\uFF0C\u4E0E bootstrap-credentials.txt \u540C\u76EE\u5F55\uFF0C\u6743\u9650 600\uFF09\u3002\u5EFA\u8BAE\u8BBE\u7F6E\u73AF\u5883\u53D8\u91CF ENCRYPTION_KEY \u4E3A\u8BE5\u6587\u4EF6\u4E2D\u7684 64 \u4F4D hex\uFF0C\u5E76\u79BB\u7EBF\u5907\u4EFD\u8BE5\u6587\u4EF6\u3002site-backup \u4E0D\u5305\u542B\u6B64\u6587\u4EF6\u3002\u4E22\u5931\u540E\u65E0\u6CD5\u89E3\u5BC6 AI Provider API Key \u4E0E\u73ED\u7EA7\u4E34\u65F6\u53E3\u4EE4\u3002";
     HEX_64 = /^[0-9a-fA-F]{64}$/;
@@ -1921,10 +1924,10 @@ function getMaxUncompressedSize() {
 }
 function isInsideRoot(root, target) {
   if (!root || !target) return false;
-  const rel = path8.relative(path8.resolve(root), path8.resolve(target));
+  const rel = path9.relative(path9.resolve(root), path9.resolve(target));
   if (rel === "") return false;
-  if (path8.isAbsolute(rel)) return false;
-  return rel !== ".." && !rel.startsWith(".." + path8.sep);
+  if (path9.isAbsolute(rel)) return false;
+  return rel !== ".." && !rel.startsWith(".." + path9.sep);
 }
 function realPathOrNull(target) {
   try {
@@ -1934,7 +1937,7 @@ function realPathOrNull(target) {
   }
 }
 function realPathOrSelf(target) {
-  return realPathOrNull(target) ?? path8.resolve(target);
+  return realPathOrNull(target) ?? path9.resolve(target);
 }
 function getMaxUploadBodyBytes() {
   return getMaxUncompressedSize();
@@ -1949,7 +1952,7 @@ function writeBufferToTempZip(buffer, prefix = "plugin-upload-") {
   if (!Buffer.isBuffer(buffer) || buffer.length === 0) {
     throw new Error("[install-utils] \u7A7A\u7684 ZIP Buffer");
   }
-  const zipPath = path8.join(os2.tmpdir(), `${prefix}${(0, import_uuid6.v7)()}.zip`);
+  const zipPath = path9.join(os2.tmpdir(), `${prefix}${(0, import_uuid6.v7)()}.zip`);
   fs7.writeFileSync(zipPath, buffer);
   return zipPath;
 }
@@ -2209,13 +2212,13 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
   const esbuild = await import("esbuild");
   const allowedRoots = [];
   const allowRoot = (dir) => {
-    const lexical = path8.resolve(dir);
+    const lexical = path9.resolve(dir);
     if (allowedRoots.some((r) => r.lexical === lexical)) return;
     allowedRoots.push({ lexical, real: realPathOrSelf(lexical) });
   };
   allowRoot(resolveDir);
   const isPermittedPath = (target) => {
-    const resolved = path8.resolve(target);
+    const resolved = path9.resolve(target);
     if (allowedRoots.some((r) => isInsideRoot(r.lexical, resolved))) return true;
     const real = realPathOrNull(resolved);
     if (!real) return false;
@@ -2242,14 +2245,14 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
         setup(build) {
           build.onResolve({ filter: /.*/ }, (args) => {
             if (args.path.includes("core/di/interfaces")) {
-              const tsPath = path8.resolve(process.cwd(), "packages/core/di/interfaces.ts");
+              const tsPath = path9.resolve(process.cwd(), "packages/core/di/interfaces.ts");
               if (fs7.existsSync(tsPath)) {
-                allowRoot(path8.dirname(tsPath));
+                allowRoot(path9.dirname(tsPath));
                 return { path: tsPath };
               }
-              const jsPath = path8.resolve(process.cwd(), "packages/core/di/interfaces.js");
+              const jsPath = path9.resolve(process.cwd(), "packages/core/di/interfaces.js");
               if (fs7.existsSync(jsPath)) {
-                allowRoot(path8.dirname(jsPath));
+                allowRoot(path9.dirname(jsPath));
                 return { path: jsPath };
               }
             }
@@ -2263,8 +2266,8 @@ async function bundlePlugin(entryCode, resolveDir, outfile) {
               };
             }
             if (args.path.startsWith(".")) {
-              const importerDir = args.resolveDir || path8.resolve(resolveDir);
-              const candidate = path8.resolve(importerDir, args.path);
+              const importerDir = args.resolveDir || path9.resolve(resolveDir);
+              const candidate = path9.resolve(importerDir, args.path);
               if (!isPermittedPath(candidate)) {
                 return {
                   errors: [
@@ -2316,8 +2319,8 @@ async function extractZipEntries(zip, destDir, maxTotalBytes) {
   let totalBytes = 0;
   for (const [name, file] of Object.entries(zip.files)) {
     if (file.dir) continue;
-    const filePath = path8.join(destDir, name);
-    fs7.mkdirSync(path8.dirname(filePath), { recursive: true });
+    const filePath = path9.join(destDir, name);
+    fs7.mkdirSync(path9.dirname(filePath), { recursive: true });
     const content = await file.async("nodebuffer");
     totalBytes += content.length;
     if (totalBytes > maxTotalBytes) {
@@ -2373,11 +2376,11 @@ async function validateAndBundleZip(zipPath) {
     throw new Error(`Entry file "${manifest.main}" specified in manifest not found in ZIP package`);
   }
   const entryCode = await entryFile.async("string");
-  const tmpDir = path8.join(os2.tmpdir(), `plugin-build-${(0, import_uuid6.v7)()}`);
+  const tmpDir = path9.join(os2.tmpdir(), `plugin-build-${(0, import_uuid6.v7)()}`);
   try {
     fs7.mkdirSync(tmpDir, { recursive: true });
     await extractZipEntries(zip, tmpDir, getMaxUncompressedSize());
-    const bundledPath = path8.join(os2.tmpdir(), `plugin-bundle-${(0, import_uuid6.v7)()}.mjs`);
+    const bundledPath = path9.join(os2.tmpdir(), `plugin-bundle-${(0, import_uuid6.v7)()}.mjs`);
     await bundlePlugin(entryCode, tmpDir, bundledPath);
     return { manifest, bundledPath, entryFileName: resolvedMain, package: zip };
   } finally {
@@ -2390,14 +2393,14 @@ async function validateAndBundleZip(zipPath) {
 async function extractManifestFromBundle(_bundledCode) {
   throw new Error("extractManifestFromBundle is not yet implemented");
 }
-var import_jszip, fs7, os2, path8, import_uuid6, PluginCodeSecurityError, LEX_SCAN_LIMIT;
+var import_jszip, fs7, os2, path9, import_uuid6, PluginCodeSecurityError, LEX_SCAN_LIMIT;
 var init_install_utils = __esm({
   "packages/core/esm-loader/install-utils.ts"() {
     "use strict";
     import_jszip = __toESM(require("jszip"), 1);
     fs7 = __toESM(require("fs"), 1);
     os2 = __toESM(require("os"), 1);
-    path8 = __toESM(require("path"), 1);
+    path9 = __toESM(require("path"), 1);
     import_uuid6 = require("uuid");
     init_manifest_schema();
     PluginCodeSecurityError = class extends Error {
@@ -2516,12 +2519,12 @@ function resolveAuditRotationConfig(env = process.env) {
   const maxFiles = Math.floor(readPositiveInt(env.AUDIT_LOG_MAX_FILES, 20, "AUDIT_LOG_MAX_FILES"));
   return { maxBytes: Math.floor(maxSizeMb * 1024 * 1024), maxFiles };
 }
-var import_node_fs5, import_node_path5, import_node_stream, activeStreams, exitHookInstalled, RotatingFileStream;
+var import_node_fs5, import_node_path6, import_node_stream, activeStreams, exitHookInstalled, RotatingFileStream;
 var init_rotating_file_stream = __esm({
   "packages/core/observability/rotating-file-stream.ts"() {
     "use strict";
     import_node_fs5 = __toESM(require("node:fs"), 1);
-    import_node_path5 = __toESM(require("node:path"), 1);
+    import_node_path6 = __toESM(require("node:path"), 1);
     import_node_stream = require("node:stream");
     activeStreams = /* @__PURE__ */ new Set();
     exitHookInstalled = false;
@@ -2535,7 +2538,7 @@ var init_rotating_file_stream = __esm({
         this.filePath = options.filePath;
         this.maxBytes = options.maxBytes;
         this.maxFiles = options.maxFiles;
-        this.dir = import_node_path5.default.dirname(this.filePath);
+        this.dir = import_node_path6.default.dirname(this.filePath);
       }
       /** 当前活动文件路径（测试与排障用） */
       get activeFilePath() {
@@ -2640,21 +2643,21 @@ function consoleStream() {
 function createLogger(component) {
   return logger.child({ component });
 }
-var import_pino, import_node_fs6, import_node_path6, defaultLevel, consoleLevel, fileLevel, rootLevel, logDir, logFile, streams, fileLogging, logger;
+var import_pino, import_node_fs6, import_node_path7, defaultLevel, consoleLevel, fileLevel, rootLevel, logDir, logFile, streams, fileLogging, logger;
 var init_logger = __esm({
   "packages/core/observability/logger.ts"() {
     "use strict";
     import_pino = __toESM(require("pino"), 1);
     import_node_fs6 = __toESM(require("node:fs"), 1);
-    import_node_path6 = __toESM(require("node:path"), 1);
+    import_node_path7 = __toESM(require("node:path"), 1);
     init_redaction();
     init_rotating_file_stream();
     defaultLevel = process.env.LOG_LEVEL || (process.env.HTTP_ACCESS_LOG === "all" ? "debug" : process.env.NODE_ENV === "production" ? "info" : "debug");
     consoleLevel = process.env.LOG_CONSOLE_LEVEL || defaultLevel;
     fileLevel = defaultLevel;
     rootLevel = minPinoLevel(consoleLevel, fileLevel);
-    logDir = import_node_path6.default.resolve(process.env.LOG_DIR || import_node_path6.default.join(process.cwd(), "logs"));
-    logFile = import_node_path6.default.join(logDir, "openlearn.log");
+    logDir = import_node_path7.default.resolve(process.env.LOG_DIR || import_node_path7.default.join(process.cwd(), "logs"));
+    logFile = import_node_path7.default.join(logDir, "openlearn.log");
     streams = [
       { level: consoleLevel, stream: consoleStream() }
     ];
@@ -2787,7 +2790,7 @@ function buildAuditLogger() {
   if (process.env.NODE_ENV === "test" || process.env.VITEST) {
     return (0, import_pino2.default)({ level: "silent" }, import_pino2.default.destination(1));
   }
-  const logDir2 = import_node_path7.default.resolve(process.env.LOG_DIR || import_node_path7.default.join(process.cwd(), "logs"));
+  const logDir2 = import_node_path8.default.resolve(process.env.LOG_DIR || import_node_path8.default.join(process.cwd(), "logs"));
   try {
     if (!import_node_fs7.default.existsSync(logDir2)) import_node_fs7.default.mkdirSync(logDir2, { recursive: true });
     import_node_fs7.default.accessSync(logDir2, import_node_fs7.default.constants.W_OK);
@@ -2795,7 +2798,7 @@ function buildAuditLogger() {
     streams2.push({
       level: "info",
       stream: new RotatingFileStream({
-        filePath: import_node_path7.default.join(logDir2, "audit.log"),
+        filePath: import_node_path8.default.join(logDir2, "audit.log"),
         maxBytes: rotation.maxBytes,
         maxFiles: rotation.maxFiles
       })
@@ -2820,12 +2823,12 @@ function recordSecurityAudit(event, fields = {}) {
   }
   return record;
 }
-var import_node_fs7, import_node_path7, import_pino2, testSink, auditLogger;
+var import_node_fs7, import_node_path8, import_pino2, testSink, auditLogger;
 var init_audit_log = __esm({
   "packages/core/observability/audit-log.ts"() {
     "use strict";
     import_node_fs7 = __toESM(require("node:fs"), 1);
-    import_node_path7 = __toESM(require("node:path"), 1);
+    import_node_path8 = __toESM(require("node:path"), 1);
     import_pino2 = __toESM(require("pino"), 1);
     init_logger();
     init_request_context();
@@ -3575,6 +3578,19 @@ var init_errors2 = __esm({
 function scopedId(scopeType, scopeId, key) {
   return `${scopeType}\0${scopeId}\0${key}`;
 }
+function getSharedState(db2, manifestId) {
+  let byManifest = sharedStates.get(db2);
+  if (!byManifest) {
+    byManifest = /* @__PURE__ */ new Map();
+    sharedStates.set(db2, byManifest);
+  }
+  let state = byManifest.get(manifestId);
+  if (!state) {
+    state = { values: /* @__PURE__ */ new Map(), instances: /* @__PURE__ */ new Set() };
+    byManifest.set(manifestId, state);
+  }
+  return state;
+}
 function normalizeWriteScope(scope) {
   const scopeType = scope?.scopeType ?? "platform";
   const scopeId = scope?.scopeId?.trim() ?? "";
@@ -3583,21 +3599,29 @@ function normalizeWriteScope(scope) {
   }
   return { scopeType, scopeId: scopeType === "platform" ? "" : scopeId };
 }
-var CONFIG_SCOPE_TYPES, ConfigService;
+var CONFIG_SCOPE_TYPES, sharedStates, instanceCleanup, ConfigService;
 var init_config_service = __esm({
   "packages/core/plugin-host/config-service.ts"() {
     "use strict";
     CONFIG_SCOPE_TYPES = ["platform", "school", "class"];
+    sharedStates = /* @__PURE__ */ new WeakMap();
+    instanceCleanup = new FinalizationRegistry(
+      ({ state, ref }) => {
+        state.instances.delete(ref);
+      }
+    );
     ConfigService = class _ConfigService {
       constructor(db2, manifest) {
-        /** In-memory cache (scoped key → value). `null` 表示「明确没有值」，避免反复查询。 */
-        this.values = /* @__PURE__ */ new Map();
-        /** Change listeners. */
+        /** Change listeners（每个实例独立，广播时按实例分发）。 */
         this.listeners = /* @__PURE__ */ new Set();
         this.tableEnsured = false;
         this.db = db2;
         this.manifestId = manifest.id;
         this.schema = manifest.configuration?.properties ?? {};
+        this.state = getSharedState(db2, manifest.id);
+        const ref = new WeakRef(this);
+        this.state.instances.add(ref);
+        instanceCleanup.register(this, { state: this.state, ref });
       }
       static {
         this.KEY_PREFIX = "config:";
@@ -3660,21 +3684,21 @@ var init_config_service = __esm({
       }
       readScoped(key, scopeType, scopeId) {
         const cacheKey2 = scopedId(scopeType, scopeId, key);
-        if (this.values.has(cacheKey2)) {
-          const cached3 = this.values.get(cacheKey2);
+        if (this.state.values.has(cacheKey2)) {
+          const cached3 = this.state.values.get(cacheKey2);
           return cached3 === null ? { found: false } : { found: true, value: cached3 };
         }
         const row = this.queryScoped(key, scopeType, scopeId);
         if (!row) {
-          this.values.set(cacheKey2, null);
+          this.state.values.set(cacheKey2, null);
           return { found: false };
         }
         try {
           const parsed = JSON.parse(row.value);
-          this.values.set(cacheKey2, parsed);
+          this.state.values.set(cacheKey2, parsed);
           return { found: true, value: parsed };
         } catch {
-          this.values.set(cacheKey2, row.value);
+          this.state.values.set(cacheKey2, row.value);
           return { found: true, value: row.value };
         }
       }
@@ -3690,21 +3714,21 @@ var init_config_service = __esm({
       }
       readLegacyPlatformValue(key) {
         const cacheKey2 = scopedId("platform", "", `legacy:${key}`);
-        if (this.values.has(cacheKey2)) {
-          const cached3 = this.values.get(cacheKey2);
+        if (this.state.values.has(cacheKey2)) {
+          const cached3 = this.state.values.get(cacheKey2);
           return cached3 === null ? { found: false } : { found: true, value: cached3 };
         }
         try {
           const row = this.db.prepare("SELECT value FROM plugin_storage WHERE plugin_id = ? AND key = ?").get(this.manifestId, _ConfigService.KEY_PREFIX + key);
           if (!row) {
-            this.values.set(cacheKey2, null);
+            this.state.values.set(cacheKey2, null);
             return { found: false };
           }
           const parsed = JSON.parse(row.value);
-          this.values.set(cacheKey2, parsed);
+          this.state.values.set(cacheKey2, parsed);
           return { found: true, value: parsed };
         } catch {
-          this.values.set(cacheKey2, null);
+          this.state.values.set(cacheKey2, null);
           return { found: false };
         }
       }
@@ -3760,8 +3784,8 @@ var init_config_service = __esm({
         const { scopeType, scopeId } = normalizeWriteScope(scope);
         this.assertScopeAllowed(key, scopeType);
         const cacheKey2 = scopedId(scopeType, scopeId, key);
-        const previous = this.values.get(cacheKey2);
-        this.values.set(cacheKey2, value);
+        const previous = this.state.values.get(cacheKey2);
+        this.state.values.set(cacheKey2, value);
         try {
           this.ensureTable();
           this.db.prepare(
@@ -3772,16 +3796,32 @@ var init_config_service = __esm({
           ).run(this.manifestId, scopeType, scopeId, key, JSON.stringify(value), Date.now());
         } catch (e) {
           if (previous === void 0) {
-            this.values.delete(cacheKey2);
+            this.state.values.delete(cacheKey2);
           } else {
-            this.values.set(cacheKey2, previous);
+            this.state.values.set(cacheKey2, previous);
           }
           throw e;
         }
-        for (const listener of this.listeners) {
-          try {
-            listener(key, value, previous === null ? void 0 : previous);
-          } catch {
+        this.broadcast(key, value, previous ?? void 0);
+      }
+      /**
+       * 通知所有共享同一 db + manifest.id 的活跃实例（含自身）。
+       *
+       * 管理端通过临时实例写入时，运行中插件的 `onChange` 也因此能收到。
+       * 已回收的实例在遍历时顺手清理。
+       */
+      broadcast(key, newValue, oldValue) {
+        for (const ref of this.state.instances) {
+          const instance = ref.deref();
+          if (!instance) {
+            this.state.instances.delete(ref);
+            continue;
+          }
+          for (const listener of instance.listeners) {
+            try {
+              listener(key, newValue, oldValue);
+            } catch {
+            }
           }
         }
       }
@@ -3814,11 +3854,12 @@ var init_config_service = __esm({
        * 插件在 `activate()` 里通常会马上读配置，提前填充避免每条配置一次查询。
        */
       loadFromDB() {
+        this.state.values.clear();
         try {
           const rows = this.db.prepare(`SELECT scope_type, scope_id, key, value FROM ${_ConfigService.TABLE} WHERE plugin_id = ?`).all(this.manifestId);
           for (const row of rows) {
             const scopeType = CONFIG_SCOPE_TYPES.includes(row.scope_type) ? row.scope_type : "platform";
-            this.values.set(scopedId(scopeType, row.scope_id ?? "", row.key), this.parseStored(row.value));
+            this.state.values.set(scopedId(scopeType, row.scope_id ?? "", row.key), this.parseStored(row.value));
           }
         } catch {
         }
@@ -3827,7 +3868,7 @@ var init_config_service = __esm({
           const rows = this.db.prepare(`SELECT key, value FROM plugin_storage WHERE plugin_id = ? AND key LIKE ?`).all(this.manifestId, prefix + "%");
           for (const row of rows) {
             const key = row.key.slice(prefix.length);
-            this.values.set(scopedId("platform", "", `legacy:${key}`), this.parseStored(row.value));
+            this.state.values.set(scopedId("platform", "", `legacy:${key}`), this.parseStored(row.value));
           }
         } catch {
         }
@@ -3839,9 +3880,9 @@ var init_config_service = __esm({
           return raw;
         }
       }
-      /** 测试/诊断：当前缓存里的作用域条目数。 */
+      /** 测试/诊断：当前共享缓存里的作用域条目数。 */
       cachedEntryCount() {
-        return this.values.size;
+        return this.state.values.size;
       }
     };
   }
@@ -3875,9 +3916,9 @@ var init_http_router = __esm({
       /**
        * 注册指定动词与路径的 Handler
        */
-      route(method, path46, handler, options = {}) {
+      route(method, path47, handler, options = {}) {
         const upperMethod = method.toUpperCase();
-        const normalized = path46.startsWith("/") ? path46 : "/" + path46;
+        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
         const { regex, paramNames } = compileRoutePattern(normalized);
         this.warnIfUnscoped(upperMethod, normalized, options);
         this.routes.push({
@@ -3890,20 +3931,20 @@ var init_http_router = __esm({
           scope: options.scope
         });
       }
-      get(path46, handler, options) {
-        this.route("GET", path46, handler, options);
+      get(path47, handler, options) {
+        this.route("GET", path47, handler, options);
       }
-      post(path46, handler, options) {
-        this.route("POST", path46, handler, options);
+      post(path47, handler, options) {
+        this.route("POST", path47, handler, options);
       }
-      put(path46, handler, options) {
-        this.route("PUT", path46, handler, options);
+      put(path47, handler, options) {
+        this.route("PUT", path47, handler, options);
       }
-      patch(path46, handler, options) {
-        this.route("PATCH", path46, handler, options);
+      patch(path47, handler, options) {
+        this.route("PATCH", path47, handler, options);
       }
-      delete(path46, handler, options) {
-        this.route("DELETE", path46, handler, options);
+      delete(path47, handler, options) {
+        this.route("DELETE", path47, handler, options);
       }
       warnIfUnscoped(method, pattern, options) {
         if (options.scope) return;
@@ -3918,19 +3959,19 @@ var init_http_router = __esm({
       }
       stream(methodOrPath, pathOrHandler, maybeHandler) {
         if (typeof pathOrHandler === "function") {
-          const path46 = methodOrPath;
+          const path47 = methodOrPath;
           const handler = pathOrHandler;
-          this.registerStream("GET", path46, handler);
-          this.registerStream("POST", path46, handler);
+          this.registerStream("GET", path47, handler);
+          this.registerStream("POST", path47, handler);
         } else {
           const method = methodOrPath.toUpperCase();
-          const path46 = pathOrHandler;
+          const path47 = pathOrHandler;
           const handler = maybeHandler;
-          this.registerStream(method, path46, handler);
+          this.registerStream(method, path47, handler);
         }
       }
-      registerStream(method, path46, handler) {
-        const normalized = path46.startsWith("/") ? path46 : "/" + path46;
+      registerStream(method, path47, handler) {
+        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
         const { regex, paramNames } = compileRoutePattern(normalized);
         this.routes.push({
           method: method.toUpperCase(),
@@ -3944,9 +3985,9 @@ var init_http_router = __esm({
       /**
        * 检查指定动词与路径是否为流式路由
        */
-      isStream(method, path46) {
+      isStream(method, path47) {
         const upperMethod = method.toUpperCase();
-        const normalized = path46.startsWith("/") ? path46 : "/" + path46;
+        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
         for (const entry of this.routes) {
           if (entry.method !== upperMethod) continue;
           if (entry.regex.test(normalized)) {
@@ -3958,9 +3999,9 @@ var init_http_router = __esm({
       /**
        * 匹配路由并提取路由参数
        */
-      match(method, path46) {
+      match(method, path47) {
         const upperMethod = method.toUpperCase();
-        const normalized = path46.startsWith("/") ? path46 : "/" + path46;
+        const normalized = path47.startsWith("/") ? path47 : "/" + path47;
         for (const entry of this.routes) {
           if (entry.method !== upperMethod) continue;
           const match = normalized.match(entry.regex);
@@ -4103,13 +4144,13 @@ function checkMethodPolicy(input) {
   if (tokens.frontendApi && token === tokens.frontendApi) {
     if (isReadOnlyMethod(method)) return null;
     if (method === "request" && !Array.isArray(args)) return null;
-    const path46 = extractPathArg(args);
-    const isHighRisk = HIGH_RISK_PATH_PREFIXES.some((p) => path46 === p || path46.startsWith(`${p}/`));
-    const isIrreversible = IRREVERSIBLE_PATH_SUFFIXES.some((s) => path46.endsWith(s));
-    const isEntityDelete = method === "del" && ENTITY_DELETE_RE.test(path46);
+    const path47 = extractPathArg(args);
+    const isHighRisk = HIGH_RISK_PATH_PREFIXES.some((p) => path47 === p || path47.startsWith(`${p}/`));
+    const isIrreversible = IRREVERSIBLE_PATH_SUFFIXES.some((s) => path47.endsWith(s));
+    const isEntityDelete = method === "del" && ENTITY_DELETE_RE.test(path47);
     if (isHighRisk || isIrreversible || isEntityDelete) {
       if (hasCapability(caps, CAP_API_ADMIN)) return null;
-      const why = isIrreversible ? `\u4E0D\u53EF\u9006\u64CD\u4F5C '${path46}'` : isEntityDelete ? `\u5B9E\u4F53\u7EA7\u5220\u9664 '${path46}'` : `\u5199\u5165\u9AD8\u5371\u8DEF\u5F84 '${path46 || "<\u672A\u63D0\u4F9B\u8DEF\u5F84>"}'`;
+      const why = isIrreversible ? `\u4E0D\u53EF\u9006\u64CD\u4F5C '${path47}'` : isEntityDelete ? `\u5B9E\u4F53\u7EA7\u5220\u9664 '${path47}'` : `\u5199\u5165\u9AD8\u5371\u8DEF\u5F84 '${path47 || "<\u672A\u63D0\u4F9B\u8DEF\u5F84>"}'`;
       return `${why} \u9700\u8981 manifest \u58F0\u660E '${CAP_API_ADMIN}' \u80FD\u529B`;
     }
     return hasCapability(caps, CAP_API_WRITE) ? null : `\u5199\u64CD\u4F5C\uFF08${method}\uFF09\u9700\u8981 manifest \u58F0\u660E '${CAP_API_WRITE}' \u80FD\u529B\uFF08\u666E\u901A\u53EA\u8BFB\u8C03\u7528\u8BF7\u7528 get\uFF09`;
@@ -4609,6 +4650,53 @@ function wrapPointsDimensionRegistry(registry4, tracker, pluginId) {
     })
   };
 }
+function wrapClassroomLifecycleService(service, tracker, pluginId) {
+  return {
+    getStage: createSafeFunction((lessonId) => service.getStage(lessonId)),
+    transitionStage: createSafeFunction(
+      (lessonId, toStage, actorId, classId) => service.transitionStage(lessonId, toStage, actorId, classId)
+    ),
+    registerStageGuard: createSafeFunction((owner, guard) => {
+      service.registerStageGuard(owner, guard);
+      tracker.track(pluginId, {
+        dispose: () => {
+          service.unregisterStageGuard(owner);
+        }
+      });
+    }),
+    unregisterStageGuard: createSafeFunction((owner) => {
+      service.unregisterStageGuard(owner);
+    })
+  };
+}
+function wrapInteractionRuntimeService(service, tracker, pluginId) {
+  return {
+    registerActivityProvider: createSafeFunction((owner, descriptor) => {
+      service.registerActivityProvider(owner, descriptor);
+      const providerId = descriptor?.id;
+      if (providerId) {
+        tracker.track(pluginId, {
+          dispose: () => {
+            service.unregisterActivityProvider(owner, providerId);
+          }
+        });
+      }
+    }),
+    unregisterActivityProvider: createSafeFunction((owner, id) => {
+      service.unregisterActivityProvider(owner, id);
+    }),
+    listActivityProviders: createSafeFunction(() => service.listActivityProviders())
+  };
+}
+function wrapPluginRuntimeService(raw, tokenName, tracker, pluginId) {
+  if (tokenName === IClassroomLifecycleServiceToken.name) {
+    return wrapClassroomLifecycleService(raw, tracker, pluginId);
+  }
+  if (tokenName === IInteractionRuntimeServiceToken.name) {
+    return wrapInteractionRuntimeService(raw, tracker, pluginId);
+  }
+  return raw;
+}
 function wrapPointsLedgerService(service, pluginId, capabilities) {
   const auditAccess = (studentId, method, operation, requiredCap) => {
     const hasCap = hasCapability(capabilities ?? [], requiredCap);
@@ -4903,9 +4991,9 @@ async function buildContext(serviceRegistry, tracker, pluginId, manifest, db2, s
             `[PluginHost] Plugin "${manifest.id}" cannot resolve "${token}" by name. Use the Token object imported from @openlearn/plugin-sdk, or one of the SDK-exported Token names.`
           );
         }
-        return serviceRegistry.resolveByName(token);
+        return serviceRegistry.resolveByName(token).then((raw) => wrapPluginRuntimeService(raw, token, tracker, pluginId));
       }
-      return serviceRegistry.resolve(token);
+      return serviceRegistry.resolve(token).then((raw) => wrapPluginRuntimeService(raw, token.name, tracker, pluginId));
     },
     // V3.2: 插件向 DI 容器提供服务（对应 manifest.provides）
     provide: async (token, instance) => {
@@ -5740,7 +5828,7 @@ function isPidAlive(pid) {
   }
 }
 function writeBootstrapTempFile(code) {
-  const file = import_node_path10.default.join(
+  const file = import_node_path11.default.join(
     import_node_os.default.tmpdir(),
     `${BOOTSTRAP_PREFIX}${process.pid}-${import_node_crypto7.default.randomBytes(8).toString("hex")}${BOOTSTRAP_SUFFIX}`
   );
@@ -5754,7 +5842,7 @@ function cleanupStaleBootstrapFiles(now = Date.now()) {
     let cleaned = 0;
     for (const file of files) {
       if (!file.startsWith(BOOTSTRAP_PREFIX) || !file.endsWith(BOOTSTRAP_SUFFIX)) continue;
-      const full = import_node_path10.default.join(tmpDir, file);
+      const full = import_node_path11.default.join(tmpDir, file);
       const ownerPid = bootstrapOwnerPid(file);
       if (ownerPid === null) {
         try {
@@ -5779,9 +5867,9 @@ function cleanupStaleBootstrapFiles(now = Date.now()) {
 function defaultNetPreloadStartDirs() {
   const dirs = [];
   try {
-    const url = import_meta5.url;
+    const url = import_meta6.url;
     if (typeof url === "string" && url.startsWith("file:")) {
-      dirs.push(import_node_path10.default.dirname((0, import_node_url3.fileURLToPath)(url)));
+      dirs.push(import_node_path11.default.dirname((0, import_node_url3.fileURLToPath)(url)));
     }
   } catch {
   }
@@ -5793,11 +5881,11 @@ function defaultNetPreloadStartDirs() {
 function resolveNetPreloadPath(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const candidates = [
-    import_node_path10.default.resolve(cwd, "packages/core/worker-runtime/plugin-net-preload.cjs"),
-    import_node_path10.default.resolve(cwd, "dist/plugin-net-preload.cjs")
+    import_node_path11.default.resolve(cwd, "packages/core/worker-runtime/plugin-net-preload.cjs"),
+    import_node_path11.default.resolve(cwd, "dist/plugin-net-preload.cjs")
   ];
   for (const dir of options.startDirs ?? defaultNetPreloadStartDirs()) {
-    candidates.unshift(import_node_path10.default.join(dir, "plugin-net-preload.cjs"));
+    candidates.unshift(import_node_path11.default.join(dir, "plugin-net-preload.cjs"));
   }
   const found = candidates.find((candidate) => import_node_fs9.default.existsSync(candidate));
   if (!found) {
@@ -5805,7 +5893,7 @@ function resolveNetPreloadPath(options = {}) {
   }
   return found;
 }
-var import_node_child_process, import_node_crypto7, import_node_fs9, import_node_os, import_node_path10, import_node_url3, import_meta5, ENV_ALLOWLIST, ENV_DENYLIST, WORKER_DATA_ENV, BOOTSTRAP_PREFIX, BOOTSTRAP_SUFFIX, LEGACY_BOOTSTRAP_STALE_MS;
+var import_node_child_process, import_node_crypto7, import_node_fs9, import_node_os, import_node_path11, import_node_url3, import_meta6, ENV_ALLOWLIST, ENV_DENYLIST, WORKER_DATA_ENV, BOOTSTRAP_PREFIX, BOOTSTRAP_SUFFIX, LEGACY_BOOTSTRAP_STALE_MS;
 var init_child_spawn = __esm({
   "packages/core/worker-runtime/child-spawn.ts"() {
     "use strict";
@@ -5813,13 +5901,13 @@ var init_child_spawn = __esm({
     import_node_crypto7 = __toESM(require("node:crypto"), 1);
     import_node_fs9 = __toESM(require("node:fs"), 1);
     import_node_os = __toESM(require("node:os"), 1);
-    import_node_path10 = __toESM(require("node:path"), 1);
+    import_node_path11 = __toESM(require("node:path"), 1);
     import_node_url3 = require("node:url");
     init_child_transport();
     init_child_isolate();
     init_plugin_permission();
     init_plugin_limits();
-    import_meta5 = {};
+    import_meta6 = {};
     ENV_ALLOWLIST = [
       "PATH",
       "LANG",
@@ -8923,9 +9011,9 @@ __export(worker_manager_exports, {
 function collectSharedReadPaths(pluginDir) {
   if (!pluginDir) return [];
   const paths = /* @__PURE__ */ new Set();
-  const nodeModulesDir = import_node_path11.default.join(import_node_path11.default.dirname(pluginDir), "node_modules");
+  const nodeModulesDir = import_node_path12.default.join(import_node_path12.default.dirname(pluginDir), "node_modules");
   paths.add(nodeModulesDir);
-  const sdkLink = import_node_path11.default.join(nodeModulesDir, "@openlearn", "plugin-sdk");
+  const sdkLink = import_node_path12.default.join(nodeModulesDir, "@openlearn", "plugin-sdk");
   try {
     if (import_fs7.default.existsSync(sdkLink)) paths.add(import_fs7.default.realpathSync(sdkLink));
   } catch {
@@ -8964,7 +9052,7 @@ function generateBootstrapCode() {
   const rootPath = process.cwd().replace(/\\/g, "/");
   return composeBootstrapCode(`${rootPath}/package.json`);
 }
-var import_node_worker_threads, import_fs7, import_node_path11, import_uuid12, BASE_WORKER_SERVICE_TOKENS, ALL_SERVICE_TOKENS, POINTS_SERVICE_TOKENS, MAX_WORKERS, ACTIVATE_TIMEOUT_MS, ACTIVATE_PROGRESS_SLIDE_MS, WorkerRegistry, WorkerManager;
+var import_node_worker_threads, import_fs7, import_node_path12, import_uuid12, BASE_WORKER_SERVICE_TOKENS, ALL_SERVICE_TOKENS, POINTS_SERVICE_TOKENS, MAX_WORKERS, ACTIVATE_TIMEOUT_MS, ACTIVATE_PROGRESS_SLIDE_MS, WorkerRegistry, WorkerManager;
 var init_worker_manager = __esm({
   "packages/core/worker-runtime/worker-manager.ts"() {
     "use strict";
@@ -8978,7 +9066,7 @@ var init_worker_manager = __esm({
     init_plugin_limits();
     init_thread_isolate();
     import_fs7 = __toESM(require("fs"), 1);
-    import_node_path11 = __toESM(require("node:path"), 1);
+    import_node_path12 = __toESM(require("node:path"), 1);
     init_transport();
     init_plugin_net_proxy();
     init_service_host();
@@ -9383,7 +9471,7 @@ var init_worker_manager = __esm({
         const encodedBootstrap = Buffer.from(bootstrapCode, "utf-8").toString("base64");
         const bootstrapDataUrl = `data:text/javascript;base64,${encodedBootstrap}`;
         const allowedTokens = computeAllowedWorkerTokens(manifest, serviceTokens);
-        const resolvedPluginDir = pluginDir && import_fs7.default.existsSync(import_node_path11.default.join(pluginDir, "index.js")) ? pluginDir : void 0;
+        const resolvedPluginDir = pluginDir && import_fs7.default.existsSync(import_node_path12.default.join(pluginDir, "index.js")) ? pluginDir : void 0;
         let approvedNetHosts = [];
         try {
           approvedNetHosts = listApprovedNetHosts(this.db, [pluginId, manifest.id]);
@@ -9755,6 +9843,193 @@ __export(server_exports, {
   startServer: () => startServer
 });
 module.exports = __toCommonJS(server_exports);
+
+// server/security/runtime-check.ts
+var import_node_path = __toESM(require("node:path"), 1);
+var import_node_module = require("node:module");
+
+// scripts/assert-node-runtime.mjs
+var SUPPORTED_NODE_MAJORS = Object.freeze([20, 22, 24]);
+var SUPPORTED_NODE_TEXT = "Node.js 20.x / 22.x / 24.x";
+var PINNED_NODE_MAJOR = 22;
+function parseNodeMajor(version) {
+  if (typeof version !== "string") return null;
+  const matched = /^v?(\d+)\./.exec(version.trim());
+  if (!matched) return null;
+  const major = Number(matched[1]);
+  return Number.isFinite(major) ? major : null;
+}
+function checkNodeVersion(version, supported = SUPPORTED_NODE_MAJORS) {
+  const major = parseNodeMajor(version);
+  if (major === null) {
+    return {
+      ok: false,
+      code: "unparseable",
+      major: null,
+      message: `\u65E0\u6CD5\u89E3\u6790 Node \u7248\u672C\u300C${version}\u300D\u3002`
+    };
+  }
+  if (supported.includes(major)) {
+    return { ok: true, code: "supported", major, message: "" };
+  }
+  return {
+    ok: false,
+    code: "unsupported",
+    major,
+    message: `\u5F53\u524D Node \u7248\u672C v${major}.x \u4E0D\u53D7\u652F\u6301\uFF08\u652F\u6301\u8303\u56F4\uFF1A${SUPPORTED_NODE_TEXT}\uFF09\u3002\u672C\u9879\u76EE\u7684\u539F\u751F\u4F9D\u8D56\uFF08better-sqlite3\uFF09\u6309 Node ABI \u7F16\u8BD1\uFF0C\u590D\u7528\u65E7 node_modules \u4F1A\u5728\u8FD0\u884C\u671F\u62A5 ERR_DLOPEN_FAILED / NODE_MODULE_VERSION \u4E0D\u4E00\u81F4\u3002`
+  };
+}
+function buildFixGuidance(major) {
+  const pinned = PINNED_NODE_MAJOR;
+  const lines = [
+    "\u600E\u4E48\u4FEE\uFF08\u4EFB\u9009\u5176\u4E00\uFF09\uFF1A",
+    `  1) \u5207\u5230\u53D7\u652F\u6301\u7684 Node \u7248\u672C\uFF08\u672C\u9879\u76EE\u5B9E\u6D4B ${SUPPORTED_NODE_MAJORS.join(" / ")}\uFF09\uFF1A`,
+    `       nvm install ${pinned} && nvm use ${pinned}`,
+    `       fnm install ${pinned} && fnm use ${pinned}`,
+    `       asdf install nodejs ${pinned}.16.0 && asdf local nodejs ${pinned}.16.0`,
+    "     \u4ED3\u5E93\u6839\u7684 .nvmrc / .node-version \u5DF2\u9489\u4F4F " + pinned + "\uFF0Cnvm / fnm \u4F1A\u81EA\u52A8\u91C7\u7528\u3002",
+    "  2) \u7528\u5B98\u65B9\u5BB9\u5668\u955C\u50CF\uFF08\u5185\u542B Node " + pinned + "\uFF0C\u5BBF\u4E3B\u673A\u65E0\u9700\u88C5 Node\uFF09\uFF1A",
+    "       docker compose up -d",
+    "  3) \u786E\u5B9E\u8981\u7528\u522B\u7684 Node \u7248\u672C\uFF1A\u5FC5\u987B\u8BA9\u539F\u751F\u6A21\u5757\u6309\u65B0 ABI \u91CD\u65B0\u7F16\u8BD1 \u2014\u2014",
+    "     \u4FDD\u7559\u65E7 node_modules \u53EA\u4F1A\u7EE7\u7EED\u590D\u7528 ABI \u4E0D\u5339\u914D\u7684\u4E8C\u8FDB\u5236\uFF1A",
+    "       rm -rf node_modules && pnpm install"
+  ];
+  if (major !== null && major === 21) {
+    lines.push(
+      "     \u6CE8\uFF1ANode 21 \u4E0D\u662F LTS\uFF0C\u4E14 better-sqlite3 \u5B98\u65B9\u4E0D\u63D0\u4F9B 21.x \u9884\u7F16\u8BD1\u4EA7\u7269\uFF0C",
+      "     \u91CD\u88C5\u540E\u4ECD\u9700\u8981\u672C\u5730\u7F16\u8BD1\u5DE5\u5177\u94FE\uFF08python3 + make + g++\uFF09\uFF0C\u4E0D\u5EFA\u8BAE\u7528\u4E8E\u751F\u4EA7\u3002"
+    );
+  }
+  return lines.join("\n");
+}
+function formatUnsupportedMessage(version, check = checkNodeVersion(version)) {
+  if (check.ok) return "";
+  const head = `[NodeRuntime] FATAL: ${check.message}`;
+  return `${head}
+
+${buildFixGuidance(check.major)}
+`;
+}
+function runCliGuard() {
+  const result = checkNodeVersion(process.version);
+  if (result.ok) return;
+  console.error(formatUnsupportedMessage(process.version, result));
+  process.exit(1);
+}
+var invokedDirectly = process.argv[1] && (process.argv[1].endsWith("assert-node-runtime.mjs") || process.argv[1].endsWith("assert-node-runtime") || process.argv[1].includes("assert-node-runtime"));
+if (invokedDirectly) {
+  runCliGuard();
+}
+
+// server/security/runtime-check.ts
+var import_meta = {};
+var ABI_PATTERN = /NODE_MODULE_VERSION\s+(\d+)/i;
+var MISSING_BINDINGS_MARKERS = ["Could not locate the bindings file", "bindings file"];
+function detectNativeModuleFailure(error) {
+  const runtimeAbi = Number(process.versions.modules);
+  const message = error instanceof Error ? error.message : String(error);
+  const abiMatch = ABI_PATTERN.exec(message);
+  if (abiMatch) {
+    return {
+      kind: "abi-mismatch",
+      // better-sqlite3 的报错里第一个 NODE_MODULE_VERSION 是「模块编译时的 ABI」，
+      // 第二个是「当前运行时要求的 ABI」。
+      moduleAbi: Number(abiMatch[1]),
+      runtimeAbi,
+      detail: message
+    };
+  }
+  if (MISSING_BINDINGS_MARKERS.some((marker) => message.includes(marker))) {
+    return { kind: "missing-bindings", moduleAbi: null, runtimeAbi, detail: message };
+  }
+  return { kind: "unknown", moduleAbi: null, runtimeAbi, detail: message };
+}
+function resolveRequire() {
+  if (typeof import_meta !== "undefined" && import_meta.url) {
+    return (0, import_node_module.createRequire)(import_meta.url);
+  }
+  if (typeof __filename !== "undefined") {
+    return (0, import_node_module.createRequire)(__filename);
+  }
+  return (0, import_node_module.createRequire)(import_node_path.default.join(process.cwd(), "package.json"));
+}
+function loadBetterSqlite3Binding(loadModule) {
+  const load = loadModule ?? resolveRequire();
+  const Database3 = load("better-sqlite3");
+  const probe = new Database3(":memory:");
+  probe.close();
+}
+function checkNativeModule(load = loadBetterSqlite3Binding) {
+  try {
+    load();
+    return null;
+  } catch (error) {
+    const failure = detectNativeModuleFailure(error);
+    if (failure.kind === "abi-mismatch") {
+      return {
+        key: "native-module-abi",
+        severity: "error",
+        message: `\u539F\u751F\u6A21\u5757 better-sqlite3 \u4E0E\u5F53\u524D Node \u8FD0\u884C\u65F6\u4E0D\u517C\u5BB9\uFF1A\u4E8C\u8FDB\u5236\u662F\u6309 ABI ${failure.moduleAbi} \u7F16\u8BD1\u7684\uFF0C\u5F53\u524D\u8FD0\u884C\u65F6\uFF08Node ${process.versions.node}\uFF09\u8981\u6C42 ABI ${failure.runtimeAbi}\u3002
+  \u5E38\u89C1\u539F\u56E0\uFF1Anode_modules \u662F\u5728\u53E6\u4E00\u4E2A Node \u7248\u672C\u4E0B\u5B89\u88C5/\u62F7\u8D1D\u7684\u3002
+  \u4FEE\u590D\uFF1Arm -rf node_modules && pnpm install\uFF08\u6309\u5F53\u524D Node \u91CD\u65B0\u7F16\u8BD1\u539F\u751F\u6A21\u5757\uFF09\uFF0C
+        \u6216\u5207\u56DE\u53D7\u652F\u6301\u7684 Node \u7248\u672C\uFF08${SUPPORTED_NODE_TEXT}\uFF09\u3002`
+      };
+    }
+    if (failure.kind === "missing-bindings") {
+      return {
+        key: "native-module-missing",
+        severity: "error",
+        message: `\u539F\u751F\u6A21\u5757 better-sqlite3 \u7684\u4E8C\u8FDB\u5236\u4E0D\u5B58\u5728\uFF08\u672A\u7F16\u8BD1\u6216\u4F9D\u8D56\u88AB\u88C1\u526A\uFF09\u3002
+  \u4FEE\u590D\uFF1Arm -rf node_modules && pnpm install\uFF08pnpm \u9700\u8981 allowBuilds \u653E\u884C better-sqlite3 \u7684\u6784\u5EFA\u811A\u672C\uFF09\uFF0C
+        \u6216\u6539\u7528\u5B98\u65B9\u5BB9\u5668\u955C\u50CF\uFF08\u5DF2\u5185\u7F6E\u7F16\u8BD1\u597D\u7684\u4E8C\u8FDB\u5236\uFF09\u3002`
+      };
+    }
+    return {
+      key: "native-module-load",
+      severity: "error",
+      message: `\u539F\u751F\u6A21\u5757 better-sqlite3 \u52A0\u8F7D\u5931\u8D25\uFF1A${failure.detail}`
+    };
+  }
+}
+function checkRuntimeEnvironment(input = {}) {
+  const errors = [];
+  const warnings = [];
+  const nodeVersion = input.nodeVersion ?? process.version;
+  const nodeCheck = checkNodeVersion(nodeVersion);
+  if (!nodeCheck.ok) {
+    errors.push({
+      key: "node-version",
+      severity: "error",
+      message: `${nodeCheck.message}
+${buildFixGuidance(nodeCheck.major)}`
+    });
+    return { errors, warnings };
+  }
+  const nativeIssue = checkNativeModule(input.loadNativeModule);
+  if (nativeIssue) {
+    errors.push(nativeIssue);
+  }
+  return { errors, warnings };
+}
+function assertRuntimeEnvironment() {
+  const { errors, warnings } = checkRuntimeEnvironment();
+  for (const warning of warnings) {
+    console.warn(`[NodeRuntime] WARN: ${warning.message}`);
+  }
+  if (errors.length === 0) return;
+  console.error("[NodeRuntime] FATAL: \u8FD0\u884C\u65F6\u73AF\u5883\u4E0D\u6EE1\u8DB3\u8981\u6C42\uFF0C\u62D2\u7EDD\u542F\u52A8\u3002");
+  for (const issue of errors) {
+    console.error(`
+[NodeRuntime] ${issue.key}
+${issue.message}`);
+  }
+  process.exit(1);
+}
+
+// server/security/runtime-preflight.ts
+assertRuntimeEnvironment();
+
+// server.ts
 var import_express4 = __toESM(require("express"), 1);
 var import_path23 = __toESM(require("path"), 1);
 var import_dotenv = __toESM(require("dotenv"), 1);
@@ -10786,12 +11061,12 @@ var import_url = require("url");
 
 // packages/core/db/backup-manager.ts
 var import_node_fs2 = __toESM(require("node:fs"), 1);
-var import_node_path2 = __toESM(require("node:path"), 1);
+var import_node_path3 = __toESM(require("node:path"), 1);
 var import_better_sqlite3 = __toESM(require("better-sqlite3"), 1);
 
 // packages/core/db/secure-files.ts
 var import_node_fs = __toESM(require("node:fs"), 1);
-var import_node_path = __toESM(require("node:path"), 1);
+var import_node_path2 = __toESM(require("node:path"), 1);
 var SECURE_FILE_MODE = 384;
 var SECURE_DIR_MODE = 448;
 var GROUP_OTHER_BITS = 63;
@@ -10835,7 +11110,7 @@ function ensureSecureFile(filePath) {
       hardenFile(filePath);
       return;
     }
-    import_node_fs.default.mkdirSync(import_node_path.default.dirname(filePath), { recursive: true });
+    import_node_fs.default.mkdirSync(import_node_path2.default.dirname(filePath), { recursive: true });
     const fd = import_node_fs.default.openSync(filePath, "a", SECURE_FILE_MODE);
     import_node_fs.default.closeSync(fd);
   } catch {
@@ -10853,15 +11128,15 @@ function secureDatabaseFiles(dbPath2) {
 // packages/core/db/backup-manager.ts
 function getDefaultDbPath() {
   if (process.env.OPENLEARN_DB_PATH) {
-    return import_node_path2.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH);
+    return import_node_path3.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH);
   }
-  return import_node_path2.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
+  return import_node_path3.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
 }
 function getDefaultBackupDir() {
   if (process.env.BACKUP_DIR) {
-    return import_node_path2.default.resolve(process.cwd(), process.env.BACKUP_DIR);
+    return import_node_path3.default.resolve(process.cwd(), process.env.BACKUP_DIR);
   }
-  return import_node_path2.default.resolve(process.cwd(), "backups");
+  return import_node_path3.default.resolve(process.cwd(), "backups");
 }
 function validateBackup(filePath) {
   if (!import_node_fs2.default.existsSync(filePath)) {
@@ -10915,7 +11190,7 @@ function pruneByPrefix(backupDir, prefix, keepCount) {
   let pruned = 0;
   for (const file of files.slice(keepCount)) {
     try {
-      import_node_fs2.default.unlinkSync(import_node_path2.default.join(backupDir, file));
+      import_node_fs2.default.unlinkSync(import_node_path3.default.join(backupDir, file));
       pruned++;
     } catch {
     }
@@ -10934,15 +11209,15 @@ function pruneMigratorSnapshots(backupDir = getDefaultBackupDir(), keepCount) {
   return pruneByPrefix(backupDir, "pre_migration_", Math.max(1, keepCount ?? resolvePreMigrationKeep()));
 }
 function performBackup(options = {}) {
-  const dbPath2 = options.dbPath ? import_node_path2.default.resolve(options.dbPath) : getDefaultDbPath();
-  const backupDir = options.backupDir ? import_node_path2.default.resolve(options.backupDir) : getDefaultBackupDir();
+  const dbPath2 = options.dbPath ? import_node_path3.default.resolve(options.dbPath) : getDefaultDbPath();
+  const backupDir = options.backupDir ? import_node_path3.default.resolve(options.backupDir) : getDefaultBackupDir();
   const keep = typeof options.keep === "number" ? options.keep : 10;
   if (!import_node_fs2.default.existsSync(backupDir)) {
     ensureSecureDir(backupDir);
   }
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const filename = options.customName || `backup_${timestamp}.db`;
-  const backupPath = import_node_path2.default.join(backupDir, filename);
+  const backupPath = import_node_path3.default.join(backupDir, filename);
   if (import_node_fs2.default.existsSync(backupPath)) {
     import_node_fs2.default.unlinkSync(backupPath);
   }
@@ -10979,7 +11254,7 @@ function performBackup(options = {}) {
 }
 
 // packages/core/db/migrator.ts
-var import_meta = {};
+var import_meta2 = {};
 function splitSqlStatements(sql) {
   return sql.split(";").map((s) => s.trim()).filter((s) => {
     const content = s.replace(/--.*$/gm, "").trim();
@@ -11135,8 +11410,8 @@ function getDefaultMigrationsDir(options = {}) {
   const starts = options.startDirs ? [...options.startDirs] : [];
   if (!options.startDirs && typeof __dirname !== "undefined") starts.push(__dirname);
   try {
-    if (!options.startDirs && typeof import_meta !== "undefined" && import_meta.url) {
-      starts.push(import_path.default.dirname((0, import_url.fileURLToPath)(import_meta.url)));
+    if (!options.startDirs && typeof import_meta2 !== "undefined" && import_meta2.url) {
+      starts.push(import_path.default.dirname((0, import_url.fileURLToPath)(import_meta2.url)));
     }
   } catch {
   }
@@ -11164,7 +11439,7 @@ function getDefaultMigrationsDir(options = {}) {
 
 // packages/core/db/schema-golden.ts
 var import_node_fs3 = __toESM(require("node:fs"), 1);
-var import_node_path3 = __toESM(require("node:path"), 1);
+var import_node_path4 = __toESM(require("node:path"), 1);
 var SCHEMA_GOLDEN_FILENAME = "schema-golden.json";
 function extractSchemaSnapshot(db2) {
   const tables = db2.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name").all();
@@ -11200,7 +11475,7 @@ function formatSchemaGoldenDrifts(drifts) {
   ).join("\n");
 }
 function loadSchemaGolden(migrationsDir) {
-  const filePath = import_node_path3.default.join(migrationsDir, SCHEMA_GOLDEN_FILENAME);
+  const filePath = import_node_path4.default.join(migrationsDir, SCHEMA_GOLDEN_FILENAME);
   if (!import_node_fs3.default.existsSync(filePath)) {
     throw new Error(
       `[SchemaGolden] FATAL: ${filePath} \u4E0D\u5B58\u5728\u3002\u91D1\u6837\u4E0E\u8FC1\u79FB\u6587\u4EF6\u540C\u76EE\u5F55\u53D1\u5E03\uFF0C\u7F3A\u5931\u8BF4\u660E\u5B89\u88C5\u5305\u4E0D\u5B8C\u6574\uFF1B\u6E90\u7801\u4ED3\u5E93\u91CC\u8BF7\u8FD0\u884C pnpm db:gen-golden \u751F\u6210\u3002`
@@ -11745,7 +12020,7 @@ function purgeAllExpiredData(db2, options) {
 
 // packages/core/db/index.ts
 init_api_key_crypto();
-var import_meta2 = {};
+var import_meta3 = {};
 var BCRYPT_ROUNDS = 10;
 function hashPassword(pwd) {
   return import_bcryptjs.default.hashSync(pwd, BCRYPT_ROUNDS);
@@ -11820,8 +12095,8 @@ if (process.env.VITEST) {
     dbPath = import_path2.default.join(__dirname, "educational_os.db");
   } else {
     try {
-      if (typeof import_meta2 !== "undefined" && import_meta2.url) {
-        const __filename2 = (0, import_url2.fileURLToPath)(import_meta2.url);
+      if (typeof import_meta3 !== "undefined" && import_meta3.url) {
+        const __filename2 = (0, import_url2.fileURLToPath)(import_meta3.url);
         const __dir = import_path2.default.dirname(__filename2);
         dbPath = import_path2.default.join(__dir, "educational_os.db");
       } else {
@@ -14149,10 +14424,10 @@ function parseScoreFields(fields) {
   if (typeof fields !== "string" || !fields.trim()) return [];
   return fields.split(/[\n\r,，;；|]+/).map((f) => f.trim()).filter(Boolean);
 }
-function getNested(raw, path46) {
+function getNested(raw, path47) {
   if (raw === null || raw === void 0) return void 0;
-  if (!path46) return void 0;
-  const parts = String(path46).split(".").map((p) => p.trim()).filter(Boolean);
+  if (!path47) return void 0;
+  const parts = String(path47).split(".").map((p) => p.trim()).filter(Boolean);
   let cursor = raw;
   for (let i = 0; i < parts.length; i += 1) {
     if (cursor === null || cursor === void 0) return void 0;
@@ -18152,7 +18427,7 @@ var import_path11 = __toESM(require("path"), 1);
 // packages/core/plugin-host/base.ts
 var import_path5 = __toESM(require("path"), 1);
 var import_express = __toESM(require("express"), 1);
-var import_node_module = require("node:module");
+var import_node_module2 = require("node:module");
 var import_node_url = require("node:url");
 
 // packages/core/plugin-host/resource-tracker.ts
@@ -18438,7 +18713,7 @@ var ContributionRegistry = class {
 // packages/core/plugin-host/base.ts
 init_types();
 init_errors2();
-var import_meta3 = {};
+var import_meta4 = {};
 var VALID_TRANSITIONS = {
   ["installed" /* INSTALLED */]: ["activating" /* ACTIVATING */, "uninstalled" /* UNINSTALLED */],
   ["activating" /* ACTIVATING */]: ["active" /* ACTIVE */, "error" /* ERROR */],
@@ -18473,12 +18748,12 @@ function resolveHostSdkDir() {
   const bases = [];
   if (typeof __dirname !== "undefined") bases.push(__dirname);
   try {
-    bases.push(import_path5.default.dirname((0, import_node_url.fileURLToPath)(import_meta3.url)));
+    bases.push(import_path5.default.dirname((0, import_node_url.fileURLToPath)(import_meta4.url)));
   } catch {
   }
   for (const base of bases) {
     try {
-      const req = (0, import_node_module.createRequire)(import_path5.default.join(base, "__openlearn_resolve__.js"));
+      const req = (0, import_node_module2.createRequire)(import_path5.default.join(base, "__openlearn_resolve__.js"));
       return import_path5.default.dirname(req.resolve("@openlearn/plugin-sdk/package.json"));
     } catch {
     }
@@ -18743,10 +19018,10 @@ var import_semver2 = __toESM(require("semver"), 1);
 init_types();
 
 // packages/core/plugin-host/execution-policy.ts
-var import_node_path8 = __toESM(require("node:path"), 1);
+var import_node_path9 = __toESM(require("node:path"), 1);
 var import_node_url2 = require("node:url");
 init_types();
-var import_meta4 = {};
+var import_meta5 = {};
 function trustedInlineAllowlist(env = process.env) {
   return new Set(
     (env.OPENLEARN_TRUSTED_INLINE_PLUGINS ?? "").split(",").map((item) => item.trim()).filter((item) => item.length > 0)
@@ -18754,23 +19029,23 @@ function trustedInlineAllowlist(env = process.env) {
 }
 function builtinPluginsDir() {
   try {
-    const url = import_meta4.url;
+    const url = import_meta5.url;
     if (typeof url === "string" && url.startsWith("file:")) {
-      return import_node_path8.default.resolve(import_node_path8.default.dirname((0, import_node_url2.fileURLToPath)(url)), "../../plugins");
+      return import_node_path9.default.resolve(import_node_path9.default.dirname((0, import_node_url2.fileURLToPath)(url)), "../../plugins");
     }
   } catch {
   }
   if (typeof __dirname !== "undefined") {
-    return import_node_path8.default.resolve(__dirname, "../packages/plugins");
+    return import_node_path9.default.resolve(__dirname, "../packages/plugins");
   }
-  return import_node_path8.default.resolve(process.cwd(), "packages/plugins");
+  return import_node_path9.default.resolve(process.cwd(), "packages/plugins");
 }
 function isInsideBuiltinPluginsDir(sourcePath, builtinDir = builtinPluginsDir()) {
   if (!sourcePath) return false;
-  const root = import_node_path8.default.resolve(builtinDir);
-  const resolved = import_node_path8.default.resolve(sourcePath);
-  const relative2 = import_node_path8.default.relative(root, resolved);
-  return relative2 === "" || !relative2.startsWith("..") && !import_node_path8.default.isAbsolute(relative2);
+  const root = import_node_path9.default.resolve(builtinDir);
+  const resolved = import_node_path9.default.resolve(sourcePath);
+  const relative2 = import_node_path9.default.relative(root, resolved);
+  return relative2 === "" || !relative2.startsWith("..") && !import_node_path9.default.isAbsolute(relative2);
 }
 function isTrustedInProcessPlugin(manifestId, env = process.env, sourcePath) {
   if (isInsideBuiltinPluginsDir(sourcePath)) return true;
@@ -19733,6 +20008,37 @@ var PluginHostCore = class _PluginHostCore extends PluginHostBase {
       console.warn(`[PluginHost] Failed to revoke stage guards for "${pluginId}":`, e);
     }
   }
+  /**
+   * 回收该插件注册的服务端题型（Issue #320）。
+   *
+   * 题型注册表（`IAssessmentGraderRegistry`）是插件用 `ctx.resolve(token)` 直取的
+   * **裸注册表**，不像 `ctx.services.*` 那样经过 `ResourceTracker` 包装 —— 所以
+   * `disposeAll()` 拿它没办法。不清理的后果已验证为真：
+   *
+   * 1. 停用插件后题型仍留在注册表里 —— 教师继续能出题、继续按旧闭包判分（“幽灵题型”），
+   *    `GET /api/assessment-question-types` 也继续把它列给前端；
+   * 2. 重装/升级插件时 `registerQuestionType` 抛 `duplicate question type`，
+   *    表现为「升级后插件激活失败」，必须重启宿主才能恢复。
+   *
+   * 与 `revokePluginStageGuards` 同构：注册方可能传安装行 UUID，也可能传
+   * manifest.id（文档约定的就是后者），两侧都清一遍（幂等）。
+   */
+  async revokePluginQuestionTypes(pluginId, manifestId) {
+    try {
+      const registry4 = await this.serviceRegistry.tryResolve(IAssessmentGraderRegistryToken);
+      if (!registry4 || typeof registry4.clearOwnedQuestionTypes !== "function") return;
+      let removed = 0;
+      for (const owner of /* @__PURE__ */ new Set([pluginId, manifestId])) {
+        if (!owner) continue;
+        removed += registry4.clearOwnedQuestionTypes(owner) ?? 0;
+      }
+      if (removed > 0) {
+        console.log(`[PluginHost] Revoked ${removed} question type(s) for plugin "${pluginId}"`);
+      }
+    } catch (e) {
+      console.warn(`[PluginHost] Failed to revoke question types for "${pluginId}":`, e);
+    }
+  }
   setPluginState(pluginId, state, opts = {}) {
     this.pluginStates.set(pluginId, state);
     if (!opts.persistDb) return;
@@ -19830,7 +20136,7 @@ var PluginHostHttp = class extends PluginHostCore {
   /**
    * 判断指定插件的某个请求路径是否为流式路由 (SSE)
    */
-  isStreamRoute(pluginIdOrManifestId, method, path46) {
+  isStreamRoute(pluginIdOrManifestId, method, path47) {
     const upperMethod = method.toUpperCase();
     const resolvedId = this.resolvePluginUuid(pluginIdOrManifestId);
     const instance = this.pluginInstances.get(resolvedId) ?? this.pluginInstances.get(pluginIdOrManifestId);
@@ -19839,7 +20145,7 @@ var PluginHostHttp = class extends PluginHostCore {
       for (const r of manifest.api.routes) {
         if (r.method.toUpperCase() === upperMethod && r.streaming === true) {
           const compiled = compileRoutePattern(r.path);
-          if (compiled.regex.test(path46)) {
+          if (compiled.regex.test(path47)) {
             return true;
           }
         }
@@ -19847,14 +20153,14 @@ var PluginHostHttp = class extends PluginHostCore {
     }
     if (!instance) return false;
     if (instance.context?.http) {
-      return instance.context.http.isStream(upperMethod, path46);
+      return instance.context.http.isStream(upperMethod, path47);
     }
     if (instance.workerRef) {
       const routes = instance.workerRef.serviceHost.getRegisteredRoutes();
       for (const r of routes) {
         if (r.method === upperMethod && r.isStream) {
           const compiled = compileRoutePattern(r.pattern);
-          if (compiled.regex.test(path46)) {
+          if (compiled.regex.test(path47)) {
             return true;
           }
         }
@@ -19928,7 +20234,7 @@ init_context_builder();
 
 // packages/core/plugin-host/declarative-migrator.ts
 var import_node_fs8 = __toESM(require("node:fs"), 1);
-var import_node_path9 = __toESM(require("node:path"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
 init_errors2();
 init_plugin_tables();
 function ensurePluginDeclaredMigrationsTable(db2) {
@@ -19944,7 +20250,7 @@ function ensurePluginDeclaredMigrationsTable(db2) {
   `);
 }
 function parseMigrationFileName(fileName) {
-  const baseName = import_node_path9.default.basename(fileName, ".sql");
+  const baseName = import_node_path10.default.basename(fileName, ".sql");
   const match = baseName.match(/^(\d+)[_-]?(.*)$/);
   if (match) {
     const version = parseInt(match[1], 10);
@@ -19967,7 +20273,7 @@ function loadPluginMigrations(migrationsDir) {
     return a.localeCompare(b, void 0, { numeric: true, sensitivity: "base" });
   });
   return files.map((file) => {
-    const fullPath = import_node_path9.default.join(migrationsDir, file);
+    const fullPath = import_node_path10.default.join(migrationsDir, file);
     const content = import_node_fs8.default.readFileSync(fullPath, "utf8");
     const { version, baseName } = parseMigrationFileName(file);
     const parsed = parseMigrationSql(baseName, content);
@@ -20609,6 +20915,7 @@ var PluginHostLifecycle = class extends PluginHostHttp {
           this.resourceTracker.disposeAll(pluginId);
           this.pluginInstances.delete(pluginId);
           this.revokePluginContributions(pluginId);
+          await this.revokePluginQuestionTypes(pluginId, deactManifest.id);
           this.setPluginState(pluginId, "inactive" /* INACTIVE */, { persistDb: true });
           if (this._hotReloadController) {
             this._hotReloadController.unregisterPlugin(pluginId);
@@ -20627,6 +20934,7 @@ var PluginHostLifecycle = class extends PluginHostHttp {
       this.resourceTracker.disposeAll(pluginId);
       this.pluginInstances.delete(pluginId);
       this.revokePluginContributions(pluginId);
+      await this.revokePluginQuestionTypes(pluginId, deactManifest.id);
       this.setPluginState(pluginId, "inactive" /* INACTIVE */, { persistDb: true });
       if (actorId) {
         await this.revokeCapabilities(actorId);
@@ -20662,6 +20970,7 @@ var PluginHostLifecycle = class extends PluginHostHttp {
       this.resourceTracker.disposeAll(pluginId);
       this.pluginInstances.delete(pluginId);
       this.revokePluginContributions(pluginId);
+      await this.revokePluginQuestionTypes(pluginId, instance?.manifest?.id ?? pluginId);
       this.setPluginState(pluginId, "inactive" /* INACTIVE */, { persistDb: true });
       if (actorId) {
         await this.revokeCapabilities(actorId);
@@ -20725,26 +21034,26 @@ var import_semver3 = __toESM(require("semver"), 1);
 
 // packages/core/version.ts
 var import_node_fs11 = __toESM(require("node:fs"), 1);
-var import_node_path12 = __toESM(require("node:path"), 1);
+var import_node_path13 = __toESM(require("node:path"), 1);
 var import_node_url5 = require("node:url");
-var import_meta6 = {};
-var FALLBACK_VERSION = "0.7.4";
+var import_meta7 = {};
+var FALLBACK_VERSION = "0.7.6";
 function readPlatformVersion() {
   const bases = [];
   if (typeof __dirname !== "undefined") bases.push(__dirname);
   try {
-    bases.push(import_node_path12.default.dirname((0, import_node_url5.fileURLToPath)(import_meta6.url)));
+    bases.push(import_node_path13.default.dirname((0, import_node_url5.fileURLToPath)(import_meta7.url)));
   } catch {
   }
   for (const base of bases) {
     let dir = base;
     for (; ; ) {
       try {
-        const pkg = JSON.parse(import_node_fs11.default.readFileSync(import_node_path12.default.join(dir, "package.json"), "utf-8"));
+        const pkg = JSON.parse(import_node_fs11.default.readFileSync(import_node_path13.default.join(dir, "package.json"), "utf-8"));
         if (pkg.name === "openlearn-next" && typeof pkg.version === "string") return pkg.version;
       } catch {
       }
-      const parent = import_node_path12.default.dirname(dir);
+      const parent = import_node_path13.default.dirname(dir);
       if (parent === dir) break;
       dir = parent;
     }
@@ -21464,7 +21773,7 @@ init_audit_log();
 // packages/core/plugin-host/dependency-install.ts
 var import_node_child_process2 = require("node:child_process");
 var import_node_fs12 = __toESM(require("node:fs"), 1);
-var import_node_path13 = __toESM(require("node:path"), 1);
+var import_node_path14 = __toESM(require("node:path"), 1);
 var DependencyInstallError = class extends Error {
   constructor(message, pluginId, cause) {
     super(message);
@@ -21499,7 +21808,7 @@ function resolveRegistry() {
 function assertDependenciesResolved(pluginDir, dependencies, pluginId) {
   const names = dependencyNames(dependencies);
   if (names.length === 0) return;
-  const lockPath = import_node_path13.default.join(pluginDir, "package-lock.json");
+  const lockPath = import_node_path14.default.join(pluginDir, "package-lock.json");
   if (!import_node_fs12.default.existsSync(lockPath)) {
     throw new DependencyInstallError(
       `\u4F9D\u8D56\u5B89\u88C5\u672A\u4EA7\u51FA package-lock.json \u2014\u2014 \u65E0\u6CD5\u786E\u8BA4\u4F9D\u8D56\u5DF2\u843D\u76D8\u3002pluginId=${pluginId}\uFF0C\u58F0\u660E\u4F9D\u8D56\uFF1A${names.join(", ")}`,
@@ -21581,7 +21890,7 @@ function installPluginDependencies(pluginDir, opts, runNpm = import_node_child_p
   const { pluginId, dependencies, operation = "install" } = opts;
   const depMap = toNpmDependencyMap(dependencies);
   if (Object.keys(depMap).length === 0) return;
-  const pkgJsonPath = import_node_path13.default.join(pluginDir, "package.json");
+  const pkgJsonPath = import_node_path14.default.join(pluginDir, "package.json");
   import_node_fs12.default.writeFileSync(
     pkgJsonPath,
     JSON.stringify({ name: pluginId, version: "0.0.0", dependencies: depMap }, null, 2),
@@ -22411,6 +22720,7 @@ var PluginHostUninstall = class extends PluginHostInstall {
         return pluginId;
       }
     })();
+    await this.revokePluginQuestionTypes(pluginId, manifestId);
     if (state === "uninstalled" /* UNINSTALLED */ && !row) {
       this.pluginStates.delete(pluginId);
       return {
@@ -32668,7 +32978,7 @@ ${formatEnvIssues(warnings)}`);
 
 // server/security/file-permissions.ts
 var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
 var FILE_PERMISSION_BASELINE_DOC = "\u4FEE\u590D\uFF1Achmod 600 <file>\uFF08\u76EE\u5F55 chmod 700\uFF09\uFF1B\u8BE6\u89C1 docs/administrator-guide/admin-manual.md \u6587\u4EF6\u6743\u9650\u57FA\u7EBF\u4E00\u8282\u3002";
 function modeOf(p) {
   try {
@@ -32678,13 +32988,13 @@ function modeOf(p) {
   }
 }
 function defaultPaths() {
-  const dbPath2 = process.env.OPENLEARN_DB_PATH ? import_node_path14.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH) : import_node_path14.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
-  const backupDir = process.env.BACKUP_DIR ? import_node_path14.default.resolve(process.cwd(), process.env.BACKUP_DIR) : import_node_path14.default.join(import_node_path14.default.dirname(dbPath2), "backups");
+  const dbPath2 = process.env.OPENLEARN_DB_PATH ? import_node_path15.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH) : import_node_path15.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
+  const backupDir = process.env.BACKUP_DIR ? import_node_path15.default.resolve(process.cwd(), process.env.BACKUP_DIR) : import_node_path15.default.join(import_node_path15.default.dirname(dbPath2), "backups");
   return {
-    envPath: import_node_path14.default.resolve(process.cwd(), ".env"),
+    envPath: import_node_path15.default.resolve(process.cwd(), ".env"),
     dbPath: dbPath2,
     backupDir,
-    encryptionKeyPath: import_node_path14.default.resolve(process.cwd(), "storage", "encryption-key")
+    encryptionKeyPath: import_node_path15.default.resolve(process.cwd(), "storage", "encryption-key")
   };
 }
 function checkSensitiveFilePermissions(options = {}) {
@@ -32719,7 +33029,7 @@ function checkSensitiveFilePermissions(options = {}) {
       if (scanned >= maxBackupFiles) break;
       if (!entry.endsWith(".db")) continue;
       scanned++;
-      checkFile(import_node_path14.default.join(backupDir, entry), "600", "backup-file");
+      checkFile(import_node_path15.default.join(backupDir, entry), "600", "backup-file");
     }
   }
   return issues;
@@ -33620,7 +33930,7 @@ var runOpenAIAgentChat = async (provider, request) => {
 
 // server/backup-scheduler.ts
 var import_node_fs15 = __toESM(require("node:fs"), 1);
-var import_node_path15 = __toESM(require("node:path"), 1);
+var import_node_path16 = __toESM(require("node:path"), 1);
 var HOUR_MS = 60 * 60 * 1e3;
 var DAY_MS2 = 24 * HOUR_MS;
 var WAL_FULL_THRESHOLD_BYTES = 50 * 1024 * 1024;
@@ -33637,8 +33947,8 @@ function shouldFullCheckpoint(walBytes, threshold = WAL_FULL_THRESHOLD_BYTES) {
 }
 function resolveDbPath(explicit) {
   if (explicit) return explicit;
-  if (process.env.OPENLEARN_DB_PATH) return import_node_path15.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH);
-  return import_node_path15.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
+  if (process.env.OPENLEARN_DB_PATH) return import_node_path16.default.resolve(process.cwd(), process.env.OPENLEARN_DB_PATH);
+  return import_node_path16.default.resolve(process.cwd(), "packages/core/db/educational_os.db");
 }
 function startBackupScheduler(deps) {
   const noop = { stop: () => {
@@ -33757,9 +34067,9 @@ function isWhitelisted(route, whitelist) {
     (entry) => entry.method.toUpperCase() === route.method && normalizePath2(entry.path) === normalizePath2(route.path)
   );
 }
-function normalizePath2(path46) {
-  if (!path46) return "/";
-  return path46.endsWith("/") && path46.length > 1 ? path46.slice(0, -1) : path46;
+function normalizePath2(path47) {
+  if (!path47) return "/";
+  return path47.endsWith("/") && path47.length > 1 ? path47.slice(0, -1) : path47;
 }
 function auditRouteScopes(app, whitelist = []) {
   const declared = [];
@@ -33937,11 +34247,11 @@ function enforcePasswordChanged(req, res, next) {
   if (isPasswordChangeGateSkipped()) {
     return next();
   }
-  const path46 = req.path || "";
-  if (!path46.startsWith("/api/")) {
+  const path47 = req.path || "";
+  if (!path47.startsWith("/api/")) {
     return next();
   }
-  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path46)) {
+  if (PASSWORD_CHANGE_EXEMPT_PATHS.has(path47)) {
     return next();
   }
   const token = getCookieToken(req);
@@ -34016,8 +34326,8 @@ function csrfGuard(req, res, next) {
       next();
       return;
     }
-    const path47 = req.path;
-    if (EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
+    const path48 = req.path;
+    if (EXEMPT_PREFIXES.some((p) => path48 === p || path48.startsWith(p))) {
       next();
       return;
     }
@@ -34027,10 +34337,10 @@ function csrfGuard(req, res, next) {
   const origin = req.headers.origin;
   const referer = req.headers.referer;
   const host = req.headers.host;
-  const path46 = req.path;
+  const path47 = req.path;
   if (typeof origin === "string" && origin !== "") {
     if (origin === "null") {
-      if (!EXEMPT_PREFIXES.some((p) => path46 === p || path46.startsWith(p))) {
+      if (!EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
         res.status(403).json({ success: false, code: "FORBIDDEN_CROSS_SITE", error: "Opaque origin write request blocked" });
         return;
       }
@@ -34038,7 +34348,7 @@ function csrfGuard(req, res, next) {
       try {
         const originHost = new URL(origin).host;
         if (host && originHost.toLowerCase() !== host.toLowerCase()) {
-          if (!EXEMPT_PREFIXES.some((p) => path46 === p || path46.startsWith(p))) {
+          if (!EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
             res.status(403).json({
               success: false,
               code: "FORBIDDEN_CROSS_SITE",
@@ -34056,7 +34366,7 @@ function csrfGuard(req, res, next) {
     try {
       const refererHost = new URL(referer).host;
       if (host && refererHost.toLowerCase() !== host.toLowerCase()) {
-        if (!EXEMPT_PREFIXES.some((p) => path46 === p || path46.startsWith(p))) {
+        if (!EXEMPT_PREFIXES.some((p) => path47 === p || path47.startsWith(p))) {
           res.status(403).json({
             success: false,
             code: "FORBIDDEN_CROSS_SITE",
@@ -34109,8 +34419,8 @@ function parseSentryDsn(dsn) {
     const projectId = url.pathname.split("/").filter(Boolean).pop();
     if (!projectId || !/^\d+$/.test(projectId)) return null;
     const prefix = url.pathname.split("/").filter(Boolean).slice(0, -1).join("/");
-    const path46 = prefix ? `/${prefix}` : "";
-    const envelopeUrl = `${url.protocol}//${url.host}${path46}/api/${projectId}/envelope/`;
+    const path47 = prefix ? `/${prefix}` : "";
+    const envelopeUrl = `${url.protocol}//${url.host}${path47}/api/${projectId}/envelope/`;
     return { envelopeUrl, publicKey };
   } catch {
     return null;
@@ -34551,14 +34861,14 @@ function createSocketIoCors(options) {
 
 // server/routes/health.ts
 var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_path17 = __toESM(require("node:path"), 1);
+var import_node_path18 = __toESM(require("node:path"), 1);
 
 // packages/core/observability/health.ts
 var import_node_fs16 = __toESM(require("node:fs"), 1);
-var import_node_path16 = __toESM(require("node:path"), 1);
+var import_node_path17 = __toESM(require("node:path"), 1);
 var import_node_crypto13 = require("node:crypto");
 function probeStorageWritable(dir) {
-  const probe = import_node_path16.default.join(dir, `.ready-${process.pid}-${(0, import_node_crypto13.randomBytes)(4).toString("hex")}`);
+  const probe = import_node_path17.default.join(dir, `.ready-${process.pid}-${(0, import_node_crypto13.randomBytes)(4).toString("hex")}`);
   try {
     import_node_fs16.default.mkdirSync(dir, { recursive: true });
     import_node_fs16.default.writeFileSync(probe, "ok", { flag: "w" });
@@ -34575,14 +34885,14 @@ function probeStorageWritable(dir) {
 function listMigrationNames(migrationsDir) {
   try {
     if (!import_node_fs16.default.existsSync(migrationsDir)) return null;
-    const names = import_node_fs16.default.readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).map((file) => import_node_path16.default.basename(file, ".sql"));
+    const names = import_node_fs16.default.readdirSync(migrationsDir).filter((file) => file.endsWith(".sql")).map((file) => import_node_path17.default.basename(file, ".sql"));
     return names.length > 0 ? names : null;
   } catch {
     return null;
   }
 }
 function migrationRecordName(name) {
-  return import_node_path16.default.basename(name.replace(/\r/g, "").trim(), ".sql");
+  return import_node_path17.default.basename(name.replace(/\r/g, "").trim(), ".sql");
 }
 function migrationsComplete(expected, applied) {
   if (!expected) return { ok: false, reason: "migrations" };
@@ -34682,7 +34992,7 @@ function newestBackupAgeSeconds(backupDir, now) {
   let newestMs = Number.NEGATIVE_INFINITY;
   for (const name of names) {
     try {
-      const stat = import_node_fs17.default.statSync(import_node_path17.default.join(backupDir, name));
+      const stat = import_node_fs17.default.statSync(import_node_path18.default.join(backupDir, name));
       if (!stat.isFile()) continue;
       if (stat.mtimeMs > newestMs) newestMs = stat.mtimeMs;
     } catch {
@@ -34714,7 +35024,7 @@ function defaultCountEvents() {
 function registerHealthRoutes(app, options) {
   const startTime = options?.startTime ?? Date.now();
   const platformVersion = options?.platformVersion ?? PLATFORM_VERSION;
-  const migrationsDir = options?.migrationsDir ?? import_node_path17.default.join(process.cwd(), "migrations");
+  const migrationsDir = options?.migrationsDir ?? import_node_path18.default.join(process.cwd(), "migrations");
   const storageDir = options?.storageDir ?? getStorageDir();
   const backupDir = options?.backupDir ?? getBackupsDir();
   const countEvents = options?.countEvents ?? defaultCountEvents;
@@ -34835,7 +35145,7 @@ var import_zod2 = require("zod");
 
 // server/services/course-package-assets.ts
 var import_node_fs18 = __toESM(require("node:fs"), 1);
-var import_node_path18 = __toESM(require("node:path"), 1);
+var import_node_path19 = __toESM(require("node:path"), 1);
 var import_node_crypto14 = __toESM(require("node:crypto"), 1);
 var import_jszip3 = __toESM(require("jszip"), 1);
 var import_jspdf = require("jspdf");
@@ -35102,7 +35412,7 @@ async function materializePackageAssets(assets) {
         throw new Error(`\u8BFE\u7A0B\u5305\u8D44\u4EA7 "${asset.id}" \u58F0\u660E\u4E3A ${asset.contentType} \u4F46\u5185\u5BB9\u662F\u4E8C\u8FDB\u5236`);
       }
       const uniqueName = `${Date.now()}-${import_node_crypto14.default.randomBytes(4).toString("hex")}${ext}`;
-      const filePath = import_node_path18.default.join(uploadsDir, uniqueName);
+      const filePath = import_node_path19.default.join(uploadsDir, uniqueName);
       import_node_fs18.default.writeFileSync(filePath, buffer);
       writtenPaths.push(filePath);
       const slideCount = isEmbeddableAssetType(asset.contentType) ? asset.contentType === "pdf" ? countPdfPages(buffer) : await countPptxSlides(buffer) : 0;
@@ -42066,7 +42376,7 @@ function registerLessonsRoutes(ctx) {
 
 // server/services/course-package-import.ts
 var import_node_fs20 = __toESM(require("node:fs"), 1);
-var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_path20 = __toESM(require("node:path"), 1);
 var import_uuid18 = require("uuid");
 
 // server/services/course-package-identity.ts
@@ -42341,8 +42651,8 @@ function findReferencedAsset(rawData, assets) {
 function cleanupMaterializedAssets(materialized) {
   const uploadsDir = getUploadsDir();
   for (const asset of materialized.values()) {
-    const fileName = import_node_path19.default.basename(asset.fileUrl);
-    const target = import_node_path19.default.join(uploadsDir, fileName);
+    const fileName = import_node_path20.default.basename(asset.fileUrl);
+    const target = import_node_path20.default.join(uploadsDir, fileName);
     try {
       if (import_node_fs20.default.existsSync(target)) {
         import_node_fs20.default.unlinkSync(target);
@@ -46478,6 +46788,85 @@ function registerAssignmentsRoutes(ctx) {
 
 // server/routes/assignment-hub.ts
 var import_express3 = __toESM(require("express"), 1);
+
+// packages/core/assignment/file-preview-policy.ts
+function extensionOf(fileName) {
+  if (typeof fileName !== "string") return "";
+  const base = fileName.split(/[\\/]/).pop() || "";
+  const dot = base.lastIndexOf(".");
+  if (dot <= 0 || dot === base.length - 1) return "";
+  return base.slice(dot).toLowerCase();
+}
+var PREVIEW_CONTENT_TYPES = Object.freeze({
+  // 文档
+  ".pdf": "application/pdf",
+  ".rtf": "application/rtf",
+  ".odt": "application/vnd.oasis.opendocument.text",
+  ".odp": "application/vnd.oasis.opendocument.presentation",
+  ".ods": "application/vnd.oasis.opendocument.spreadsheet",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  // 纯文本 / 代码 / 数据 —— 宿主按文本渲染
+  ".txt": "text/plain",
+  ".md": "text/plain",
+  ".csv": "text/plain",
+  ".json": "text/plain",
+  ".xml": "text/plain",
+  ".html": "text/plain",
+  ".css": "text/plain",
+  ".py": "text/plain",
+  ".js": "text/plain",
+  ".mjs": "text/plain",
+  ".cjs": "text/plain",
+  ".ts": "text/plain",
+  ".tsx": "text/plain",
+  ".jsx": "text/plain",
+  ".java": "text/plain",
+  ".c": "text/plain",
+  ".h": "text/plain",
+  ".cpp": "text/plain",
+  ".cs": "text/plain",
+  ".go": "text/plain",
+  ".rs": "text/plain",
+  ".rb": "text/plain",
+  ".php": "text/plain",
+  ".sql": "text/plain",
+  ".ino": "text/plain",
+  // 图片
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".bmp": "image/bmp",
+  ".svg": "image/svg+xml",
+  ".heic": "image/heic",
+  // 压缩包
+  ".zip": "application/zip"
+});
+var INLINE_SAFE_CONTENT_TYPES = /* @__PURE__ */ new Set([
+  "application/pdf",
+  "text/plain",
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/bmp"
+]);
+var TEXT_PREVIEW_MAX_BYTES = 512 * 1024;
+function resolveContentType(fileName) {
+  const extension = extensionOf(fileName);
+  return PREVIEW_CONTENT_TYPES[extension] ?? "application/octet-stream";
+}
+function isInlineSafeContentType(contentType) {
+  return INLINE_SAFE_CONTENT_TYPES.has((contentType || "").toLowerCase());
+}
+
+// server/routes/assignment-hub.ts
 function decodeFileName(raw) {
   const text = String(raw ?? "").trim();
   if (!text) return "";
@@ -46657,6 +47046,19 @@ function registerAssignmentHubRoutes(ctx) {
       );
       res.setHeader("X-Content-Type-Options", "nosniff");
       res.setHeader("Cache-Control", "private, no-store");
+      const wantsInline = String(req.query.disposition || "").toLowerCase() === "inline";
+      const contentType = resolveContentType(originalName);
+      if (wantsInline && isInlineSafeContentType(contentType)) {
+        res.setHeader("Content-Type", contentType);
+        res.setHeader(
+          "Content-Security-Policy",
+          contentType === "application/pdf" ? "sandbox allow-scripts" : "sandbox"
+        );
+        const safeName = encodeURIComponent(originalName).replace(/['()]/g, escape);
+        res.setHeader("Content-Disposition", `inline; filename*=UTF-8''${safeName}`);
+        res.sendFile(absPath);
+        return;
+      }
       res.download(absPath, originalName);
     } catch (e) {
       sendHubError(res, e);
@@ -48422,7 +48824,7 @@ async function checkVersion(source, installedVersion) {
 init_audit_log();
 
 // server/routes/plugin-api-gateway.ts
-var import_node_path20 = __toESM(require("node:path"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
 init_http_router();
 init_interfaces();
 var RESERVED_ACTIONS = /* @__PURE__ */ new Set([
@@ -48596,7 +48998,7 @@ async function pluginApiGatewayMiddleware(req, res, next) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
   }
-  const normalizedSubPath = import_node_path20.default.posix.normalize("/" + rawSubPath);
+  const normalizedSubPath = import_node_path21.default.posix.normalize("/" + rawSubPath);
   if (normalizedSubPath.includes("..")) {
     res.status(400).json({ success: false, error: "Path traversal attempt detected" });
     return;
@@ -49034,7 +49436,7 @@ init_fetch_with_retry();
 // server/services/community-registry.ts
 var import_semver7 = __toESM(require("semver"), 1);
 var import_node_fs21 = __toESM(require("node:fs"), 1);
-var import_node_path21 = __toESM(require("node:path"), 1);
+var import_node_path22 = __toESM(require("node:path"), 1);
 var import_node_os3 = __toESM(require("node:os"), 1);
 var import_node_crypto16 = require("node:crypto");
 var COMMUNITY_REGISTRY_ENV = "PLUGIN_COMMUNITY_REGISTRY_URL";
@@ -49256,7 +49658,7 @@ async function downloadPluginPackage(downloadUrl, options = {}) {
   if (!response.body) {
     throw new Error("\u4E0B\u8F7D\u63D2\u4EF6\u5305\u5931\u8D25: \u54CD\u5E94\u4F53\u4E3A\u7A7A");
   }
-  const zipPath = import_node_path21.default.join(import_node_os3.default.tmpdir(), `plugin-download-${(0, import_node_crypto16.randomUUID)()}.zip`);
+  const zipPath = import_node_path22.default.join(import_node_os3.default.tmpdir(), `plugin-download-${(0, import_node_crypto16.randomUUID)()}.zip`);
   const out = import_node_fs21.default.createWriteStream(zipPath);
   let received = 0;
   try {