icoa-cli 2.19.71 → 2.19.73

package/dist/commands/exam.js

@@ -1040,6 +1040,20 @@ export function registerExamCommand(program) {
         state.answers[num] = c;
         state._lastQ = num;
         saveExamState(state);
+        // Per-question sync to server (real exam only). Best-effort, fire-and-forget.
+        // If timer expires or network drops before final submit, the server still
+        // has the answer. Final submit is authoritative and overwrites this.
+        const tokenForSync = state.session.token;
+        if (tokenForSync && state.session.examId !== 'demo-free') {
+            const cfg = getConfig();
+            const url = `${cfg.ctfdUrl || 'https://practice.icoa2026.au'}/api/icoa/exams/${state.session.examId}/answer`;
+            fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token: tokenForSync, question: num, answer: c }),
+                signal: AbortSignal.timeout(5000),
+            }).catch(() => { }); // silent failure — local state still saved
+        }
         const answered = Object.keys(state.answers).length;
         const total = state.session.questionCount;
         printSuccess(`Q${num}: ${c} ✓  (${answered}/${total} answered)`);

package/dist/repl.js

@@ -704,7 +704,11 @@ export async function startRepl(program, resumeMode) {
         // ─── Mode-based command filtering ───
         const selectionCommands = ['exam', 'demo', 'retry', 'nations', 'next', 'prev', 'continue', 'setup', 'lang', 'ref', 'ai4ctf', 'ctf4ai', 'mark', 'unmark', 'review', 'submit'];
         const organizerCommands = ['join', 'exam', 'demo', 'retry', 'next', 'prev', 'logout', 'setup', 'lang', 'ref', 'ctf', 'mark', 'unmark', 'review', 'submit'];
-        if (mode === 'selection' && !selectionCommands.includes(cmd)) {
+        // Selection mode allows shell commands prefixed with ! — contestants
+        // need !python3, !cat, !base64 etc. for practical questions (Q31-Q40).
+        // BLOCKED_COMMANDS check downstream still rejects dangerous ones.
+        const isShellCommand = input.startsWith('!') || cmd.startsWith('!');
+        if (mode === 'selection' && !isShellCommand && !selectionCommands.includes(cmd)) {
             console.log(chalk.gray('  Not available in Selection mode.'));
             if (examState) {
                 const currentQ = examState._lastQ || 1;
@@ -764,7 +768,9 @@ export async function startRepl(program, resumeMode) {
                 }
             }
             // Force Python 3.12 — rewrite python/python3 to correct binary
-            let resolvedInput = input;
+            // Strip optional ! prefix that contestants use to disambiguate shell
+            // commands from CLI commands (e.g. !python3 vs cli's "python" command).
+            let resolvedInput = input.startsWith('!') ? input.slice(1).trim() : input;
             if (process.platform === 'darwin') {
                 const py12 = '/opt/homebrew/opt/python@3.12/bin/python3.12';
                 resolvedInput = resolvedInput

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.19.71",
+  "version": "2.19.73",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {