icoa-cli 2.19.347 → 2.19.349

package/dist/lib/comms.js

@@ -1 +1,212 @@
-import chalk from"chalk";import{getConfig as t}from"./config.js";const e=/\x1b\[[0-9;?]*[ -/]*[@-~]/g,o=/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;let n=!1;export function isCommsActive(){return n}export function setCommsActive(t){n=t}export function isLeaderToken(t){return/^LDR[A-Z0-9]{10,}$/i.test((t||"").trim())}export function isLeaderSession(){return Boolean(t().leaderToken)}export function isLeaderAccount(t){return(t||"").trim().toUpperCase().startsWith("TMLD")}export function sanitizeCommsLine(t){let n=(t??"").toString();return n=n.replace(e,""),n=n.replace(/[\r\n\t]/g," "),n=n.replace(o," "),n=n.replace(/\s+/g," ").trim(),n.slice(0,500)}export function commsBaseUrl(){return(t().ctfdUrl||"").replace(/\/+$/,"")}export function isCompetitionJoined(){const e=t();return Boolean((e.token||e.leaderToken)&&e.ctfdUrl&&e.userName)}export function isMelCompetition(){return isCompetitionJoined()&&function(t){try{return new URL(t).host}catch{return(t||"").replace(/^https?:\/\//,"").replace(/\/.*$/,"")}}(t().ctfdUrl).endsWith("au.icoa2026.au")}export function formatBroadcastBar(t){const e=sanitizeCommsLine(t);if(!e)return chalk.green("  ✓ No issues reported — enjoy the competition!");const o="─".repeat(49);return[chalk.yellow(`  ${o}`),chalk.bold.yellow("  ⚠  BROADCAST  ")+chalk.yellow(e),chalk.yellow(`  ${o}`)].join("\n")}function r(){const e=t(),o={"Content-Type":"application/json"};return e.token&&(o.Authorization=`Token ${e.token}`),o}export async function fetchBroadcast(){try{const t=await fetch(`${commsBaseUrl()}/api/icoa/broadcast`,{headers:r(),signal:AbortSignal.timeout(5e3)});if(!t.ok)return{text:"",ts:null};const e=await t.json(),o=e?.data??{};return{text:sanitizeCommsLine(o.text||""),ts:o.ts??null}}catch{return{text:"",ts:null}}}async function a(e,o){try{const n=await fetch(`${commsBaseUrl()}/api/icoa/${e}`,{method:"POST",headers:r(),body:JSON.stringify({text:sanitizeCommsLine(o),account:t().userName||"",leader_token:t().leaderToken||void 0}),signal:AbortSignal.timeout(8e3)}),a=await n.json().catch(()=>({}));return n.ok&&a?.success?{ok:!0,id:a.data?.id,ts:a.data?.ts,status:n.status}:{ok:!1,status:n.status,message:a?.message}}catch(t){return{ok:!1,status:0,message:t?.message||"network error"}}}export function postMemo(t){return a("memo",t)}export function postJury(t){return a("jury",t)}export async function leaderAuth(t,e){try{const o=await fetch(`${t.replace(/\/+$/,"")}/api/icoa/leader-auth`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({token:(e||"").trim()}),signal:AbortSignal.timeout(8e3)}),n=await o.json().catch(()=>({}));return o.ok&&n?.success&&n.data?.account?{account:String(n.data.account),team:String(n.data.team||"")}:null}catch{return null}}export async function fetchPublicScoreboard(){try{const t=await fetch(`${commsBaseUrl()}/api/v1/scoreboard`,{headers:{Accept:"application/json"},signal:AbortSignal.timeout(8e3)});if(!t.ok)return[];const e=await t.json().catch(()=>({}));return(Array.isArray(e?.data)?e.data:[]).map((t,e)=>({pos:t.pos??e+1,name:String(t.name??""),score:Number(t.score??0)}))}catch{return[]}}let s=null,c="",i=!1;export function showBroadcast(){console.log(),console.log(formatBroadcastBar(c))}export function startBroadcastPoll(t){if(s)return;const e=async()=>{const{text:e}=await fetchBroadcast(),o=e!==c;c=e,i&&o&&e&&(console.log(),console.log(formatBroadcastBar(e)),t()),i=!0};e(),s=setInterval(()=>{e()},45e3)}export function stopBroadcastPoll(){s&&clearInterval(s),s=null,c="",i=!1}
+import chalk from 'chalk';
+import { getConfig } from './config.js';
+const MEL_HOST = 'au.icoa2026.au';
+const MAX_TEXT_LEN = 500;
+// eslint-disable-next-line no-control-regex
+const ANSI_RE = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
+// eslint-disable-next-line no-control-regex
+const CTRL_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+// Comms sub-screen (memo/jury) active flag. The main REPL wraps rl.prompt() to
+// force computePrompt() (→ `icoa 2026>`) on every prompt; chat/exam sub-modes
+// bypass that wrap via their own active flags. Memo/jury need the same, or the
+// wrapper clobbers their `icoa memo>` / `icoa jury>` prompt back to `icoa 2026>`.
+let _commsActive = false;
+export function isCommsActive() {
+    return _commsActive;
+}
+export function setCommsActive(active) {
+    _commsActive = active;
+}
+// A leader token (printed on the leader's card) — `LDR` + confusable-free body.
+// Typed at the join Username prompt; the CLI authenticates it via token-api
+// instead of doing a CTFd login, so the leader never gets a web session.
+export function isLeaderToken(s) {
+    return /^LDR[A-Z0-9]{10,}$/i.test((s || '').trim());
+}
+// A leader SESSION = authenticated by a leader token (config.leaderToken set).
+// Distinct from isLeaderAccount (name-prefix), which still gates legacy logins.
+export function isLeaderSession() {
+    return Boolean(getConfig().leaderToken);
+}
+export function isLeaderAccount(name) {
+    // Team-leader accounts use the `TMLD` prefix (confirmed 2026-06-23). This is
+    // collision-free: `ZZRH` and `ZZCP` are BOTH contestants (ZZRH = reused AU-camp
+    // student logins) and must never be blocked from challenges. Only `TMLD` gets
+    // the minimal leader REPL + the hidden `jury` command; everyone else competes.
+    // (Replaces the earlier broken `ZZRH`=leader rule and the interim fail-open.)
+    return (name || '').trim().toUpperCase().startsWith('TMLD');
+}
+export function sanitizeCommsLine(s) {
+    let out = (s ?? '').toString();
+    out = out.replace(ANSI_RE, '');
+    out = out.replace(/[\r\n\t]/g, ' ');
+    // remap (not delete) remaining control chars to space, matching comms_store.py
+    out = out.replace(CTRL_RE, ' ');
+    out = out.replace(/\s+/g, ' ').trim();
+    return out.slice(0, MAX_TEXT_LEN);
+}
+function hostOf(url) {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return (url || '').replace(/^https?:\/\//, '').replace(/\/.*$/, '');
+    }
+}
+export function commsBaseUrl() {
+    return (getConfig().ctfdUrl || '').replace(/\/+$/, '');
+}
+export function isCompetitionJoined() {
+    const c = getConfig();
+    // Contestants join with a CTFd token; leaders join with a leader token (no
+    // CTFd login). Either counts as "in the competition" for comms gating.
+    return Boolean((c.token || c.leaderToken) && c.ctfdUrl && c.userName);
+}
+export function isMelCompetition() {
+    return isCompetitionJoined() && hostOf(getConfig().ctfdUrl).endsWith(MEL_HOST);
+}
+export function formatBroadcastBar(text) {
+    const clean = sanitizeCommsLine(text);
+    if (!clean) {
+        return chalk.green('  ✓ No issues reported — enjoy the competition!');
+    }
+    const rule = '─'.repeat(49);
+    return [
+        chalk.yellow(`  ${rule}`),
+        chalk.bold.yellow('  ⚠  BROADCAST  ') + chalk.yellow(clean),
+        chalk.yellow(`  ${rule}`),
+    ].join('\n');
+}
+// ─── network ───
+function authHeaders() {
+    const c = getConfig();
+    const h = { 'Content-Type': 'application/json' };
+    if (c.token)
+        h.Authorization = `Token ${c.token}`;
+    return h;
+}
+export async function fetchBroadcast() {
+    try {
+        const res = await fetch(`${commsBaseUrl()}/api/icoa/broadcast`, {
+            headers: authHeaders(),
+            signal: AbortSignal.timeout(5000),
+        });
+        if (!res.ok)
+            return { text: '', ts: null };
+        const json = await res.json();
+        const d = json?.data ?? {};
+        return { text: sanitizeCommsLine(d.text || ''), ts: d.ts ?? null };
+    }
+    catch {
+        return { text: '', ts: null };
+    }
+}
+async function postComms(kind, text) {
+    try {
+        const res = await fetch(`${commsBaseUrl()}/api/icoa/${kind}`, {
+            method: 'POST',
+            headers: authHeaders(),
+            // account = self-reported fallback for session-mode logins (no API token).
+            // leader_token = un-forgeable leader identity (server validates it) so a
+            // leader with no CTFd login can still file jury appeals.
+            // Server prefers token-verified > leader-token > self-reported account.
+            body: JSON.stringify({
+                text: sanitizeCommsLine(text),
+                account: getConfig().userName || '',
+                leader_token: getConfig().leaderToken || undefined,
+            }),
+            signal: AbortSignal.timeout(8000),
+        });
+        const json = await res.json().catch(() => ({}));
+        if (res.ok && json?.success) {
+            return { ok: true, id: json.data?.id, ts: json.data?.ts, status: res.status };
+        }
+        return { ok: false, status: res.status, message: json?.message };
+    }
+    catch (e) {
+        return { ok: false, status: 0, message: e?.message || 'network error' };
+    }
+}
+export function postMemo(text) {
+    return postComms('memo', text);
+}
+export function postJury(text) {
+    return postComms('jury', text);
+}
+// Authenticate a leader token against token-api. No CTFd login happens.
+// Returns the resolved account + team on success, null otherwise.
+export async function leaderAuth(baseUrl, token) {
+    try {
+        const res = await fetch(`${baseUrl.replace(/\/+$/, '')}/api/icoa/leader-auth`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ token: (token || '').trim() }),
+            signal: AbortSignal.timeout(8000),
+        });
+        const json = await res.json().catch(() => ({}));
+        if (res.ok && json?.success && json.data?.account) {
+            return { account: String(json.data.account), team: String(json.data.team || '') };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+// Read the PUBLIC CTFd scoreboard (score_visibility=public → no auth needed).
+// Leaders use this since they have no CTFd session. Returns [] on any failure.
+export async function fetchPublicScoreboard() {
+    try {
+        const res = await fetch(`${commsBaseUrl()}/api/v1/scoreboard`, {
+            headers: { Accept: 'application/json' },
+            signal: AbortSignal.timeout(8000),
+        });
+        if (!res.ok)
+            return [];
+        const json = await res.json().catch(() => ({}));
+        const data = Array.isArray(json?.data) ? json.data : [];
+        return data.map((e, i) => ({
+            pos: e.pos ?? i + 1,
+            name: String(e.name ?? ''),
+            score: Number(e.score ?? 0),
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+// ─── background poll + render ───
+let pollTimer = null;
+let cachedText = '';
+let primed = false;
+export function showBroadcast() {
+    console.log();
+    console.log(formatBroadcastBar(cachedText));
+}
+export function startBroadcastPoll(redraw) {
+    if (pollTimer)
+        return;
+    const tick = async () => {
+        const { text } = await fetchBroadcast();
+        const changed = text !== cachedText;
+        cachedText = text;
+        // Print a fresh alert when the text changes after the first prime — never
+        // on the very first fetch (that would clobber the join screen), and only a
+        // non-empty change is loud (clearing is silent).
+        if (primed && changed && text) {
+            console.log();
+            console.log(formatBroadcastBar(text));
+            redraw();
+        }
+        primed = true;
+    };
+    void tick();
+    pollTimer = setInterval(() => void tick(), 45_000);
+}
+export function stopBroadcastPoll() {
+    if (pollTimer)
+        clearInterval(pollTimer);
+    pollTimer = null;
+    cachedText = '';
+    primed = false;
+}

package/dist/lib/config.js

@@ -1 +1,93 @@
-import{mkdirSync as t,readFileSync as n,writeFileSync as o,existsSync as r,chmodSync as e,statSync as i}from"node:fs";import{join as c}from"node:path";import{homedir as f}from"node:os";import{randomUUID as s}from"node:crypto";import{DEFAULT_CONFIG as u,DEFAULT_BUDGET as g}from"../types/index.js";const p=c(f(),".icoa"),d=c(p,"config.json"),m=c(p,"budget.json");function a(t,n){o(t,n);try{e(t,384)}catch{}}function y(t){try{63&i(t).mode&&e(t,384)}catch{}}function l(){r(p)||t(p,{recursive:!0,mode:448})}export function getConfig(){if(l(),!r(d)){const t={...u,sessionId:s()};return a(d,JSON.stringify(t,null,2)),t}y(d);try{const t=n(d,"utf-8");return{...u,...JSON.parse(t)}}catch{return{...u,sessionId:s()}}}export function saveConfig(t){l();const n={...getConfig(),...t};a(d,JSON.stringify(n,null,2))}export function getBudget(){if(l(),!r(m))return a(m,JSON.stringify(g,null,2)),{...g};y(m);try{const t=n(m,"utf-8");return{...g,...JSON.parse(t)}}catch{return{...g}}}export function saveBudget(t){l(),a(m,JSON.stringify(t,null,2))}export function getIcoaDir(){return l(),p}export function isConnected(){const t=getConfig();return!(!t.ctfdUrl||!t.token)}
+import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { DEFAULT_CONFIG, DEFAULT_BUDGET } from '../types/index.js';
+const ICOA_DIR = join(homedir(), '.icoa');
+const CONFIG_FILE = join(ICOA_DIR, 'config.json');
+const BUDGET_FILE = join(ICOA_DIR, 'budget.json');
+// V16 fix (v2.19.181): config.json holds the exam token, geminiApiKey, and
+// accessToken in plaintext. On shared/multi-user hosts (school labs, family
+// machines) a world-readable 0o644 leaks them to anyone with a shell. We
+// force 0o600 (owner-only read/write) at every write, and proactively re-
+// chmod on read for files created before this fix.
+function writePrivate(path, contents) {
+    // Write first so we can chmod afterwards. The Node fs.writeFile mode
+    // option only applies on file CREATION, not existing files — chmodSync
+    // is the reliable cross-platform path. Best-effort on Windows where
+    // POSIX modes don't apply.
+    writeFileSync(path, contents);
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        /* ignore — Windows/restricted FS */
+    }
+}
+function ensurePrivateMode(path) {
+    // For files written by older versions at 0o644: tighten on first read.
+    try {
+        const st = statSync(path);
+        // Mode low bits: group + other. If any non-zero, tighten.
+        if ((st.mode & 0o077) !== 0) {
+            chmodSync(path, 0o600);
+        }
+    }
+    catch {
+        /* ignore */
+    }
+}
+function ensureDir() {
+    if (!existsSync(ICOA_DIR)) {
+        mkdirSync(ICOA_DIR, { recursive: true, mode: 0o700 });
+    }
+}
+export function getConfig() {
+    ensureDir();
+    if (!existsSync(CONFIG_FILE)) {
+        const config = { ...DEFAULT_CONFIG, sessionId: randomUUID() };
+        writePrivate(CONFIG_FILE, JSON.stringify(config, null, 2));
+        return config;
+    }
+    ensurePrivateMode(CONFIG_FILE);
+    try {
+        const raw = readFileSync(CONFIG_FILE, 'utf-8');
+        return { ...DEFAULT_CONFIG, ...JSON.parse(raw) };
+    }
+    catch {
+        return { ...DEFAULT_CONFIG, sessionId: randomUUID() };
+    }
+}
+export function saveConfig(config) {
+    ensureDir();
+    const current = getConfig();
+    const merged = { ...current, ...config };
+    writePrivate(CONFIG_FILE, JSON.stringify(merged, null, 2));
+}
+export function getBudget() {
+    ensureDir();
+    if (!existsSync(BUDGET_FILE)) {
+        writePrivate(BUDGET_FILE, JSON.stringify(DEFAULT_BUDGET, null, 2));
+        return { ...DEFAULT_BUDGET };
+    }
+    ensurePrivateMode(BUDGET_FILE);
+    try {
+        const raw = readFileSync(BUDGET_FILE, 'utf-8');
+        return { ...DEFAULT_BUDGET, ...JSON.parse(raw) };
+    }
+    catch {
+        return { ...DEFAULT_BUDGET };
+    }
+}
+export function saveBudget(budget) {
+    ensureDir();
+    writePrivate(BUDGET_FILE, JSON.stringify(budget, null, 2));
+}
+export function getIcoaDir() {
+    ensureDir();
+    return ICOA_DIR;
+}
+export function isConnected() {
+    const config = getConfig();
+    return !!(config.ctfdUrl && config.token);
+}

package/dist/lib/country-lang.js

@@ -1 +1,39 @@
-export const COUNTRY_LANG={UA:"uk",PE:"es",CN:"zh",AU:"en",JP:"ja",KR:"ko",BR:"pt",SA:"ar",FR:"fr",DE:"de",IN:"hi",ID:"id",TH:"th",VN:"vi",TR:"tr",RU:"ru",EG:"ar",HT:"ht",PH:"en",MY:"en",MM:"en",SG:"en",ZA:"en",KE:"sw",TZ:"sw",MO:"zh",UZ:"uz",GH:"en",LA:"lo",BD:"bn",BI:"fr",US:"en",UK:"en",NZ:"en",LK:"si",BW:"en",VE:"es"};
+export const COUNTRY_LANG = {
+    UA: 'uk',
+    PE: 'es',
+    CN: 'zh',
+    AU: 'en',
+    JP: 'ja',
+    KR: 'ko',
+    BR: 'pt',
+    SA: 'ar',
+    FR: 'fr',
+    DE: 'de',
+    IN: 'hi',
+    ID: 'id',
+    TH: 'th',
+    VN: 'vi',
+    TR: 'tr',
+    RU: 'ru',
+    EG: 'ar',
+    HT: 'ht',
+    PH: 'en',
+    MY: 'en',
+    MM: 'en',
+    SG: 'en',
+    ZA: 'en',
+    KE: 'sw',
+    TZ: 'sw',
+    MO: 'zh',
+    UZ: 'uz',
+    GH: 'en',
+    LA: 'lo',
+    BD: 'bn',
+    BI: 'fr',
+    US: 'en',
+    UK: 'en',
+    NZ: 'en',
+    LK: 'si',
+    BW: 'en',
+    VE: 'es',
+};