icoa-cli 2.19.356 → 2.19.357

package/dist/lib/demo2-progress.js

@@ -1 +1,102 @@
-import{mkdirSync as t,readFileSync as e,unlinkSync as r,writeFileSync as o}from"node:fs";import{join as n}from"node:path";import{homedir as a}from"node:os";const s=n(a(),".icoa","demo2-progress.json");export function loadDemo2Progress(){let t,r;try{t=e(s,"utf-8")}catch{return null}try{r=JSON.parse(t)}catch{return clearDemo2Progress(),null}if("number"!=typeof r.nextCardIndex||"number"!=typeof r.totalCards||"string"!=typeof r.lang||"number"!=typeof r.startedAt)return clearDemo2Progress(),null;const o=r.completedAt??r.startedAt;return"number"==typeof o&&Date.now()-o>6048e5?(clearDemo2Progress(),null):{nextCardIndex:r.nextCardIndex,totalCards:r.totalCards,lang:r.lang,startedAt:r.startedAt,completedAt:"number"==typeof r.completedAt?r.completedAt:void 0}}export function saveDemo2Progress(e){!function(){try{t(n(a(),".icoa"),{recursive:!0})}catch{}}();try{o(s,JSON.stringify(e))}catch{}}export function clearDemo2Progress(){try{r(s)}catch{}}export function markCardDone(t,e,r,o){saveDemo2Progress({nextCardIndex:t+1,totalCards:e,lang:r,startedAt:o})}export function markDemo2Complete(t,e,r){saveDemo2Progress({nextCardIndex:t,totalCards:t,lang:e,startedAt:r,completedAt:Date.now()})}
+/**
+ * demo2 progress persistence — opt-in resume + replay hooks.
+ *
+ * State lives in `~/.icoa/demo2-progress.json`. Records the last card
+ * index the user finished plus a completedAt timestamp when they reach
+ * the outro. Auto-clears anything older than 7 days so re-runs after a
+ * gap feel like a fresh start (no manual cleanup needed — see
+ * feedback_no_manual_rm).
+ *
+ * Out of scope: scores, answers, language history. Those are run-scoped
+ * and re-initialised every call to runDemo2Once().
+ */
+import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const PROGRESS_FILE = join(homedir(), '.icoa', 'demo2-progress.json');
+// Auto-expire stale partial progress so coming back next month re-greets
+// the user fresh instead of dangling on card 5/10.
+const STALE_AFTER_MS = 7 * 24 * 60 * 60 * 1000;
+function ensureDir() {
+    try {
+        mkdirSync(join(homedir(), '.icoa'), { recursive: true });
+    }
+    catch {
+        // Non-fatal — caller's writeFileSync will surface the real failure
+    }
+}
+/**
+ * Load progress, auto-clearing anything stale. Returns null if no usable
+ * record exists.
+ */
+export function loadDemo2Progress() {
+    let raw;
+    try {
+        raw = readFileSync(PROGRESS_FILE, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        clearDemo2Progress();
+        return null;
+    }
+    if (typeof parsed.nextCardIndex !== 'number' ||
+        typeof parsed.totalCards !== 'number' ||
+        typeof parsed.lang !== 'string' ||
+        typeof parsed.startedAt !== 'number') {
+        clearDemo2Progress();
+        return null;
+    }
+    const anchor = parsed.completedAt ?? parsed.startedAt;
+    if (typeof anchor === 'number' && Date.now() - anchor > STALE_AFTER_MS) {
+        clearDemo2Progress();
+        return null;
+    }
+    return {
+        nextCardIndex: parsed.nextCardIndex,
+        totalCards: parsed.totalCards,
+        lang: parsed.lang,
+        startedAt: parsed.startedAt,
+        completedAt: typeof parsed.completedAt === 'number' ? parsed.completedAt : undefined,
+    };
+}
+export function saveDemo2Progress(p) {
+    ensureDir();
+    try {
+        writeFileSync(PROGRESS_FILE, JSON.stringify(p));
+    }
+    catch {
+        // Non-fatal — progress is convenience, not correctness
+    }
+}
+export function clearDemo2Progress() {
+    try {
+        unlinkSync(PROGRESS_FILE);
+    }
+    catch {
+        // Already absent — fine
+    }
+}
+/** Convenience: record that the user finished card N (0-based). */
+export function markCardDone(cardIndex, totalCards, lang, startedAt) {
+    saveDemo2Progress({
+        nextCardIndex: cardIndex + 1,
+        totalCards,
+        lang,
+        startedAt,
+    });
+}
+export function markDemo2Complete(totalCards, lang, startedAt) {
+    saveDemo2Progress({
+        nextCardIndex: totalCards,
+        totalCards,
+        lang,
+        startedAt,
+        completedAt: Date.now(),
+    });
+}

package/dist/lib/docker-probe.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Detect whether the Docker daemon is running WITHOUT waking it.
+ *
+ * The `docker` CLI is the trigger: on macOS, running any `docker` command
+ * (including `docker info`) can auto-launch Docker Desktop. The old probe
+ * shelled out to `docker info`, so every REPL shell-out and every `shell`
+ * invocation kept starting Docker on the user's Mac even though the sandbox is
+ * OPTIONAL and the host-shell fallback is the norm (2026-07 feedback).
+ *
+ * This probes the daemon's listening SOCKET directly (Node `net`) and never
+ * invokes the `docker` binary. Docker already up → the socket connects → we use
+ * the sandbox. Docker down → connection refused → we silently use the host
+ * shell, and Docker is never started.
+ */
+export type DockerProbeKind = 'unix' | 'tcp' | 'npipe';
+export interface DockerProbeTarget {
+    kind: DockerProbeKind;
+    /** unix/npipe: a filesystem/pipe path. tcp: "host:port". */
+    target: string;
+}
+/**
+ * Ordered daemon endpoints to probe. A `DOCKER_HOST` (unix://, tcp://, npipe://)
+ * overrides everything — it's the user's explicit daemon. Otherwise fall back to
+ * the well-known per-platform sockets, most-specific first. Pure + testable:
+ * platform/env/home are all injected.
+ */
+export declare function dockerProbeTargets(platform: NodeJS.Platform, env: NodeJS.ProcessEnv, home: string): DockerProbeTarget[];
+/**
+ * True if ANY target accepts a connection, probing in order and stopping at the
+ * first hit. `connect` is injected (returns whether a target is reachable) so
+ * the ordering/short-circuit is unit-tested without real sockets.
+ */
+export declare function anyReachable(targets: DockerProbeTarget[], connect: (t: DockerProbeTarget) => Promise<boolean>): Promise<boolean>;
+/**
+ * True iff `raw` is a Docker Engine `/_ping` response from a LIVE daemon — an
+ * HTTP 200. A bare connect isn't enough: after Docker Desktop quits, a lingering
+ * helper can keep the socket connectable while the daemon is down, so we require
+ * the daemon to actually answer the API. Pure + tested.
+ */
+export declare function isDockerPingResponse(raw: string): boolean;
+/**
+ * The public check: is a Docker daemon reachable right now, without starting it?
+ * platform/env/home are injectable for tests; production uses process defaults.
+ */
+export declare function isDockerRunning(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv, home?: string): Promise<boolean>;

package/dist/lib/docker-probe.js

@@ -0,0 +1,118 @@
+/**
+ * Detect whether the Docker daemon is running WITHOUT waking it.
+ *
+ * The `docker` CLI is the trigger: on macOS, running any `docker` command
+ * (including `docker info`) can auto-launch Docker Desktop. The old probe
+ * shelled out to `docker info`, so every REPL shell-out and every `shell`
+ * invocation kept starting Docker on the user's Mac even though the sandbox is
+ * OPTIONAL and the host-shell fallback is the norm (2026-07 feedback).
+ *
+ * This probes the daemon's listening SOCKET directly (Node `net`) and never
+ * invokes the `docker` binary. Docker already up → the socket connects → we use
+ * the sandbox. Docker down → connection refused → we silently use the host
+ * shell, and Docker is never started.
+ */
+import net from 'node:net';
+/**
+ * Ordered daemon endpoints to probe. A `DOCKER_HOST` (unix://, tcp://, npipe://)
+ * overrides everything — it's the user's explicit daemon. Otherwise fall back to
+ * the well-known per-platform sockets, most-specific first. Pure + testable:
+ * platform/env/home are all injected.
+ */
+export function dockerProbeTargets(platform, env, home) {
+    const host = env.DOCKER_HOST?.trim();
+    if (host) {
+        if (host.startsWith('unix://'))
+            return [{ kind: 'unix', target: host.slice('unix://'.length) }];
+        if (host.startsWith('tcp://'))
+            return [{ kind: 'tcp', target: host.slice('tcp://'.length) }];
+        if (host.startsWith('npipe://'))
+            return [{ kind: 'npipe', target: host.slice('npipe://'.length) }];
+        // Unknown scheme — ignore and fall through to platform defaults.
+    }
+    if (platform === 'win32') {
+        return [{ kind: 'npipe', target: '\\\\.\\pipe\\docker_engine' }];
+    }
+    if (platform === 'darwin') {
+        return [
+            { kind: 'unix', target: `${home}/.docker/run/docker.sock` },
+            { kind: 'unix', target: '/var/run/docker.sock' },
+        ];
+    }
+    // linux / wsl / crostini
+    const targets = [{ kind: 'unix', target: '/var/run/docker.sock' }];
+    const xdg = env.XDG_RUNTIME_DIR?.trim();
+    if (xdg)
+        targets.push({ kind: 'unix', target: `${xdg}/docker.sock` }); // rootless docker
+    targets.push({ kind: 'unix', target: `${home}/.docker/run/docker.sock` }); // Docker Desktop for Linux
+    return targets;
+}
+/**
+ * True if ANY target accepts a connection, probing in order and stopping at the
+ * first hit. `connect` is injected (returns whether a target is reachable) so
+ * the ordering/short-circuit is unit-tested without real sockets.
+ */
+export async function anyReachable(targets, connect) {
+    for (const t of targets) {
+        if (await connect(t))
+            return true;
+    }
+    return false;
+}
+/**
+ * True iff `raw` is a Docker Engine `/_ping` response from a LIVE daemon — an
+ * HTTP 200. A bare connect isn't enough: after Docker Desktop quits, a lingering
+ * helper can keep the socket connectable while the daemon is down, so we require
+ * the daemon to actually answer the API. Pure + tested.
+ */
+export function isDockerPingResponse(raw) {
+    return /^HTTP\/1\.[01] 200\b/.test(raw.trimStart());
+}
+// A minimal, version-less Engine API ping. Connection: close so the daemon ends
+// the response and we don't hold the socket.
+const PING_REQUEST = 'GET /_ping HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n';
+/**
+ * Real socket probe: connect, ask the Engine API `/_ping`, resolve true only on
+ * a 200. Uses `net.connect` (NOT the docker CLI), so a stopped Docker Desktop is
+ * NOT auto-started. Short timeout — the socket is local, a live daemon answers
+ * in milliseconds.
+ */
+function connectTarget(t, timeoutMs = 600) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let buf = '';
+        const finish = (v) => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                socket.destroy();
+            }
+            catch {
+                /* ignore */
+            }
+            resolve(v);
+        };
+        const socket = t.kind === 'tcp'
+            ? net.connect({ host: t.target.split(':')[0], port: Number(t.target.split(':')[1]) })
+            : net.connect(t.target); // unix socket path or windows named pipe
+        socket.setTimeout(timeoutMs);
+        socket.once('connect', () => socket.write(PING_REQUEST));
+        socket.on('data', (chunk) => {
+            buf += chunk.toString('utf8');
+            // The status line arrives in the first packet; decide as soon as we have it.
+            if (buf.includes('\n') || buf.length > 15)
+                finish(isDockerPingResponse(buf));
+        });
+        socket.once('timeout', () => finish(false));
+        socket.once('error', () => finish(false));
+        socket.once('close', () => finish(isDockerPingResponse(buf)));
+    });
+}
+/**
+ * The public check: is a Docker daemon reachable right now, without starting it?
+ * platform/env/home are injectable for tests; production uses process defaults.
+ */
+export async function isDockerRunning(platform = process.platform, env = process.env, home = process.env.HOME || process.env.USERPROFILE || '') {
+    return anyReachable(dockerProbeTargets(platform, env, home), connectTarget);
+}

package/dist/lib/editor-spawn.js

@@ -1 +1,53 @@
-import{spawnSync as r}from"node:child_process";import{mkdtempSync as o,readFileSync as t,rmSync as s,writeFileSync as e}from"node:fs";import{tmpdir as n}from"node:os";import{join as i}from"node:path";export function resolveEditor(r=process.env,o=process.platform){const t=(r.VISUAL??"").trim()||(r.EDITOR??"").trim();if(t){const r=t.split(/\s+/);return{cmd:r[0],args:r.slice(1)}}return"win32"===o?{cmd:"notepad",args:[]}:{cmd:"nano",args:[]}}export function editTextInEditor(c,d=".py"){const l=o(i(n(),"icoa-cell-")),a=i(l,`cell${d}`);e(a,""===c||c.endsWith("\n")?c:`${c}\n`);const m=resolveEditor(),p=process.stdin,f=!!p.isTTY&&p.isRaw;try{p.isTTY&&p.setRawMode(!1);const o=r(m.cmd,[...m.args,a],{stdio:"inherit"});return o.error||0!==o.status?null:t(a,"utf8")}catch{return null}finally{p.isTTY&&f&&p.setRawMode(!0),s(l,{recursive:!0,force:!0})}}
+/**
+ * editor-spawn — hand the terminal to the user's $EDITOR for one text
+ * fragment, then take it back. The `git commit` / `crontab -e` idiom: write a
+ * temp file, block on the editor, read the file back.
+ *
+ * BUG-008 note: this must NOT create any readline. `spawnSync` blocks the
+ * event loop, so the main REPL's readline cannot fire while the editor owns
+ * the TTY; we only save/drop/restore raw mode around the child (editors expect
+ * a cooked terminal and manage their own termios).
+ */
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+/** $VISUAL → $EDITOR → nano (notepad on native Windows). Values like
+ *  "code -w" split on whitespace into cmd + args. Pure for testability. */
+export function resolveEditor(env = process.env, platform = process.platform) {
+    const raw = (env.VISUAL ?? '').trim() || (env.EDITOR ?? '').trim();
+    if (raw) {
+        const parts = raw.split(/\s+/);
+        return { cmd: parts[0], args: parts.slice(1) };
+    }
+    return platform === 'win32' ? { cmd: 'notepad', args: [] } : { cmd: 'nano', args: [] };
+}
+/**
+ * Open `initial` in the user's editor; return the edited text, or null if the
+ * editor failed to launch or exited non-zero (a deliberate cancel, vi `:cq`).
+ * Caller is expected to `rl.pause()` before and `rl.resume()` after.
+ */
+export function editTextInEditor(initial, suffix = '.py') {
+    const dir = mkdtempSync(join(tmpdir(), 'icoa-cell-'));
+    const file = join(dir, `cell${suffix}`);
+    writeFileSync(file, initial === '' || initial.endsWith('\n') ? initial : `${initial}\n`);
+    const ed = resolveEditor();
+    const stdin = process.stdin;
+    const wasRaw = stdin.isTTY ? stdin.isRaw : false;
+    try {
+        if (stdin.isTTY)
+            stdin.setRawMode(false);
+        const r = spawnSync(ed.cmd, [...ed.args, file], { stdio: 'inherit' });
+        if (r.error || r.status !== 0)
+            return null;
+        return readFileSync(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (stdin.isTTY && wasRaw)
+            stdin.setRawMode(true);
+        rmSync(dir, { recursive: true, force: true });
+    }
+}

package/dist/lib/exam-client.js

@@ -1 +1,54 @@
-export class ExamClient{baseUrl;token;constructor(t,e){this.baseUrl=t.replace(/\/+$/,""),this.token=e}async request(t,e,r){const s=[`${this.baseUrl}/api/icoa/exams${e}`,`${this.baseUrl}:9090/api/icoa/exams${e}`];let a=null;for(const e of s)try{return await this._fetch(t,e,r)}catch(t){a=t}throw a||new Error("Exam API unreachable")}async _fetch(t,e,r){const s=await fetch(e,{method:t,headers:{Authorization:`Token ${this.token}`,"Content-Type":"application/json"},body:r?JSON.stringify(r):void 0,signal:AbortSignal.timeout(1e4)});if(!s.ok){const t=await s.text().catch(()=>"Unknown error");throw new Error(`Exam API error (${s.status}): ${t}`)}const a=await s.json();if(!1===a.success)throw new Error(a.message||"Exam API error");return a.data}async getExams(){return this.request("GET","")}async startExam(t){return this.request("POST",`/${t}/start`)}async submitExam(t,e){return this.request("POST",`/${t}/submit`,{answers:e})}async getResult(t){return this.request("GET",`/${t}/result`)}}
+export class ExamClient {
+    baseUrl;
+    token;
+    constructor(baseUrl, token) {
+        this.baseUrl = baseUrl.replace(/\/+$/, '');
+        this.token = token;
+    }
+    async request(method, path, body) {
+        // Try nginx proxy first, fallback to direct port
+        const urls = [`${this.baseUrl}/api/icoa/exams${path}`, `${this.baseUrl}:9090/api/icoa/exams${path}`];
+        let lastError = null;
+        for (const url of urls) {
+            try {
+                return await this._fetch(method, url, body);
+            }
+            catch (e) {
+                lastError = e;
+            }
+        }
+        throw lastError || new Error('Exam API unreachable');
+    }
+    async _fetch(method, url, body) {
+        const res = await fetch(url, {
+            method,
+            headers: {
+                Authorization: `Token ${this.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: body ? JSON.stringify(body) : undefined,
+            signal: AbortSignal.timeout(10000),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => 'Unknown error');
+            throw new Error(`Exam API error (${res.status}): ${text}`);
+        }
+        const json = (await res.json());
+        if (json.success === false) {
+            throw new Error(json.message || 'Exam API error');
+        }
+        return json.data;
+    }
+    async getExams() {
+        return this.request('GET', '');
+    }
+    async startExam(examId) {
+        return this.request('POST', `/${examId}/start`);
+    }
+    async submitExam(examId, answers) {
+        return this.request('POST', `/${examId}/submit`, { answers });
+    }
+    async getResult(examId) {
+        return this.request('GET', `/${examId}/result`);
+    }
+}

package/dist/lib/exam-sandbox.js

@@ -1 +1,201 @@
-import{mkdtempSync as t,mkdirSync as e,existsSync as o,appendFileSync as s,statSync as i}from"node:fs";import{execFileSync as n}from"node:child_process";import{tmpdir as r,homedir as a,platform as c}from"node:os";import{join as p,delimiter as l}from"node:path";import{getIcoaDir as d,getConfig as h}from"./config.js";import{getRealExamState as u}from"./exam-state.js";const m=["claude","cursor-agent","aider","codex","ollama","llm","cody","continue","windsurf","mods","gemini","q","chatgpt","sgpt","aichat","copilot"];function f(t){const e=process.env.PATH||"",o="win32"===c()?(process.env.PATHEXT||".EXE;.CMD;.BAT").split(";"):[""];for(const s of e.split(l))if(s)for(const e of o){const o=p(s,t+e);try{if(i(o).isFile())return!0}catch{}}return!1}export function scanForAIBinaries(){const t=[];for(const e of m)f(e)&&t.push(e);if(f("gh"))try{const e=n("gh",["extension","list"],{encoding:"utf-8",timeout:2e3,stdio:["ignore","pipe","ignore"]});/copilot/i.test(e)&&t.push("gh-copilot")}catch{}return t}const g=[{pattern:/(?:^|[\s|;&`$(!])(?:cat|less|more|head|tail|bat)\s+(?:~|\$HOME|\/home\/[^/\s]+|\/Users\/[^/\s]+)/,label:"reads home directory"},{pattern:/\.bash_history|\.zsh_history|\.fish_history|\.python_history/,label:"reads shell history"},{pattern:/(?:^|[\s|;&`$(!])(?:find|grep\s+-[rR]\S*|rg|fd|ack)\s+(?:~|\$HOME|\/home|\/Users)/,label:"searches home directory"},{pattern:/(?:^|[\s|;&`$(!])(?:claude|cursor-agent|aider|codex|ollama|llm|cody|continue|windsurf|mods|gemini|chatgpt|sgpt|aichat|copilot)\b/,label:"invokes AI agent CLI"},{pattern:/(?:^|[;&|]\s*)!?\s*q\b/,label:"invokes AI agent CLI"},{pattern:/(?:^|[\s|;&`$(!])gh\s+copilot\b/,label:"invokes gh copilot"},{pattern:/(?:^|[\s|;&`$(!])history\b/,label:"inspects shell history"},{pattern:/(?:^|[\s|;&`$(!])cd\s+(?:~|\$HOME|\/home|\/Users|\/etc|\/var)/,label:"cd outside exam workspace"}];export function checkShellRisk(t){const e=[];for(const{pattern:o,label:s}of g)o.test(t)&&e.push(s);return e}export function auditIdentity(){const t={},e=h();e.deviceFingerprint&&(t.deviceFingerprint=e.deviceFingerprint);const o=u();return o?.session?.token?t.examToken=o.session.token:e.ctfdUrl&&e.token&&e.userName&&(t.account=e.userName),t}export function logShellAudit(t){const e=u();if(!e)return;const o=JSON.stringify({ts:(new Date).toISOString(),examId:e.session.examId,country:e.session.country,...auditIdentity(),cwd:t.cwd,input:t.input.slice(0,500),riskFlags:t.riskFlags});try{s(p(d(),"exam-audit.log"),`${o}\n`)}catch{}fetch("https://practice.icoa2026.au/api/icoa/exam-audit",{method:"POST",headers:{"Content-Type":"application/json"},body:o,signal:AbortSignal.timeout(3e3)}).catch(()=>{})}export function reportAIBinaryDetection(t){if(0===t.length)return;const e=u(),o=JSON.stringify({ts:(new Date).toISOString(),examId:e?.session.examId??"(pre-start)",country:e?.session.country??"(pre-start)",...auditIdentity(),binaries:t,platform:process.platform});fetch("https://practice.icoa2026.au/api/icoa/exam-ai-binaries",{method:"POST",headers:{"Content-Type":"application/json"},body:o,signal:AbortSignal.timeout(3e3)}).catch(()=>{})}export function createExamWorkspace(e){const o=e.replace(/[^a-zA-Z0-9_-]/g,"_").slice(0,32);return t(p(r(),`icoa-exam-${o}-`))}const y=p(a(),"icoa-workspace");export function getActiveCwd(){const t=u(),s=t?.session?.workspaceDir;return s&&o(s)?s:(o(y)||e(y,{recursive:!0}),y)}
+import { mkdtempSync, mkdirSync, existsSync, appendFileSync, statSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { tmpdir, homedir, platform } from 'node:os';
+import { join, delimiter } from 'node:path';
+import { getIcoaDir, getConfig } from './config.js';
+import { getRealExamState } from './exam-state.js';
+// L3 — AI coding-assistant CLIs that can read terminal output / clipboard
+// and answer exam questions. Detection at exam start makes their presence a
+// knowing, logged choice rather than a silent cheat surface.
+const AI_BINARIES = [
+    'claude',
+    'cursor-agent',
+    'aider',
+    'codex',
+    'ollama',
+    'llm',
+    'cody',
+    'continue',
+    'windsurf',
+    'mods',
+    'gemini',
+    'q', // Amazon Q CLI
+    // 2026-06-19 — kept in sync with the L2 typed-command regex below (RISK_PATTERNS
+    // 'invokes AI agent CLI'). Any name added here must also appear there and vice versa.
+    'chatgpt',
+    'sgpt', // shell-gpt
+    'aichat',
+    'copilot', // GitHub Copilot CLI (standalone; `gh copilot` handled separately)
+];
+function whichBinary(bin) {
+    // PATH-scan implementation — avoids invoking a shell with bin in it.
+    const PATH = process.env.PATH || '';
+    const exts = platform() === 'win32' ? (process.env.PATHEXT || '.EXE;.CMD;.BAT').split(';') : [''];
+    for (const dir of PATH.split(delimiter)) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const p = join(dir, bin + ext);
+            try {
+                if (statSync(p).isFile())
+                    return true;
+            }
+            catch {
+                /* not present */
+            }
+        }
+    }
+    return false;
+}
+export function scanForAIBinaries() {
+    const detected = [];
+    for (const bin of AI_BINARIES) {
+        if (whichBinary(bin))
+            detected.push(bin);
+    }
+    // `gh copilot` is a subcommand of GitHub CLI — only flag `gh` when the
+    // copilot extension is also installed (avoids dinging every gh user).
+    if (whichBinary('gh')) {
+        try {
+            const out = execFileSync('gh', ['extension', 'list'], {
+                encoding: 'utf-8',
+                timeout: 2000,
+                stdio: ['ignore', 'pipe', 'ignore'],
+            });
+            if (/copilot/i.test(out))
+                detected.push('gh-copilot');
+        }
+        catch {
+            /* gh has no extensions or call failed */
+        }
+    }
+    return detected;
+}
+// L2 — patterns whose presence in a `!cmd` strongly suggests reaching
+// outside the exam sandbox for cheat material. Not a block: we log + warn.
+const RISK_PATTERNS = [
+    {
+        pattern: /(?:^|[\s|;&`$(!])(?:cat|less|more|head|tail|bat)\s+(?:~|\$HOME|\/home\/[^/\s]+|\/Users\/[^/\s]+)/,
+        label: 'reads home directory',
+    },
+    { pattern: /\.bash_history|\.zsh_history|\.fish_history|\.python_history/, label: 'reads shell history' },
+    {
+        pattern: /(?:^|[\s|;&`$(!])(?:find|grep\s+-[rR]\S*|rg|fd|ack)\s+(?:~|\$HOME|\/home|\/Users)/,
+        label: 'searches home directory',
+    },
+    {
+        // Multi-char AI CLIs — kept in sync with AI_BINARIES above (the L3 PATH scan).
+        pattern: /(?:^|[\s|;&`$(!])(?:claude|cursor-agent|aider|codex|ollama|llm|cody|continue|windsurf|mods|gemini|chatgpt|sgpt|aichat|copilot)\b/,
+        label: 'invokes AI agent CLI',
+    },
+    {
+        // Amazon Q (`q`) — single-char, so only flag it at a command boundary
+        // (start, or after ; & |, with an optional `!` bang) to avoid 误伤 on a
+        // stray `q` elsewhere in a line (e.g. `grep q file`). Bare `q` at the REPL
+        // is intercepted as "quit" before reaching here.
+        pattern: /(?:^|[;&|]\s*)!?\s*q\b/,
+        label: 'invokes AI agent CLI',
+    },
+    { pattern: /(?:^|[\s|;&`$(!])gh\s+copilot\b/, label: 'invokes gh copilot' },
+    { pattern: /(?:^|[\s|;&`$(!])history\b/, label: 'inspects shell history' },
+    { pattern: /(?:^|[\s|;&`$(!])cd\s+(?:~|\$HOME|\/home|\/Users|\/etc|\/var)/, label: 'cd outside exam workspace' },
+];
+export function checkShellRisk(input) {
+    const flags = [];
+    for (const { pattern, label } of RISK_PATTERNS) {
+        if (pattern.test(input))
+            flags.push(label);
+    }
+    return flags;
+}
+function auditLogPath() {
+    return join(getIcoaDir(), 'exam-audit.log');
+}
+// Identity attached to every audit POST so the server (and post-competition
+// review) can attribute a flagged action to a PERSON — not just an exam id.
+// Without this the server can only record examId+country, and a shared-NAT
+// room collapses to one row. Mirrors the AI-chat account binding in gemini.ts:
+//   1. a proctored exam token wins when a real exam is active (un-forgeable),
+//   2. else the CTFd-join logged-in username (self-reported),
+//   3. the device fingerprint is always included as a last-resort anon key.
+// Self-reported fields are audit signal, not proof — the un-forgeable boundary
+// stays server-side, same as the AI budget. NOTE: this only carries the
+// SANCTIONED-AI-orthogonal external signals (shell-escape risk flags, AI
+// binaries in PATH); the in-CLI ai4ctf AI never routes through here.
+export function auditIdentity() {
+    const id = {};
+    const cfg = getConfig();
+    if (cfg.deviceFingerprint)
+        id.deviceFingerprint = cfg.deviceFingerprint;
+    const realExam = getRealExamState();
+    if (realExam?.session?.token) {
+        id.examToken = realExam.session.token;
+    }
+    else if (cfg.ctfdUrl && cfg.token && cfg.userName) {
+        // CTFd-join session mode (no exam token): attribute to the logged-in account.
+        id.account = cfg.userName;
+    }
+    return id;
+}
+export function logShellAudit(entry) {
+    const state = getRealExamState();
+    if (!state)
+        return; // audit only fires inside a real exam
+    const line = JSON.stringify({
+        ts: new Date().toISOString(),
+        examId: state.session.examId,
+        country: state.session.country,
+        ...auditIdentity(),
+        cwd: entry.cwd,
+        input: entry.input.slice(0, 500),
+        riskFlags: entry.riskFlags,
+    });
+    try {
+        appendFileSync(auditLogPath(), `${line}\n`);
+    }
+    catch {
+        /* local log is best-effort */
+    }
+    fetch('https://practice.icoa2026.au/api/icoa/exam-audit', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: line,
+        signal: AbortSignal.timeout(3000),
+    }).catch(() => { });
+}
+export function reportAIBinaryDetection(binaries) {
+    if (binaries.length === 0)
+        return;
+    const state = getRealExamState();
+    const body = JSON.stringify({
+        ts: new Date().toISOString(),
+        examId: state?.session.examId ?? '(pre-start)',
+        country: state?.session.country ?? '(pre-start)',
+        ...auditIdentity(),
+        binaries,
+        platform: process.platform,
+    });
+    fetch('https://practice.icoa2026.au/api/icoa/exam-ai-binaries', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body,
+        signal: AbortSignal.timeout(3000),
+    }).catch(() => { });
+}
+// L1 — per-exam tmpdir. Replaces ~/icoa-workspace during a real exam so the
+// contestant lands in a clean slate; leaving this dir trips a cwd risk flag
+// via L2. Persists in ExamSession so subsequent REPL invocations reuse it.
+export function createExamWorkspace(examId) {
+    const safeId = examId.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 32);
+    return mkdtempSync(join(tmpdir(), `icoa-exam-${safeId}-`));
+}
+const LEGACY_WORKSPACE = join(homedir(), 'icoa-workspace');
+export function getActiveCwd() {
+    const state = getRealExamState();
+    const w = state?.session?.workspaceDir;
+    if (w && existsSync(w))
+        return w;
+    if (!existsSync(LEGACY_WORKSPACE))
+        mkdirSync(LEGACY_WORKSPACE, { recursive: true });
+    return LEGACY_WORKSPACE;
+}

package/dist/lib/exam-setup.js

@@ -1 +1,36 @@
-import{existsSync as t,readFileSync as e,writeFileSync as n}from"node:fs";import{join as r}from"node:path";import{getIcoaDir as o}from"./config.js";const u=()=>r(o(),"exam-setup.json");export function getExamSetup(){try{return t(u())?JSON.parse(e(u(),"utf-8")):null}catch{return null}}export function saveExamSetup(t){try{n(u(),JSON.stringify(t,null,2))}catch{}}export function isExamSetupComplete(){return null!==getExamSetup()}export function examIdSkipsSetupGate(t){return!!t&&(t.endsWith("-c")||t.startsWith("simoc-"))}
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { getIcoaDir } from './config.js';
+const SETUP_FILE = () => join(getIcoaDir(), 'exam-setup.json');
+export function getExamSetup() {
+    try {
+        if (!existsSync(SETUP_FILE()))
+            return null;
+        return JSON.parse(readFileSync(SETUP_FILE(), 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function saveExamSetup(state) {
+    try {
+        writeFileSync(SETUP_FILE(), JSON.stringify(state, null, 2));
+    }
+    catch { }
+}
+export function isExamSetupComplete() {
+    return getExamSetup() !== null;
+}
+/**
+ * Papers that are MCQ / short-answer only (no Python, no Unix tooling, no
+ * practical/CTF questions) skip the `exam setup` gate entirely — running it
+ * would be pointless and could block a valid token.
+ *
+ *  - Paper C:        exam_id ends in `-c`  (e.g. `zz-2026-c`)
+ *  - SIMOC / Paper M: exam_id starts `simoc-` (e.g. `simoc-2026-g6`)
+ */
+export function examIdSkipsSetupGate(examId) {
+    if (!examId)
+        return false;
+    return examId.endsWith('-c') || examId.startsWith('simoc-');
+}