claude-cac 1.1.5 → 1.1.7

package/cac

@@ -10,7 +10,7 @@ VERSIONS_DIR="$CAC_DIR/versions"
 # ━━━ utils.sh ━━━
 # ── utils: 颜色、读写、UUID、proxy 解析 ───────────────────────
 
-CAC_VERSION="1.1.5"
+CAC_VERSION="1.1.7"
 
 _read()   { [[ -f "$1" ]] && tr -d '[:space:]' < "$1" || echo "${2:-}"; }
 _die()    { printf '%b\n' "$(_red "error:") $*" >&2; exit 1; }
@@ -1195,20 +1195,20 @@ _ensure_initialized() {
     mkdir -p "$CAC_DIR" "$ENVS_DIR" "$VERSIONS_DIR"
 
     # Always sync JS hooks + dns-guard (they update with cac versions)
-    # Resolve symlink — npm global install creates: .nvm/.../bin/cac → ../lib/node_modules/claude-cac/cac
-    local _self_path="${BASH_SOURCE[0]:-$0}"
-    # $0 may be just "cac" (no path) when invoked via PATH — resolve it
-    if [[ "$_self_path" != /* ]]; then
-        _self_path="$(command -v "$_self_path" 2>/dev/null || which "$_self_path" 2>/dev/null || echo "$_self_path")"
-    fi
-    # Follow symlink to real package directory
-    if [[ -L "$_self_path" ]]; then
-        local _link; _link="$(readlink "$_self_path")"
-        [[ "$_link" != /* ]] && _link="$(dirname "$_self_path")/$_link"
-        _self_path="$_link"
-    fi
-    local _self_dir
-    _self_dir="$(cd "$(dirname "$_self_path")" && pwd)"
+    # Find the real package directory — npm creates symlinks:
+    #   ~/.nvm/.../bin/cac → ../lib/node_modules/claude-cac/cac
+    # relay.js and fingerprint-hook.js live alongside the real cac script
+    local _self_dir=""
+    local _cac_bin; _cac_bin="$(command -v cac 2>/dev/null || true)"
+    if [[ -n "$_cac_bin" ]] && [[ -L "$_cac_bin" ]]; then
+        local _link; _link="$(readlink "$_cac_bin")"
+        [[ "$_link" != /* ]] && _link="$(dirname "$_cac_bin")/$_link"
+        _self_dir="$(cd "$(dirname "$_link")" && pwd)"
+    fi
+    # Fallback: directory of the running script
+    if [[ -z "$_self_dir" ]] || [[ ! -f "$_self_dir/relay.js" ]]; then
+        _self_dir="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
+    fi
     [[ -f "$_self_dir/fingerprint-hook.js" ]] && cp "$_self_dir/fingerprint-hook.js" "$CAC_DIR/fingerprint-hook.js"
     [[ -f "$_self_dir/relay.js" ]] && cp "$_self_dir/relay.js" "$CAC_DIR/relay.js"
     _write_dns_guard_js 2>/dev/null || true
@@ -1694,16 +1694,16 @@ cmd_relay() {
 # ━━━ cmd_check.sh ━━━
 # ── cmd: check ─────────────────────────────────────────────────
 
-# 检测本地代理软件冲突（Clash / Surge / Shadowrocket 等）
+# 检测本地代理软件冲突
 _check_proxy_conflict() {
-    local proxy="$1" proxy_ip="$2"
+    local proxy="$1" proxy_ip="$2" verbose="$3"
     local proxy_hp; proxy_hp=$(_proxy_host_port "$proxy")
     local proxy_host="${proxy_hp%%:*}"
 
     local os; os=$(_detect_os)
     local conflicts=()
 
-    # ── 1. 检测 TUN 模式进程 ──
+    # 检测 TUN 模式进程
     local tun_procs="clash|mihomo|sing-box|surge|shadowrocket|v2ray|xray|hysteria|tuic|nekoray"
     local running
     if [[ "$os" == "macos" ]]; then
@@ -1711,29 +1711,22 @@ _check_proxy_conflict() {
     else
         running=$(ps -eo comm 2>/dev/null | grep -iE "$tun_procs" || true)
     fi
-
     if [[ -n "$running" ]]; then
         local proc_names
         proc_names=$(echo "$running" | grep -ioE "$tun_procs" | sort -u | head -3)
-        if [[ -n "$proc_names" ]]; then
-            conflicts+=("检测到本地代理进程: $(echo "$proc_names" | tr '\n' ' ')")
-        fi
+        [[ -n "$proc_names" ]] && conflicts+=("本地代理进程: $(echo "$proc_names" | tr '\n' ' ')")
     fi
 
-    # ── 2. 检测 TUN 网卡（utun / tun）──
+    # 检测 TUN 网卡
     if [[ "$os" == "macos" ]]; then
         local tun_count
         tun_count=$(ifconfig 2>/dev/null | grep -cE '^utun[0-9]+' || echo 0)
-        if [[ "$tun_count" -gt 3 ]]; then
-            conflicts+=("检测到多个 TUN 网卡 (${tun_count} 个)，可能有代理软件启用了 TUN 模式")
-        fi
+        [[ "$tun_count" -gt 3 ]] && conflicts+=("TUN 网卡 ${tun_count} 个")
     elif [[ "$os" == "linux" ]]; then
-        if ip link show tun0 >/dev/null 2>&1; then
-            conflicts+=("检测到 tun0 网卡，可能有代理软件启用了 TUN 模式")
-        fi
+        ip link show tun0 >/dev/null 2>&1 && conflicts+=("检测到 tun0")
     fi
 
-    # ── 3. 检测系统代理是否指向本机（macOS）──
+    # 检测系统代理（macOS）
     if [[ "$os" == "macos" ]]; then
         local net_service
         net_service=$(networksetup -listallnetworkservices 2>/dev/null | grep -iE 'Wi-Fi|Ethernet|以太网' | head -1 || true)
@@ -1741,172 +1734,170 @@ _check_proxy_conflict() {
             local sys_http_proxy
             sys_http_proxy=$(networksetup -getwebproxy "$net_service" 2>/dev/null || true)
             if echo "$sys_http_proxy" | grep -qi "Enabled: Yes"; then
-                local sys_host sys_port
-                sys_host=$(echo "$sys_http_proxy" | awk '/^Server:/{print $2}')
-                sys_port=$(echo "$sys_http_proxy" | awk '/^Port:/{print $2}')
-                [[ -n "$sys_host" ]] && conflicts+=("系统 HTTP 代理已开启: ${sys_host}:${sys_port}")
+                local sys_host; sys_host=$(echo "$sys_http_proxy" | awk '/^Server:/{print $2}')
+                local sys_port; sys_port=$(echo "$sys_http_proxy" | awk '/^Port:/{print $2}')
+                [[ -n "$sys_host" ]] && conflicts+=("系统代理: ${sys_host}:${sys_port}")
             fi
         fi
     fi
 
-    # ── 4. 检测代理流量是否被二次转发（复用已获取的 proxy_ip）──
+    # 检测双重代理
     local direct_ip
     direct_ip=$(curl -s --noproxy '*' --connect-timeout 5 https://api.ipify.org 2>/dev/null || true)
     if [[ -n "$direct_ip" ]] && [[ -n "$proxy_ip" ]] && [[ "$direct_ip" == "$proxy_ip" ]]; then
-        conflicts+=("代理出口 IP ($proxy_ip) 与直连出口 IP 相同，代理流量可能被本地软件拦截")
+        conflicts+=("出口 IP 与直连相同，可能被拦截")
     fi
 
-    # ── 输出结果 ──
+    # 无冲突
     if [[ ${#conflicts[@]} -eq 0 ]]; then
-        echo "$(_green "✓") 未检测到代理冲突"
         return 0
     fi
 
-    echo "$(_yellow "检测到本地代理软件")："
-    for msg in "${conflicts[@]}"; do
-        echo "    $(_dim "•") $msg"
-    done
-
-    # 验证 relay 能否实际绕过
+    # 验证 relay 能否绕过
+    local relay_ok=false
     if _relay_is_running 2>/dev/null; then
         local rport; rport=$(_read "$CAC_DIR/relay.port" "")
         local relay_ip
         relay_ip=$(curl -s --proxy "http://127.0.0.1:$rport" --connect-timeout 8 https://api.ipify.org 2>/dev/null || true)
-        if [[ -n "$relay_ip" ]]; then
-            echo "    $(_green "→") relay 已启动并连通 (出口: $(_cyan "$relay_ip"))，冲突已自动绕过"
-            return 0
-        fi
-    fi
-
-    # relay 未运行，尝试启动测试
-    if [[ -f "$CAC_DIR/relay.js" ]]; then
+        [[ -n "$relay_ip" ]] && relay_ok=true
+    elif [[ -f "$CAC_DIR/relay.js" ]]; then
         local _test_env; _test_env=$(_current_env)
         if _relay_start "$_test_env" 2>/dev/null; then
             local rport; rport=$(_read "$CAC_DIR/relay.port" "")
             local relay_ip
             relay_ip=$(curl -s --proxy "http://127.0.0.1:$rport" --connect-timeout 8 https://api.ipify.org 2>/dev/null || true)
             _relay_stop 2>/dev/null || true
-            if [[ -n "$relay_ip" ]]; then
-                echo "    $(_green "→") relay 测试连通 (出口: $(_cyan "$relay_ip"))，claude 启动时会自动绕过"
-                return 0
-            fi
+            [[ -n "$relay_ip" ]] && relay_ok=true
         fi
     fi
 
-    # relay 也不行，给手动方案
-    echo "    $(_yellow "→") relay 无法绕过此冲突，需手动处理："
-    echo "    在本地代理软件中为代理服务器 IP 添加 DIRECT 规则"
-    echo "    代理服务器：$(_bold "$proxy_host")"
+    if [[ "$relay_ok" == "true" ]]; then
+        echo "$(_green "✓") relay 自动绕过"
+        if [[ "$verbose" == "true" ]]; then
+            for msg in "${conflicts[@]}"; do
+                echo "    $(_dim "$msg")"
+            done
+        fi
+        return 0
+    fi
+
+    # relay 失败
+    echo "$(_red "✗") 代理冲突，需手动处理"
+    for msg in "${conflicts[@]}"; do
+        echo "    $(_yellow "•") $msg"
+    done
+    echo "    解决：在代理软件中为 $(_bold "$proxy_host") 添加 DIRECT 规则"
     return 1
 }
 
 cmd_check() {
     _require_setup
 
+    local verbose=false
+    [[ "${1:-}" == "-d" || "${1:-}" == "--detail" ]] && verbose=true
+
     local current; current=$(_current_env)
 
     if [[ -f "$CAC_DIR/stopped" ]]; then
-        echo "$(_yellow "⚠ cac 已停用（cac stop）") — claude 裸跑中"
-        echo "  恢复：cac ${current:-<name>}"
+        echo "$(_yellow "⚠") cac 已停用 — 运行 'cac <name>' 恢复"
         return
     fi
-
     if [[ -z "$current" ]]; then
         echo "错误：未激活任何环境，运行 'cac <name>'" >&2; exit 1
     fi
 
     local env_dir="$ENVS_DIR/$current"
     local proxy; proxy=$(_read "$env_dir/proxy" "")
+    local ver; ver=$(_read "$env_dir/version" "system")
 
-    echo "当前环境：$(_bold "$current")"
-    echo "  代理      ：${proxy:-（无代理）}"
-    echo "  UUID      ：$(_read "$env_dir/uuid")"
-    echo "  stable_id ：$(_read "$env_dir/stable_id")"
-    echo "  user_id   ：$(_read "$env_dir/user_id" "（旧环境，无此字段）")"
-    echo "  版本      ：$(_read "$env_dir/version" "system")"
-    echo "  TZ        ：$(_read "$env_dir/tz" "（未设置）")"
-    echo "  LANG      ：$(_read "$env_dir/lang" "（未设置）")"
-    echo
+    # ── 基本信息 ──
+    echo "$(_bold "$current") (claude: $(_cyan "$ver"))"
 
-    # ── 网络连通性（仅在有代理时检查）──
-    if [[ -n "$proxy" ]]; then
-        printf "  TCP 连通  ... "
-        if ! _proxy_reachable "$proxy"; then
-            echo "$(_red "✗ 不通")"; return
-        fi
-        echo "$(_green "✓")"
-
-        printf "  出口 IP   ... "
-        local proxy_ip
-        proxy_ip=$(curl -s --proxy "$proxy" \
-             --connect-timeout 8 https://api.ipify.org 2>/dev/null || true)
-        if [[ -n "$proxy_ip" ]]; then
-            echo "$(_green "$proxy_ip")"
-        else
-            echo "$(_yellow "获取失败")"
-        fi
-    else
-        echo "  $(_dim "（无代理，跳过网络检查）")"
+    if [[ "$verbose" == "true" ]]; then
+        echo "  UUID      : $(_read "$env_dir/uuid")"
+        echo "  stable_id : $(_read "$env_dir/stable_id")"
+        echo "  user_id   : $(_read "$env_dir/user_id" "—")"
+        echo "  TZ        : $(_read "$env_dir/tz" "—")"
+        echo "  LANG      : $(_read "$env_dir/lang" "—")"
     fi
 
-    # ── 本地代理冲突检测（仅在有代理时）──
+    # ── 网络 ──
+    local proxy_ip=""
     if [[ -n "$proxy" ]]; then
-        echo
-        echo "── 冲突检测 ────────────────────────────────────────────"
-        printf "  代理冲突  ... "
-        _check_proxy_conflict "$proxy" "${proxy_ip:-}"
-    fi
+        printf "  代理      : "
+        if ! _proxy_reachable "$proxy"; then
+            echo "$(_red "✗ 不通") ($proxy)"
+            return
+        fi
+        proxy_ip=$(curl -s --proxy "$proxy" --connect-timeout 8 https://api.ipify.org 2>/dev/null || true)
+        echo "$(_green "✓") ${proxy_ip:-?} $(_dim "via ${proxy%%@*}@...")"
 
-    echo
-    echo "── Relay 中转 ────────────────────────────────────────"
-    if _relay_is_running; then
-        local rpid; rpid=$(_read "$CAC_DIR/relay.pid")
-        local rport; rport=$(_read "$CAC_DIR/relay.port" "未知")
-        echo "  Relay     ... $(_green "运行中") (PID=$rpid, 端口=$rport)"
-    elif [[ -n "$proxy" ]]; then
-        echo "  Relay     ... $(_dim "未运行（claude 启动时按需自动启用）")"
+        # 冲突检测
+        printf "  冲突检测  : "
+        _check_proxy_conflict "$proxy" "${proxy_ip:-}" "$verbose"
     else
-        echo "  Relay     ... $(_dim "（无代理，不需要）")"
+        echo "  代理      : $(_dim "无（API Key 模式）")"
     fi
 
-    echo
-    echo "── 安全防护状态 ──────────────────────────────────────"
-
-    # ── NS 层级 DNS 拦截 ──
-    printf "  DNS 拦截  ... "
-    _check_dns_block "statsig.anthropic.com"
-
-    # ── 多层环境变量保护（单次读取 wrapper 文件）──
-    echo "  环境变量保护："
+    # ── 安全防护（简洁模式只显示计数）──
     local wrapper_file="$CAC_DIR/bin/claude"
     local wrapper_content=""
     [[ -f "$wrapper_file" ]] && wrapper_content=$(<"$wrapper_file")
     local env_vars=(
-        "CLAUDE_CODE_ENABLE_TELEMETRY"
-        "DO_NOT_TRACK"
-        "OTEL_SDK_DISABLED"
-        "OTEL_TRACES_EXPORTER"
-        "OTEL_METRICS_EXPORTER"
-        "OTEL_LOGS_EXPORTER"
-        "SENTRY_DSN"
-        "DISABLE_ERROR_REPORTING"
-        "DISABLE_BUG_COMMAND"
-        "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"
-        "TELEMETRY_DISABLED"
-        "DISABLE_TELEMETRY"
+        "CLAUDE_CODE_ENABLE_TELEMETRY" "DO_NOT_TRACK"
+        "OTEL_SDK_DISABLED" "OTEL_TRACES_EXPORTER" "OTEL_METRICS_EXPORTER" "OTEL_LOGS_EXPORTER"
+        "SENTRY_DSN" "DISABLE_ERROR_REPORTING" "DISABLE_BUG_COMMAND"
+        "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC" "TELEMETRY_DISABLED" "DISABLE_TELEMETRY"
     )
+    local env_ok=0 env_total=${#env_vars[@]}
     for var in "${env_vars[@]}"; do
-        printf "    %-32s" "$var"
-        if [[ "$wrapper_content" == *"$var"* ]]; then
-            echo "$(_green "✓ 已配置")"
-        else
-            echo "$(_red "✗ 未找到")"
-        fi
+        [[ "$wrapper_content" == *"$var"* ]] && (( env_ok++ )) || true
     done
 
-    # ── mTLS 证书 ──
-    printf "  mTLS 认证 ... "
-    _check_mtls "$env_dir"
+    # DNS 拦截
+    local dns_ok=false
+    if [[ -f "$CAC_DIR/cac-dns-guard.js" ]]; then
+        local dns_result
+        dns_result=$(node -e '
+            require(process.argv[1]);
+            var dns = require("dns");
+            dns.lookup(process.argv[2], function(err) {
+                process.stdout.write(err && (err.code === "ECONNREFUSED" || err.code === "ENOTFOUND") ? "BLOCKED" : "OPEN");
+            });
+        ' "$CAC_DIR/cac-dns-guard.js" "statsig.anthropic.com" 2>/dev/null || echo "ERROR")
+        [[ "$dns_result" == "BLOCKED" ]] && dns_ok=true
+    fi
+
+    # mTLS
+    local mtls_ok=false
+    local ca_cert="$CAC_DIR/ca/ca_cert.pem"
+    local client_cert="$env_dir/client_cert.pem"
+    [[ -f "$ca_cert" ]] && [[ -f "$client_cert" ]] && \
+        openssl verify -CAfile "$ca_cert" "$client_cert" >/dev/null 2>&1 && mtls_ok=true
+
+    if [[ "$verbose" == "true" ]]; then
+        printf "  DNS 拦截  : "
+        [[ "$dns_ok" == "true" ]] && echo "$(_green "✓")" || echo "$(_red "✗")"
+        echo "  遥测屏蔽  : ${env_ok}/${env_total} 环境变量"
+        for var in "${env_vars[@]}"; do
+            printf "    %-36s" "$var"
+            [[ "$wrapper_content" == *"$var"* ]] && echo "$(_green "✓")" || echo "$(_red "✗")"
+        done
+        printf "  mTLS      : "
+        [[ "$mtls_ok" == "true" ]] && echo "$(_green "✓")" || echo "$(_yellow "—")"
+    else
+        local checks=() fails=()
+        [[ "$dns_ok" == "true" ]] && checks+=("DNS 拦截") || fails+=("DNS 拦截")
+        [[ "$env_ok" -eq "$env_total" ]] && checks+=("遥测屏蔽 ${env_ok}/${env_total}") || fails+=("遥测屏蔽 ${env_ok}/${env_total}")
+        [[ "$mtls_ok" == "true" ]] && checks+=("mTLS") || true
+
+        printf "  防护      : "
+        if [[ ${#fails[@]} -eq 0 ]]; then
+            echo "$(_green "✓") $(IFS=', '; echo "${checks[*]}")"
+        else
+            echo "$(_yellow "⚠") $(IFS=', '; echo "${fails[*]}")"
+        fi
+    fi
 }
 
 # ━━━ cmd_stop.sh ━━━

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-cac",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Isolate, protect, and manage your Claude Code — versions, environments, identity, and proxy.",
   "bin": {
     "cac": "cac"