icoa-cli 2.1.8 → 2.2.0

package/dist/commands/env.js

@@ -289,6 +289,16 @@ function showStatus() {
         console.log(chalk.gray('  Then run icoa inside WSL for 100% tool compatibility'));
     }
     console.log(chalk.gray('  ─────────────────────────────────────────────'));
+    // Node.js version check
+    const nodeVer = process.versions.node;
+    const nodeMajor = parseInt(nodeVer.split('.')[0]);
+    if (nodeMajor >= 20) {
+        console.log(chalk.green(`  ✓ Node.js ${nodeVer}`));
+    }
+    else {
+        console.log(chalk.red(`  ✗ Node.js ${nodeVer}`) + chalk.gray(' (v20+ required)'));
+        console.log(chalk.gray('    Upgrade: https://nodejs.org/ or nvm install 22'));
+    }
     // Python version check
     const pyVer = getPythonMajorMinor();
     const fullVer = getPythonFullVersion();

package/dist/index.js

@@ -36,7 +36,7 @@ ${LINE}
    ${chalk.white('Sydney, Australia')}  ${chalk.gray('Jun 27 - Jul 2, 2026')}
    ${chalk.cyan.underline('https://icoa2026.au')}
 
-   ${chalk.gray('CLI-Native Competition Terminal  v2.1.8')}
+   ${chalk.gray('CLI-Native Competition Terminal  v2.2.0')}
 
 ${LINE}
 `;

package/dist/repl.js

@@ -27,7 +27,7 @@ const BLOCKED_COMMANDS = new Set([
     'iptables', 'ufw', // firewall
 ]);
 const INTERCEPT = '__REPL_NO_EXIT__';
-const VERSION = '2.1.8';
+const VERSION = '2.2.0';
 export async function startRepl(program, resumeMode) {
     const config = getConfig();
     const connected = isConnected();
@@ -222,6 +222,19 @@ export async function startRepl(program, resumeMode) {
                 rl.prompt();
                 return;
             }
+            // Block path escape attempts
+            if (/(?:^|\s)(?:\/(?!home\/|Users\/|tmp\/)|\.\.\/|~\/)/.test(input) && !input.startsWith('cd ')) {
+                // Allow relative paths within workspace, block absolute paths outside
+                const hasAbsPath = /(?:^|\s)\/(?!home\/\w+\/icoa-workspace|Users\/\w+\/icoa-workspace|tmp\/)/.test(input);
+                const hasParentPath = /\.\./.test(input);
+                if (hasAbsPath || hasParentPath) {
+                    console.log(chalk.red('  Blocked: access outside workspace is not allowed.'));
+                    console.log(chalk.gray(`  Workspace: ${WORKSPACE}`));
+                    console.log();
+                    rl.prompt();
+                    return;
+                }
+            }
             // Force Python 3.12 — rewrite python/python3 to correct binary
             let resolvedInput = input;
             if (process.platform === 'darwin') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.1.8",
+  "version": "2.2.0",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {