icoa-cli 1.9.1 → 2.0.0

package/dist/index.js

@@ -36,7 +36,7 @@ ${LINE}
    ${chalk.white('Sydney, Australia')}  ${chalk.gray('Jun 27 - Jul 2, 2026')}
    ${chalk.cyan.underline('https://icoa2026.au')}
 
-   ${chalk.gray('CLI-Native Competition Terminal  v1.9.1')}
+   ${chalk.gray('CLI-Native Competition Terminal  v2.0.0')}
 
 ${LINE}
 `;

package/dist/repl.js

@@ -7,8 +7,27 @@ import { resetTerminalTheme } from './lib/theme.js';
 import { ensureSandbox, runInSandbox, isDockerAvailable } from './lib/sandbox.js';
 import { logCommand } from './lib/logger.js';
 import { startLogSync, stopLogSync } from './lib/log-sync.js';
+import { existsSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+// Competition workspace — all system commands restricted here
+const WORKSPACE = join(homedir(), 'icoa-workspace');
+function ensureWorkspace() {
+    if (!existsSync(WORKSPACE))
+        mkdirSync(WORKSPACE, { recursive: true });
+    return WORKSPACE;
+}
+// Blocked commands — security risk
+const BLOCKED_COMMANDS = new Set([
+    'sudo', 'su', 'doas', 'pkexec', // privilege escalation
+    'brew', 'apt', 'apt-get', 'yum', 'choco', // package managers (use env setup)
+    'npm', 'npx', 'pip', 'pip3', // package install (use env setup)
+    'shutdown', 'reboot', 'halt', // system control
+    'mkfs', 'fdisk', 'dd', // disk operations
+    'iptables', 'ufw', // firewall
+]);
 const INTERCEPT = '__REPL_NO_EXIT__';
-const VERSION = '1.9.1';
+const VERSION = '2.0.0';
 export async function startRepl(program, resumeMode) {
     const config = getConfig();
     const connected = isConnected();
@@ -83,7 +102,9 @@ export async function startRepl(program, resumeMode) {
         console.log();
     }
     else if (activated) {
+        ensureWorkspace();
         console.log(chalk.green('   Welcome, competitor! Ready to hack.'));
+        console.log(chalk.gray(`   Workspace: ${WORKSPACE}`));
         console.log();
         console.log(chalk.gray('   Quick Start'));
         console.log(chalk.gray('   ─────────────'));
@@ -193,20 +214,24 @@ export async function startRepl(program, resumeMode) {
             'log', 'lang', 'setup', 'env', 'model', 'ctf',
         ];
         if (!knownCommands.includes(cmd)) {
-            // Force Python 3.12 — rewrite python3/python/pip3 to 3.12 binaries
+            // Block dangerous commands
+            if (BLOCKED_COMMANDS.has(cmd)) {
+                console.log(chalk.red(`  Blocked: ${cmd} is not allowed during competition.`));
+                console.log();
+                rl.prompt();
+                return;
+            }
+            // Force Python 3.12 — rewrite python3/python to 3.12 binaries
             let resolvedInput = input;
             if (process.platform === 'darwin') {
                 const py12 = '/opt/homebrew/opt/python@3.12/bin/python3.12';
-                const pip12 = '/opt/homebrew/opt/python@3.12/bin/pip3.12';
                 resolvedInput = resolvedInput
                     .replace(/^python3?\s/, `${py12} `)
-                    .replace(/^pip3?\s/, `${pip12} `);
-                if (resolvedInput === 'python3' || resolvedInput === 'python')
-                    resolvedInput = py12;
-                if (resolvedInput === 'pip3' || resolvedInput === 'pip')
-                    resolvedInput = pip12;
+                    .replace(/^(python3|python)$/, py12);
             }
-            // Route to Docker sandbox if available, otherwise system shell
+            // Ensure workspace directory
+            const cwd = ensureWorkspace();
+            // Route to Docker sandbox if available, otherwise system shell (in workspace)
             processing = true;
             try {
                 if (isDockerAvailable()) {
@@ -215,11 +240,11 @@ export async function startRepl(program, resumeMode) {
                         await runInSandbox(resolvedInput, rl);
                     }
                     else {
-                        await runSystemCommand(resolvedInput, rl);
+                        await runSystemCommand(resolvedInput, rl, cwd);
                     }
                 }
                 else {
-                    await runSystemCommand(resolvedInput, rl);
+                    await runSystemCommand(resolvedInput, rl, cwd);
                 }
             }
             catch {
@@ -264,13 +289,13 @@ export async function startRepl(program, resumeMode) {
         realExit(0);
     });
 }
-function runSystemCommand(input, rl) {
+function runSystemCommand(input, rl, cwd) {
     return new Promise((resolve) => {
-        // Pause readline so the child process gets full terminal control
         rl.pause();
         const child = spawn(input, {
             shell: true,
             stdio: 'inherit',
+            cwd: cwd || process.cwd(),
         });
         child.on('close', () => {
             rl.resume();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "1.9.1",
+  "version": "2.0.0",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {