icoa-cli 2.19.357 → 2.19.358

package/dist/lib/demo2-progress.js

@@ -1,102 +1 @@
-/**
- * demo2 progress persistence — opt-in resume + replay hooks.
- *
- * State lives in `~/.icoa/demo2-progress.json`. Records the last card
- * index the user finished plus a completedAt timestamp when they reach
- * the outro. Auto-clears anything older than 7 days so re-runs after a
- * gap feel like a fresh start (no manual cleanup needed — see
- * feedback_no_manual_rm).
- *
- * Out of scope: scores, answers, language history. Those are run-scoped
- * and re-initialised every call to runDemo2Once().
- */
-import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
-const PROGRESS_FILE = join(homedir(), '.icoa', 'demo2-progress.json');
-// Auto-expire stale partial progress so coming back next month re-greets
-// the user fresh instead of dangling on card 5/10.
-const STALE_AFTER_MS = 7 * 24 * 60 * 60 * 1000;
-function ensureDir() {
-    try {
-        mkdirSync(join(homedir(), '.icoa'), { recursive: true });
-    }
-    catch {
-        // Non-fatal — caller's writeFileSync will surface the real failure
-    }
-}
-/**
- * Load progress, auto-clearing anything stale. Returns null if no usable
- * record exists.
- */
-export function loadDemo2Progress() {
-    let raw;
-    try {
-        raw = readFileSync(PROGRESS_FILE, 'utf-8');
-    }
-    catch {
-        return null;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        clearDemo2Progress();
-        return null;
-    }
-    if (typeof parsed.nextCardIndex !== 'number' ||
-        typeof parsed.totalCards !== 'number' ||
-        typeof parsed.lang !== 'string' ||
-        typeof parsed.startedAt !== 'number') {
-        clearDemo2Progress();
-        return null;
-    }
-    const anchor = parsed.completedAt ?? parsed.startedAt;
-    if (typeof anchor === 'number' && Date.now() - anchor > STALE_AFTER_MS) {
-        clearDemo2Progress();
-        return null;
-    }
-    return {
-        nextCardIndex: parsed.nextCardIndex,
-        totalCards: parsed.totalCards,
-        lang: parsed.lang,
-        startedAt: parsed.startedAt,
-        completedAt: typeof parsed.completedAt === 'number' ? parsed.completedAt : undefined,
-    };
-}
-export function saveDemo2Progress(p) {
-    ensureDir();
-    try {
-        writeFileSync(PROGRESS_FILE, JSON.stringify(p));
-    }
-    catch {
-        // Non-fatal — progress is convenience, not correctness
-    }
-}
-export function clearDemo2Progress() {
-    try {
-        unlinkSync(PROGRESS_FILE);
-    }
-    catch {
-        // Already absent — fine
-    }
-}
-/** Convenience: record that the user finished card N (0-based). */
-export function markCardDone(cardIndex, totalCards, lang, startedAt) {
-    saveDemo2Progress({
-        nextCardIndex: cardIndex + 1,
-        totalCards,
-        lang,
-        startedAt,
-    });
-}
-export function markDemo2Complete(totalCards, lang, startedAt) {
-    saveDemo2Progress({
-        nextCardIndex: totalCards,
-        totalCards,
-        lang,
-        startedAt,
-        completedAt: Date.now(),
-    });
-}
+import{mkdirSync as t,readFileSync as e,unlinkSync as r,writeFileSync as o}from"node:fs";import{join as n}from"node:path";import{homedir as a}from"node:os";const s=n(a(),".icoa","demo2-progress.json");export function loadDemo2Progress(){let t,r;try{t=e(s,"utf-8")}catch{return null}try{r=JSON.parse(t)}catch{return clearDemo2Progress(),null}if("number"!=typeof r.nextCardIndex||"number"!=typeof r.totalCards||"string"!=typeof r.lang||"number"!=typeof r.startedAt)return clearDemo2Progress(),null;const o=r.completedAt??r.startedAt;return"number"==typeof o&&Date.now()-o>6048e5?(clearDemo2Progress(),null):{nextCardIndex:r.nextCardIndex,totalCards:r.totalCards,lang:r.lang,startedAt:r.startedAt,completedAt:"number"==typeof r.completedAt?r.completedAt:void 0}}export function saveDemo2Progress(e){!function(){try{t(n(a(),".icoa"),{recursive:!0})}catch{}}();try{o(s,JSON.stringify(e))}catch{}}export function clearDemo2Progress(){try{r(s)}catch{}}export function markCardDone(t,e,r,o){saveDemo2Progress({nextCardIndex:t+1,totalCards:e,lang:r,startedAt:o})}export function markDemo2Complete(t,e,r){saveDemo2Progress({nextCardIndex:t,totalCards:t,lang:e,startedAt:r,completedAt:Date.now()})}

package/dist/lib/docker-probe.js

@@ -1,118 +1 @@
-/**
- * Detect whether the Docker daemon is running WITHOUT waking it.
- *
- * The `docker` CLI is the trigger: on macOS, running any `docker` command
- * (including `docker info`) can auto-launch Docker Desktop. The old probe
- * shelled out to `docker info`, so every REPL shell-out and every `shell`
- * invocation kept starting Docker on the user's Mac even though the sandbox is
- * OPTIONAL and the host-shell fallback is the norm (2026-07 feedback).
- *
- * This probes the daemon's listening SOCKET directly (Node `net`) and never
- * invokes the `docker` binary. Docker already up → the socket connects → we use
- * the sandbox. Docker down → connection refused → we silently use the host
- * shell, and Docker is never started.
- */
-import net from 'node:net';
-/**
- * Ordered daemon endpoints to probe. A `DOCKER_HOST` (unix://, tcp://, npipe://)
- * overrides everything — it's the user's explicit daemon. Otherwise fall back to
- * the well-known per-platform sockets, most-specific first. Pure + testable:
- * platform/env/home are all injected.
- */
-export function dockerProbeTargets(platform, env, home) {
-    const host = env.DOCKER_HOST?.trim();
-    if (host) {
-        if (host.startsWith('unix://'))
-            return [{ kind: 'unix', target: host.slice('unix://'.length) }];
-        if (host.startsWith('tcp://'))
-            return [{ kind: 'tcp', target: host.slice('tcp://'.length) }];
-        if (host.startsWith('npipe://'))
-            return [{ kind: 'npipe', target: host.slice('npipe://'.length) }];
-        // Unknown scheme — ignore and fall through to platform defaults.
-    }
-    if (platform === 'win32') {
-        return [{ kind: 'npipe', target: '\\\\.\\pipe\\docker_engine' }];
-    }
-    if (platform === 'darwin') {
-        return [
-            { kind: 'unix', target: `${home}/.docker/run/docker.sock` },
-            { kind: 'unix', target: '/var/run/docker.sock' },
-        ];
-    }
-    // linux / wsl / crostini
-    const targets = [{ kind: 'unix', target: '/var/run/docker.sock' }];
-    const xdg = env.XDG_RUNTIME_DIR?.trim();
-    if (xdg)
-        targets.push({ kind: 'unix', target: `${xdg}/docker.sock` }); // rootless docker
-    targets.push({ kind: 'unix', target: `${home}/.docker/run/docker.sock` }); // Docker Desktop for Linux
-    return targets;
-}
-/**
- * True if ANY target accepts a connection, probing in order and stopping at the
- * first hit. `connect` is injected (returns whether a target is reachable) so
- * the ordering/short-circuit is unit-tested without real sockets.
- */
-export async function anyReachable(targets, connect) {
-    for (const t of targets) {
-        if (await connect(t))
-            return true;
-    }
-    return false;
-}
-/**
- * True iff `raw` is a Docker Engine `/_ping` response from a LIVE daemon — an
- * HTTP 200. A bare connect isn't enough: after Docker Desktop quits, a lingering
- * helper can keep the socket connectable while the daemon is down, so we require
- * the daemon to actually answer the API. Pure + tested.
- */
-export function isDockerPingResponse(raw) {
-    return /^HTTP\/1\.[01] 200\b/.test(raw.trimStart());
-}
-// A minimal, version-less Engine API ping. Connection: close so the daemon ends
-// the response and we don't hold the socket.
-const PING_REQUEST = 'GET /_ping HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n';
-/**
- * Real socket probe: connect, ask the Engine API `/_ping`, resolve true only on
- * a 200. Uses `net.connect` (NOT the docker CLI), so a stopped Docker Desktop is
- * NOT auto-started. Short timeout — the socket is local, a live daemon answers
- * in milliseconds.
- */
-function connectTarget(t, timeoutMs = 600) {
-    return new Promise((resolve) => {
-        let settled = false;
-        let buf = '';
-        const finish = (v) => {
-            if (settled)
-                return;
-            settled = true;
-            try {
-                socket.destroy();
-            }
-            catch {
-                /* ignore */
-            }
-            resolve(v);
-        };
-        const socket = t.kind === 'tcp'
-            ? net.connect({ host: t.target.split(':')[0], port: Number(t.target.split(':')[1]) })
-            : net.connect(t.target); // unix socket path or windows named pipe
-        socket.setTimeout(timeoutMs);
-        socket.once('connect', () => socket.write(PING_REQUEST));
-        socket.on('data', (chunk) => {
-            buf += chunk.toString('utf8');
-            // The status line arrives in the first packet; decide as soon as we have it.
-            if (buf.includes('\n') || buf.length > 15)
-                finish(isDockerPingResponse(buf));
-        });
-        socket.once('timeout', () => finish(false));
-        socket.once('error', () => finish(false));
-        socket.once('close', () => finish(isDockerPingResponse(buf)));
-    });
-}
-/**
- * The public check: is a Docker daemon reachable right now, without starting it?
- * platform/env/home are injectable for tests; production uses process defaults.
- */
-export async function isDockerRunning(platform = process.platform, env = process.env, home = process.env.HOME || process.env.USERPROFILE || '') {
-    return anyReachable(dockerProbeTargets(platform, env, home), connectTarget);
-}
+import t from"node:net";export function dockerProbeTargets(t,e,n){const r=e.DOCKER_HOST?.trim();if(r){if(r.startsWith("unix://"))return[{kind:"unix",target:r.slice(7)}];if(r.startsWith("tcp://"))return[{kind:"tcp",target:r.slice(6)}];if(r.startsWith("npipe://"))return[{kind:"npipe",target:r.slice(8)}]}if("win32"===t)return[{kind:"npipe",target:"\\\\.\\pipe\\docker_engine"}];if("darwin"===t)return[{kind:"unix",target:`${n}/.docker/run/docker.sock`},{kind:"unix",target:"/var/run/docker.sock"}];const o=[{kind:"unix",target:"/var/run/docker.sock"}],i=e.XDG_RUNTIME_DIR?.trim();return i&&o.push({kind:"unix",target:`${i}/docker.sock`}),o.push({kind:"unix",target:`${n}/.docker/run/docker.sock`}),o}export async function anyReachable(t,e){for(const n of t)if(await e(n))return!0;return!1}export function isDockerPingResponse(t){return/^HTTP\/1\.[01] 200\b/.test(t.trimStart())}function e(e,n=600){return new Promise(r=>{let o=!1,i="";const c=t=>{if(!o){o=!0;try{s.destroy()}catch{}r(t)}},s="tcp"===e.kind?t.connect({host:e.target.split(":")[0],port:Number(e.target.split(":")[1])}):t.connect(e.target);s.setTimeout(n),s.once("connect",()=>s.write("GET /_ping HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")),s.on("data",t=>{i+=t.toString("utf8"),(i.includes("\n")||i.length>15)&&c(isDockerPingResponse(i))}),s.once("timeout",()=>c(!1)),s.once("error",()=>c(!1)),s.once("close",()=>c(isDockerPingResponse(i)))})}export async function isDockerRunning(t=process.platform,n=process.env,r=process.env.HOME||process.env.USERPROFILE||""){return anyReachable(dockerProbeTargets(t,n,r),e)}

package/dist/lib/editor-spawn.js

@@ -1,53 +1 @@
-/**
- * editor-spawn — hand the terminal to the user's $EDITOR for one text
- * fragment, then take it back. The `git commit` / `crontab -e` idiom: write a
- * temp file, block on the editor, read the file back.
- *
- * BUG-008 note: this must NOT create any readline. `spawnSync` blocks the
- * event loop, so the main REPL's readline cannot fire while the editor owns
- * the TTY; we only save/drop/restore raw mode around the child (editors expect
- * a cooked terminal and manage their own termios).
- */
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-/** $VISUAL → $EDITOR → nano (notepad on native Windows). Values like
- *  "code -w" split on whitespace into cmd + args. Pure for testability. */
-export function resolveEditor(env = process.env, platform = process.platform) {
-    const raw = (env.VISUAL ?? '').trim() || (env.EDITOR ?? '').trim();
-    if (raw) {
-        const parts = raw.split(/\s+/);
-        return { cmd: parts[0], args: parts.slice(1) };
-    }
-    return platform === 'win32' ? { cmd: 'notepad', args: [] } : { cmd: 'nano', args: [] };
-}
-/**
- * Open `initial` in the user's editor; return the edited text, or null if the
- * editor failed to launch or exited non-zero (a deliberate cancel, vi `:cq`).
- * Caller is expected to `rl.pause()` before and `rl.resume()` after.
- */
-export function editTextInEditor(initial, suffix = '.py') {
-    const dir = mkdtempSync(join(tmpdir(), 'icoa-cell-'));
-    const file = join(dir, `cell${suffix}`);
-    writeFileSync(file, initial === '' || initial.endsWith('\n') ? initial : `${initial}\n`);
-    const ed = resolveEditor();
-    const stdin = process.stdin;
-    const wasRaw = stdin.isTTY ? stdin.isRaw : false;
-    try {
-        if (stdin.isTTY)
-            stdin.setRawMode(false);
-        const r = spawnSync(ed.cmd, [...ed.args, file], { stdio: 'inherit' });
-        if (r.error || r.status !== 0)
-            return null;
-        return readFileSync(file, 'utf8');
-    }
-    catch {
-        return null;
-    }
-    finally {
-        if (stdin.isTTY && wasRaw)
-            stdin.setRawMode(true);
-        rmSync(dir, { recursive: true, force: true });
-    }
-}
+import{spawnSync as r}from"node:child_process";import{mkdtempSync as o,readFileSync as t,rmSync as s,writeFileSync as e}from"node:fs";import{tmpdir as n}from"node:os";import{join as i}from"node:path";export function resolveEditor(r=process.env,o=process.platform){const t=(r.VISUAL??"").trim()||(r.EDITOR??"").trim();if(t){const r=t.split(/\s+/);return{cmd:r[0],args:r.slice(1)}}return"win32"===o?{cmd:"notepad",args:[]}:{cmd:"nano",args:[]}}export function editTextInEditor(c,d=".py"){const l=o(i(n(),"icoa-cell-")),a=i(l,`cell${d}`);e(a,""===c||c.endsWith("\n")?c:`${c}\n`);const m=resolveEditor(),p=process.stdin,f=!!p.isTTY&&p.isRaw;try{p.isTTY&&p.setRawMode(!1);const o=r(m.cmd,[...m.args,a],{stdio:"inherit"});return o.error||0!==o.status?null:t(a,"utf8")}catch{return null}finally{p.isTTY&&f&&p.setRawMode(!0),s(l,{recursive:!0,force:!0})}}

package/dist/lib/exam-client.js

@@ -1,54 +1 @@
-export class ExamClient {
-    baseUrl;
-    token;
-    constructor(baseUrl, token) {
-        this.baseUrl = baseUrl.replace(/\/+$/, '');
-        this.token = token;
-    }
-    async request(method, path, body) {
-        // Try nginx proxy first, fallback to direct port
-        const urls = [`${this.baseUrl}/api/icoa/exams${path}`, `${this.baseUrl}:9090/api/icoa/exams${path}`];
-        let lastError = null;
-        for (const url of urls) {
-            try {
-                return await this._fetch(method, url, body);
-            }
-            catch (e) {
-                lastError = e;
-            }
-        }
-        throw lastError || new Error('Exam API unreachable');
-    }
-    async _fetch(method, url, body) {
-        const res = await fetch(url, {
-            method,
-            headers: {
-                Authorization: `Token ${this.token}`,
-                'Content-Type': 'application/json',
-            },
-            body: body ? JSON.stringify(body) : undefined,
-            signal: AbortSignal.timeout(10000),
-        });
-        if (!res.ok) {
-            const text = await res.text().catch(() => 'Unknown error');
-            throw new Error(`Exam API error (${res.status}): ${text}`);
-        }
-        const json = (await res.json());
-        if (json.success === false) {
-            throw new Error(json.message || 'Exam API error');
-        }
-        return json.data;
-    }
-    async getExams() {
-        return this.request('GET', '');
-    }
-    async startExam(examId) {
-        return this.request('POST', `/${examId}/start`);
-    }
-    async submitExam(examId, answers) {
-        return this.request('POST', `/${examId}/submit`, { answers });
-    }
-    async getResult(examId) {
-        return this.request('GET', `/${examId}/result`);
-    }
-}
+export class ExamClient{baseUrl;token;constructor(t,e){this.baseUrl=t.replace(/\/+$/,""),this.token=e}async request(t,e,r){const s=[`${this.baseUrl}/api/icoa/exams${e}`,`${this.baseUrl}:9090/api/icoa/exams${e}`];let a=null;for(const e of s)try{return await this._fetch(t,e,r)}catch(t){a=t}throw a||new Error("Exam API unreachable")}async _fetch(t,e,r){const s=await fetch(e,{method:t,headers:{Authorization:`Token ${this.token}`,"Content-Type":"application/json"},body:r?JSON.stringify(r):void 0,signal:AbortSignal.timeout(1e4)});if(!s.ok){const t=await s.text().catch(()=>"Unknown error");throw new Error(`Exam API error (${s.status}): ${t}`)}const a=await s.json();if(!1===a.success)throw new Error(a.message||"Exam API error");return a.data}async getExams(){return this.request("GET","")}async startExam(t){return this.request("POST",`/${t}/start`)}async submitExam(t,e){return this.request("POST",`/${t}/submit`,{answers:e})}async getResult(t){return this.request("GET",`/${t}/result`)}}

package/dist/lib/exam-sandbox.js

@@ -1,201 +1 @@
-import { mkdtempSync, mkdirSync, existsSync, appendFileSync, statSync } from 'node:fs';
-import { execFileSync } from 'node:child_process';
-import { tmpdir, homedir, platform } from 'node:os';
-import { join, delimiter } from 'node:path';
-import { getIcoaDir, getConfig } from './config.js';
-import { getRealExamState } from './exam-state.js';
-// L3 — AI coding-assistant CLIs that can read terminal output / clipboard
-// and answer exam questions. Detection at exam start makes their presence a
-// knowing, logged choice rather than a silent cheat surface.
-const AI_BINARIES = [
-    'claude',
-    'cursor-agent',
-    'aider',
-    'codex',
-    'ollama',
-    'llm',
-    'cody',
-    'continue',
-    'windsurf',
-    'mods',
-    'gemini',
-    'q', // Amazon Q CLI
-    // 2026-06-19 — kept in sync with the L2 typed-command regex below (RISK_PATTERNS
-    // 'invokes AI agent CLI'). Any name added here must also appear there and vice versa.
-    'chatgpt',
-    'sgpt', // shell-gpt
-    'aichat',
-    'copilot', // GitHub Copilot CLI (standalone; `gh copilot` handled separately)
-];
-function whichBinary(bin) {
-    // PATH-scan implementation — avoids invoking a shell with bin in it.
-    const PATH = process.env.PATH || '';
-    const exts = platform() === 'win32' ? (process.env.PATHEXT || '.EXE;.CMD;.BAT').split(';') : [''];
-    for (const dir of PATH.split(delimiter)) {
-        if (!dir)
-            continue;
-        for (const ext of exts) {
-            const p = join(dir, bin + ext);
-            try {
-                if (statSync(p).isFile())
-                    return true;
-            }
-            catch {
-                /* not present */
-            }
-        }
-    }
-    return false;
-}
-export function scanForAIBinaries() {
-    const detected = [];
-    for (const bin of AI_BINARIES) {
-        if (whichBinary(bin))
-            detected.push(bin);
-    }
-    // `gh copilot` is a subcommand of GitHub CLI — only flag `gh` when the
-    // copilot extension is also installed (avoids dinging every gh user).
-    if (whichBinary('gh')) {
-        try {
-            const out = execFileSync('gh', ['extension', 'list'], {
-                encoding: 'utf-8',
-                timeout: 2000,
-                stdio: ['ignore', 'pipe', 'ignore'],
-            });
-            if (/copilot/i.test(out))
-                detected.push('gh-copilot');
-        }
-        catch {
-            /* gh has no extensions or call failed */
-        }
-    }
-    return detected;
-}
-// L2 — patterns whose presence in a `!cmd` strongly suggests reaching
-// outside the exam sandbox for cheat material. Not a block: we log + warn.
-const RISK_PATTERNS = [
-    {
-        pattern: /(?:^|[\s|;&`$(!])(?:cat|less|more|head|tail|bat)\s+(?:~|\$HOME|\/home\/[^/\s]+|\/Users\/[^/\s]+)/,
-        label: 'reads home directory',
-    },
-    { pattern: /\.bash_history|\.zsh_history|\.fish_history|\.python_history/, label: 'reads shell history' },
-    {
-        pattern: /(?:^|[\s|;&`$(!])(?:find|grep\s+-[rR]\S*|rg|fd|ack)\s+(?:~|\$HOME|\/home|\/Users)/,
-        label: 'searches home directory',
-    },
-    {
-        // Multi-char AI CLIs — kept in sync with AI_BINARIES above (the L3 PATH scan).
-        pattern: /(?:^|[\s|;&`$(!])(?:claude|cursor-agent|aider|codex|ollama|llm|cody|continue|windsurf|mods|gemini|chatgpt|sgpt|aichat|copilot)\b/,
-        label: 'invokes AI agent CLI',
-    },
-    {
-        // Amazon Q (`q`) — single-char, so only flag it at a command boundary
-        // (start, or after ; & |, with an optional `!` bang) to avoid 误伤 on a
-        // stray `q` elsewhere in a line (e.g. `grep q file`). Bare `q` at the REPL
-        // is intercepted as "quit" before reaching here.
-        pattern: /(?:^|[;&|]\s*)!?\s*q\b/,
-        label: 'invokes AI agent CLI',
-    },
-    { pattern: /(?:^|[\s|;&`$(!])gh\s+copilot\b/, label: 'invokes gh copilot' },
-    { pattern: /(?:^|[\s|;&`$(!])history\b/, label: 'inspects shell history' },
-    { pattern: /(?:^|[\s|;&`$(!])cd\s+(?:~|\$HOME|\/home|\/Users|\/etc|\/var)/, label: 'cd outside exam workspace' },
-];
-export function checkShellRisk(input) {
-    const flags = [];
-    for (const { pattern, label } of RISK_PATTERNS) {
-        if (pattern.test(input))
-            flags.push(label);
-    }
-    return flags;
-}
-function auditLogPath() {
-    return join(getIcoaDir(), 'exam-audit.log');
-}
-// Identity attached to every audit POST so the server (and post-competition
-// review) can attribute a flagged action to a PERSON — not just an exam id.
-// Without this the server can only record examId+country, and a shared-NAT
-// room collapses to one row. Mirrors the AI-chat account binding in gemini.ts:
-//   1. a proctored exam token wins when a real exam is active (un-forgeable),
-//   2. else the CTFd-join logged-in username (self-reported),
-//   3. the device fingerprint is always included as a last-resort anon key.
-// Self-reported fields are audit signal, not proof — the un-forgeable boundary
-// stays server-side, same as the AI budget. NOTE: this only carries the
-// SANCTIONED-AI-orthogonal external signals (shell-escape risk flags, AI
-// binaries in PATH); the in-CLI ai4ctf AI never routes through here.
-export function auditIdentity() {
-    const id = {};
-    const cfg = getConfig();
-    if (cfg.deviceFingerprint)
-        id.deviceFingerprint = cfg.deviceFingerprint;
-    const realExam = getRealExamState();
-    if (realExam?.session?.token) {
-        id.examToken = realExam.session.token;
-    }
-    else if (cfg.ctfdUrl && cfg.token && cfg.userName) {
-        // CTFd-join session mode (no exam token): attribute to the logged-in account.
-        id.account = cfg.userName;
-    }
-    return id;
-}
-export function logShellAudit(entry) {
-    const state = getRealExamState();
-    if (!state)
-        return; // audit only fires inside a real exam
-    const line = JSON.stringify({
-        ts: new Date().toISOString(),
-        examId: state.session.examId,
-        country: state.session.country,
-        ...auditIdentity(),
-        cwd: entry.cwd,
-        input: entry.input.slice(0, 500),
-        riskFlags: entry.riskFlags,
-    });
-    try {
-        appendFileSync(auditLogPath(), `${line}\n`);
-    }
-    catch {
-        /* local log is best-effort */
-    }
-    fetch('https://practice.icoa2026.au/api/icoa/exam-audit', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: line,
-        signal: AbortSignal.timeout(3000),
-    }).catch(() => { });
-}
-export function reportAIBinaryDetection(binaries) {
-    if (binaries.length === 0)
-        return;
-    const state = getRealExamState();
-    const body = JSON.stringify({
-        ts: new Date().toISOString(),
-        examId: state?.session.examId ?? '(pre-start)',
-        country: state?.session.country ?? '(pre-start)',
-        ...auditIdentity(),
-        binaries,
-        platform: process.platform,
-    });
-    fetch('https://practice.icoa2026.au/api/icoa/exam-ai-binaries', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body,
-        signal: AbortSignal.timeout(3000),
-    }).catch(() => { });
-}
-// L1 — per-exam tmpdir. Replaces ~/icoa-workspace during a real exam so the
-// contestant lands in a clean slate; leaving this dir trips a cwd risk flag
-// via L2. Persists in ExamSession so subsequent REPL invocations reuse it.
-export function createExamWorkspace(examId) {
-    const safeId = examId.replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 32);
-    return mkdtempSync(join(tmpdir(), `icoa-exam-${safeId}-`));
-}
-const LEGACY_WORKSPACE = join(homedir(), 'icoa-workspace');
-export function getActiveCwd() {
-    const state = getRealExamState();
-    const w = state?.session?.workspaceDir;
-    if (w && existsSync(w))
-        return w;
-    if (!existsSync(LEGACY_WORKSPACE))
-        mkdirSync(LEGACY_WORKSPACE, { recursive: true });
-    return LEGACY_WORKSPACE;
-}
+import{mkdtempSync as t,mkdirSync as e,existsSync as o,appendFileSync as s,statSync as i}from"node:fs";import{execFileSync as n}from"node:child_process";import{tmpdir as r,homedir as a,platform as c}from"node:os";import{join as p,delimiter as l}from"node:path";import{getIcoaDir as d,getConfig as h}from"./config.js";import{getRealExamState as u}from"./exam-state.js";const m=["claude","cursor-agent","aider","codex","ollama","llm","cody","continue","windsurf","mods","gemini","q","chatgpt","sgpt","aichat","copilot"];function f(t){const e=process.env.PATH||"",o="win32"===c()?(process.env.PATHEXT||".EXE;.CMD;.BAT").split(";"):[""];for(const s of e.split(l))if(s)for(const e of o){const o=p(s,t+e);try{if(i(o).isFile())return!0}catch{}}return!1}export function scanForAIBinaries(){const t=[];for(const e of m)f(e)&&t.push(e);if(f("gh"))try{const e=n("gh",["extension","list"],{encoding:"utf-8",timeout:2e3,stdio:["ignore","pipe","ignore"]});/copilot/i.test(e)&&t.push("gh-copilot")}catch{}return t}const g=[{pattern:/(?:^|[\s|;&`$(!])(?:cat|less|more|head|tail|bat)\s+(?:~|\$HOME|\/home\/[^/\s]+|\/Users\/[^/\s]+)/,label:"reads home directory"},{pattern:/\.bash_history|\.zsh_history|\.fish_history|\.python_history/,label:"reads shell history"},{pattern:/(?:^|[\s|;&`$(!])(?:find|grep\s+-[rR]\S*|rg|fd|ack)\s+(?:~|\$HOME|\/home|\/Users)/,label:"searches home directory"},{pattern:/(?:^|[\s|;&`$(!])(?:claude|cursor-agent|aider|codex|ollama|llm|cody|continue|windsurf|mods|gemini|chatgpt|sgpt|aichat|copilot)\b/,label:"invokes AI agent CLI"},{pattern:/(?:^|[;&|]\s*)!?\s*q\b/,label:"invokes AI agent CLI"},{pattern:/(?:^|[\s|;&`$(!])gh\s+copilot\b/,label:"invokes gh copilot"},{pattern:/(?:^|[\s|;&`$(!])history\b/,label:"inspects shell history"},{pattern:/(?:^|[\s|;&`$(!])cd\s+(?:~|\$HOME|\/home|\/Users|\/etc|\/var)/,label:"cd outside exam workspace"}];export function checkShellRisk(t){const e=[];for(const{pattern:o,label:s}of g)o.test(t)&&e.push(s);return e}export function auditIdentity(){const t={},e=h();e.deviceFingerprint&&(t.deviceFingerprint=e.deviceFingerprint);const o=u();return o?.session?.token?t.examToken=o.session.token:e.ctfdUrl&&e.token&&e.userName&&(t.account=e.userName),t}export function logShellAudit(t){const e=u();if(!e)return;const o=JSON.stringify({ts:(new Date).toISOString(),examId:e.session.examId,country:e.session.country,...auditIdentity(),cwd:t.cwd,input:t.input.slice(0,500),riskFlags:t.riskFlags});try{s(p(d(),"exam-audit.log"),`${o}\n`)}catch{}fetch("https://practice.icoa2026.au/api/icoa/exam-audit",{method:"POST",headers:{"Content-Type":"application/json"},body:o,signal:AbortSignal.timeout(3e3)}).catch(()=>{})}export function reportAIBinaryDetection(t){if(0===t.length)return;const e=u(),o=JSON.stringify({ts:(new Date).toISOString(),examId:e?.session.examId??"(pre-start)",country:e?.session.country??"(pre-start)",...auditIdentity(),binaries:t,platform:process.platform});fetch("https://practice.icoa2026.au/api/icoa/exam-ai-binaries",{method:"POST",headers:{"Content-Type":"application/json"},body:o,signal:AbortSignal.timeout(3e3)}).catch(()=>{})}export function createExamWorkspace(e){const o=e.replace(/[^a-zA-Z0-9_-]/g,"_").slice(0,32);return t(p(r(),`icoa-exam-${o}-`))}const y=p(a(),"icoa-workspace");export function getActiveCwd(){const t=u(),s=t?.session?.workspaceDir;return s&&o(s)?s:(o(y)||e(y,{recursive:!0}),y)}

package/dist/lib/exam-setup.js

@@ -1,36 +1 @@
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { getIcoaDir } from './config.js';
-const SETUP_FILE = () => join(getIcoaDir(), 'exam-setup.json');
-export function getExamSetup() {
-    try {
-        if (!existsSync(SETUP_FILE()))
-            return null;
-        return JSON.parse(readFileSync(SETUP_FILE(), 'utf-8'));
-    }
-    catch {
-        return null;
-    }
-}
-export function saveExamSetup(state) {
-    try {
-        writeFileSync(SETUP_FILE(), JSON.stringify(state, null, 2));
-    }
-    catch { }
-}
-export function isExamSetupComplete() {
-    return getExamSetup() !== null;
-}
-/**
- * Papers that are MCQ / short-answer only (no Python, no Unix tooling, no
- * practical/CTF questions) skip the `exam setup` gate entirely — running it
- * would be pointless and could block a valid token.
- *
- *  - Paper C:        exam_id ends in `-c`  (e.g. `zz-2026-c`)
- *  - SIMOC / Paper M: exam_id starts `simoc-` (e.g. `simoc-2026-g6`)
- */
-export function examIdSkipsSetupGate(examId) {
-    if (!examId)
-        return false;
-    return examId.endsWith('-c') || examId.startsWith('simoc-');
-}
+import{existsSync as t,readFileSync as e,writeFileSync as n}from"node:fs";import{join as r}from"node:path";import{getIcoaDir as o}from"./config.js";const u=()=>r(o(),"exam-setup.json");export function getExamSetup(){try{return t(u())?JSON.parse(e(u(),"utf-8")):null}catch{return null}}export function saveExamSetup(t){try{n(u(),JSON.stringify(t,null,2))}catch{}}export function isExamSetupComplete(){return null!==getExamSetup()}export function examIdSkipsSetupGate(t){return!!t&&(t.endsWith("-c")||t.startsWith("simoc-"))}