Season 4 Secure Code Game by jkcso · Pull Request #188 · skills/secure-code-game

jkcso · 2026-04-12T17:31:17Z

This PR merges Season 4 of the Secure Code Game.

# Conflicts: # .devcontainer/devcontainer.json

- Replace structured JSON actions with bash command execution - Add lib/bash.js: command validation (denylist, path confinement) + executor - Add y/n confirmation before each command runs - Sandbox all operations to Level-1/prodbot-activities/ - Remove obsolete code: code.spec.js, .utils/utils.js, actions.js - Remove chat:Level-1 npm script

- Delete .gitkeep (prodbot.js auto-creates sandbox on startup) - Add Season-4/Level-1/prodbot-activities/ to .gitignore - Add JSDoc and inline comments to bash.js, ai.js, prodbot.js explaining security concepts, REPL flow, and API integration

- Add password.txt with flag BYPA55ED in realistic credential format - Add hint-1.txt: read the validator code, spot the regex weakness - Add hint-2.txt: base64 encoding can hide paths from regex - Add hint-3.txt: bash variables bypass the .. regex check - Add solution.txt: full walkthrough of both bypasses - Add flag detection in prodbot.js: congrats banner on successful escape

- Rebuild congrats banner with pad() function for consistent right border - Replace em-dash with hyphen in all box headers (em-dash is double-width) - Fix hint-1/2/3 header box widths to be consistent - Suppress punycode DEP0040 deprecation warning from openai package

- Switch welcome box to magentaBright/greenBright for vivid borders - Switch congrats banner to bright variants (greenBright, yellowBright, etc.) - Update help, prompt, and goodbye to use bright colors

- banner.js: cyanBright, #FF00FF, greenBright, whiteBright - ai.js: redBright for errors - prodbot.js: yellowBright, cyanBright, redBright, greenBright

- Replace execSync with a long-lived bash process (PersistentShell class) - Shell state (variables, cwd) persists between commands like a real terminal - Use marker-based output delimiting to capture command results - Block 'exec' command to prevent shell replacement - No timeout on commands (players can take their time reading hints) - Shell auto-respawns if it crashes - Opens a third bypass path: set D=.. in one command, use it in the next

- Hint 2: now covers variable assignment regex gap - Hint 3: now covers base64 encoding approach - Solution: Bypass 1 is env var, Bypass 2 is base64

… data lesson - Remove 'Execute? (y/n)' references from solution.txt - Add split-command note for D=.. bypass in solution - Move showCongrats to bottom of prodbot.js (away from player's view) - Reword secure alternative 1: business-objective-aware framing - Add secure alternative 4: never store sensitive data in reachable paths

- Block ~ references (expands to $HOME at runtime) - Block bare 'cd' (defaults to $HOME) - Intended bypasses (env var, base64) still work

…th Season 4 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Add dividers between all sections for visual consistency - Wrap Example in blockquote for visual distinction - Remove bullet from Additional Information paragraph Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Secure Coding track (Seasons 1 & 2): existing proposal/PR flow preserved - AI track (Seasons 3, 4 & beyond): invites contributions extending ProdBot towards Season 5 - Same emojis as main README (🛡️ Secure Coding, 🤖 AI) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ents.txt - AI section now appears first to reflect current focus - Changed 'described above' to 'described below' since PR process follows - Added comment to requirements.txt explaining it serves Seasons 1 & 2 via postCreateCommand Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- 'How to contribute' with steps 1-3 now applies to both tracks - AI and Secure Coding sections describe only their focus areas - Removed JS-specific file list from PR step (generalised to all tracks) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The symlink used /workspaces/secure-code-game/ which breaks when users create a repo from the template with a different name. Now uses $(pwd) to resolve the correct workspace path dynamically. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The newer Ubuntu base image blocks system-wide pip installs. Add --break-system-packages flag since this is a disposable Codespace container. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add onConsoleLog returning false to suppress the source location annotations (❯ file:line) that vitest adds to every console.log, so congratulations and error messages display cleanly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Set vitest.logLevel to error to prevent the Collecting/Skipping debug noise when running tests via the VS Code play button. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Pass descriptive messages to assert.fail() so the VS Code Test Results panel shows the LLM model response on failure and meaningful error text instead of a bare AssertionError - Revert onConsoleLog suppression from vitest.config.js so console output flows through to terminal and Test Results panel - Applied consistently across all 6 levels Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Move all failure output (model response, error messages, hints) into assert.fail() messages which vitest renders cleanly without stdout/stderr block headers and file:line annotations. Consolidate success output into a single console.log. Remove unused error/warn imports from all levels. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>