icoa-cli 2.19.290 → 2.19.292

package/dist/lib/exam-sandbox.d.ts

@@ -1,5 +1,10 @@
 export declare function scanForAIBinaries(): string[];
 export declare function checkShellRisk(input: string): string[];
+export declare function auditIdentity(): {
+    account?: string;
+    examToken?: string;
+    deviceFingerprint?: string;
+};
 export declare function logShellAudit(entry: {
     cwd: string;
     input: string;

package/dist/lib/exam-sandbox.js

@@ -1 +1 @@
-import{mkdtempSync as t,mkdirSync as e,existsSync as o,appendFileSync as s,statSync as r}from"node:fs";import{execFileSync as i}from"node:child_process";import{tmpdir as n,homedir as a,platform as c}from"node:os";import{join as p,delimiter as l}from"node:path";import{getIcoaDir as h}from"./config.js";import{getRealExamState as d}from"./exam-state.js";const m=["claude","cursor-agent","aider","codex","ollama","llm","cody","continue","windsurf","mods","gemini","q"];function u(t){const e=process.env.PATH||"",o="win32"===c()?(process.env.PATHEXT||".EXE;.CMD;.BAT").split(";"):[""];for(const s of e.split(l))if(s)for(const e of o){const o=p(s,t+e);try{if(r(o).isFile())return!0}catch{}}return!1}export function scanForAIBinaries(){const t=[];for(const e of m)u(e)&&t.push(e);if(u("gh"))try{const e=i("gh",["extension","list"],{encoding:"utf-8",timeout:2e3,stdio:["ignore","pipe","ignore"]});/copilot/i.test(e)&&t.push("gh-copilot")}catch{}return t}const f=[{pattern:/(?:^|[\s|;&`$(])(?:cat|less|more|head|tail|bat)\s+(?:~|\$HOME|\/home\/[^/\s]+|\/Users\/[^/\s]+)/,label:"reads home directory"},{pattern:/\.bash_history|\.zsh_history|\.fish_history|\.python_history/,label:"reads shell history"},{pattern:/(?:^|[\s|;&`$(])(?:find|grep\s+-[rR]\S*|rg|fd|ack)\s+(?:~|\$HOME|\/home|\/Users)/,label:"searches home directory"},{pattern:/(?:^|[\s|;&`$(])(?:claude|cursor-agent|aider|codex|ollama|llm|cody|continue|windsurf|mods|gemini)\b/,label:"invokes AI agent CLI"},{pattern:/(?:^|[\s|;&`$(])gh\s+copilot\b/,label:"invokes gh copilot"},{pattern:/(?:^|[\s|;&`$(])history\b/,label:"inspects shell history"},{pattern:/(?:^|[\s|;&`$(])cd\s+(?:~|\$HOME|\/home|\/Users|\/etc|\/var)/,label:"cd outside exam workspace"}];export function checkShellRisk(t){const e=[];for(const{pattern:o,label:s}of f)o.test(t)&&e.push(s);return e}export function logShellAudit(t){const e=d();if(!e)return;const o=JSON.stringify({ts:(new Date).toISOString(),examId:e.session.examId,country:e.session.country,cwd:t.cwd,input:t.input.slice(0,500),riskFlags:t.riskFlags});try{s(p(h(),"exam-audit.log"),`${o}\n`)}catch{}fetch("https://practice.icoa2026.au/api/icoa/exam-audit",{method:"POST",headers:{"Content-Type":"application/json"},body:o,signal:AbortSignal.timeout(3e3)}).catch(()=>{})}export function reportAIBinaryDetection(t){if(0===t.length)return;const e=d(),o=JSON.stringify({ts:(new Date).toISOString(),examId:e?.session.examId??"(pre-start)",country:e?.session.country??"(pre-start)",binaries:t,platform:process.platform});fetch("https://practice.icoa2026.au/api/icoa/exam-ai-binaries",{method:"POST",headers:{"Content-Type":"application/json"},body:o,signal:AbortSignal.timeout(3e3)}).catch(()=>{})}export function createExamWorkspace(e){const o=e.replace(/[^a-zA-Z0-9_-]/g,"_").slice(0,32);return t(p(n(),`icoa-exam-${o}-`))}const g=p(a(),"icoa-workspace");export function getActiveCwd(){const t=d(),s=t?.session?.workspaceDir;return s&&o(s)?s:(o(g)||e(g,{recursive:!0}),g)}
+import{mkdtempSync as t,mkdirSync as e,existsSync as o,appendFileSync as s,statSync as i}from"node:fs";import{execFileSync as n}from"node:child_process";import{tmpdir as r,homedir as a,platform as c}from"node:os";import{join as p,delimiter as l}from"node:path";import{getIcoaDir as d,getConfig as h}from"./config.js";import{getRealExamState as u}from"./exam-state.js";const m=["claude","cursor-agent","aider","codex","ollama","llm","cody","continue","windsurf","mods","gemini","q","chatgpt","sgpt","aichat","copilot"];function f(t){const e=process.env.PATH||"",o="win32"===c()?(process.env.PATHEXT||".EXE;.CMD;.BAT").split(";"):[""];for(const s of e.split(l))if(s)for(const e of o){const o=p(s,t+e);try{if(i(o).isFile())return!0}catch{}}return!1}export function scanForAIBinaries(){const t=[];for(const e of m)f(e)&&t.push(e);if(f("gh"))try{const e=n("gh",["extension","list"],{encoding:"utf-8",timeout:2e3,stdio:["ignore","pipe","ignore"]});/copilot/i.test(e)&&t.push("gh-copilot")}catch{}return t}const g=[{pattern:/(?:^|[\s|;&`$(!])(?:cat|less|more|head|tail|bat)\s+(?:~|\$HOME|\/home\/[^/\s]+|\/Users\/[^/\s]+)/,label:"reads home directory"},{pattern:/\.bash_history|\.zsh_history|\.fish_history|\.python_history/,label:"reads shell history"},{pattern:/(?:^|[\s|;&`$(!])(?:find|grep\s+-[rR]\S*|rg|fd|ack)\s+(?:~|\$HOME|\/home|\/Users)/,label:"searches home directory"},{pattern:/(?:^|[\s|;&`$(!])(?:claude|cursor-agent|aider|codex|ollama|llm|cody|continue|windsurf|mods|gemini|chatgpt|sgpt|aichat|copilot)\b/,label:"invokes AI agent CLI"},{pattern:/(?:^|[;&|]\s*)!?\s*q\b/,label:"invokes AI agent CLI"},{pattern:/(?:^|[\s|;&`$(!])gh\s+copilot\b/,label:"invokes gh copilot"},{pattern:/(?:^|[\s|;&`$(!])history\b/,label:"inspects shell history"},{pattern:/(?:^|[\s|;&`$(!])cd\s+(?:~|\$HOME|\/home|\/Users|\/etc|\/var)/,label:"cd outside exam workspace"}];export function checkShellRisk(t){const e=[];for(const{pattern:o,label:s}of g)o.test(t)&&e.push(s);return e}export function auditIdentity(){const t={},e=h();e.deviceFingerprint&&(t.deviceFingerprint=e.deviceFingerprint);const o=u();return o?.session?.token?t.examToken=o.session.token:e.ctfdUrl&&e.token&&e.userName&&(t.account=e.userName),t}export function logShellAudit(t){const e=u();if(!e)return;const o=JSON.stringify({ts:(new Date).toISOString(),examId:e.session.examId,country:e.session.country,...auditIdentity(),cwd:t.cwd,input:t.input.slice(0,500),riskFlags:t.riskFlags});try{s(p(d(),"exam-audit.log"),`${o}\n`)}catch{}fetch("https://practice.icoa2026.au/api/icoa/exam-audit",{method:"POST",headers:{"Content-Type":"application/json"},body:o,signal:AbortSignal.timeout(3e3)}).catch(()=>{})}export function reportAIBinaryDetection(t){if(0===t.length)return;const e=u(),o=JSON.stringify({ts:(new Date).toISOString(),examId:e?.session.examId??"(pre-start)",country:e?.session.country??"(pre-start)",...auditIdentity(),binaries:t,platform:process.platform});fetch("https://practice.icoa2026.au/api/icoa/exam-ai-binaries",{method:"POST",headers:{"Content-Type":"application/json"},body:o,signal:AbortSignal.timeout(3e3)}).catch(()=>{})}export function createExamWorkspace(e){const o=e.replace(/[^a-zA-Z0-9_-]/g,"_").slice(0,32);return t(p(r(),`icoa-exam-${o}-`))}const y=p(a(),"icoa-workspace");export function getActiveCwd(){const t=u(),s=t?.session?.workspaceDir;return s&&o(s)?s:(o(y)||e(y,{recursive:!0}),y)}

package/dist/lib/hint-client.js

@@ -1 +1 @@
-(function(a,b){const v=a0b,c=a();while(!![]){try{const d=parseInt(v(0x13a))/(0xf5e+0x107a+-0x1fd7)*(-parseInt(v(0x154))/(-0x4fa*0x3+0x1*-0x2689+-0x41d*-0xd))+-parseInt(v(0x144))/(-0x1869+0xbd*0x19+-0x5f7*-0x1)+parseInt(v(0x14b))/(0x1f06+-0x5*-0x5b1+-0x3b77)+-parseInt(v(0x14e))/(0x511*-0x4+-0x1*0x16c5+0x2b0e)*(-parseInt(v(0x137))/(0x1*-0x226d+-0x1a02+0x3c75))+-parseInt(v(0x138))/(-0x1508+0x2222+-0xd13)*(parseInt(v(0x139))/(0x2169+-0x11ab*-0x2+-0x44b7))+parseInt(v(0x14d))/(-0x147*0x7+0x2395+0x7*-0x3cd)*(-parseInt(v(0x13f))/(-0x6c6+-0x715+0xde5))+parseInt(v(0x157))/(-0x1c43+0x1*0x9d6+-0xc5*-0x18);if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a0a,-0x1*0x1140e7+-0x4*-0x14881+0x159967));import{getConfig as a0c}from'./config.js';function a0a(){const x=['AgLUDcbbueKGDw5YzwfJAgfIBgu','BMv0D29YAYbLCNjVCG','mte4odK0nvnjDevJra','yxbWBgLJyxrPB24VANnVBG','y2f0y2G','AgLUDcbYzxf1zxn0igzHAwXLzcaO','BwvZC2fNzq','l2fWAs9Py29Hl2v4yw1ZlW','y3rMzfvYBa','nduWntC2mgfTz2PIsG','B2jQzwn0','oujmwKTwtW','mZqWnwfrz2r3sa','DgLTzw91Da','C3vJy2vZCW','AwnVys1JBgK','Ahr0Chm6lY9WCMfJDgLJzs5Py29HmJaYnI5HDq','C3rHDhvZ','mtm1nfzcDwzzrG','ANnVBG','BgfUz3vHz2u','mJmYmZqYntv6v3zwzg8','oJKWotaVyxbPl2LJB2eVzxHHBxmV','l2HPBNq','BgfUzW','zxHHBuLK','mJK2ngHqAMXiqW','mJfOD2rZDei','mZi2mZm3nNH6q2fOEa','mte2n2P0tvPwrW','Bgv2zwW','ue9tva','zgf0yq','C3rYAw5NAwz5','ntqZnZmXmg5JB3ziqq','CxvLC3rPB24','Dg9Rzw4'];a0a=function(){return x;};return a0a();}function a0b(a,b){a=a-(-0x1623*-0x1+0xfdb+0x5*-0x75b);const c=a0a();let d=c[a];if(a0b['AdRpJN']===undefined){var e=function(i){const j='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let l='',m='';for(let n=0x349+0x6*-0x19c+0x65f,o,p,q=-0xf*-0x49+-0x20b1+-0x1c6a*-0x1;p=i['charAt'](q++);~p&&(o=n%(0xf54+0x18d1+0x2821*-0x1)?o*(-0x1*0x1ad9+0x1536+0x5e3)+p:p,n++%(-0x10a*0x1f+-0x658+0x2*0x1349))?l+=String['fromCharCode'](0x267b*-0x1+-0x1119+0x3893&o>>(-(-0x3*-0x8b3+0x1*-0x13b8+-0x65f)*n&0x1956*-0x1+0x5*-0x203+0x1*0x236b)):0x1*-0x8aa+0x1d*-0x113+0x27d1){p=j['indexOf'](p);}for(let r=-0x6af*-0x1+-0x22f4+0x1c45,s=l['length'];r<s;r++){m+='%'+('00'+l['charCodeAt'](r)['toString'](-0x1894*0x1+-0x1dc*0x14+0x3dd4))['slice'](-(-0x5c1+-0x5d5*-0x2+-0x5e7));}return decodeURIComponent(m);};a0b['ofkJac']=e,a0b['MKCUeg']={},a0b['AdRpJN']=!![];}const f=c[0xb49+0x45a+-0xfa3],g=a+f,h=a0b['MKCUeg'][g];return!h?(d=a0b['ofkJac'](d),a0b['MKCUeg'][g]=d):d=h,d;}export async function requestHint(d){const w=a0b,f=a0c(),g=f[w(0x14a)]||w(0x152),h=d[w(0x15a)]||f[w(0x156)]||'en',j=d['timeoutMs']??0x7*-0x235+-0xe82+-0x3d35*-0x1,k=[g+w(0x149)+d[w(0x15b)]+w(0x159),g+w(0x158)+d[w(0x15b)]+'/hint'];let l=null;for(const p of k)try{const q=await fetch(p,{'method':w(0x13c),'headers':{'Content-Type':w(0x145),'User-Agent':w(0x151)},'body':JSON[w(0x13e)]({'token':d[w(0x141)],'question':d[w(0x140)],'level':d[w(0x13b)],'lang':h}),'signal':AbortSignal[w(0x14f)](j)}),r=await q[w(0x155)]()[w(0x146)](()=>({}));if(!q['ok']||!(0x229b+-0x116a*0x1+0xb0*-0x19)===r[w(0x150)]){if(l={'status':q[w(0x153)],'message':r?.[w(0x148)]||w(0x147)+q[w(0x153)]+')'},q[w(0x153)]>=0x3d7*-0x5+-0x22ea+0x3*0x128f&&q['status']<-0x3dd+-0x5d3+0xba4)throw l;continue;}return r[w(0x13d)];}catch(u){if(u&&w(0x14c)==typeof u&&'status'in u)throw u;l={'status':0x0,'message':u?.[w(0x148)]||w(0x143)};}const m={};m['status']=0x0,m['message']=w(0x142);throw l||m;}
+function a0b(a,b){a=a-(0xa*0xa4+-0xf5e+0xab8);const c=a0a();let d=c[a];if(a0b['iWmoDR']===undefined){var e=function(i){const j='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let l='',m='';for(let n=0x1bef+0x1f7f+-0x3b6e,o,p,q=-0x1b7*-0x2+-0x1795+0x1427;p=i['charAt'](q++);~p&&(o=n%(-0x23*-0x97+-0x20c4+0xc23)?o*(-0x1*-0x589+0x20c3+0x14*-0x1e7)+p:p,n++%(0xee*0x5+0x1ad4+-0xfbb*0x2))?l+=String['fromCharCode'](0xe12+0xc37*0x1+-0x194a&o>>(-(0xa*0xe5+0x3*-0x15f+0x13*-0x41)*n&0x9*-0x11f+-0x1*0x250c+0x2f29*0x1)):-0x1ceb+-0x26e2+0x43cd){p=j['indexOf'](p);}for(let r=0x1a50+0x1766+-0x31b6,s=l['length'];r<s;r++){m+='%'+('00'+l['charCodeAt'](r)['toString'](0x1621+0x1279*0x1+-0x288a))['slice'](-(-0x2b*0xdf+0x1bc1+0x9b6));}return decodeURIComponent(m);};a0b['LVkkUk']=e,a0b['ZStksS']={},a0b['iWmoDR']=!![];}const f=c[-0x15d*0x2+0x20d6+-0x1e1c],g=a+f,h=a0b['ZStksS'][g];return!h?(d=a0b['LVkkUk'](d),a0b['ZStksS'][g]=d):d=h,d;}(function(a,b){const v=a0b,c=a();while(!![]){try{const d=-parseInt(v(0x1d3))/(-0x191e*0x1+0x16*0x1b7+0x7*-0x1cd)+-parseInt(v(0x1c9))/(-0x1d4f+0x15e6+0x76b)*(-parseInt(v(0x1db))/(-0x1987+-0xe5+0x65*0x43))+parseInt(v(0x1df))/(-0x5f*0x11+-0x1cf7*-0x1+-0x16a4)*(parseInt(v(0x1c8))/(-0x1745+0x3*0x719+0x1ff))+parseInt(v(0x1de))/(-0x5*-0x3b+0x97*0x3a+-0x53*0x6d)*(-parseInt(v(0x1c2))/(-0x106*-0x4+-0xd3*-0x7+-0x9d6))+parseInt(v(0x1d7))/(-0x1a76+0x208f+-0x611)*(parseInt(v(0x1d6))/(0x20*0x68+0xa39*0x3+-0x2ba2))+parseInt(v(0x1d9))/(0x1909+0x1e50+-0x374f)+-parseInt(v(0x1cf))/(-0x1*-0xc04+0x1b0b+-0x2704);if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a0a,-0x5b*0x3465+0xc743b+0x10*0x12547));function a0a(){const x=['mtKYtg1JyMX5','ndbHt1PMyLm','mtq5mJi2zvvzwuLW','ANnVBG','Ahr0Chm6lY9WCMfJDgLJzs5Py29HmJaYnI5HDq','zxHHBuLK','DgLTzw91De1Z','ue9tva','mJq5mtCWvhfQANLw','mMDHEgH6uG','AwnVys1JBgK','CxvLC3rPB24','C3vJy2vZCW','yxbWBgLJyxrPB24VANnVBG','y2f0y2G','mtu4nJa0otntBe1kteG','Bgv2zwW','AgLUDcbbueKGDw5YzwfJAgfIBgu','BgfUz3vHz2u','mta3nJm3mu9it3LntW','DgLTzw91Da','AgLUDcbYzxf1zxn0igzHAwXLzcaO','mte5ndG0uMvOrvjM','odGWqvPVywXX','C3rHDhvZ','mtq2ndu1nZbVzfzKq00','BMv0D29YAYbLCNjVCG','mtCYmJa2m1bWDNfptq','BwvZC2fNzq','l2fWAs9Py29Hl2v4yw1ZlW'];a0a=function(){return x;};return a0a();}import{getConfig as a0c}from'./config.js';export async function requestHint(d){const w=a0b,f=a0c(),g=f['ctfdUrl']||w(0x1c4),h=d['lang']||f[w(0x1d2)]||'en',j=d[w(0x1c6)]??-0xa48+-0xcb*0x25+-0x46df*-0x1,k=[g+w(0x1dd)+d[w(0x1c5)]+'/hint',g+':9090/api/icoa/exams/'+d[w(0x1c5)]+'/hint'];let l=null;for(const p of k)try{const q=await fetch(p,{'method':w(0x1c7),'headers':{'Content-Type':w(0x1cd),'User-Agent':w(0x1ca)},'body':JSON['stringify']({'token':d['token'],'question':d[w(0x1cb)],'level':d[w(0x1d0)],'lang':h}),'signal':AbortSignal[w(0x1d4)](j)}),r=await q[w(0x1c3)]()[w(0x1ce)](()=>({}));if(!q['ok']||!(-0x9b1*0x2+-0x4*0x175+0x1937)===r[w(0x1cc)]){if(l={'status':q[w(0x1d8)],'message':r?.[w(0x1dc)]||w(0x1d5)+q[w(0x1d8)]+')'},q[w(0x1d8)]>=0x16f7*-0x1+0x589+0x12fe&&q[w(0x1d8)]<0x81*0x17+0x1196*0x1+-0x1b39)throw l;continue;}return r['data'];}catch(u){if(u&&'object'==typeof u&&w(0x1d8)in u)throw u;l={'status':0x0,'message':u?.[w(0x1dc)]||w(0x1da)};}const m={};m['status']=0x0,m['message']=w(0x1d1);throw l||m;}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.19.290",
+  "version": "2.19.292",
   "description": "ICOA CLI — The world's first CLI-native cyber & AI security olympiad terminal: AI4CTF (Day 1), CTF4AI (Day 2), VLA4CTF (Pioneer Round — embodied AI)",
   "type": "module",
   "bin": {