fix: the application uses http (not https) for all t... in AcodeX.js

[anupamme]

Summary

Fix high severity security issue in src/AcodeX.js.

Vulnerability

Field	Value
ID	V-002
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-002
File	src/AcodeX.js:1847
Assessment	Likely exploitable
Chain Complexity	2-step

Description: The application uses HTTP (not HTTPS) for all terminal server communication. Fetch calls explicitly use http:// protocol instead of https:// or wss:// for WebSocket connections. This allows attackers on the same network or with MITM position to intercept, read, and modify all terminal traffic including commands, outputs, and authentication data.

Evidence

Exploitation scenario: An attacker positioned on the network path (e.g., compromised router, ISP-level access, shared WiFi) can: (1) Intercept HTTP traffic between client and terminal server, (2) Read terminal commands.

Scanner confirmation: multi_agent_ai rule V-002 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/AcodeX.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

Automated security fix by OrbisAI Security