icoa-cli 2.19.355 → 2.19.357

package/dist/commands/ctf.js

@@ -1 +1,787 @@
-import chalk from"chalk";import{CTFdClient as e}from"../lib/ctfd-client.js";import{getConfig as o,saveConfig as t}from"../lib/config.js";import{postIntegritySnapshot as n}from"../lib/integrity-snapshot.js";import{logCommand as i,logSubmission as s}from"../lib/logger.js";import{getTranslation as a}from"../lib/translation.js";import{isLeaderAccount as l,isLeaderToken as c,leaderAuth as r}from"../lib/comms.js";import{printSuccess as d,printError as g,printWarning as m,printInfo as p,printTable as y,printMarkdown as h,printHeader as u,printKeyValue as w,createSpinner as f,formatCountdown as b}from"../lib/ui.js";import{eaiArenaTask as S,printEaiArenaGuide as v}from"./connect.js";export function detectFlagFormat(e){if(!e)return null;const o=e.match(/flag\s*format\s*[:：]?\s*`?([A-Za-z][A-Za-z0-9_]{0,20}\{[^}\n]{1,60}\})`?/i);return o?o[1]:null}function C(){const t=o();t.ctfdUrl&&(t.token||t.sessionCookie)||(g("Not connected to CTFd. Run: join <url>"),process.exit(1));const n=t.sessionCookie||"",i=t.token&&!t.token.includes("session=")?t.token:"";return{config:t,client:new e(t.ctfdUrl,i,n||t.token)}}export function registerCtfCommands(k){const I=k.command("ctf").description("Competition commands");I.command("join <url>").description("Connect to a CTFd instance").action(async n=>{let s=n.trim().replace(/\/+$/,"");function a(e,o){return new Promise(t=>{process.stdout.write(chalk.white(e));const n=!!process.stdin.isTTY&&!!process.stdin.isRaw,i=process.stdin.listeners("data").slice(),s=process.stdin.listeners("keypress").slice();for(const e of i)process.stdin.removeListener("data",e);for(const e of s)process.stdin.removeListener("keypress",e);process.stdin.isTTY&&process.stdin.setRawMode?.(!0),process.stdin.resume();let a="";const l=e=>{const c=e.toString(),r=e=>{process.stdin.isTTY&&process.stdin.setRawMode?.(n),process.stdin.removeListener("data",l);for(const e of i)process.stdin.on("data",e);for(const e of s)process.stdin.on("keypress",e);process.stdout.write("\n"),t(e)};"\n"===c||"\r"===c?r(a):""===c||"\b"===c?a.length>0&&(a=a.slice(0,-1),process.stdout.write("\b \b")):""===c?r(""):(a+=c,process.stdout.write(o||c))};process.stdin.on("data",l)})}s.startsWith("http://")||s.startsWith("https://")||(s=`https://${s}`),i(`ctf join ${s}`),console.log(),p(`Connecting to ${chalk.bold(s)}`);const y=await a("  Username: ");if(c(y)){const e=f("Verifying leader token...");e.start();const o=await r(s,y);return o?(e.succeed("Leader verified"),t({ctfdUrl:s,token:"",sessionCookie:"",leaderToken:y.trim(),leaderTeam:o.team,userName:o.account,userId:null,teamId:null,joinedAt:(new Date).toISOString()}),console.log(),w("Leader",o.account),o.team&&w("Team",o.team),console.log(),console.log(chalk.yellow("  ─────────────────────────────────────────────")),console.log(chalk.bold.yellow("  Team Leader console")),console.log(),console.log(chalk.white("    scoreboard")+chalk.gray("  Live team rankings")),console.log(chalk.white("    jury")+chalk.gray("        File a clarification / appeal (recorded)")),console.log(chalk.white("    news")+chalk.gray("        Latest organizer broadcast")),console.log(chalk.white("    time")+chalk.gray("        Event clock")),console.log(chalk.white("    logout")+chalk.gray("      Sign out")),console.log(chalk.yellow("  ─────────────────────────────────────────────")),console.log(),void console.log(chalk.gray("  The challenge bracket is not available to leaders."))):(e.fail("Invalid leader token"),void g("That leader token was not accepted. Check the token on your card and retry."))}const h=await a("  Password: ","*");let u="",b="",S="";const v=f("Logging in...");v.start();try{const o=new e(s,""),t=await o.loginWithCredentials(y,h);u=t.token,b=t.session,S=t.csrf,u?v.succeed("Login successful — API token auto-generated"):v.succeed("Login successful (session mode)")}catch(e){return v.fail("Login failed"),void g(e.message)}const C=f("Testing connection...");C.start();try{const n=new e(s,u,b,S),i=await n.testConnection();C.succeed("Connected successfully"),console.log(),w("User",i.name),w("Score",String(i.score||0)),i.team_id&&w("Team ID",String(i.team_id));try{const e=await n.getCompetitionMeta(),o={ctfdUrl:s,token:u||b,userId:i.id,userName:i.name,teamId:i.team_id,sessionCookie:b,country:i.country||"",joinedAt:(new Date).toISOString()};e.start?(o.competitionStartsAt=new Date(1e3*e.start).toISOString(),w("Starts",new Date(1e3*e.start).toLocaleString())):o.competitionStartsAt="",e.end?(o.competitionEndsAt=new Date(1e3*e.end).toISOString(),w("Ends",new Date(1e3*e.end).toLocaleString())):o.competitionEndsAt="";const a=Date.now()/1e3;e.start&&a<e.start?o.competitionState="pre_competition":e.end&&a>e.end?o.competitionState="finished":o.competitionState="live",w("Status",o.competitionState),t(o)}catch{t({ctfdUrl:s,token:u,userId:i.id,userName:i.name,teamId:i.team_id,joinedAt:(new Date).toISOString()})}console.log(),d("Connection saved. You are ready!"),console.log();const a=o().mode||"";l(i.name||"")?(console.log(chalk.yellow("  ─────────────────────────────────────────────")),console.log(chalk.bold.yellow("  Team Leader console")),console.log(),console.log(chalk.white("    scoreboard")+chalk.gray("  Live team rankings")),console.log(chalk.white("    news")+chalk.gray("        Latest organizer broadcast")),console.log(chalk.white("    jury")+chalk.gray("        File a clarification / appeal (recorded)")),console.log(chalk.white("    time")+chalk.gray("        Event clock")),console.log(chalk.white("    status")+chalk.gray("      Event state")),console.log(chalk.white("    logout")+chalk.gray("      Sign out")),console.log(chalk.yellow("  ─────────────────────────────────────────────"))):"olympiad"===a?(console.log(chalk.cyan("  ─────────────────────────────────────────────")),console.log(chalk.bold.white("  How to compete:")),console.log(),console.log(chalk.white("  Step 1  ")+chalk.bold.cyan("challenges")+chalk.gray("         Browse all challenges")),console.log(chalk.white("  Step 2  ")+chalk.bold.cyan("open <id>")+chalk.gray("          Read challenge details")),console.log(chalk.white("  Step 3  ")+chalk.bold.cyan("submit <id> <flag>")+chalk.gray("  Submit your answer")),console.log(),console.log(chalk.bold.yellow("  ★ Need AI help?    ")+chalk.bold.cyan("ai4ctf")+chalk.gray("   Chat freely with your AI teammate")),console.log(chalk.bold.yellow("  ★ Stuck on a tool? ")+chalk.bold.cyan("man <tool>")+chalk.gray("   how to use steghide / binwalk / nmap …  (")+chalk.cyan("man tools")+chalk.gray(" = list)")),console.log(),console.log(chalk.gray("  More:")),console.log(chalk.white("    scoreboard")+chalk.gray("     Live rankings")),console.log(chalk.white("    status")+chalk.gray("         Your score & timer")),console.log(chalk.white("    memo")+chalk.gray("           Report an issue with a challenge")),console.log(chalk.white("    news")+chalk.gray("           Show the latest organizer broadcast")),console.log(chalk.cyan("  ─────────────────────────────────────────────"))):(console.log(chalk.gray("  Next:")),console.log(chalk.white("    exam list      ")+chalk.gray("View available exams")),console.log(chalk.white("    challenges     ")+chalk.gray("View CTF challenges")),console.log(chalk.white("    status         ")+chalk.gray("Check score & timer")))}catch(e){/ACCOUNT_BLOCKED|banned|not enabled/i.test(e?.message||"")?(C.fail("This account cannot access the competition"),console.log(),g("Signed in OK, but the account is banned / disabled / not enabled. Try a different account, or contact the organizer."),t({ctfdUrl:s})):b?(C.succeed("Connected (session mode — limited API)"),t({ctfdUrl:s,token:b,userName:y,sessionCookie:b}),console.log(),w("User",y),m("API access limited. Some features may not work."),d("Connection saved.")):(C.fail("Connection test failed"),g(e.message),t({ctfdUrl:s}),console.log(),p(`Connection saved. Try: join ${s}`))}}),I.command("logout").description("Disconnect and clear credentials").action(()=>{i("ctf logout"),t({ctfdUrl:"",token:"",sessionCookie:"",userId:null,userName:"",teamId:null,country:"",leaderToken:"",leaderTeam:""}),d("Logged out. Credentials cleared."),console.log(),console.log(chalk.gray("  What now?")),console.log(chalk.white("    join <url>")+chalk.gray("      Re-connect to competition")),console.log(chalk.white("    setup")+chalk.gray("           Switch mode")),console.log(chalk.white("    exit")+chalk.gray("            Quit ICOA CLI"))}),I.command("activate <code>").description("Validate competition code").action(async e=>{i(`ctf activate ${e}`),C();const n=f("Validating competition code...");n.start();try{const i=await fetch(`${o().ctfdUrl}/api/v1/icoa/activate`,{method:"POST",headers:{Authorization:`Token ${o().token}`,"Content-Type":"application/json"},body:JSON.stringify({code:e})});if(i.ok){const s=await i.json();n.succeed("Competition code validated"),t({competitionCode:e,teamId:s.data?.team_id||o().teamId,competitionState:"live"}),d(`Activated: ${e}`)}else n.succeed("Competition code saved"),t({competitionCode:e}),p("Code stored locally. Server validation will be attempted during competition.")}catch{n.succeed("Competition code saved"),t({competitionCode:e}),p("Code stored locally.")}}),I.command("challenges").description("List all challenges").action(async()=>{i("ctf challenges");const{client:e}=C(),o=f("Loading challenges...");o.start();try{const t=await e.getChallenges();if(o.stop(),!t||0===t.length)return void p("No challenges available yet.");const n=new Map;for(const e of t){const o=e.category||"Uncategorized";n.has(o)||n.set(o,[]),n.get(o).push(e)}const i=t.filter(e=>e.solved_by_me).length;u(`Challenges (${i}/${t.length} solved)`);const s={Web:"Find vulnerabilities in websites",Crypto:"Break ciphers & encryption",Reversing:"Analyze compiled programs",Rev:"Analyze compiled programs",Pwn:"Exploit binary vulnerabilities",Forensics:"Investigate digital evidence",Misc:"Creative & mixed challenges",OSINT:"Open-source intelligence gathering",AI:"AI security & adversarial ML",ai4ctf:"Use AI to solve CTF challenges",ctf4ai:"Attack live AI targets (LLM / ML / agents)",ctf4eai:"Red-team embodied-AI robot policies"},a=e=>{if(s[e])return s[e];const o=e.toLowerCase().replace(/\s+practice$/,""),t=Object.keys(s).find(e=>e.toLowerCase()===o);return t?s[t]:""},l=e=>e<=100?chalk.green("Easy"):e<=250?chalk.yellow("Medium"):e<=500?chalk.red("Hard"):chalk.magenta("Expert"),c=new Set(["auditagent"]),r=e=>c.has((e||"").trim().toLowerCase()),d=[...n.entries()].sort(([e],[o])=>e.localeCompare(o)).flatMap(([e,o])=>{const t=a(e);return[[t?`${chalk.cyan.bold(`── ${e} ──`)} ${chalk.gray(t)}`:chalk.cyan.bold(`── ${e} ──`),"","","",""],...o.sort((e,o)=>{const t=r(e.name);return t!==r(o.name)?t?-1:1:e.value-o.value}).map(e=>[String(e.id),e.solved_by_me?chalk.gray.strikethrough(e.name):e.name,e.solved_by_me?chalk.gray(String(e.value)):chalk.yellow(String(e.value)),e.solved_by_me?chalk.gray("--"):l(e.value),e.solved_by_me?chalk.green("✓"):chalk.gray("○")])]});y(["#","Name","Points","Difficulty","Solved"],d),console.log(chalk.gray(`  ${t.length} challenges, ${i} solved`)),0===i&&(console.log(),console.log(chalk.gray("  Tip: Start with ")+chalk.green("Easy")+chalk.gray(" challenges! Type ")+chalk.white("open <id>")+chalk.gray(" to read one.")))}catch(e){o.fail("Failed to load challenges"),g(e.message)}}),I.command("open <id>").description("View challenge details").action(async e=>{i(`ctf open ${e}`);const{config:o,client:n}=C(),s=f("Loading challenge...");s.start();try{const i=await n.getChallenge(parseInt(e,10));s.stop(),t({currentChallengeId:i.id,currentChallengeName:i.name,currentChallengeCategory:i.category});const l=S(i);u(`${i.name} [${i.category}]`),w("Points",String(i.value)),w("Solves",String(i.solves)),i.connection_info&&!l&&w("Connection",i.connection_info),console.log();let c=i.description;if("en"!