icoa-cli 2.19.348 → 2.19.349

package/dist/lib/demo2-progress.js

@@ -1 +1,102 @@
-import{mkdirSync as t,readFileSync as e,unlinkSync as r,writeFileSync as o}from"node:fs";import{join as n}from"node:path";import{homedir as a}from"node:os";const s=n(a(),".icoa","demo2-progress.json");export function loadDemo2Progress(){let t,r;try{t=e(s,"utf-8")}catch{return null}try{r=JSON.parse(t)}catch{return clearDemo2Progress(),null}if("number"!=typeof r.nextCardIndex||"number"!=typeof r.totalCards||"string"!=typeof r.lang||"number"!=typeof r.startedAt)return clearDemo2Progress(),null;const o=r.completedAt??r.startedAt;return"number"==typeof o&&Date.now()-o>6048e5?(clearDemo2Progress(),null):{nextCardIndex:r.nextCardIndex,totalCards:r.totalCards,lang:r.lang,startedAt:r.startedAt,completedAt:"number"==typeof r.completedAt?r.completedAt:void 0}}export function saveDemo2Progress(e){!function(){try{t(n(a(),".icoa"),{recursive:!0})}catch{}}();try{o(s,JSON.stringify(e))}catch{}}export function clearDemo2Progress(){try{r(s)}catch{}}export function markCardDone(t,e,r,o){saveDemo2Progress({nextCardIndex:t+1,totalCards:e,lang:r,startedAt:o})}export function markDemo2Complete(t,e,r){saveDemo2Progress({nextCardIndex:t,totalCards:t,lang:e,startedAt:r,completedAt:Date.now()})}
+/**
+ * demo2 progress persistence — opt-in resume + replay hooks.
+ *
+ * State lives in `~/.icoa/demo2-progress.json`. Records the last card
+ * index the user finished plus a completedAt timestamp when they reach
+ * the outro. Auto-clears anything older than 7 days so re-runs after a
+ * gap feel like a fresh start (no manual cleanup needed — see
+ * feedback_no_manual_rm).
+ *
+ * Out of scope: scores, answers, language history. Those are run-scoped
+ * and re-initialised every call to runDemo2Once().
+ */
+import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const PROGRESS_FILE = join(homedir(), '.icoa', 'demo2-progress.json');
+// Auto-expire stale partial progress so coming back next month re-greets
+// the user fresh instead of dangling on card 5/10.
+const STALE_AFTER_MS = 7 * 24 * 60 * 60 * 1000;
+function ensureDir() {
+    try {
+        mkdirSync(join(homedir(), '.icoa'), { recursive: true });
+    }
+    catch {
+        // Non-fatal — caller's writeFileSync will surface the real failure
+    }
+}
+/**
+ * Load progress, auto-clearing anything stale. Returns null if no usable
+ * record exists.
+ */
+export function loadDemo2Progress() {
+    let raw;
+    try {
+        raw = readFileSync(PROGRESS_FILE, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        clearDemo2Progress();
+        return null;
+    }
+    if (typeof parsed.nextCardIndex !== 'number' ||
+        typeof parsed.totalCards !== 'number' ||
+        typeof parsed.lang !== 'string' ||
+        typeof parsed.startedAt !== 'number') {
+        clearDemo2Progress();
+        return null;
+    }
+    const anchor = parsed.completedAt ?? parsed.startedAt;
+    if (typeof anchor === 'number' && Date.now() - anchor > STALE_AFTER_MS) {
+        clearDemo2Progress();
+        return null;
+    }
+    return {
+        nextCardIndex: parsed.nextCardIndex,
+        totalCards: parsed.totalCards,
+        lang: parsed.lang,
+        startedAt: parsed.startedAt,
+        completedAt: typeof parsed.completedAt === 'number' ? parsed.completedAt : undefined,
+    };
+}
+export function saveDemo2Progress(p) {
+    ensureDir();
+    try {
+        writeFileSync(PROGRESS_FILE, JSON.stringify(p));
+    }
+    catch {
+        // Non-fatal — progress is convenience, not correctness
+    }
+}
+export function clearDemo2Progress() {
+    try {
+        unlinkSync(PROGRESS_FILE);
+    }
+    catch {
+        // Already absent — fine
+    }
+}
+/** Convenience: record that the user finished card N (0-based). */
+export function markCardDone(cardIndex, totalCards, lang, startedAt) {
+    saveDemo2Progress({
+        nextCardIndex: cardIndex + 1,
+        totalCards,
+        lang,
+        startedAt,
+    });
+}
+export function markDemo2Complete(totalCards, lang, startedAt) {
+    saveDemo2Progress({
+        nextCardIndex: totalCards,
+        totalCards,
+        lang,
+        startedAt,
+        completedAt: Date.now(),
+    });
+}

package/dist/lib/exam-client.js

@@ -1 +1,54 @@
-export class ExamClient{baseUrl;token;constructor(t,e){this.baseUrl=t.replace(/\/+$/,""),this.token=e}async request(t,e,r){const s=[`${this.baseUrl}/api/icoa/exams${e}`,`${this.baseUrl}:9090/api/icoa/exams${e}`];let a=null;for(const e of s)try{return await this._fetch(t,e,r)}catch(t){a=t}throw a||new Error("Exam API unreachable")}async _fetch(t,e,r){const s=await fetch(e,{method:t,headers:{Authorization:`Token ${this.token}`,"Content-Type":"application/json"},body:r?JSON.stringify(r):void 0,signal:AbortSignal.timeout(1e4)});if(!s.ok){const t=await s.text().catch(()=>"Unknown error");throw new Error(`Exam API error (${s.status}): ${t}`)}const a=await s.json();if(!1===a.success)throw new Error(a.message||"Exam API error");return a.data}async getExams(){return this.request("GET","")}async startExam(t){return this.request("POST",`/${t}/start`)}async submitExam(t,e){return this.request("POST",`/${t}/submit`,{answers:e})}async getResult(t){return this.request("GET",`/${t}/result`)}}
+export class ExamClient {
+    baseUrl;
+    token;
+    constructor(baseUrl, token) {
+        this.baseUrl = baseUrl.replace(/\/+$/, '');
+        this.token = token;
+    }
+    async request(method, path, body) {
+        // Try nginx proxy first, fallback to direct port
+        const urls = [`${this.baseUrl}/api/icoa/exams${path}`, `${this.baseUrl}:9090/api/icoa/exams${path}`];
+        let lastError = null;
+        for (const url of urls) {
+            try {
+                return await this._fetch(method, url, body);
+            }
+            catch (e) {
+                lastError = e;
+            }
+        }
+        throw lastError || new Error('Exam API unreachable');
+    }
+    async _fetch(method, url, body) {
+        const res = await fetch(url, {
+            method,
+            headers: {
+                Authorization: `Token ${this.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: body ? JSON.stringify(body) : undefined,
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => 'Unknown error');
+            throw new Error(`Exam API error (${res.status}): ${text}`);
+        }
+        const json = (await res.json());
+        if (json.success === false) {
+            throw new Error(json.message || 'Exam API error');
+        }
+        return json.data;
+    }
+    async getExams() {
+        return this.request('GET', '');
+    }
+    async startExam(examId) {
+        return this.request('POST', `/${examId}/start`);
+    }
+    async submitExam(examId, answers) {
+        return this.request('POST', `/${examId}/submit`, { answers });
+    }
+    async getResult(examId) {
+        return this.request('GET', `/${examId}/result`);
+    }
+}

package/dist/lib/exam-state.js

@@ -1 +1,273 @@
-import{readFileSync as t,writeFileSync as e,existsSync as n,unlinkSync as a,mkdirSync as r,chmodSync as o}from"node:fs";import{execFileSync as i}from"node:child_process";import{join as s}from"node:path";import{homedir as c}from"node:os";import{getIcoaDir as u}from"./config.js";export function practicalChatCommand(t,e){return e?"ctf4ai"===t?"ctf4ai":"ai4ctf"===t?"ai4ctf":"vla"===t?"ctf4eai":null:null}export function materializeAttachedData(t,a){if(!a)return null;let o;try{const i=getRealExamState(),u=i?.session?.workspaceDir,f=u&&n(u)?u:s(c(),"icoa-workspace");r(f,{recursive:!0}),o=s(f,`q${t}.txt`),e(o,a,"utf-8")}catch{return null}try{return i("docker",["cp",o,`icoa-sandbox:/home/competitor/challenges/q${t}.txt`],{stdio:"ignore",timeout:3e3}),`challenges/q${t}.txt`}catch{return o}}function f(){return s(u(),"exam-state.json")}function l(){return s(u(),"demo-state.json")}function m(t){return"demo-free"===t?l():f()}export function getRealExamState(){const e=f();if(!n(e))return null;try{const n=JSON.parse(t(e,"utf-8"));if("demo-free"===n?.session?.examId){try{a(e)}catch{}return null}return n}catch{return null}}export function getDemoState(){const e=l();if(!n(e))return null;try{return JSON.parse(t(e,"utf-8"))}catch{return null}}export function getExamState(){return getRealExamState()||getDemoState()}export function saveExamState(t){const n=m(t.session.examId);e(n,JSON.stringify(t,null,2));try{o(n,384)}catch{}}export function clearExamState(t){if(t){const e=m(t);n(e)&&a(e)}else{const t=getExamState();if(t){const e=m(t.session.examId);n(e)&&a(e)}}}function d(t){if(!t.session.durationMinutes)return null;const{deadlineServerMs:e,clockOffsetMs:n}=t.session;if("number"==typeof e&&"number"==typeof n)return new Date(e-n);const a=t.session.confirmedAt||t.session.startedAt,r=new Date(a).getTime();return new Date(r+60*t.session.durationMinutes*1e3)}export function getExamDeadline(){const t=getExamState();return t?d(t):null}export function getRealExamDeadline(){const t=getRealExamState();return t?d(t):null}let p=!1;export async function refetchQuestionDataIfStale(){const t=getRealExamState();if(!t)return null;if(p)return t;const e=t.session.token;if(!e)return t;if(!t.questions.some(t=>{if("ai4ctf"!==t.type&&"ctf4ai"!==t.type)return!1;const e=String(t.description||"");return(e.includes("attachedData")||/base64 blob/i.test(e))&&!t.attachedData}))return t;p=!0;try{const{getConfig:n}=await import("./config.js"),a=n(),r=a.ctfdUrl||"https://practice.icoa2026.au",o=a.language||"en",i=await fetch(`${r}/api/icoa/exam-token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({token:e,deviceHash:"",lang:o}),signal:AbortSignal.timeout(8e3)});if(!i.ok)return t;const s=await i.json(),c=s?.data?.questions||[];if(0===c.length)return t;const u=new Map;for(const t of c)u.set(t.number,t);let f=0;for(const e of t.questions){const t=u.get(e.number);t&&(t.attachedData&&!e.attachedData&&(e.attachedData=t.attachedData,f++),t.description&&(!e.description||t.description.length>e.description.length)&&(e.description=t.description))}return f>0&&saveExamState(t),t}catch{return t}}
+import { readFileSync, writeFileSync, existsSync, unlinkSync, mkdirSync, chmodSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { getIcoaDir } from './config.js';
+/**
+ * Write a practical question's attachedData blob to the contestant's
+ * workspace so they can use shell / python / editor tooling on it without
+ * pasting the whole base64 back in on the command line.
+ *
+ * Because `!shell` / `!python3` inside the REPL runs in the sandbox
+ * container (which only mounts its own challenges volume, not the host's
+ * workspace), we also mirror the file into the sandbox at
+ * /home/competitor/challenges/q<n>.txt via `docker cp` when the sandbox
+ * is running. Returns the path students should reference —
+ * sandbox-visible when the sandbox is up, else host — so the
+ * "Ways to solve" block points at a file that actually exists wherever
+ * `!command` executes.
+ *
+ * Silent on failure: null means no workspace file was materialized, and
+ * callers skip the solve-paths guidance.
+ */
+/**
+ * Map a practical question's TYPE to the AI chat command a contestant should
+ * enter for it. The practical section is interleaved (standard paper:
+ * Q38 ctf4ai, Q39 ai4ctf, Q40 ctf4ai; Paper E: Q37-46 ai4ctf, Q47-48 ctf4ai),
+ * so routing by question NUMBER misroutes questions to the wrong engine — the
+ * root cause behind both the old printSectionIntro bug and the practical
+ * answer-nudge in repl.ts. Always route by type.
+ *
+ * Returns null for MCQ / short-answer / unknown types, and (when not a real
+ * exam, i.e. the demo) since the demo has no live AI chat sections.
+ */
+export function practicalChatCommand(qType, isReal) {
+    if (!isReal)
+        return null;
+    if (qType === 'ctf4ai')
+        return 'ctf4ai';
+    if (qType === 'ai4ctf')
+        return 'ai4ctf';
+    if (qType === 'vla')
+        return 'ctf4eai';
+    return null;
+}
+export function materializeAttachedData(qNum, data) {
+    if (!data)
+        return null;
+    let hostPath;
+    try {
+        // Prefer the active exam's per-exam tmpdir (L1 anti-cheat workspace) so
+        // contestants see their question file in the same dir their `!cmd`
+        // invocations land in. Falls back to ~/icoa-workspace pre-start.
+        const state = getRealExamState();
+        const examWorkspace = state?.session?.workspaceDir;
+        const workspace = examWorkspace && existsSync(examWorkspace) ? examWorkspace : join(homedir(), 'icoa-workspace');
+        mkdirSync(workspace, { recursive: true });
+        hostPath = join(workspace, `q${qNum}.txt`);
+        writeFileSync(hostPath, data, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    // If the sandbox container is up, copy the file inside so `!command`
+    // invocations can reach it at a stable path. Uses execFileSync (no
+    // shell) because qNum is numeric and hostPath is trusted, but we still
+    // avoid string concatenation into a shell. A no-op when the container
+    // isn't running — we just swallow any error and fall back to host.
+    try {
+        execFileSync('docker', ['cp', hostPath, `icoa-sandbox:/home/competitor/challenges/q${qNum}.txt`], {
+            stdio: 'ignore',
+            timeout: 3000,
+        });
+        return `challenges/q${qNum}.txt`;
+    }
+    catch {
+        return hostPath;
+    }
+}
+// Demo and real exam use separate state files so they don't block each other
+function stateFile() {
+    return join(getIcoaDir(), 'exam-state.json');
+}
+function demoStateFile() {
+    return join(getIcoaDir(), 'demo-state.json');
+}
+// Internal: pick the right file based on examId
+function resolveStateFile(examId) {
+    return examId === 'demo-free' ? demoStateFile() : stateFile();
+}
+export function getRealExamState() {
+    const f = stateFile();
+    if (!existsSync(f))
+        return null;
+    try {
+        const state = JSON.parse(readFileSync(f, 'utf-8'));
+        // Pre-v2.19.45 versions stored demo state in exam-state.json with
+        // examId='demo-free'. After v2.19.45 demo moved to demo-state.json.
+        // Ignore stale demo-tagged content found in the real-exam file —
+        // it's contamination from an old install. Also auto-clean the file.
+        if (state?.session?.examId === 'demo-free') {
+            try {
+                unlinkSync(f);
+            }
+            catch { }
+            return null;
+        }
+        return state;
+    }
+    catch {
+        return null;
+    }
+}
+export function getDemoState() {
+    const f = demoStateFile();
+    if (!existsSync(f))
+        return null;
+    try {
+        return JSON.parse(readFileSync(f, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function getExamState() {
+    // Real exam ALWAYS takes priority over demo when both exist.
+    // Reasoning: real exam is token-gated, has a timer, and represents a serious
+    // commitment. Demo is casual practice. If a real exam is in progress, all
+    // shared commands (exam q N, exam answer, ai4ctf, ctf4ai) must target the
+    // real exam — never silently fall back to demo questions, even if demo was
+    // run more recently. (Demo→Exam→Finals progression principle, exam.md §0)
+    const real = getRealExamState();
+    if (real)
+        return real;
+    return getDemoState();
+}
+export function saveExamState(state) {
+    const f = resolveStateFile(state.session.examId);
+    writeFileSync(f, JSON.stringify(state, null, 2));
+    // V16 (v2.19.181): exam-state.json holds session.token in plaintext.
+    // 0o600 so other users on shared hosts can't read it.
+    try {
+        chmodSync(f, 0o600);
+    }
+    catch {
+        /* ignore Windows / restricted FS */
+    }
+}
+export function clearExamState(examId) {
+    if (examId) {
+        const f = resolveStateFile(examId);
+        if (existsSync(f))
+            unlinkSync(f);
+    }
+    else {
+        // Clear the currently active exam
+        const state = getExamState();
+        if (state) {
+            const f = resolveStateFile(state.session.examId);
+            if (existsSync(f))
+                unlinkSync(f);
+        }
+    }
+}
+/** Pure: compute the deadline for a given exam state, or null if the
+ *  session has no time limit. Shared by getExamDeadline (priority-aware)
+ *  and getRealExamDeadline (real-exam file only). */
+function computeDeadline(state) {
+    if (!state.session.durationMinutes)
+        return null; // 0 = no time limit
+    // Preferred path: server-time sync succeeded at exam start. deadlineServerMs
+    // is the authoritative server-time moment of expiry. Convert back to local
+    // clock domain so existing callers (which compare against Date.now()) stay
+    // correct even if the local clock drifts from server.
+    const { deadlineServerMs, clockOffsetMs } = state.session;
+    if (typeof deadlineServerMs === 'number' && typeof clockOffsetMs === 'number') {
+        return new Date(deadlineServerMs - clockOffsetMs);
+    }
+    // Fallback: local-clock-only (pre-v2.19.85 behavior). Accurate as long as
+    // client and server clocks agree; off by the clock skew otherwise.
+    const startTime = state.session.confirmedAt || state.session.startedAt;
+    const start = new Date(startTime).getTime();
+    return new Date(start + state.session.durationMinutes * 60 * 1000);
+}
+export function getExamDeadline() {
+    const state = getExamState();
+    return state ? computeDeadline(state) : null;
+}
+/** Deadline read from the real-exam state file specifically, bypassing
+ *  getExamState()'s real-over-demo priority. Used by `exam demo` to
+ *  detect a parked expired real exam that would otherwise block demo. */
+export function getRealExamDeadline() {
+    const state = getRealExamState();
+    return state ? computeDeadline(state) : null;
+}
+/**
+ * Back-fill missing attachedData / description on practical questions by
+ * re-fetching from the server. Older state files (saved before v2.19.104)
+ * may have questions whose attachedData was dropped or never stored, leaving
+ * the contestant stuck on Q31-37 ("where is the attached file?"). This runs
+ * at most once per REPL session and is a no-op if:
+ *   - no session token is stored (can't authenticate the refetch)
+ *   - all practical questions already have attachedData
+ *   - the network is unreachable
+ * Returns the (possibly updated) state so callers can use it directly.
+ */
+let _resyncAttempted = false;
+export async function refetchQuestionDataIfStale() {
+    const state = getRealExamState();
+    if (!state)
+        return null;
+    if (_resyncAttempted)
+        return state;
+    const token = state.session.token;
+    if (!token)
+        return state;
+    // Only refetch if at least one practical question references attachedData
+    // but doesn't have it locally — otherwise we'd burn a server round-trip
+    // on every ai4ctf entry.
+    const needsRefetch = state.questions.some((q) => {
+        const isPractical = q.type === 'ai4ctf' || q.type === 'ctf4ai';
+        if (!isPractical)
+            return false;
+        const desc = String(q.description || '');
+        const mentionsAttached = desc.includes('attachedData') || /base64 blob/i.test(desc);
+        return mentionsAttached && !q.attachedData;
+    });
+    if (!needsRefetch)
+        return state;
+    _resyncAttempted = true;
+    try {
+        const { getConfig } = await import('./config.js');
+        const config = getConfig();
+        const serverUrl = config.ctfdUrl || 'https://practice.icoa2026.au';
+        const lang = config.language || 'en';
+        const res = await fetch(`${serverUrl}/api/icoa/exam-token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ token, deviceHash: '', lang }),
+            signal: AbortSignal.timeout(8000),
+        });
+        if (!res.ok)
+            return state;
+        const json = (await res.json());
+        const fresh = json?.data?.questions || [];
+        if (fresh.length === 0)
+            return state;
+        // Merge: for every local question, if the fresh copy has attachedData or
+        // a longer description, copy those fields in. Keep local answer state /
+        // eliminated options etc. untouched — we only patch read-only content.
+        const byNum = new Map();
+        for (const fq of fresh)
+            byNum.set(fq.number, fq);
+        let patched = 0;
+        for (const q of state.questions) {
+            const fq = byNum.get(q.number);
+            if (!fq)
+                continue;
+            if (fq.attachedData && !q.attachedData) {
+                q.attachedData = fq.attachedData;
+                patched++;
+            }
+            if (fq.description && (!q.description || fq.description.length > q.description.length)) {
+                q.description = fq.description;
+            }
+        }
+        if (patched > 0)
+            saveExamState(state);
+        return state;
+    }
+    catch {
+        return state;
+    }
+}