claude-cac 1.2.0 → 1.3.0

package/fingerprint-hook.js

@@ -19,12 +19,18 @@ if (fakeMac) {
   const _origNetworkInterfaces = os.networkInterfaces.bind(os);
   os.networkInterfaces = () => {
     const ifaces = _origNetworkInterfaces();
+    const macParts = fakeMac.split(':').map(h => parseInt(h, 16));
+    let ifIdx = 0;
     for (const name of Object.keys(ifaces)) {
       for (const info of ifaces[name]) {
         if (info.mac && info.mac !== '00:00:00:00:00:00') {
-          info.mac = fakeMac;
+          // Derive per-interface MAC: XOR last octet with interface index
+          const derived = macParts.slice();
+          derived[5] = (derived[5] ^ ifIdx) & 0xff;
+          info.mac = derived.map(b => b.toString(16).padStart(2, '0')).join(':');
         }
       }
+      ifIdx++;
     }
     return ifaces;
   };
@@ -98,8 +104,14 @@ function makeFakeChildProcess() {
   cp.stdout = new EventEmitter();
   cp.stderr = new EventEmitter();
   cp.stdin = null;
+  cp.stdio = [null, cp.stdout, cp.stderr];
   cp.pid = 0;
-  cp.kill = () => {};
+  cp.exitCode = null;
+  cp.signalCode = null;
+  cp.killed = false;
+  cp.spawnargs = [];
+  cp.spawnfile = '';
+  cp.kill = () => false;
   return cp;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-cac",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Isolate, protect, and manage your Claude Code — versions, environments, identity, and proxy.",
   "bin": {
     "cac": "cac"

package/relay.js

@@ -133,15 +133,15 @@ function httpConnect(targetHost, targetPort, cb) {
     connectReq += '\r\n';
     sock.write(connectReq);
 
-    let buf = '';
+    let buf = Buffer.alloc(0);
     sock.on('data', function onData(chunk) {
-      buf += chunk.toString();
+      buf = Buffer.concat([buf, chunk]);
       const idx = buf.indexOf('\r\n\r\n');
       if (idx === -1) return;
 
-      const statusLine = buf.substring(0, buf.indexOf('\r\n'));
+      const statusLine = buf.slice(0, buf.indexOf('\r\n')).toString();
       const statusCode = parseInt(statusLine.split(' ')[1], 10);
-      const remaining = Buffer.from(buf.substring(idx + 4));
+      const remaining = buf.slice(idx + 4);
 
       sock.removeListener('data', onData);
 
@@ -207,16 +207,18 @@ const server = net.createServer({ pauseOnConnect: true }, (clientSock) => {
 
 function handleConnect(clientSock, targetHost, targetPort, headerRest) {
   // Consume remaining headers until \r\n\r\n
-  let restBuf = headerRest;
+  // Keep as Buffer to avoid corrupting binary data (e.g. TLS ClientHello)
+  // that may arrive in the same chunk as the last header bytes.
+  let restBuf = Buffer.from(headerRest);
   const consumeHeaders = () => {
     const endIdx = restBuf.indexOf('\r\n\r\n');
     if (endIdx !== -1) {
-      const trailing = restBuf.substring(endIdx + 4);
+      const trailing = restBuf.slice(endIdx + 4);
       doConnect(trailing);
       return;
     }
     clientSock.once('data', (chunk) => {
-      restBuf += chunk.toString();
+      restBuf = Buffer.concat([restBuf, chunk]);
       consumeHeaders();
     });
   };
@@ -235,8 +237,9 @@ function handleConnect(clientSock, targetHost, targetPort, headerRest) {
       upstreamSock.pipe(clientSock);
 
       // Send any extra data that came in after handshake
+      // upstreamExtra is data from the target server; write it to the client.
       if (upstreamExtra && upstreamExtra.length > 0) {
-        clientSock.unshift(upstreamExtra);
+        clientSock.write(upstreamExtra);
       }
       if (trailingData && trailingData.length > 0) {
         upstreamSock.write(trailingData);
@@ -253,7 +256,12 @@ function handleConnect(clientSock, targetHost, targetPort, headerRest) {
 function handlePlainHttp(clientSock, firstLine, headerRest) {
   // For plain HTTP requests, forward directly to upstream proxy
   const sock = net.connect(upstreamPort, upstreamHost, () => {
-    sock.write(firstLine + '\r\n' + headerRest);
+    let authHeader = '';
+    if (upstreamUser) {
+      const cred = Buffer.from(upstreamUser + ':' + upstreamPass).toString('base64');
+      authHeader = 'Proxy-Authorization: Basic ' + cred + '\r\n';
+    }
+    sock.write(firstLine + '\r\n' + authHeader + headerRest);
     clientSock.pipe(sock);
     sock.pipe(clientSock);
   });