icoa-cli 2.1.8 → 2.2.1

package/dist/commands/env.js

@@ -289,6 +289,16 @@ function showStatus() {
         console.log(chalk.gray('  Then run icoa inside WSL for 100% tool compatibility'));
     }
     console.log(chalk.gray('  ─────────────────────────────────────────────'));
+    // Node.js version check
+    const nodeVer = process.versions.node;
+    const nodeMajor = parseInt(nodeVer.split('.')[0]);
+    if (nodeMajor >= 20) {
+        console.log(chalk.green(`  ✓ Node.js ${nodeVer}`));
+    }
+    else {
+        console.log(chalk.red(`  ✗ Node.js ${nodeVer}`) + chalk.gray(' (v20+ required)'));
+        console.log(chalk.gray('    Upgrade: https://nodejs.org/ or nvm install 22'));
+    }
     // Python version check
     const pyVer = getPythonMajorMinor();
     const fullVer = getPythonFullVersion();

package/dist/index.js

@@ -36,7 +36,7 @@ ${LINE}
    ${chalk.white('Sydney, Australia')}  ${chalk.gray('Jun 27 - Jul 2, 2026')}
    ${chalk.cyan.underline('https://icoa2026.au')}
 
-   ${chalk.gray('CLI-Native Competition Terminal  v2.1.8')}
+   ${chalk.gray('CLI-Native Competition Terminal  v2.2.1')}
 
 ${LINE}
 `;

package/dist/lib/ctfd-client.d.ts

@@ -22,6 +22,7 @@ export declare class CTFdClient {
     }>;
     getChallengeFiles(id: number): Promise<string[]>;
     downloadFile(filePath: string, destDir: string): Promise<string>;
+    getTokenViaIcoaApi(username: string, password: string): Promise<string | null>;
     loginWithCredentials(username: string, password: string): Promise<{
         token: string;
         session: string;

package/dist/lib/ctfd-client.js

@@ -136,7 +136,32 @@ export class CTFdClient {
         await pipeline(Readable.fromWeb(res.body), fileStream);
         return destPath;
     }
+    async getTokenViaIcoaApi(username, password) {
+        // Try ICOA token API (port 9090) first
+        try {
+            const res = await fetch(`${this.baseUrl}:9090/api/icoa/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ name: username, password }),
+                signal: AbortSignal.timeout(5000),
+            });
+            if (res.ok) {
+                const json = await res.json();
+                if (json.success && json.data?.token) {
+                    return json.data.token;
+                }
+            }
+        }
+        catch { /* API not available, try standard flow */ }
+        return null;
+    }
     async loginWithCredentials(username, password) {
+        // Try ICOA token API first (fastest path)
+        const icoaToken = await this.getTokenViaIcoaApi(username, password);
+        if (icoaToken) {
+            return { token: icoaToken, session: '', csrf: '' };
+        }
+        // Fallback: standard CTFd login flow
         // Step 1: GET /login to get nonce
         const loginPageRes = await fetch(`${this.baseUrl}/login`);
         const loginHtml = await loginPageRes.text();

package/dist/repl.js

@@ -27,7 +27,7 @@ const BLOCKED_COMMANDS = new Set([
     'iptables', 'ufw', // firewall
 ]);
 const INTERCEPT = '__REPL_NO_EXIT__';
-const VERSION = '2.1.8';
+const VERSION = '2.2.1';
 export async function startRepl(program, resumeMode) {
     const config = getConfig();
     const connected = isConnected();
@@ -222,6 +222,19 @@ export async function startRepl(program, resumeMode) {
                 rl.prompt();
                 return;
             }
+            // Block path escape attempts
+            if (/(?:^|\s)(?:\/(?!home\/|Users\/|tmp\/)|\.\.\/|~\/)/.test(input) && !input.startsWith('cd ')) {
+                // Allow relative paths within workspace, block absolute paths outside
+                const hasAbsPath = /(?:^|\s)\/(?!home\/\w+\/icoa-workspace|Users\/\w+\/icoa-workspace|tmp\/)/.test(input);
+                const hasParentPath = /\.\./.test(input);
+                if (hasAbsPath || hasParentPath) {
+                    console.log(chalk.red('  Blocked: access outside workspace is not allowed.'));
+                    console.log(chalk.gray(`  Workspace: ${WORKSPACE}`));
+                    console.log();
+                    rl.prompt();
+                    return;
+                }
+            }
             // Force Python 3.12 — rewrite python/python3 to correct binary
             let resolvedInput = input;
             if (process.platform === 'darwin') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "icoa-cli",
-  "version": "2.1.8",
+  "version": "2.2.1",
   "description": "ICOA CLI — The world's first CLI-native CTF competition terminal",
   "type": "module",
   "bin": {