icoa-cli 2.1.2 → 2.1.4

package/dist/commands/ctf.js

@@ -7,11 +7,13 @@ import { getTranslation } from '../lib/translation.js';
 import { printSuccess, printError, printWarning, printInfo, printTable, printMarkdown, printHeader, printKeyValue, createSpinner, formatCountdown, } from '../lib/ui.js';
 function requireConnection() {
     const config = getConfig();
-    if (!config.ctfdUrl || !config.token) {
-        printError('Not connected to CTFd. Run: icoa ctf join <url>');
+    if (!config.ctfdUrl || (!config.token && !config.sessionCookie)) {
+        printError('Not connected to CTFd. Run: join <url>');
         process.exit(1);
     }
-    return { config, client: new CTFdClient(config.ctfdUrl, config.token) };
+    const session = config.sessionCookie || '';
+    const token = config.token && !config.token.includes('session=') ? config.token : '';
+    return { config, client: new CTFdClient(config.ctfdUrl, token, session || config.token) };
 }
 export function registerCtfCommands(program) {
     const ctf = program.command('ctf').description('Competition commands');
@@ -30,7 +32,9 @@ export function registerCtfCommands(program) {
                 { name: 'Username & Password', value: 'login' },
             ],
         });
-        let token;
+        let token = '';
+        let sessionCookie = '';
+        let csrfNonce = '';
         if (authMethod === 'token') {
             token = await input({ message: 'Enter your CTFd Access Token:' });
         }
@@ -41,7 +45,10 @@ export function registerCtfCommands(program) {
             spinner.start();
             try {
                 const client = new CTFdClient(url, '');
-                token = await client.loginWithCredentials(username, password);
+                const result = await client.loginWithCredentials(username, password);
+                token = result.token;
+                sessionCookie = result.session;
+                csrfNonce = result.csrf;
                 spinner.succeed('Login successful');
             }
             catch (err) {
@@ -54,7 +61,7 @@ export function registerCtfCommands(program) {
         const spinner = createSpinner('Testing connection...');
         spinner.start();
         try {
-            const client = new CTFdClient(url, token);
+            const client = new CTFdClient(url, token, sessionCookie, csrfNonce);
             const user = await client.testConnection();
             spinner.succeed('Connected successfully');
             console.log();
@@ -68,10 +75,11 @@ export function registerCtfCommands(program) {
                 const meta = await client.getCompetitionMeta();
                 const configUpdate = {
                     ctfdUrl: url,
-                    token: token,
+                    token: token || sessionCookie,
                     userId: user.id,
                     userName: user.name,
                     teamId: user.team_id,
+                    sessionCookie: sessionCookie,
                 };
                 if (meta.start) {
                     configUpdate.competitionStartsAt = new Date(meta.start * 1000).toISOString();

package/dist/index.js

@@ -36,7 +36,7 @@ ${LINE}
    ${chalk.white('Sydney, Australia')}  ${chalk.gray('Jun 27 - Jul 2, 2026')}
    ${chalk.cyan.underline('https://icoa2026.au')}
 
-   ${chalk.gray('CLI-Native Competition Terminal  v2.1.2')}
+   ${chalk.gray('CLI-Native Competition Terminal  v2.1.4')}
 
 ${LINE}
 `;

package/dist/lib/ctfd-client.d.ts

@@ -2,7 +2,11 @@ import type { CTFdChallenge, CTFdChallengeListItem, CTFdUser, CTFdTeam, CTFdScor
 export declare class CTFdClient {
     private baseUrl;
     private token;
-    constructor(baseUrl: string, token: string);
+    private sessionCookie;
+    private csrfNonce;
+    constructor(baseUrl: string, token: string, sessionCookie?: string, csrfNonce?: string);
+    private getAuthHeaders;
+    fetchCsrfNonce(): Promise<string>;
     private request;
     testConnection(): Promise<CTFdUser>;
     getChallenges(): Promise<CTFdChallengeListItem[]>;
@@ -18,5 +22,9 @@ export declare class CTFdClient {
     }>;
     getChallengeFiles(id: number): Promise<string[]>;
     downloadFile(filePath: string, destDir: string): Promise<string>;
-    loginWithCredentials(username: string, password: string): Promise<string>;
+    loginWithCredentials(username: string, password: string): Promise<{
+        token: string;
+        session: string;
+        csrf: string;
+    }>;
 }

package/dist/lib/ctfd-client.js

@@ -5,14 +5,52 @@ import { Readable } from 'node:stream';
 export class CTFdClient {
     baseUrl;
     token;
-    constructor(baseUrl, token) {
+    sessionCookie;
+    csrfNonce;
+    constructor(baseUrl, token, sessionCookie, csrfNonce) {
         this.baseUrl = baseUrl.replace(/\/+$/, '');
         this.token = token;
+        this.sessionCookie = sessionCookie || '';
+        this.csrfNonce = csrfNonce || '';
+    }
+    getAuthHeaders() {
+        if (this.token) {
+            return { Authorization: `Token ${this.token}` };
+        }
+        if (this.sessionCookie) {
+            const headers = { Cookie: this.sessionCookie };
+            if (this.csrfNonce) {
+                headers['CSRF-Token'] = this.csrfNonce;
+            }
+            return headers;
+        }
+        return {};
+    }
+    async fetchCsrfNonce() {
+        if (this.csrfNonce)
+            return this.csrfNonce;
+        try {
+            const res = await fetch(this.baseUrl, {
+                headers: this.sessionCookie ? { Cookie: this.sessionCookie } : {},
+            });
+            const html = await res.text();
+            const match = html.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
+            if (match) {
+                this.csrfNonce = match[1];
+                return this.csrfNonce;
+            }
+        }
+        catch { /* ignore */ }
+        return '';
     }
     async request(method, path, body) {
+        // Auto-fetch CSRF nonce for session-based auth
+        if (this.sessionCookie && !this.csrfNonce) {
+            await this.fetchCsrfNonce();
+        }
         const url = `${this.baseUrl}/api/v1${path}`;
         const headers = {
-            Authorization: `Token ${this.token}`,
+            ...this.getAuthHeaders(),
             'Content-Type': 'application/json',
         };
         const res = await fetch(url, {
@@ -43,7 +81,7 @@ export class CTFdClient {
         const res = await fetch(`${this.baseUrl}/api/v1/challenges/attempt`, {
             method: 'POST',
             headers: {
-                Authorization: `Token ${this.token}`,
+                ...this.getAuthHeaders(),
                 'Content-Type': 'application/json',
             },
             body: JSON.stringify({ challenge_id: challengeId, submission }),
@@ -85,13 +123,12 @@ export class CTFdClient {
             ? filePath
             : `${this.baseUrl}/${filePath.replace(/^\//, '')}`;
         const res = await fetch(url, {
-            headers: { Authorization: `Token ${this.token}` },
+            headers: this.getAuthHeaders(),
             redirect: 'follow',
         });
         if (!res.ok || !res.body) {
             throw new Error(`Failed to download: ${url}`);
         }
-        // Extract clean filename (strip query params like ?token=xxx)
         const rawName = filePath.split('/').pop() || 'file';
         const fileName = rawName.split('?')[0];
         const destPath = join(destDir, fileName);
@@ -103,7 +140,6 @@ export class CTFdClient {
         // Step 1: GET /login to get nonce
         const loginPageRes = await fetch(`${this.baseUrl}/login`);
         const loginHtml = await loginPageRes.text();
-        // Try multiple nonce patterns (CTFd versions differ)
         const nonceMatch = loginHtml.match(/name="nonce"[^>]*value="([^"]+)"/) ||
             loginHtml.match(/value="([^"]+)"[^>]*name="nonce"/) ||
             loginHtml.match(/id="nonce"[^>]*value="([^"]+)"/) ||
@@ -112,7 +148,6 @@ export class CTFdClient {
         if (!nonce) {
             throw new Error('Could not extract CSRF nonce from login page.');
         }
-        // Extract cookies
         const cookies = loginPageRes.headers.getSetCookie?.() || [];
         const cookieStr = cookies.map((c) => c.split(';')[0]).join('; ');
         // Step 2: POST /login with credentials
@@ -127,35 +162,46 @@ export class CTFdClient {
         });
         const loginCookies = loginRes.headers.getSetCookie?.() || [];
         const allCookies = [...cookies, ...loginCookies].map((c) => c.split(';')[0]).join('; ');
-        // Check if login was successful (redirect to /challenges or /, not back to /login)
         const location = loginRes.headers.get('location') || '';
         if (location.includes('/login')) {
             throw new Error('Invalid username or password.');
         }
-        // Step 3: Generate API token
-        // First get CSRF nonce from settings page
-        const settingsRes = await fetch(`${this.baseUrl}/settings`, {
-            headers: { Cookie: allCookies },
-        });
-        const settingsHtml = await settingsRes.text();
-        const csrfMatch = settingsHtml.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
-        const csrfNonce = csrfMatch?.[1] || nonce;
-        const tokenRes = await fetch(`${this.baseUrl}/api/v1/tokens`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Cookie: allCookies,
-                'CSRF-Token': csrfNonce,
-            },
-            body: JSON.stringify({ expiration: '2026-12-31T23:59:59+00:00' }),
-        });
-        if (!tokenRes.ok) {
-            throw new Error('Failed to generate API token. Please use a manual access token instead.');
+        // Step 3: Try to generate API token (some CTFd instances allow it)
+        try {
+            const settingsRes = await fetch(`${this.baseUrl}/settings`, {
+                headers: { Cookie: allCookies },
+            });
+            const settingsHtml = await settingsRes.text();
+            const csrfMatch = settingsHtml.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
+            const csrfNonce = csrfMatch?.[1] || nonce;
+            const tokenRes = await fetch(`${this.baseUrl}/api/v1/tokens`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Cookie: allCookies,
+                    'CSRF-Token': csrfNonce,
+                },
+                body: JSON.stringify({ expiration: '2026-12-31T23:59:59+00:00' }),
+            });
+            if (tokenRes.ok) {
+                const tokenJson = (await tokenRes.json());
+                if (tokenJson.success && tokenJson.data?.value) {
+                    return { token: tokenJson.data.value, session: '', csrf: '' };
+                }
+            }
         }
-        const tokenJson = (await tokenRes.json());
-        if (tokenJson.success && tokenJson.data?.value) {
-            return tokenJson.data.value;
+        catch { /* Token generation not available, use session */ }
+        // Fallback: use session cookie + CSRF nonce
+        // Get CSRF nonce from the main page
+        let csrf = '';
+        try {
+            const mainRes = await fetch(`${this.baseUrl}/challenges`, { headers: { Cookie: allCookies } });
+            const mainHtml = await mainRes.text();
+            const csrfMatch = mainHtml.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
+            if (csrfMatch)
+                csrf = csrfMatch[1];
         }
-        throw new Error('Failed to generate API token. Response: ' + JSON.stringify(tokenJson));
+        catch { /* ignore */ }
+        return { token: '', session: allCookies, csrf };
     }
 }

package/dist/repl.js

@@ -6,7 +6,6 @@ import { isActivated, activateToken, isFreeCommand, isDeviceMatch, recordExit, r
 import { resetTerminalTheme } from './lib/theme.js';
 import { ensureSandbox, runInSandbox, isDockerAvailable } from './lib/sandbox.js';
 import { logCommand } from './lib/logger.js';
-import { startLogSync, stopLogSync } from './lib/log-sync.js';
 import { existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
@@ -27,7 +26,7 @@ const BLOCKED_COMMANDS = new Set([
     'iptables', 'ufw', // firewall
 ]);
 const INTERCEPT = '__REPL_NO_EXIT__';
-const VERSION = '2.1.2';
+const VERSION = '2.1.4';
 export async function startRepl(program, resumeMode) {
     const config = getConfig();
     const connected = isConnected();
@@ -138,8 +137,8 @@ export async function startRepl(program, resumeMode) {
         terminal: true,
     });
     let processing = false;
-    // Start background log sync (every 30s to server)
-    startLogSync();
+    // Log sync disabled until server audit endpoint is configured
+    // startLogSync();
     rl.prompt();
     rl.on('line', async (line) => {
         if (processing)
@@ -153,7 +152,7 @@ export async function startRepl(program, resumeMode) {
         logCommand(input);
         // Exit — record, reset terminal colors, and quit
         if (input === 'exit' || input === 'quit' || input === 'q') {
-            stopLogSync();
+            // stopLogSync();
             recordExit();
             console.log(chalk.gray('  Session saved. Use ') + chalk.white('icoa --resume') + chalk.gray(' to continue.'));
             resetTerminalTheme();
@@ -296,7 +295,7 @@ export async function startRepl(program, resumeMode) {
         rl.prompt();
     });
     rl.on('close', () => {
-        stopLogSync();
+        // stopLogSync();
         recordExit();
         resetTerminalTheme();
         realExit(0);

package/dist/types/index.d.ts

@@ -101,6 +101,7 @@ export interface IcoaConfig {
     accessToken: string;
     deviceFingerprint: string;
     lastVersion: string;
+    sessionCookie: string;
 }
 export type CompetitionState = 'pre_competition' | 'demo' | 'live' | 'finished' | 'unknown';
 export type HintLevel = 'A' | 'B' | 'C';

package/dist/types/index.js

@@ -29,5 +29,6 @@ export const DEFAULT_CONFIG = {
     accessToken: '',
     deviceFingerprint: '',
     lastVersion: '',
+    sessionCookie: '',
 };
 export const SUPPORTED_LANGUAGES = ['en', 'zh', 'ja', 'ko', 'es'];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {

package/refs/hint.txt

@@ -21,8 +21,14 @@ LEVELS
     - No flags
     - Requires confirmation before use
 
+COMMANDS
+  hint <question>        Level A hint
+  hint-b <question>      Level B hint
+  hint-c <question>      Level C hint (requires confirmation)
+  hint budget            Check remaining budget
+
 USAGE TIPS
-  1. Open a challenge first: icoa ctf open <id>
+  1. Open a challenge first: open <id>
      This sets context for better hints.
 
   2. Be specific in your question:
@@ -33,7 +39,7 @@ USAGE TIPS
   3. Start with Level A — it's cheap (50 uses).
      Only escalate to B/C when A isn't enough.
 
-  4. Check your budget: icoa hint budget
+  4. Check your budget: hint budget
 
 TOKEN CAP
   All AI usage shares a 50,000 token cap.

package/refs/icoa.txt

@@ -1,36 +1,58 @@
-ICOA CLI — Quick Reference
-==========================
-
-COMPETITION COMMANDS
-  icoa ctf join <url>          Connect to CTFd instance
-  icoa ctf activate <code>     Validate competition code
-  icoa ctf challenges          List all challenges
-  icoa ctf open <id>           View challenge details
-  icoa ctf submit <id> <flag>  Submit a flag
-  icoa ctf scoreboard          View scoreboard / rankings
-  icoa ctf status              Show hint budget, score, rank, time
-  icoa ctf time                Competition countdown timer
-
-AI HINT SYSTEM
-  icoa hint <question>         Level A — General guidance (50 uses)
-  icoa hint-b <question>       Level B — Deep analysis (10 uses)
-  icoa hint-c <question>       Level C — Critical assist (2 uses)
-  icoa hint budget             Show remaining hint budget
-
-TOOLS & FILES
-  icoa shell                   Open Docker sandbox environment
-  icoa ref <topic>             Quick reference (this system)
-  icoa files <id>              Download challenge files
-  icoa connect <id>            Connect to remote target
-  icoa note <text>             Add personal note
-  icoa log                     View session history
-
-LANGUAGE
-  icoa lang <code>             Switch language (en/zh/ja/ko/es)
+ICOA CLI v2 — Quick Reference
+==============================
+
+GETTING STARTED
+  activate <token>       Unlock with your access token
+  join <url>             Connect to CTFd competition
+  env                    Check tool environment (109 commands)
+  env setup              One-click install all tools
+  help                   Show all commands
+
+COMPETITION
+  challenges (ch)        List all challenges
+  open <id>              View challenge details
+  submit <id> <flag>     Submit a flag
+  scoreboard (sb)        View rankings
+  status                 Hint budget, score, rank, time
+  time                   Competition countdown
+
+AI HINTS
+  hint <question>        Level A — General guidance (50 uses)
+  hint-b <question>      Level B — Deep analysis (10 uses)
+  hint-c <question>      Level C — Critical assist (2 uses)
+  hint budget            Show remaining budget
+
+TOOLS
+  ref <topic>            Quick reference (38 topics)
+  files <id>             Download challenge files
+  connect <id>           Connect to remote target
+  note <text>            Personal notepad
+  log                    Session history
+  log stats              Session statistics
+  log export             Export audit trail (JSON)
+
+SYSTEM COMMANDS
+  python solve.py        Run Python (forced to 3.12.13)
+  nano solve.py          Edit files
+  gcc -o pwn pwn.c       Compile code
+  Any Linux command      Runs in ~/icoa-workspace/
+
+SETTINGS
+  setup                  Configure API keys
+  lang <code>            Switch language (en/zh/ja/ko/es)
+  clear                  Clear screen
+  exit                   Save session & quit
+
+SHORTCUTS
+  ch = challenges
+  sb = scoreboard
+  flag = submit
 
 TIPS
-  - Use 'icoa ctf open <id>' before 'icoa hint' to set challenge context
-  - Level A hints are cheap — use them freely for direction
+  - Use 'open <id>' before 'hint' to set challenge context
+  - Level A hints are cheap — use freely for direction
   - Level C hints require confirmation — use wisely
-  - All prompts are logged automatically
-  - Use 'icoa ref <topic>' for zero-cost tool references
+  - All commands are logged for audit
+  - python/python3 always uses Python 3.12.13
+  - System commands run in ~/icoa-workspace/ (sandboxed)
+  - Use 'ref <topic>' for zero-cost tool references