icoa-cli 2.19.348 → 2.19.349

package/dist/lib/kernel.js

@@ -1,4 +1,28 @@
-import{spawn as e}from"node:child_process";import{writeFileSync as t}from"node:fs";import{join as i}from"node:path";import{foldCellOutputs as n,parseKernelEvent as r}from"./kernel-protocol.js";export const KERNEL_BRIDGE_PY=String.raw`import sys, os, json, queue
+/**
+ * NotebookKernel — the Node driver for a Jupyter kernel, Phase 1 of the CLI
+ * notebook arena (see `project_cli_notebook_arena_plan`).
+ *
+ * icoa (Node) can't talk to a Jupyter kernel directly, so we spawn a small
+ * Python BRIDGE under the aienv venv. The bridge owns the kernel via
+ * `jupyter_client` and exchanges line-delimited JSON with us (parsed by
+ * `kernel-protocol.ts`). This keeps the kernel a PLUGGABLE backend: Phase 1
+ * runs it locally; Phase 2/4 point the same bridge at a remote Kernel Gateway
+ * with zero change to the Node side.
+ *
+ * Isolation: the bridge runs as `<venv>/bin/python`, and it registers its
+ * kernelspec INSIDE the venv's own `share/jupyter` tree — so the kernel is the
+ * venv interpreter, never the system python3 (BUG3 invariant), and nothing is
+ * written outside the venv. On posix the kernel uses IPC transport (unix
+ * sockets) so it opens no TCP ports.
+ */
+import { spawn } from 'node:child_process';
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { foldCellOutputs, parseKernelEvent } from './kernel-protocol.js';
+// The bridge. Ships as a string (like sample-runner's RUNNER_PY) and is written
+// next to the venv at start. stdout carries ONLY protocol JSON; kernel/runtime
+// chatter stays on the kernel subprocess's own stderr.
+export const KERNEL_BRIDGE_PY = String.raw `import sys, os, json, queue
 
 def emit(o):
     sys.stdout.write(json.dumps(o) + "\n")
@@ -78,4 +102,124 @@ def main():
     os._exit(0)
 
 main()
-`;export class NotebookKernel{proc=null;buf="";nextId=1;ready=!1;pending=null;onReady=null;onExit=null;opts;bridgePath;constructor(e){this.opts=e,this.bridgePath=i(e.venvRoot,"icoa-kernel-bridge.py")}start(){this.buf="",this.ready=!1,this.pending=null,this.nextId=1,t(this.bridgePath,KERNEL_BRIDGE_PY);const i=e(this.opts.venvPython,[this.bridgePath],{stdio:["pipe","pipe","pipe"]});this.proc=i,i.stdout.setEncoding("utf-8"),i.stdout.on("data",e=>this.onStdout(e)),i.on("exit",()=>{this.ready=!1,this.onExit?.()});const n=this.opts.readyTimeoutMs??6e4;return new Promise((e,t)=>{const i=setTimeout(()=>t(new Error("kernel did not become ready in time")),n);this.onReady=()=>{clearTimeout(i),e()},this.onExit=()=>{clearTimeout(i),this.ready||t(new Error("kernel process exited before ready"))}})}execute(e){if(!this.proc||!this.ready)return Promise.reject(new Error("kernel not ready"));if(this.pending)return Promise.reject(new Error("a cell is already executing"));const t=this.nextId++;return new Promise(i=>{this.pending={id:t,events:[],resolve:i},this.proc?.stdin.write(`${JSON.stringify({id:t,code:e})}\n`)})}shutdown(){const e=this.proc;return e?new Promise(t=>{this.onExit=()=>t();try{e.stdin.write(`${JSON.stringify({cmd:"shutdown"})}\n`)}catch{e.kill()}setTimeout(()=>{this.proc&&(this.proc.kill(),t())},5e3)}):Promise.resolve()}onStdout(e){this.buf+=e;let t=this.buf.indexOf("\n");for(;-1!==t;){const e=this.buf.slice(0,t);this.buf=this.buf.slice(t+1),this.handleEvent(r(e)),t=this.buf.indexOf("\n")}}handleEvent(e){if(!e)return;if("ready"===e.type)return this.ready=!0,void this.onReady?.();const t=this.pending;if(t){if("done"===e.type){if(e.id!==t.id)return;const i=n(t.events.concat(e));return this.pending=null,void t.resolve(i)}t.events.push(e)}}}
+`;
+/**
+ * A live notebook kernel. Executes are serialized (one cell at a time, as a
+ * notebook does) so the line-buffered output demux stays unambiguous.
+ */
+export class NotebookKernel {
+    proc = null;
+    buf = '';
+    nextId = 1;
+    ready = false;
+    // Resolver for the in-flight cell (id → its event accumulator + resolve fn).
+    pending = null;
+    onReady = null;
+    onExit = null;
+    opts;
+    bridgePath;
+    constructor(opts) {
+        this.opts = opts;
+        this.bridgePath = join(opts.venvRoot, 'icoa-kernel-bridge.py');
+    }
+    /**
+     * Write the bridge + spawn it; resolves once the kernel reports `ready`.
+     * Safe to call again after shutdown() to get a fresh kernel (restart) — all
+     * per-run state is reset here.
+     */
+    start() {
+        this.buf = '';
+        this.ready = false;
+        this.pending = null;
+        this.nextId = 1;
+        writeFileSync(this.bridgePath, KERNEL_BRIDGE_PY);
+        const proc = spawn(this.opts.venvPython, [this.bridgePath], {
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        this.proc = proc;
+        proc.stdout.setEncoding('utf-8');
+        proc.stdout.on('data', (chunk) => this.onStdout(chunk));
+        proc.on('exit', () => {
+            this.ready = false;
+            this.onExit?.();
+        });
+        const timeoutMs = this.opts.readyTimeoutMs ?? 60000;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => reject(new Error('kernel did not become ready in time')), timeoutMs);
+            this.onReady = () => {
+                clearTimeout(timer);
+                resolve();
+            };
+            this.onExit = () => {
+                clearTimeout(timer);
+                if (!this.ready)
+                    reject(new Error('kernel process exited before ready'));
+            };
+        });
+    }
+    /** Run one cell; resolves with its folded outputs after the `done` event. */
+    execute(code) {
+        if (!this.proc || !this.ready)
+            return Promise.reject(new Error('kernel not ready'));
+        if (this.pending)
+            return Promise.reject(new Error('a cell is already executing'));
+        const id = this.nextId++;
+        return new Promise((resolve) => {
+            this.pending = { id, events: [], resolve };
+            this.proc?.stdin.write(`${JSON.stringify({ id, code })}\n`);
+        });
+    }
+    /** Ask the bridge to shut the kernel down; resolves when the process exits. */
+    shutdown() {
+        const proc = this.proc;
+        if (!proc)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            this.onExit = () => resolve();
+            try {
+                proc.stdin.write(`${JSON.stringify({ cmd: 'shutdown' })}\n`);
+            }
+            catch {
+                proc.kill();
+            }
+            // Hard backstop if the bridge ignores us.
+            setTimeout(() => {
+                if (this.proc) {
+                    this.proc.kill();
+                    resolve();
+                }
+            }, 5000);
+        });
+    }
+    onStdout(chunk) {
+        this.buf += chunk;
+        let nl = this.buf.indexOf('\n');
+        while (nl !== -1) {
+            const line = this.buf.slice(0, nl);
+            this.buf = this.buf.slice(nl + 1);
+            this.handleEvent(parseKernelEvent(line));
+            nl = this.buf.indexOf('\n');
+        }
+    }
+    handleEvent(ev) {
+        if (!ev)
+            return;
+        if (ev.type === 'ready') {
+            this.ready = true;
+            this.onReady?.();
+            return;
+        }
+        const p = this.pending;
+        if (!p)
+            return; // event outside any execution (shouldn't happen) — ignore
+        if (ev.type === 'done') {
+            if (ev.id !== p.id)
+                return;
+            const folded = foldCellOutputs(p.events.concat(ev));
+            this.pending = null;
+            p.resolve(folded);
+            return;
+        }
+        p.events.push(ev);
+    }
+}

package/dist/lib/learn-curricula.js

@@ -1 +1,309 @@
-export function localized(r,t){if(!t.startsWith("zh")||!r._zh)return r;const e=r._zh,c={...r};for(const r of Object.keys(e))void 0!==e[r]&&(c[r]=e[r]);return c}export function isValidCurriculum(r){if(!r||"object"!=typeof r)return!1;const t=r;return"string"==typeof t.id&&"number"==typeof t.totalCards&&Array.isArray(t.cards)&&Array.isArray(t.modules)}import{readFileSync as r,writeFileSync as t,mkdirSync as e,existsSync as c,statSync as n,utimesSync as a}from"node:fs";import{join as i}from"node:path";import{homedir as o}from"node:os";const u=i(o(),".icoa","learn-cache"),s="https://practice.icoa2026.au";function l(r){const t=r.replace(/[^A-Za-z0-9_-]/g,"_");return i(u,`${t}.json`)}function d(r){const t=r.replace(/[^A-Za-z0-9_-]/g,"_");return i(u,`${t}.etag`)}export async function loadCurriculumById(i){"ctf4eai-12"===i&&(i="LEARNDEMO01");const o=function(t){const e=l(t);if(!c(e))return null;try{const t=n(e),c=Date.now()-t.mtimeMs;return{curriculum:JSON.parse(r(e,"utf-8")),ageMs:c}}catch{return null}}(i);if(o&&o.ageMs<6048e5&&isValidCurriculum(o.curriculum))return o.curriculum;const m=await async function(t){const e=s.replace(/\/$/,"")+"/api/icoa/learn/curriculum/"+encodeURIComponent(t),n={},a=function(t){const e=d(t);if(!c(e))return null;try{return r(e,"utf-8").trim()||null}catch{return null}}(t);a&&(n["If-None-Match"]=a);try{const r=await fetch(e,{headers:n,signal:AbortSignal.timeout(6e4)});if(304===r.status)return{kind:"unchanged"};if(!r.ok)return{kind:"error"};const t=await r.json();if(!t.success||!t.data)return{kind:"error"};if(!isValidCurriculum(t.data))return{kind:"error"};const c=r.headers.get("etag")||r.headers.get("ETag")||void 0;return{kind:"fresh",curriculum:t.data,etag:c||void 0}}catch{return{kind:"error"}}}(i);return"fresh"===m.kind?(function(r,c,n){try{e(u,{recursive:!0}),t(l(r),JSON.stringify(c)),n&&t(d(r),n)}catch{}}(i,m.curriculum,m.etag),m.curriculum):"unchanged"===m.kind&&o&&isValidCurriculum(o.curriculum)?(function(r){try{const t=l(r);if(c(t)){const r=Date.now()/1e3;a(t,r,r)}}catch{}}(i),o.curriculum):o&&isValidCurriculum(o.curriculum)?o.curriculum:null}export async function validateEAToken(r){const t=s.replace(/\/$/,"")+"/api/icoa/learn/validate";try{const e=await fetch(t,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({token:r.toUpperCase()}),signal:AbortSignal.timeout(8e3)});if(!e.ok)return{ok:!1,message:(await e.json().catch(()=>({}))).message||`HTTP ${e.status}`};const c=await e.json();return c.success&&c.data?{ok:!0,curriculumId:c.data.curriculum_id,status:c.data.status,validUntil:c.data.valid_until}:{ok:!1,message:c.message||"Validation failed"}}catch(r){return{ok:!1,message:`Network error: ${r instanceof Error?r.message:String(r)}`}}}export async function syncProgress(r,t){if("LEARNDEMO01"===r.toUpperCase())return;const e=s.replace(/\/$/,"")+"/api/icoa/learn/progress/"+r.toUpperCase();try{await fetch(e,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({card_number:t.card_number,event_type:t.event_type,mcq_answer:t.mcq_answer,mcq_correct:t.mcq_correct?1:0,check_answer:t.check_answer,check_correct:t.check_correct?1:0,time_on_card_ms:t.time_on_card_ms}),signal:AbortSignal.timeout(5e3)})}catch{}}export async function syncCardFeedback(r,t){const e=s.replace(/\/$/,"")+"/api/icoa/learn/feedback/"+r.toUpperCase();try{await fetch(e,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({curriculum_id:t.curriculum_id,card_number:t.card_number,feedback_text:t.feedback_text,time_on_card_ms:t.time_on_card_ms}),signal:AbortSignal.timeout(5e3)})}catch{}}
+/**
+ * Learn-mode curriculum content.
+ *
+ * Phase 0: hardcoded LEARNDEMO01 (n=10 cards, free for everyone).
+ * Phase 1+: full EAxxxxxxxx tokens load curriculum from server.
+ *
+ * Card types:
+ *   knowledge   — text + diagram + "ok / next" to advance
+ *   mcq         — 4-choice question with instant feedback + explanation
+ *   practical   — drop into sandbox Python, return when done
+ *   sim_demo    — open MuJoCo viewer, watch action play out
+ *   milestone   — section completion celebration with ASCII trophy
+ */
+/** Returns a copy of `card` with locale-aware fields applied.
+ *
+ *  As of v2.19.204, all curriculum content is fetched from the server
+ *  with _zh and check fields already merged (see panda/seed-server-curricula.js).
+ *  This function just picks the localised text out of card._zh when
+ *  the requested locale starts with 'zh'. The auto-overlay maps that
+ *  used to live in learn-phases-zh.ts and learn-phases-checks.ts are
+ *  no longer client-side — they were merged at seed time.
+ *
+ *  Spread-then-merge keeps undefined keys clean. */
+export function localized(card, lang) {
+    if (!lang.startsWith('zh') || !card._zh)
+        return card;
+    const zh = card._zh;
+    const out = { ...card };
+    for (const k of Object.keys(zh)) {
+        if (zh[k] !== undefined)
+            out[k] = zh[k];
+    }
+    return out;
+}
+/**
+ * Shape guard for a server curriculum payload.
+ *
+ * The learn-validate + curriculum endpoints are lenient: a NON-learn token
+ * (e.g. an EXAM token typed into `learn`) can return success:true with a
+ * payload that is not a curriculum. Before this guard, fetchCurriculum cast it
+ * straight to Curriculum, it passed the `!curriculum` null-check in learn.ts,
+ * then renderWelcome/newLearnState read `.cards` / `.totalCards` on undefined →
+ * TypeError → uncaught → worker exit → "validating… processing… <crash> menu".
+ *
+ * Returning false makes loadCurriculumById yield null, so learn.ts shows a
+ * clean error instead of crashing. Checks only stable core fields.
+ */
+export function isValidCurriculum(data) {
+    if (!data || typeof data !== 'object')
+        return false;
+    const c = data;
+    return (typeof c.id === 'string' && typeof c.totalCards === 'number' && Array.isArray(c.cards) && Array.isArray(c.modules));
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// v2.19.204: Card content moved server-side
+//
+// All curricula (demos + 96 + 360, including LEARNDEMO01) are stored on
+// the server in `learn.db.curricula` and fetched via
+// GET /api/icoa/learn/curriculum/<id>. Client caches in ~/.icoa/learn-cache/
+// to keep cold-start fast and survive brief server outages.
+//
+// Cache strategy:
+//   - On every loadCurriculumById(id), check ~/.icoa/learn-cache/<id>.json
+//   - If cached AND ageMs < CACHE_TTL_MS, return cached immediately
+//   - Else fetch from server, write cache, return
+//   - If fetch fails AND cache exists (stale OK in this case), return cached
+//   - If fetch fails AND no cache, return null
+//
+// LEARNDEMO01 is no longer baked into the bundle — first-ever launch
+// requires network, but subsequent runs (with cache) are offline-ok.
+// ─────────────────────────────────────────────────────────────────────────────
+import { readFileSync, writeFileSync, mkdirSync, existsSync, statSync, utimesSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const CACHE_DIR = join(homedir(), '.icoa', 'learn-cache');
+const CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days — content rarely changes
+// Learn is token-only (no login/join) and ALL learn tokens + curricula live on
+// the canonical learn server (practice). Every learn call below is pinned to
+// LEARN_SERVER and deliberately ignores cfg.ctfdUrl — a learner who joined a
+// competition box (mel/au.icoa2026.au, which has no learn data) must still learn.
+// Token access stays server-authoritative: practice validates the token; no
+// valid token → no curriculum_id → no access. Pinning the host changes WHO we
+// ask, never WHETHER the token is checked.
+const LEARN_SERVER = 'https://practice.icoa2026.au';
+// Curriculum bodies are large (360-tier ≈ 2.8 MB). The target cohort spans
+// low-bandwidth nations; a 10 s cap aborted the download mid-stream on slow
+// links (≈2.3 Mbps needed for 2.8 MB/10 s) → null → "Failed to fetch
+// curriculum". 60 s covers ~50 KB/s links. An unreachable host still fails
+// fast at connect; this only extends the budget for slow-but-live downloads.
+const CURRICULUM_FETCH_TIMEOUT_MS = 60000;
+function cachePath(id) {
+    // Sanitize id for filename — only allow [A-Za-z0-9_-]
+    const safe = id.replace(/[^A-Za-z0-9_-]/g, '_');
+    return join(CACHE_DIR, `${safe}.json`);
+}
+function etagPath(id) {
+    const safe = id.replace(/[^A-Za-z0-9_-]/g, '_');
+    return join(CACHE_DIR, `${safe}.etag`);
+}
+function readCache(id) {
+    const p = cachePath(id);
+    if (!existsSync(p))
+        return null;
+    try {
+        const stat = statSync(p);
+        const ageMs = Date.now() - stat.mtimeMs;
+        const curriculum = JSON.parse(readFileSync(p, 'utf-8'));
+        return { curriculum, ageMs };
+    }
+    catch {
+        return null;
+    }
+}
+function readEtag(id) {
+    const p = etagPath(id);
+    if (!existsSync(p))
+        return null;
+    try {
+        return readFileSync(p, 'utf-8').trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(id, curriculum, etag) {
+    try {
+        mkdirSync(CACHE_DIR, { recursive: true });
+        writeFileSync(cachePath(id), JSON.stringify(curriculum));
+        if (etag)
+            writeFileSync(etagPath(id), etag);
+    }
+    catch {
+        // Cache write failure is non-fatal; we just refetch next time.
+    }
+}
+function touchCache(id) {
+    // After a 304, mark the cached file fresh so the TTL window resets.
+    try {
+        const p = cachePath(id);
+        if (existsSync(p)) {
+            const now = Date.now() / 1000;
+            utimesSync(p, now, now);
+        }
+    }
+    catch {
+        // non-fatal
+    }
+}
+async function fetchCurriculum(id) {
+    // Always the canonical learn server — never cfg.ctfdUrl. See LEARN_SERVER note.
+    const url = LEARN_SERVER.replace(/\/$/, '') + '/api/icoa/learn/curriculum/' + encodeURIComponent(id);
+    const headers = {};
+    const prevEtag = readEtag(id);
+    if (prevEtag)
+        headers['If-None-Match'] = prevEtag;
+    try {
+        const r = await fetch(url, {
+            headers,
+            signal: AbortSignal.timeout(CURRICULUM_FETCH_TIMEOUT_MS),
+        });
+        if (r.status === 304)
+            return { kind: 'unchanged' };
+        if (!r.ok)
+            return { kind: 'error' };
+        const j = (await r.json());
+        if (!j.success || !j.data)
+            return { kind: 'error' };
+        // Reject a JSON-valid but non-curriculum payload (e.g. a non-learn token
+        // that the server accepted) so it never gets cached or rendered.
+        if (!isValidCurriculum(j.data))
+            return { kind: 'error' };
+        const newEtag = r.headers.get('etag') || r.headers.get('ETag') || undefined;
+        return { kind: 'fresh', curriculum: j.data, etag: newEtag || undefined };
+    }
+    catch {
+        return { kind: 'error' };
+    }
+}
+/**
+ * Resolves a curriculum by id. Order:
+ *   1. Fresh cache (< 7 days)        → instant return, no network
+ *   2. Server fetch + cache write    → if reachable; uses If-None-Match
+ *      304 Not Modified              → cache content unchanged, just refresh mtime
+ *      200 OK                        → rewrite cache + etag
+ *   3. Stale cache as fallback       → if server unreachable but cache exists
+ *   4. null                          → no cache, no server
+ */
+export async function loadCurriculumById(id) {
+    // Backward-compat alias: ctf4eai-12 maps to LEARNDEMO01 on the server.
+    if (id === 'ctf4eai-12')
+        id = 'LEARNDEMO01';
+    // 1. Fresh cache — only if it is actually a curriculum (a past bad write or
+    //    a non-learn token's payload must never be returned as one).
+    const cached = readCache(id);
+    if (cached && cached.ageMs < CACHE_TTL_MS && isValidCurriculum(cached.curriculum)) {
+        return cached.curriculum;
+    }
+    // 2. Server fetch (fetchCurriculum already shape-checks before 'fresh')
+    const result = await fetchCurriculum(id);
+    if (result.kind === 'fresh') {
+        writeCache(id, result.curriculum, result.etag);
+        return result.curriculum;
+    }
+    if (result.kind === 'unchanged' && cached && isValidCurriculum(cached.curriculum)) {
+        // Server says content is the same as what we have. Treat as fresh.
+        touchCache(id);
+        return cached.curriculum;
+    }
+    // 3. Stale cache fallback
+    if (cached && isValidCurriculum(cached.curriculum)) {
+        return cached.curriculum;
+    }
+    return null;
+}
+export async function validateEAToken(token) {
+    // Always validates against the canonical learn server — never cfg.ctfdUrl.
+    // A learn token is registered on practice; a competition box returns
+    // "Not found". See the LEARN_SERVER note for why this is safe.
+    const url = LEARN_SERVER.replace(/\/$/, '') + '/api/icoa/learn/validate';
+    try {
+        const r = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ token: token.toUpperCase() }),
+            signal: AbortSignal.timeout(8000),
+        });
+        if (!r.ok) {
+            const err = (await r.json().catch(() => ({})));
+            return { ok: false, message: err.message || `HTTP ${r.status}` };
+        }
+        const data = (await r.json());
+        if (!data.success || !data.data) {
+            return { ok: false, message: data.message || 'Validation failed' };
+        }
+        return {
+            ok: true,
+            curriculumId: data.data.curriculum_id,
+            status: data.data.status,
+            validUntil: data.data.valid_until,
+        };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { ok: false, message: `Network error: ${msg}` };
+    }
+}
+/**
+ * Best-effort progress sync to server. Silent failure — local state is
+ * always authoritative; server is for cross-device persistence + analytics.
+ */
+export async function syncProgress(token, event) {
+    if (token.toUpperCase() === 'LEARNDEMO01')
+        return; // demo is local-only
+    // Progress is recorded where the token lives — the canonical learn server.
+    const url = LEARN_SERVER.replace(/\/$/, '') + '/api/icoa/learn/progress/' + token.toUpperCase();
+    try {
+        await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                card_number: event.card_number,
+                event_type: event.event_type,
+                mcq_answer: event.mcq_answer,
+                mcq_correct: event.mcq_correct ? 1 : 0,
+                check_answer: event.check_answer,
+                check_correct: event.check_correct ? 1 : 0,
+                time_on_card_ms: event.time_on_card_ms,
+            }),
+            signal: AbortSignal.timeout(5000),
+        });
+    }
+    catch {
+        // Silent — local state still saved
+    }
+}
+/**
+ * Best-effort card-feedback submission (the `e` "report a problem" channel).
+ * Crowdsourced card QA — a learner flags an error/confusion on a card; we
+ * record it server-side bound to (curriculum_id, card_number) so the author
+ * team can triage. Fire-and-forget, same contract as syncProgress.
+ *
+ * Unlike syncProgress, demo (LEARNDEMO01) feedback IS sent — the demo is the
+ * highest-traffic curriculum, so its cards benefit most from crowdsourced QA.
+ * The server records feedback for any token-shaped string (no learn_tokens
+ * membership required; feedback is low-risk user text).
+ *
+ * Card identity is the (curriculum_id, card_number) composite — card numbers
+ * are curriculum-LOCAL, so curriculum_id is required to disambiguate.
+ */
+export async function syncCardFeedback(token, payload) {
+    // Feedback is recorded on the canonical learn server alongside the curriculum.
+    const url = LEARN_SERVER.replace(/\/$/, '') + '/api/icoa/learn/feedback/' + token.toUpperCase();
+    try {
+        await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                curriculum_id: payload.curriculum_id,
+                card_number: payload.card_number,
+                feedback_text: payload.feedback_text,
+                time_on_card_ms: payload.time_on_card_ms,
+            }),
+            signal: AbortSignal.timeout(5000),
+        });
+    }
+    catch {
+        // Silent — feedback is best-effort
+    }
+}

package/dist/lib/learn-i18n.js

@@ -1 +1,184 @@
-const e={academy_title:"ICOA Embodied AI Security Academy",welcome_new_demo:"Welcome — this is the free demo.",welcome_new:"Welcome — your curriculum is ready.",welcome_back:"Welcome back — last seen",just_now:"just now",ago_hours:"h ago",ago_days:"d ago",module:"Module:",progress:"Progress:",streak:"Streak:",next_card:"Next card:",of:"of",continue_start:"start the curriculum",continue_resume:"resume at card",status_label:"continue",status_desc:"     ",status_full:"full progress dashboard",bookmarks_label:"bookmarks",bookmarks_desc:"cards bookmarked for review",quit_label:"quit",quit_desc:"exit learn mode",card:"Card",unknown_module:"Unknown",press_ok_continue:"Press",to_continue:"to continue",ok:"ok",next:"next",bookmark:"bookmark",bookmark_desc:"mark for later review",back:"back",back_desc:"previous card",continue_to_next:"continue to next card",icoa_connection:"ICOA connection",type_to_answer:"to answer",correct:"✓ Correct!",one_point:"+1 point",not_quite:"✗ Not quite.",you_chose:"You chose",answer_is:"the answer is",explanation:"Explanation:",mcq_accuracy_so_far:"MCQ accuracy so far:",try_in_sandbox:"Try it in the sandbox:",drops_into_python:"(drops you into Python REPL)",when_done:"When you're done:",done_label:"done",done_desc:"I figured it out — show me the answer",skip_label:"skip",skip_desc:"skip (counts as incomplete)",practical_recorded:"✓ Practical recorded",reference_answer:"Reference answer:",starter_code:"Starter code (copy + edit in your editor or sandbox):",sim_launch_label:"sim",sim_launch_desc:"launch MuJoCo viewer, watch Franka arm",sim_play_action:"play out action:",sim_skip_desc:"skip simulation, continue to next card",sim_requires:"(Requires: pip install mujoco; or use icoa/sandbox-vla)",milestone_header:"✦ ✦ ✦  MILESTONE  ✦ ✦ ✦",in_wild_corresponds:"In the wild, this level corresponds to:",whats_next:"What's next:",demo_complete:"Demo complete! 🎉",unlock_full:"To unlock the full",curriculum_name:"n=480 PhD-entry curriculum",contact_team_leader:"contact your country's team leader to request an",ea_token:"EA",learn_token:"learn token,",or_email:"or email",for_partnership:"for ICOA partnership.",type_quit:"Type",to_exit:"to exit, or",for_dashboard:"for the dashboard.",status_title:"ICOA Embodied AI Security — Status",total_progress:"Total progress:",longest:"longest:",mcq_accuracy:"MCQ accuracy:",practicals_done:"Practicals done:",bookmarked:"Bookmarked:",achievements:"Achievements:",achievements_none:"Achievements: none yet — push to the first milestone!"},o={academy_title:"ICOA 具身智能安全学院",welcome_new_demo:"欢迎 —— 这是免费 demo。",welcome_new:"欢迎 —— 你的课程已就绪。",welcome_back:"欢迎回来 —— 上次访问",just_now:"刚才",ago_hours:"小时前",ago_days:"天前",module:"模块:",progress:"进度:",streak:"连续天数:",next_card:"下一张卡:",of:"/",continue_start:"开始课程",continue_resume:"继续到卡",status_label:"continue",status_desc:"     ",status_full:"完整进度面板",bookmarks_label:"bookmarks",bookmarks_desc:"张卡标记待复习",quit_label:"quit",quit_desc:"退出学习模式",card:"卡片",unknown_module:"未知",press_ok_continue:"按",to_continue:"继续",ok:"ok",next:"next",bookmark:"bookmark",bookmark_desc:"标记本卡待复习",back:"back",back_desc:"回到上一张卡",continue_to_next:"进入下一张卡",icoa_connection:"ICOA 关联",type_to_answer:"作答",correct:"✓ 正确!",one_point:"+1 分",not_quite:"✗ 差一点。",you_chose:"你选了",answer_is:"正确答案是",explanation:"解析:",mcq_accuracy_so_far:"目前选择题准确率:",try_in_sandbox:"在沙盒里试一下:",drops_into_python:"(进入 Python REPL)",when_done:"搞定后:",done_label:"done",done_desc:"我想出来了 —— 给我看答案",skip_label:"skip",skip_desc:"跳过 (计为未完成)",practical_recorded:"✓ 实操已记录",reference_answer:"参考答案:",starter_code:"起始代码 (复制到你的编辑器或沙盒里改):",sim_launch_label:"sim",sim_launch_desc:"打开 MuJoCo,观察 Franka 机械臂",sim_play_action:"执行动作:",sim_skip_desc:"跳过仿真,进入下一张卡",sim_requires:"(需要: pip install mujoco; 或用 icoa/sandbox-vla)",milestone_header:"✦ ✦ ✦  里程碑  ✦ ✦ ✦",in_wild_corresponds:"在真实世界,这个水平对应:",whats_next:"接下来:",demo_complete:"Demo 完成! 🎉",unlock_full:"想解锁完整的",curriculum_name:"n=480 博士级先锋课程",contact_team_leader:"联系你所在国家的领队申请",ea_token:"EA",learn_token:"learn token,",or_email:"或邮件至",for_partnership:"洽谈 ICOA 合作。",type_quit:"输入",to_exit:"退出,或",for_dashboard:"查看面板。",status_title:"ICOA 具身智能安全 —— 状态",total_progress:"总进度:",longest:"最长:",mcq_accuracy:"选择题准确率:",practicals_done:"已完成实操:",bookmarked:"已收藏:",achievements:"成就:",achievements_none:"成就: 还没有 —— 冲到第一个里程碑!"};export function t(a,n){return(n.startsWith("zh")?o:e)[a]??e[a]??a}
+/**
+ * Chrome (UI scaffolding) i18n for learn mode.
+ *
+ * Card *content* localisation lives on each card via the `_zh` field on
+ * Card types (see learn-curricula.ts). This file is for the rendered
+ * frame around the content: welcome screen labels, prompts, dashboards.
+ */
+const EN = {
+    // Welcome screen
+    academy_title: 'ICOA Embodied AI Security Academy',
+    welcome_new_demo: 'Welcome — this is the free demo.',
+    welcome_new: 'Welcome — your curriculum is ready.',
+    welcome_back: 'Welcome back — last seen',
+    just_now: 'just now',
+    ago_hours: 'h ago',
+    ago_days: 'd ago',
+    module: 'Module:',
+    progress: 'Progress:',
+    streak: 'Streak:',
+    next_card: 'Next card:',
+    of: 'of',
+    continue_start: 'start the curriculum',
+    continue_resume: 'resume at card',
+    status_label: 'continue',
+    status_desc: '     ',
+    status_full: 'full progress dashboard',
+    bookmarks_label: 'bookmarks',
+    bookmarks_desc: 'cards bookmarked for review',
+    quit_label: 'quit',
+    quit_desc: 'exit learn mode',
+    // Card chrome
+    card: 'Card',
+    unknown_module: 'Unknown',
+    press_ok_continue: 'Press',
+    to_continue: 'to continue',
+    ok: 'ok',
+    next: 'next',
+    bookmark: 'bookmark',
+    bookmark_desc: 'mark for later review',
+    back: 'back',
+    back_desc: 'previous card',
+    continue_to_next: 'continue to next card',
+    icoa_connection: 'ICOA connection',
+    // MCQ
+    type_to_answer: 'to answer',
+    correct: '✓ Correct!',
+    one_point: '+1 point',
+    not_quite: '✗ Not quite.',
+    you_chose: 'You chose',
+    answer_is: 'the answer is',
+    explanation: 'Explanation:',
+    mcq_accuracy_so_far: 'MCQ accuracy so far:',
+    // Practical
+    try_in_sandbox: 'Try it in the sandbox:',
+    drops_into_python: '(drops you into Python REPL)',
+    when_done: "When you're done:",
+    done_label: 'done',
+    done_desc: 'I figured it out — show me the answer',
+    skip_label: 'skip',
+    skip_desc: 'skip (counts as incomplete)',
+    practical_recorded: '✓ Practical recorded',
+    reference_answer: 'Reference answer:',
+    starter_code: 'Starter code (copy + edit in your editor or sandbox):',
+    // sim_demo
+    sim_launch_label: 'sim',
+    sim_launch_desc: 'launch MuJoCo viewer, watch Franka arm',
+    sim_play_action: 'play out action:',
+    sim_skip_desc: 'skip simulation, continue to next card',
+    sim_requires: '(Requires: pip install mujoco; or use icoa/sandbox-vla)',
+    // Milestone
+    milestone_header: '✦ ✦ ✦  MILESTONE  ✦ ✦ ✦',
+    in_wild_corresponds: 'In the wild, this level corresponds to:',
+    whats_next: "What's next:",
+    demo_complete: 'Demo complete! 🎉',
+    unlock_full: 'To unlock the full',
+    curriculum_name: 'n=480 PhD-entry curriculum',
+    contact_team_leader: "contact your country's team leader to request an",
+    ea_token: 'EA',
+    learn_token: 'learn token,',
+    or_email: 'or email',
+    for_partnership: 'for ICOA partnership.',
+    type_quit: 'Type',
+    to_exit: 'to exit, or',
+    for_dashboard: 'for the dashboard.',
+    // Status dashboard
+    status_title: 'ICOA Embodied AI Security — Status',
+    total_progress: 'Total progress:',
+    longest: 'longest:',
+    mcq_accuracy: 'MCQ accuracy:',
+    practicals_done: 'Practicals done:',
+    bookmarked: 'Bookmarked:',
+    achievements: 'Achievements:',
+    achievements_none: 'Achievements: none yet — push to the first milestone!',
+};
+const ZH = {
+    academy_title: 'ICOA 具身智能安全学院',
+    welcome_new_demo: '欢迎 —— 这是免费 demo。',
+    welcome_new: '欢迎 —— 你的课程已就绪。',
+    welcome_back: '欢迎回来 —— 上次访问',
+    just_now: '刚才',
+    ago_hours: '小时前',
+    ago_days: '天前',
+    module: '模块:',
+    progress: '进度:',
+    streak: '连续天数:',
+    next_card: '下一张卡:',
+    of: '/',
+    continue_start: '开始课程',
+    continue_resume: '继续到卡',
+    status_label: 'continue',
+    status_desc: '     ',
+    status_full: '完整进度面板',
+    bookmarks_label: 'bookmarks',
+    bookmarks_desc: '张卡标记待复习',
+    quit_label: 'quit',
+    quit_desc: '退出学习模式',
+    // Card chrome
+    card: '卡片',
+    unknown_module: '未知',
+    press_ok_continue: '按',
+    to_continue: '继续',
+    ok: 'ok',
+    next: 'next',
+    bookmark: 'bookmark',
+    bookmark_desc: '标记本卡待复习',
+    back: 'back',
+    back_desc: '回到上一张卡',
+    continue_to_next: '进入下一张卡',
+    icoa_connection: 'ICOA 关联',
+    // MCQ
+    type_to_answer: '作答',
+    correct: '✓ 正确!',
+    one_point: '+1 分',
+    not_quite: '✗ 差一点。',
+    you_chose: '你选了',
+    answer_is: '正确答案是',
+    explanation: '解析:',
+    mcq_accuracy_so_far: '目前选择题准确率:',
+    // Practical
+    try_in_sandbox: '在沙盒里试一下:',
+    drops_into_python: '(进入 Python REPL)',
+    when_done: '搞定后:',
+    done_label: 'done',
+    done_desc: '我想出来了 —— 给我看答案',
+    skip_label: 'skip',
+    skip_desc: '跳过 (计为未完成)',
+    practical_recorded: '✓ 实操已记录',
+    reference_answer: '参考答案:',
+    starter_code: '起始代码 (复制到你的编辑器或沙盒里改):',
+    // sim_demo
+    sim_launch_label: 'sim',
+    sim_launch_desc: '打开 MuJoCo,观察 Franka 机械臂',
+    sim_play_action: '执行动作:',
+    sim_skip_desc: '跳过仿真,进入下一张卡',
+    sim_requires: '(需要: pip install mujoco; 或用 icoa/sandbox-vla)',
+    // Milestone
+    milestone_header: '✦ ✦ ✦  里程碑  ✦ ✦ ✦',
+    in_wild_corresponds: '在真实世界,这个水平对应:',
+    whats_next: '接下来:',
+    demo_complete: 'Demo 完成! 🎉',
+    unlock_full: '想解锁完整的',
+    curriculum_name: 'n=480 博士级先锋课程',
+    contact_team_leader: '联系你所在国家的领队申请',
+    ea_token: 'EA',
+    learn_token: 'learn token,',
+    or_email: '或邮件至',
+    for_partnership: '洽谈 ICOA 合作。',
+    type_quit: '输入',
+    to_exit: '退出,或',
+    for_dashboard: '查看面板。',
+    // Status dashboard
+    status_title: 'ICOA 具身智能安全 —— 状态',
+    total_progress: '总进度:',
+    longest: '最长:',
+    mcq_accuracy: '选择题准确率:',
+    practicals_done: '已完成实操:',
+    bookmarked: '已收藏:',
+    achievements: '成就:',
+    achievements_none: '成就: 还没有 —— 冲到第一个里程碑!',
+};
+export function t(key, lang) {
+    const pack = lang.startsWith('zh') ? ZH : EN;
+    return pack[key] ?? EN[key] ?? key;
+}