icoa-cli 2.19.54 → 2.19.55

package/dist/commands/exam.js

@@ -1453,12 +1453,30 @@ export function registerExamCommand(program) {
         .description('Enter exam with access token (no login needed)')
         .action(async (code) => {
         logCommand(`exam token ${code}`);
-        const { getRealExamState } = await import('../lib/exam-state.js');
+        const { getRealExamState, saveExamState: saveExamStateFn } = await import('../lib/exam-state.js');
         const existing = getRealExamState();
         if (existing) {
+            const existingToken = existing.session.token;
+            // Migration path: pre-v2.19.55 sessions didn't persist the token on
+            // state. Those sessions can't use `lang` or submit via the new token
+            // path. If the user re-types the matching token, attach it so the
+            // session can reach the server again. Device binding on the server
+            // means only the original token holder can do this.
+            if (!existingToken && code) {
+                existing.session.token = code.trim();
+                saveExamStateFn(existing);
+                console.log();
+                console.log(chalk.green('  ✓ Token re-attached to your in-progress exam.'));
+                console.log(chalk.gray('    You can now use: ') + chalk.white('lang <code>') + chalk.gray(' · ') + chalk.white('exam submit'));
+                console.log();
+                console.log(chalk.bold.white('  Continue this exam:'));
+                console.log(chalk.gray('    → ') + chalk.bold.cyan('exam q 1') + chalk.gray('      resume at any question'));
+                console.log(chalk.gray('    → ') + chalk.bold.cyan('exam review') + chalk.gray('   see progress + flagged items'));
+                console.log();
+                return;
+            }
             const answered = Object.keys(existing.answers).length;
             const total = existing.session.questionCount;
-            const existingToken = existing.session.token;
             const deadline = getExamDeadline();
             const remainingMin = deadline ? Math.max(0, Math.round((deadline.getTime() - Date.now()) / 60000)) : null;
             console.log();
@@ -1571,6 +1589,11 @@ export function registerExamCommand(program) {
             // ── Timer starts NOW ──
             const confirmedAt = new Date().toISOString();
             session.confirmedAt = confirmedAt;
+            // Store the token on session so lang switching, exam submit, and
+            // resume can reach the server without re-prompting. Device binding
+            // means the token alone is useless on another machine, so keeping
+            // it in exam-state.json is safe.
+            session.token = code.trim();
             saveExamState({ session, questions, answers: {}, interactions: [], aiUsage: { ai4ctf: 0, ctf4ai: 0 } });
             console.log();
             printSuccess('Exam started! Timer is running.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.19.54",
+  "version": "2.19.55",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {