icoa-cli 2.19.33 → 2.19.35

package/dist/commands/ai4ctf.js

@@ -17,6 +17,10 @@ function getChallengeContext() {
 let chatActive = false;
 let chatSession = null;
 let chatTokensUsed = 0;
+// Set true when the user burns through DEMO_TOKEN_CAP without solving. The
+// chat session stays alive so `!<shell>` and `submit <flag>` still work, but
+// further AI messages are blocked. See the reveal path in handleChatMessage.
+let tokensLocked = false;
 const DEMO_TOKEN_CAP = 5000;
 export function isChatActive() {
     return chatActive;
@@ -53,14 +57,46 @@ const DEMO_HINTS = {
         'For simple challenges like this one, hint c adds nothing extra:',
         'hint b already tells you everything you need.',
         '',
-        'If you do not remember how to decode Base64, ask your AI teammate —',
-        'just type a question like: how do I decode Base64 on the command line?',
+        'Two ways forward from here:',
         '',
-        'To run a shell command inside ai4ctf, prefix it with "!". For example:',
+        '  1. Chat with your AI teammate in natural language. Examples:',
+        '       what is the base64 command?',
+        '       how do I decode Base64 on macOS?',
+        '     Just type the question — anything without "!" goes to the AI.',
         '',
-        '    !echo aWNvYXt3M2xjMG1lXzJfYWk0Y3RmfQ== | base64 -d',
+        '  2. Run a shell command directly. Shell commands inside ai4ctf',
+        '     must start with "!", otherwise your text goes to the AI. Example:',
+        '',
+        '         !echo aWNvYXt3M2xjMG1lXzJfYWk0Y3RmfQ== | base64 -d',
     ],
 };
+// Shown when the user hits the 5000-token demo cap without solving. Keeps
+// the session alive (no chatActive=false) so they can still paste the shell
+// command below and then `submit <flag>`.
+function showTokenCapReveal() {
+    console.log();
+    console.log(chalk.yellow('  ─────────────────────────────────────────────'));
+    console.log(chalk.bold.yellow('  💡 Out of AI tokens — here is the reveal'));
+    console.log(chalk.yellow('  ─────────────────────────────────────────────'));
+    console.log();
+    console.log(chalk.white('    Looks like you have not found the flag yet.'));
+    console.log(chalk.white('    No worries — for the demo we will just tell you.'));
+    console.log();
+    console.log(chalk.white('    Run this command to decode the Base64 string:'));
+    console.log();
+    console.log(chalk.cyan('        !echo aWNvYXt3M2xjMG1lXzJfYWk0Y3RmfQ== | base64 -d'));
+    console.log();
+    console.log(chalk.white('    You will see the flag:'));
+    console.log();
+    console.log(chalk.green('        icoa{w3lc0me_2_ai4ctf}'));
+    console.log();
+    console.log(chalk.white('    Then submit it:'));
+    console.log();
+    console.log(chalk.cyan('        submit icoa{w3lc0me_2_ai4ctf}'));
+    console.log();
+    console.log(chalk.gray('    (AI chat is locked — only shell commands and submit work now.)'));
+    console.log();
+}
 function showDemoHint(tier) {
     const title = tier === 'a' ? t('ai4ctfHintA') : tier === 'b' ? t('ai4ctfHintB') : t('ai4ctfHintC');
     const tierLabel = `Hint ${tier.toUpperCase()}`;
@@ -88,6 +124,9 @@ function showDemoHint(tier) {
 export async function handleChatMessage(input) {
     if (!chatSession)
         return 'exit';
+    // Capture every input (including special commands like hint/submit/exit)
+    // so the full flow shows up in session.log even before any early return.
+    logCommand(`ai4ctf: ${input}`);
     // Scripted demo hints — intercept before the AI chat so that typing
     // `hint a` / `hint b` / `hint c` behaves like a real competition command
     // instead of becoming a generic AI chat turn.
@@ -211,12 +250,14 @@ export async function handleChatMessage(input) {
         console.log();
         return 'exit';
     }
-    if (chatTokensUsed >= DEMO_TOKEN_CAP) {
-        chatActive = false;
-        chatSession = null;
-        // Report the token-cap session so the server can count "hit the wall"
-        // outcomes. Without this, a user who burned 5000 tokens without solving
-        // was invisible to the admin dashboard.
+    // Token cap: first hit → reveal the answer, lock AI, but keep the session
+    // alive so the user can still paste the shell command and then submit.
+    // `tokensLocked` prevents any further sendMessage calls.
+    if (!tokensLocked && chatTokensUsed >= DEMO_TOKEN_CAP) {
+        tokensLocked = true;
+        // Report the token-cap session once (solved:false). If the user then
+        // submits the revealed flag, the submit-success path fires another POST
+        // with solved:true which is the canonical record.
         fetch('https://practice.icoa2026.au/api/icoa/demo-stats', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
@@ -226,18 +267,19 @@ export async function handleChatMessage(input) {
         console.log();
         console.log(chalk.yellow(`  ${t('tokenLimit')}`));
         drawTokenBar();
+        showTokenCapReveal();
+        return 'continue';
+    }
+    // If AI is locked (post-reveal), bounce any non-shell, non-submit input
+    // back to the user with a reminder of what actually works now.
+    if (tokensLocked) {
         console.log();
-        console.log(chalk.gray('  ─────────────────────────────────────────'));
-        console.log(chalk.white(`  ${t('ai4ctfReport')}`));
-        console.log(chalk.gray(`  ${t('ai4ctfTokens')}: ${chatTokensUsed}/${DEMO_TOKEN_CAP}`));
-        console.log(chalk.gray(`  ${t('ai4ctfModel')}: Google Gemma 4 (gemma-4-31b-it)`));
-        console.log(chalk.gray('  ─────────────────────────────────────────'));
-        console.log();
-        console.log(chalk.white(`  ${t('ai4ctfNext')}`));
+        console.log(chalk.yellow('  AI chat is locked — out of tokens.'));
+        console.log(chalk.gray('  Use: ') + chalk.cyan('!echo aWNvYXt3M2xjMG1lXzJfYWk0Y3RmfQ== | base64 -d'));
+        console.log(chalk.gray('  Then: ') + chalk.cyan('submit icoa{w3lc0me_2_ai4ctf}'));
         console.log();
-        return 'exit';
+        return 'continue';
     }
-    logCommand(`ai4ctf: ${input}`);
     console.log(chalk.gray(`  ${t('ai4ctfThinking')}`));
     try {
         const response = await chatSession.sendMessage(input);
@@ -278,6 +320,7 @@ export function registerAi4ctfCommand(program) {
         }
         chatActive = true;
         chatTokensUsed = 0;
+        tokensLocked = false;
         // Guided welcome
         console.log();
         console.log(chalk.green.bold(`  ═══ ${t('ai4ctfTitle')} ═══`));

package/dist/commands/ctf4ai-demo.js

@@ -89,6 +89,9 @@ export function isCtf4aiActive() {
 export async function handleCtf4aiMessage(input) {
     if (!ctf4aiSession)
         return 'exit';
+    // Capture every input (including special commands) for the audit trail
+    // before any early-return branches.
+    logCommand(`ctf4ai: ${input}`);
     if (input === 'exit' || input === 'back' || input === 'quit') {
         ctf4aiActive = false;
         ctf4aiSession = null;
@@ -118,7 +121,6 @@ export async function handleCtf4aiMessage(input) {
         printDemoReport(false, ctf4aiTokens);
         return 'exit';
     }
-    logCommand(`ctf4ai: ${input}`);
     try {
         console.log(chalk.gray(`  ${t('ctf4aiThinking')}`));
         const { text, tokensUsed } = await ctf4aiSession.sendMessage(input);

package/dist/commands/exam.js

@@ -9,6 +9,23 @@ import { printSuccess, printError, printWarning, printInfo, printTable, printHea
 import { t } from '../lib/i18n.js';
 import { getDeviceFingerprint } from '../lib/access.js';
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+// Fire-and-forget event POST to /api/icoa/demo-stats. Used for demo-flow
+// choice points (demo enter, retry, back) where we want a server-side
+// timestamp of the user's decision but have nothing more to report.
+function reportDemoEvent(type, extra = {}) {
+    const config = getConfig();
+    fetch('https://practice.icoa2026.au/api/icoa/demo-stats', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            type,
+            lang: config.language || 'en',
+            timestamp: new Date().toISOString(),
+            ...extra,
+        }),
+        signal: AbortSignal.timeout(5000),
+    }).catch(() => { });
+}
 /**
  * Skippable intro animation for first-time demo users.
  * Resolves immediately on any keypress. Max 30s auto-advance.
@@ -1077,6 +1094,7 @@ export function registerExamCommand(program) {
         .description('Try a free practice exam (no account needed)')
         .action(async () => {
         logCommand('exam demo');
+        reportDemoEvent('demo-enter');
         const { pickDemoQuestions, getLocalizedDemoSession, DEMO_PICK_SIZE, DEMO_POOL_SIZE } = await import('../lib/demo-exam.js');
         // First-time intro animation (skippable)
         const cfg = getConfig();
@@ -1150,6 +1168,7 @@ export function registerExamCommand(program) {
         .description('Retry only the questions you got wrong last demo attempt')
         .action(async () => {
         logCommand('exam demo-retry');
+        reportDemoEvent('post-report-retry');
         const { getLocalizedDemoSession } = await import('../lib/demo-exam.js');
         const retryQueue = getRetryQueue();
         if (!retryQueue || retryQueue.length === 0) {

package/dist/lib/log-sync.js

@@ -1,7 +1,19 @@
 import { readFileSync, existsSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { getIcoaDir, getConfig } from './config.js';
-const SYNC_INTERVAL = 30_000; // 30 seconds
+import { getDeviceFingerprint } from './access.js';
+// Every 30s, post new lines from ~/.icoa/session.log to the server audit
+// endpoint. Two auth modes:
+//
+//   1. Logged-in user (CTFd token present)  → Authorization: Token <token>,
+//      stored on the server as /opt/CTFd/audit/user-<userId>.jsonl
+//   2. Anonymous demo user (no token)       → X-Device-Fingerprint: <hash>,
+//      stored as /opt/CTFd/audit/demo-<fingerprint>.jsonl
+//
+// The demo path is what lets us observe the full prompt/command history of
+// users who never log in (the main demo audience).
+const SYNC_INTERVAL = 30_000;
+const DEFAULT_SERVER = 'https://practice.icoa2026.au';
 const SYNC_STATE_FILE = () => join(getIcoaDir(), 'sync-state.json');
 let syncTimer = null;
 function getSyncState() {
@@ -20,25 +32,37 @@ function saveSyncState(state) {
 }
 async function syncLogs() {
     const config = getConfig();
-    if (!config.ctfdUrl)
-        return; // Not connected, skip
+    const serverUrl = config.ctfdUrl || DEFAULT_SERVER;
     const logPath = join(getIcoaDir(), 'session.log');
     if (!existsSync(logPath))
         return;
     const state = getSyncState();
     const allLines = readFileSync(logPath, 'utf-8').trim().split('\n').filter(Boolean);
-    // Only send new lines since last sync
     const newLines = allLines.slice(state.lastSyncedLine);
     if (newLines.length === 0)
         return;
+    // Pick auth mode: token for logged-in users, device fingerprint for anon.
+    const headers = { 'Content-Type': 'application/json' };
+    let identity;
+    if (config.token) {
+        headers['Authorization'] = `Token ${config.token}`;
+        identity = `user:${config.userId ?? 'unknown'}`;
+    }
+    else {
+        const fp = config.deviceFingerprint || getDeviceFingerprint();
+        headers['X-Device-Fingerprint'] = fp;
+        identity = `demo:${fp.slice(0, 12)}`;
+    }
     const payload = {
+        identity,
         userId: config.userId,
         userName: config.userName,
         teamId: config.teamId,
         sessionId: config.sessionId,
-        deviceFingerprint: config.deviceFingerprint,
+        deviceFingerprint: config.deviceFingerprint || getDeviceFingerprint(),
+        lang: config.language || 'en',
         timestamp: new Date().toISOString(),
-        entries: newLines.map(line => {
+        entries: newLines.map((line) => {
             try {
                 return JSON.parse(line);
             }
@@ -48,16 +72,12 @@ async function syncLogs() {
         }),
     };
     try {
-        // POST to CTFd server audit endpoint
-        const url = new URL('/api/icoa/audit', config.ctfdUrl).href;
+        const url = new URL('/api/icoa/audit', serverUrl).href;
         const res = await fetch(url, {
             method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Token ${config.token}`,
-            },
+            headers,
             body: JSON.stringify(payload),
-            signal: AbortSignal.timeout(10_000), // 10s timeout
+            signal: AbortSignal.timeout(10_000),
         });
         if (res.ok) {
             state.lastSyncedLine = allLines.length;
@@ -77,9 +97,7 @@ async function syncLogs() {
     }
 }
 export function startLogSync() {
-    // Initial sync after 5 seconds
     setTimeout(() => syncLogs(), 5_000);
-    // Then every 30 seconds
     syncTimer = setInterval(() => syncLogs(), SYNC_INTERVAL);
 }
 export function stopLogSync() {

package/dist/repl.js

@@ -360,6 +360,20 @@ export async function startRepl(program, resumeMode) {
                 console.log();
             }
             else {
+                // No active exam — typically this is the "post-report back" choice
+                // after the user has finished the 3-stage demo flow. Report it as a
+                // distinct event so the admin can count retry vs back decisions.
+                const cfg = getConfig();
+                fetch('https://practice.icoa2026.au/api/icoa/demo-stats', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        type: 'post-report-back',
+                        lang: cfg.language || 'en',
+                        timestamp: new Date().toISOString(),
+                    }),
+                    signal: AbortSignal.timeout(5000),
+                }).catch(() => { });
                 console.log(chalk.gray('  Already at main menu.'));
             }
             rl.prompt();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.19.33",
+  "version": "2.19.35",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {