claude-cac 1.5.0-beta.2 → 1.5.0

package/cac

@@ -11,7 +11,7 @@ VERSIONS_DIR="$CAC_DIR/versions"
 # ── utils: colors, read/write, UUID, proxy parsing ───────────────────────
 
 # shellcheck disable=SC2034  # used in build-concatenated cac script
-CAC_VERSION="1.5.0-beta.2"
+CAC_VERSION="1.5.0"
 
 _read()   { [[ -f "$1" ]] && tr -d '[:space:]' < "$1" || echo "${2:-}"; }
 _die()    { printf '%b\n' "$(_red "error:") $*" >&2; exit 1; }
@@ -63,7 +63,7 @@ _new_hostname() { echo "host-$(_gen_uuid | cut -d- -f1 | tr '[:upper:]' '[:lower
 _new_mac() { printf '02:%02x:%02x:%02x:%02x:%02x' $((RANDOM%256)) $((RANDOM%256)) $((RANDOM%256)) $((RANDOM%256)) $((RANDOM%256)); }
 _new_git_remote() { echo "https://github.com/user-$(_gen_uuid | cut -d- -f1)/project-$(_gen_uuid | cut -d- -f2).git"; }
 _new_git_email() { echo "user-$(_gen_uuid | cut -d- -f1 | tr '[:upper:]' '[:lower:]')@users.noreply.github.com"; }
-_new_device_token() { python3 -c "import os; print(os.urandom(32).hex())" || _die "python3 required"; }
+_new_device_token() { _new_user_id; }
 
 # Get real command path (bypass shim)
 _get_real_cmd() {
@@ -1232,12 +1232,10 @@ if [[ -n "$PROXY" ]]; then
 fi
 
 # ── git identity spoofing ──
-# Prevent git email leakage (Claude runs `git config --get user.email` on startup)
+# Intercept `git config --get user.email` at process level (telemetry read only)
+# Do NOT set GIT_AUTHOR_EMAIL/GIT_COMMITTER_EMAIL — those would affect real git commits
 if [[ -f "$_env_dir/git_email" ]]; then
-    _git_email=$(tr -d '[:space:]' < "$_env_dir/git_email")
-    export GIT_AUTHOR_EMAIL="$_git_email"
-    export GIT_COMMITTER_EMAIL="$_git_email"
-    export CAC_GIT_EMAIL="$_git_email"
+    export CAC_GIT_EMAIL=$(tr -d '[:space:]' < "$_env_dir/git_email")
 fi
 
 # ── repository fingerprint (rh) spoofing ──
@@ -1255,31 +1253,29 @@ fi
 # ── persona (Docker/server environment spoofing) ──
 if [[ -f "$_env_dir/persona" ]]; then
     _persona=$(tr -d '[:space:]' < "$_env_dir/persona")
+    export TERM="xterm-256color"
     case "$_persona" in
         macos-vscode)
             export TERM_PROGRAM="vscode"
             export VSCODE_GIT_ASKPASS_MAIN="/Applications/Visual Studio Code.app/Contents/Resources/app/extensions/git/dist/askpass-main.js"
             export __CFBundleIdentifier="com.microsoft.VSCode"
-            export TERM="xterm-256color"
             ;;
         macos-cursor)
             export TERM_PROGRAM="vscode"
-            export CURSOR_TRACE_ID="cursor-$(head -c 8 /dev/urandom 2>/dev/null | od -An -tx1 | tr -d ' \n')"
+            [[ -f "$_env_dir/cursor_trace_id" ]] || printf 'cursor-%s' "$(od -An -tx1 -N8 /dev/urandom | tr -d ' \n')" > "$_env_dir/cursor_trace_id"
+            export CURSOR_TRACE_ID=$(tr -d '[:space:]' < "$_env_dir/cursor_trace_id")
             export __CFBundleIdentifier="com.todesktop.230313mzl4w4u92"
-            export TERM="xterm-256color"
             ;;
         macos-iterm)
             export TERM_PROGRAM="iTerm.app"
             export __CFBundleIdentifier="com.googlecode.iterm2"
-            export TERM="xterm-256color"
-            export ITERM_SESSION_ID="w0t0p0:$(head -c 16 /dev/urandom 2>/dev/null | od -An -tx1 | tr -d ' \n')"
+            [[ -f "$_env_dir/iterm_session_id" ]] || printf 'w0t0p0:%s' "$(od -An -tx1 -N16 /dev/urandom | tr -d ' \n')" > "$_env_dir/iterm_session_id"
+            export ITERM_SESSION_ID=$(tr -d '[:space:]' < "$_env_dir/iterm_session_id")
             ;;
         linux-desktop)
             export TERM_PROGRAM="vscode"
-            export TERM="xterm-256color"
             ;;
     esac
-    # Hide Docker signals when persona is active
     export CAC_HIDE_DOCKER=1
 fi
 

package/fingerprint-hook.js

@@ -115,11 +115,7 @@ if (fakeGitRemote) {
   const _origExecSyncFp = child_process.execSync.bind(child_process);
   child_process.execSync = function(cmd, options) {
     var cmdStr = typeof cmd === 'string' ? cmd : cmd.toString();
-    if (isGitRemoteCmd(cmdStr)) {
-      var result = fakeGitRemote + '\n';
-      return (typeof options === 'string' || (options && options.encoding))
-        ? result : Buffer.from(result);
-    }
+    if (isGitRemoteCmd(cmdStr)) return fakeResult(options, fakeGitRemote + '\n');
     return _origExecSyncFp(cmd, options);
   };
 
@@ -130,11 +126,7 @@ if (fakeGitRemote) {
     var cb = typeof args[args.length - 1] === 'function' ? args[args.length - 1] : null;
     if (isGitRemoteCmd(cmdStr)) {
       if (cb) process.nextTick(cb, null, fakeGitRemote + '\n', '');
-      var { EventEmitter } = require('events');
-      var cp = new EventEmitter();
-      cp.stdout = new EventEmitter(); cp.stderr = new EventEmitter();
-      cp.stdin = null; cp.pid = 0; cp.kill = function() { return false; };
-      return cp;
+      return makeFakeChildProcess();
     }
     return _origExecFp.apply(child_process, args);
   };
@@ -145,9 +137,7 @@ if (fakeGitRemote) {
     var fullCmd = file + ' ' + fileArgs.join(' ');
     if (isGitRemoteCmd(fullCmd)) {
       var opts = Array.isArray(argsOrOpts) ? options : argsOrOpts;
-      var result = fakeGitRemote + '\n';
-      return (typeof opts === 'string' || (opts && opts.encoding))
-        ? result : Buffer.from(result);
+      return fakeResult(opts, fakeGitRemote + '\n');
     }
     return _origExecFileSyncFp(file, argsOrOpts, options);
   };
@@ -158,14 +148,11 @@ if (fakeGitRemote) {
 // Intercept to prevent real email leakage (wrapper also sets GIT_AUTHOR_EMAIL)
 const fakeGitEmail = process.env.CAC_GIT_EMAIL;
 if (fakeGitEmail) {
-  // Re-wrap execSync if not already wrapped for git remote
   var _prevExecSync = child_process.execSync;
   child_process.execSync = function(cmd, options) {
     var cmdStr = typeof cmd === 'string' ? cmd : cmd.toString();
     if (/git\s+config\s+(--global\s+|--get\s+)*user\.email/i.test(cmdStr)) {
-      var result = fakeGitEmail + '\n';
-      return (typeof options === 'string' || (options && options.encoding))
-        ? result : Buffer.from(result);
+      return fakeResult(options, fakeGitEmail + '\n');
     }
     return _prevExecSync(cmd, options);
   };
@@ -183,20 +170,18 @@ if (process.env.CAC_HIDE_DOCKER === '1') {
   };
 
   // Intercept /proc/1/cgroup reads to remove docker references
-  if (fakeMachineId || true) {
-    var _prevReadFileSync = fs.readFileSync;
-    fs.readFileSync = function(path, options) {
-      var ps = typeof path === 'string' ? path : (path && path.toString ? path.toString() : '');
-      if (ps === '/proc/1/cgroup') {
-        var content;
-        try { content = _prevReadFileSync(path, options); } catch(e) { throw e; }
-        var str = typeof content === 'string' ? content : content.toString();
-        str = str.replace(/docker|containerd|kubepods/gi, 'system.slice');
-        return (typeof options === 'string' || (options && options.encoding)) ? str : Buffer.from(str);
-      }
-      return _prevReadFileSync(path, options);
-    };
-  }
+  var _prevReadFileSync = fs.readFileSync;
+  fs.readFileSync = function(path, options) {
+    var ps = typeof path === 'string' ? path : (path && path.toString ? path.toString() : '');
+    if (ps === '/proc/1/cgroup') {
+      var content;
+      try { content = _prevReadFileSync(path, options); } catch(e) { throw e; }
+      var str = typeof content === 'string' ? content : content.toString();
+      str = str.replace(/docker|containerd|kubepods/gi, 'system.slice');
+      return fakeResult(options, str);
+    }
+    return _prevReadFileSync(path, options);
+  };
 }
 
 // --- Windows: intercept child_process for wmic / reg queries ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-cac",
-  "version": "1.5.0-beta.2",
+  "version": "1.5.0",
   "description": "Isolate, protect, and manage your Claude Code — versions, environments, identity, and proxy.",
   "bin": {
     "cac": "cac"