icoa-cli 2.19.70 → 2.19.72

package/dist/commands/exam.js

@@ -1247,7 +1247,9 @@ export function registerExamCommand(program) {
                 const helpState = getHelpState(state);
                 clearExamState();
                 const percentage = Math.round(score / total * 100);
-                // Report demo stats to server
+                // Report demo stats to server (includes full interaction audit
+                // trail so admin can see hint usage patterns, time per question,
+                // answer changes — same data we collect for real exams).
                 const config = getConfig();
                 fetch('https://practice.icoa2026.au/api/icoa/demo-stats', {
                     method: 'POST',
@@ -1262,6 +1264,7 @@ export function registerExamCommand(program) {
                         tokens_used: 0,
                         solved: percentage >= 60 ? 1 : 0,
                         timestamp: new Date().toISOString(),
+                        interactions: state.interactions || [],
                     }),
                     signal: AbortSignal.timeout(5000),
                 }).catch(() => { });

package/dist/repl.js

@@ -704,7 +704,11 @@ export async function startRepl(program, resumeMode) {
         // ─── Mode-based command filtering ───
         const selectionCommands = ['exam', 'demo', 'retry', 'nations', 'next', 'prev', 'continue', 'setup', 'lang', 'ref', 'ai4ctf', 'ctf4ai', 'mark', 'unmark', 'review', 'submit'];
         const organizerCommands = ['join', 'exam', 'demo', 'retry', 'next', 'prev', 'logout', 'setup', 'lang', 'ref', 'ctf', 'mark', 'unmark', 'review', 'submit'];
-        if (mode === 'selection' && !selectionCommands.includes(cmd)) {
+        // Selection mode allows shell commands prefixed with ! — contestants
+        // need !python3, !cat, !base64 etc. for practical questions (Q31-Q40).
+        // BLOCKED_COMMANDS check downstream still rejects dangerous ones.
+        const isShellCommand = input.startsWith('!') || cmd.startsWith('!');
+        if (mode === 'selection' && !isShellCommand && !selectionCommands.includes(cmd)) {
             console.log(chalk.gray('  Not available in Selection mode.'));
             if (examState) {
                 const currentQ = examState._lastQ || 1;
@@ -764,7 +768,9 @@ export async function startRepl(program, resumeMode) {
                 }
             }
             // Force Python 3.12 — rewrite python/python3 to correct binary
-            let resolvedInput = input;
+            // Strip optional ! prefix that contestants use to disambiguate shell
+            // commands from CLI commands (e.g. !python3 vs cli's "python" command).
+            let resolvedInput = input.startsWith('!') ? input.slice(1).trim() : input;
             if (process.platform === 'darwin') {
                 const py12 = '/opt/homebrew/opt/python@3.12/bin/python3.12';
                 resolvedInput = resolvedInput

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.19.70",
+  "version": "2.19.72",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {