icoa-cli 2.19.294 → 2.19.296

package/dist/commands/files.js

@@ -1 +1 @@
-import{join as o}from"node:path";import{homedir as e}from"node:os";import chalk from"chalk";import{CTFdClient as i}from"../lib/ctfd-client.js";import{getConfig as n,isConnected as t}from"../lib/config.js";import{logCommand as l}from"../lib/logger.js";import{printError as s,createSpinner as a}from"../lib/ui.js";export function registerFilesCommand(c){c.command("files <id>").description("Download challenge files").action(async c=>{l(`files ${c}`);const r=n();if(!t())return void s("Not connected. Run: join <url>");const f=r.sessionCookie||"",d=r.token&&!r.token.includes("session=")?r.token:"",g=new i(r.ctfdUrl,d,f||r.token),m=o(e(),"icoa-challenges",c),h=a("Fetching challenge files...");h.start();try{const o=await g.getChallengeFiles(parseInt(c,10));if(!o||0===o.length)return void h.info("No files attached to this challenge.");h.text=`Downloading ${o.length} file(s)...`;const e=[];for(const i of o)try{const o=await g.downloadFile(i,m);e.push(o)}catch(o){h.warn(`Failed to download: ${i}`)}h.succeed(`Downloaded ${e.length} file(s)`),console.log(chalk.gray(`  Location: ${m}`));for(const o of e)console.log(chalk.gray(`    → ${o.split("/").pop()}`));console.log(chalk.gray(`  Open an image/audio file with: ${chalk.white(`view ${c} <file>`)}`)),console.log()}catch(o){h.fail("Failed to download files"),s(o.message)}})}
+import chalk from"chalk";import{CTFdClient as o}from"../lib/ctfd-client.js";import{getConfig as e,isConnected as i}from"../lib/config.js";import{challengeDownloadDir as l}from"../lib/challenge-dir.js";import{logCommand as t}from"../lib/logger.js";import{printError as n,createSpinner as s}from"../lib/ui.js";export function registerFilesCommand(c){c.command("files <id>").description("Download challenge files").action(async c=>{t(`files ${c}`);const a=e();if(!i())return void n("Not connected. Run: join <url>");const r=a.sessionCookie||"",f=a.token&&!a.token.includes("session=")?a.token:"",g=new o(a.ctfdUrl,f,r||a.token),d=l(c),h=s("Fetching challenge files...");h.start();try{const o=await g.getChallengeFiles(parseInt(c,10));if(!o||0===o.length)return void h.info("No files attached to this challenge.");h.text=`Downloading ${o.length} file(s)...`;const e=[];for(const i of o)try{const o=await g.downloadFile(i,d);e.push(o)}catch(o){h.warn(`Failed to download: ${i}`)}h.succeed(`Downloaded ${e.length} file(s)`),console.log(chalk.gray(`  Location: ${d}`));for(const o of e)console.log(chalk.gray(`    → ${o.split("/").pop()}`));const i=e.length?e[0].split("/").pop():"<file>";console.log(chalk.gray(`  Run tools on them directly, e.g. ${chalk.white(`file ${c}/${i}`)}`)),console.log(chalk.gray(`  Open an image/audio file with: ${chalk.white(`view ${c} <file>`)}`)),console.log()}catch(o){h.fail("Failed to download files"),n(o.message)}})}

package/dist/commands/lang.js

@@ -1 +1 @@
-import chalk from"chalk";import{getConfig as e,saveConfig as o}from"../lib/config.js";import{COUNTRY_LANG as s}from"../lib/country-lang.js";import{getExamState as a,getRealExamState as t}from"../lib/exam-state.js";import{logCommand as n}from"../lib/logger.js";import{ensureLangCache as r}from"../lib/translations-fetcher.js";import{printSuccess as i,printError as l,printInfo as c}from"../lib/ui.js";import{SUPPORTED_LANGUAGES as g}from"../types/index.js";const u={en:"English",zh:"中文 (Chinese)",ja:"日本語 (Japanese)",ko:"한국어 (Korean)",es:"Español (Spanish)",ar:"العربية (Arabic)",fr:"Français (French)",pt:"Português (Portuguese)",ru:"Русский (Russian)",hi:"हिन्दी (Hindi)",de:"Deutsch (German)",id:"Bahasa (Indonesian)",th:"ไทย (Thai)",vi:"Tiếng Việt (Vietnamese)",tr:"Türkçe (Turkish)",uk:"Українська (Ukrainian)",ht:"Kreyòl (Haitian Creole)",sw:"Kiswahili (Swahili)",uz:"Oʻzbek (Uzbek)",lo:"ລາວ (Lao)"};export function registerLangCommand(m){m.command("lang [code]").description("Switch display language").action(async m=>{if(n(`lang ${m||""}`),!m){const o=e();c(`Current language: ${chalk.white(u[o.language]||o.language)}`),console.log(),console.log(chalk.gray("  Supported languages:"));for(const e of g){const s=o.language===e?chalk.yellow(" ← current"):"";console.log(`    ${chalk.white(e)}  ${u[e]}${s}`)}return console.log(),console.log(chalk.gray("  Switch now: ")+chalk.cyan("lang <code>")+chalk.gray("   (e.g. ")+chalk.cyan("lang es")+chalk.gray(")")),console.log(chalk.gray('  No "back" needed — you are still at the ')+chalk.cyan("icoa>")+chalk.gray(" prompt.")),void console.log()}if(!g.includes(m)){l(`Unsupported language: ${m}`);const e=g.map(e=>`${e} (${u[e]?.split(" ")[0]||e})`).join(", ");return void c(`Supported: ${e}`)}const p=t(),d=p?.session?.token;if(d){const e=d.substring(0,2).toUpperCase(),o=s[e];if(o&&m!==o&&"en"!==m)return l("Language is locked during your exam."),c(`Your token (${e}xxx) supports two languages: ${chalk.cyan("en")} (English) or ${chalk.cyan(o)} (${u[o]||o}).`),void c("To change language, finish or quit the current exam first.")}o({language:m}),i(`Language set to: ${u[m]||m}`),await r(m);const y=a();if(y&&"demo-free"===y.session.examId)try{const{pickDemoQuestions:e,getLocalizedDemoSession:o,getLocalizedDemoQuestions:s,getLocalizedExplanations:a,DEMO_PICK_SIZE:t}=await import("../lib/demo-exam.js"),{saveExamState:n}=await import("../lib/exam-state.js");if(y.questions.every(e=>null!=e.sourceNumber&&Array.isArray(e.sourceOrder)&&4===e.sourceOrder.length)){const e=s(),t=a();y.questions=y.questions.map(o=>{const s=e.find(e=>e.number===o.sourceNumber);return s&&o.sourceOrder?{...o,text:s.text,category:s.category,options:{A:s.options[o.sourceOrder[0]],B:s.options[o.sourceOrder[1]],C:s.options[o.sourceOrder[2]],D:s.options[o.sourceOrder[3]]},explanation:t[o.sourceNumber]}:o}),y.session.examName=o().examName,n(y);const r=y._lastQ||1;console.log(),console.log(chalk.green(`  Demo continues in ${u[m]||m}. Your progress is kept.`)),console.log(chalk.white(`  Resume: exam q ${r}`))}else y.questions=e(t),y.answers={},y.session.examName=o().examName,y.session.startedAt=(new Date).toISOString(),y._lastQ=1,n(y),console.log(),console.log(chalk.green(`  Demo restarted in ${u[m]||m}.`)),console.log(chalk.white("  Type: exam q 1"))}catch{console.log(chalk.gray("  Language changed. Type: demo"))}else if(y&&y.session.token)try{const{getConfig:e}=await import("../lib/config.js"),{saveExamState:o}=await import("../lib/exam-state.js"),{getDeviceFingerprint:s}=await import("../lib/access.js"),a=e().ctfdUrl||"https://practice.icoa2026.au",t=y.session.token,n=await fetch(`${a}/api/icoa/exam-token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({token:t,deviceHash:s(),lang:m}),signal:AbortSignal.timeout(1e4)});if(n.ok){const e=(await n.json()).data.questions;y.questions=e,o(y);const s=y._lastQ||1;console.log(),i(`Exam questions updated to ${u[m]||m}. Your answers are kept.`),console.log(chalk.white(`  Resume: exam q ${s}`))}else if(429===n.status){const e=await n.json().catch(()=>null),o=e?.message?.match(/(\d+)\s*s/i),s=o?parseInt(o[1],10):60;console.log(),c(`Server rate-limited that token (wait ~${s}s).`),c(`Your exam session is intact — try ${chalk.cyan(`lang ${m}`)} again after the cooldown.`)}else{const{clearExamState:e}=await import("../lib/exam-state.js");e(),console.log(),console.log(chalk.green("  ✓ Old session record cleared — your scores are safe.")),console.log(chalk.gray("  To start (or resume) your exam, type your token:")),console.log(chalk.gray("    → ")+chalk.bold.cyan("exam <your-token>"))}}catch{console.log(chalk.yellow("  Could not reach server. Language changed for UI only."))}else if(y){const e=y._lastQ||1;console.log(),console.log(chalk.gray(`  Exam in progress — resuming Q${e}:`)),console.log(chalk.white(`  Type: exam q ${e}`))}})}
+import chalk from"chalk";import{getConfig as e,saveConfig as o}from"../lib/config.js";import{COUNTRY_LANG as s}from"../lib/country-lang.js";import{getExamState as a,getRealExamState as t}from"../lib/exam-state.js";import{logCommand as n}from"../lib/logger.js";import{ensureLangCache as r}from"../lib/translations-fetcher.js";import{loadUiPack as i}from"../lib/i18n.js";import{printSuccess as l,printError as c,printInfo as g}from"../lib/ui.js";import{SUPPORTED_LANGUAGES as u}from"../types/index.js";const m={en:"English",zh:"中文 (Chinese)",ja:"日本語 (Japanese)",ko:"한국어 (Korean)",es:"Español (Spanish)",ar:"العربية (Arabic)",fr:"Français (French)",pt:"Português (Portuguese)",ru:"Русский (Russian)",hi:"हिन्दी (Hindi)",de:"Deutsch (German)",id:"Bahasa (Indonesian)",th:"ไทย (Thai)",vi:"Tiếng Việt (Vietnamese)",tr:"Türkçe (Turkish)",uk:"Українська (Ukrainian)",ht:"Kreyòl (Haitian Creole)",sw:"Kiswahili (Swahili)",uz:"Oʻzbek (Uzbek)",lo:"ລາວ (Lao)"};export function registerLangCommand(p){p.command("lang [code]").description("Switch display language").action(async p=>{if(n(`lang ${p||""}`),!p){const o=e();g(`Current language: ${chalk.white(m[o.language]||o.language)}`),console.log(),console.log(chalk.gray("  Supported languages:"));for(const e of u){const s=o.language===e?chalk.yellow(" ← current"):"";console.log(`    ${chalk.white(e)}  ${m[e]}${s}`)}return console.log(),console.log(chalk.gray("  Switch now: ")+chalk.cyan("lang <code>")+chalk.gray("   (e.g. ")+chalk.cyan("lang es")+chalk.gray(")")),console.log(chalk.gray('  No "back" needed — you are still at the ')+chalk.cyan("icoa>")+chalk.gray(" prompt.")),void console.log()}if(!u.includes(p)){c(`Unsupported language: ${p}`);const e=u.map(e=>`${e} (${m[e]?.split(" ")[0]||e})`).join(", ");return void g(`Supported: ${e}`)}const d=t(),y=d?.session?.token;if(y){const e=y.substring(0,2).toUpperCase(),o=s[e];if(o&&p!==o&&"en"!==p)return c("Language is locked during your exam."),g(`Your token (${e}xxx) supports two languages: ${chalk.cyan("en")} (English) or ${chalk.cyan(o)} (${m[o]||o}).`),void g("To change language, finish or quit the current exam first.")}o({language:p}),l(`Language set to: ${m[p]||p}`),await r(p),i(p);const h=a();if(h&&"demo-free"===h.session.examId)try{const{pickDemoQuestions:e,getLocalizedDemoSession:o,getLocalizedDemoQuestions:s,getLocalizedExplanations:a,DEMO_PICK_SIZE:t}=await import("../lib/demo-exam.js"),{saveExamState:n}=await import("../lib/exam-state.js");if(h.questions.every(e=>null!=e.sourceNumber&&Array.isArray(e.sourceOrder)&&4===e.sourceOrder.length)){const e=s(),t=a();h.questions=h.questions.map(o=>{const s=e.find(e=>e.number===o.sourceNumber);return s&&o.sourceOrder?{...o,text:s.text,category:s.category,options:{A:s.options[o.sourceOrder[0]],B:s.options[o.sourceOrder[1]],C:s.options[o.sourceOrder[2]],D:s.options[o.sourceOrder[3]]},explanation:t[o.sourceNumber]}:o}),h.session.examName=o().examName,n(h);const r=h._lastQ||1;console.log(),console.log(chalk.green(`  Demo continues in ${m[p]||p}. Your progress is kept.`)),console.log(chalk.white(`  Resume: exam q ${r}`))}else h.questions=e(t),h.answers={},h.session.examName=o().examName,h.session.startedAt=(new Date).toISOString(),h._lastQ=1,n(h),console.log(),console.log(chalk.green(`  Demo restarted in ${m[p]||p}.`)),console.log(chalk.white("  Type: exam q 1"))}catch{console.log(chalk.gray("  Language changed. Type: demo"))}else if(h&&h.session.token)try{const{getConfig:e}=await import("../lib/config.js"),{saveExamState:o}=await import("../lib/exam-state.js"),{getDeviceFingerprint:s}=await import("../lib/access.js"),a=e().ctfdUrl||"https://practice.icoa2026.au",t=h.session.token,n=await fetch(`${a}/api/icoa/exam-token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({token:t,deviceHash:s(),lang:p}),signal:AbortSignal.timeout(1e4)});if(n.ok){const e=(await n.json()).data.questions;h.questions=e,o(h);const s=h._lastQ||1;console.log(),l(`Exam questions updated to ${m[p]||p}. Your answers are kept.`),console.log(chalk.white(`  Resume: exam q ${s}`))}else if(429===n.status){const e=await n.json().catch(()=>null),o=e?.message?.match(/(\d+)\s*s/i),s=o?parseInt(o[1],10):60;console.log(),g(`Server rate-limited that token (wait ~${s}s).`),g(`Your exam session is intact — try ${chalk.cyan(`lang ${p}`)} again after the cooldown.`)}else{const{clearExamState:e}=await import("../lib/exam-state.js");e(),console.log(),console.log(chalk.green("  ✓ Old session record cleared — your scores are safe.")),console.log(chalk.gray("  To start (or resume) your exam, type your token:")),console.log(chalk.gray("    → ")+chalk.bold.cyan("exam <your-token>"))}}catch{console.log(chalk.yellow("  Could not reach server. Language changed for UI only."))}else if(h){const e=h._lastQ||1;console.log(),console.log(chalk.gray(`  Exam in progress — resuming Q${e}:`)),console.log(chalk.white(`  Type: exam q ${e}`))}})}

package/dist/commands/view.js

@@ -1 +1 @@
-import{join as e,basename as o}from"node:path";import{homedir as n}from"node:os";import{existsSync as i,readdirSync as t,statSync as l,readFileSync as r}from"node:fs";import chalk from"chalk";import{openFile as s}from"../lib/open-file.js";import{logCommand as c}from"../lib/logger.js";import{printError as f,printInfo as a}from"../lib/ui.js";function g(e){try{const o=r(e);if(0===o.length)return!0;const n=o.subarray(0,8e3);let i=0;for(const e of n){if(0===e)return!1;(e<9||e>13&&e<32)&&i++}return i/n.length<.1}catch{return!1}}export function registerViewCommand(h){h.command("view <id> [file]").description("Open a downloaded challenge file in the system viewer (image/audio/etc.)").action((h,$)=>{c(`view ${h}${$?` ${$}`:""}`);const d=e(n(),"icoa-challenges",h);if(!i(d))return void a(`No downloaded files for challenge ${h}. Run: ${chalk.white(`files ${h}`)}`);const u=t(d).filter(o=>{try{return l(e(d,o)).isFile()}catch{return!1}});if(0===u.length)return void a(`No files in ${d}. Run: ${chalk.white(`files ${h}`)}`);let m;if($){const e=o($),n=u.find(o=>o===e||o.toLowerCase()===e.toLowerCase());if(!n){f(`No file "${$}" in challenge ${h}.`),console.log(chalk.gray("  Available:"));for(const e of u)console.log(chalk.white(`    ${e}`));return void console.log(chalk.gray(`  Open one with: ${chalk.white(`view ${h} <file>`)}`))}m=[n]}else{if(1!==u.length){a(`Challenge ${h} has ${u.length} files — pick one:`);for(const e of u)console.log(chalk.white(`    ${e}`));return void console.log(chalk.gray(`  Open with: ${chalk.white(`view ${h} <file>`)}`))}m=u}for(const o of m){const n=e(d,o);if(g(n)){const e=65536,i=(()=>{try{return l(n).size}catch{return 0}})();let t=r(n,"utf-8"),s=!1;i>e&&(t=t.slice(0,e),s=!0),console.log(chalk.cyan(`  ── ${o} ──`)),console.log(t.replace(/\r\n/g,"\n")),s&&console.log(chalk.yellow(`  … truncated (file is ${(i/1024).toFixed(0)} KB)`)),console.log(chalk.cyan("  ──────────"));continue}s(n)?(console.log(chalk.green(`  Opened ${o}`)+chalk.gray(" in the system viewer")),console.log(chalk.gray(`  Path: ${n}`))):f(`Could not open ${o}. Path: ${n}`)}})}
+import{join as e,basename as o}from"node:path";import{existsSync as n,readdirSync as i,statSync as t,readFileSync as l}from"node:fs";import chalk from"chalk";import{challengeDownloadDir as r}from"../lib/challenge-dir.js";import{openFile as s}from"../lib/open-file.js";import{logCommand as c}from"../lib/logger.js";import{printError as f,printInfo as a}from"../lib/ui.js";function g(e){try{const o=l(e);if(0===o.length)return!0;const n=o.subarray(0,8e3);let i=0;for(const e of n){if(0===e)return!1;(e<9||e>13&&e<32)&&i++}return i/n.length<.1}catch{return!1}}export function registerViewCommand(h){h.command("view <id> [file]").description("Open a downloaded challenge file in the system viewer (image/audio/etc.)").action((h,$)=>{c(`view ${h}${$?` ${$}`:""}`);const d=r(h);if(!n(d))return void a(`No downloaded files for challenge ${h}. Run: ${chalk.white(`files ${h}`)}`);const u=i(d).filter(o=>{try{return t(e(d,o)).isFile()}catch{return!1}});if(0===u.length)return void a(`No files in ${d}. Run: ${chalk.white(`files ${h}`)}`);let m;if($){const e=o($),n=u.find(o=>o===e||o.toLowerCase()===e.toLowerCase());if(!n){f(`No file "${$}" in challenge ${h}.`),console.log(chalk.gray("  Available:"));for(const e of u)console.log(chalk.white(`    ${e}`));return void console.log(chalk.gray(`  Open one with: ${chalk.white(`view ${h} <file>`)}`))}m=[n]}else{if(1!==u.length){a(`Challenge ${h} has ${u.length} files — pick one:`);for(const e of u)console.log(chalk.white(`    ${e}`));return void console.log(chalk.gray(`  Open with: ${chalk.white(`view ${h} <file>`)}`))}m=u}for(const o of m){const n=e(d,o);if(g(n)){const e=65536,i=(()=>{try{return t(n).size}catch{return 0}})();let r=l(n,"utf-8"),s=!1;i>e&&(r=r.slice(0,e),s=!0),console.log(chalk.cyan(`  ── ${o} ──`)),console.log(r.replace(/\r\n/g,"\n")),s&&console.log(chalk.yellow(`  … truncated (file is ${(i/1024).toFixed(0)} KB)`)),console.log(chalk.cyan("  ──────────"));continue}s(n)?(console.log(chalk.green(`  Opened ${o}`)+chalk.gray(" in the system viewer")),console.log(chalk.gray(`  Path: ${n}`))):f(`Could not open ${o}. Path: ${n}`)}})}

package/dist/lib/challenge-dir.d.ts

@@ -0,0 +1 @@
+export declare function challengeDownloadDir(id: string, base?: string): string;

package/dist/lib/challenge-dir.js

@@ -0,0 +1 @@
+import{join as o}from"node:path";import{getActiveCwd as r}from"./exam-sandbox.js";export function challengeDownloadDir(n,e=r()){return o(e,n)}

package/dist/lib/gemini.js

@@ -1 +1 @@
-import{GoogleGenAI as e}from"@google/genai";import chalk from"chalk";import{readFileSync as t}from"node:fs";import{dirname as n,join as o}from"node:path";import{fileURLToPath as r}from"node:url";import{getConfig as a,saveConfig as s}from"./config.js";import{getRealExamState as i}from"./exam-state.js";const l=n(r(import.meta.url));let c=null;function u(){if(c)return c;try{const e=JSON.parse(t(o(l,"..","..","package.json"),"utf-8"));c=e.version||"unknown"}catch{c="unknown"}return c}export async function translateText(e,t){throw new Error("Local AI model path has been disabled (2026-04-24). ICOA provides all AI server-side — no API key setup needed. Use `ai4ctf` (chat) or `exam` (with integrated help/hint) instead.")}export function setApiKey(e){s({geminiApiKey:e})}export async function createChatSession(e,t){const n=a();let o=t||"You are an AI teammate in the ICOA cybersecurity CTF competition (International Cyber Olympiad in AI 2026, Sydney).\n\nYou're a friendly, knowledgeable cybersecurity partner — like a fellow competitor sitting next to the user. Be conversational, encouraging, and collaborative.\n\nRULES:\n- Help the competitor think through challenges, brainstorm approaches, explain concepts\n- You MAY discuss vulnerability types, tools, techniques, and methodologies\n- You MAY suggest approaches and help debug code\n- Do NOT provide complete working exploits or full solution scripts\n- Do NOT provide flags or flag fragments\n- Never output anything matching flag format: icoa{...}\n- If you don't know something, say so honestly\n- Keep responses concise unless the user asks for detail\n- When the user opens a challenge, use the context to give relevant advice";e&&(o+=`\n\nThe competitor is currently working on:\nChallenge: ${e.name}\nCategory: ${e.category}`),o+='\n\nINTEGRITY — give method, not the produced answer:\n- You may name the tool/command/technique (e.g. "this is base64; run base64 -d on the file").\n- Do NOT perform a solution step for the competitor and hand back its result: never decode,\n  decrypt, deobfuscate, run, execute, or compute over data they paste or that is attached,\n  and then reveal the produced value. They must run it themselves and read the output.\n- Do NOT reveal the exact final answer, and never output icoa{...} / flag{...} in any case.\n- If asked to "just give the answer" / "solve it" / "decode this and tell me", refuse and\n  nudge them to do the step themselves.';const r=n.ctfdUrl||"https://practice.icoa2026.au",s=n.deviceFingerprint||"",l=n.geminiModel||"gemini-2.5-flash-lite",c=[];return{async sendMessage(e){c.push({role:"user",text:e});const t=i(),a={systemPrompt:o,messages:c,model:l,maxTokens:2048,deviceFingerprint:s};t?.session?.token&&(a.examToken=t.session.token),!a.examToken&&n.ctfdUrl&&n.token&&n.userName&&(a.account=n.userName);const p=e=>new Promise(t=>setTimeout(t,e)),d=[2e3,5e3];let h=null,m=null;for(let e=0;e<=d.length&&(h=await fetch(`${r}/api/icoa/ai/chat`,{method:"POST",headers:{"Content-Type":"application/json","User-Agent":`icoa-cli/${u()}`,"X-Device-Fingerprint":s},body:JSON.stringify(a),signal:AbortSignal.timeout(6e4)}),!h.ok&&429===h.status);e++)e<d.length?await p(d[e]):m=h;if(!h)throw new Error("AI proxy: no response");if(!h.ok){const e=(await h.json().catch(()=>({message:"AI proxy error"}))).message||`AI proxy returned ${h.status}`;if(401===h.status)throw new Error(`${chalk.yellow("⚠ ")}Exam token expired. Re-enter via \`exam <token>\`.`);if(403===h.status)throw new Error(chalk.yellow("⚠ ")+e);if(429===h.status)throw new Error(chalk.yellow("⏳ ")+e+chalk.gray(" (retried twice — quota burst, try again in ~30s)"));throw new Error(e)}const g=await h.json(),f=function(e){return e.replace(/icoa\{[^}]*\}/gi,"[FLAG REDACTED]")}(g.data?.text||""),y=g.data?.tokensUsed||0;return c.push({role:"model",text:f}),{text:f,tokensUsed:y}}}}
+import{GoogleGenAI as e}from"@google/genai";import chalk from"chalk";import{readFileSync as t}from"node:fs";import{dirname as n,join as o}from"node:path";import{fileURLToPath as r}from"node:url";import{getConfig as a,saveConfig as s}from"./config.js";import{getRealExamState as i}from"./exam-state.js";const l=n(r(import.meta.url));let c=null;function u(){if(c)return c;try{const e=JSON.parse(t(o(l,"..","..","package.json"),"utf-8"));c=e.version||"unknown"}catch{c="unknown"}return c}export async function translateText(e,t){throw new Error("Local AI model path has been disabled (2026-04-24). ICOA provides all AI server-side — no API key setup needed. Use `ai4ctf` (chat) or `exam` (with integrated help/hint) instead.")}export function setApiKey(e){s({geminiApiKey:e})}export async function createChatSession(e,t){const n=a();let o=t||"You are an AI teammate in the ICOA cybersecurity CTF competition (International Cyber Olympiad in AI 2026, Sydney).\n\nYou're a friendly, knowledgeable cybersecurity partner — like a fellow competitor sitting next to the user. Be conversational, encouraging, and collaborative.\n\nRULES:\n- Help the competitor think through challenges, brainstorm approaches, explain concepts\n- You MAY discuss vulnerability types, tools, techniques, and methodologies\n- You MAY suggest approaches and help debug code\n- Do NOT provide complete working exploits or full solution scripts\n- Do NOT provide flags or flag fragments\n- Never output anything matching flag format: icoa{...}\n- If you don't know something, say so honestly\n- Keep responses concise unless the user asks for detail\n- When the user opens a challenge, use the context to give relevant advice";e&&(o+=`\n\nThe competitor is currently working on:\nChallenge: ${e.name}\nCategory: ${e.category}`),o+='\n\nINTEGRITY — give method, not the produced answer:\n- You may name the tool/command/technique (e.g. "this is base64; run base64 -d on the file").\n- Do NOT perform a solution step for the competitor and hand back its result: never decode,\n  decrypt, deobfuscate, run, execute, or compute over data they paste or that is attached,\n  and then reveal the produced value. They must run it themselves and read the output.\n- Do NOT reveal the exact final answer, and never output icoa{...} / flag{...} in any case.\n- If asked to "just give the answer" / "solve it" / "decode this and tell me", refuse and\n  nudge them to do the step themselves.';const r=n.ctfdUrl||"https://practice.icoa2026.au",s=n.deviceFingerprint||"",l=n.geminiModel||"gemini-2.5-flash-lite",c=[];return{async sendMessage(e){c.push({role:"user",text:e});const t=i(),a={systemPrompt:o,messages:c,model:l,maxTokens:2048,deviceFingerprint:s};t?.session?.token&&(a.examToken=t.session.token);const h={"Content-Type":"application/json","User-Agent":`icoa-cli/${u()}`,"X-Device-Fingerprint":s};!a.examToken&&n.ctfdUrl&&n.token&&n.userName&&(a.account=n.userName,h.Authorization=`Token ${n.token}`);const p=e=>new Promise(t=>setTimeout(t,e)),d=[2e3,5e3];let m=null,g=null;for(let e=0;e<=d.length&&(m=await fetch(`${r}/api/icoa/ai/chat`,{method:"POST",headers:h,body:JSON.stringify(a),signal:AbortSignal.timeout(6e4)}),!m.ok&&429===m.status);e++)e<d.length?await p(d[e]):g=m;if(!m)throw new Error("AI proxy: no response");if(!m.ok){const e=(await m.json().catch(()=>({message:"AI proxy error"}))).message||`AI proxy returned ${m.status}`;if(401===m.status)throw new Error(`${chalk.yellow("⚠ ")}Exam token expired. Re-enter via \`exam <token>\`.`);if(403===m.status)throw new Error(chalk.yellow("⚠ ")+e);if(429===m.status)throw new Error(chalk.yellow("⏳ ")+e+chalk.gray(" (retried twice — quota burst, try again in ~30s)"));throw new Error(e)}const f=await m.json(),y=function(e){return e.replace(/icoa\{[^}]*\}/gi,"[FLAG REDACTED]")}(f.data?.text||""),w=f.data?.tokensUsed||0;return c.push({role:"model",text:y}),{text:y,tokensUsed:w}}}}

package/dist/lib/hint-client.js

@@ -1 +1 @@
-(function(a,b){const v=a0b,c=a();while(!![]){try{const d=parseInt(v(0x1e3))/(0x1ce0+-0x109*-0x1c+-0x39db)+parseInt(v(0x1e6))/(-0x237*0x7+-0x236+0x11b9)*(-parseInt(v(0x1e7))/(0xc99*-0x1+0x7*0x2cc+-0x6f8))+-parseInt(v(0x1eb))/(0xdc6*-0x1+0x1*-0x1b92+0x295c)+-parseInt(v(0x1e2))/(-0x1f64*-0x1+0x1*0x1f45+-0xfa9*0x4)*(-parseInt(v(0x1ed))/(0xf78+0xcfe*-0x1+-0x274))+parseInt(v(0x1e4))/(0x1*0x280+-0x1acb*-0x1+-0x1d44)+parseInt(v(0x1e5))/(-0x29*-0xbf+-0xcb9+0x8eb*-0x2)+-parseInt(v(0x1ea))/(-0x1*0x709+-0xbd4+0x12e6);if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a0a,-0x79c36+-0x1*0x3cb93+-0x1*-0x113ae3));import{getConfig as a0c}from'./config.js';export async function requestHint(d){const w=a0b,f=a0c(),g=f[w(0x1f5)]||'https://practice.icoa2026.au',h=d[w(0x1f6)]||f['language']||'en',j=d[w(0x1f7)]??0xf*0x3ad+-0x407+-0x52*0x3e,k=[g+w(0x1e9)+d[w(0x1f3)]+'/hint',g+':9090/api/icoa/exams/'+d[w(0x1f3)]+'/hint'];let l=null;for(const p of k)try{const q=await fetch(p,{'method':'POST','headers':{'Content-Type':'application/json','User-Agent':'icoa-cli'},'body':JSON[w(0x1ee)]({'token':d['token'],'question':d[w(0x1f9)],'level':d['level'],'lang':h}),'signal':AbortSignal[w(0x1f2)](j)}),r=await q[w(0x1f0)]()[w(0x1f8)](()=>({}));if(!q['ok']||!(-0x1d3e+0x930+0x140f)===r['success']){if(l={'status':q[w(0x1e1)],'message':r?.[w(0x1ef)]||'hint\x20request\x20failed\x20('+q[w(0x1e1)]+')'},q[w(0x1e1)]>=0x916+-0x1a32+0x12ac&&q[w(0x1e1)]<0x1*-0xd32+-0x347*-0x3+0x551)throw l;continue;}return r[w(0x1f1)];}catch(u){if(u&&w(0x1ec)==typeof u&&w(0x1e1)in u)throw u;l={'status':0x0,'message':u?.[w(0x1ef)]||w(0x1e8)};}const m={};m[w(0x1e1)]=0x0,m[w(0x1ef)]=w(0x1f4);throw l||m;}function a0b(a,b){a=a-(0xa3*0x34+0x202b*-0x1+0xf0);const c=a0a();let d=c[a];if(a0b['arwBsT']===undefined){var e=function(i){const j='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let l='',m='';for(let n=-0x2d1+0x16*0x191+-0x1fa5,o,p,q=0x212f+-0x167f*0x1+-0xab0;p=i['charAt'](q++);~p&&(o=n%(-0x145c+0x916+0xb4a)?o*(0x1*-0x23f9+0x699*-0x2+0x316b)+p:p,n++%(-0x26ce*0x1+-0xe9c+0x1ab7*0x2))?l+=String['fromCharCode'](0x2ba*0xb+-0xbb8+-0x1147*0x1&o>>(-(-0x1fe4+-0x2653+0x4639)*n&0x53*0x31+0x1*0x151+-0x112e)):0x15d8+0xfc*0x9+0xa*-0x312){p=j['indexOf'](p);}for(let r=0x1*-0x23df+-0xbb4+0x13*0x281,s=l['length'];r<s;r++){m+='%'+('00'+l['charCodeAt'](r)['toString'](0x215*-0x9+0xa*0x6f+-0x17*-0xa1))['slice'](-(0x9*0x1ec+-0x16c9*0x1+0xc9*0x7));}return decodeURIComponent(m);};a0b['lVwzws']=e,a0b['OjXpai']={},a0b['arwBsT']=!![];}const f=c[0x2*0xd37+-0xc7*0x15+-0xa1b],g=a+f,h=a0b['OjXpai'][g];return!h?(d=a0b['lVwzws'](d),a0b['OjXpai'][g]=d):d=h,d;}function a0a(){const x=['BMv0D29YAYbLCNjVCG','l2fWAs9Py29Hl2v4yw1ZlW','mty2nZaZneXOAxLKAa','mty3mtCXmLPfDvrmBG','B2jQzwn0','mtm5ohbmA1zhrq','C3rYAw5NAwz5','BwvZC2fNzq','ANnVBG','zgf0yq','DgLTzw91Da','zxHHBuLK','AgLUDcbbueKGDw5YzwfJAgfIBgu','y3rMzfvYBa','BgfUzW','DgLTzw91De1Z','y2f0y2G','CxvLC3rPB24','C3rHDhvZ','mJK5nunqvLfkqW','mJKXnJuWDhvlqu1q','nda3nJm1owjdu1jWqW','ndy4otm2oereA3LfAa','mtiYoty5ofzkz09gzG','m0XvsuHJCW'];a0a=function(){return x;};return a0a();}
+(function(a,b){const v=a0b,c=a();while(!![]){try{const d=parseInt(v(0x156))/(-0x48b*0x1+0x94d*0x1+-0x4c1)+-parseInt(v(0x15c))/(0x4*0xa6+0x11dd+-0x1473*0x1)*(-parseInt(v(0x15f))/(0x18b1*0x1+-0x445*-0x7+-0x3691))+parseInt(v(0x167))/(-0x2372+0x1b3e+0x107*0x8)*(-parseInt(v(0x16d))/(-0x1*0x21f8+0xda7+0x13*0x112))+-parseInt(v(0x169))/(-0x1b1*0x4+0x1d3+0x29*0x1f)*(-parseInt(v(0x163))/(-0xe03+-0x707*-0x1+-0x703*-0x1))+parseInt(v(0x162))/(0x724+-0x1231+0x1*0xb15)*(-parseInt(v(0x170))/(0x2647+-0x2191+-0x3*0x18f))+-parseInt(v(0x164))/(0x9d*-0x2c+-0x1776+-0x3*-0x10d4)*(-parseInt(v(0x15a))/(0xb5*0x34+-0x116*-0x22+-0x49a5*0x1))+-parseInt(v(0x16c))/(-0x13f9*-0x1+0x15d0+-0x29bd)*(parseInt(v(0x16f))/(0x89*-0x1b+-0x2475+0xa31*0x5));if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a0a,0x89b0+-0x9bb5e+0x17*0xcae2));function a0b(a,b){a=a-(0x1109+0x1*-0x1bfd+0xc47*0x1);const c=a0a();let d=c[a];if(a0b['TKhnTC']===undefined){var e=function(i){const j='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let l='',m='';for(let n=0xb2d+0x5db*0x4+-0x2299,o,p,q=0xc9d*-0x3+0x2294+-0x343*-0x1;p=i['charAt'](q++);~p&&(o=n%(-0x55*0x4a+0xa68*-0x2+0x2d66)?o*(-0xd4b+0x1c1f+-0xe94)+p:p,n++%(-0x1*-0x3a6+-0xd*-0x1f3+-0x1cf9*0x1))?l+=String['fromCharCode'](0x2*0xece+-0x8*0x1f2+0xd*-0x101&o>>(-(-0x2*-0x1df+0x32*-0x25+0x37e)*n&-0x3*-0x71+0x7ab*-0x2+0xe09*0x1)):-0x15f2+0x12b6+0x33c){p=j['indexOf'](p);}for(let r=-0x39*-0xa9+-0x268a+0xe9,s=l['length'];r<s;r++){m+='%'+('00'+l['charCodeAt'](r)['toString'](-0x1f46+0x3cd*0x9+-0x2df))['slice'](-(0x24d4+-0x157a+-0xf58));}return decodeURIComponent(m);};a0b['uujQAi']=e,a0b['oucdKf']={},a0b['TKhnTC']=!![];}const f=c[0x1*0x1993+-0x23*0x116+0xc6f],g=a+f,h=a0b['oucdKf'][g];return!h?(d=a0b['uujQAi'](d),a0b['oucdKf'][g]=d):d=h,d;}import{getConfig as a0c}from'./config.js';function a0a(){const x=['DgLTzw91De1Z','Dg9Rzw4','nZC2DfDIv2fP','mJiYnty1quLWyM1N','mtbqAhnXEum','zxHHBuLK','B2jQzwn0','ne5UAhzMvW','BgfUz3vHz2u','mtuWzg93uMfz','yxbWBgLJyxrPB24VANnVBG','ANnVBG','mtjUAKnwwMi','nJi2nte1BuXuALLS','BMv0D29YAYbLCNjVCG','mJi4mdG4ntfTr3HcvMG','mZmXodnYCwHbrum','l2HPBNq','oJKWotaVyxbPl2LJB2eVzxHHBxmV','l2fWAs9Py29Hl2v4yw1ZlW','AwnVys1JBgK','C3rHDhvZ','nZy4mdi2wu5Kqxbn','BgfUzW','BwvZC2fNzq','Ahr0Chm6lY9WCMfJDgLJzs5Py29HmJaYnI5HDq','mJyXmti3ou1QCMfZDG','y3rMzfvYBa','nZiYBLHuqK5S','AgLUDcbYzxf1zxn0igzHAwXLzcaO','C3rYAw5NAwz5','odu1m01VAhLAyq'];a0a=function(){return x;};return a0a();}export async function requestHint(d){const w=a0b,f=a0c(),g=f[w(0x15b)]||w(0x159),h=d[w(0x157)]||f[w(0x168)]||'en',j=d[w(0x160)]??0xb5*0x35+-0xd1b+0x6e2,k=[g+w(0x153)+d[w(0x165)]+w(0x171),g+w(0x172)+d[w(0x165)]+w(0x171)];let l=null;for(const p of k)try{const q=await fetch(p,{'method':'POST','headers':{'Content-Type':w(0x16a),'User-Agent':w(0x154)},'body':JSON[w(0x15e)]({'token':d[w(0x161)],'question':d['question'],'level':d['level'],'lang':h}),'signal':AbortSignal['timeout'](j)}),r=await q[w(0x16b)]()['catch'](()=>({}));if(!q['ok']||!(-0x1*-0x2294+-0x1046*-0x2+-0x431f)===r['success']){if(l={'status':q['status'],'message':r?.[w(0x158)]||w(0x15d)+q[w(0x155)]+')'},q[w(0x155)]>=-0x14d0+0x259d*0x1+-0xf3d&&q[w(0x155)]<-0xd4b+0x1c1f+-0xce0)throw l;continue;}return r['data'];}catch(u){if(u&&w(0x166)==typeof u&&w(0x155)in u)throw u;l={'status':0x0,'message':u?.[w(0x158)]||w(0x16e)};}const m={};m[w(0x155)]=0x0,m[w(0x158)]='hint\x20API\x20unreachable';throw l||m;}

package/dist/lib/i18n.d.ts

@@ -205,5 +205,11 @@ export declare const EN: {
     ai4ctfLockedUse: string;
     ai4ctfLockedThen: string;
 };
+/**
+ * Force (re)load the UI pack for `lang` into the in-memory cache. Call right
+ * after a fetch (boot / lang switch) so a freshly-downloaded ui.json takes
+ * effect even if t() already memoized an empty pack for this lang.
+ */
+export declare function loadUiPack(lang: string): void;
 export declare function t(key: keyof Strings): string;
 export {};