icoa-cli 2.19.357 → 2.19.359

package/dist/lib/tool-man.js

@@ -1,418 +1 @@
-/**
- * `man <tool>` — quick CTF usage cheatsheet for the frozen sandbox toolset.
- *
- * This is the *usage* counterpart to `env` (which only reports install status).
- * Scope = the curated ~40 tools players actually use to SOLVE challenges, not
- * all 110 (a `man ls` stub is noise). Every tool here is confirmed present in
- * `src/commands/env.ts` SYSTEM_TOOLS / PYTHON_LIBS and the sandbox image.
- *
- * Bundled offline (tiny text, universal to every CTF player) — plane-1 OK,
- * same class as i18n strings; NOT a dataset (Thin-Client three-plane rule).
- *
- * Black-bg colour rule: chalk only; cyan = tool/command, gray = note,
- * bold.yellow = the "important" lifeline.
- */
-import chalk from 'chalk';
-// Ordered roughly by how often a CTF player reaches for them.
-export const TOOL_DOCS = [
-    // ── Recon / first look ───────────────────────────────────────────
-    {
-        name: 'file',
-        cat: 'Forensics',
-        summary: 'identify a file type (always step 1)',
-        ex: [['file mystery', 'what is this really? (extension lies)']],
-    },
-    {
-        name: 'strings',
-        cat: 'Forensics',
-        summary: 'pull printable text out of any binary',
-        ex: [
-            ['strings -n 8 bin', 'runs ≥8 chars (cuts noise)'],
-            ['strings bin | grep -i flag', 'hunt the flag directly'],
-            ['strings -e l bin', '16-bit little-endian (wide) strings'],
-        ],
-    },
-    {
-        name: 'xxd',
-        cat: 'Data',
-        summary: 'hex dump / reverse hex back to bytes',
-        ex: [
-            ['xxd file | head', 'inspect magic bytes / header'],
-            ['xxd -r hex.txt out.bin', 'rebuild a file from a hex dump'],
-            ['xxd -s 0x100 -l 64 file', 'dump 64 bytes from offset 0x100'],
-        ],
-    },
-    {
-        name: 'hexdump',
-        aliases: ['od'],
-        cat: 'Data',
-        summary: 'byte/octal dump (od is the BSD cousin)',
-        ex: [
-            ['hexdump -C file | head', 'canonical hex+ASCII view'],
-            ['od -An -tx1 file', 'raw hex bytes, no offsets'],
-        ],
-    },
-    // ── Stego / carving ──────────────────────────────────────────────
-    {
-        name: 'binwalk',
-        cat: 'Forensics',
-        summary: 'find + extract files embedded in files',
-        ex: [
-            ['binwalk file', 'scan for embedded signatures'],
-            ['binwalk -e file', 'auto-extract everything it finds'],
-            ['binwalk --dd=".*" file', 'carve every match (greedy)'],
-        ],
-    },
-    {
-        name: 'foremost',
-        cat: 'Forensics',
-        summary: 'carve files by header (recover deleted/hidden)',
-        ex: [['foremost -i disk.img -o out/', 'recover into out/ by type']],
-    },
-    {
-        name: 'steghide',
-        cat: 'Forensics',
-        summary: 'hide/extract data in JPG/BMP/WAV/AU (passphrase)',
-        ex: [
-            ['steghide info cat.jpg', 'is anything embedded?'],
-            ['steghide extract -sf cat.jpg', 'pull it out (asks passphrase; blank often works)'],
-        ],
-    },
-    {
-        name: 'exiftool',
-        cat: 'Forensics',
-        summary: 'read/write image & doc metadata (flags hide here)',
-        ex: [
-            ['exiftool pic.png', 'dump all metadata'],
-            ['exiftool -Comment pic.png', 'one specific tag'],
-        ],
-    },
-    {
-        name: 'pngcheck',
-        cat: 'Forensics',
-        summary: 'validate PNG chunks (find tampering / appended data)',
-        ex: [['pngcheck -v flag.png', 'verbose chunk-by-chunk check']],
-    },
-    {
-        name: 'pdftotext',
-        cat: 'Data',
-        summary: 'extract text (and hidden layers) from a PDF',
-        ex: [['pdftotext doc.pdf -', 'print extracted text to stdout']],
-    },
-    // ── Disk / memory forensics ──────────────────────────────────────
-    {
-        name: 'sleuthkit',
-        aliases: ['mmls', 'fls', 'icat', 'tsk'],
-        cat: 'Forensics',
-        summary: 'disk-image forensics (partition → files → recover)',
-        ex: [
-            ['mmls disk.img', 'list partitions + offsets'],
-            ['fls -o 2048 -r disk.img', 'list files (use the partition offset)'],
-            ['icat -o 2048 disk.img 12 > out', 'dump file by inode number'],
-        ],
-    },
-    {
-        name: 'volatility3',
-        aliases: ['vol', 'volatility'],
-        cat: 'Forensics',
-        summary: 'memory-dump analysis',
-        ex: [
-            ['vol -f mem.raw windows.pslist', 'list processes'],
-            ['vol -f mem.raw windows.cmdline', 'recover command lines'],
-        ],
-    },
-    // ── Crypto / passwords ───────────────────────────────────────────
-    {
-        name: 'openssl',
-        cat: 'Crypto',
-        summary: 'swiss-army crypto (decode, hash, enc/dec, certs)',
-        ex: [
-            ['openssl enc -d -aes-256-cbc -in f -k pass', 'decrypt AES'],
-            ['openssl x509 -in cert.pem -text -noout', 'read a certificate'],
-            ['echo -n txt | openssl dgst -sha256', 'hash it'],
-        ],
-    },
-    {
-        name: 'john',
-        aliases: ['john-the-ripper'],
-        cat: 'Crypto',
-        summary: 'crack password hashes (CPU)',
-        ex: [
-            ['john --wordlist=rockyou.txt hashes', 'dictionary attack'],
-            ['zip2john x.zip > h ; john h', 'crack a zip password'],
-            ['john --show hashes', 'print cracked results'],
-        ],
-    },
-    {
-        name: 'hashcat',
-        cat: 'Crypto',
-        summary: 'fast hash cracker (modes by -m)',
-        ex: [['hashcat -m 0 -a 0 hash rockyou.txt', 'MD5 dictionary (-m 0 = MD5)']],
-    },
-    {
-        name: 'gpg',
-        cat: 'Crypto',
-        summary: 'PGP decrypt / symmetric decrypt',
-        ex: [['gpg -d secret.gpg', 'decrypt (prompts for passphrase/key)']],
-    },
-    {
-        name: 'base64',
-        aliases: ['base32'],
-        cat: 'Data',
-        summary: 'decode/encode base64 (base32 alike)',
-        ex: [
-            ['echo -n SGk= | base64 -d', 'decode'],
-            ['base64 -d f.txt', 'decode a file blob'],
-        ],
-    },
-    // ── Network ──────────────────────────────────────────────────────
-    {
-        name: 'nmap',
-        cat: 'Networking',
-        summary: 'port/service scan a target host',
-        ex: [
-            ['nmap -sV -p- host', 'all ports + version detection'],
-            ['nmap -sC -p 80,443 host', 'default scripts on web ports'],
-        ],
-    },
-    {
-        name: 'nc',
-        aliases: ['netcat', 'ncat'],
-        cat: 'Networking',
-        summary: 'raw TCP/UDP connect (talk to a service)',
-        ex: [
-            ['nc host 1337', 'connect to a challenge service'],
-            ['nc -lvnp 4444', 'listen (catch a callback)'],
-        ],
-    },
-    {
-        name: 'socat',
-        cat: 'Networking',
-        summary: 'flexible socket relay (TLS, pty, bridging)',
-        ex: [['socat - OPENSSL:host:443', 'connect over TLS interactively']],
-    },
-    {
-        name: 'curl',
-        cat: 'Web',
-        summary: 'HTTP client — the web-CTF workhorse',
-        ex: [
-            ['curl -i url', 'show response headers'],
-            ['curl -b "session=..." url', 'send a cookie'],
-            ['curl -X POST -d "a=1" url', 'POST form data'],
-        ],
-    },
-    {
-        name: 'wget',
-        cat: 'Web',
-        summary: 'download files / mirror a site',
-        ex: [['wget -r url', 'recursive download']],
-    },
-    {
-        name: 'tshark',
-        aliases: ['wireshark-cli'],
-        cat: 'Networking',
-        summary: 'CLI Wireshark — read/filter pcaps',
-        ex: [
-            ['tshark -r cap.pcap -Y http', 'show only HTTP packets'],
-            ['tshark -r cap.pcap -T fields -e data', 'dump a field across packets'],
-        ],
-    },
-    {
-        name: 'tcpdump',
-        cat: 'Networking',
-        summary: 'capture/read packets (pcap)',
-        ex: [['tcpdump -r cap.pcap -A', 'print packets as ASCII']],
-    },
-    {
-        name: 'dig',
-        aliases: ['whois'],
-        cat: 'Networking',
-        summary: 'DNS lookups (whois = registration data)',
-        ex: [
-            ['dig TXT domain', 'read TXT records (flags hide here)'],
-            ['whois domain', 'ownership info'],
-        ],
-    },
-    {
-        name: 'sqlmap',
-        cat: 'Web',
-        summary: 'automated SQL-injection exploitation',
-        ex: [
-            ['sqlmap -u "url?id=1" --dbs', 'enumerate databases'],
-            ['sqlmap -u url --dump -T users', 'dump a table'],
-        ],
-    },
-    // ── Reverse engineering / binary ─────────────────────────────────
-    {
-        name: 'radare2',
-        aliases: ['r2'],
-        cat: 'Reverse Engineering',
-        summary: 'interactive RE framework (disasm/debug)',
-        ex: [
-            ['r2 -A bin', 'open + auto-analyze'],
-            ['(in r2) afl ; pdf @ main', 'list funcs; disasm main'],
-        ],
-    },
-    {
-        name: 'rabin2',
-        cat: 'Reverse Engineering',
-        summary: 'binary info (radare2 family)',
-        ex: [
-            ['rabin2 -z bin', 'list strings + offsets'],
-            ['rabin2 -I bin', 'arch/bits/protections'],
-        ],
-    },
-    {
-        name: 'objdump',
-        cat: 'Reverse Engineering',
-        summary: 'disassemble / inspect object files',
-        ex: [['objdump -d -M intel bin', 'Intel-syntax disassembly']],
-    },
-    {
-        name: 'readelf',
-        cat: 'Reverse Engineering',
-        summary: 'ELF header / sections / symbols',
-        ex: [
-            ['readelf -a bin', 'everything'],
-            ['readelf -d bin', 'dynamic section / RPATH'],
-        ],
-    },
-    {
-        name: 'gdb',
-        aliases: ['pwndbg'],
-        cat: 'Debuggers',
-        summary: 'debugger (pwndbg plugin preloaded for pwn)',
-        ex: [
-            ['gdb ./bin', 'start; then: break main / run / info registers'],
-            ['(pwndbg) checksec', 'show binary mitigations'],
-            ['(pwndbg) cyclic 200', 'gen pattern to find offset'],
-        ],
-    },
-    {
-        name: 'ltrace',
-        aliases: ['strace'],
-        cat: 'Debuggers',
-        summary: 'trace library (ltrace) / syscalls (strace)',
-        ex: [
-            ['ltrace ./bin', 'watch libc calls (e.g. strcmp the flag)'],
-            ['strace ./bin', 'watch syscalls'],
-        ],
-    },
-    {
-        name: 'upx',
-        cat: 'Reverse Engineering',
-        summary: 'un/pack executables',
-        ex: [['upx -d packed', 'unpack before analyzing']],
-    },
-    // ── Pwn ──────────────────────────────────────────────────────────
-    {
-        name: 'pwntools',
-        aliases: ['pwn'],
-        cat: 'CTF Core',
-        summary: 'Python exploit framework (+ pwn CLI)',
-        ex: [
-            ['pwn checksec ./bin', 'show mitigations'],
-            ['pwn cyclic 100 / pwn cyclic -l 0x6161', 'pattern + find offset'],
-            ['python3: from pwn import *; p=process("./bin")', 'scripting entrypoint'],
-        ],
-    },
-    {
-        name: 'ROPgadget',
-        aliases: ['ropper'],
-        cat: 'Binary & RE',
-        summary: 'find ROP gadgets in a binary',
-        ex: [
-            ['ROPgadget --binary bin | grep "pop rdi"', 'find a gadget'],
-            ['ropper -f bin --search "pop rdi"', 'ropper equivalent'],
-        ],
-    },
-    // ── Data wrangling ───────────────────────────────────────────────
-    {
-        name: 'jq',
-        cat: 'Data',
-        summary: 'slice/query JSON',
-        ex: [
-            ['curl url | jq .', 'pretty-print'],
-            ['jq -r ".data[].flag" f.json', 'extract a field'],
