icoa-cli 2.19.17 → 2.19.19

package/dist/commands/exam.js

@@ -405,13 +405,6 @@ export function registerExamCommand(program) {
         const q = state.questions.find((qq) => qq.number === currentQ);
         if (!q)
             return;
-        // Find the correct answer for demo
-        let correctAnswer = null;
-        if (state.session.examId === 'demo-free') {
-            import('../lib/demo-exam.js').then(({ DEMO_ANSWERS }) => {
-                correctAnswer = DEMO_ANSWERS[currentQ];
-            });
-        }
         // Check: already used 2 helps on this question
         if (qHelps >= 2) {
             console.log();
@@ -468,9 +461,8 @@ export function registerExamCommand(program) {
             console.log(chalk.yellow(`  💡 Option ${toRemove} eliminated!`) + chalk.gray(`  (help ${help.used}/${help.max})`));
             printQuestion(q, state.answers[q.number]);
         };
-        if (state.session.examId === 'demo-free') {
-            const { DEMO_ANSWERS } = await import('../lib/demo-exam.js');
-            doEliminate(DEMO_ANSWERS[currentQ]);
+        if (state.session.examId === 'demo-free' && q.answer) {
+            doEliminate(q.answer);
         }
         else {
             // For server exams, we don't know the answer — eliminate random non-selected option
@@ -671,28 +663,34 @@ export function registerExamCommand(program) {
         // Demo exam: grade locally
         if (state.session.examId === 'demo-free') {
             try {
-                const { DEMO_ANSWERS, getLocalizedExplanations } = await import('../lib/demo-exam.js');
                 drawProgress(0, t('grading'));
                 await sleep(300);
                 let score = 0;
                 const wrongQuestions = [];
-                for (const [qn, ans] of Object.entries(state.answers)) {
-                    const num = Number(qn);
-                    if (DEMO_ANSWERS[num] === ans) {
+                const categoryStats = {};
+                for (const q of state.questions) {
+                    const cat = q.category || 'Other';
+                    if (!categoryStats[cat])
+                        categoryStats[cat] = { correct: 0, total: 0 };
+                    categoryStats[cat].total++;
+                    const userAns = state.answers[q.number];
+                    if (userAns && q.answer && userAns === q.answer) {
                         score++;
+                        categoryStats[cat].correct++;
                     }
                     else {
-                        wrongQuestions.push(num);
-                    }
-                }
-                // Also count unanswered as wrong
-                for (const q of state.questions) {
-                    if (!state.answers[q.number])
                         wrongQuestions.push(q.number);
+                    }
                 }
                 wrongQuestions.sort((a, b) => a - b);
                 drawProgress(100, t('complete'));
                 console.log();
+                // Elapsed time
+                const startedMs = new Date(state.session.startedAt).getTime();
+                const elapsedSec = Math.max(0, Math.round((Date.now() - startedMs) / 1000));
+                const elapsedMin = Math.floor(elapsedSec / 60);
+                const elapsedS = elapsedSec % 60;
+                const elapsedLabel = `${elapsedMin}m ${elapsedS}s`;
                 const questionsSnapshot = [...state.questions];
                 const answersSnapshot = { ...state.answers };
                 const helpState = getHelpState(state);
@@ -728,14 +726,27 @@ export function registerExamCommand(program) {
                 console.log();
                 console.log(chalk.bold(`   ${t('score')}: ${score}/${total} (${percentage}%)`));
                 console.log(chalk.bold(`   ${percentage >= 60 ? chalk.green(t('passed')) : chalk.red(t('notPassed'))}`));
+                console.log(chalk.gray(`   Elapsed: ${elapsedLabel}`));
                 console.log();
                 console.log(chalk.yellow('   International Cyber Olympiad in AI 2026'));
                 console.log(chalk.gray('   Sydney, Australia · Jun 27 - Jul 2, 2026'));
                 console.log();
                 console.log(chalk.cyan('  ═══════════════════════════════════════'));
+                // Per-category breakdown
+                const catEntries = Object.entries(categoryStats);
+                if (catEntries.length > 0) {
+                    console.log();
+                    console.log(chalk.bold.white('  By category'));
+                    for (const [cat, s] of catEntries) {
+                        const pct = s.total > 0 ? Math.round(s.correct / s.total * 100) : 0;
+                        const color = pct >= 80 ? chalk.green : pct >= 50 ? chalk.yellow : chalk.red;
+                        console.log('    ' + color(`${cat.padEnd(20)} ${s.correct}/${s.total}  (${pct}%)`));
+                    }
+                    console.log();
+                    console.log(chalk.cyan('  ─────────────────────────────────────────────'));
+                }
                 // Show wrong answers with explanations
                 if (wrongQuestions.length > 0) {
-                    const explanations = getLocalizedExplanations();
                     console.log();
                     console.log(chalk.yellow(`  ${wrongQuestions.length} ${t('incorrectIntro')}`));
                     console.log();
@@ -744,7 +755,7 @@ export function registerExamCommand(program) {
                         if (!q)
                             continue;
                         const userAns = answersSnapshot[qn];
-                        const correctAns = DEMO_ANSWERS[qn];
+                        const correctAns = q.answer;
                         console.log(chalk.white(`  Q${qn}. ${q.text}`));
                         if (userAns) {
                             console.log(chalk.red(`    ${t('yourAnswer')}: ${userAns}. ${q.options[userAns]}`));
@@ -752,9 +763,11 @@ export function registerExamCommand(program) {
                         else {
                             console.log(chalk.yellow(`    ${t('yourAnswer')}: —`));
                         }
-                        console.log(chalk.green(`    ${t('correct')}: ${correctAns}. ${q.options[correctAns]}`));
-                        if (explanations[qn]) {
-                            console.log(chalk.gray(`    → ${explanations[qn]}`));
+                        if (correctAns) {
+                            console.log(chalk.green(`    ${t('correct')}: ${correctAns}. ${q.options[correctAns]}`));
+                        }
+                        if (q.explanation) {
+                            console.log(chalk.gray(`    → ${q.explanation}`));
                         }
                         console.log();
                     }
@@ -952,8 +965,8 @@ export function registerExamCommand(program) {
         .description('Try a free practice exam (no account needed)')
         .action(async () => {
         logCommand('exam demo');
-        const { getLocalizedDemoQuestions, getLocalizedDemoSession } = await import('../lib/demo-exam.js');
-        const DEMO_QUESTIONS = getLocalizedDemoQuestions();
+        const { pickDemoQuestions, getLocalizedDemoSession, DEMO_PICK_SIZE, DEMO_POOL_SIZE } = await import('../lib/demo-exam.js');
+        const DEMO_QUESTIONS = pickDemoQuestions(DEMO_PICK_SIZE);
         const DEMO_SESSION = getLocalizedDemoSession();
         const existing = getExamState();
         if (existing) {
@@ -971,7 +984,7 @@ export function registerExamCommand(program) {
         printHeader('ICOA Demo Exam — Free Practice');
         console.log();
         console.log(chalk.white('  Free practice · No account needed · No time limit'));
-        console.log(chalk.white('  15 questions · Pick one answer per question'));
+        console.log(chalk.white(`  ${DEMO_PICK_SIZE} random questions from a pool of ${DEMO_POOL_SIZE} · Pick one answer per question`));
         console.log();
         printHowToPlay();
         console.log();
@@ -981,7 +994,7 @@ export function registerExamCommand(program) {
         if (currentLang === 'en') {
             console.log(chalk.gray('  Questions in English. To switch language first:'));
             console.log(chalk.gray('  lang es (Español) · lang zh (中文) · lang ko (한국어) · lang ja (日本語)'));
-            console.log(chalk.gray('  lang fr · lang ar · lang pt · lang to see all 15'));
+            console.log(chalk.gray('  lang fr · lang ar · lang pt · 15 languages supported'));
         }
         else {
             console.log(chalk.green(`  Language: ${currentLang}`));
@@ -992,7 +1005,7 @@ export function registerExamCommand(program) {
         console.log();
         drawProgress(0, 'Preparing questions...');
         await sleep(200);
-        drawProgress(40, 'Setting up timer...');
+        drawProgress(40, 'Shuffling options...');
         await sleep(200);
         drawProgress(80, 'Almost ready...');
         await sleep(150);
@@ -1000,7 +1013,7 @@ export function registerExamCommand(program) {
         console.log();
         console.log();
         saveExamState({ session, questions: DEMO_QUESTIONS, answers: {} });
-        printKeyValue('Questions', '15');
+        printKeyValue('Questions', String(DEMO_PICK_SIZE));
         printKeyValue('Duration', 'No time limit');
         // Show first question
         printQuestion(DEMO_QUESTIONS[0]);

package/dist/commands/lang.js

@@ -50,22 +50,28 @@ export function registerLangCommand(program) {
         }
         saveConfig({ language: code });
         printSuccess(`Language set to: ${LANG_NAMES[code] || code}`);
-        // If demo exam in progress, reload questions in new language
+        // If demo exam in progress, restart with fresh random pick in new language.
+        // (Progress is lost because questions are randomly picked from a 30-question pool
+        // and each attempt shuffles option positions — mid-exam translation would
+        // desync the answer key.)
         const state = getExamState();
         if (state && state.session.examId === 'demo-free') {
             try {
-                const { getLocalizedDemoQuestions, getLocalizedDemoSession } = await import('../lib/demo-exam.js');
-                state.questions = getLocalizedDemoQuestions();
+                const { pickDemoQuestions, getLocalizedDemoSession, DEMO_PICK_SIZE } = await import('../lib/demo-exam.js');
+                const freshQuestions = pickDemoQuestions(DEMO_PICK_SIZE);
+                state.questions = freshQuestions;
+                state.answers = {};
                 state.session.examName = getLocalizedDemoSession().examName;
+                state.session.startedAt = new Date().toISOString();
+                state._lastQ = 1;
                 const { saveExamState } = await import('../lib/exam-state.js');
                 saveExamState(state);
-                const currentQ = state._lastQ || 1;
                 console.log();
-                console.log(chalk.green(`  Demo questions reloaded in ${LANG_NAMES[code] || code}.`));
-                console.log(chalk.white(`  Resuming: exam q ${currentQ}`));
+                console.log(chalk.green(`  Demo restarted in ${LANG_NAMES[code] || code}.`));
+                console.log(chalk.white('  Type: exam q 1'));
             }
             catch {
-                console.log(chalk.gray('  Language changed. Resume with: exam q 1'));
+                console.log(chalk.gray('  Language changed. Type: demo'));
             }
         }
         else if (state) {

package/dist/lib/demo-exam.d.ts

@@ -1,18 +1,26 @@
 import type { ExamQuestion, ExamSession } from '../types/index.js';
+export declare const DEMO_POOL_SIZE = 30;
+export declare const DEMO_PICK_SIZE = 10;
 export declare const DEMO_SESSION: ExamSession;
-export declare const DEMO_ANSWERS: Record<number, string>;
+export declare const DEMO_ANSWERS: Record<number, 'A' | 'B' | 'C' | 'D'>;
 export declare const DEMO_EXPLANATIONS: Record<number, string>;
 export declare const DEMO_QUESTIONS: ExamQuestion[];
+/**
+ * Pick `n` random questions from the pool, shuffle each question's options,
+ * renumber 1..n. Returns fully self-contained questions with answer + explanation
+ * populated, so downstream code does not need to look up DEMO_ANSWERS by number.
+ */
+export declare function pickDemoQuestions(n?: number): ExamQuestion[];
 /**
  * Get localized explanations for demo questions.
  * Reads from translations/<lang>/demo-explanations.json.
- * Falls back to English if not available.
+ * Falls back to English for any missing entries.
  */
 export declare function getLocalizedExplanations(): Record<number, string>;
 /**
  * Get demo questions translated to user's language.
  * Reads from translations/<lang>/demo.json (bundled static file).
- * Falls back to English if not available.
+ * Per-question fallback: missing entries use the English source.
  */
 export declare function getLocalizedDemoQuestions(): ExamQuestion[];
 /**

package/dist/lib/demo-exam.js

@@ -3,71 +3,166 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getConfig } from './config.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
+export const DEMO_POOL_SIZE = 30;
+export const DEMO_PICK_SIZE = 10;
 export const DEMO_SESSION = {
     examId: 'demo-free',
     examName: 'ICOA Demo Exam — Free Practice',
     startedAt: '',
-    durationMinutes: 0, // 0 = no time limit for demo
-    questionCount: 15,
+    durationMinutes: 0,
+    questionCount: DEMO_PICK_SIZE,
     country: 'ALL',
 };
+// Answer key for the 30-question pool (balanced A=7 B=7 C=8 D=8)
+// Q16-30 option order was rebalanced from translate-demo.js to distribute answers.
 export const DEMO_ANSWERS = {
-    1: 'C', 2: 'A', 3: 'D', 4: 'B', 5: 'A', 6: 'D', 7: 'C', 8: 'B',
-    9: 'A', 10: 'D', 11: 'C', 12: 'B', 13: 'A', 14: 'C', 15: 'D',
+    1: 'C', 2: 'B', 3: 'C', 4: 'B', 5: 'C', 6: 'B', 7: 'B', 8: 'C',
+    9: 'C', 10: 'B', 11: 'C', 12: 'B', 13: 'B', 14: 'B', 15: 'B',
+    16: 'D', 17: 'D', 18: 'C', 19: 'C', 20: 'B', 21: 'A', 22: 'D', 23: 'C',
+    24: 'B', 25: 'A', 26: 'B', 27: 'D', 28: 'C', 29: 'A', 30: 'B',
 };
 export const DEMO_EXPLANATIONS = {
     1: 'RSA is an asymmetric (public-key) cipher. AES, DES, and Blowfish are all symmetric ciphers that use the same key for encryption and decryption.',
     2: 'SQL injection occurs when user input is inserted directly into database queries without proper sanitization, allowing attackers to manipulate the query.',
     3: 'HTTP 403 means Forbidden — the server understood the request but refuses to authorize it. 401 is Unauthorized, 404 is Not Found, 500 is Internal Server Error.',
-    4: 'Wireshark is the standard tool for capturing and analyzing network packets. Burp Suite is for web testing, John the Ripper for password cracking, Ghidra for reverse engineering.',
-    5: 'XSS stands for Cross-Site Scripting — a vulnerability where attackers inject malicious scripts into web pages viewed by other users.',
-    6: 'A Trojan disguises itself as legitimate software to trick users into installing it. Unlike worms, Trojans do not self-replicate.',
-    7: 'SSH (Secure Shell) runs on port 22 by default. Port 21 is FTP, 80 is HTTP, 443 is HTTPS.',
-    8: 'A cryptographic hash is a one-way function that produces a fixed-size digest. It cannot be reversed, unlike encryption.',
-    9: 'Two-factor authentication (2FA) requires two distinct types of credentials — something you know (password) and something you have (phone/token) or are (biometrics).',
-    10: 'The command "netstat -tulpn" shows all listening TCP/UDP ports with process info. "ls -la" lists files, "chmod" changes permissions, "cat /etc/passwd" shows user accounts.',
-    11: 'A Man-in-the-Middle attack intercepts and potentially modifies communications between two parties who believe they are communicating directly with each other.',
-    12: 'The principle of least privilege means granting users only the minimum permissions necessary to perform their tasks, reducing the attack surface.',
-    13: 'Phishing is a social engineering attack that tricks people into revealing sensitive information. Buffer overflow, SQL injection, and port scanning are technical attacks.',
-    14: 'A VPN (Virtual Private Network) creates an encrypted tunnel for internet traffic, protecting data from interception and masking the user\'s IP address.',
-    15: 'Passwords should be stored as salted hashes. Plain text and Base64 are insecure. AES encryption is reversible if the key is compromised, but hashing with salt is one-way.',
+    4: 'A nonce (number used once) is a random value used in cryptographic protocols to prevent replay attacks — ensuring each request or message is unique and cannot be reused by an attacker.',
+    5: 'Wireshark is the standard tool for capturing and analyzing network packets. Burp Suite is for web testing, John the Ripper for password cracking, Ghidra for reverse engineering.',
+    6: 'XSS stands for Cross-Site Scripting — a vulnerability where attackers inject malicious scripts into web pages viewed by other users.',
+    7: 'A firewall filters network traffic based on security rules, blocking unauthorized access while allowing legitimate communication. It does not encrypt, scan for viruses, or speed up connections.',
+    8: 'A Trojan disguises itself as legitimate software to trick users into installing it. Unlike worms, Trojans do not self-replicate.',
+    9: 'HTTPS (HTTP Secure) uses TLS/SSL to encrypt web traffic, protecting data from eavesdropping and tampering. HTTP, FTP, and SMTP are not secure by default.',
+    10: 'A cryptographic hash is a one-way function that produces a fixed-size digest. It cannot be reversed, unlike encryption.',
+    11: 'Ghidra is a reverse engineering and binary analysis tool developed by the NSA. Nmap scans ports, SQLMap tests SQL injection, Nikto scans web servers.',
+    12: 'DNS Spoofing (cache poisoning) manipulates DNS responses to redirect victims to attacker-controlled servers. It is distinct from phishing, SQLi, and brute force.',
+    13: 'SSH (Secure Shell) runs on port 22 by default. Port 21 is FTP, 80 is HTTP, 443 is HTTPS.',
+    14: 'Two-factor authentication (2FA) requires two distinct types of credentials — something you know (password) and something you have (phone/token) or are (biometrics).',
+    15: 'The command "netstat -tulpn" shows all listening TCP/UDP ports with process info. "ls -la" lists files, "chmod" changes permissions, "cat /etc/passwd" shows user accounts.',
+    16: 'A Man-in-the-Middle (MitM) attack intercepts and potentially modifies communications between two parties who believe they are communicating directly with each other.',
+    17: 'SHA-256 is a cryptographic hash function. AES-256 is a symmetric cipher, RSA-2048 is an asymmetric cipher, and Diffie-Hellman is a key exchange protocol.',
+    18: 'The principle of least privilege means granting users only the minimum permissions necessary to perform their tasks, reducing the attack surface.',
+    19: 'Nmap is the standard port scanning tool. Wireshark captures packets, Metasploit is an exploitation framework, and Hashcat is a password cracker.',
+    20: 'Ransomware encrypts the victim\'s files and demands payment (usually cryptocurrency) in exchange for the decryption key.',
+    21: 'Symmetric encryption uses a single shared key for both encrypting and decrypting. Asymmetric encryption uses a key pair — a public key to encrypt and a private key to decrypt.',
+    22: 'Remote Code Execution (RCE) allows an attacker to run arbitrary code on a target server, often leading to full system compromise. CSRF, clickjacking, and open redirect have different impacts.',
+    23: 'OWASP (Open Web Application Security Project) is a non-profit organization that publishes widely-used web security standards and guides, including the OWASP Top 10.',
+    24: 'The chmod command changes file permissions in Linux. chown changes ownership, chgrp changes group, and passwd changes user passwords.',
+    25: 'An SSL/TLS certificate is a digital document issued by a trusted Certificate Authority that verifies a website\'s identity and enables encrypted HTTPS connections.',
+    26: 'Phishing is a social engineering attack that tricks people into revealing sensitive information. Buffer overflow, SQL injection, and port scanning are technical attacks.',
+    27: 'The grep command searches for text patterns in files using regular expressions. It is one of the most commonly used Linux text processing tools.',
+    28: 'A VPN (Virtual Private Network) creates an encrypted tunnel for internet traffic, protecting data from interception and masking the user\'s IP address.',
+    29: 'CSRF (Cross-Site Request Forgery) tricks a logged-in user\'s browser into performing unwanted actions on a trusted site, such as changing account settings or transferring funds.',
+    30: 'Passwords should be stored as salted cryptographic hashes. Plain text and Base64 are insecure, and AES encryption is reversible if the key is compromised. Salted hashing is one-way and resistant to rainbow tables.',
 };
+// 30-question pool. Q16-30 options were rebalanced from the original translate-demo.js layout
+// to achieve an even answer distribution across A/B/C/D.
+// Translation files (translations/<lang>/demo.json) must match this option order.
 export const DEMO_QUESTIONS = [
     { number: 1, text: 'Which algorithm is NOT a symmetric cipher?', category: 'Cryptography',
-        options: { A: 'AES', B: 'DES', C: 'RSA', D: 'Blowfish' } },
+        options: { A: 'AES', B: 'RSA', C: 'DES', D: 'Blowfish' } },
     { number: 2, text: 'What does SQL injection exploit?', category: 'Web Security',
-        options: { A: 'Unsanitized user input in database queries', B: 'Buffer overflow in web server', C: 'Misconfigured firewall rules', D: 'Weak encryption algorithms' } },
+        options: { A: 'Buffer overflow in web server', B: 'Unsanitized user input in database queries', C: 'Weak encryption algorithms', D: 'Misconfigured firewall rules' } },
     { number: 3, text: 'Which HTTP status code indicates "Forbidden"?', category: 'Web Security',
-        options: { A: '401', B: '404', C: '500', D: '403' } },
-    { number: 4, text: 'Which tool is commonly used for network packet capture?', category: 'Network',
-        options: { A: 'Burp Suite', B: 'Wireshark', C: 'John the Ripper', D: 'Ghidra' } },
-    { number: 5, text: 'What does XSS stand for in cybersecurity?', category: 'Web Security',
-        options: { A: 'Cross-Site Scripting', B: 'Extended Security System', C: 'XML Secure Socket', D: 'Cross-Server Sharing' } },
-    { number: 6, text: 'Which type of malware disguises itself as legitimate software?', category: 'Malware',
-        options: { A: 'Worm', B: 'Ransomware', C: 'Adware', D: 'Trojan' } },
-    { number: 7, text: 'What is the standard port for SSH?', category: 'Network',
-        options: { A: '21', B: '80', C: '22', D: '443' } },
-    { number: 8, text: 'What is a cryptographic hash?', category: 'Cryptography',
+        options: { A: '401', B: '404', C: '403', D: '500' } },
+    { number: 4, text: 'What is the primary purpose of a nonce in cryptography?', category: 'Cryptography',
+        options: { A: 'Encrypt data at rest', B: 'Prevent replay attacks', C: 'Generate random passwords', D: 'Compress data before encryption' } },
+    { number: 5, text: 'Which tool is commonly used for network packet capture?', category: 'Network',
+        options: { A: 'Burp Suite', B: 'Ghidra', C: 'Wireshark', D: 'John the Ripper' } },
+    { number: 6, text: 'What does XSS stand for in cybersecurity?', category: 'Web Security',
+        options: { A: 'Extended Security System', B: 'Cross-Site Scripting', C: 'XML Secure Socket', D: 'Cross-Server Sharing' } },
+    { number: 7, text: 'What is the primary function of a firewall?', category: 'Network',
+        options: { A: 'Encrypt network data', B: 'Filter network traffic based on security rules', C: 'Detect viruses in files', D: 'Speed up internet connection' } },
+    { number: 8, text: 'Which type of malware disguises itself as legitimate software?', category: 'Malware',
+        options: { A: 'Worm', B: 'Ransomware', C: 'Trojan', D: 'Adware' } },
+    { number: 9, text: 'Which protocol provides secure communication on the web?', category: 'Network',
+        options: { A: 'HTTP', B: 'FTP', C: 'HTTPS', D: 'SMTP' } },
+    { number: 10, text: 'What is a cryptographic hash?', category: 'Cryptography',
         options: { A: 'A reversible encryption key', B: 'A one-way function producing a fixed-size digest', C: 'An authentication protocol', D: 'A type of digital signature' } },
-    { number: 9, text: 'What is two-factor authentication (2FA)?', category: 'Authentication',
-        options: { A: 'Verifying identity with two distinct types of credentials', B: 'Using two different passwords', C: 'Encrypting data twice', D: 'Connecting through two networks' } },
-    { number: 10, text: 'Which Linux command shows open ports on a system?', category: 'Linux',
-        options: { A: 'ls -la', B: 'chmod 777', C: 'cat /etc/passwd', D: 'netstat -tulpn' } },
-    { number: 11, text: 'What is a Man-in-the-Middle (MitM) attack?', category: 'Network',
-        options: { A: 'Accessing a server without authorization', B: 'Guessing passwords by brute force', C: 'Intercepting and modifying communications between two parties', D: 'Sending multiple requests to overload a server' } },
-    { number: 12, text: 'What is the principle of least privilege?', category: 'Security',
-        options: { A: 'Give root access to all users', B: 'Grant only the permissions necessary to perform a task', C: 'Use the shortest password possible', D: 'Disable all firewalls' } },
-    { number: 13, text: 'Which of the following is a social engineering attack?', category: 'Security',
-        options: { A: 'Phishing', B: 'Buffer overflow', C: 'SQL Injection', D: 'Port scanning' } },
-    { number: 14, text: 'What is a VPN?', category: 'Network',
+    { number: 11, text: 'Which tool is used for binary analysis?', category: 'Reverse Engineering',
+        options: { A: 'Nmap', B: 'SQLMap', C: 'Ghidra', D: 'Nikto' } },
+    { number: 12, text: 'Which attack manipulates DNS requests to redirect traffic?', category: 'Network',
+        options: { A: 'Phishing', B: 'DNS Spoofing', C: 'SQL Injection', D: 'Brute Force' } },
+    { number: 13, text: 'What is the standard port for SSH?', category: 'Network',
+        options: { A: '21', B: '22', C: '80', D: '443' } },
+    { number: 14, text: 'What is two-factor authentication (2FA)?', category: 'Authentication',
+        options: { A: 'Using two different passwords', B: 'Verifying identity with two distinct types of credentials', C: 'Encrypting data twice', D: 'Connecting through two networks' } },
+    { number: 15, text: 'Which Linux command shows open ports on a system?', category: 'Linux',
+        options: { A: 'ls -la', B: 'netstat -tulpn', C: 'chmod 777', D: 'cat /etc/passwd' } },
+    { number: 16, text: 'What is a Man-in-the-Middle (MitM) attack?', category: 'Network',
+        options: { A: 'Accessing a server without authorization', B: 'Guessing passwords by brute force', C: 'Sending multiple requests to overload a server', D: 'Intercepting and modifying communications between two parties' } },
+    { number: 17, text: 'Which of these is a hash algorithm?', category: 'Cryptography',
+        options: { A: 'AES-256', B: 'Diffie-Hellman', C: 'RSA-2048', D: 'SHA-256' } },
+    { number: 18, text: 'What is the principle of least privilege?', category: 'Security',
+        options: { A: 'Give root access to all users', B: 'Use the shortest password possible', C: 'Grant only the permissions necessary to perform a task', D: 'Disable all firewalls' } },
+    { number: 19, text: 'Which tool is commonly used for port scanning?', category: 'Network',
+        options: { A: 'Wireshark', B: 'Metasploit', C: 'Nmap', D: 'Hashcat' } },
+    { number: 20, text: 'What is ransomware?', category: 'Malware',
+        options: { A: 'Software that shows unwanted ads', B: 'Software that encrypts files and demands payment to decrypt', C: 'Software that records keystrokes', D: 'Software that replicates across networks' } },
+    { number: 21, text: 'What is the difference between symmetric and asymmetric encryption?', category: 'Cryptography',
+        options: { A: 'Symmetric uses the same key to encrypt and decrypt; asymmetric uses two different keys', B: 'Symmetric is slower than asymmetric', C: 'Asymmetric only works with small files', D: 'There is no significant difference' } },
+    { number: 22, text: 'Which vulnerability allows arbitrary code execution on a web server?', category: 'Web Security',
+        options: { A: 'CSRF', B: 'Open Redirect', C: 'Clickjacking', D: 'Remote Code Execution (RCE)' } },
+    { number: 23, text: 'What is OWASP?', category: 'Security',
+        options: { A: 'A security operating system', B: 'A type of firewall', C: 'An organization that publishes web security standards and guides', D: 'A programming language for security' } },
+    { number: 24, text: 'Which Linux command changes file permissions?', category: 'Linux',
+        options: { A: 'chown', B: 'chmod', C: 'chgrp', D: 'passwd' } },
+    { number: 25, text: 'What is an SSL/TLS certificate?', category: 'Cryptography',
+        options: { A: 'A digital document that verifies a website identity', B: 'A file containing malware', C: 'A private key for SSH', D: 'A type of encrypted database' } },
+    { number: 26, text: 'Which of the following is a social engineering attack?', category: 'Security',
+        options: { A: 'Buffer overflow', B: 'Phishing', C: 'SQL Injection', D: 'Port scanning' } },
+    { number: 27, text: 'What does the Linux command "grep" do?', category: 'Linux',
+        options: { A: 'Compresses files', B: 'Configures the network', C: 'Shows active processes', D: 'Searches for text patterns in files' } },
+    { number: 28, text: 'What is a VPN?', category: 'Network',
         options: { A: 'A type of virus', B: 'A file transfer protocol', C: 'A virtual private network that encrypts internet traffic', D: 'A vulnerability scanner' } },
-    { number: 15, text: 'What is the best practice for storing passwords in a database?', category: 'Security',
-        options: { A: 'Plain text', B: 'Encrypted with AES', C: 'Encoded in Base64', D: 'Hashed with salt' } },
+    { number: 29, text: 'What is CSRF (Cross-Site Request Forgery)?', category: 'Web Security',
+        options: { A: 'An attack that forces a user browser to perform unauthorized actions', B: 'A data encryption method', C: 'A type of network scanner', D: 'A file compression technique' } },
+    { number: 30, text: 'What is the best practice for storing passwords in a database?', category: 'Security',
+        options: { A: 'Plain text', B: 'Hashed with salt', C: 'Encrypted with AES', D: 'Encoded in Base64' } },
 ];
+/** Fisher-Yates shuffle, returns a new array. */
+function shuffle(arr) {
+    const out = [...arr];
+    for (let i = out.length - 1; i > 0; i--) {
+        const j = Math.floor(Math.random() * (i + 1));
+        [out[i], out[j]] = [out[j], out[i]];
+    }
+    return out;
+}
+/** Shuffle the four options within a single question; recompute the answer letter. */
+function shuffleQuestionOptions(q) {
+    if (!q.answer)
+        return q;
+    const correctText = q.options[q.answer];
+    const keys = ['A', 'B', 'C', 'D'];
+    const values = shuffle(keys.map((k) => q.options[k]));
+    const newOptions = { A: values[0], B: values[1], C: values[2], D: values[3] };
+    const newAnswer = keys.find((k) => newOptions[k] === correctText);
+    return { ...q, options: newOptions, answer: newAnswer };
+}
+/**
+ * Pick `n` random questions from the pool, shuffle each question's options,
+ * renumber 1..n. Returns fully self-contained questions with answer + explanation
+ * populated, so downstream code does not need to look up DEMO_ANSWERS by number.
+ */
+export function pickDemoQuestions(n = DEMO_PICK_SIZE) {
+    const translatedPool = getLocalizedDemoQuestions();
+    const explanations = getLocalizedExplanations();
+    // Enrich pool with answer + explanation keyed by ORIGINAL number
+    const enriched = translatedPool.map((q) => ({
+        ...q,
+        answer: DEMO_ANSWERS[q.number],
+        explanation: explanations[q.number],
+    }));
+    // Shuffle pool, pick n, shuffle each question's options, renumber 1..n
+    const picked = shuffle(enriched).slice(0, n);
+    return picked.map((q, i) => ({
+        ...shuffleQuestionOptions(q),
+        number: i + 1,
+    }));
+}
 /**
  * Get localized explanations for demo questions.
  * Reads from translations/<lang>/demo-explanations.json.
- * Falls back to English if not available.
+ * Falls back to English for any missing entries.
  */
 export function getLocalizedExplanations() {
     const lang = getConfig().language;
@@ -78,8 +173,10 @@ export function getLocalizedExplanations() {
         return DEMO_EXPLANATIONS;
     try {
         const data = JSON.parse(readFileSync(path, 'utf-8'));
-        if (data && typeof data === 'object')
-            return data;
+        if (data && typeof data === 'object') {
+            // Merge: translated entries override English, missing entries stay English
+            return { ...DEMO_EXPLANATIONS, ...data };
+        }
     }
     catch { }
     return DEMO_EXPLANATIONS;
@@ -87,7 +184,7 @@ export function getLocalizedExplanations() {
 /**
  * Get demo questions translated to user's language.
  * Reads from translations/<lang>/demo.json (bundled static file).
- * Falls back to English if not available.
+ * Per-question fallback: missing entries use the English source.
  */
 export function getLocalizedDemoQuestions() {
     const lang = getConfig().language;
@@ -98,8 +195,13 @@ export function getLocalizedDemoQuestions() {
         return DEMO_QUESTIONS;
     try {
         const data = JSON.parse(readFileSync(path, 'utf-8'));
-        if (Array.isArray(data) && data.length >= DEMO_QUESTIONS.length)
-            return data;
+        if (!Array.isArray(data))
+            return DEMO_QUESTIONS;
+        // Per-question merge: use translated where available, English fallback otherwise.
