icoa-cli 1.9.0 → 2.0.0

package/dist/commands/env.js

@@ -61,9 +61,9 @@ const SYSTEM_TOOLS = [
     { name: 'as', check: CMD('as'), category: 'Compilers & Build' },
     { name: 'ld', check: CMD('ld'), category: 'Compilers & Build' },
     { name: 'pkg-config', check: CMD('pkg-config'), brew: 'pkg-config', apt: 'pkg-config', category: 'Compilers & Build' },
-    // Python (3)
-    { name: 'python3', check: W ? 'python --version' : 'python3 --version', brew: 'python@3.12', apt: 'python3', choco: 'python312', category: 'Python Runtime' },
-    { name: 'pip3', check: W ? 'pip --version' : 'pip3 --version', category: 'Python Runtime' },
+    // Python (3) — prefer brew 3.12 on macOS
+    { name: 'python3', check: process.platform === 'darwin' ? '/opt/homebrew/opt/python@3.12/bin/python3.12 --version' : (W ? 'python --version' : 'python3 --version'), brew: 'python@3.12', apt: 'python3', choco: 'python312', category: 'Python Runtime' },
+    { name: 'pip3', check: process.platform === 'darwin' ? '/opt/homebrew/opt/python@3.12/bin/pip3.12 --version' : (W ? 'pip --version' : 'pip3 --version'), category: 'Python Runtime' },
     { name: 'python3-venv', check: W ? 'python -c "import venv"' : 'python3 -c "import venv"', apt: 'python3-venv', category: 'Python Runtime' },
     // Networking (12)
     { name: 'curl', check: CMD('curl'), brew: 'curl', apt: 'curl', choco: 'curl', category: 'Networking' },
@@ -160,8 +160,8 @@ function isInstalled(check) {
 function getVersion(name) {
     // Version commands for each tool
     const versionCmds = {
-        'python3': 'python3 --version',
-        'pip3': 'pip3 --version',
+        'python3': process.platform === 'darwin' ? '/opt/homebrew/opt/python@3.12/bin/python3.12 --version' : 'python3 --version',
+        'pip3': process.platform === 'darwin' ? '/opt/homebrew/opt/python@3.12/bin/pip3.12 --version' : 'pip3 --version',
         'gcc': 'gcc --version',
         'g++': 'g++ --version',
         'make': 'make --version',
@@ -237,6 +237,13 @@ function getNodeInfo() {
     return `Node.js ${process.version}`;
 }
 function getPythonMajorMinor() {
+    // On macOS, prefer brew Python 3.12
+    if (process.platform === 'darwin') {
+        try {
+            return execSync('/opt/homebrew/opt/python@3.12/bin/python3.12 -c "import sys; print(f\'{sys.version_info.major}.{sys.version_info.minor}\')"', { encoding: 'utf-8' }).trim();
+        }
+        catch { /* fall through */ }
+    }
     try {
         return execSync('python3 -c "import sys; print(f\'{sys.version_info.major}.{sys.version_info.minor}\')"', { encoding: 'utf-8' }).trim();
     }
@@ -244,6 +251,20 @@ function getPythonMajorMinor() {
         return '';
     }
 }
+function getPythonFullVersion() {
+    if (process.platform === 'darwin') {
+        try {
+            return execSync('/opt/homebrew/opt/python@3.12/bin/python3.12 --version', { encoding: 'utf-8' }).trim().replace('Python ', '');
+        }
+        catch { /* fall through */ }
+    }
+    try {
+        return execSync('python3 --version', { encoding: 'utf-8' }).trim().replace('Python ', '');
+    }
+    catch {
+        return '';
+    }
+}
 export function registerEnvCommand(program) {
     const envCmd = program.command('env').description('Manage competition environment');
     envCmd.command('status').alias('check').description('Check all 109 tools').action(() => showStatus());
@@ -261,19 +282,14 @@ function showStatus() {
     console.log(chalk.gray('  Package:  ') + chalk.white(pm));
     console.log(chalk.gray('  Target:   ') + chalk.white(`Python ${PYTHON_TARGET}.x`));
     console.log(chalk.gray('  ─────────────────────────────────────────────'));
-    // Python version check
+    // Python version check — use brew 3.12 on macOS
     const pyVer = getPythonMajorMinor();
-    if (pyVer) {
-        const fullVer = getVersion('python3');
-        if (pyVer === '3.12') {
-            console.log(chalk.green(`  ✓ Python ${fullVer}`) + chalk.gray(' (recommended)'));
-        }
-        else if (pyVer === '3.11' || pyVer === '3.13') {
-            console.log(chalk.yellow(`  ~ Python ${fullVer}`) + chalk.gray(' (3.12.x recommended for full compatibility)'));
-        }
-        else {
-            console.log(chalk.red(`  ✗ Python ${fullVer}`) + chalk.gray(' (3.12.x required — some tools may not work)'));
-        }
+    const fullVer = getPythonFullVersion();
+    if (pyVer === '3.12') {
+        console.log(chalk.green(`  ✓ Python ${fullVer}`) + chalk.gray(' (recommended)'));
+    }
+    else if (pyVer) {
+        console.log(chalk.yellow(`  ~ Python ${fullVer}`) + chalk.gray(' (3.12.x recommended)'));
     }
     else {
         console.log(chalk.red('  ✗ Python 3 not found'));

package/dist/index.js

@@ -36,7 +36,7 @@ ${LINE}
    ${chalk.white('Sydney, Australia')}  ${chalk.gray('Jun 27 - Jul 2, 2026')}
    ${chalk.cyan.underline('https://icoa2026.au')}
 
-   ${chalk.gray('CLI-Native Competition Terminal  v1.9.0')}
+   ${chalk.gray('CLI-Native Competition Terminal  v2.0.0')}
 
 ${LINE}
 `;

package/dist/repl.js

@@ -7,8 +7,27 @@ import { resetTerminalTheme } from './lib/theme.js';
 import { ensureSandbox, runInSandbox, isDockerAvailable } from './lib/sandbox.js';
 import { logCommand } from './lib/logger.js';
 import { startLogSync, stopLogSync } from './lib/log-sync.js';
+import { existsSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+// Competition workspace — all system commands restricted here
+const WORKSPACE = join(homedir(), 'icoa-workspace');
+function ensureWorkspace() {
+    if (!existsSync(WORKSPACE))
+        mkdirSync(WORKSPACE, { recursive: true });
+    return WORKSPACE;
+}
+// Blocked commands — security risk
+const BLOCKED_COMMANDS = new Set([
+    'sudo', 'su', 'doas', 'pkexec', // privilege escalation
+    'brew', 'apt', 'apt-get', 'yum', 'choco', // package managers (use env setup)
+    'npm', 'npx', 'pip', 'pip3', // package install (use env setup)
+    'shutdown', 'reboot', 'halt', // system control
+    'mkfs', 'fdisk', 'dd', // disk operations
+    'iptables', 'ufw', // firewall
+]);
 const INTERCEPT = '__REPL_NO_EXIT__';
-const VERSION = '1.9.0';
+const VERSION = '2.0.0';
 export async function startRepl(program, resumeMode) {
     const config = getConfig();
     const connected = isConnected();
@@ -83,7 +102,9 @@ export async function startRepl(program, resumeMode) {
         console.log();
     }
     else if (activated) {
+        ensureWorkspace();
         console.log(chalk.green('   Welcome, competitor! Ready to hack.'));
+        console.log(chalk.gray(`   Workspace: ${WORKSPACE}`));
         console.log();
         console.log(chalk.gray('   Quick Start'));
         console.log(chalk.gray('   ─────────────'));
@@ -193,20 +214,24 @@ export async function startRepl(program, resumeMode) {
             'log', 'lang', 'setup', 'env', 'model', 'ctf',
         ];
         if (!knownCommands.includes(cmd)) {
-            // Force Python 3.12 — rewrite python3/python/pip3 to 3.12 binaries
+            // Block dangerous commands
+            if (BLOCKED_COMMANDS.has(cmd)) {
+                console.log(chalk.red(`  Blocked: ${cmd} is not allowed during competition.`));
+                console.log();
+                rl.prompt();
+                return;
+            }
+            // Force Python 3.12 — rewrite python3/python to 3.12 binaries
             let resolvedInput = input;
             if (process.platform === 'darwin') {
                 const py12 = '/opt/homebrew/opt/python@3.12/bin/python3.12';
-                const pip12 = '/opt/homebrew/opt/python@3.12/bin/pip3.12';
                 resolvedInput = resolvedInput
                     .replace(/^python3?\s/, `${py12} `)
-                    .replace(/^pip3?\s/, `${pip12} `);
-                if (resolvedInput === 'python3' || resolvedInput === 'python')
-                    resolvedInput = py12;
-                if (resolvedInput === 'pip3' || resolvedInput === 'pip')
-                    resolvedInput = pip12;
+                    .replace(/^(python3|python)$/, py12);
             }
-            // Route to Docker sandbox if available, otherwise system shell
+            // Ensure workspace directory
+            const cwd = ensureWorkspace();
+            // Route to Docker sandbox if available, otherwise system shell (in workspace)
             processing = true;
             try {
                 if (isDockerAvailable()) {
@@ -215,11 +240,11 @@ export async function startRepl(program, resumeMode) {
                         await runInSandbox(resolvedInput, rl);
                     }
                     else {
-                        await runSystemCommand(resolvedInput, rl);
+                        await runSystemCommand(resolvedInput, rl, cwd);
                     }
                 }
                 else {
-                    await runSystemCommand(resolvedInput, rl);
+                    await runSystemCommand(resolvedInput, rl, cwd);
                 }
             }
             catch {
@@ -264,13 +289,13 @@ export async function startRepl(program, resumeMode) {
         realExit(0);
     });
 }
-function runSystemCommand(input, rl) {
+function runSystemCommand(input, rl, cwd) {
     return new Promise((resolve) => {
-        // Pause readline so the child process gets full terminal control
         rl.pause();
         const child = spawn(input, {
             shell: true,
             stdio: 'inherit',
+            cwd: cwd || process.cwd(),
         });
         child.on('close', () => {
             rl.resume();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "1.9.0",
+  "version": "2.0.0",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {