icoa-cli 2.19.356 → 2.19.357

package/dist/lib/i18n.js

@@ -1 +1,302 @@
-import{getConfig as e}from"./config.js";import{DEMO_AI4CTF_FLAG_B64 as a}from"./demo-flags.js";import{readFileSync as o,existsSync as i}from"node:fs";import{join as n}from"node:path";import{getLangCacheDir as r}from"./translations-fetcher.js";export const EN={howToPlay:"How to play:",htpAnswer:"answer the question",htpHelp:"remove a wrong option",htpNav:"move between questions",htpMoreHelp:"+3 bonus helps",htpBack:"pause and return to menu",htpLang:"view all languages / lang es to switch",egg3:"Sydney Opera House — Great start!",egg5:"A koala says g'day — 1/3 done!",egg7:"Sydney Harbour Bridge — Keep going!",egg9:"A kangaroo hops by — past halfway!",egg11:"Bondi Beach — almost there!",egg13:"Great Barrier Reef — 2 more to go!",egg15:"G'day mate! All done! 🇦🇺",answerThis:"answer this question",helpRemove:"remove a wrong option",helpUsedUp:"used up — type more help for +3",helpAllUsed:"used up",wrong:"wrong",qTutorial:'👉 Try typing "help" to see what happens!',qTutorialBlock:"Try typing help first to see what it does!",qTutorialRequired:"This question requires you to use help before answering.",allAnswered:"🎉 All questions answered!",typeSubmit:"Type exam submit to see your results!",autoSubmitting:"Auto-submitting your demo...",grading:"Grading...",complete:"Complete!",passed:"✓ PASSED",notPassed:"✗ NOT PASSED",score:"Score",incorrectIntro:"incorrect — here are the corrections:",yourAnswer:"Your answer",correct:"Correct",perfectScore:"Perfect score! All answers correct! 🎉",theoryDone:"These were theory questions. In the real ICOA",theoryDone2:"competition, everything happens in this terminal.",didYouKnow:"Did you know?",ctfHistory1:"CTF (Capture The Flag) started at DEF CON 4 in 1996,",ctfHistory2:"Las Vegas. Founded by Jeff Moss (Dark Tangent).",ctfHistory3:"2026 marks 30 years of CTF worldwide.",ctfFlags1:"In a CTF, you solve challenges to find hidden",ctfFlags2:'"flags" — secret codes like:',ctfFlags3:"Find it, submit it, score points!",timeline1:"1996  First CTF @ DEF CON, Las Vegas",timeline2:"2016  DARPA Cyber Grand Challenge — AI enters CTF",timeline3:"2026  ICOA — First AI Security Olympiad, Sydney",twoTracks:"ICOA uses TWO competition tracks:",ai4ctfDesc:"Use AI to help you solve CTF challenges",ai4ctfSub:"AI is your teammate. Chat, ask for hints, work together.",ctf4aiDesc:"Trick the AI (Prompt Injection)",ctf4aiSub:"Can you make the AI break its own safety rules?",wantToContinue:"Want to experience both? Type",orBack:'Or type "back" to return to the main menu.',ai4ctfTitle:"AI4CTF Demo — AI as Your Teammate",ai4ctfSample:"Here's a sample CTF challenge:",ai4ctfChallenge:"Challenge: Hidden Message [Cryptography]",ai4ctfIntercepted:"You intercepted this encoded text:",ai4ctfDecode:"Can you decode it to find the flag?",ai4ctfLevels:"In competition, you get AI help at 3 levels:",ai4ctfHintA:'General guidance — "What type of encoding is this?"',ai4ctfHintAUses:"50 uses per competition. Safe to use freely.",ai4ctfHintB:'Deep analysis — "How do I decode Base64?"',ai4ctfHintBUses:"10 uses. Use when you're stuck.",ai4ctfHintC:"Critical assist — Nearly gives you the answer",ai4ctfHintCUses:"2 uses only. Last resort!",ai4ctfTryNow:"Try now: ask the AI anything about the challenge above.",ai4ctfExample:`Example: "What encoding is ${a}?"`,ai4ctfFreeChat:"Or just chat freely! You can also try hint a, hint b, hint c.",ai4ctfExit:'Type "exit" when done.',ai4ctfReport:"AI4CTF Session Report",ai4ctfTokens:"Tokens used",ai4ctfModel:"AI Model",ai4ctfNext:'Next: try ctf4ai — trick the AI into saying "koala"',tokenLimit:"Token limit reached!",ctf4aiTitle:"CTF4AI Demo — Challenge the AI",ctf4aiChallenge:"Challenge: Make the AI Say a Forbidden Word",ctf4aiIntro1:"In the real world, AI systems have safety rules.",ctf4aiIntro2:"Your job: find a way to trick the AI into breaking them!",ctf4aiRule:'The AI must NEVER say the word "koala".',ctf4aiMission:'Your mission: make it say "koala" anyway!',ctf4aiIdeas:"Ideas to try:",ctf4aiIdea1:"Ask about Australian animals",ctf4aiIdea2:"Ask it to write a story or poem",ctf4aiIdea3:"Ask it to translate or spell something",ctf4aiIdea4:"Be creative — there is no wrong approach!",ctf4aiBudget:"Conversation budget",ctf4aiQuit:'Type "exit" to quit anytime.',ctf4aiSuccess:'🎉 SUCCESS! The AI said "koala"!',ctf4aiDefense:"You broke through the AI's defenses!",ctf4aiInjection:"This is prompt injection — a real AI vulnerability.",ctf4aiHeld:"The AI held its ground this time. 💪",reportTitle:"ICOA Demo — Complete Report",reportStage1:"Stage 1: Theory Exam (15 questions)",reportCompleted:"✓ Completed",reportStage2:"Stage 2: AI4CTF — AI as Your Teammate",reportExperienced:"✓ Experienced",reportStage2Sub:"You used AI to analyze a CTF challenge.",reportStage2Hints:"In competition: hint a (50x) · hint b (10x) · hint c (2x)",reportStage3:"Stage 3: CTF4AI — Trick the AI",reportSolved:'✓ Solved! You made the AI say "koala"',reportNotSolved:"✗ The AI held its ground",reportRecommend:"Recommendations:",reportRec1:"Study cryptography, web security, and networking",reportRec2:"Practice on CTF platforms like picoCTF",reportRec3:"Learn about prompt injection and AI safety",reportRec4:'Explore the 38 reference guides: type "ref"',reportReady:"Ready for the real competition?",reportNations:"View participating countries",reportAbout:"Learn more about ICOA 2026",reportDemo:"Try again",continueTitle:"AI4CTF — AI as Your Teammate",continueLevels:"In AI4CTF, you solve cybersecurity challenges\nwith AI by your side.",continueHints:"In competition, you get AI help at 3 levels:",continueHintA:"General guidance (50 uses)",continueHintB:"Deep analysis (10 uses)",continueHintC:"Critical assist (2 uses)",continueTry:"Try it now! Type:",continueChat:'Chat freely with your AI teammate. Type "exit" when done.',continueAfter:'After ai4ctf, try: ctf4ai — trick the AI into saying "koala"',ai4ctfCommands:"Commands:",ai4ctfSubmitCmd:"Submit your answer (e.g. submit icoa{...})",ai4ctfShellCmd:"Run a shell command (e.g. !echo aWNv... | base64 -d)",ai4ctfEndSession:"End session",ai4ctfCorrectFlag:"🎉 Correct! Flag accepted!",ai4ctfDecoded:"You decoded the Base64 and found the flag.",ai4ctfWouldEarn:"In the real competition, this would earn you points!",ai4ctfWrongFlag:"✗ Incorrect flag. Try again!",ai4ctfFlagHint:"Hint: decode the Base64 string. Flag format: icoa{...}",ai4ctfFoundFlag:"Found a flag? Type: submit <flag>",ai4ctfThinking:"Thinking...",ctf4aiRelaxed:"After 50%, spelled-out variants (K-O-A-L-A) also count!",ctf4aiEnded:"CTF4AI challenge ended.",ctf4aiAlready:'Already in CTF4AI challenge. Type your message or "exit".',ctf4aiPrompt:'Try to make the AI say "koala"...',ctf4aiThinking:"Thinking...",readyToTry:"Ready to try? Type a command:",forNational:"For national selection exams:",viewRegions:"View all participating regions",enterExam:"Enter your country selection exam",htpJump:"jump to a specific question",htpReview:"check progress",htpSubmit:"submit your answers for grading",htpMark:"flag this question to review later",nextLabel:"Next:",reportRetryCta:"Want to nail the ones you missed? Type:",reportRetryWrongN:"retry the {n} wrong question",reportRetryWrongNPlural:"retry the {n} wrong questions",reportBackHint:"return to main menu",reportAboutHint:"Learn more about ICOA 2026",reportExamSetupHint:"next level: prepare tools for national selection",ai4ctfExitNextTitle:"Next:",ai4ctfExitNextSub:"Challenge the AI (Prompt Injection)",ai4ctfExitNextBody:"Can you make an AI violate its own safety rules?",ai4ctfExitCmdNext:"start the next challenge",ai4ctfExitCmdBack:"return to main menu",ai4ctfWelcomeCta:"👉 New here? Start with the hints in order:",ai4ctfHintNudge:"nudge",ai4ctfHintTechnique:"technique",ai4ctfHintPrinciple:"principle + shell reminder",ai4ctfWelcomeNoReveal:"(hints guide you — they never give the answer directly)",ai4ctfOrChat:"Or chat freely with your AI teammate — ask anything",ai4ctfOrChatExample:"about the challenge. Example:",ai4ctfCmdHintLine:"pre-written hints (safe to use)",ai4ctfCmdShellLine:"run a shell command",ai4ctfHintABody:'The string ends with "==" and uses only letters, digits, "+", "/", and "=".\nThat pattern is a fingerprint — you have seen it before.\nWhere is "=" typically used as padding?',ai4ctfHintBBody:"This is Base64 encoded. Decode the string to find the flag.",ai4ctfHintCBody:`Hints never give you the answer directly — they only point you in the right direction.\nFor simple challenges like this one, hint c adds nothing extra:\nhint b already tells you everything you need.\n\nTwo ways forward from here:\n\n  1. Chat with your AI teammate in natural language. Examples:\n       what is the base64 command?\n       how do I decode Base64 on macOS?\n     Just type the question — anything without "!" goes to the AI.\n\n  2. Run a shell command directly. Shell commands inside ai4ctf\n     must start with "!", otherwise your text goes to the AI. Example:\n\n         !echo ${a} | base64 -d`,ai4ctfHintNextA:"Stuck? Try:",ai4ctfHintNextB:"Really stuck? Try:",ai4ctfHintNextC:"Once you have the flag:",examWaysToSolve:"Ways to solve",examWaysSavedTo:"data saved to",examWaysShell:"shell one-liner (base64 / xxd / strings / grep …)",examWaysPythonRepl:"interactive REPL (base64/re pre-imported)",examWaysRefPython:"python cheat-sheet",examWaysAi4ctf:"ask your AI teammate (knows this file)",examWaysFound:"When you find it:",ai4ctfWrapTitle:"✨ What you just learned",ai4ctfWrapLine1Head:"Need a command?",ai4ctfWrapLine1Body:'Just ask your AI teammate in natural\nlanguage — "how do I decode Base64 on the command line?"\nYou do not need to memorize every tool. The AI era is\nabout {thinking}, not mechanical memorization.',ai4ctfWrapLine2Head:"Need to run something?",ai4ctfWrapLine2Body:'Prefix shell commands with "!":',ai4ctfWrapQuotasTitle:"🎯 Real competition hint quotas",ai4ctfWrapQuotaA:"50 uses per competition",ai4ctfWrapQuotaAHint:"(use freely)",ai4ctfWrapQuotaB:"10 uses",ai4ctfWrapQuotaBHint:"(when stuck)",ai4ctfWrapQuotaC:" 2 uses",ai4ctfWrapQuotaCHint:"(last resort)",ai4ctfWrapQuotaFooter:"Prefer hint a → b → c. And when you just need to look\nsomething up, chat with the AI first — it costs nothing\nagainst your hint quota.",ai4ctfWrapNextTitle:"🔜 Next up:",ai4ctfWrapNextSub:'trick the AI into saying "koala"',ai4ctfWrapNextBody:'This next demo {noProg} — just your\nwit and creativity. Can you make a "safe" AI break its\nown rules?',ai4ctfWrapNoProg:"does not need programming",ai4ctfWrapTypeCtf4ai:"Type:",typeAndEnterToBegin:"Type {cmd} and press ENTER to begin.",ai4ctfRevealTitle:"💡 Out of AI tokens — here is the reveal",ai4ctfRevealBody:"Looks like you have not found the flag yet.\nNo worries — for the demo we will just tell you.\n\nRun this command to decode the Base64 string:",ai4ctfRevealSeeFlag:"You will see the flag:",ai4ctfRevealThenSubmit:"Then submit it:",ai4ctfRevealLockNote:"(AI chat is locked — only shell commands and submit work now.)",ai4ctfLockedTitle:"AI chat is locked — out of tokens.",ai4ctfLockedUse:"Use:",ai4ctfLockedThen:"Then:"};let s=null,c={};function l(e){if("en"===e)return{};try{const a=n(r(e),"ui.json");return i(a)?JSON.parse(o(a,"utf8")):{}}catch{return{}}}export function loadUiPack(e){s=e||"en",c=l(s)}export function t(a){const o=e().language||"en";if(o!==s&&(s=o,c=l(o)),"en"!==o){const e=c[a];if(null!=e)return e}return EN[a]}
+import { getConfig } from './config.js';
+import { DEMO_AI4CTF_FLAG_B64 } from './demo-flags.js';
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { getLangCacheDir } from './translations-fetcher.js';
+export const EN = {
+    // How to play
+    howToPlay: 'How to play:',
+    htpAnswer: 'answer the question',
+    htpHelp: 'remove a wrong option',
+    htpNav: 'move between questions',
+    htpMoreHelp: '+3 bonus helps',
+    htpBack: 'pause and return to menu',
+    htpLang: 'view all languages / lang es to switch',
+    // Easter eggs
+    egg3: 'Sydney Opera House — Great start!',
+    egg5: "A koala says g'day — 1/3 done!",
+    egg7: 'Sydney Harbour Bridge — Keep going!',
+    egg9: 'A kangaroo hops by — past halfway!',
+    egg11: 'Bondi Beach — almost there!',
+    egg13: 'Great Barrier Reef — 2 more to go!',
+    egg15: "G'day mate! All done! 🇦🇺",
+    // Question UI
+    answerThis: 'answer this question',
+    helpRemove: 'remove a wrong option',
+    helpUsedUp: 'used up — type more help for +3',
+    helpAllUsed: 'used up',
+    wrong: 'wrong',
+    qTutorial: '👉 Try typing "help" to see what happens!',
+    qTutorialBlock: 'Try typing help first to see what it does!',
+    qTutorialRequired: 'This question requires you to use help before answering.',
+    // Results
+    allAnswered: '🎉 All questions answered!',
+    typeSubmit: 'Type exam submit to see your results!',
+    autoSubmitting: 'Auto-submitting your demo...',
+    grading: 'Grading...',
+    complete: 'Complete!',
+    passed: '✓ PASSED',
+    notPassed: '✗ NOT PASSED',
+    score: 'Score',
+    incorrectIntro: 'incorrect — here are the corrections:',
+    yourAnswer: 'Your answer',
+    correct: 'Correct',
+    perfectScore: 'Perfect score! All answers correct! 🎉',
+    // CTF intro
+    theoryDone: 'These were theory questions. In the real ICOA',
+    theoryDone2: 'competition, everything happens in this terminal.',
+    didYouKnow: 'Did you know?',
+    ctfHistory1: 'CTF (Capture The Flag) started at DEF CON 4 in 1996,',
+    ctfHistory2: 'Las Vegas. Founded by Jeff Moss (Dark Tangent).',
+    ctfHistory3: '2026 marks 30 years of CTF worldwide.',
+    ctfFlags1: 'In a CTF, you solve challenges to find hidden',
+    ctfFlags2: '"flags" — secret codes like:',
+    ctfFlags3: 'Find it, submit it, score points!',
+    timeline1: '1996  First CTF @ DEF CON, Las Vegas',
+    timeline2: '2016  DARPA Cyber Grand Challenge — AI enters CTF',
+    timeline3: '2026  ICOA — First AI Security Olympiad, Sydney',
+    twoTracks: 'ICOA uses TWO competition tracks:',
+    ai4ctfDesc: 'Use AI to help you solve CTF challenges',
+    ai4ctfSub: 'AI is your teammate. Chat, ask for hints, work together.',
+    ctf4aiDesc: 'Trick the AI (Prompt Injection)',
+    ctf4aiSub: 'Can you make the AI break its own safety rules?',
+    wantToContinue: 'Want to experience both? Type',
+    orBack: 'Or type "back" to return to the main menu.',
+    // ai4ctf
+    ai4ctfTitle: 'AI4CTF Demo — AI as Your Teammate',
+    ai4ctfSample: "Here's a sample CTF challenge:",
+    ai4ctfChallenge: 'Challenge: Hidden Message [Cryptography]',
+    ai4ctfIntercepted: 'You intercepted this encoded text:',
+    ai4ctfDecode: 'Can you decode it to find the flag?',
+    ai4ctfLevels: 'In competition, you get AI help at 3 levels:',
+    ai4ctfHintA: 'General guidance — "What type of encoding is this?"',
+    ai4ctfHintAUses: '50 uses per competition. Safe to use freely.',
+    ai4ctfHintB: 'Deep analysis — "How do I decode Base64?"',
+    ai4ctfHintBUses: "10 uses. Use when you're stuck.",
+    ai4ctfHintC: 'Critical assist — Nearly gives you the answer',
+    ai4ctfHintCUses: '2 uses only. Last resort!',
+    ai4ctfTryNow: 'Try now: ask the AI anything about the challenge above.',
+    ai4ctfExample: `Example: "What encoding is ${DEMO_AI4CTF_FLAG_B64}?"`,
+    ai4ctfFreeChat: 'Or just chat freely! You can also try hint a, hint b, hint c.',
+    ai4ctfExit: 'Type "exit" when done.',
+    ai4ctfReport: 'AI4CTF Session Report',
+    ai4ctfTokens: 'Tokens used',
+    ai4ctfModel: 'AI Model',
+    ai4ctfNext: 'Next: try ctf4ai — trick the AI into saying "koala"',
+    tokenLimit: 'Token limit reached!',
+    // ctf4ai
+    ctf4aiTitle: 'CTF4AI Demo — Challenge the AI',
+    ctf4aiChallenge: 'Challenge: Make the AI Say a Forbidden Word',
+    ctf4aiIntro1: 'In the real world, AI systems have safety rules.',
+    ctf4aiIntro2: 'Your job: find a way to trick the AI into breaking them!',
+    ctf4aiRule: 'The AI must NEVER say the word "koala".',
+    ctf4aiMission: 'Your mission: make it say "koala" anyway!',
+    ctf4aiIdeas: 'Ideas to try:',
+    ctf4aiIdea1: 'Ask about Australian animals',
+    ctf4aiIdea2: 'Ask it to write a story or poem',
+    ctf4aiIdea3: 'Ask it to translate or spell something',
+    ctf4aiIdea4: 'Be creative — there is no wrong approach!',
+    ctf4aiBudget: 'Conversation budget',
+    ctf4aiQuit: 'Type "exit" to quit anytime.',
+    ctf4aiSuccess: '🎉 SUCCESS! The AI said "koala"!',
+    ctf4aiDefense: "You broke through the AI's defenses!",
+    ctf4aiInjection: 'This is prompt injection — a real AI vulnerability.',
+    ctf4aiHeld: 'The AI held its ground this time. 💪',
+    // Demo report
+    reportTitle: 'ICOA Demo — Complete Report',
+    reportStage1: 'Stage 1: Theory Exam (15 questions)',
+    reportCompleted: '✓ Completed',
+    reportStage2: 'Stage 2: AI4CTF — AI as Your Teammate',
+    reportExperienced: '✓ Experienced',
+    reportStage2Sub: 'You used AI to analyze a CTF challenge.',
+    reportStage2Hints: 'In competition: hint a (50x) · hint b (10x) · hint c (2x)',
+    reportStage3: 'Stage 3: CTF4AI — Trick the AI',
+    reportSolved: '✓ Solved! You made the AI say "koala"',
+    reportNotSolved: '✗ The AI held its ground',
+    reportRecommend: 'Recommendations:',
+    reportRec1: 'Study cryptography, web security, and networking',
+    reportRec2: 'Practice on CTF platforms like picoCTF',
+    reportRec3: 'Learn about prompt injection and AI safety',
+    reportRec4: 'Explore the 38 reference guides: type "ref"',
+    reportReady: 'Ready for the real competition?',
+    reportNations: 'View participating countries',
+    reportAbout: 'Learn more about ICOA 2026',
+    reportDemo: 'Try again',
+    // continue command
+    continueTitle: 'AI4CTF — AI as Your Teammate',
+    continueLevels: 'In AI4CTF, you solve cybersecurity challenges\nwith AI by your side.',
+    continueHints: 'In competition, you get AI help at 3 levels:',
+    continueHintA: 'General guidance (50 uses)',
+    continueHintB: 'Deep analysis (10 uses)',
+    continueHintC: 'Critical assist (2 uses)',
+    continueTry: 'Try it now! Type:',
+    continueChat: 'Chat freely with your AI teammate. Type "exit" when done.',
+    continueAfter: 'After ai4ctf, try: ctf4ai — trick the AI into saying "koala"',
+    // ai4ctf new features
+    ai4ctfCommands: 'Commands:',
+    ai4ctfSubmitCmd: 'Submit your answer (e.g. submit icoa{...})',
+    ai4ctfShellCmd: 'Run a shell command (e.g. !echo aWNv... | base64 -d)',
+    ai4ctfEndSession: 'End session',
+    ai4ctfCorrectFlag: '🎉 Correct! Flag accepted!',
+    ai4ctfDecoded: 'You decoded the Base64 and found the flag.',
+    ai4ctfWouldEarn: 'In the real competition, this would earn you points!',
+    ai4ctfWrongFlag: '✗ Incorrect flag. Try again!',
+    ai4ctfFlagHint: 'Hint: decode the Base64 string. Flag format: icoa{...}',
+    ai4ctfFoundFlag: 'Found a flag? Type: submit <flag>',
+    ai4ctfThinking: 'Thinking...',
+    // ctf4ai new features
+    ctf4aiRelaxed: 'After 50%, spelled-out variants (K-O-A-L-A) also count!',
+    ctf4aiEnded: 'CTF4AI challenge ended.',
+    ctf4aiAlready: 'Already in CTF4AI challenge. Type your message or "exit".',
+    ctf4aiPrompt: 'Try to make the AI say "koala"...',
+    ctf4aiThinking: 'Thinking...',
+    // exam CTF intro
+    readyToTry: 'Ready to try? Type a command:',
+    forNational: 'For national selection exams:',
+    viewRegions: 'View all participating regions',
+    enterExam: 'Enter your country selection exam',
+    // ═══ v2.19.26–35 additions ═══
+    // Exam help footer (v2.19.26)
+    htpJump: 'jump to a specific question',
+    htpReview: 'check progress',
+    htpSubmit: 'submit your answers for grading',
+    htpMark: 'flag this question to review later',
+    // Stage 1 → Stage 2 handoff (v2.19.28)
+    nextLabel: 'Next:',
+    // Final report retry/back menu (v2.19.28)
+    reportRetryCta: 'Want to nail the ones you missed? Type:',
+    reportRetryWrongN: 'retry the {n} wrong question',
+    reportRetryWrongNPlural: 'retry the {n} wrong questions',
+    reportBackHint: 'return to main menu',
+    reportAboutHint: 'Learn more about ICOA 2026',
+    reportExamSetupHint: 'next level: prepare tools for national selection',
+    // AI4CTF exit → CTF4AI transition (v2.19.47)
+    ai4ctfExitNextTitle: 'Next:',
+    ai4ctfExitNextSub: 'Challenge the AI (Prompt Injection)',
+    ai4ctfExitNextBody: 'Can you make an AI violate its own safety rules?',
+    ai4ctfExitCmdNext: 'start the next challenge',
+    ai4ctfExitCmdBack: 'return to main menu',
+    // ai4ctf welcome / CTA (v2.19.30–32)
+    ai4ctfWelcomeCta: '👉 New here? Start with the hints in order:',
+    ai4ctfHintNudge: 'nudge',
+    ai4ctfHintTechnique: 'technique',
+    ai4ctfHintPrinciple: 'principle + shell reminder',
+    ai4ctfWelcomeNoReveal: '(hints guide you — they never give the answer directly)',
+    ai4ctfOrChat: 'Or chat freely with your AI teammate — ask anything',
+    ai4ctfOrChatExample: 'about the challenge. Example:',
+    ai4ctfCmdHintLine: 'pre-written hints (safe to use)',
+    ai4ctfCmdShellLine: 'run a shell command',
+    // Hint A/B/C bodies (v2.19.30–31 + v2.19.35)
+    ai4ctfHintABody: 'The string ends with "==" and uses only letters, digits, "+", "/", and "=".\n' +
+        'That pattern is a fingerprint — you have seen it before.\n' +
+        'Where is "=" typically used as padding?',
+    ai4ctfHintBBody: 'This is Base64 encoded. Decode the string to find the flag.',
+    ai4ctfHintCBody: 'Hints never give you the answer directly — they only point you in the right direction.\n' +
+        'For simple challenges like this one, hint c adds nothing extra:\n' +
+        'hint b already tells you everything you need.\n' +
+        '\n' +
+        'Two ways forward from here:\n' +
+        '\n' +
+        '  1. Chat with your AI teammate in natural language. Examples:\n' +
+        '       what is the base64 command?\n' +
+        '       how do I decode Base64 on macOS?\n' +
+        '     Just type the question — anything without "!" goes to the AI.\n' +
+        '\n' +
+        '  2. Run a shell command directly. Shell commands inside ai4ctf\n' +
+        '     must start with "!", otherwise your text goes to the AI. Example:\n' +
+        '\n' +
+        `         !echo ${DEMO_AI4CTF_FLAG_B64} | base64 -d`,
+    ai4ctfHintNextA: 'Stuck? Try:',
+    ai4ctfHintNextB: 'Really stuck? Try:',
+    ai4ctfHintNextC: 'Once you have the flag:',
+    examWaysToSolve: 'Ways to solve',
+    examWaysSavedTo: 'data saved to',
+    examWaysShell: 'shell one-liner (base64 / xxd / strings / grep …)',
+    examWaysPythonRepl: 'interactive REPL (base64/re pre-imported)',
+    examWaysRefPython: 'python cheat-sheet',
+    examWaysAi4ctf: 'ask your AI teammate (knows this file)',
+    examWaysFound: 'When you find it:',
+    // Post-solve wrap-up (v2.19.32)
+    ai4ctfWrapTitle: '✨ What you just learned',
+    ai4ctfWrapLine1Head: 'Need a command?',
+    ai4ctfWrapLine1Body: 'Just ask your AI teammate in natural\n' +
+        'language — "how do I decode Base64 on the command line?"\n' +
+        'You do not need to memorize every tool. The AI era is\n' +
+        'about {thinking}, not mechanical memorization.',
+    ai4ctfWrapLine2Head: 'Need to run something?',
+    ai4ctfWrapLine2Body: 'Prefix shell commands with "!":',
+    ai4ctfWrapQuotasTitle: '🎯 Real competition hint quotas',
+    ai4ctfWrapQuotaA: '50 uses per competition',
+    ai4ctfWrapQuotaAHint: '(use freely)',
+    ai4ctfWrapQuotaB: '10 uses',
+    ai4ctfWrapQuotaBHint: '(when stuck)',
+    ai4ctfWrapQuotaC: ' 2 uses',
+    ai4ctfWrapQuotaCHint: '(last resort)',
+    ai4ctfWrapQuotaFooter: 'Prefer hint a → b → c. And when you just need to look\n' +
+        'something up, chat with the AI first — it costs nothing\n' +
+        'against your hint quota.',
+    ai4ctfWrapNextTitle: '🔜 Next up:',
+    ai4ctfWrapNextSub: 'trick the AI into saying "koala"',
+    ai4ctfWrapNextBody: 'This next demo {noProg} — just your\n' + 'wit and creativity. Can you make a "safe" AI break its\n' + 'own rules?',
+    ai4ctfWrapNoProg: 'does not need programming',
+    ai4ctfWrapTypeCtf4ai: 'Type:',
+    // Demo section-transition prompt (MCQ → ai4ctf, ai4ctf → ctf4ai).
+    // {cmd} is replaced in code with the highlighted command name.
+    typeAndEnterToBegin: 'Type {cmd} and press ENTER to begin.',
+    // Token-cap reveal (v2.19.35)
+    ai4ctfRevealTitle: '💡 Out of AI tokens — here is the reveal',
+    ai4ctfRevealBody: 'Looks like you have not found the flag yet.\n' +
+        'No worries — for the demo we will just tell you.\n' +
+        '\n' +
+        'Run this command to decode the Base64 string:',
+    ai4ctfRevealSeeFlag: 'You will see the flag:',
+    ai4ctfRevealThenSubmit: 'Then submit it:',
+    ai4ctfRevealLockNote: '(AI chat is locked — only shell commands and submit work now.)',
+    // Locked-chat bounce (v2.19.35)
+    ai4ctfLockedTitle: 'AI chat is locked — out of tokens.',
+    ai4ctfLockedUse: 'Use:',
+    ai4ctfLockedThen: 'Then:',
+};
+// ─── Lazy-loaded UI packs ──────────────────────────────────────────────────
+// EN is bundled above (offline-instant source of truth). The 20 non-EN UI
+// packs were moved out of the npm tarball (~78KB gz) and ride the existing
+// translation-pack lazy-load: ensureLangCache() fetches <lang>.tar.gz (which
+// now contains ui.json) → ~/.icoa/translations/<lang>/ui.json. t() stays
+// synchronous — it reads config.language each call and lazily loads the active
+// pack from disk once per language (memoized). Missing pack → EN fallback.
+let loadedLang = null;
+let activePack = {};
+function readPack(lang) {
+    if (lang === 'en')
+        return {};
+    try {
+        const p = join(getLangCacheDir(lang), 'ui.json');
+        return existsSync(p) ? JSON.parse(readFileSync(p, 'utf8')) : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Force (re)load the UI pack for `lang` into the in-memory cache. Call right
+ * after a fetch (boot / lang switch) so a freshly-downloaded ui.json takes
+ * effect even if t() already memoized an empty pack for this lang.
+ */
+export function loadUiPack(lang) {
+    loadedLang = lang || 'en';
+    activePack = readPack(loadedLang);
+}
+// For languages without a (loaded) translation, fall back to English.
+export function t(key) {
+    const lang = getConfig().language || 'en';
+    if (lang !== loadedLang) {
+        loadedLang = lang;
+        activePack = readPack(lang);
+    }
+    if (lang !== 'en') {
+        const v = activePack[key];
+        if (v != null)
+            return v;
+    }
+    return EN[key];
+}

package/dist/lib/integrity-snapshot.js

@@ -1 +1,88 @@
-import{readFileSync as t}from"node:fs";import{join as n}from"node:path";import{homedir as o}from"node:os";import{getConfig as e,getBudget as i}from"./config.js";import{getCliVersion as r}from"./version.js";function s(n){try{return JSON.parse(t(n,"utf-8"))}catch{return null}}export async function postIntegritySnapshot(){try{const t=e();if("live"!==t.competitionState)return;const a=t.ctfdUrl;if(!a)return;const c=n(o(),".icoa"),p=i(),d={deviceFingerprint:t.deviceFingerprint||"",installSalt:t.installSalt||"",budget:{tokensUsed:p.tokensUsed,tokenCap:p.tokenCap},simCooldown:s(n(c,"sim-cooldown.json")),tokenBindings:s(n(c,"token-bindings.json"))},m={"Content-Type":"application/json","User-Agent":`icoa-cli/${r()}`,"X-Device-Fingerprint":t.deviceFingerprint||""};t.token&&t.userName&&(d.account=t.userName,m.Authorization=`Token ${t.token}`),await fetch(`${a}/api/icoa/snapshot`,{method:"POST",headers:m,body:JSON.stringify(d),signal:AbortSignal.timeout(8e3)})}catch{}}
+// Submit-triggered integrity sampling (P1.5 — detective layer).
+//
+// On the flag-submit path we fire a SECOND, fire-and-forget POST to our own
+// server carrying a SCRUBBED snapshot of client-only-knowable state, anchored
+// to a real server-recorded scoring event (the CTFd submission). The server
+// debounces (first per 5-min window, server-side so a cheater can't suppress
+// it), reconciles against its own authoritative ledger, and stores the row in
+// an auditable SQLite table.
+//
+// This is DETECTIVE-ONLY: it never auto-judges, never blocks a submit, and
+// never reveals any verdict to the client. It catches casual tampering
+// (`echo > budget.json`, `rm sim-cooldown.json`) and cross-account fingerprint
+// reuse. A sophisticated forger who also fakes consistent snapshots evades it —
+// it COMPLEMENTS the server-authoritative scoring surfaces (§9 of
+// docs/POST_COMPETITION_AUDIT_STANDARD.md), it does not replace them.
+//
+// HARD RULES honored here (see §11):
+//   - Gate on competitionState === 'live' (sample only during the contest).
+//   - NEVER upload secrets: config.accessToken / config.token are excluded.
+//   - Carry the CTFd account identity (Authorization: Token <t> + account) so
+//     the server can VERIFY against CTFd's tokens→users tables — mirrors the
+//     gemini.ts / /api/icoa/audit auth so attribution is evidence, not a
+//     forgeable self-report.
+//   - Fire-and-forget: any failure is swallowed so the submit UX is untouched.
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { getConfig, getBudget } from './config.js';
+import { getCliVersion } from './version.js';
+function readJsonFile(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Fire a scrubbed integrity snapshot to the server. Best-effort, non-blocking,
+ * and self-swallowing — callers may `await` it inside an existing try/catch
+ * without risking the submit flow.
+ */
+export async function postIntegritySnapshot() {
+    try {
+        const config = getConfig();
+        // Gate: only sample during the live contest. Practice/learn traffic is
+        // non-scoring (§9) and carries no integrity interest.
+        if (config.competitionState !== 'live')
+            return;
+        const serverUrl = config.ctfdUrl;
+        if (!serverUrl)
+            return;
+        const icoaDir = join(homedir(), '.icoa');
+        const budget = getBudget();
+        // SCRUBBED payload — only client-only-knowable, non-secret state. The
+        // accessToken / token in config.json are deliberately NOT included.
+        const payload = {
+            deviceFingerprint: config.deviceFingerprint || '',
+            installSalt: config.installSalt || '',
+            budget: { tokensUsed: budget.tokensUsed, tokenCap: budget.tokenCap },
+            simCooldown: readJsonFile(join(icoaDir, 'sim-cooldown.json')),
+            tokenBindings: readJsonFile(join(icoaDir, 'token-bindings.json')),
+        };
+        const headers = {
+            'Content-Type': 'application/json',
+            'User-Agent': `icoa-cli/${getCliVersion()}`,
+            'X-Device-Fingerprint': config.deviceFingerprint || '',
+        };
+        // CTFd-account identity — same mechanism as gemini.ts. Only attach when
+        // connected to a CTFd event; the server VERIFIES the token in-process
+        // (account_verified=1) and falls back to the self-reported account only
+        // when it can't resolve.
+        if (config.token && config.userName) {
+            payload.account = config.userName;
+            headers.Authorization = `Token ${config.token}`;
+        }
+        await fetch(`${serverUrl}/api/icoa/snapshot`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(8000),
+        });
+        // Response intentionally ignored: detective-only, server reveals nothing.
+    }
+    catch {
+        // Swallow everything — the snapshot must never affect the submit UX.
+    }
+}

package/dist/lib/interactive-spawn.js

@@ -1 +1,55 @@
-import{spawn as e}from"node:child_process";import{getMainRl as t}from"./main-rl.js";export function runInteractive(o,s=[],i={}){return new Promise(r=>{const n=t(),c=process.stdin,a=!!c.isTTY&&!!c.isRaw;if(n?.pause(),c.isTTY&&"function"==typeof c.setRawMode)try{c.setRawMode(!1)}catch{}const f=i.shell?e(o,{shell:!0,stdio:"inherit"}):e(o,s,{stdio:"inherit"});let d=!1;const l=e=>{if(!d){if(d=!0,c.isTTY&&"function"==typeof c.setRawMode&&a)try{c.setRawMode(!0)}catch{}n?.resume(),r(e)}};f.on("close",e=>l(e??0)),f.on("error",()=>l(1))})}
+import { spawn } from 'node:child_process';
+import { getMainRl } from './main-rl.js';
+/**
+ * Run an interactive child process (nc / ncat / ssh) with the terminal fully
+ * released so the user's INPUT and Ctrl-C reach the child.
+ *
+ * Why this exists (BUG: pwn `connect` could read output but not send input and
+ * Ctrl-C was dead): when dispatched IN-PROCESS from the icoa REPL, the main
+ * readline holds stdin in RAW mode. A child spawned with `stdio: 'inherit'`
+ * then inherits a raw, non-blocking stdin → its reads see no keystrokes, and
+ * raw mode means Ctrl-C is delivered as a byte (0x03), never as SIGINT → the
+ * session looks frozen and won't quit. `execSync`/`execFileSync` never dropped
+ * raw mode, which is the bug.
+ *
+ * This mirrors repl.ts `runSystemCommand`'s proven TTY dance (pause the rl +
+ * `setRawMode(false)` + async spawn + restore), but pulls the active REPL
+ * readline via getMainRl() so it works BOTH inside the REPL and standalone
+ * (`icoa connect …`, where getMainRl() === null → pause/restore are no-ops).
+ *
+ * Pass a file + args (no shell — injection-safe, preferred for server-supplied
+ * host/port) OR set `shell: true` to run `file` as a full command string.
+ *
+ * Resolves with the child's exit code (1 on spawn error).
+ */
+export function runInteractive(file, args = [], opts = {}) {
+    return new Promise((resolve) => {
+        const rl = getMainRl();
+        const stdin = process.stdin;
+        const wasRaw = stdin.isTTY ? !!stdin.isRaw : false;
+        rl?.pause();
+        if (stdin.isTTY && typeof stdin.setRawMode === 'function') {
+            try {
+                stdin.setRawMode(false);
+            }
+            catch { }
+        }
+        const child = opts.shell ? spawn(file, { shell: true, stdio: 'inherit' }) : spawn(file, args, { stdio: 'inherit' });
+        let settled = false;
+        const restore = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (stdin.isTTY && typeof stdin.setRawMode === 'function' && wasRaw) {
+                try {
+                    stdin.setRawMode(true);
+                }
+                catch { }
+            }
+            rl?.resume();
+            resolve(code);
+        };
+        child.on('close', (code) => restore(code ?? 0));
+        child.on('error', () => restore(1));
+    });
+}

package/dist/lib/ipynb-input.js

@@ -1 +1,65 @@
-export function isBlockOpener(t){const e=t.split("#")[0];return/:\s*$/.test(e)}export function shouldExecuteCell(t){if(0===t.length)return!1;const e=t[t.length-1];return t.length>1?""===e.trim():!(""===e.trim()||isBlockOpener(e)||/\\\s*$/.test(e)||function(t){let e=0;for(const n of t)"("===n||"["===n||"{"===n?e++:")"!==n&&"]"!==n&&"}"!==n||e--;return e}(e)>0)}
+/**
+ * ipynb-input — pure cell-input decision logic for the `icoa ipynb` REPL
+ * (Phase 1 UI of the CLI notebook arena).
+ *
+ * IPython-style model: a one-liner runs the moment you press Enter; a block
+ * (def/for/if/…, an open bracket, or a trailing backslash) keeps accepting
+ * lines until you end it with a blank line. Kept pure so the rule is unit-
+ * tested without a kernel or readline.
+ */
+/**
+ * Does this line open a multi-line block? True when its CODE portion (trailing
+ * `#` comment stripped) ends with a colon. Naive comment-strip — good enough for
+ * opener detection (a real block opener never hides its colon in a comment).
+ */
+export function isBlockOpener(line) {
+    const code = line.split('#')[0];
+    return /:\s*$/.test(code);
+}
+/** Trailing line-continuation backslash. */
+function hasLineContinuation(line) {
+    return /\\\s*$/.test(line);
+}
+/**
+ * Count of unclosed brackets across the buffer. Naive: ignores brackets inside
+ * string literals (rare in interactive one-liners; a blank line always forces
+ * execution as the escape hatch). Positive → still open.
+ */
+function openBracketDepth(code) {
+    let depth = 0;
+    for (const ch of code) {
+        if (ch === '(' || ch === '[' || ch === '{')
+            depth++;
+        else if (ch === ')' || ch === ']' || ch === '}')
+            depth--;
+    }
+    return depth;
+}
+/**
+ * Given the lines accumulated SO FAR (including the just-entered line), decide
+ * whether to execute the cell now or keep taking input.
+ *
+ *  - empty buffer → nothing to run (false),
+ *  - multi-line cell → execute as soon as the last line is blank,
+ *  - single line → execute unless it opens a block / ends with `\` / has an
+ *    unbalanced bracket.
+ */
+export function shouldExecuteCell(lines) {
+    if (lines.length === 0)
+        return false;
+    const last = lines[lines.length - 1];
+    if (lines.length > 1) {
+        // In multi-line mode a blank line is the universal "run it now".
+        return last.trim() === '';
+    }
+    // Single line.
+    if (last.trim() === '')
+        return false;
+    if (isBlockOpener(last))
+        return false;
+    if (hasLineContinuation(last))
+        return false;
+    if (openBracketDepth(last) > 0)
+        return false;
+    return true;
+}

package/dist/lib/kernel-protocol.js

@@ -1 +1,88 @@
-const e=new Set(["ready","stream","result","display","error","done","fatal"]);export function parseKernelEvent(t){const a=t.trim();if(!a)return null;let r;try{r=JSON.parse(a)}catch{return null}if(!r||"object"!=typeof r)return null;const n=r.type;return"string"==typeof n&&e.has(n)?r:null}export function foldCellOutputs(e){const t=[];let a=!0,r=null;for(const n of e)switch(n.type){case"stream":{const e=t[t.length-1];e&&"stream"===e.kind&&e.name===n.name?e.text+=n.text:t.push({kind:"stream",name:n.name,text:n.text});break}case"result":t.push({kind:"result",text:n.text,...n.data?{data:n.data}:{}});break;case"display":t.push({kind:"display",data:n.data});break;case"error":a=!1,t.push({kind:"error",ename:n.ename,evalue:n.evalue,traceback:n.traceback});break;case"done":r=n.count;break;case"fatal":a=!1,t.push({kind:"error",ename:"KernelError",evalue:n.message,traceback:[n.message]})}return{outputs:t,ok:a,execCount:r}}
+/**
+ * Kernel protocol — the pure Node side of the Node ↔ Python-bridge boundary
+ * (Phase 1 of the CLI notebook arena, see `project_cli_notebook_arena_plan`).
+ *
+ * icoa is TypeScript/Node, but Jupyter kernels are driven by `jupyter_client`
+ * (Python). So a thin Python bridge (shipped alongside, run from the aienv
+ * venv) owns the kernel and speaks a line-delimited JSON protocol to Node: one
+ * event object per stdout line. This module parses those lines and folds them
+ * into renderable cell outputs.
+ *
+ * Keeping this layer pure (no I/O) means the wire contract is unit-tested
+ * without spawning Python — and it stays identical whether the bridge drives a
+ * LOCAL kernel (Phase 1) or a REMOTE one over a Kernel Gateway (Phase 2/4). The
+ * Node side never changes; only the bridge's connection does.
+ */
+const KNOWN_TYPES = new Set(['ready', 'stream', 'result', 'display', 'error', 'done', 'fatal']);
+/**
+ * Parse one stdout line from the bridge into a KernelEvent. Returns null for
+ * blank lines, non-JSON, or JSON without a recognized `type` (the bridge may
+ * interleave incidental output; we ignore anything not in the protocol).
+ */
+export function parseKernelEvent(line) {
+    const trimmed = line.trim();
+    if (!trimmed)
+        return null;
+    let obj;
+    try {
+        obj = JSON.parse(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (!obj || typeof obj !== 'object')
+        return null;
+    const type = obj.type;
+    if (typeof type !== 'string' || !KNOWN_TYPES.has(type))
+        return null;
+    return obj;
+}
+/**
+ * Fold a cell's event stream into renderable outputs.
+ *
+ *  - consecutive `stream` events of the SAME name coalesce into one text block
+ *    (matches Jupyter's stdout/stderr batching → clean rendering),
+ *  - `result` / `display` / `error` pass through as discrete blocks,
+ *  - any `error` sets ok=false,
+ *  - `done.count` becomes execCount (null if the cell never finished).
+ */
+export function foldCellOutputs(events) {
+    const outputs = [];
+    let ok = true;
+    let execCount = null;
+    for (const e of events) {
+        switch (e.type) {
+            case 'stream': {
+                const last = outputs[outputs.length - 1];
+                if (last && last.kind === 'stream' && last.name === e.name) {
+                    last.text += e.text;
+                }
+                else {
+                    outputs.push({ kind: 'stream', name: e.name, text: e.text });
+                }
+                break;
+            }
+            case 'result':
+                outputs.push({ kind: 'result', text: e.text, ...(e.data ? { data: e.data } : {}) });
+                break;
+            case 'display':
+                outputs.push({ kind: 'display', data: e.data });
+                break;
+            case 'error':
+                ok = false;
+                outputs.push({ kind: 'error', ename: e.ename, evalue: e.evalue, traceback: e.traceback });
+                break;
+            case 'done':
+                execCount = e.count;
+                break;
+            case 'fatal':
+                ok = false;
+                outputs.push({ kind: 'error', ename: 'KernelError', evalue: e.message, traceback: [e.message] });
+                break;
+            default:
+                // 'ready' and any future event types carry no cell output.
+                break;
+        }
+    }
+    return { outputs, ok, execCount };
+}