+        return DEMO_QUESTIONS.map((eng) => {
+            const tr = data.find((d) => d.number === eng.number);
+            return tr && tr.options ? tr : eng;
+        });
     }
     catch { }
     return DEMO_QUESTIONS;

package/dist/repl.js

@@ -56,53 +56,47 @@ export async function startRepl(program, resumeMode) {
             default: savedMode || 'selection',
         });
         if (selected === 'about') {
+            console.clear();
             console.log();
             console.log(chalk.cyan('  ═══════════════════════════════════════════════════'));
-            console.log();
-            console.log(chalk.bold.white('   ██╗ ██████╗ ██████╗  █████╗'));
-            console.log(chalk.bold.white('   ██║██╔════╝██╔═══██╗██╔══██╗'));
-            console.log(chalk.bold.white('   ██║██║     ██║   ██║███████║'));
-            console.log(chalk.bold.white('   ██║██║     ██║   ██║██╔══██║'));
-            console.log(chalk.bold.white('   ██║╚██████╗╚██████╔╝██║  ██║'));
-            console.log(chalk.bold.white('   ╚═╝ ╚═════╝ ╚═════╝ ╚═╝  ╚═╝'));
-            console.log();
-            console.log(chalk.bold.yellow('   The World\'s First'));
-            console.log(chalk.bold.white('   AI-Native CLI Operating System for'));
-            console.log(chalk.bold.white('   Cybersecurity & AI Security Competition'));
-            console.log(chalk.bold.white('   and Olympiad for K-12'));
-            console.log();
-            console.log(chalk.white('   One terminal. 15 languages. 15,000 concurrent participants.'));
-            console.log(chalk.white('   109 pre-configured CTF tools. Zero browser required.'));
-            console.log();
-            console.log(chalk.cyan('  ─────────────────────────────────────────────────'));
+            console.log(chalk.bold.yellow('   ICOA') + chalk.white(' — AI-Native CLI OS for Cyber & AI Security'));
+            console.log(chalk.gray('   Olympiad & Competition  ·  K-12 to University'));
+            console.log(chalk.cyan('  ───────────────────────────────────────────────────'));
             console.log();
             console.log(chalk.bold.white('   What Makes ICOA Different'));
             console.log(chalk.gray('   · AI-native     AI teammate, AI adversary, AI translation'));
             console.log(chalk.gray('   · CLI OS        Complete competition environment in terminal'));
             console.log(chalk.gray('   · 109 tools     pwntools, z3, gdb, nmap... pre-configured'));
-            console.log(chalk.gray('   · Global scale  15,000+ concurrent exams, single server'));
-            console.log(chalk.gray('   · 15 languages  Real-time AI translation for all content'));
+            console.log(chalk.gray('   · Global scale  15,000+ concurrent exams · 15 languages'));
             console.log();
             console.log(chalk.bold.white('   Competition Format'));
-            console.log(chalk.green.bold('   AI4CTF') + chalk.gray(' [Day 1]  AI as your teammate — 5hr jeopardy CTF'));
-            console.log(chalk.red.bold('   CTF4AI') + chalk.gray(' [Day 2]  Challenge & evaluate AI — adversarial ML, red-teaming'));
-            console.log();
-            console.log(chalk.white('   Sydney, Australia') + chalk.gray('  ·  Jun 27 - Jul 2, 2026'));
-            console.log(chalk.gray('   40+ countries and regions represented'));
+            console.log('   ' + chalk.green.bold('AI4CTF') + chalk.gray(' [Day 1]  AI as teammate — 5hr jeopardy CTF'));
+            console.log('   ' + chalk.red.bold('CTF4AI') + chalk.gray(' [Day 2]  Challenge AI — adversarial ML, red-team'));
             console.log();
-            console.log(chalk.cyan('  ─────────────────────────────────────────────────'));
-            console.log();
-            console.log(chalk.bold.white('   Organized by'));
-            console.log(chalk.gray('   ASRA — Australia STEM and Robotics Advancement Association Inc'));
-            console.log(chalk.gray('   ICO Foundation Inc (Australia)'));
-            console.log();
-            console.log(chalk.bold.white('   Contact & Accreditation'));
-            console.log(chalk.cyan('   australia@icoa2026.au'));
-            console.log(chalk.cyan('   accreditation@icoa2026.au'));
-            console.log(chalk.cyan.underline('   https://icoa2026.au'));
+            console.log(chalk.white('   Sydney, Australia') + chalk.gray('  ·  Jun 27 - Jul 2, 2026  ·  40+ countries'));
             console.log();
+            console.log(chalk.bold.white('   Organized by') + chalk.gray('  ASRA (Australia) · ICO Foundation Inc'));
+            console.log(chalk.bold.white('   Contact     ') + chalk.cyan(' australia@icoa2026.au  ·  accreditation@icoa2026.au'));
+            console.log(chalk.bold.white('   Website     ') + chalk.cyan.underline(' https://icoa2026.au'));
             console.log(chalk.cyan('  ═══════════════════════════════════════════════════'));
             console.log();
+            console.log(chalk.gray('   Press ') + chalk.yellow('Enter') + chalk.gray(' to return...'));
+            await new Promise((resolve) => {
+                const onKey = (_chunk) => {
+                    process.stdin.removeListener('data', onKey);
+                    if (process.stdin.isTTY && process.stdin.setRawMode) {
+                        process.stdin.setRawMode(false);
+                    }
+                    process.stdin.pause();
+                    resolve();
+                };
+                if (process.stdin.isTTY && process.stdin.setRawMode) {
+                    process.stdin.setRawMode(true);
+                }
+                process.stdin.resume();
+                process.stdin.once('data', onKey);
+            });
+            console.clear();
             // Loop back to mode selection
             continue;
         }

package/dist/types/index.d.ts

@@ -149,6 +149,8 @@ export interface ExamQuestion {
         C: string;
         D: string;
     };
+    answer?: 'A' | 'B' | 'C' | 'D';
+    explanation?: string;
 }
 export interface ExamSession {
     examId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.19.17",
+  "version": "2.19.19",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {