icoa-cli 2.19.33 → 2.19.34

package/dist/commands/ai4ctf.js

@@ -88,6 +88,9 @@ function showDemoHint(tier) {
 export async function handleChatMessage(input) {
     if (!chatSession)
         return 'exit';
+    // Capture every input (including special commands like hint/submit/exit)
+    // so the full flow shows up in session.log even before any early return.
+    logCommand(`ai4ctf: ${input}`);
     // Scripted demo hints — intercept before the AI chat so that typing
     // `hint a` / `hint b` / `hint c` behaves like a real competition command
     // instead of becoming a generic AI chat turn.
@@ -237,7 +240,6 @@ export async function handleChatMessage(input) {
         console.log();
         return 'exit';
     }
-    logCommand(`ai4ctf: ${input}`);
     console.log(chalk.gray(`  ${t('ai4ctfThinking')}`));
     try {
         const response = await chatSession.sendMessage(input);

package/dist/commands/ctf4ai-demo.js

@@ -89,6 +89,9 @@ export function isCtf4aiActive() {
 export async function handleCtf4aiMessage(input) {
     if (!ctf4aiSession)
         return 'exit';
+    // Capture every input (including special commands) for the audit trail
+    // before any early-return branches.
+    logCommand(`ctf4ai: ${input}`);
     if (input === 'exit' || input === 'back' || input === 'quit') {
         ctf4aiActive = false;
         ctf4aiSession = null;
@@ -118,7 +121,6 @@ export async function handleCtf4aiMessage(input) {
         printDemoReport(false, ctf4aiTokens);
         return 'exit';
     }
-    logCommand(`ctf4ai: ${input}`);
     try {
         console.log(chalk.gray(`  ${t('ctf4aiThinking')}`));
         const { text, tokensUsed } = await ctf4aiSession.sendMessage(input);

package/dist/commands/exam.js

@@ -9,6 +9,23 @@ import { printSuccess, printError, printWarning, printInfo, printTable, printHea
 import { t } from '../lib/i18n.js';
 import { getDeviceFingerprint } from '../lib/access.js';
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+// Fire-and-forget event POST to /api/icoa/demo-stats. Used for demo-flow
+// choice points (demo enter, retry, back) where we want a server-side
+// timestamp of the user's decision but have nothing more to report.
+function reportDemoEvent(type, extra = {}) {
+    const config = getConfig();
+    fetch('https://practice.icoa2026.au/api/icoa/demo-stats', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            type,
+            lang: config.language || 'en',
+            timestamp: new Date().toISOString(),
+            ...extra,
+        }),
+        signal: AbortSignal.timeout(5000),
+    }).catch(() => { });
+}
 /**
  * Skippable intro animation for first-time demo users.
  * Resolves immediately on any keypress. Max 30s auto-advance.
@@ -1077,6 +1094,7 @@ export function registerExamCommand(program) {
         .description('Try a free practice exam (no account needed)')
         .action(async () => {
         logCommand('exam demo');
+        reportDemoEvent('demo-enter');
         const { pickDemoQuestions, getLocalizedDemoSession, DEMO_PICK_SIZE, DEMO_POOL_SIZE } = await import('../lib/demo-exam.js');
         // First-time intro animation (skippable)
         const cfg = getConfig();
@@ -1150,6 +1168,7 @@ export function registerExamCommand(program) {
         .description('Retry only the questions you got wrong last demo attempt')
         .action(async () => {
         logCommand('exam demo-retry');
+        reportDemoEvent('post-report-retry');
         const { getLocalizedDemoSession } = await import('../lib/demo-exam.js');
         const retryQueue = getRetryQueue();
         if (!retryQueue || retryQueue.length === 0) {

package/dist/lib/log-sync.js

@@ -1,7 +1,19 @@
 import { readFileSync, existsSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { getIcoaDir, getConfig } from './config.js';
-const SYNC_INTERVAL = 30_000; // 30 seconds
+import { getDeviceFingerprint } from './access.js';
+// Every 30s, post new lines from ~/.icoa/session.log to the server audit
+// endpoint. Two auth modes:
+//
+//   1. Logged-in user (CTFd token present)  → Authorization: Token <token>,
+//      stored on the server as /opt/CTFd/audit/user-<userId>.jsonl
+//   2. Anonymous demo user (no token)       → X-Device-Fingerprint: <hash>,
+//      stored as /opt/CTFd/audit/demo-<fingerprint>.jsonl
+//
+// The demo path is what lets us observe the full prompt/command history of
+// users who never log in (the main demo audience).
+const SYNC_INTERVAL = 30_000;
+const DEFAULT_SERVER = 'https://practice.icoa2026.au';
 const SYNC_STATE_FILE = () => join(getIcoaDir(), 'sync-state.json');
 let syncTimer = null;
 function getSyncState() {
@@ -20,25 +32,37 @@ function saveSyncState(state) {
 }
 async function syncLogs() {
     const config = getConfig();
-    if (!config.ctfdUrl)
-        return; // Not connected, skip
+    const serverUrl = config.ctfdUrl || DEFAULT_SERVER;
     const logPath = join(getIcoaDir(), 'session.log');
     if (!existsSync(logPath))
         return;
     const state = getSyncState();
     const allLines = readFileSync(logPath, 'utf-8').trim().split('\n').filter(Boolean);
-    // Only send new lines since last sync
     const newLines = allLines.slice(state.lastSyncedLine);
     if (newLines.length === 0)
         return;
+    // Pick auth mode: token for logged-in users, device fingerprint for anon.
+    const headers = { 'Content-Type': 'application/json' };
+    let identity;
+    if (config.token) {
+        headers['Authorization'] = `Token ${config.token}`;
+        identity = `user:${config.userId ?? 'unknown'}`;
+    }
+    else {
+        const fp = config.deviceFingerprint || getDeviceFingerprint();
+        headers['X-Device-Fingerprint'] = fp;
+        identity = `demo:${fp.slice(0, 12)}`;
+    }
     const payload = {
+        identity,
         userId: config.userId,
         userName: config.userName,
         teamId: config.teamId,
         sessionId: config.sessionId,
-        deviceFingerprint: config.deviceFingerprint,
+        deviceFingerprint: config.deviceFingerprint || getDeviceFingerprint(),
+        lang: config.language || 'en',
         timestamp: new Date().toISOString(),
-        entries: newLines.map(line => {
+        entries: newLines.map((line) => {
             try {
                 return JSON.parse(line);
             }
@@ -48,16 +72,12 @@ async function syncLogs() {
         }),
     };
     try {
-        // POST to CTFd server audit endpoint
-        const url = new URL('/api/icoa/audit', config.ctfdUrl).href;
+        const url = new URL('/api/icoa/audit', serverUrl).href;
         const res = await fetch(url, {
             method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Token ${config.token}`,
-            },
+            headers,
             body: JSON.stringify(payload),
-            signal: AbortSignal.timeout(10_000), // 10s timeout
+            signal: AbortSignal.timeout(10_000),
         });
         if (res.ok) {
             state.lastSyncedLine = allLines.length;
@@ -77,9 +97,7 @@ async function syncLogs() {
     }
 }
 export function startLogSync() {
-    // Initial sync after 5 seconds
     setTimeout(() => syncLogs(), 5_000);
-    // Then every 30 seconds
     syncTimer = setInterval(() => syncLogs(), SYNC_INTERVAL);
 }
 export function stopLogSync() {

package/dist/repl.js

@@ -360,6 +360,20 @@ export async function startRepl(program, resumeMode) {
                 console.log();
             }
             else {
+                // No active exam — typically this is the "post-report back" choice
+                // after the user has finished the 3-stage demo flow. Report it as a
+                // distinct event so the admin can count retry vs back decisions.
+                const cfg = getConfig();
+                fetch('https://practice.icoa2026.au/api/icoa/demo-stats', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        type: 'post-report-back',
+                        lang: cfg.language || 'en',
+                        timestamp: new Date().toISOString(),
+                    }),
+                    signal: AbortSignal.timeout(5000),
+                }).catch(() => { });
                 console.log(chalk.gray('  Already at main menu.'));
             }
             rl.prompt();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.19.33",
+  "version": "2.19.34",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {