icoa-cli 2.19.34 → 2.19.35

package/dist/commands/ai4ctf.js

@@ -17,6 +17,10 @@ function getChallengeContext() {
 let chatActive = false;
 let chatSession = null;
 let chatTokensUsed = 0;
+// Set true when the user burns through DEMO_TOKEN_CAP without solving. The
+// chat session stays alive so `!<shell>` and `submit <flag>` still work, but
+// further AI messages are blocked. See the reveal path in handleChatMessage.
+let tokensLocked = false;
 const DEMO_TOKEN_CAP = 5000;
 export function isChatActive() {
     return chatActive;
@@ -53,14 +57,46 @@ const DEMO_HINTS = {
         'For simple challenges like this one, hint c adds nothing extra:',
         'hint b already tells you everything you need.',
         '',
-        'If you do not remember how to decode Base64, ask your AI teammate —',
-        'just type a question like: how do I decode Base64 on the command line?',
+        'Two ways forward from here:',
         '',
-        'To run a shell command inside ai4ctf, prefix it with "!". For example:',
+        '  1. Chat with your AI teammate in natural language. Examples:',
+        '       what is the base64 command?',
+        '       how do I decode Base64 on macOS?',
+        '     Just type the question — anything without "!" goes to the AI.',
         '',
-        '    !echo aWNvYXt3M2xjMG1lXzJfYWk0Y3RmfQ== | base64 -d',
+        '  2. Run a shell command directly. Shell commands inside ai4ctf',
+        '     must start with "!", otherwise your text goes to the AI. Example:',
+        '',
+        '         !echo aWNvYXt3M2xjMG1lXzJfYWk0Y3RmfQ== | base64 -d',
     ],
 };
+// Shown when the user hits the 5000-token demo cap without solving. Keeps
+// the session alive (no chatActive=false) so they can still paste the shell
+// command below and then `submit <flag>`.
+function showTokenCapReveal() {
+    console.log();
+    console.log(chalk.yellow('  ─────────────────────────────────────────────'));
+    console.log(chalk.bold.yellow('  💡 Out of AI tokens — here is the reveal'));
+    console.log(chalk.yellow('  ─────────────────────────────────────────────'));
+    console.log();
+    console.log(chalk.white('    Looks like you have not found the flag yet.'));
+    console.log(chalk.white('    No worries — for the demo we will just tell you.'));
+    console.log();
+    console.log(chalk.white('    Run this command to decode the Base64 string:'));
+    console.log();
+    console.log(chalk.cyan('        !echo aWNvYXt3M2xjMG1lXzJfYWk0Y3RmfQ== | base64 -d'));
+    console.log();
+    console.log(chalk.white('    You will see the flag:'));
+    console.log();
+    console.log(chalk.green('        icoa{w3lc0me_2_ai4ctf}'));
+    console.log();
+    console.log(chalk.white('    Then submit it:'));
+    console.log();
+    console.log(chalk.cyan('        submit icoa{w3lc0me_2_ai4ctf}'));
+    console.log();
+    console.log(chalk.gray('    (AI chat is locked — only shell commands and submit work now.)'));
+    console.log();
+}
 function showDemoHint(tier) {
     const title = tier === 'a' ? t('ai4ctfHintA') : tier === 'b' ? t('ai4ctfHintB') : t('ai4ctfHintC');
     const tierLabel = `Hint ${tier.toUpperCase()}`;
@@ -214,12 +250,14 @@ export async function handleChatMessage(input) {
         console.log();
         return 'exit';
     }
-    if (chatTokensUsed >= DEMO_TOKEN_CAP) {
-        chatActive = false;
-        chatSession = null;
-        // Report the token-cap session so the server can count "hit the wall"
-        // outcomes. Without this, a user who burned 5000 tokens without solving
-        // was invisible to the admin dashboard.
+    // Token cap: first hit → reveal the answer, lock AI, but keep the session
+    // alive so the user can still paste the shell command and then submit.
+    // `tokensLocked` prevents any further sendMessage calls.
+    if (!tokensLocked && chatTokensUsed >= DEMO_TOKEN_CAP) {
+        tokensLocked = true;
+        // Report the token-cap session once (solved:false). If the user then
+        // submits the revealed flag, the submit-success path fires another POST
+        // with solved:true which is the canonical record.
         fetch('https://practice.icoa2026.au/api/icoa/demo-stats', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
@@ -229,16 +267,18 @@ export async function handleChatMessage(input) {
         console.log();
         console.log(chalk.yellow(`  ${t('tokenLimit')}`));
         drawTokenBar();
+        showTokenCapReveal();
+        return 'continue';
+    }
+    // If AI is locked (post-reveal), bounce any non-shell, non-submit input
+    // back to the user with a reminder of what actually works now.
+    if (tokensLocked) {
         console.log();
-        console.log(chalk.gray('  ─────────────────────────────────────────'));
-        console.log(chalk.white(`  ${t('ai4ctfReport')}`));
-        console.log(chalk.gray(`  ${t('ai4ctfTokens')}: ${chatTokensUsed}/${DEMO_TOKEN_CAP}`));
-        console.log(chalk.gray(`  ${t('ai4ctfModel')}: Google Gemma 4 (gemma-4-31b-it)`));
-        console.log(chalk.gray('  ─────────────────────────────────────────'));
-        console.log();
-        console.log(chalk.white(`  ${t('ai4ctfNext')}`));
+        console.log(chalk.yellow('  AI chat is locked — out of tokens.'));
+        console.log(chalk.gray('  Use: ') + chalk.cyan('!echo aWNvYXt3M2xjMG1lXzJfYWk0Y3RmfQ== | base64 -d'));
+        console.log(chalk.gray('  Then: ') + chalk.cyan('submit icoa{w3lc0me_2_ai4ctf}'));
         console.log();
-        return 'exit';
+        return 'continue';
     }
     console.log(chalk.gray(`  ${t('ai4ctfThinking')}`));
     try {
@@ -280,6 +320,7 @@ export function registerAi4ctfCommand(program) {
         }
         chatActive = true;
         chatTokensUsed = 0;
+        tokensLocked = false;
         // Guided welcome
         console.log();
         console.log(chalk.green.bold(`  ═══ ${t('ai4ctfTitle')} ═══`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.19.34",
+  "version": "2.19.35",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {