icoa-cli 2.19.458 → 2.19.460

package/dist/lib/shell-split.d.ts

@@ -1,17 +0,0 @@
-/**
- * shellSplit — a minimal, quote-aware tokenizer for REPL commands that forward
- * raw args straight to a child process (currently `aienv run` / `aienv python`).
- *
- * The icoa REPL is NOT a shell: the default command split on /\s+/ turns quotes
- * into literal characters and tears spaced args apart, so `aienv run "my file.py"`
- * and `aienv python -c "print(1 + 1)"` reach python mangled. This honours
- * single/double quotes (and backslash escapes inside double quotes / outside
- * quotes) the way a real shell would tokenize them. (Direct-CLI invocation never
- * needs this — there the system shell does the tokenization for us.)
- *
- * Scope is deliberately small: word-splitting + quote removal + backslash
- * escapes. No globbing, no variable/`$()` expansion, no `~` expansion — the
- * child process / caller handles paths, and we explicitly do not want shell
- * metacharacter semantics in the REPL.
- */
-export declare function shellSplit(input: string): string[];

package/dist/lib/sim-cooldown.d.ts

@@ -1,14 +0,0 @@
-export declare const COOLDOWN_SECONDS = 60;
-export declare function lastSimAt(): number;
-export declare function markSimAt(t: number): void;
-/** Seconds remaining (0 if clear). */
-export declare function cooldownRemaining(): number;
-export declare function lastBundledAt(): number;
-export declare function markBundledAt(t: number): void;
-export declare function lastArmAt(): number;
-export declare function markArmAt(t: number): void;
-/**
- * Has the user seen any sim render — bundled, server, or arm — at least once?
- * Used by demo2 + boot screen to switch from "first time" to "continue" copy.
- */
-export declare function hasAnySimHistory(): boolean;

package/dist/lib/sprint-meta.d.ts

@@ -1,72 +0,0 @@
-/** Media a task needs that its CSV three-pack does not carry. */
-export interface SprintMedia {
-    /** what the files are — decides which library the guidance names */
-    kind: 'audio' | 'image' | 'weights' | 'archive';
-    /** teleload pack id (also the folder it unpacks into) */
-    pack: string;
-    /** unpacked size, MB — from the live teleload manifest at authoring time */
-    mb: number;
-    /** where the files sit inside the pack, for the "replace this cell" hint */
-    glob?: string;
-}
-export interface SprintTaskMeta {
-    seq: number;
-    bullseye: string;
-    title: string;
-    platform: string;
-    difficulty: number;
-    data_mb: number;
-    needs_gpu: boolean;
-    cli_mode: string;
-    dir?: string;
-    topic_cn?: string;
-    comp?: string | null;
-    judged?: boolean;
-    status?: string;
-    /**
-     * What `run all` prints on the shipped starter, measured by actually running
-     * every notebook (not read off the code). `'none'` = it stops before scoring.
-     * `'pack'` = the teleload pack ships its own baseline notebook.
-     */
-    baseline?: string;
-    media?: SprintMedia;
-}
-/** Data files live next to the built JS (copied by the build), fall back to repo layout. */
-export declare function sprintDataPath(name: string): string;
-export declare function loadSprintTasks(): SprintTaskMeta[];
-/** Look a task up by the competition id the student types (`s01-sound-of-nature`). */
-export declare function sprintTaskForComp(comp: string | null | undefined): SprintTaskMeta | null;
-/**
- * The commands to type, in order. A media task is TWO steps and the media comes
- * first — pulling the CSVs first only to hit a wall in cell 3 is the dead end
- * this function exists to remove.
- */
-export declare function taskSteps(t: SprintTaskMeta): string[];
-/** One-line answer to "will `run all` give me a number?" */
-export declare function baselineChip(t: SprintTaskMeta, zh: boolean): string;
-/**
- * What a student can do RIGHT NOW.
- *
- * 🔴 The GPU half used to read "⚡ 需 GPU · 排晚场", which sent students to
- * `gpu on` — and that path is currently broken for sprint tasks: the box's data
- * tree is `/data/aiproblems/<platform>/<source-name>` while the notebook asks
- * for `/data/kaggle/<comp_id>`, so the kernel lands on a directory that does not
- * exist (and these comps carry no `data_base` fallback either). Meanwhile we
- * MEASURED every one of them producing a baseline on a laptop CPU. So the chip
- * says the true thing: heavy, GPU optional, starts here. Put "evening window"
- * back once the box-side hydration lands.
- */
-export declare function computeChip(t: SprintTaskMeta, zh: boolean): string;
-/**
- * The list's legend for the same three marks the cards use. It lives here, next
- * to `computeChip`, because the two were written apart and immediately drifted:
- * the card said "GPU optional, the baseline runs on your laptop" while the
- * legend two screens earlier still said "needs GPU — gpu key → gpu on".
- */
-export declare function computeLegend(zh: boolean): string;
-/**
- * The media block: what is missing, the command that fetches it, and the first
- * line of code that reads it. Used by the download guide AND baked into the
- * starter notebook's stop message, so the two can never disagree.
- */
-export declare function mediaHelpLines(t: SprintTaskMeta, zh: boolean): string[];

package/dist/lib/statusline.d.ts

@@ -1 +0,0 @@
-export declare function buildStatusLine(width?: number): string | null;

package/dist/lib/terminal-cleanup.d.ts

@@ -1,35 +0,0 @@
-/**
- * When icoa-cli runs inside the ICOA Terminal (Tauri + xterm.js) the host is
- * already pre-themed to our exact palette, so theme.ts never sets OSC 10/11/12
- * and we must not reset them either — doing so would fight the host.
- */
-export declare function isIcoaTerminal(): boolean;
-export declare function supportsAnsi(): boolean;
-/**
- * Pure sequence builder — the whole point of splitting it out is that the exit
- * path is testable without a TTY. See test/terminal-cleanup.test.js.
- *
- * Note the two guards differ on purpose: the mode reset is gated on being a
- * TTY (bracketed paste is switched on for any TTY, colour support or not),
- * while the colour reset is gated on ANSI support so a `TERM=dumb` session
- * never gets escape bytes echoed at it.
- */
-export declare function buildCleanupSequence(opts: {
-    ansi: boolean;
-    icoaTerminal: boolean;
-}): string;
-/** Restore the terminal now. Idempotent, safe to call from any exit path. */
-export declare function cleanupTerminal(): void;
-/**
- * Register cleanup on every exit path. Idempotent: the first caller wins, so
- * both theme.ts (colour owner) and input-dynamics.ts (bracketed-paste owner)
- * can call it unconditionally without double-registering.
- *
- * Deliberately NOT called by the supervisor in index.ts — the supervisor must
- * survive Ctrl+C so the worker can own SIGINT (exam pause, inquirer cancel).
- * It calls cleanupTerminal() directly instead, right before it exits.
- *
- * Exit codes match the shell convention (128 + signal number) and preserve
- * what theme.ts shipped before this module existed.
- */
-export declare function armTerminalCleanup(): void;

package/dist/lib/theme.d.ts

@@ -1,4 +0,0 @@
-type ThemeVariant = 'dark' | 'high-contrast';
-export declare function setTerminalTheme(variant?: ThemeVariant): void;
-export declare function resetTerminalTheme(): void;
-export {};

package/dist/lib/token-format.d.ts

@@ -1,41 +0,0 @@
-/**
- * Client mirror of panda/token_alphabet.py — the confusable-free token rule.
- *
- * Tokens are <2-char prefix> + <7 random Crockford chars> + <1 checksum char>.
- * Crockford Base32 excludes I, L, O, U (look like 1, 1, 0, V) so a token copied
- * off a PDF or dictated aloud can't be mistranscribed.
- *
- * Two helpers used at token entry:
- *  - normalizeTokenBody(): fix look-alikes a human typed (O→0, I/L→1, U→V) in
- *    the BODY only (prefix is a fixed track/country code, may contain I/O).
- *  - validTokenChecksum(): verify the trailing Crockford checksum.
- *
- * IMPORTANT backward-compat note: tokens issued before 2026-06-07 used the full
- * 36-char alphabet and have NO valid checksum (and ~61% of learn tokens contain
- * a real I/L/O/U in the body). So on the LEARN path normalization must be a
- * FALLBACK (try literal first) and checksum must NEVER hard-block — the server
- * stays authoritative (BUG-001). Exam tokens have always been Crockford+checksum
- * so both helpers are safe to apply directly there.
- */
-export declare const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-export declare const PREFIX_LEN = 2;
-export declare const BODY_RANDOM_LEN = 7;
-export declare const TOKEN_LEN: number;
-/** Replace confusable letters in a string (uppercased first). */
-export declare function normalizeConfusables(s: string): string;
-/**
- * Normalize a token's BODY only — the 2-char prefix is a fixed track/country
- * code (e.g. EI / IO legitimately contain I/O) and must NOT be transformed.
- * Returns the trimmed, upper-cased token with body confusables canonicalized.
- */
-export declare function normalizeTokenBody(token: string): string;
-/** 1-char Crockford mod-32 checksum over the payload chars. */
-export declare function checksumChar(payload: string): string;
-/** True iff `body` is 7 Crockford chars + 1 correct checksum char. */
-export declare function validBody(body: string): boolean;
-/**
- * Whole-token checksum check for a 10-char `<prefix><body>` token. Returns
- * false for old (pre-checksum) tokens — only meaningful as a *soft* signal on
- * the learn path; authoritative only for exam tokens.
- */
-export declare function validTokenChecksum(token: string): boolean;

package/dist/lib/tool-man.d.ts

@@ -1,11 +0,0 @@
-export interface ToolDoc {
-    name: string;
-    aliases?: string[];
-    cat: string;
-    summary: string;
-    /** [command, note] — real CTF invocations */
-    ex: Array<[string, string]>;
-}
-export declare const TOOL_DOCS: ToolDoc[];
-/** Render `man <query>`: empty/"tools"/"list" → index; a tool → its sheet; else nearest hints. */
-export declare function renderToolMan(query: string): void;

package/dist/lib/toolset-hash.d.ts

@@ -1,15 +0,0 @@
-export interface ToolsetHashRecord {
-    hash: string;
-    platform: string;
-    count: number;
-    computedAt: string;
-}
-/** Compute the hash over (name=version) pairs, persist it, return the hash.
- *  Called once at the end of `env setup` so the exam-start path only READS. */
-export declare function computeAndCacheToolsetHash(entries: Array<{
-    name: string;
-    version: string;
-}>): string;
-/** Read the cached env-fingerprint hash. Returns undefined if `env setup` has
- *  not run (so the exam start path never blocks or spawns 30 version probes). */
-export declare function getCachedToolsetHash(): string | undefined;

package/dist/lib/translation.d.ts

@@ -1 +0,0 @@
-export declare function getTranslation(text: string, challengeId: number, targetLang: string): Promise<string>;

package/dist/lib/translations-fetcher.d.ts

@@ -1,6 +0,0 @@
-export declare function getLangCacheDir(lang: string): string;
-export declare function isLangCached(lang: string): boolean;
-export interface EnsureLangCacheOptions {
-    silent?: boolean;
-}
-export declare function ensureLangCache(lang: string, opts?: EnsureLangCacheOptions): Promise<boolean>;

package/dist/lib/ui.d.ts

@@ -1,12 +0,0 @@
-export declare function printSuccess(msg: string): void;
-export declare function printError(msg: string): void;
-export declare function printWarning(msg: string): void;
-export declare function printInfo(msg: string): void;
-export declare function printTable(headers: string[], rows: string[][]): void;
-export declare function printMarkdown(text: string): void;
-export declare function printMarkdownYellow(text: string): void;
-export declare function setReplMode(enabled: boolean): void;
-export declare function createSpinner(text: string): any;
-export declare function formatCountdown(targetDate: Date): string;
-export declare function printHeader(title: string): void;
-export declare function printKeyValue(key: string, value: string): void;

package/dist/lib/update-check.d.ts

@@ -1 +0,0 @@
-export declare function checkForUpdates(): void;

package/dist/lib/version.d.ts

@@ -1,8 +0,0 @@
-/**
- * Returns the running CLI's package.json version, cached after first call.
- * Used by interaction events + log-sync payload so future forensic audits
- * can pinpoint which CLI version produced any given event. Added in
- * v2.19.185 in response to the Paper E dispatcher bug, where we couldn't
- * tell from the data which contestants ran pre-fix vs post-fix code.
- */
-export declare function getCliVersion(): string;

package/dist/repl.d.ts

@@ -1,4 +0,0 @@
-import { Command } from 'commander';
-export declare function nearestCommand(word: string, max?: number): string | null;
-export declare function startRepl(program: Command, resumeMode: boolean): Promise<void>;
-export declare function mapCommand(input: string): string[];

package/dist/types/index.d.ts

@@ -1,221 +0,0 @@
-export interface CTFdChallenge {
-    id: number;
-    name: string;
-    description: string;
-    category: string;
-    value: number;
-    type: string;
-    state: string;
-    max_attempts: number;
-    tags: string[];
-    files: string[];
-    hints: {
-        id: number;
-        cost: number;
-    }[];
-    solves: number;
-    solved_by_me: boolean;
-    connection_info?: string;
-}
-export interface CTFdChallengeListItem {
-    id: number;
-    name: string;
-    category: string;
-    value: number;
-    type: string;
-    solves: number;
-    solved_by_me: boolean;
-    tags: string[];
-}
-export interface CTFdUser {
-    id: number;
-    name: string;
-    email: string;
-    team_id: number | null;
-    country: string | null;
-    score: number;
-    place: string | null;
-}
-export interface CTFdTeam {
-    id: number;
-    name: string;
-    score: number;
-    place: string | null;
-    members: {
-        id: number;
-        name: string;
-    }[];
-}
-export interface CTFdScoreboardEntry {
-    pos: number;
-    account_id: number;
-    account_url: string;
-    account_type: string;
-    name: string;
-    score: number;
-    members?: {
-        id: number;
-        name: string;
-    }[];
-}
-export interface CTFdAttemptResponse {
-    success: boolean;
-    data: {
-        status: 'correct' | 'incorrect' | 'already_solved' | 'paused' | 'ratelimited';
-        message: string;
-    };
-}
-export interface CTFdApiResponse<T> {
-    success: boolean;
-    data: T;
-    errors?: string[];
-}
-export interface IcoaConfig {
-    ctfdUrl: string;
-    token: string;
-    language: string;
-    sessionId: string;
-    competitionCode: string;
-    teamId: number | null;
-    userId: number | null;
-    userName: string;
-    teamName: string;
-    currentChallengeId: number | null;
-    currentChallengeName: string;
-    currentChallengeCategory: string;
-    competitionState: CompetitionState;
-    competitionStartsAt: string;
-    competitionEndsAt: string;
-    geminiApiKey: string;
-    geminiModel: string;
-    ai4ioaiEndpoint?: string;
-    ai4ioaiApiKey?: string;
-    ai4ioaiModel?: string;
-    accessToken: string;
-    deviceFingerprint: string;
-    installSalt?: string;
-    lastVersion: string;
-    demoCleanedForVersion?: string;
-    sessionCookie: string;
-    joinedAt?: string;
-    country: string;
-    mode: IcoaMode | '';
