@opslane/claude-code-game 0.1.0

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+import { startServer } from "./server.js";
+import open from "open";
+import fs from "fs";
+const args = process.argv.slice(2);
+const noOpen = args.includes("--no-open");
+const portFlag = args.indexOf("--port");
+const preferredPort = portFlag !== -1 ? parseInt(args[portFlag + 1], 10) : 3000;
+// Detect WSL — auto-open doesn't work there
+function isWSL() {
+    try {
+        return fs.readFileSync("/proc/version", "utf-8").toLowerCase().includes("microsoft");
+    }
+    catch {
+        return false;
+    }
+}
+async function tryStart(port) {
+    try {
+        return await startServer(port);
+    }
+    catch (err) {
+        if (err.code === "EADDRINUSE") {
+            throw err;
+        }
+        throw err;
+    }
+}
+async function main() {
+    console.log("Starting Claude Code Game...");
+    let actualPort;
+    try {
+        // Try preferred port first
+        actualPort = await tryStart(preferredPort);
+    }
+    catch (err) {
+        if (err.code === "EADDRINUSE") {
+            console.log(`Port ${preferredPort} is in use, finding an available port...`);
+            // Let the OS assign a free port
+            actualPort = await tryStart(0);
+        }
+        else {
+            throw err;
+        }
+    }
+    const url = `http://127.0.0.1:${actualPort}`;
+    console.log(`Running at ${url}`);
+    if (!noOpen && !isWSL()) {
+        await open(url);
+    }
+    else if (isWSL()) {
+        console.log("WSL detected — open the URL above in your browser manually.");
+    }
+}
+main().catch((err) => {
+    console.error("Failed to start:", err);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACxC,MAAM,aAAa,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEhF,4CAA4C;AAC5C,SAAS,KAAK;IACZ,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAE5C,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,2BAA2B;QAC3B,UAAU,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,QAAQ,aAAa,0CAA0C,CAAC,CAAC;YAC7E,gCAAgC;YAChC,UAAU,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,oBAAoB,UAAU,EAAE,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;SAAM,IAAI,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/routes/auth.d.ts

@@ -0,0 +1 @@
+export declare const authRouter: import("express-serve-static-core").Router;

package/dist/routes/auth.js

@@ -0,0 +1,123 @@
+import { Router } from "express";
+import fs from "fs";
+import path from "path";
+import os from "os";
+import jwt from "jsonwebtoken";
+import { fileURLToPath } from "url";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const DATA_DIR = path.join(os.homedir(), ".claude-code-game");
+const AUTH_FILE = path.join(DATA_DIR, "auth.json");
+const KEYS_DIR = path.resolve(__dirname, "../../keys");
+// Worker URL — defaults to deployed Cloudflare Worker, overridable via env
+const WORKER_URL = process.env.WORKER_URL || "https://claude-code-game-api.abhishekray07.workers.dev";
+export const authRouter = Router();
+function readAuthFile() {
+    try {
+        if (!fs.existsSync(AUTH_FILE))
+            return null;
+        const data = JSON.parse(fs.readFileSync(AUTH_FILE, "utf-8"));
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+function writeAuthFile(data) {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    // Write with 0600 permissions on Unix
+    fs.writeFileSync(AUTH_FILE, JSON.stringify(data), { mode: 0o600 });
+}
+function verifyToken(token) {
+    try {
+        // Try all public keys in keys/ directory
+        if (!fs.existsSync(KEYS_DIR))
+            return { valid: false };
+        const keyFiles = fs.readdirSync(KEYS_DIR).filter(f => f.endsWith(".pem"));
+        for (const keyFile of keyFiles) {
+            try {
+                const publicKey = fs.readFileSync(path.join(KEYS_DIR, keyFile), "utf-8");
+                const payload = jwt.verify(token, publicKey, {
+                    algorithms: ["RS256"],
+                    issuer: "claude-code-game-worker",
+                    audience: "claude-code-game-local",
+                });
+                return { valid: true, payload };
+            }
+            catch {
+                continue;
+            }
+        }
+        return { valid: false };
+    }
+    catch {
+        return { valid: false };
+    }
+}
+// GET /api/auth/status — check if user has valid local token
+authRouter.get("/api/auth/status", (_req, res) => {
+    const auth = readAuthFile();
+    if (!auth) {
+        res.json({ authenticated: false });
+        return;
+    }
+    const { valid, payload } = verifyToken(auth.token);
+    if (!valid) {
+        res.json({ authenticated: false });
+        return;
+    }
+    res.json({ authenticated: true, token: auth.token, email: payload.sub, name: payload.name });
+});
+// POST /api/auth/request — proxy to Worker
+authRouter.post("/api/auth/request", async (req, res) => {
+    try {
+        const workerRes = await fetch(`${WORKER_URL}/verify/request`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(req.body),
+        });
+        const data = await workerRes.json();
+        res.status(workerRes.status).json(data);
+    }
+    catch (err) {
+        res.status(503).json({ error: "Auth service unavailable. Please try again later." });
+    }
+});
+// POST /api/auth/confirm — proxy to Worker, store token locally
+authRouter.post("/api/auth/confirm", async (req, res) => {
+    try {
+        const workerRes = await fetch(`${WORKER_URL}/verify/confirm`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(req.body),
+        });
+        const data = await workerRes.json();
+        if (workerRes.ok && data.token) {
+            writeAuthFile({ token: data.token, email: data.email, name: data.name });
+        }
+        res.status(workerRes.status).json(data);
+    }
+    catch (err) {
+        res.status(503).json({ error: "Auth service unavailable. Please try again later." });
+    }
+});
+// POST /api/auth/logout — delete local auth file
+authRouter.post("/api/auth/logout", (_req, res) => {
+    try {
+        if (fs.existsSync(AUTH_FILE))
+            fs.unlinkSync(AUTH_FILE);
+    }
+    catch { }
+    res.json({ ok: true });
+});
+// GET /api/leaderboard — proxy to Worker
+authRouter.get("/api/leaderboard", async (_req, res) => {
+    try {
+        const workerRes = await fetch(`${WORKER_URL}/leaderboard`);
+        const data = await workerRes.json();
+        res.status(workerRes.status).json(data);
+    }
+    catch {
+        res.json([]); // Return empty if Worker is unreachable
+    }
+});
+//# sourceMappingURL=auth.js.map

package/dist/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAC;AAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAEvD,2EAA2E;AAC3E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wDAAwD,CAAC;AAEtG,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;AAEnC,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAoD;IACzE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,sCAAsC;IACtC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,yCAAyC;QACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;oBAC3C,UAAU,EAAE,CAAC,OAAO,CAAC;oBACrB,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EAAE,wBAAwB;iBACnC,CAAC,CAAC;gBACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IAClE,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,2CAA2C;AAC3C,UAAU,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,iBAAiB,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;SAC/B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAyB,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,gEAAgE;AAChE,UAAU,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,iBAAiB,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;SAC/B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAyB,CAAC;QAC3D,IAAI,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iDAAiD;AACjD,UAAU,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IACnE,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,yCAAyC;AACzC,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;IACxE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,cAAc,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,wCAAwC;IACxD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/routes/levels.d.ts

@@ -0,0 +1,44 @@
+export declare const levelsRouter: import("express-serve-static-core").Router;
+export interface VerificationRule {
+    type: string;
+    tool_name?: string;
+    min_count?: number;
+    path?: string;
+    pattern?: string;
+    command?: string;
+    expected_output?: string;
+    description?: string;
+}
+export interface Hint {
+    after_minutes: number;
+    text: string;
+}
+export interface Level {
+    id: string;
+    number: number;
+    title: string;
+    module: string;
+    intro: string;
+    video?: {
+        url: string;
+        duration_seconds: number;
+    };
+    exercise?: {
+        intro: string;
+        objective: string;
+    };
+    verification: VerificationRule[];
+    hints: Hint[];
+    success: string;
+    limits: {
+        max_duration_minutes: number;
+        max_claude_messages: number;
+    };
+}
+export declare function loadLevelByNumber(num: number): Level | null;
+export declare function listLevels(): Array<{
+    id: string;
+    number: number;
+    title: string;
+    module: string;
+}>;

package/dist/routes/levels.js

@@ -0,0 +1,78 @@
+import { Router } from "express";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+import YAML from "yaml";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const LEVELS_DIR = path.resolve(__dirname, "../../levels");
+export const levelsRouter = Router();
+export function loadLevelByNumber(num) {
+    const prefix = String(num).padStart(2, "0");
+    const entries = fs.readdirSync(LEVELS_DIR, { withFileTypes: true });
+    for (const entry of entries) {
+        if (entry.isDirectory() && entry.name.startsWith(`${prefix}-`)) {
+            const lessonPath = path.join(LEVELS_DIR, entry.name, "lesson.yaml");
+            if (fs.existsSync(lessonPath)) {
+                const raw = YAML.parse(fs.readFileSync(lessonPath, "utf-8"));
+                return parseLevel(raw);
+            }
+        }
+    }
+    return null;
+}
+export function listLevels() {
+    const levels = [];
+    const entries = fs.readdirSync(LEVELS_DIR, { withFileTypes: true });
+    for (const entry of entries) {
+        if (entry.isDirectory() && /^\d{2}-/.test(entry.name)) {
+            const lessonPath = path.join(LEVELS_DIR, entry.name, "lesson.yaml");
+            if (fs.existsSync(lessonPath)) {
+                const raw = YAML.parse(fs.readFileSync(lessonPath, "utf-8"));
+                levels.push({ id: raw.id, number: raw.number, title: raw.title, module: raw.module });
+            }
+        }
+    }
+    return levels.sort((a, b) => a.number - b.number);
+}
+function parseLevel(data) {
+    return {
+        id: data.id,
+        number: data.number,
+        title: data.title,
+        module: data.module,
+        intro: data.intro,
+        video: data.video ? { url: data.video.url, duration_seconds: data.video.duration_seconds } : undefined,
+        exercise: data.exercise ? { intro: data.exercise.intro, objective: data.exercise.objective } : undefined,
+        verification: (data.verification || []).map((r) => ({
+            type: r.type,
+            tool_name: r.tool_name,
+            min_count: r.min_count,
+            path: r.path,
+            pattern: r.pattern,
+            command: r.command,
+            expected_output: r.expected_output,
+            description: r.description,
+        })),
+        hints: (data.hints || []).map((h) => ({ after_minutes: h.after_minutes, text: h.text })),
+        success: data.success,
+        limits: {
+            max_duration_minutes: data.limits?.max_duration_minutes ?? 15,
+            max_claude_messages: data.limits?.max_claude_messages ?? 20,
+        },
+    };
+}
+// GET /api/levels
+levelsRouter.get("/api/levels", (_req, res) => {
+    res.json(listLevels());
+});
+// GET /api/levels/:number
+levelsRouter.get("/api/levels/:number", (req, res) => {
+    const num = parseInt(req.params.number, 10);
+    const level = loadLevelByNumber(num);
+    if (!level) {
+        res.status(404).json({ detail: `Level ${num} not found` });
+        return;
+    }
+    res.json(level);
+});
+//# sourceMappingURL=levels.js.map

package/dist/routes/levels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"levels.js","sourceRoot":"","sources":["../../src/routes/levels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;AAiCrC,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACpE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC7D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,MAAM,GAAyE,EAAE,CAAC;IACxF,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACpE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,IAAyB;IAC3C,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS;QACtG,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;QACxG,YAAY,EAAE,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YACvD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;QACH,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE;YACN,oBAAoB,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB,IAAI,EAAE;YAC7D,mBAAmB,EAAE,IAAI,CAAC,MAAM,EAAE,mBAAmB,IAAI,EAAE;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,kBAAkB;AAClB,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC5C,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,0BAA0B;AAC1B,YAAY,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,GAAG,YAAY,EAAE,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/routes/sessions.d.ts

@@ -0,0 +1,17 @@
+import { Server } from "http";
+import { Level } from "./levels.js";
+import type { IPty } from "node-pty-prebuilt-multiarch";
+interface Session {
+    sessionId: string;
+    wsToken: string;
+    pty: IPty;
+    level: Level;
+    levelNumber: number;
+    workspaceDir: string;
+    completed: boolean;
+    lastActivity: number;
+}
+export declare const sessionsRouter: import("express-serve-static-core").Router;
+export declare function getSession(sessionId: string): Session | undefined;
+export declare function setupWebSocket(server: Server): void;
+export {};

package/dist/routes/sessions.js

@@ -0,0 +1,303 @@
+import { Router } from "express";
+import { WebSocketServer, WebSocket } from "ws";
+import { v4 as uuidv4 } from "uuid";
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+import os from "os";
+import { spawnTerminal } from "../terminal.js";
+import { loadLevelByNumber } from "./levels.js";
+import { VerificationEngine } from "../verification.js";
+const DATA_DIR = path.join(os.homedir(), ".claude-code-game");
+const WORKSPACES_DIR = path.join(DATA_DIR, "workspaces");
+const LEVELS_DIR = path.resolve(path.dirname(new URL(import.meta.url).pathname), "../../levels");
+const sessions = new Map();
+export const sessionsRouter = Router();
+function safePath(root, relative) {
+    const resolved = path.resolve(root, relative);
+    if (!resolved.startsWith(path.resolve(root) + path.sep) && resolved !== path.resolve(root)) {
+        throw new Error(`Path traversal detected: ${relative}`);
+    }
+    return resolved;
+}
+function getExerciseDir(levelNumber) {
+    const prefix = String(levelNumber).padStart(2, "0");
+    const entries = fs.readdirSync(LEVELS_DIR, { withFileTypes: true });
+    for (const entry of entries) {
+        if (entry.isDirectory() && entry.name.startsWith(`${prefix}-`)) {
+            const exerciseDir = path.join(LEVELS_DIR, entry.name, "exercise");
+            if (fs.existsSync(exerciseDir))
+                return exerciseDir;
+        }
+    }
+    return null;
+}
+function copyExerciseFiles(exerciseDir, workspaceDir) {
+    const entries = fs.readdirSync(exerciseDir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (entry.isSymbolicLink())
+            continue;
+        const src = path.join(exerciseDir, entry.name);
+        const dest = path.join(workspaceDir, entry.name);
+        if (entry.isDirectory()) {
+            fs.cpSync(src, dest, { recursive: true });
+        }
+        else {
+            fs.copyFileSync(src, dest);
+        }
+    }
+}
+// Report completion to cloud (fire and forget)
+function reportCompletion(levelNumber) {
+    try {
+        const authPath = path.join(os.homedir(), ".claude-code-game", "auth.json");
+        if (!fs.existsSync(authPath))
+            return;
+        const auth = JSON.parse(fs.readFileSync(authPath, "utf-8"));
+        if (!auth.token)
+            return;
+        const workerUrl = process.env.WORKER_URL || "https://claude-code-game-api.abhishekray07.workers.dev";
+        fetch(`${workerUrl}/events`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "Authorization": `Bearer ${auth.token}`,
+            },
+            body: JSON.stringify({ level_number: levelNumber }),
+        }).catch(() => { }); // fire and forget
+    }
+    catch { }
+}
+const IDLE_TIMEOUT_MS = 30 * 60 * 1000;
+setInterval(() => {
+    const now = Date.now();
+    for (const [id, session] of sessions) {
+        if (now - session.lastActivity > IDLE_TIMEOUT_MS) {
+            session.pty.kill();
+            fs.rmSync(session.workspaceDir, { recursive: true, force: true });
+            sessions.delete(id);
+        }
+    }
+}, 60_000);
+process.on("exit", () => {
+    for (const [, session] of sessions) {
+        try {
+            session.pty.kill();
+        }
+        catch { }
+    }
+});
+// POST /api/sessions
+sessionsRouter.post("/api/sessions", (req, res) => {
+    const { level_number = 1 } = req.body;
+    const level = loadLevelByNumber(level_number);
+    if (!level) {
+        res.status(404).json({ detail: `Level ${level_number} not found` });
+        return;
+    }
+    const sessionId = uuidv4().slice(0, 8);
+    const wsToken = crypto.randomBytes(16).toString("hex");
+    const workspaceDir = path.join(WORKSPACES_DIR, sessionId);
+    fs.mkdirSync(workspaceDir, { recursive: true });
+    const exerciseDir = getExerciseDir(level_number);
+    if (exerciseDir) {
+        copyExerciseFiles(exerciseDir, workspaceDir);
+    }
+    let ptyProcess;
+    try {
+        ptyProcess = spawnTerminal(workspaceDir);
+    }
+    catch (err) {
+        fs.rmSync(workspaceDir, { recursive: true, force: true });
+        res.status(500).json({ detail: `Failed to spawn terminal: ${err.message}` });
+        return;
+    }
+    sessions.set(sessionId, {
+        sessionId,
+        wsToken,
+        pty: ptyProcess,
+        level,
+        levelNumber: level_number,
+        workspaceDir,
+        completed: false,
+        lastActivity: Date.now(),
+    });
+    res.json({
+        session_id: sessionId,
+        ws_token: wsToken,
+        status: "ready",
+        level: {
+            number: level.number,
+            title: level.title,
+            module: level.module,
+            intro: level.intro,
+            video: level.video ?? null,
+            exercise: level.exercise ?? null,
+        },
+    });
+});
+// DELETE /api/sessions/:sessionId
+sessionsRouter.delete("/api/sessions/:sessionId", (req, res) => {
+    const sessionId = req.params.sessionId;
+    const session = sessions.get(sessionId);
+    if (session) {
+        session.pty.kill();
+        fs.rmSync(session.workspaceDir, { recursive: true, force: true });
+        sessions.delete(sessionId);
+    }
+    res.json({ session_id: sessionId, status: "stopped" });
+});
+// PATCH /api/sessions/:sessionId/level
+sessionsRouter.patch("/api/sessions/:sessionId/level", (req, res) => {
+    const session = sessions.get(req.params.sessionId);
+    if (!session) {
+        res.status(404).json({ detail: "Session not found" });
+        return;
+    }
+    const { level_number } = req.body;
+    const level = loadLevelByNumber(level_number);
+    if (!level) {
+        res.status(404).json({ detail: `Level ${level_number} not found` });
+        return;
+    }
+    session.pty.kill();
+    fs.rmSync(session.workspaceDir, { recursive: true, force: true });
+    fs.mkdirSync(session.workspaceDir, { recursive: true });
+    const exerciseDir = getExerciseDir(level_number);
+    if (exerciseDir) {
+        copyExerciseFiles(exerciseDir, session.workspaceDir);
+    }
+    session.pty = spawnTerminal(session.workspaceDir);
+    session.level = level;
+    session.levelNumber = level_number;
+    session.completed = false;
+    session.lastActivity = Date.now();
+    res.json({
+        level: {
+            number: level.number,
+            title: level.title,
+            module: level.module,
+            intro: level.intro,
+            video: level.video ?? null,
+            exercise: level.exercise ?? null,
+        },
+    });
+});
+// GET /api/sessions/:sessionId/progress
+sessionsRouter.get("/api/sessions/:sessionId/progress", async (req, res) => {
+    const sessionId = req.params.sessionId;
+    const session = sessions.get(sessionId);
+    if (!session) {
+        res.status(404).json({ detail: "Session not found" });
+        return;
+    }
+    session.lastActivity = Date.now();
+    const engine = new VerificationEngine(session.workspaceDir);
+    const progress = await engine.getProgress(session.level);
+    if (progress.completed) {
+        session.completed = true;
+        reportCompletion(session.levelNumber);
+    }
+    res.json({
+        session_id: session.sessionId,
+        level_number: session.levelNumber,
+        completed: session.completed,
+        progress,
+    });
+});
+// GET /api/sessions/:sessionId/status
+sessionsRouter.get("/api/sessions/:sessionId/status", async (req, res) => {
+    const sessionId = req.params.sessionId;
+    const session = sessions.get(sessionId);
+    if (!session) {
+        res.status(404).json({ detail: "Session not found" });
+        return;
+    }
+    session.lastActivity = Date.now();
+    if (!session.completed) {
+        const engine = new VerificationEngine(session.workspaceDir);
+        const progress = await engine.getProgress(session.level);
+        if (progress.completed) {
+            session.completed = true;
+            reportCompletion(session.levelNumber);
+        }
+    }
+    res.json({ completed: session.completed });
+});
+export function getSession(sessionId) {
+    return sessions.get(sessionId);
+}
+// WebSocket setup
+export function setupWebSocket(server) {
+    const wss = new WebSocketServer({ noServer: true });
+    server.on("upgrade", (request, socket, head) => {
+        const url = new URL(request.url || "", `http://${request.headers.host}`);
+        const match = url.pathname.match(/^\/ws\/terminal\/(.+)$/);
+        if (!match) {
+            socket.destroy();
+            return;
+        }
+        const sessionId = match[1];
+        const token = url.searchParams.get("token");
+        const session = sessions.get(sessionId);
+        if (!session || session.wsToken !== token) {
+            socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+            socket.destroy();
+            return;
+        }
+        const origin = request.headers.origin || "";
+        if (origin && !origin.match(/^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/)) {
+            socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+            socket.destroy();
+            return;
+        }
+        wss.handleUpgrade(request, socket, head, (ws) => {
+            wss.emit("connection", ws, request, sessionId);
+        });
+    });
+    wss.on("connection", (ws, _req, sessionId) => {
+        const session = sessions.get(sessionId);
+        if (!session) {
+            ws.close(1008, "Session not found");
+            return;
+        }
+        session.lastActivity = Date.now();
+        const intro = session.level.intro;
+        ws.send("\x1b[2J\x1b[H");
+        ws.send("\r\n");
+        for (const line of intro.split("\n")) {
+            ws.send(line + "\r\n");
+        }
+        ws.send("\r\n");
+        ws.send("\x1b[90m" + "\u2500".repeat(60) + "\x1b[0m\r\n");
+        ws.send("\r\n");
+        session.pty.onData((data) => {
+            if (ws.readyState === WebSocket.OPEN) {
+                ws.send(data);
+            }
+        });
+        // Trigger a fresh prompt — the original was emitted before WS connected
+        session.pty.write("\n");
+        ws.on("message", (data) => {
+            const text = typeof data === "string" ? data : data.toString("utf-8");
+            session.lastActivity = Date.now();
+            if (text.startsWith("{")) {
+                try {
+                    const msg = JSON.parse(text);
+                    if (typeof msg.cols === "number" && typeof msg.rows === "number") {
+                        session.pty.resize(msg.cols, msg.rows);
+                        return;
+                    }
+                }
+                catch {
+                    // Not valid JSON, treat as PTY input
+                }
+            }
+            session.pty.write(text);
+        });
+        ws.on("close", () => {
+            // Session stays alive — user might reconnect
+        });
+    });
+}
+//# sourceMappingURL=sessions.js.map