==o.language)try{c=await a(c,i.id,o.language)}catch{}h(c);const r=detectFlagFormat(i.description);if(console.log(),r?console.log(chalk.bold.white("  Flag format: ")+chalk.green(r)):console.log(chalk.bold.white("  Flag format: ")+chalk.gray("submit the flag exactly as you receive it, including its ")+chalk.green("wrapper{...}")+chalk.gray(" — don't retype or add a prefix.")),i.files&&i.files.length>0&&(console.log(),p(`Files (${i.files.length}): use ${chalk.white(`files ${e}`)} to download`)),i.hints&&i.hints.length>0&&p(`CTFd Hints available: ${i.hints.length}`),l)return console.log(),void v(e,l);i.connection_info&&(console.log(),p(`Quick connect: ${chalk.white(`connect ${e}`)}`));const d=!!i.connection_info&&/^https?:\/\//i.test(i.connection_info.trim());console.log(),console.log(chalk.gray("  ─────────────────────────────────────────────")),console.log(chalk.bold.white("  What to do next:")),d&&console.log(chalk.white(`    connect ${e}`)+chalk.gray("            How to attack & submit — full guide")),console.log(chalk.white('    hint "how to start?"')+chalk.gray("   Ask the AI teammate (if enabled this round)")),i.files&&i.files.length>0&&console.log(chalk.white(`    files ${e}`)+chalk.gray("                Download challenge files")),i.connection_info&&!d&&console.log(chalk.white(`    connect ${e}`)+chalk.gray("              Connect to target")),console.log(chalk.white(`    submit ${e} <flag>`)+chalk.gray("   Submit your answer (paste the full flag with its wrapper)")),console.log(chalk.gray("  ─────────────────────────────────────────────"))}catch(e){s.fail("Failed to load challenge"),g(e.message)}}),I.command("submit <id> <flag>").description("Submit a flag").action(async(e,o)=>{i(`ctf submit ${e}`),s(parseInt(e,10),o);const{client:t}=C(),a=f("Submitting flag...");a.start();try{const i=await t.submitFlag(parseInt(e,10),o);switch(a.stop(),i.status){case"correct":console.log(),console.log(chalk.green.bold("  🎉 Correct! ")+chalk.white(i.message)),console.log();break;case"incorrect":g(`Incorrect. ${i.message}`);break;case"already_solved":m("Already solved.");break;case"paused":m("Competition is paused.");break;case"ratelimited":m("Rate limited. Please wait before trying again.");break;default:p(i.message||"Unknown response")}await n()}catch(e){a.fail("Submission failed"),g(e.message)}}),I.command("scoreboard [top]").description("View scoreboard (optional: top N)").action(async e=>{i("ctf scoreboard");const{config:o,client:t}=C(),n=f("Loading scoreboard...");n.start();try{const e=await t.getScoreboard();if(n.stop(),!e||0===e.length)return void p("Scoreboard is empty.");u("Scoreboard");const i=e.map(e=>{const t=e.account_id===o.teamId,n=[String(e.pos),e.name,String(e.score)];return t?n.map(e=>chalk.yellow.bold(e)):n});y(["Rank","Team","Score"],i)}catch(e){n.fail("Failed to load scoreboard"),g(e.message)}}),I.command("status").description("Show competition status").action(async()=>{i("ctf status");const{config:e,client:o}=C();u("Competition Status");const t={pre_competition:chalk.yellow,demo:chalk.blue,live:chalk.green,finished:chalk.red,unknown:chalk.gray},n=e.competitionState||"unknown",s=t[n]||chalk.gray;console.log(`  ${chalk.gray("State:")} ${chalk.bold(s({pre_competition:"PRE-COMPETITION",demo:"DEMO",live:"LIVE",finished:"FINISHED",unknown:"UNKNOWN"}[n]||n))}`);try{const e=await o.testConnection();w("User",chalk.white.bold(e.name)),w("Score",chalk.yellow.bold(String(e.score||0))),w("Rank",chalk.cyan(e.place||"N/A"))}catch{w("User",e.userName||"Unknown")}if(e.competitionEndsAt){console.log();const o=new Date(e.competitionEndsAt);new Date<o?w("Time Remaining",chalk.yellow.bold(b(o))):w("Time",chalk.red("Competition ended"))}console.log()}),I.command("time").description("Show competition countdown").action(async()=>{i("ctf time");let n=o();if(n.ctfdUrl)try{const i=new e(n.ctfdUrl,n.token,n.sessionCookie),s=await i.getCompetitionMeta(),a={};a.competitionStartsAt=s.start?new Date(1e3*s.start).toISOString():"",a.competitionEndsAt=s.end?new Date(1e3*s.end).toISOString():"",t(a),n=o()}catch{}if(!n.competitionStartsAt&&!n.competitionEndsAt)return p("Competition times not configured."),void p("They will be set when the competition server provides timing information.");const s=new Date,a=n.competitionStartsAt?new Date(n.competitionStartsAt):null,l=n.competitionEndsAt?new Date(n.competitionEndsAt):null;u("Competition Timer"),a&&s<a?(console.log(chalk.yellow("  Competition has not started yet.")),console.log(),console.log(`  ${chalk.bold("Starts in:")} ${b(a)}`)):l&&s<l?(console.log(chalk.green("  Competition is LIVE")),console.log(),console.log(`  ${chalk.bold("Time remaining:")} ${b(l)}`),console.log(),console.log(chalk.gray("  This is the shared event clock. If you are on a timed exam")),console.log(chalk.gray("  paper, your personal deadline is shown by ")+chalk.white("exam info")+chalk.gray("."))):console.log(chalk.red("  Competition has ended."))})}
+import chalk from 'chalk';
+import { CTFdClient } from '../lib/ctfd-client.js';
+import { getConfig, saveConfig } from '../lib/config.js';
+import { postIntegritySnapshot } from '../lib/integrity-snapshot.js';
+import { logCommand, logSubmission } from '../lib/logger.js';
+import { getTranslation } from '../lib/translation.js';
+import { isLeaderAccount, isLeaderToken, leaderAuth } from '../lib/comms.js';
+import { printSuccess, printError, printWarning, printInfo, printTable, printMarkdown, printHeader, printKeyValue, createSpinner, formatCountdown, } from '../lib/ui.js';
+import { eaiArenaTask, printEaiArenaGuide } from './connect.js';
+// Pull an explicit flag-format hint out of a challenge description so `open`
+// can show contestants the exact wrapper to submit (the prefix is instance-
+// specific — pecan{...} on practice, ICOA{...} at the real comp — so we never
+// hardcode it). Only matches an EXPLICIT "flag format: name{...}" statement to
+// avoid grabbing unrelated braces (code snippets, set/dict literals).
+export function detectFlagFormat(desc) {
+    if (!desc)
+        return null;
+    const m = desc.match(/flag\s*format\s*[:：]?\s*`?([A-Za-z][A-Za-z0-9_]{0,20}\{[^}\n]{1,60}\})`?/i);
+    return m ? m[1] : null;
+}
+function requireConnection() {
+    const config = getConfig();
+    if (!config.ctfdUrl || (!config.token && !config.sessionCookie)) {
+        printError('Not connected to CTFd. Run: join <url>');
+        process.exit(1);
+    }
+    const session = config.sessionCookie || '';
+    const token = config.token && !config.token.includes('session=') ? config.token : '';
+    return { config, client: new CTFdClient(config.ctfdUrl, token, session || config.token) };
+}
+export function registerCtfCommands(program) {
+    const ctf = program.command('ctf').description('Competition commands');
+    // ─── icoa ctf join <url> ───
+    ctf
+        .command('join <url>')
+        .description('Connect to a CTFd instance')
+        .action(async (rawUrl) => {
+        // Auto-add https:// if missing
+        let url = rawUrl.trim().replace(/\/+$/, '');
+        if (!url.startsWith('http://') && !url.startsWith('https://')) {
+            url = `https://${url}`;
+        }
+        logCommand(`ctf join ${url}`);
+        console.log();
+        printInfo(`Connecting to ${chalk.bold(url)}`);
+        // Read username and password using raw stdin. rl.pause() in the REPL is
+        // not enough on its own: the parent readline's keypress handler stays
+        // attached to stdin, and stdin.resume() below re-routes data to BOTH
+        // that handler and our onData — every keystroke would echo twice.
+        // Snapshot stdin's data/keypress listeners, detach while we read, restore
+        // on completion. Preserve the original isRaw so the REPL keeps working.
+        function rawInput(prompt, mask) {
+            return new Promise((resolve) => {
+                process.stdout.write(chalk.white(prompt));
+                const wasRaw = process.stdin.isTTY ? !!process.stdin.isRaw : false;
+                const savedData = process.stdin.listeners('data').slice();
+                const savedKeypress = process.stdin.listeners('keypress').slice();
+                for (const l of savedData)
+                    process.stdin.removeListener('data', l);
+                for (const l of savedKeypress)
+                    process.stdin.removeListener('keypress', l);
+                if (process.stdin.isTTY)
+                    process.stdin.setRawMode?.(true);
+                process.stdin.resume();
+                let buf = '';
+                const onData = (ch) => {
+                    const c = ch.toString();
+                    const finish = (value) => {
+                        if (process.stdin.isTTY)
+                            process.stdin.setRawMode?.(wasRaw);
+                        process.stdin.removeListener('data', onData);
+                        for (const l of savedData)
+                            process.stdin.on('data', l);
+                        for (const l of savedKeypress)
+                            process.stdin.on('keypress', l);
+                        process.stdout.write('\n');
+                        resolve(value);
+                    };
+                    if (c === '\n' || c === '\r') {
+                        finish(buf);
+                    }
+                    else if (c === '\x7f' || c === '\b') {
+                        if (buf.length > 0) {
+                            buf = buf.slice(0, -1);
+                            process.stdout.write('\b \b');
+                        }
+                    }
+                    else if (c === '\x03') {
+                        finish('');
+                    }
+                    else {
+                        buf += c;
+                        process.stdout.write(mask || c);
+                    }
+                };
+                process.stdin.on('data', onData);
+            });
+        }
+        const username = await rawInput('  Username: ');
+        // ─── Team-leader token path ───
+        // A leader pastes their leader token at the Username prompt. We validate it
+        // against token-api (NO CTFd login → no web session → challenge bracket
+        // unreachable), store a leader session, and stop. Account ↔ team are
+        // server-resolved from the token (un-forgeable).
+        if (isLeaderToken(username)) {
+            const spinnerL = createSpinner('Verifying leader token...');
+            spinnerL.start();
+            const lead = await leaderAuth(url, username);
+            if (!lead) {
+                spinnerL.fail('Invalid leader token');
+                printError('That leader token was not accepted. Check the token on your card and retry.');
+                return;
+            }
+            spinnerL.succeed('Leader verified');
+            saveConfig({
+                ctfdUrl: url,
+                token: '', // leaders hold NO CTFd credential
+                sessionCookie: '',
+                leaderToken: username.trim(),
+                leaderTeam: lead.team,
+                userName: lead.account,
+                userId: null,
+                teamId: null,
+                joinedAt: new Date().toISOString(),
+            });
+            console.log();
+            printKeyValue('Leader', lead.account);
+            if (lead.team)
+                printKeyValue('Team', lead.team);
+            console.log();
+            console.log(chalk.yellow('  ─────────────────────────────────────────────'));
+            console.log(chalk.bold.yellow('  Team Leader console'));
+            console.log();
+            console.log(chalk.white('    scoreboard') + chalk.gray('  Live team rankings'));
+            console.log(chalk.white('    jury') + chalk.gray('        File a clarification / appeal (recorded)'));
+            console.log(chalk.white('    news') + chalk.gray('        Latest organizer broadcast'));
+            console.log(chalk.white('    time') + chalk.gray('        Event clock'));
+            console.log(chalk.white('    logout') + chalk.gray('      Sign out'));
+            console.log(chalk.yellow('  ─────────────────────────────────────────────'));
+            console.log();
+            console.log(chalk.gray('  The challenge bracket is not available to leaders.'));
+            return;
+        }
+        const password = await rawInput('  Password: ', '*');
+        let token = '';
+        let sessionCookie = '';
+        let csrfNonce = '';
+        const spinner = createSpinner('Logging in...');
+        spinner.start();
+        try {
+            const client = new CTFdClient(url, '');
+            const result = await client.loginWithCredentials(username, password);
+            token = result.token;
+            sessionCookie = result.session;
+            csrfNonce = result.csrf;
+            if (token) {
+                spinner.succeed('Login successful — API token auto-generated');
+            }
+            else {
+                spinner.succeed('Login successful (session mode)');
+            }
+        }
+        catch (err) {
+            spinner.fail('Login failed');
+            printError(err.message);
+            return;
+        }
+        // Test connection
+        const spinner2 = createSpinner('Testing connection...');
+        spinner2.start();
+        try {
+            const client = new CTFdClient(url, token, sessionCookie, csrfNonce);
+            const user = await client.testConnection();
+            spinner2.succeed('Connected successfully');
+            console.log();
+            printKeyValue('User', user.name);
+            printKeyValue('Score', String(user.score || 0));
+            if (user.team_id) {
+                printKeyValue('Team ID', String(user.team_id));
+            }
+            // Fetch competition metadata (times, mode)
+            try {
+                const meta = await client.getCompetitionMeta();
+                const configUpdate = {
+                    ctfdUrl: url,
+                    token: token || sessionCookie,
+                    userId: user.id,
+                    userName: user.name,
+                    teamId: user.team_id,
+                    sessionCookie: sessionCookie,
+                    country: user.country || '',
+                    joinedAt: new Date().toISOString(),
+                };
+                // Mirror the server exactly: when the server reports a time, save it;
+                // when it reports none (null), CLEAR any stale cached value. Otherwise
+                // a once-set end time lingers forever and `time` shows a bogus
+                // countdown against a deadline the server no longer has.
+                if (meta.start) {
+                    configUpdate.competitionStartsAt = new Date(meta.start * 1000).toISOString();
+                    printKeyValue('Starts', new Date(meta.start * 1000).toLocaleString());
+                }
+                else {
+                    configUpdate.competitionStartsAt = '';
+                }
+                if (meta.end) {
+                    configUpdate.competitionEndsAt = new Date(meta.end * 1000).toISOString();
+                    printKeyValue('Ends', new Date(meta.end * 1000).toLocaleString());
+                }
+                else {
+                    configUpdate.competitionEndsAt = '';
+                }
+                // Determine competition state
+                const now = Date.now() / 1000;
+                if (meta.start && now < meta.start) {
+                    configUpdate.competitionState = 'pre_competition';
+                }
+                else if (meta.end && now > meta.end) {
+                    configUpdate.competitionState = 'finished';
+                }
+                else {
+                    configUpdate.competitionState = 'live';
+                }
+                printKeyValue('Status', configUpdate.competitionState);
+                saveConfig(configUpdate);
+            }
+            catch {
+                // Fallback: save without competition times
+                saveConfig({
+                    ctfdUrl: url,
+                    token: token,
+                    userId: user.id,
+                    userName: user.name,
+                    teamId: user.team_id,
+                    joinedAt: new Date().toISOString(),
+                });
+            }
+            console.log();
+            printSuccess('Connection saved. You are ready!');
+            console.log();
+            const currentMode = getConfig().mode || '';
+            const isLeader = isLeaderAccount(user.name || '');
+            if (isLeader) {
+                console.log(chalk.yellow('  ─────────────────────────────────────────────'));
+                console.log(chalk.bold.yellow('  Team Leader console'));
+                console.log();
+                console.log(chalk.white('    scoreboard') + chalk.gray('  Live team rankings'));
+                console.log(chalk.white('    news') + chalk.gray('        Latest organizer broadcast'));
+                console.log(chalk.white('    jury') + chalk.gray('        File a clarification / appeal (recorded)'));
+                console.log(chalk.white('    time') + chalk.gray('        Event clock'));
+                console.log(chalk.white('    status') + chalk.gray('      Event state'));
+                console.log(chalk.white('    logout') + chalk.gray('      Sign out'));
+                console.log(chalk.yellow('  ─────────────────────────────────────────────'));
+            }
+            else if (currentMode === 'olympiad') {
+                // Olympiad: guided step-by-step walkthrough
+                console.log(chalk.cyan('  ─────────────────────────────────────────────'));
+                console.log(chalk.bold.white('  How to compete:'));
+                console.log();
+                console.log(chalk.white('  Step 1  ') + chalk.bold.cyan('challenges') + chalk.gray('         Browse all challenges'));
+                console.log(chalk.white('  Step 2  ') + chalk.bold.cyan('open <id>') + chalk.gray('          Read challenge details'));
+                console.log(chalk.white('  Step 3  ') + chalk.bold.cyan('submit <id> <flag>') + chalk.gray('  Submit your answer'));
+                console.log();
+                console.log(chalk.bold.yellow('  ★ Need AI help?    ') +
+                    chalk.bold.cyan('ai4ctf') +
+                    chalk.gray('   Chat freely with your AI teammate'));
+                console.log(chalk.bold.yellow('  ★ Stuck on a tool? ') +
+                    chalk.bold.cyan('man <tool>') +
+                    chalk.gray('   how to use steghide / binwalk / nmap …  (') +
+                    chalk.cyan('man tools') +
+                    chalk.gray(' = list)'));
+                console.log();
+                console.log(chalk.gray('  More:'));
+                console.log(chalk.white('    scoreboard') + chalk.gray('     Live rankings'));
+                console.log(chalk.white('    status') + chalk.gray('         Your score & timer'));
+                console.log(chalk.white('    memo') + chalk.gray('           Report an issue with a challenge'));
+                console.log(chalk.white('    news') + chalk.gray('           Show the latest organizer broadcast'));
+                console.log(chalk.cyan('  ─────────────────────────────────────────────'));
+            }
+            else {
+                console.log(chalk.gray('  Next:'));
+                console.log(chalk.white('    exam list      ') + chalk.gray('View available exams'));
+                console.log(chalk.white('    challenges     ') + chalk.gray('View CTF challenges'));
+                console.log(chalk.white('    status         ') + chalk.gray('Check score & timer'));
+            }
+        }
+        catch (err) {
+            // A banned / not-enabled account logs in fine (302) but 403s on every API
+            // call. Do NOT mislabel that as a usable "limited API" session — it isn't,
+            // and re-running join with the same account won't help. Tell the user to
+            // switch accounts. (Confirmed root cause of the mel banned-ZZCP login: the
+            // session is valid, the account is blocked.)
