icoa-cli 2.1.7 → 2.2.0

package/dist/commands/env.js

@@ -289,6 +289,16 @@ function showStatus() {
         console.log(chalk.gray('  Then run icoa inside WSL for 100% tool compatibility'));
     }
     console.log(chalk.gray('  ─────────────────────────────────────────────'));
+    // Node.js version check
+    const nodeVer = process.versions.node;
+    const nodeMajor = parseInt(nodeVer.split('.')[0]);
+    if (nodeMajor >= 20) {
+        console.log(chalk.green(`  ✓ Node.js ${nodeVer}`));
+    }
+    else {
+        console.log(chalk.red(`  ✗ Node.js ${nodeVer}`) + chalk.gray(' (v20+ required)'));
+        console.log(chalk.gray('    Upgrade: https://nodejs.org/ or nvm install 22'));
+    }
     // Python version check
     const pyVer = getPythonMajorMinor();
     const fullVer = getPythonFullVersion();

package/dist/index.js

@@ -36,7 +36,7 @@ ${LINE}
    ${chalk.white('Sydney, Australia')}  ${chalk.gray('Jun 27 - Jul 2, 2026')}
    ${chalk.cyan.underline('https://icoa2026.au')}
 
-   ${chalk.gray('CLI-Native Competition Terminal  v2.1.7')}
+   ${chalk.gray('CLI-Native Competition Terminal  v2.2.0')}
 
 ${LINE}
 `;

package/dist/lib/ui.d.ts

@@ -4,7 +4,8 @@ export declare function printWarning(msg: string): void;
 export declare function printInfo(msg: string): void;
 export declare function printTable(headers: string[], rows: string[][]): void;
 export declare function printMarkdown(text: string): void;
-export declare function createSpinner(text: string): import("ora").Ora;
+export declare function setReplMode(enabled: boolean): void;
+export declare function createSpinner(text: string): any;
 export declare function formatCountdown(targetDate: Date): string;
 export declare function printHeader(title: string): void;
 export declare function printKeyValue(key: string, value: string): void;

package/dist/lib/ui.js

@@ -32,7 +32,23 @@ export function printMarkdown(text) {
         console.log(rendered);
     }
 }
+// In REPL mode, spinners conflict with readline — use simple log instead
+let replMode = false;
+export function setReplMode(enabled) { replMode = enabled; }
 export function createSpinner(text) {
+    if (replMode) {
+        // Fake spinner that just logs — no terminal cursor manipulation
+        const fake = {
+            text,
+            start() { console.log(chalk.cyan('  ' + text)); return fake; },
+            stop() { return fake; },
+            succeed(msg) { console.log(chalk.green('  ✓ ' + msg)); return fake; },
+            fail(msg) { console.log(chalk.red('  ✗ ' + msg)); return fake; },
+            info(msg) { console.log(chalk.blue('  ℹ ' + msg)); return fake; },
+            warn(msg) { console.log(chalk.yellow('  ⚠ ' + msg)); return fake; },
+        };
+        return fake;
+    }
     return ora({ text, color: 'cyan' });
 }
 export function formatCountdown(targetDate) {

package/dist/repl.js

@@ -3,6 +3,7 @@ import { spawn, execSync as execSyncFn } from 'node:child_process';
 import chalk from 'chalk';
 import { isConnected, getConfig } from './lib/config.js';
 import { isActivated, activateToken, isFreeCommand, isDeviceMatch, recordExit, recordResume, isFirstRunOrUpgrade, markVersionSeen } from './lib/access.js';
+import { setReplMode } from './lib/ui.js';
 import { resetTerminalTheme } from './lib/theme.js';
 import { ensureSandbox, runInSandbox, isDockerAvailable } from './lib/sandbox.js';
 import { logCommand } from './lib/logger.js';
@@ -26,7 +27,7 @@ const BLOCKED_COMMANDS = new Set([
     'iptables', 'ufw', // firewall
 ]);
 const INTERCEPT = '__REPL_NO_EXIT__';
-const VERSION = '2.1.7';
+const VERSION = '2.2.0';
 export async function startRepl(program, resumeMode) {
     const config = getConfig();
     const connected = isConnected();
@@ -137,6 +138,7 @@ export async function startRepl(program, resumeMode) {
         terminal: true,
     });
     let processing = false;
+    setReplMode(true);
     // Log sync disabled until server audit endpoint is configured
     // startLogSync();
     rl.prompt();
@@ -220,6 +222,19 @@ export async function startRepl(program, resumeMode) {
                 rl.prompt();
                 return;
             }
+            // Block path escape attempts
+            if (/(?:^|\s)(?:\/(?!home\/|Users\/|tmp\/)|\.\.\/|~\/)/.test(input) && !input.startsWith('cd ')) {
+                // Allow relative paths within workspace, block absolute paths outside
+                const hasAbsPath = /(?:^|\s)\/(?!home\/\w+\/icoa-workspace|Users\/\w+\/icoa-workspace|tmp\/)/.test(input);
+                const hasParentPath = /\.\./.test(input);
+                if (hasAbsPath || hasParentPath) {
+                    console.log(chalk.red('  Blocked: access outside workspace is not allowed.'));
+                    console.log(chalk.gray(`  Workspace: ${WORKSPACE}`));
+                    console.log();
+                    rl.prompt();
+                    return;
+                }
+            }
             // Force Python 3.12 — rewrite python/python3 to correct binary
             let resolvedInput = input;
             if (process.platform === 'darwin') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.1.7",
+  "version": "2.2.0",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {