claude-cac 1.2.0 → 1.3.0

package/cac

@@ -10,7 +10,8 @@ VERSIONS_DIR="$CAC_DIR/versions"
 # ━━━ utils.sh ━━━
 # ── utils: 颜色、读写、UUID、proxy 解析 ───────────────────────
 
-CAC_VERSION="1.2.0"
+# shellcheck disable=SC2034  # used in build-concatenated cac script
+CAC_VERSION="1.3.0"
 
 _read()   { [[ -f "$1" ]] && tr -d '[:space:]' < "$1" || echo "${2:-}"; }
 _die()    { printf '%b\n' "$(_red "error:") $*" >&2; exit 1; }
@@ -68,7 +69,7 @@ _parse_proxy() {
     host=$(echo "$raw" | cut -d: -f1)
     port=$(echo "$raw" | cut -d: -f2)
     user=$(echo "$raw" | cut -d: -f3)
-    pass=$(echo "$raw" | cut -d: -f4)
+    pass=$(echo "$raw" | cut -d: -f4-)
     if [[ -z "$user" ]]; then
         echo "http://${host}:${port}"
     else
@@ -103,7 +104,7 @@ _auto_detect_proxy() {
     host=$(echo "$raw" | cut -d: -f1)
     port=$(echo "$raw" | cut -d: -f2)
     user=$(echo "$raw" | cut -d: -f3)
-    pass=$(echo "$raw" | cut -d: -f4)
+    pass=$(echo "$raw" | cut -d: -f4-)
     if [[ -n "$user" ]]; then
         auth_part="${user}:${pass}@"
     else
@@ -134,6 +135,25 @@ _env_dir()      { echo "$ENVS_DIR/$1"; }
 
 # ── Version management helpers ────────────────────────────────────
 
+# Find the highest installed version by semver sort
+_update_latest() {
+    local highest=""
+    for d in "$VERSIONS_DIR"/*/; do
+        [[ -d "$d" ]] || continue
+        local v
+        v=$(basename "$d")
+        [[ "$v" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]] || continue
+        if [[ -z "$highest" ]] || [[ "$(printf '%s\n%s\n' "$highest" "$v" | sort -t. -k1,1n -k2,2n -k3,3n | tail -1)" == "$v" ]]; then
+            highest="$v"
+        fi
+    done
+    if [[ -n "$highest" ]]; then
+        echo "$highest" > "$VERSIONS_DIR/.latest"
+    else
+        rm -f "$VERSIONS_DIR/.latest"
+    fi
+}
+
 _resolve_version() {
     local v="$1"
     if [[ "$v" == "latest" || -z "$v" ]]; then
@@ -195,8 +215,8 @@ _ensure_version_installed() {
     if [[ ! -x "$(_version_binary "$ver")" ]]; then
         echo "Version $(_cyan "$ver") not installed, downloading ..." >&2
         mkdir -p "$VERSIONS_DIR"
-        _download_version "$ver" || return 1
-        echo "$ver" > "$VERSIONS_DIR/.latest"
+        _download_version "$ver" >&2 || return 1
+        _update_latest
         echo >&2
     fi
     echo "$ver"
@@ -245,15 +265,22 @@ _find_real_claude() {
 }
 
 _detect_rc_file() {
-    if [[ -f "$HOME/.zshrc" ]]; then
-        echo "$HOME/.zshrc"
-    elif [[ -f "$HOME/.bashrc" ]]; then
-        echo "$HOME/.bashrc"
-    elif [[ -f "$HOME/.bash_profile" ]]; then
-        echo "$HOME/.bash_profile"
-    else
-        echo ""
-    fi
+    local shell_name
+    shell_name=$(basename "${SHELL:-/bin/bash}")
+    case "$shell_name" in
+        zsh)
+            [[ -f "$HOME/.zshrc" ]] && { echo "$HOME/.zshrc"; return; }
+            ;;
+        bash)
+            [[ -f "$HOME/.bashrc" ]] && { echo "$HOME/.bashrc"; return; }
+            [[ -f "$HOME/.bash_profile" ]] && { echo "$HOME/.bash_profile"; return; }
+            ;;
+    esac
+    # Fallback: try common rc files
+    [[ -f "$HOME/.bashrc" ]] && { echo "$HOME/.bashrc"; return; }
+    [[ -f "$HOME/.zshrc" ]] && { echo "$HOME/.zshrc"; return; }
+    [[ -f "$HOME/.bash_profile" ]] && { echo "$HOME/.bash_profile"; return; }
+    echo ""
 }
 
 _install_method() {
@@ -292,13 +319,20 @@ _write_path_to_rc() {
         _remove_path_from_rc "$rc_file"
     fi
 
-    cat >> "$rc_file" << 'EOF'
+    cat >> "$rc_file" << 'CACEOF'
 
 # >>> cac — Claude Code Cloak >>>
-export PATH="$HOME/bin:$PATH"          # cac 命令
-export PATH="$HOME/.cac/bin:$PATH"     # claude wrapper
+PATH=$(echo "$PATH" | tr ':' '\n' | grep -v '\.cac/bin' | grep -v "$HOME/bin" | tr '\n' ':' | sed 's/:$//')
+export PATH="$HOME/.cac/bin:$HOME/bin:$PATH"
+cac() {
+    command "$HOME/bin/cac" "$@"
+    local _rc=$?
+    PATH=$(echo "$PATH" | tr ':' '\n' | grep -v '\.cac/bin' | tr '\n' ':' | sed 's/:$//')
+    export PATH="$HOME/.cac/bin:$HOME/bin:$PATH"
+    return $_rc
+}
 # <<< cac — Claude Code Cloak <<<
-EOF
+CACEOF
     echo "  ✓ PATH 已写入 $rc_file"
     return 0
 }
@@ -333,9 +367,13 @@ _update_statsig() {
     local config_dir="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
     local statsig="$config_dir/statsig"
     [[ -d "$statsig" ]] || return 0
+    local found=false
     for f in "$statsig"/statsig.stable_id.*; do
-        [[ -f "$f" ]] && printf '"%s"' "$sid" > "$f"
+        [[ -f "$f" ]] && { printf '"%s"' "$sid" > "$f"; found=true; }
     done
+    if [[ "$found" == "false" ]]; then
+        printf '"%s"' "$sid" > "$statsig/statsig.stable_id.local"
+    fi
 }
 
 _update_claude_json_user_id() {
@@ -345,11 +383,16 @@ _update_claude_json_user_id() {
     [[ -f "$claude_json" ]] || claude_json="$HOME/.claude.json"
     [[ -f "$claude_json" ]] || return 0
     python3 - "$claude_json" "$user_id" << 'PYEOF'
-import json, sys
+import json, sys, uuid
 fpath, uid = sys.argv[1], sys.argv[2]
 with open(fpath) as f:
     d = json.load(f)
 d['userID'] = uid
+d['anonymousId'] = 'claudecode.v1.' + str(uuid.uuid4())
+d.pop('numStartups', None)
+d.pop('firstStartTime', None)
+d.pop('cachedGrowthBookFeatures', None)
+d.pop('cachedStatsigGates', None)
 with open(fpath, 'w') as f:
     json.dump(d, f, indent=2, ensure_ascii=False)
 PYEOF
@@ -364,6 +407,7 @@ TELEMETRY_DOMAINS=(
     "statsig.anthropic.com"
     "sentry.io"
     "o1137031.ingest.sentry.io"
+    "cdn.growthbook.io"
 )
 
 # 写入 HOSTALIASES 文件（备用层：gethostbyname 级别拦截）
@@ -403,6 +447,7 @@ var BLOCKED_DOMAINS = new Set([
     'statsig.anthropic.com',
     'sentry.io',
     'o1137031.ingest.sentry.io',
+    'cdn.growthbook.io',
 ]);
 
 /**
@@ -877,7 +922,137 @@ _check_mtls() {
 }
 
 # ━━━ templates.sh ━━━
-# ── templates: 写入 wrapper 和 ioreg shim ──────────────────────
+# ── templates: 写入 wrapper、shim、环境初始化 ──────────────────
+
+# 写入 statusline-command.sh 到环境 .claude 目录
+_write_statusline_script() {
+    local config_dir="$1"
+    cat > "$config_dir/statusline-command.sh" << 'STATUSLINE_EOF'
+#!/usr/bin/env bash
+input=$(cat)
+
+model=$(echo "$input" | jq -r '.model.display_name // empty')
+cwd=$(echo "$input" | jq -r '.cwd // empty')
+version=$(echo "$input" | jq -r '.version // empty')
+session_name=$(echo "$input" | jq -r '.session_name // empty')
+
+used_pct=$(echo "$input" | jq -r '.context_window.used_percentage // empty')
+ctx_size=$(echo "$input" | jq -r '.context_window.context_window_size // empty')
+input_tokens=$(echo "$input" | jq -r '.context_window.current_usage.input_tokens // empty')
+
+five_pct=$(echo "$input" | jq -r '.rate_limits.five_hour.used_percentage // empty')
+week_pct=$(echo "$input" | jq -r '.rate_limits.seven_day.used_percentage // empty')
+five_reset=$(echo "$input" | jq -r '.rate_limits.five_hour.resets_at // empty')
+
+worktree_name=$(echo "$input" | jq -r '.worktree.name // empty')
+worktree_branch=$(echo "$input" | jq -r '.worktree.branch // empty')
+
+reset='\033[0m'; bold='\033[1m'; dim='\033[2m'
+cyan='\033[36m'; yellow='\033[33m'; green='\033[32m'; red='\033[31m'
+magenta='\033[35m'; blue='\033[34m'
+
+parts=()
+
+[ -n "$model" ] && parts+=("$(printf "${cyan}${bold}%s${reset}" "$model")")
+[ -n "$version" ] && parts+=("$(printf "${dim}v%s${reset}" "$version")")
+[ -n "$session_name" ] && parts+=("$(printf "${magenta}[%s]${reset}" "$session_name")")
+
+if [ -n "$cwd" ]; then
+  short_cwd="${cwd/#$HOME/~}"
+  parts+=("$(printf "${blue}%s${reset}" "$short_cwd")")
+fi
+
+if [ -n "$used_pct" ] && [ -n "$ctx_size" ]; then
+  ctx_int=$(printf "%.0f" "$used_pct")
+  if [ "$ctx_int" -ge 80 ]; then ctx_color="$red"
+  elif [ "$ctx_int" -ge 50 ]; then ctx_color="$yellow"
+  else ctx_color="$green"; fi
+  ctx_k=$(echo "$ctx_size" | awk '{printf "%.0fk", $1/1000}')
+  if [ -n "$input_tokens" ]; then
+    tokens_k=$(echo "$input_tokens" | awk '{printf "%.1fk", $1/1000}')
+    parts+=("$(printf "${ctx_color}ctx:%.0f%% %s/%s${reset}" "$used_pct" "${tokens_k}" "${ctx_k}")")
+  else
+    parts+=("$(printf "${ctx_color}ctx:%.0f%% (%s)${reset}" "$used_pct" "${ctx_k}")")
+  fi
+fi
+
+rate_parts=()
+if [ -n "$five_pct" ]; then
+  five_int=$(printf "%.0f" "$five_pct")
+  if [ "$five_int" -ge 80 ]; then rc="$red"
+  elif [ "$five_int" -ge 50 ]; then rc="$yellow"
+  else rc="$green"; fi
+  rs="$(printf "${rc}5h:%.0f%%${reset}" "$five_pct")"
+  if [ -n "$five_reset" ] && [ "$five_int" -ge 50 ]; then
+    rm=$(( (five_reset - $(date +%s)) / 60 ))
+    [ "$rm" -gt 0 ] && rs="$rs$(printf "${dim}(${rm}m)${reset}")"
+  fi
+  rate_parts+=("$rs")
+fi
+if [ -n "$week_pct" ]; then
+  week_int=$(printf "%.0f" "$week_pct")
+  if [ "$week_int" -ge 80 ]; then wc="$red"
+  elif [ "$week_int" -ge 50 ]; then wc="$yellow"
+  else wc="$green"; fi
+  rate_parts+=("$(printf "${wc}7d:%.0f%%${reset}" "$week_pct")")
+fi
+if [ "${#rate_parts[@]}" -gt 0 ]; then
+  rstr="${rate_parts[0]}"
+  for i in "${rate_parts[@]:1}"; do rstr="$rstr $i"; done
+  parts+=("$rstr")
+fi
+
+if [ -n "$worktree_name" ]; then
+  wt="wt:$worktree_name"
+  [ -n "$worktree_branch" ] && wt="$wt($worktree_branch)"
+  parts+=("$(printf "${cyan}%s${reset}" "$wt")")
+fi
+
+if [ "${#parts[@]}" -eq 0 ]; then printf "${dim}claude${reset}\n"; exit 0; fi
+sep="$(printf " ${dim}|${reset} ")"
+result="${parts[0]}"
+for p in "${parts[@]:1}"; do result="$result$sep$p"; done
+printf "%b\n" "$result"
+STATUSLINE_EOF
+    chmod +x "$config_dir/statusline-command.sh"
+}
+
+# 写入 settings.json 到环境 .claude 目录
+_write_env_settings() {
+    local config_dir="$1"
+    cat > "$config_dir/settings.json" << 'SETTINGS_EOF'
+{
+  "permissions": {
+    "defaultMode": "bypassPermissions"
+  },
+  "skipDangerousModePermissionPrompt": true,
+  "statusLine": {
+    "type": "command",
+    "command": "bash $CLAUDE_CONFIG_DIR/statusline-command.sh"
+  }
+}
+SETTINGS_EOF
+}
+
+# 写入 CLAUDE.md 到环境 .claude 目录
+_write_env_claude_md() {
+    local config_dir="$1"
+    local env_name="$2"
+    cat > "$config_dir/CLAUDE.md" << CLAUDEMD_EOF
+# cac managed environment
+
+This Claude Code instance is managed by **cac** (Claude Code Cloak).
+
+- Environment name: \`$env_name\`
+- Config directory: \`CLAUDE_CONFIG_DIR\` is set to this \`.claude/\` folder
+- Your settings, credentials, and sessions are isolated per-environment
+
+Useful commands:
+- \`cac env ls\` — list all environments and their config paths
+- \`cac env check\` — verify current environment health
+- \`cac <name>\` — switch to another environment
+CLAUDEMD_EOF
+}
 
 _write_wrapper() {
     mkdir -p "$CAC_DIR/bin"
@@ -906,6 +1081,8 @@ _env_dir="$ENVS_DIR/$_name"
 # Isolated .claude config directory
 if [[ -d "$_env_dir/.claude" ]]; then
     export CLAUDE_CONFIG_DIR="$_env_dir/.claude"
+    # 确保 settings.json 存在，阻止 Claude Code fallback 到 ~/.claude/settings.json
+    [[ -f "$_env_dir/.claude/settings.json" ]] || echo '{}' > "$_env_dir/.claude/settings.json"
 fi
 
 # Proxy — optional: only if proxy file exists and is non-empty
@@ -930,9 +1107,13 @@ fi
 if [[ -f "$_env_dir/stable_id" ]]; then
     _sid=$(tr -d '[:space:]' < "$_env_dir/stable_id")
     _config_dir="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
-    for _f in "$_config_dir/statsig"/statsig.stable_id.*; do
-        [[ -f "$_f" ]] && printf '"%s"' "$_sid" > "$_f"
-    done
+    if [[ -d "$_config_dir/statsig" ]]; then
+        _sid_found=false
+        for _f in "$_config_dir/statsig"/statsig.stable_id.*; do
+            [[ -f "$_f" ]] && { printf '"%s"' "$_sid" > "$_f"; _sid_found=true; }
+        done
+        [[ "$_sid_found" == "false" ]] && printf '"%s"' "$_sid" > "$_config_dir/statsig/statsig.stable_id.local"
+    fi
 fi
 
 # 注入环境变量 —— 代理（仅在配置了代理时）
@@ -1214,6 +1395,13 @@ _ensure_initialized() {
     _write_dns_guard_js 2>/dev/null || true
     _write_blocked_hosts 2>/dev/null || true
 
+    # PATH (idempotent — always ensure it's in rc file)
+    local rc_file; rc_file=$(_detect_rc_file)
+    _write_path_to_rc "$rc_file" >/dev/null 2>&1 || true
+
+    # Keep .latest pointing to highest installed version
+    _update_latest 2>/dev/null || true
+
     # Rest only needed on first init
     [[ -f "$CAC_DIR/bin/claude" ]] && return 0
 
@@ -1244,10 +1432,6 @@ _ensure_initialized() {
 
     # mTLS CA
     _generate_ca_cert 2>/dev/null || true
-
-    # PATH (idempotent)
-    local rc_file; rc_file=$(_detect_rc_file)
-    _write_path_to_rc "$rc_file" >/dev/null 2>&1 || true
 }
 
 # Explicit setup command — runs initialization with verbose output
@@ -1305,7 +1489,7 @@ _env_cmd_create() {
         esac
     done
 
-    [[ -n "$name" ]] || _die "usage: cac env create <name> [-p <proxy>] [-c <version>] [--type local|container]"
+    [[ -n "$name" ]] || _die "usage: cac env create <name> [-p <proxy>] [-c <version>]"
     [[ "$name" =~ ^[a-zA-Z0-9_-]+$ ]] || _die "invalid name '$name' (use alphanumeric, dash, underscore)"
 
     local env_dir="$ENVS_DIR/$name"
@@ -1314,15 +1498,15 @@ _env_cmd_create() {
     _timer_start
 
     # Auto-install version (just-in-time, like uv)
-    if [[ -n "$claude_ver" ]]; then
-        claude_ver=$(_ensure_version_installed "$claude_ver") || exit 1
-    fi
+    # No version specified → use latest
+    [[ -z "$claude_ver" ]] && claude_ver="latest"
+    claude_ver=$(_ensure_version_installed "$claude_ver") || exit 1
 
     # Auto-detect proxy protocol
     local proxy_url=""
     if [[ -n "$proxy" ]]; then
         if [[ ! "$proxy" =~ ^(http|https|socks5):// ]]; then
-            printf "Detecting proxy protocol ... "
+            printf "  $(_dim "Detecting proxy protocol ...") "
             if proxy_url=$(_auto_detect_proxy "$proxy"); then
                 echo "$(_cyan "$(echo "$proxy_url" | grep -oE '^[a-z]+')")"
             else
@@ -1336,7 +1520,7 @@ _env_cmd_create() {
     # Geo-detect timezone (single request via proxy)
     local tz="America/New_York" lang="en_US.UTF-8"
     if [[ -n "$proxy_url" ]]; then
-        printf "Detecting timezone ... "
+        printf "  $(_dim "Detecting timezone ...") "
         local ip_info
         ip_info=$(curl -s --proxy "$proxy_url" --connect-timeout 8 "http://ip-api.com/json/?fields=timezone,countryCode" 2>/dev/null || true)
         if [[ -n "$ip_info" ]]; then
@@ -1363,42 +1547,86 @@ _env_cmd_create() {
     echo "$env_type"          > "$env_dir/type"
     mkdir -p "$env_dir/.claude"
 
+    # Initialize settings.json, statusline, and CLAUDE.md
+    _write_env_settings "$env_dir/.claude"
+    _write_statusline_script "$env_dir/.claude"
+    _write_env_claude_md "$env_dir/.claude" "$name"
+
     _generate_client_cert "$name" >/dev/null 2>&1 || true
 
+    # Auto-activate
+    echo "$name" > "$CAC_DIR/current"
+    rm -f "$CAC_DIR/stopped"
+    if [[ -d "$env_dir/.claude" ]]; then
+        export CLAUDE_CONFIG_DIR="$env_dir/.claude"
+    fi
+    _update_statsig "$(_read "$env_dir/stable_id")" 2>/dev/null || true
+    _update_claude_json_user_id "$(_read "$env_dir/user_id")" 2>/dev/null || true
+
     local elapsed; elapsed=$(_timer_elapsed)
-    echo "$(_green_bold "Created") environment $(_cyan "$name") $(_dim "in $elapsed")"
-    [[ -n "$proxy_url" ]] && echo "  $(_green "+") proxy: $proxy_url"
-    [[ -n "$claude_ver" ]] && echo "  $(_green "+") claude: $(_cyan "$claude_ver")"
-    echo "  $(_green "+") type: $env_type"
     echo
-    echo "Activate with: $(_green "cac $name")"
+    echo "  $(_green_bold "Created") $(_bold "$name") $(_dim "in $elapsed")"
+    echo
+    [[ -n "$proxy_url" ]] && echo "  $(_green "+") proxy    $proxy_url"
+    [[ -n "$claude_ver" ]] && echo "  $(_green "+") claude   $(_cyan "$claude_ver")"
+    echo "  $(_green "+") env      $(_dim "${env_dir/#$HOME/~}/.claude/")"
+    echo
+    echo "  $(_dim "Environment activated. Run") $(_green "claude") $(_dim "to start.")"
+    echo
 }
 
 _env_cmd_ls() {
     if [[ ! -d "$ENVS_DIR" ]] || [[ -z "$(ls -A "$ENVS_DIR" 2>/dev/null)" ]]; then
-        echo "$(_dim "(no environments — create with 'cac env create <name>')")"
+        echo "$(_dim "  No environments yet.")"
+        echo "  Run $(_green "cac env create <name>") to get started."
         return
     fi
 
     local current; current=$(_current_env)
-    local stopped_tag=""
-    [[ -f "$CAC_DIR/stopped" ]] && stopped_tag=" $(_red "[stopped]")"
 
+    # Collect data first to calculate column widths
+    local names=() versions=() proxies=() paths=()
     for env_dir in "$ENVS_DIR"/*/; do
         [[ -d "$env_dir" ]] || continue
-        local name; name=$(basename "$env_dir")
-        local proxy; proxy=$(_read "$env_dir/proxy" "")
-        local ver; ver=$(_read "$env_dir/version" "system")
-        local etype; etype=$(_read "$env_dir/type" "local")
+        names+=("$(basename "$env_dir")")
+        versions+=("$(_read "$env_dir/version" "system")")
+        local p; p=$(_read "$env_dir/proxy" "")
+        if [[ -n "$p" ]] && [[ "$p" == *"://"*"@"* ]]; then
+            p=$(echo "$p" | sed 's|://[^@]*@|://***@|')
+        fi
+        proxies+=("${p:-—}")
+        local ep="${env_dir}.claude/"
+        paths+=("${ep/#$HOME/~}")
+    done
+
+    # Calculate max widths
+    local max_name=4 max_ver=6 max_proxy=5
+    local i
+    for i in "${!names[@]}"; do
+        local nl=${#names[$i]} vl=${#versions[$i]} pl=${#proxies[$i]}
+        (( nl > max_name )) && max_name=$nl
+        (( vl > max_ver )) && max_ver=$vl
+        (( pl > max_proxy )) && max_proxy=$pl
+    done
+    # Cap proxy column
+    (( max_proxy > 40 )) && max_proxy=40
+
+    # Header
+    printf "  $(_dim "  %-${max_name}s  %-${max_ver}s  %-${max_proxy}s  %s")" "NAME" "CLAUDE" "PROXY" "ENV"
+    echo
+
+    # Rows
+    for i in "${!names[@]}"; do
+        local name="${names[$i]}"
+        local ver="${versions[$i]}"
+        local proxy="${proxies[$i]}"
+        local epath="${paths[$i]}"
 
         if [[ "$name" == "$current" ]]; then
-            printf "  %s %s%s\n" "$(_green "▶")" "$(_bold "$name")" "$stopped_tag"
+            printf "  $(_green "▶") $(_bold "%-${max_name}s")  $(_cyan "%-${max_ver}s")  %-${max_proxy}s  $(_dim "%s")\n" "$name" "$ver" "$proxy" "$epath"
         else
-            printf "    %s\n" "$name"
+            printf "  $(_dim "○") %-${max_name}s  $(_cyan "%-${max_ver}s")  $(_dim "%-${max_proxy}s")  $(_dim "%s")\n" "$name" "$ver" "$proxy" "$epath"
         fi
-        local details="claude: $(_cyan "$ver")  type: $etype"
-        [[ -n "$proxy" ]] && details="proxy: $proxy  $details"
-        printf "      %s\n" "$details"
     done
 }
 
@@ -1410,7 +1638,7 @@ _env_cmd_rm() {
     local current; current=$(_current_env)
     [[ "$name" != "$current" ]] || _die "cannot remove active environment $(_cyan "'$name'")\n  switch to another environment first"
 
-    rm -rf "$ENVS_DIR/$name"
+    rm -rf "${ENVS_DIR:?}/$name"
     echo "$(_green_bold "Removed") environment $(_cyan "$name")"
 }
 
@@ -1444,37 +1672,115 @@ _env_cmd_activate() {
     echo "$(_green_bold "Activated") $(_bold "$name") $(_dim "in $elapsed")"
 }
 
-_env_cmd_deactivate() {
-    if [[ ! -f "$CAC_DIR/current" ]]; then
-        echo "$(_dim "no active environment")"
+_env_cmd_set() {
+    _require_setup
+
+    # Parse: cac env set [name] <key> <value|--remove>
+    # If first arg is a known key, use current env; otherwise treat as env name
+    local name="" key="" value="" remove=false
+    local known_keys="proxy version"
+
+    if [[ $# -lt 1 ]] || [[ "${1:-}" == "-h" ]] || [[ "${1:-}" == "--help" ]] || [[ "${1:-}" == "help" ]]; then
+        echo
+        echo "  $(_bold "cac env set") — modify environment configuration"
+        echo
+        echo "    $(_green "set") [name] proxy <url>           Set proxy"
+        echo "    $(_green "set") [name] proxy --remove        Remove proxy"
+        echo "    $(_green "set") [name] version <ver|latest>  Change Claude version"
+        echo
+        echo "  $(_dim "If name is omitted, uses the current active environment.")"
+        echo
         return
     fi
-    local current; current=$(_current_env)
-    rm -f "$CAC_DIR/current"
-    touch "$CAC_DIR/stopped"
-    _relay_stop 2>/dev/null || true
-    echo "$(_green_bold "Deactivated") $(_bold "$current") — claude runs unprotected"
+
+    # Is first arg a known key or an env name?
+    if echo "$known_keys" | grep -qw "${1:-}"; then
+        name=$(_current_env)
+        [[ -n "$name" ]] || _die "no active environment — specify env name"
+    else
+        name="$1"; shift
+    fi
+
+    _require_env "$name"
+    local env_dir="$ENVS_DIR/$name"
+
+    [[ $# -ge 1 ]] || _die "usage: cac env set [name] <proxy|version|bypass> <value|--remove>"
+    key="$1"; shift
+
+    # Parse value or --remove
+    if [[ "${1:-}" == "--remove" ]]; then
+        remove=true; shift
+    elif [[ $# -ge 1 ]]; then
+        value="$1"; shift
+    fi
+
+    case "$key" in
+        proxy)
+            if [[ "$remove" == "true" ]]; then
+                rm -f "$env_dir/proxy"
+                echo "$(_green_bold "Removed") proxy from $(_bold "$name")"
+            else
+                [[ -n "$value" ]] || _die "usage: cac env set [name] proxy <url|host:port:user:pass>"
+                local proxy_url
+                if [[ ! "$value" =~ ^(http|https|socks5):// ]]; then
+                    printf "  $(_dim "Detecting proxy protocol ...") "
+                    if proxy_url=$(_auto_detect_proxy "$value"); then
+                        echo "$(_cyan "$(echo "$proxy_url" | grep -oE '^[a-z]+')")"
+                    else
+                        echo "$(_yellow "failed, defaulting to http")"
+                    fi
+                else
+                    proxy_url=$(_parse_proxy "$value")
+                fi
+                echo "$proxy_url" > "$env_dir/proxy"
+                echo "$(_green_bold "Set") proxy for $(_bold "$name") → $proxy_url"
+            fi
+            ;;
+        version)
+            [[ "$remove" != "true" ]] || _die "cannot remove version — use 'cac env set $name version latest'"
+            [[ -n "$value" ]] || _die "usage: cac env set [name] version <ver|latest>"
+            local ver
+            ver=$(_ensure_version_installed "$value") || exit 1
+            echo "$ver" > "$env_dir/version"
+            echo "$(_green_bold "Set") version for $(_bold "$name") → $(_cyan "$ver")"
+            ;;
+        *)
+            _die "unknown key '$key' — use proxy or version"
+            ;;
+    esac
 }
 
 cmd_env() {
     case "${1:-help}" in
         create)       _env_cmd_create "${@:2}" ;;
+        set)          _env_cmd_set "${@:2}" ;;
         ls|list)      _env_cmd_ls ;;
         rm|remove)    _env_cmd_rm "${@:2}" ;;
         activate)     _env_cmd_activate "${@:2}" ;;
-        deactivate)   _env_cmd_deactivate ;;
-        check)        cmd_check ;;
+        check)        cmd_check "${@:2}" ;;
+        deactivate)   echo "$(_yellow "warning:") deactivate has been removed — switch with 'cac <name>' or uninstall with 'cac self delete'" >&2 ;;
         help|-h|--help)
-            echo "$(_bold "cac env") — environment management"
             echo
-            echo "  $(_bold "create") <name> [-p <proxy>] [-c <ver>] [--type local|container]"
-            echo "  $(_bold "ls")              List all environments"
-            echo "  $(_bold "rm") <name>       Remove an environment"
-            echo "  $(_bold "activate") <name> Activate (shortcut: cac <name>)"
-            echo "  $(_bold "deactivate")      Deactivate — claude runs unprotected"
-            echo "  $(_bold "check")           Verify current environment"
+            echo "  $(_bold "cac env") — environment management"
+            echo
+            echo "    $(_green "create") <name> [-p proxy] [-c ver]"
+            echo "    $(_green "set") [name] proxy <url>           Set proxy"
+            echo "    $(_green "set") [name] proxy --remove        Remove proxy"
+            echo "    $(_green "set") [name] version <ver|latest>  Change Claude version"
+            echo "    $(_green "ls")              List all environments"
+            echo "    $(_green "rm") <name>       Remove an environment"
+            echo "    $(_green "check")           Verify current environment"
+            echo "    $(_green "cac") <name>      Switch environment"
+            echo
+            ;;
+        *)
+            # If first arg is an existing env name, treat as: cac env set <name> ...
+            if [[ -d "$ENVS_DIR/$1" ]] && [[ $# -ge 2 ]]; then
+                _env_cmd_set "$@"
+            else
+                _die "unknown: cac env $1"
+            fi
             ;;
-        *) _die "unknown: cac env $1" ;;
     esac
 }
 
@@ -1505,8 +1811,8 @@ _relay_start() {
     disown
 
     # 等待 relay 就绪
-    local i
-    for i in {1..30}; do
+    local _i
+    for _i in {1..30}; do
         (echo >/dev/tcp/127.0.0.1/$port) 2>/dev/null && break
         sleep 0.1
     done
@@ -1527,8 +1833,8 @@ _relay_stop() {
         if [[ -n "$pid" ]] && kill -0 "$pid" 2>/dev/null; then
             kill "$pid" 2>/dev/null
             # 等待进程退出
-            local i
-            for i in {1..20}; do
+            local _i
+            for _i in {1..20}; do
                 kill -0 "$pid" 2>/dev/null || break
                 sleep 0.1
             done
@@ -1702,18 +2008,14 @@ cmd_check() {
 
     local current; current=$(_current_env)
 
-    if [[ -f "$CAC_DIR/stopped" ]]; then
-        echo "$(_red "✗") cac 已停用 — 运行 'cac <name>' 恢复"
-        return
-    fi
     if [[ -z "$current" ]]; then
-        echo "错误：未激活任何环境，运行 'cac <name>'" >&2; exit 1
+        echo "error: no active environment — run $(_green "cac env create <name>")" >&2; exit 1
     fi
 
     local env_dir="$ENVS_DIR/$current"
     local proxy; proxy=$(_read "$env_dir/proxy" "")
 
-    # 解析版本号
+    # Resolve version
     local ver; ver=$(_read "$env_dir/version" "")
     if [[ -z "$ver" ]] || [[ "$ver" == "system" ]]; then
         local _real; _real=$(_read "$CAC_DIR/real_claude" "")
@@ -1725,80 +2027,27 @@ cmd_check() {
     fi
 
     local problems=()
-    local summary_parts=()
-
-    # ── wrapper 检查 ──
-    local claude_path; claude_path="$(command -v claude 2>/dev/null || true)"
-    if [[ -z "$claude_path" ]] || [[ "$(readlink -f "$claude_path" 2>/dev/null || echo "$claude_path")" != *"/.cac/bin/claude"* ]]; then
-        if [[ "$claude_path" != *"/.cac/bin/claude" ]]; then
-            problems+=("claude 未指向 wrapper — 运行 source ~/.zshrc 或重开终端")
-        fi
-    fi
 
-    # ── 网络检查 ──
-    local proxy_ip=""
-    if [[ -n "$proxy" ]]; then
-        if ! _proxy_reachable "$proxy"; then
-            problems+=("代理不通: $proxy")
-        else
-            proxy_ip=$(curl -s --proxy "$proxy" --connect-timeout 8 https://api.ipify.org 2>/dev/null || true)
-            if [[ -n "$proxy_ip" ]]; then
-                summary_parts+=("出口 $proxy_ip")
-            else
-                problems+=("出口 IP 获取失败")
-            fi
-        fi
+    # ── header (neutral, no pass/fail yet) ──
+    echo
+    echo "  $(_bold "$current") $(_dim "(claude $ver)")"
+    echo
 
-        # 冲突检测（仅代理连通时才有意义）
-        if [[ -n "$proxy_ip" ]]; then
-        local os; os=$(_detect_os)
-        local has_conflict=false
-        local tun_procs="clash|mihomo|sing-box|surge|shadowrocket|v2ray|xray|hysteria|tuic|nekoray"
-        local running
-        if [[ "$os" == "macos" ]]; then
-            running=$(ps aux 2>/dev/null | grep -iE "$tun_procs" | grep -v grep || true)
+    # ── wrapper check (instant) ──
+    local claude_path; claude_path="$(command -v claude 2>/dev/null || true)"
+    if [[ -z "$claude_path" ]] || [[ "$claude_path" != *"/.cac/bin/claude" ]]; then
+        local _rc; _rc=$(_detect_rc_file)
+        if [[ -n "$_rc" ]] && grep -q '# >>> cac' "$_rc" 2>/dev/null; then
+            echo "    $(_green "✓") wrapper    configured in ${_rc/#$HOME/~}"
         else
-            running=$(ps -eo comm 2>/dev/null | grep -iE "$tun_procs" || true)
-        fi
-        [[ -n "$running" ]] && has_conflict=true
-        if [[ "$os" == "macos" ]]; then
-            local tun_count; tun_count=$(ifconfig 2>/dev/null | grep -cE '^utun[0-9]+' || echo 0)
-            [[ "$tun_count" -gt 3 ]] && has_conflict=true
-        elif [[ "$os" == "linux" ]]; then
-            ip link show tun0 >/dev/null 2>&1 && has_conflict=true
-        fi
-
-        if [[ "$has_conflict" == "true" ]]; then
-            # 测试 relay
-            local relay_ok=false
-            if _relay_is_running 2>/dev/null; then
-                local rport; rport=$(_read "$CAC_DIR/relay.port" "")
-                local relay_ip; relay_ip=$(curl -s --proxy "http://127.0.0.1:$rport" --connect-timeout 8 https://api.ipify.org 2>/dev/null || true)
-                [[ -n "$relay_ip" ]] && relay_ok=true
-            elif [[ -f "$CAC_DIR/relay.js" ]]; then
-                local _test_env; _test_env=$(_current_env)
-                if _relay_start "$_test_env" 2>/dev/null; then
-                    local rport; rport=$(_read "$CAC_DIR/relay.port" "")
-                    local relay_ip; relay_ip=$(curl -s --proxy "http://127.0.0.1:$rport" --connect-timeout 8 https://api.ipify.org 2>/dev/null || true)
-                    _relay_stop 2>/dev/null || true
-                    [[ -n "$relay_ip" ]] && relay_ok=true
-                fi
-            fi
-
-            if [[ "$relay_ok" == "true" ]]; then
-                summary_parts+=("TUN 冲突已绕过")
-            else
-                local proxy_hp; proxy_hp=$(_proxy_host_port "$proxy")
-                local proxy_host="${proxy_hp%%:*}"
-                problems+=("代理冲突：需在代理软件中为 $proxy_host 添加 DIRECT 规则")
-            fi
-        fi
+            _write_path_to_rc "$_rc" >/dev/null 2>&1 || true
+            echo "    $(_green "✓") wrapper    $(_dim "added to ${_rc/#$HOME/~}")"
         fi
     else
-        summary_parts+=("API Key 模式")
+        echo "    $(_green "✓") wrapper    active"
     fi
 
-    # ── 防护检查 ──
+    # ── telemetry shield (instant) ──
     local wrapper_file="$CAC_DIR/bin/claude"
     local wrapper_content=""
     [[ -f "$wrapper_file" ]] && wrapper_content=$(<"$wrapper_file")
@@ -1814,43 +2063,125 @@ cmd_check() {
     done
 
     if [[ "$env_ok" -eq "$env_total" ]]; then
-        summary_parts+=("遥测屏蔽 ${env_ok}/${env_total}")
+        echo "    $(_green "✓") telemetry  ${env_ok}/${env_total} blocked"
     else
-        problems+=("遥测屏蔽 ${env_ok}/${env_total}")
+        echo "    $(_red "✗") telemetry  ${env_ok}/${env_total} blocked"
+        problems+=("telemetry shield ${env_ok}/${env_total}")
     fi
 
-    # ── 输出结论 ──
+    # ── network check (slow — streaming output) ──
+    local proxy_ip=""
+    if [[ -n "$proxy" ]]; then
+        if ! _proxy_reachable "$proxy"; then
+            echo "    $(_red "✗") proxy      unreachable"
+            problems+=("proxy unreachable: $proxy")
+        else
+            # Fast retry with dots: each attempt adds a dot
+            local _ip_url _dots=""
+            local _urls="https://api.ip.sb/ip https://ip.3322.net https://api.ipify.org https://ipinfo.io/ip https://api.ip.sb/ip"
+            for _ip_url in $_urls; do
+                _dots="${_dots}."
+                printf "\r    · exit IP    $(_dim "detecting${_dots}")"
+                proxy_ip=$(curl --proxy "$proxy" --connect-timeout 3 --max-time 6 "$_ip_url" 2>/dev/null || true)
+                [[ "$proxy_ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] && break
+                proxy_ip=""
+            done
+            # Overwrite the "detecting..." line
+            if [[ -n "$proxy_ip" ]]; then
+                printf "\r    $(_green "✓") exit IP    $(_cyan "$proxy_ip")\033[K\n"
+            else
+                printf "\r    $(_green "✓") exit IP    $(_dim "run again to detect exit IP")\033[K\n"
+            fi
+
+            # TUN conflict detection
+            if [[ -n "$proxy_ip" ]]; then
+            local os; os=$(_detect_os)
+            local has_conflict=false
+            local tun_procs="clash|mihomo|sing-box|surge|shadowrocket|v2ray|xray|hysteria|tuic|nekoray"
+            local running
+            if [[ "$os" == "macos" ]]; then
+                running=$(ps aux 2>/dev/null | grep -iE "$tun_procs" | grep -v grep || true)
+            else
+                running=$(ps -eo comm 2>/dev/null | grep -iE "$tun_procs" || true)
+            fi
+            [[ -n "$running" ]] && has_conflict=true
+            if [[ "$os" == "macos" ]]; then
+                local tun_count; tun_count=$(ifconfig 2>/dev/null | grep -cE '^utun[0-9]+' || echo 0)
+                [[ "$tun_count" -gt 3 ]] && has_conflict=true
+            elif [[ "$os" == "linux" ]]; then
+                ip link show tun0 >/dev/null 2>&1 && has_conflict=true
+            fi
+
+            if [[ "$has_conflict" == "true" ]]; then
+                local relay_ok=false
+                if _relay_is_running 2>/dev/null; then
+                    local rport; rport=$(_read "$CAC_DIR/relay.port" "")
+                    local relay_ip; relay_ip=$(curl --proxy "http://127.0.0.1:$rport" --connect-timeout 8 --max-time 12 https://api.ipify.org 2>/dev/null || true)
+                    [[ -n "$relay_ip" ]] && relay_ok=true
+                elif [[ -f "$CAC_DIR/relay.js" ]]; then
+                    local _test_env; _test_env=$(_current_env)
+                    if _relay_start "$_test_env" 2>/dev/null; then
+                        local rport; rport=$(_read "$CAC_DIR/relay.port" "")
+                        local relay_ip; relay_ip=$(curl --proxy "http://127.0.0.1:$rport" --connect-timeout 8 --max-time 12 https://api.ipify.org 2>/dev/null || true)
+                        _relay_stop 2>/dev/null || true
+                        [[ -n "$relay_ip" ]] && relay_ok=true
+                    fi
+                fi
+
+                if [[ "$relay_ok" == "true" ]]; then
+                    echo "    $(_green "✓") TUN        relay bypass active"
+                else
+                    local proxy_hp; proxy_hp=$(_proxy_host_port "$proxy")
+                    local proxy_host="${proxy_hp%%:*}"
+                    echo "    $(_red "✗") TUN        conflict — add DIRECT rule for $proxy_host"
+                    problems+=("TUN conflict: add DIRECT rule for $proxy_host in proxy software")
+                fi
+            fi
+            fi
+        fi
+    else
+        echo "    $(_green "✓") mode       API Key (no proxy)"
+    fi
+
+    # ── summary ──
+    echo
     if [[ ${#problems[@]} -eq 0 ]]; then
-        echo "$(_green "✓") $(_bold "$current") (claude $(_cyan "$ver")) — 一切正常"
-        echo "  $(IFS=' | '; echo "${summary_parts[*]}")"
+        echo "  $(_green "✓") all good"
     else
-        echo "$(_red "✗") $(_bold "$current") (claude $(_cyan "$ver")) — 发现 ${#problems[@]} 个问题"
         for p in "${problems[@]}"; do
             echo "  $(_red "✗") $p"
         done
     fi
+    echo
 
-    # ── 详细模式 ──
+    # ── verbose mode ──
     if [[ "$verbose" == "true" ]]; then
+        echo "  $(_bold "Details")"
+        echo "    $(_dim "UUID")       $(_read "$env_dir/uuid")"
+        echo "    $(_dim "stable_id")  $(_read "$env_dir/stable_id")"
+        echo "    $(_dim "user_id")    $(_read "$env_dir/user_id" "—")"
+        echo "    $(_dim "TZ")         $(_read "$env_dir/tz" "—")"
+        echo "    $(_dim "LANG")       $(_read "$env_dir/lang" "—")"
+        echo "    $(_dim "env")        ${env_dir/#$HOME/~}/.claude/"
         echo
-        echo "  UUID      : $(_read "$env_dir/uuid")"
-        echo "  stable_id : $(_read "$env_dir/stable_id")"
-        echo "  user_id   : $(_read "$env_dir/user_id" "—")"
-        echo "  TZ        : $(_read "$env_dir/tz" "—")"
-        echo "  LANG      : $(_read "$env_dir/lang" "—")"
-        echo "  遥测屏蔽  : ${env_ok}/${env_total}"
+        echo "  $(_bold "Telemetry") ${env_ok}/${env_total}"
         for var in "${env_vars[@]}"; do
-            printf "    %-36s" "$var"
-            [[ "$wrapper_content" == *"$var"* ]] && echo "$(_green "✓")" || echo "$(_red "✗")"
+            if [[ "$wrapper_content" == *"$var"* ]]; then
+                printf "    $(_green "✓") %s\n" "$var"
+            else
+                printf "    $(_red "✗") %s\n" "$var"
+            fi
         done
-        printf "  DNS 拦截  : "
+        echo
+        printf "  $(_bold "DNS block")  "
         if [[ -f "$CAC_DIR/cac-dns-guard.js" ]]; then
             _check_dns_block "statsig.anthropic.com"
         else
             echo "$(_red "✗")"
         fi
-        printf "  mTLS      : "
+        printf "  $(_bold "mTLS")       "
         _check_mtls "$env_dir"
+        echo
     fi
 }
 
@@ -1959,7 +2290,7 @@ _claude_cmd_install() {
 
     mkdir -p "$VERSIONS_DIR"
     if _download_version "$ver"; then
-        echo "$ver" > "$VERSIONS_DIR/.latest"
+        _update_latest
         echo
         echo "  Bind to environment: $(_cyan "cac env create <name> -c $ver")"
     fi
@@ -1973,35 +2304,34 @@ _claude_cmd_uninstall() {
     local count; count=$(_envs_using_version "$ver")
     [[ "$count" -eq 0 ]] || _die "version $(_cyan "$ver") in use by $count environment(s)"
 
-    rm -rf "$VERSIONS_DIR/$ver"
+    rm -rf "${VERSIONS_DIR:?}/$ver"
+    _update_latest
     echo "$(_green_bold "Uninstalled") Claude Code $(_cyan "$ver")"
 }
 
 _claude_cmd_ls() {
-    echo "$(_bold "Installed Claude Code versions:")"
-    echo
-
+    _update_latest 2>/dev/null || true
     if [[ ! -d "$VERSIONS_DIR" ]] || [[ -z "$(ls -A "$VERSIONS_DIR" 2>/dev/null)" ]]; then
-        echo "  $(_dim "(none — install with 'cac claude install')")"
+        echo "$(_dim "  No versions installed.")"
+        echo "  Run $(_green "cac claude install") to get started."
         return
     fi
 
     local latest; latest=$(_read "$VERSIONS_DIR/.latest" "")
+
+    printf "  $(_dim "%-12s  %-8s  %s")\n" "VERSION" "STATUS" "ENVIRONMENTS"
     for ver_dir in "$VERSIONS_DIR"/*/; do
         [[ -d "$ver_dir" ]] || continue
         local ver; ver=$(basename "$ver_dir")
-        local tag=""; [[ "$ver" == "$latest" ]] && tag=" $(_green "(latest)")"
+        local status=""; [[ "$ver" == "$latest" ]] && status="latest"
         local count; count=$(_envs_using_version "$ver")
-        local usage=""; [[ "$count" -gt 0 ]] && usage=" $(_dim "— $count environment(s)")"
-        printf "  %s%s%s\n" "$(_cyan "$ver")" "$tag" "$usage"
+        local usage="—"; [[ "$count" -gt 0 ]] && usage="$count env(s)"
+        if [[ -n "$status" ]]; then
+            printf "  $(_cyan "%-12s")  $(_green "%-8s")  %s\n" "$ver" "$status" "$usage"
+        else
+            printf "  $(_cyan "%-12s")  $(_dim "%-8s")  %s\n" "$ver" "—" "$usage"
+        fi
     done
-
-    local sys; sys=$(_read "$CAC_DIR/real_claude" "")
-    if [[ -n "$sys" ]] && [[ -x "$sys" ]]; then
-        local sv; sv=$("$sys" --version 2>/dev/null | head -1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || echo "?")
-        echo
-        echo "  System: $(_cyan "$sys") ($(_dim "$sv"))"
-    fi
 }
 
 _claude_cmd_pin() {
@@ -2136,6 +2466,7 @@ _dk_init() {
 }
 
 _dk_load_env() {
+  # shellcheck disable=SC1090  # dynamic env file path
   [[ -f "$_dk_env_file" ]] && set -a && source "$_dk_env_file" && set +a
 }
 
@@ -2182,6 +2513,7 @@ _dk_compose_files() {
 
 _dk_compose() {
   local files
+  # shellcheck disable=SC2207  # intentional word splitting
   files=($(_dk_compose_files))
   docker compose "${files[@]}" "$@"
 }
@@ -2615,7 +2947,23 @@ cmd_delete() {
 
     _remove_path_from_rc "$rc_file"
 
+    # 停止 relay 进程和路由
     if [[ -d "$CAC_DIR" ]]; then
+        _relay_stop 2>/dev/null || true
+
+        # 停止 docker port-forward 进程
+        if [[ -d /tmp/cac-docker-ports ]]; then
+            for _pf in /tmp/cac-docker-ports/*.pid; do
+                [[ -f "$_pf" ]] || continue
+                kill "$(cat "$_pf")" 2>/dev/null || true
+                rm -f "$_pf"
+            done
+            echo "  ✓ 已停止 docker port-forward 进程"
+        fi
+
+        # 兜底：清理可能残留的 relay 孤儿进程
+        pkill -f "node.*\.cac/relay\.js" 2>/dev/null || true
+
         rm -rf "$CAC_DIR"
         echo "  ✓ 已删除 $CAC_DIR"
     else
@@ -2650,60 +2998,47 @@ cmd_delete() {
 # ── cmd: version ───────────────────────────────────────────────
 
 cmd_version() {
-    local method
-    method=$(_install_method)
-
-    local method_label
-    case "$method" in
-        npm)  method_label="npm (Node)" ;;
-        bash) method_label="bash (Shell Script)" ;;
-        *)    method_label="unknown" ;;
-    esac
-
-    echo "cac $CAC_VERSION"
-    echo "安装方式: $method_label"
+    echo "  $(_bold "cac") $(_cyan "$CAC_VERSION")"
 }
 
 # ━━━ cmd_help.sh ━━━
 # ── cmd: help ──────────────────────────────────────────────────
 
 cmd_help() {
-cat <<EOF
-$(_bold "cac") — Isolate, protect, and manage your Claude Code
-
-$(_bold "cac claude") — version management
-  install [latest|<ver>]   Install a Claude Code version
-  uninstall <ver>           Remove an installed version
-  ls                        List installed versions
-  pin <ver>                 Pin current environment to a version
-
-$(_bold "cac env") — environment management
-  create <name> [-p <proxy>] [-c <ver>] [--type local|container]
-  ls                        List all environments
-  rm <name>                 Remove an environment
-  activate <name>           Activate (shortcut: cac <name>)
-  deactivate                Deactivate — claude runs unprotected
-  check                     Verify current environment
-
-$(_bold "cac self") — self-management
-  update                    Update cac to the latest version
-  delete                    Uninstall cac completely
-
-$(_bold "cac docker") — containerized mode
-  setup|start|enter|check|port|stop|help
-
-$(_bold "Shortcuts:")
-  cac <name>                = cac env activate <name>
-  cac ls                    = cac env ls
-
-$(_bold "Examples:")
-  cac claude install latest
-  cac env create work -p 1.2.3.4:1080:u:p -c 2.1.81
-  cac env create personal
-  cac work
-  cac env deactivate
-  cac env check
-EOF
+    echo
+    echo "  $(_bold "cac") $(_dim "$CAC_VERSION") — Isolate, protect, and manage your Claude Code"
+    echo
+
+    echo "  $(_bold "Environment")"
+    echo "    $(_green "cac env create") <name> [-p proxy] [-c ver]"
+    echo "    $(_green "cac env set") [name] <key> <value>   Modify environment"
+    echo "    $(_green "cac env ls")                  List all environments"
+    echo "    $(_green "cac env rm") <name>           Remove an environment"
+    echo "    $(_green "cac env check")               Verify current environment"
+    echo "    $(_green "cac") <name>                  Switch environment"
+    echo
+
+    echo "  $(_bold "Version")"
+    echo "    $(_green "cac claude install") [latest|ver]   Install Claude Code"
+    echo "    $(_green "cac claude ls")                     List installed versions"
+    echo "    $(_green "cac claude pin") <ver>              Pin env to a version"
+    echo "    $(_green "cac claude uninstall") <ver>        Remove a version"
+    echo
+
+    echo "  $(_bold "Self")"
+    echo "    $(_green "cac self update")             Update cac"
+    echo "    $(_green "cac self delete")             Uninstall cac completely"
+    echo
+
+    echo "  $(_bold "Docker")"
+    echo "    $(_green "cac docker") setup|start|enter|check|port|stop"
+    echo
+
+    echo "  $(_dim "Examples:")"
+    echo "    $(_dim "cac env create work -p 1.2.3.4:1080:u:p -c 2.1.81")"
+    echo "    $(_dim "cac env create personal")"
+    echo "    $(_dim "cac work")"
+    echo
 }
 
 # ━━━ main.sh ━━━
@@ -2723,7 +3058,7 @@ case "$1" in
     add)                echo "$(_yellow "warning:") 'cac add' → 'cac env create <name> -p <proxy>'" >&2; exit 1 ;;
     setup)              echo "$(_yellow "warning:") 'cac setup' is no longer needed — cac auto-initializes" >&2 ;;
     check)              echo "$(_yellow "warning:") 'cac check' → 'cac env check'" >&2; cmd_check ;;
-    stop)               echo "$(_yellow "warning:") 'cac stop' → 'cac env deactivate'" >&2; _env_cmd_deactivate ;;
+    stop)               echo "$(_yellow "warning:") 'cac stop' has been removed — switch with 'cac <name>'" >&2 ;;
     resume|-c)          echo "$(_yellow "warning:") 'cac resume' removed — use 'cac env activate <name>'" >&2; exit 1 ;;
     relay)              echo "$(_yellow "warning:") relay is now automatic (TUN auto-detected)" >&2 ;;
     delete|uninstall)   echo "$(_yellow "warning:") 'cac delete' → 'cac self delete'" >&2; cmd_delete ;;