icoa-cli 2.19.13 → 2.19.15

package/dist/commands/ctf.js

@@ -176,12 +176,27 @@ export function registerCtfCommands(program) {
             }
         }
         catch (err) {
-            spinner2.fail('Connection test failed');
-            printError(err.message);
-            // Still save URL so user can retry
-            saveConfig({ ctfdUrl: url, sessionCookie: sessionCookie });
-            console.log();
-            printInfo('Connection saved. Try: join ' + url);
+            if (sessionCookie) {
+                // Session login succeeded but API test failed — save anyway
+                spinner2.succeed('Connected (session mode — limited API)');
+                saveConfig({
+                    ctfdUrl: url,
+                    token: sessionCookie,
+                    userName: username,
+                    sessionCookie: sessionCookie,
+                });
+                console.log();
+                printKeyValue('User', username);
+                printWarning('API access limited. Some features may not work.');
+                printSuccess('Connection saved.');
+            }
+            else {
+                spinner2.fail('Connection test failed');
+                printError(err.message);
+                saveConfig({ ctfdUrl: url });
+                console.log();
+                printInfo('Connection saved. Try: join ' + url);
+            }
         }
     });
     // ─── icoa ctf logout ───

package/dist/commands/exam.js

@@ -6,6 +6,7 @@ import { getExamState, saveExamState, clearExamState, getExamDeadline } from '..
 import { logCommand } from '../lib/logger.js';
 import { printSuccess, printError, printWarning, printInfo, printTable, printHeader, printKeyValue, createSpinner, formatCountdown, } from '../lib/ui.js';
 import { t } from '../lib/i18n.js';
+import { getDeviceFingerprint } from '../lib/access.js';
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function drawProgress(percent, label) {
     const width = 30;
@@ -29,14 +30,17 @@ function checkTimeRemaining() {
         return true;
     if (new Date() >= deadline) {
         const state = getExamState();
-        if (state && state.session.examId === 'demo-free') {
-            // Demo expired — auto-clear
-            printWarning('Demo time expired. Starting fresh!');
-            printInfo('Type: demo');
-            clearExamState();
-        }
-        else {
-            printError('Time expired! Use "exam submit" to submit your answers.');
+        if (state) {
+            const answered = Object.keys(state.answers).length;
+            if (state.session.examId === 'demo-free' || answered === 0) {
+                // Demo or unanswered expired exam — auto-clear to avoid deadlock
+                clearExamState();
+                printWarning('Exam expired and cleared.');
+                printInfo('Type: demo to start again.');
+            }
+            else {
+                printError('Time expired! Use "exam submit" to submit your answers.');
+            }
         }
         return false;
     }
@@ -639,12 +643,15 @@ export function registerExamCommand(program) {
         const total = state.session.questionCount;
         const unanswered = total - answered;
         if (answered === 0) {
-            printWarning('No answers to submit.');
-            if (state.session.examId === 'demo-free') {
+            const deadline = getExamDeadline();
+            const expired = deadline && new Date() >= deadline;
+            if (state.session.examId === 'demo-free' || expired) {
                 clearExamState();
-                printInfo('Demo cleared. Type: demo to start again.');
+                printWarning('No answers to submit. Exam cleared.');
+                printInfo('Type: demo to start again.');
             }
             else {
+                printWarning('No answers to submit.');
                 printInfo('Answer some questions first: exam q 1');
             }
             return;
@@ -773,12 +780,35 @@ export function registerExamCommand(program) {
             return;
         }
         // Real exam: submit to server
-        const client = requireExamConnection();
-        if (!client)
-            return;
+        // Token-based exam: use direct fetch with exam token
+        // CTFd-based exam: use ExamClient
+        const examToken = state.session.token;
         try {
             drawProgress(0, 'Uploading answers...');
-            const result = await client.submitExam(state.session.examId, state.answers);
+            let result;
+            if (examToken) {
+                // Submit via exam token
+                const config = getConfig();
+                const serverUrl = config.ctfdUrl || 'https://practice.icoa2026.au';
+                const res = await fetch(`${serverUrl}/api/icoa/exams/${state.session.examId}/submit`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ token: examToken, answers: state.answers }),
+                    signal: AbortSignal.timeout(10000),
+                });
+                if (!res.ok) {
+                    const err = await res.json().catch(() => ({ message: 'Submit failed' }));
+                    throw new Error(err.message || 'Submit failed');
+                }
+                const json = await res.json();
+                result = json.data;
+            }
+            else {
+                const client = requireExamConnection();
+                if (!client)
+                    return;
+                result = await client.submitExam(state.session.examId, state.answers);
+            }
             drawProgress(50, 'Grading...');
             await sleep(300);
             drawProgress(100, 'Complete!');
@@ -853,7 +883,11 @@ export function registerExamCommand(program) {
             const res = await fetch(`${serverUrl}/api/icoa/exam-token`, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ token: code.trim() }),
+                body: JSON.stringify({
+                    token: code.trim(),
+                    deviceHash: getDeviceFingerprint(),
+                    lang: config.language || 'en',
+                }),
                 signal: AbortSignal.timeout(10000),
             });
             if (!res.ok) {

package/dist/lib/access.d.ts

@@ -2,6 +2,7 @@ export declare function isFirstRunOrUpgrade(currentVersion: string): boolean;
 export declare function markVersionSeen(version: string): void;
 export declare function validateToken(token: string): boolean;
 export declare function isActivated(): boolean;
+export declare function getDeviceFingerprint(): string;
 export type ActivateResult = 'ok' | 'invalid' | 'already_bound';
 export declare function activateToken(token: string): ActivateResult;
 export declare function isDeviceMatch(): boolean;

package/dist/lib/access.js

@@ -127,7 +127,7 @@ export function isActivated() {
     const config = getConfig();
     return !!(config.accessToken && TOKEN_HASHES.has(hashToken(config.accessToken)));
 }
-function getDeviceFingerprint() {
+export function getDeviceFingerprint() {
     const parts = [hostname(), platform(), arch()];
     // Add hardware UUID where possible
     try {

package/dist/lib/ctfd-client.d.ts

@@ -9,6 +9,7 @@ export declare class CTFdClient {
     fetchCsrfNonce(): Promise<string>;
     private request;
     testConnection(): Promise<CTFdUser>;
+    private testConnectionViaProfile;
     getChallenges(): Promise<CTFdChallengeListItem[]>;
     getChallenge(id: number): Promise<CTFdChallenge>;
     submitFlag(challengeId: number, submission: string): Promise<CTFdAttemptResponse['data']>;

package/dist/lib/ctfd-client.js

@@ -69,7 +69,37 @@ export class CTFdClient {
         return json.data;
     }
     async testConnection() {
-        return this.request('GET', '/users/me');
+        try {
+            return await this.request('GET', '/users/me');
+        }
+        catch (err) {
+            // Session mode fallback: API may return 403, try scraping profile page
+            if (this.sessionCookie && err.message?.includes('403')) {
+                return this.testConnectionViaProfile();
+            }
+            throw err;
+        }
+    }
+    async testConnectionViaProfile() {
+        const res = await fetch(`${this.baseUrl}/settings`, {
+            headers: { Cookie: this.sessionCookie },
+        });
+        if (!res.ok)
+            throw new Error('Session expired or invalid.');
+        const html = await res.text();
+        // Extract user name from settings page
+        const nameMatch = html.match(/name="name"[^>]*value="([^"]+)"/) ||
+            html.match(/<input[^>]*id="name"[^>]*value="([^"]+)"/);
+        const name = nameMatch?.[1] || 'User';
+        // Extract user ID from page
+        const idMatch = html.match(/user_id['":\s]+(\d+)/) ||
+            html.match(/userId['":\s]+(\d+)/);
+        const id = idMatch ? parseInt(idMatch[1], 10) : 0;
+        // Update CSRF nonce from settings page
+        const csrfMatch = html.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
+        if (csrfMatch)
+            this.csrfNonce = csrfMatch[1];
+        return { id, name, score: 0, team_id: 0, country: '' };
     }
     async getChallenges() {
         return this.request('GET', '/challenges');

package/dist/lib/demo-exam.js

@@ -98,7 +98,7 @@ export function getLocalizedDemoQuestions() {
         return DEMO_QUESTIONS;
     try {
         const data = JSON.parse(readFileSync(path, 'utf-8'));
-        if (Array.isArray(data) && data.length === 30)
+        if (Array.isArray(data) && data.length >= DEMO_QUESTIONS.length)
             return data;
     }
     catch { }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.19.13",
+  "version": "2.19.15",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "build": "tsc",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
-    "postinstall": "node dist/postinstall.js 2>/dev/null || true"
+    "postinstall": "node -e \"try{require('./dist/postinstall.js')}catch(e){}\""
   },
   "keywords": [
     "ctf",