+            const blocked = /ACCOUNT_BLOCKED|banned|not enabled/i.test(err?.message || '');
+            if (blocked) {
+                spinner2.fail('This account cannot access the competition');
+                console.log();
+                printError('Signed in OK, but the account is banned / disabled / not enabled. ' +
+                    'Try a different account, or contact the organizer.');
+                saveConfig({ ctfdUrl: url });
+            }
+            else if (sessionCookie) {
+                // Session login succeeded but API test failed — save anyway
+                spinner2.succeed('Connected (session mode — limited API)');
+                saveConfig({
+                    ctfdUrl: url,
+                    token: sessionCookie,
+                    userName: username,
+                    sessionCookie: sessionCookie,
+                });
+                console.log();
+                printKeyValue('User', username);
+                printWarning('API access limited. Some features may not work.');
+                printSuccess('Connection saved.');
+            }
+            else {
+                spinner2.fail('Connection test failed');
+                printError(err.message);
+                saveConfig({ ctfdUrl: url });
+                console.log();
+                printInfo(`Connection saved. Try: join ${url}`);
+            }
+        }
+    });
+    // ─── icoa ctf logout ───
+    ctf
+        .command('logout')
+        .description('Disconnect and clear credentials')
+        .action(() => {
+        logCommand('ctf logout');
+        saveConfig({
+            ctfdUrl: '',
+            token: '',
+            sessionCookie: '',
+            userId: null,
+            userName: '',
+            teamId: null,
+            country: '',
+            leaderToken: '',
+            leaderTeam: '',
+        });
+        printSuccess('Logged out. Credentials cleared.');
+        console.log();
+        console.log(chalk.gray('  What now?'));
+        console.log(chalk.white('    join <url>') + chalk.gray('      Re-connect to competition'));
+        console.log(chalk.white('    setup') + chalk.gray('           Switch mode'));
+        console.log(chalk.white('    exit') + chalk.gray('            Quit ICOA CLI'));
+    });
+    // ─── icoa ctf activate <code> ───
+    ctf
+        .command('activate <code>')
+        .description('Validate competition code')
+        .action(async (code) => {
+        logCommand(`ctf activate ${code}`);
+        requireConnection();
+        const spinner = createSpinner('Validating competition code...');
+        spinner.start();
+        try {
+            // Try custom ICOA endpoint first
+            const res = await fetch(`${getConfig().ctfdUrl}/api/v1/icoa/activate`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Token ${getConfig().token}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({ code }),
+            });
+            if (res.ok) {
+                const data = (await res.json());
+                spinner.succeed('Competition code validated');
+                saveConfig({
+                    competitionCode: code,
+                    teamId: data.data?.team_id || getConfig().teamId,
+                    competitionState: 'live',
+                });
+                printSuccess(`Activated: ${code}`);
+            }
+            else {
+                // Fallback: just store the code locally
+                spinner.succeed('Competition code saved');
+                saveConfig({ competitionCode: code });
+                printInfo('Code stored locally. Server validation will be attempted during competition.');
+            }
+        }
+        catch {
+            // Server doesn't have custom endpoint, store locally
+            spinner.succeed('Competition code saved');
+            saveConfig({ competitionCode: code });
+            printInfo('Code stored locally.');
+        }
+    });
+    // ─── icoa ctf challenges ───
+    ctf
+        .command('challenges')
+        .description('List all challenges')
+        .action(async () => {
+        logCommand('ctf challenges');
+        const { client } = requireConnection();
+        const spinner = createSpinner('Loading challenges...');
+        spinner.start();
+        try {
+            const challenges = await client.getChallenges();
+            spinner.stop();
+            if (!challenges || challenges.length === 0) {
+                printInfo('No challenges available yet.');
+                return;
+            }
+            // Group by category
+            const byCategory = new Map();
+            for (const c of challenges) {
+                const cat = c.category || 'Uncategorized';
+                if (!byCategory.has(cat))
+                    byCategory.set(cat, []);
+                byCategory.get(cat).push(c);
+            }
+            const solved = challenges.filter((c) => c.solved_by_me).length;
+            printHeader(`Challenges (${solved}/${challenges.length} solved)`);
+            // Category descriptions for beginners
+            const catDesc = {
+                Web: 'Find vulnerabilities in websites',
+                Crypto: 'Break ciphers & encryption',
+                Reversing: 'Analyze compiled programs',
+                Rev: 'Analyze compiled programs',
+                Pwn: 'Exploit binary vulnerabilities',
+                Forensics: 'Investigate digital evidence',
+                Misc: 'Creative & mixed challenges',
+                OSINT: 'Open-source intelligence gathering',
+                AI: 'AI security & adversarial ML',
+                ai4ctf: 'Use AI to solve CTF challenges',
+                ctf4ai: 'Attack live AI targets (LLM / ML / agents)',
+                ctf4eai: 'Red-team embodied-AI robot policies',
+            };
+            // Resolve a category blurb, tolerating the live track variants
+            // ("ctf4ai", "ctf4eai practice", "ai4ctf practice", …) that CTFd serves.
+            const describeCat = (cat) => {
+                if (catDesc[cat])
+                    return catDesc[cat];
+                const base = cat.toLowerCase().replace(/\s+practice$/, '');
+                const key = Object.keys(catDesc).find((k) => k.toLowerCase() === base);
+                return key ? catDesc[key] : '';
+            };
+            // Difficulty based on points
+            const difficulty = (pts) => {
+                if (pts <= 100)
+                    return chalk.green('Easy');
+                if (pts <= 250)
+                    return chalk.yellow('Medium');
+                if (pts <= 500)
+                    return chalk.red('Hard');
+                return chalk.magenta('Expert');
+            };
+            // Flagship challenges that must lead their category regardless of point
+            // value (e.g. `auditagent` is the ctf4ai showcase target at 3000 pts, so
+            // value-ascending sort would otherwise bury it last). Matched on the
+            // CTFd challenge name, case-insensitively.
+            const pinnedFirst = new Set(['auditagent']);
+            const isPinned = (name) => pinnedFirst.has((name || '').trim().toLowerCase());
+            // Sort categories and display
+            const rows = [...byCategory.entries()]
+                .sort(([a], [b]) => a.localeCompare(b))
+                .flatMap(([category, challs]) => {
+                const desc = describeCat(category);
+                const catLabel = desc
+                    ? `${chalk.cyan.bold(`── ${category} ──`)} ${chalk.gray(desc)}`
+                    : chalk.cyan.bold(`── ${category} ──`);
+                const catRow = [catLabel, '', '', '', ''];
+                const challRows = challs
+                    .sort((a, b) => {
+                    // Pinned flagship challenges lead, then the rest by point value.
+                    const pa = isPinned(a.name);
+                    const pb = isPinned(b.name);
+                    if (pa !== pb)
+                        return pa ? -1 : 1;
+                    return a.value - b.value;
+                })
+                    .map((c) => [
+                    String(c.id),
+                    c.solved_by_me ? chalk.gray.strikethrough(c.name) : c.name,
+                    c.solved_by_me ? chalk.gray(String(c.value)) : chalk.yellow(String(c.value)),
+                    c.solved_by_me ? chalk.gray('--') : difficulty(c.value),
+                    c.solved_by_me ? chalk.green('✓') : chalk.gray('○'),
+                ]);
+                return [catRow, ...challRows];
+            });
+            printTable(['#', 'Name', 'Points', 'Difficulty', 'Solved'], rows);
+            console.log(chalk.gray(`  ${challenges.length} challenges, ${solved} solved`));
+            if (solved === 0) {
+                console.log();
+                console.log(chalk.gray('  Tip: Start with ') +
+                    chalk.green('Easy') +
+                    chalk.gray(' challenges! Type ') +
+                    chalk.white('open <id>') +
+                    chalk.gray(' to read one.'));
+            }
+        }
+        catch (err) {
+            spinner.fail('Failed to load challenges');
+            printError(err.message);
+        }
+    });
+    // ─── icoa ctf open <id> ───
+    ctf
+        .command('open <id>')
+        .description('View challenge details')
+        .action(async (id) => {
+        logCommand(`ctf open ${id}`);
+        const { config, client } = requireConnection();
+        const spinner = createSpinner('Loading challenge...');
+        spinner.start();
+        try {
+            const challenge = await client.getChallenge(parseInt(id, 10));
+            spinner.stop();
+            // Save current challenge context for hints
+            saveConfig({
+                currentChallengeId: challenge.id,
+                currentChallengeName: challenge.name,
+                currentChallengeCategory: challenge.category,
+            });
+            // ctf4eai arena tasks are CLI-solved (`eai <task>`); their connection_info
+            // is just the base URL (manifest path="") and is NOT something to connect
+            // to, so don't surface it as a "Connection" target.
+            const eaiTask = eaiArenaTask(challenge);
+            printHeader(`${challenge.name} [${challenge.category}]`);
+            printKeyValue('Points', String(challenge.value));
+            printKeyValue('Solves', String(challenge.solves));
+            if (challenge.connection_info && !eaiTask) {
+                printKeyValue('Connection', challenge.connection_info);
+            }
+            console.log();
+            // Display description (with optional translation)
+            let description = challenge.description;
+            if (config.language !== 'en') {
+                try {
+                    description = await getTranslation(description, challenge.id, config.language);
+                }
+                catch {
+                    // Translation failed, use English
+                }
+            }
+            printMarkdown(description);
+            // Flag format — contestants need to know the exact wrapper to submit.
+            // Show the format stated in the challenge text if present; otherwise an
+            // honest, instance-agnostic instruction (don't claim it's "shown above"
+            // when it isn't).
+            const flagFmt = detectFlagFormat(challenge.description);
+            console.log();
+            if (flagFmt) {
+                console.log(chalk.bold.white('  Flag format: ') + chalk.green(flagFmt));
+            }
+            else {
+                console.log(chalk.bold.white('  Flag format: ') +
+                    chalk.gray('submit the flag exactly as you receive it, including its ') +
+                    chalk.green('wrapper{...}') +
+                    chalk.gray(" — don't retype or add a prefix."));
+            }
+            // Show files
+            if (challenge.files && challenge.files.length > 0) {
+                console.log();
+                printInfo(`Files (${challenge.files.length}): use ${chalk.white(`files ${id}`)} to download`);
+            }
+            // Show hints
+            if (challenge.hints && challenge.hints.length > 0) {
+                printInfo(`CTFd Hints available: ${challenge.hints.length}`);
+            }
+            // ctf4eai arena tasks are CLI-solved (`eai <task>`), NOT a network
+            // target. Render the arena guide and skip every `connect`-flavoured hint
+            // below, which would falsely tell the student to connect/curl the target.
+            if (eaiTask) {
+                console.log();
+                printEaiArenaGuide(id, eaiTask);
+                return;
+            }
+            // Show connection info
+            if (challenge.connection_info) {
+                console.log();
+                printInfo(`Quick connect: ${chalk.white(`connect ${id}`)}`);
+            }
+            // Show guided next actions. For HTTP AI targets (ctf4ai), `connect` now
+            // prints a full attack→submit guide, so make it the PRIMARY step. The AI
+            // `hint` is teammate-backed and may be disabled in a given round (e.g. no
+            // server AI key), so phrase it honestly rather than as the go-to.
+            const httpTarget = !!challenge.connection_info && /^https?:\/\//i.test(challenge.connection_info.trim());
+            console.log();
+            console.log(chalk.gray('  ─────────────────────────────────────────────'));
+            console.log(chalk.bold.white('  What to do next:'));
+            if (httpTarget) {
+                console.log(chalk.white(`    connect ${id}`) + chalk.gray('            How to attack & submit — full guide'));
+            }
+            console.log(chalk.white(`    hint "how to start?"`) + chalk.gray('   Ask the AI teammate (if enabled this round)'));
+            if (challenge.files && challenge.files.length > 0) {
+                console.log(chalk.white(`    files ${id}`) + chalk.gray('                Download challenge files'));
+            }
+            if (challenge.connection_info && !httpTarget) {
+                console.log(chalk.white(`    connect ${id}`) + chalk.gray('              Connect to target'));
+            }
+            console.log(chalk.white(`    submit ${id} <flag>`) +
+                chalk.gray('   Submit your answer (paste the full flag with its wrapper)'));
+            console.log(chalk.gray('  ─────────────────────────────────────────────'));
+        }
+        catch (err) {
+            spinner.fail('Failed to load challenge');
+            printError(err.message);
+        }
+    });
+    // ─── icoa ctf submit <id> <flag> ───
+    ctf
+        .command('submit <id> <flag>')
+        .description('Submit a flag')
+        .action(async (id, flag) => {
+        logCommand(`ctf submit ${id}`);
+        logSubmission(parseInt(id, 10), flag);
+        const { client } = requireConnection();
+        const spinner = createSpinner('Submitting flag...');
+        spinner.start();
+        try {
+            const result = await client.submitFlag(parseInt(id, 10), flag);
+            spinner.stop();
+            switch (result.status) {
+                case 'correct':
+                    console.log();
+                    console.log(chalk.green.bold('  🎉 Correct! ') + chalk.white(result.message));
+                    console.log();
+                    break;
+                case 'incorrect':
+                    printError(`Incorrect. ${result.message}`);
+                    break;
+                case 'already_solved':
+                    printWarning('Already solved.');
+                    break;
+                case 'paused':
+                    printWarning('Competition is paused.');
+                    break;
+                case 'ratelimited':
+                    printWarning('Rate limited. Please wait before trying again.');
+                    break;
+                default:
+                    printInfo(result.message || 'Unknown response');
+            }
+            // P1.5 integrity sampling — fire a scrubbed, server-debounced snapshot
+            // anchored to this server-recorded submission. Detective-only and
+            // self-swallowing; gated to competitionState:'live' inside the helper.
+            // Both correct & incorrect submits are real scoring events, so we
+            // sample on either — the 5-min debounce lives server-side.
+            await postIntegritySnapshot();
+        }
+        catch (err) {
+            spinner.fail('Submission failed');
+            printError(err.message);
+        }
+    });
+    // ─── icoa ctf scoreboard ───
+    ctf
+        .command('scoreboard [top]')
+        .description('View scoreboard (optional: top N)')
+        .action(async (_top) => {
+        logCommand('ctf scoreboard');
+        const { config, client } = requireConnection();
+        const spinner = createSpinner('Loading scoreboard...');
+        spinner.start();
+        try {
+            const scoreboard = await client.getScoreboard();
+            spinner.stop();
+            if (!scoreboard || scoreboard.length === 0) {
+                printInfo('Scoreboard is empty.');
+                return;
+            }
+            printHeader('Scoreboard');
+            const rows = scoreboard.map((entry) => {
+                const isMyTeam = entry.account_id === config.teamId;
+                const row = [String(entry.pos), entry.name, String(entry.score)];
+                if (isMyTeam) {
+                    return row.map((cell) => chalk.yellow.bold(cell));
+                }
+                return row;
+            });
+            printTable(['Rank', 'Team', 'Score'], rows);
+        }
+        catch (err) {
+            spinner.fail('Failed to load scoreboard');
+            printError(err.message);
+        }
+    });
+    // ─── icoa ctf status ───
+    ctf
+        .command('status')
+        .description('Show competition status')
+        .action(async () => {
+        logCommand('ctf status');
+        const { config, client } = requireConnection();
+        printHeader('Competition Status');
+        // Competition state
+        const stateColors = {
+            pre_competition: chalk.yellow,
+            demo: chalk.blue,
+            live: chalk.green,
+            finished: chalk.red,
+            unknown: chalk.gray,
+        };
+        const stateLabels = {
+            pre_competition: 'PRE-COMPETITION',
+            demo: 'DEMO',
+            live: 'LIVE',
+            finished: 'FINISHED',
+            unknown: 'UNKNOWN',
+        };
+        const state = config.competitionState || 'unknown';
+        const colorFn = stateColors[state] || chalk.gray;
+        console.log(`  ${chalk.gray('State:')} ${chalk.bold(colorFn(stateLabels[state] || state))}`);
+        // User info
+        try {
+            const user = await client.testConnection();
+            printKeyValue('User', chalk.white.bold(user.name));
+            printKeyValue('Score', chalk.yellow.bold(String(user.score || 0)));
+            printKeyValue('Rank', chalk.cyan(user.place || 'N/A'));
+        }
+        catch {
+            printKeyValue('User', config.userName || 'Unknown');
+        }
+        // Time
+        if (config.competitionEndsAt) {
+            console.log();
+            const endsAt = new Date(config.competitionEndsAt);
+            const now = new Date();
+            if (now < endsAt) {
+                printKeyValue('Time Remaining', chalk.yellow.bold(formatCountdown(endsAt)));
+            }
+            else {
+                printKeyValue('Time', chalk.red('Competition ended'));
+            }
+        }
+        console.log();
+    });
+    // ─── icoa ctf time ───
+    ctf
+        .command('time')
+        .description('Show competition countdown')
+        .action(async () => {
+        logCommand('ctf time');
+        let config = getConfig();
+        // The cached competition window is only written at `join` time, so a once-
+        // set deadline goes stale the moment an admin changes the event window (and
+        // never self-heals). Re-fetch the live server window here so the countdown
+        // reflects the CURRENT deadline, not a snapshot from when the user joined.
+        // Best-effort: if the refresh fails (offline), fall back to the cached value.
+        if (config.ctfdUrl) {
+            try {
+                const client = new CTFdClient(config.ctfdUrl, config.token, config.sessionCookie);
+                const meta = await client.getCompetitionMeta();
+                const refresh = {};
+                refresh.competitionStartsAt = meta.start ? new Date(meta.start * 1000).toISOString() : '';
+                refresh.competitionEndsAt = meta.end ? new Date(meta.end * 1000).toISOString() : '';
+                saveConfig(refresh);
+                config = getConfig();
+            }
+            catch {
+                /* offline or server unreachable — fall back to cached window */
+            }
+        }
+        if (!config.competitionStartsAt && !config.competitionEndsAt) {
+            printInfo('Competition times not configured.');
+            printInfo('They will be set when the competition server provides timing information.');
+            return;
+        }
+        const now = new Date();
+        const startsAt = config.competitionStartsAt ? new Date(config.competitionStartsAt) : null;
+        const endsAt = config.competitionEndsAt ? new Date(config.competitionEndsAt) : null;
+        printHeader('Competition Timer');
+        // Static snapshot only — print the current countdown once and return.
+        // A live setInterval here corrupts the REPL prompt (it keeps writing
+        // over the prompt line every second) and never stops, so `time` shows
+        // the time remaining at the moment it's run; re-run it to refresh.
+        if (startsAt && now < startsAt) {
+            console.log(chalk.yellow('  Competition has not started yet.'));
+            console.log();
+            console.log(`  ${chalk.bold('Starts in:')} ${formatCountdown(startsAt)}`);
+        }
+        else if (endsAt && now < endsAt) {
+            console.log(chalk.green('  Competition is LIVE'));
+            console.log();
+            console.log(`  ${chalk.bold('Time remaining:')} ${formatCountdown(endsAt)}`);
+            console.log();
+            console.log(chalk.gray('  This is the shared event clock. If you are on a timed exam'));
+            console.log(chalk.gray('  paper, your personal deadline is shown by ') + chalk.white('exam info') + chalk.gray('.'));
+        }
+        else {
+            console.log(chalk.red('  Competition has ended.'));
+        }
+    });
+}