-        ],
-    },
-    {
-        name: 'sqlite3',
-        cat: 'Data',
-        summary: 'open/query a SQLite DB file',
-        ex: [
-            ['sqlite3 app.db ".tables"', 'list tables'],
-            ['sqlite3 app.db "select * from users"', 'query'],
-        ],
-    },
-];
-// alias / name → doc
-const INDEX = new Map();
-for (const d of TOOL_DOCS) {
-    INDEX.set(d.name.toLowerCase(), d);
-    for (const a of d.aliases ?? [])
-        INDEX.set(a.toLowerCase(), d);
-}
-function printOne(d) {
-    const alias = d.aliases?.length ? chalk.gray('  (' + d.aliases.join(', ') + ')') : '';
-    console.log();
-    console.log('  ' + chalk.bold.cyan(d.name) + alias + chalk.gray('  · ' + d.cat));
-    console.log('  ' + chalk.white(d.summary));
-    console.log();
-    for (const [cmd, note] of d.ex) {
-        console.log('    ' + chalk.cyan(cmd));
-        console.log('      ' + chalk.gray(note));
-    }
-    console.log();
-    console.log(chalk.gray('  More: ') + chalk.cyan('man tools') + chalk.gray('  ·  not a real judge — verify your own output.'));
-    console.log();
-}
-function printIndex() {
-    const byCat = new Map();
-    for (const d of TOOL_DOCS) {
-        const k = d.cat;
-        if (!byCat.has(k))
-            byCat.set(k, []);
-        byCat.get(k).push(d);
-    }
-    console.log();
-    console.log(chalk.bold.yellow('  ★ Tool cheatsheet') +
-        chalk.gray('   — type ') +
-        chalk.cyan('man <tool>') +
-        chalk.gray(' for usage, e.g. ') +
-        chalk.cyan('man steghide'));
-    console.log();
-    for (const [cat, list] of byCat) {
-        console.log('  ' + chalk.bold.white(cat));
-        console.log('    ' + chalk.cyan(list.map((d) => d.name).join('  ')));
-    }
-    console.log();
-    console.log(chalk.gray('  These are the frozen sandbox tools — no pip/apt install. ') +
-        chalk.cyan('env') +
-        chalk.gray(' shows what is installed.'));
-    console.log();
-}
-/** Render `man <query>`: empty/"tools"/"list" → index; a tool → its sheet; else nearest hints. */
-export function renderToolMan(query) {
-    const q = (query || '').trim().toLowerCase();
-    if (!q || q === 'tools' || q === 'list' || q === 'all') {
-        printIndex();
-        return;
-    }
-    const hit = INDEX.get(q);
-    if (hit) {
-        printOne(hit);
-        return;
-    }
-    // fuzzy: prefix then substring on names+aliases
-    const keys = [...INDEX.keys()];
-    const near = keys.filter((k) => k.startsWith(q)).concat(keys.filter((k) => k.includes(q) && !k.startsWith(q)));
-    const uniq = [...new Set(near.map((k) => INDEX.get(k).name))].slice(0, 5);
-    console.log();
-    console.log(chalk.yellow(`  No cheatsheet for "${query}".`));
-    if (uniq.length) {
-        console.log(chalk.gray('  Did you mean: ') + chalk.cyan(uniq.join('  ')) + '?');
-    }
-    console.log(chalk.gray('  Type ') + chalk.cyan('man tools') + chalk.gray(' for the full list.'));
-    console.log();
-}
+import chalk from"chalk";export const TOOL_DOCS=[{name:"file",cat:"Forensics",summary:"identify a file type (always step 1)",ex:[["file mystery","what is this really? (extension lies)"]]},{name:"strings",cat:"Forensics",summary:"pull printable text out of any binary",ex:[["strings -n 8 bin","runs ≥8 chars (cuts noise)"],["strings bin | grep -i flag","hunt the flag directly"],["strings -e l bin","16-bit little-endian (wide) strings"]]},{name:"xxd",cat:"Data",summary:"hex dump / reverse hex back to bytes",ex:[["xxd file | head","inspect magic bytes / header"],["xxd -r hex.txt out.bin","rebuild a file from a hex dump"],["xxd -s 0x100 -l 64 file","dump 64 bytes from offset 0x100"]]},{name:"hexdump",aliases:["od"],cat:"Data",summary:"byte/octal dump (od is the BSD cousin)",ex:[["hexdump -C file | head","canonical hex+ASCII view"],["od -An -tx1 file","raw hex bytes, no offsets"]]},{name:"binwalk",cat:"Forensics",summary:"find + extract files embedded in files",ex:[["binwalk file","scan for embedded signatures"],["binwalk -e file","auto-extract everything it finds"],['binwalk --dd=".*" file',"carve every match (greedy)"]]},{name:"foremost",cat:"Forensics",summary:"carve files by header (recover deleted/hidden)",ex:[["foremost -i disk.img -o out/","recover into out/ by type"]]},{name:"steghide",cat:"Forensics",summary:"hide/extract data in JPG/BMP/WAV/AU (passphrase)",ex:[["steghide info cat.jpg","is anything embedded?"],["steghide extract -sf cat.jpg","pull it out (asks passphrase; blank often works)"]]},{name:"exiftool",cat:"Forensics",summary:"read/write image & doc metadata (flags hide here)",ex:[["exiftool pic.png","dump all metadata"],["exiftool -Comment pic.png","one specific tag"]]},{name:"pngcheck",cat:"Forensics",summary:"validate PNG chunks (find tampering / appended data)",ex:[["pngcheck -v flag.png","verbose chunk-by-chunk check"]]},{name:"pdftotext",cat:"Data",summary:"extract text (and hidden layers) from a PDF",ex:[["pdftotext doc.pdf -","print extracted text to stdout"]]},{name:"sleuthkit",aliases:["mmls","fls","icat","tsk"],cat:"Forensics",summary:"disk-image forensics (partition → files → recover)",ex:[["mmls disk.img","list partitions + offsets"],["fls -o 2048 -r disk.img","list files (use the partition offset)"],["icat -o 2048 disk.img 12 > out","dump file by inode number"]]},{name:"volatility3",aliases:["vol","volatility"],cat:"Forensics",summary:"memory-dump analysis",ex:[["vol -f mem.raw windows.pslist","list processes"],["vol -f mem.raw windows.cmdline","recover command lines"]]},{name:"openssl",cat:"Crypto",summary:"swiss-army crypto (decode, hash, enc/dec, certs)",ex:[["openssl enc -d -aes-256-cbc -in f -k pass","decrypt AES"],["openssl x509 -in cert.pem -text -noout","read a certificate"],["echo -n txt | openssl dgst -sha256","hash it"]]},{name:"john",aliases:["john-the-ripper"],cat:"Crypto",summary:"crack password hashes (CPU)",ex:[["john --wordlist=rockyou.txt hashes","dictionary attack"],["zip2john x.zip > h ; john h","crack a zip password"],["john --show hashes","print cracked results"]]},{name:"hashcat",cat:"Crypto",summary:"fast hash cracker (modes by -m)",ex:[["hashcat -m 0 -a 0 hash rockyou.txt","MD5 dictionary (-m 0 = MD5)"]]},{name:"gpg",cat:"Crypto",summary:"PGP decrypt / symmetric decrypt",ex:[["gpg -d secret.gpg","decrypt (prompts for passphrase/key)"]]},{name:"base64",aliases:["base32"],cat:"Data",summary:"decode/encode base64 (base32 alike)",ex:[["echo -n SGk= | base64 -d","decode"],["base64 -d f.txt","decode a file blob"]]},{name:"nmap",cat:"Networking",summary:"port/service scan a target host",ex:[["nmap -sV -p- host","all ports + version detection"],["nmap -sC -p 80,443 host","default scripts on web ports"]]},{name:"nc",aliases:["netcat","ncat"],cat:"Networking",summary:"raw TCP/UDP connect (talk to a service)",ex:[["nc host 1337","connect to a challenge service"],["nc -lvnp 4444","listen (catch a callback)"]]},{name:"socat",cat:"Networking",summary:"flexible socket relay (TLS, pty, bridging)",ex:[["socat - OPENSSL:host:443","connect over TLS interactively"]]},{name:"curl",cat:"Web",summary:"HTTP client — the web-CTF workhorse",ex:[["curl -i url","show response headers"],['curl -b "session=..." url',"send a cookie"],['curl -X POST -d "a=1" url',"POST form data"]]},{name:"wget",cat:"Web",summary:"download files / mirror a site",ex:[["wget -r url","recursive download"]]},{name:"tshark",aliases:["wireshark-cli"],cat:"Networking",summary:"CLI Wireshark — read/filter pcaps",ex:[["tshark -r cap.pcap -Y http","show only HTTP packets"],["tshark -r cap.pcap -T fields -e data","dump a field across packets"]]},{name:"tcpdump",cat:"Networking",summary:"capture/read packets (pcap)",ex:[["tcpdump -r cap.pcap -A","print packets as ASCII"]]},{name:"dig",aliases:["whois"],cat:"Networking",summary:"DNS lookups (whois = registration data)",ex:[["dig TXT domain","read TXT records (flags hide here)"],["whois domain","ownership info"]]},{name:"sqlmap",cat:"Web",summary:"automated SQL-injection exploitation",ex:[['sqlmap -u "url?id=1" --dbs',"enumerate databases"],["sqlmap -u url --dump -T users","dump a table"]]},{name:"radare2",aliases:["r2"],cat:"Reverse Engineering",summary:"interactive RE framework (disasm/debug)",ex:[["r2 -A bin","open + auto-analyze"],["(in r2) afl ; pdf @ main","list funcs; disasm main"]]},{name:"rabin2",cat:"Reverse Engineering",summary:"binary info (radare2 family)",ex:[["rabin2 -z bin","list strings + offsets"],["rabin2 -I bin","arch/bits/protections"]]},{name:"objdump",cat:"Reverse Engineering",summary:"disassemble / inspect object files",ex:[["objdump -d -M intel bin","Intel-syntax disassembly"]]},{name:"readelf",cat:"Reverse Engineering",summary:"ELF header / sections / symbols",ex:[["readelf -a bin","everything"],["readelf -d bin","dynamic section / RPATH"]]},{name:"gdb",aliases:["pwndbg"],cat:"Debuggers",summary:"debugger (pwndbg plugin preloaded for pwn)",ex:[["gdb ./bin","start; then: break main / run / info registers"],["(pwndbg) checksec","show binary mitigations"],["(pwndbg) cyclic 200","gen pattern to find offset"]]},{name:"ltrace",aliases:["strace"],cat:"Debuggers",summary:"trace library (ltrace) / syscalls (strace)",ex:[["ltrace ./bin","watch libc calls (e.g. strcmp the flag)"],["strace ./bin","watch syscalls"]]},{name:"upx",cat:"Reverse Engineering",summary:"un/pack executables",ex:[["upx -d packed","unpack before analyzing"]]},{name:"pwntools",aliases:["pwn"],cat:"CTF Core",summary:"Python exploit framework (+ pwn CLI)",ex:[["pwn checksec ./bin","show mitigations"],["pwn cyclic 100 / pwn cyclic -l 0x6161","pattern + find offset"],['python3: from pwn import *; p=process("./bin")',"scripting entrypoint"]]},{name:"ROPgadget",aliases:["ropper"],cat:"Binary & RE",summary:"find ROP gadgets in a binary",ex:[['ROPgadget --binary bin | grep "pop rdi"',"find a gadget"],['ropper -f bin --search "pop rdi"',"ropper equivalent"]]},{name:"jq",cat:"Data",summary:"slice/query JSON",ex:[["curl url | jq .","pretty-print"],['jq -r ".data[].flag" f.json',"extract a field"]]},{name:"sqlite3",cat:"Data",summary:"open/query a SQLite DB file",ex:[['sqlite3 app.db ".tables"',"list tables"],['sqlite3 app.db "select * from users"',"query"]]}];const e=new Map;for(const a of TOOL_DOCS){e.set(a.name.toLowerCase(),a);for(const s of a.aliases??[])e.set(s.toLowerCase(),a)}export function renderToolMan(a){const s=(a||"").trim().toLowerCase();if(!s||"tools"===s||"list"===s||"all"===s)return void function(){const e=new Map;for(const a of TOOL_DOCS){const s=a.cat;e.has(s)||e.set(s,[]),e.get(s).push(a)}console.log(),console.log(chalk.bold.yellow("  ★ Tool cheatsheet")+chalk.gray("   — type ")+chalk.cyan("man <tool>")+chalk.gray(" for usage, e.g. ")+chalk.cyan("man steghide")),console.log();for(const[a,s]of e)console.log("  "+chalk.bold.white(a)),console.log("    "+chalk.cyan(s.map(e=>e.name).join("  ")));console.log(),console.log(chalk.gray("  These are the frozen sandbox tools — no pip/apt install. ")+chalk.cyan("env")+chalk.gray(" shows what is installed.")),console.log()}();const t=e.get(s);if(t)return void function(e){const a=e.aliases?.length?chalk.gray("  ("+e.aliases.join(", ")+")"):"";console.log(),console.log("  "+chalk.bold.cyan(e.name)+a+chalk.gray("  · "+e.cat)),console.log("  "+chalk.white(e.summary)),console.log();for(const[a,s]of e.ex)console.log("    "+chalk.cyan(a)),console.log("      "+chalk.gray(s));console.log(),console.log(chalk.gray("  More: ")+chalk.cyan("man tools")+chalk.gray("  ·  not a real judge — verify your own output.")),console.log()}(t);const n=[...e.keys()],o=n.filter(e=>e.startsWith(s)).concat(n.filter(e=>e.includes(s)&&!e.startsWith(s))),r=[...new Set(o.map(a=>e.get(a).name))].slice(0,5);console.log(),console.log(chalk.yellow(`  No cheatsheet for "${a}".`)),r.length&&console.log(chalk.gray("  Did you mean: ")+chalk.cyan(r.join("  "))+"?"),console.log(chalk.gray("  Type ")+chalk.cyan("man tools")+chalk.gray(" for the full list.")),console.log()}

package/dist/lib/toolset-hash.js

@@ -1,48 +1 @@
-import { createHash } from 'node:crypto';
-import { readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { platform } from 'node:os';
-import { getIcoaDir } from './config.js';
-// T3 — environment fingerprint (FORENSIC, not a gate).
-//
-// Hashes the {name=version} of the sanctioned toolset detected on this host.
-// Reported at exam start and stored server-side so a reviewer can compare
-// environments across students (and spot a session whose env fingerprint
-// changed). Honest limits: this proves which sanctioned tools/versions are
-// PRESENT — it does NOT prove the ABSENCE of forbidden tools, and the expected
-// value differs per platform (mac/ubuntu/WSL ship different versions). So it is
-// a comparison fingerprint, never a pass/fail check. See icoa2026event/07.
-const CACHE = () => join(getIcoaDir(), 'toolset-hash.json');
-/** Compute the hash over (name=version) pairs, persist it, return the hash.
- *  Called once at the end of `env setup` so the exam-start path only READS. */
-export function computeAndCacheToolsetHash(entries) {
-    const norm = entries
-        .map((e) => `${e.name}=${(e.version || '').trim()}`)
-        .sort()
-        .join('\n');
-    const hash = createHash('sha256').update(norm).digest('hex').slice(0, 16);
-    const rec = {
-        hash,
-        platform: platform(),
-        count: entries.length,
-        computedAt: new Date().toISOString(),
-    };
-    try {
-        writeFileSync(CACHE(), JSON.stringify(rec));
-    }
-    catch {
-        /* best-effort — a missing cache just means no env fingerprint is reported */
-    }
-    return hash;
-}
-/** Read the cached env-fingerprint hash. Returns undefined if `env setup` has
- *  not run (so the exam start path never blocks or spawns 30 version probes). */
-export function getCachedToolsetHash() {
-    try {
-        const rec = JSON.parse(readFileSync(CACHE(), 'utf-8'));
-        return typeof rec.hash === 'string' && rec.hash ? rec.hash : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
+import{createHash as t}from"node:crypto";import{readFileSync as o,writeFileSync as r}from"node:fs";import{join as e}from"node:path";import{platform as n}from"node:os";import{getIcoaDir as s}from"./config.js";const h=()=>e(s(),"toolset-hash.json");export function computeAndCacheToolsetHash(o){const e=o.map(t=>`${t.name}=${(t.version||"").trim()}`).sort().join("\n"),s=t("sha256").update(e).digest("hex").slice(0,16),a={hash:s,platform:n(),count:o.length,computedAt:(new Date).toISOString()};try{r(h(),JSON.stringify(a))}catch{}return s}export function getCachedToolsetHash(){try{const t=JSON.parse(o(h(),"utf-8"));return"string"==typeof t.hash&&t.hash?t.hash:void 0}catch{return}}

package/dist/lib/translation.js

@@ -1,80 +1 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { getIcoaDir } from './config.js';
-import { translateText } from './gemini.js';
-import { ensureLangCache } from './translations-fetcher.js';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-// Bundled translations shipped with the package (translations/<lang>/<id>.json)
-function getBundledPath(lang, challengeId) {
-    return join(__dirname, '..', '..', 'translations', lang, `${challengeId}.json`);
-}
-// User-local cache (~/.icoa/translations/)
-function getCachePath(lang, challengeId) {
-    const dir = join(getIcoaDir(), 'translations', lang);
-    mkdirSync(dir, { recursive: true });
-    return join(dir, `${challengeId}.json`);
-}
-export async function getTranslation(text, challengeId, targetLang) {
-    if (targetLang === 'en')
-        return text;
-    // 1. Check bundled static translations — only present in dev (npm-link) trees;
-    //    v2.19.197+ no longer ships translations/ in the npm package.
-    const bundledPath = getBundledPath(targetLang, challengeId);
-    if (existsSync(bundledPath)) {
-        try {
-            const bundled = JSON.parse(readFileSync(bundledPath, 'utf-8'));
-            if (bundled.translation)
-                return bundled.translation;
-        }
-        catch {
-            /* corrupt, fall through */
-        }
-    }
-    // 2. Safety net: if this language hasn't been fetched yet (e.g. lang was set
-    //    by country auto-detect rather than the `lang` command), pull the pack
-    //    once. No-op when already cached.
-    await ensureLangCache(targetLang, { silent: false });
-    // 3. Check user-local cache (populated by step 2 or earlier `lang` calls)
-    const cachePath = getCachePath(targetLang, challengeId);
-    if (existsSync(cachePath)) {
-        try {
-            const cached = JSON.parse(readFileSync(cachePath, 'utf-8'));
-            if (cached.translation)
-                return cached.translation;
-        }
-        catch {
-            /* corrupt, fall through */
-        }
-    }
-    // 4. Translate via Gemini API (last resort — covers untranslated tail content)
-    const translation = await translateText(text, getLangName(targetLang));
-    writeFileSync(cachePath, JSON.stringify({ original: text, translation, timestamp: new Date().toISOString() }));
-    return translation;
-}
-function getLangName(code) {
-    const names = {
-        en: 'English',
-        zh: 'Chinese (Simplified)',
-        ja: 'Japanese',
-        ko: 'Korean',
-        es: 'Spanish',
-        ar: 'Arabic',
-        fr: 'French',
-        pt: 'Portuguese (Brazilian)',
-        ru: 'Russian',
-        hi: 'Hindi',
-        de: 'German',
-        id: 'Indonesian',
-        th: 'Thai',
-        vi: 'Vietnamese',
-        tr: 'Turkish',
-        uk: 'Ukrainian',
-        ht: 'Haitian Creole',
-        bn: 'Bengali',
-        kk: 'Kazakh',
-        uz: 'Uzbek',
-        lo: 'Lao',
-    };
-    return names[code] || 'English';
-}
+import{existsSync as n,mkdirSync as t,readFileSync as i,writeFileSync as r}from"node:fs";import{join as a,dirname as o}from"node:path";import{fileURLToPath as e}from"node:url";import{getIcoaDir as s}from"./config.js";import{translateText as f}from"./gemini.js";import{ensureLangCache as u}from"./translations-fetcher.js";const c=o(e(import.meta.url));export async function getTranslation(o,e,l){if("en"===l)return o;const m=function(n,t){return a(c,"..","..","translations",n,`${t}.json`)}(l,e);if(n(m))try{const n=JSON.parse(i(m,"utf-8"));if(n.translation)return n.translation}catch{}await u(l,{silent:!1});const h=function(n,i){const r=a(s(),"translations",n);return t(r,{recursive:!0}),a(r,`${i}.json`)}(l,e);if(n(h))try{const n=JSON.parse(i(h,"utf-8"));if(n.translation)return n.translation}catch{}const p=await f(o,(g=l,{en:"English",zh:"Chinese (Simplified)",ja:"Japanese",ko:"Korean",es:"Spanish",ar:"Arabic",fr:"French",pt:"Portuguese (Brazilian)",ru:"Russian",hi:"Hindi",de:"German",id:"Indonesian",th:"Thai",vi:"Vietnamese",tr:"Turkish",uk:"Ukrainian",ht:"Haitian Creole",bn:"Bengali",kk:"Kazakh",uz:"Uzbek",lo:"Lao"}[g]||"English"));var g;return r(h,JSON.stringify({original:o,translation:p,timestamp:(new Date).toISOString()})),p}