-    demoIntroSeen: boolean;
-    themeVariant?: 'dark' | 'high-contrast';
-    leaderToken?: string;
-    leaderTeam?: string;
-    bracketedPaste?: boolean;
-    learnWidth?: LearnWidthMode;
-    learnWide?: boolean;
-}
-export type LearnWidthMode = 'normal' | 'wide' | 'wider';
-export type CompetitionState = 'pre_competition' | 'demo' | 'live' | 'finished' | 'unknown';
-export type IcoaMode = 'instant' | 'learn' | 'selection' | 'olympiad' | 'organizer' | 'embodied';
-export type HintLevel = 'A' | 'B' | 'C';
-export interface HintBudget {
-    a: number;
-    b: number;
-    c: number;
-    tokensUsed: number;
-    tokenCap: number;
-}
-export interface LogEntry {
-    timestamp: string;
-    level: 'A' | 'B' | 'C' | 'command' | 'submit';
-    input: string;
-    challengeId?: number;
-    sessionId: string;
-    _mac?: string;
-    dyn?: InputDynamics;
-}
-export interface InputDynamics {
-    ms: number;
-    keys: number;
-    backspaces: number;
-    pastes: number;
-    pasteChars: number;
-    maxBurst: number;
-    suspectPaste: boolean;
-}
-export interface ChallengeContext {
-    name: string;
-    category: string;
-    description?: string;
-}
-export declare const DEFAULT_BUDGET: HintBudget;
-export declare const DEFAULT_CONFIG: IcoaConfig;
-export declare const SUPPORTED_LANGUAGES: readonly ["en", "zh", "ja", "ko", "es", "ar", "fr", "pt", "ru", "hi", "de", "id", "th", "vi", "tr", "uk", "ht", "sw", "uz", "lo"];
-export interface ExamListItem {
-    id: string;
-    name: string;
-    country: string;
-    questionCount: number;
-    durationMinutes: number;
-    status: 'available' | 'in_progress' | 'submitted';
-}
-export interface ExamQuestion {
-    number: number;
-    text: string;
-    category?: string;
-    options: {
-        A: string;
-        B: string;
-        C: string;
-        D: string;
-    };
-    answer?: 'A' | 'B' | 'C' | 'D';
-    explanation?: string;
-    sourceNumber?: number;
-    sourceOrder?: ('A' | 'B' | 'C' | 'D')[];
-}
-export interface ExamSession {
-    examId: string;
-    examName: string;
-    startedAt: string;
-    confirmedAt?: string;
-    durationMinutes: number;
-    questionCount: number;
-    totalScore?: number;
-    passingScore?: number;
-    country: string;
-    token?: string;
-    sessionNonce?: string;
-    clockOffsetMs?: number;
-    deadlineServerMs?: number;
-    workspaceDir?: string;
-}
-export interface ExamInteraction {
-    ts: string;
-    q: number;
-    type: 'prompt_attempt' | 'hint_used' | 'help_used' | 'ai_hint' | 'answer_submitted' | 'answer_changed';
-    input?: string;
-    result?: string;
-    tokens?: number;
-}
-export interface ExamNote {
-    ts: string;
-    q?: number;
-    text: string;
-}
-export interface ExamState {
-    session: ExamSession;
-    questions: ExamQuestion[];
-    answers: Record<number, string>;
-    interactions?: ExamInteraction[];
-    aiUsage?: {
-        ai4ctf: number;
-        ctf4ai: number;
-    };
-    bookmarks?: number[];
-    shownWarnings?: string[];
-    notes?: ExamNote[];
-}
-export interface ExamResult {
-    examId: string;
-    examName: string;
-    score: number;
-    total: number;
-    percentage: number;
-    passed: boolean;
-    submittedAt: string;
-}

package/refs/ROPgadget.txt

@@ -1,67 +0,0 @@
-ROPgadget Quick Reference
-=========================
-
-BASIC USAGE
-  ROPgadget --binary binary             Find all gadgets
-  ROPgadget --binary binary --depth 10  Deeper search
-
-FILTERING
-  ROPgadget --binary binary --only "pop|ret"     Only pop/ret
-  ROPgadget --binary binary --only "mov|ret"      Only mov/ret
-  ROPgadget --binary binary --filter "leave"       Exclude leave
-
-SEARCHING
-  ROPgadget --binary binary --string "/bin/sh"    Find string
-  ROPgadget --binary binary --opcode "c3"         Find by opcode
-  ROPgadget --binary binary --re "pop .* ; ret"   Regex search
-
-AUTO ROP CHAIN
-  ROPgadget --binary binary --ropchain            Auto-generate chain
-
-COMMON GADGETS TO FIND
-  # x86-64 function call setup
-  pop rdi ; ret          # 1st argument
-  pop rsi ; ret          # 2nd argument
-  pop rdx ; ret          # 3rd argument
-  pop rax ; ret          # syscall number
-  syscall ; ret          # syscall
-
-  # x86 (32-bit)
-  pop eax ; ret
-  pop ebx ; ret
-  int 0x80               # syscall
-
-  # Stack pivot
-  xchg rax, rsp ; ret
-  leave ; ret
-
-  # Write-what-where
-  mov [rdi], rax ; ret
-  mov qword ptr [rsi], rdi ; ret
-
-ROPPER (alternative tool)
-  ropper -f binary                    Find gadgets
-  ropper -f binary --search "pop rdi" Search specific
-  ropper -f binary --chain execve     Auto chain
-
-PWNTOOLS ROP
-  from pwn import *
-  e = ELF("./binary")
-  rop = ROP(e)
-
-  rop.find_gadget(["pop rdi", "ret"])
-  rop.find_gadget(["pop rsi", "pop r15", "ret"])
-  rop.find_gadget(["ret"])           # ret gadget for alignment
-
-  # Build chain
-  rop.raw(ret_gadget)               # Stack alignment
-  rop.call("puts", [got_puts])      # Call puts(GOT[puts])
-  rop.call("main")                  # Return to main
-  chain = rop.chain()
-
-COMMON CTF ROP PATTERNS
-  # ret2libc (x86-64)
-  1. Leak libc address (puts GOT via puts PLT)
-  2. Calculate libc base
-  3. Find system() and "/bin/sh" in libc
-  4. pop rdi; ret → "/bin/sh" → system()

package/refs/base64.txt

@@ -1,63 +0,0 @@
-Base64 & Encoding Quick Reference
-=================================
-
-BASE64
-  Alphabet: A-Z a-z 0-9 + / (padding: =)
-  Encodes 3 bytes → 4 characters
-  Decodes 4 characters → 3 bytes
-
-  # Command line
-  echo -n "text" | base64          Encode
-  echo "dGV4dA==" | base64 -d     Decode (Linux)
-  echo "dGV4dA==" | base64 -D     Decode (macOS)
-  base64 file > encoded.txt       Encode file
-  base64 -d encoded.txt > file    Decode file
-
-  # Python
-  import base64
-  base64.b64encode(b"text")       → b"dGV4dA=="
-  base64.b64decode(b"dGV4dA==")   → b"text"
-
-  # URL-safe Base64
-  base64.urlsafe_b64encode(data)  Uses - and _ instead of + and /
-  base64.urlsafe_b64decode(data)
-
-BASE32
-  Alphabet: A-Z 2-7 (padding: =)
-  echo -n "text" | base32
-  base64.b32encode(b"text")
-  base64.b32decode(b"ORSXG5A=")
-
-HEX
-  echo -n "text" | xxd -p         Encode to hex
-  echo "74657874" | xxd -r -p     Decode from hex
-  bytes.fromhex("74657874")       Python decode
-  b"text".hex()                   Python encode
-
-URL ENCODING
-  # Python
-  from urllib.parse import quote, unquote
-  quote("hello world")            → "hello%20world"
-  unquote("hello%20world")        → "hello world"
-
-ROT13
-  echo "text" | tr 'a-zA-Z' 'n-za-mN-ZA-M'
-  import codecs; codecs.decode("grkg", "rot_13")
-
-BINARY
-  # Python
-  bin(65)                          → "0b1000001"
-  int("1000001", 2)               → 65
-  ''.join(format(b, '08b') for b in data)   Bytes to binary
-
-ASCII TABLE (key values)
-  0x00  NULL       0x20  SPACE      0x30  '0'
-  0x09  TAB        0x41  'A'        0x61  'a'
-  0x0a  LF (\n)    0x5a  'Z'        0x7a  'z'
-  0x0d  CR (\r)    0x7e  '~'        0x7f  DEL
-
-CTF TIPS
-  - Try "Magic" in CyberChef to auto-detect encoding
-  - Flags often have multiple layers: Base64(Hex(XOR(flag)))
-  - Look for patterns: "==" at end = base64, all hex chars = hex
-  - base64 length is always multiple of 4