claude-cac 1.5.0-beta.2 → 1.5.1-beta.1

package/README.md

@@ -110,10 +110,10 @@ cac ls                                  # = cac env ls
 | `cac claude ls` | 列出已安装版本 |
 | `cac claude pin <ver>` | 当前环境绑定版本 |
 | **环境管理** | |
-| `cac env create <name> [-p proxy] [-c ver] [--clone]` | 创建环境（自动激活，`--clone` 继承配置） |
+| `cac env create <name> [-p proxy] [-c ver] [--clone] [--telemetry mode] [--persona preset]` | 创建环境（自动激活，`--telemetry transparent/stealth/paranoid` 控制遥测，`--persona macos-vscode/...` 用于容器） |
 | `cac env ls` | 列出环境 |
 | `cac env rm <name>` | 删除环境 |
-| `cac env set [name] <key> <value>` | 修改环境（proxy / version） |
+| `cac env set [name] <key> <value>` | 修改环境（proxy / version / telemetry / persona） |
 | `cac env check [-d]` | 验证当前环境（`-d` 显示详情） |
 | `cac <name>` | 激活环境 |
 | **自管理** | |
@@ -293,10 +293,10 @@ Each environment is fully isolated:
 | `cac claude ls` | List installed versions |
 | `cac claude pin <ver>` | Pin current env to version |
 | **Environment management** | |
-| `cac env create <name> [-p proxy] [-c ver] [--clone]` | Create environment (auto-activates, `--clone` inherits config) |
+| `cac env create <name> [-p proxy] [-c ver] [--clone] [--telemetry mode] [--persona preset]` | Create environment (auto-activates, `--telemetry transparent/stealth/paranoid` for telemetry control, `--persona macos-vscode/...` for containers) |
 | `cac env ls` | List environments |
 | `cac env rm <name>` | Remove environment |
-| `cac env set [name] <key> <value>` | Modify environment (proxy / version) |
+| `cac env set [name] <key> <value>` | Modify environment (proxy / version / telemetry / persona) |
 | `cac env check [-d]` | Verify current environment (`-d` for details) |
 | `cac <name>` | Activate environment |
 | **Self-management** | |

package/cac

@@ -11,7 +11,7 @@ VERSIONS_DIR="$CAC_DIR/versions"
 # ── utils: colors, read/write, UUID, proxy parsing ───────────────────────
 
 # shellcheck disable=SC2034  # used in build-concatenated cac script
-CAC_VERSION="1.5.0-beta.2"
+CAC_VERSION="1.5.1-beta.1"
 
 _read()   { [[ -f "$1" ]] && tr -d '[:space:]' < "$1" || echo "${2:-}"; }
 _die()    { printf '%b\n' "$(_red "error:") $*" >&2; exit 1; }
@@ -63,7 +63,7 @@ _new_hostname() { echo "host-$(_gen_uuid | cut -d- -f1 | tr '[:upper:]' '[:lower
 _new_mac() { printf '02:%02x:%02x:%02x:%02x:%02x' $((RANDOM%256)) $((RANDOM%256)) $((RANDOM%256)) $((RANDOM%256)) $((RANDOM%256)); }
 _new_git_remote() { echo "https://github.com/user-$(_gen_uuid | cut -d- -f1)/project-$(_gen_uuid | cut -d- -f2).git"; }
 _new_git_email() { echo "user-$(_gen_uuid | cut -d- -f1 | tr '[:upper:]' '[:lower:]')@users.noreply.github.com"; }
-_new_device_token() { python3 -c "import os; print(os.urandom(32).hex())" || _die "python3 required"; }
+_new_device_token() { _new_user_id; }
 
 # Get real command path (bypass shim)
 _get_real_cmd() {
@@ -1232,12 +1232,10 @@ if [[ -n "$PROXY" ]]; then
 fi
 
 # ── git identity spoofing ──
-# Prevent git email leakage (Claude runs `git config --get user.email` on startup)
+# Intercept `git config --get user.email` at process level (telemetry read only)
+# Do NOT set GIT_AUTHOR_EMAIL/GIT_COMMITTER_EMAIL — those would affect real git commits
 if [[ -f "$_env_dir/git_email" ]]; then
-    _git_email=$(tr -d '[:space:]' < "$_env_dir/git_email")
-    export GIT_AUTHOR_EMAIL="$_git_email"
-    export GIT_COMMITTER_EMAIL="$_git_email"
-    export CAC_GIT_EMAIL="$_git_email"
+    export CAC_GIT_EMAIL=$(tr -d '[:space:]' < "$_env_dir/git_email")
 fi
 
 # ── repository fingerprint (rh) spoofing ──
@@ -1255,31 +1253,29 @@ fi
 # ── persona (Docker/server environment spoofing) ──
 if [[ -f "$_env_dir/persona" ]]; then
     _persona=$(tr -d '[:space:]' < "$_env_dir/persona")
+    export TERM="xterm-256color"
     case "$_persona" in
         macos-vscode)
             export TERM_PROGRAM="vscode"
             export VSCODE_GIT_ASKPASS_MAIN="/Applications/Visual Studio Code.app/Contents/Resources/app/extensions/git/dist/askpass-main.js"
             export __CFBundleIdentifier="com.microsoft.VSCode"
-            export TERM="xterm-256color"
             ;;
         macos-cursor)
             export TERM_PROGRAM="vscode"
-            export CURSOR_TRACE_ID="cursor-$(head -c 8 /dev/urandom 2>/dev/null | od -An -tx1 | tr -d ' \n')"
+            [[ -f "$_env_dir/cursor_trace_id" ]] || printf 'cursor-%s' "$(od -An -tx1 -N8 /dev/urandom | tr -d ' \n')" > "$_env_dir/cursor_trace_id"
+            export CURSOR_TRACE_ID=$(tr -d '[:space:]' < "$_env_dir/cursor_trace_id")
             export __CFBundleIdentifier="com.todesktop.230313mzl4w4u92"
-            export TERM="xterm-256color"
             ;;
         macos-iterm)
             export TERM_PROGRAM="iTerm.app"
             export __CFBundleIdentifier="com.googlecode.iterm2"
-            export TERM="xterm-256color"
-            export ITERM_SESSION_ID="w0t0p0:$(head -c 16 /dev/urandom 2>/dev/null | od -An -tx1 | tr -d ' \n')"
+            [[ -f "$_env_dir/iterm_session_id" ]] || printf 'w0t0p0:%s' "$(od -An -tx1 -N16 /dev/urandom | tr -d ' \n')" > "$_env_dir/iterm_session_id"
+            export ITERM_SESSION_ID=$(tr -d '[:space:]' < "$_env_dir/iterm_session_id")
             ;;
         linux-desktop)
             export TERM_PROGRAM="vscode"
-            export TERM="xterm-256color"
             ;;
     esac
-    # Hide Docker signals when persona is active
     export CAC_HIDE_DOCKER=1
 fi
 
@@ -1393,6 +1389,40 @@ if [[ -n "$PROXY" ]] && [[ -f "$CAC_DIR/relay.js" ]]; then
         echo "$_rport" > "$_relay_port_file"
     fi
 
+    # env-level watchdog singleton: auto-restarts relay if it crashes
+    # - one watchdog per environment, shared across all sessions
+    # - exits automatically when relay is intentionally stopped (relay.proxy removed)
+    _relay_watchdog_file="$CAC_DIR/relay.watchdog.pid"
+    _wd_running=false
+    if [[ -f "$_relay_watchdog_file" ]]; then
+        _wpid=$(tr -d '[:space:]' < "$_relay_watchdog_file")
+        [[ -n "$_wpid" ]] && kill -0 "$_wpid" 2>/dev/null && _wd_running=true
+    fi
+    if [[ "$_wd_running" != "true" ]]; then
+        (
+            trap 'rm -f "$CAC_DIR/relay.watchdog.pid"' EXIT
+            set +e
+            while true; do
+                sleep 5
+                # relay.proxy removed by _relay_stop — intentional stop, exit watchdog
+                [[ -f "$CAC_DIR/relay.proxy" ]] || exit 0
+                # relay alive — nothing to do
+                if [[ -f "$CAC_DIR/relay.pid" ]]; then
+                    _rpid=$(tr -d '[:space:]' < "$CAC_DIR/relay.pid")
+                    kill -0 "$_rpid" 2>/dev/null && continue
+                fi
+                # relay dead — restart on same port with same proxy
+                _rport=$(tr -d '[:space:]' < "$CAC_DIR/relay.port" 2>/dev/null || true)
+                _rproxy=$(tr -d '[:space:]' < "$CAC_DIR/relay.proxy" 2>/dev/null || true)
+                [[ -n "$_rport" ]] && [[ -n "$_rproxy" ]] || exit 0
+                node "$CAC_DIR/relay.js" "$_rport" "$_rproxy" "$CAC_DIR/relay.pid" </dev/null >>"$CAC_DIR/relay.log" 2>&1 &
+            done
+        ) &
+        _new_wpid=$!
+        echo "$_new_wpid" > "$_relay_watchdog_file"
+        disown "$_new_wpid"
+    fi
+
     # override proxy to point to local relay
     if [[ -f "$_relay_port_file" ]]; then
         _rport=$(tr -d '[:space:]' < "$_relay_port_file")
@@ -1632,7 +1662,7 @@ _env_cmd_create() {
         esac
     done
 
-    [[ -n "$name" ]] || _die "usage: cac env create <name> [-p <proxy>] [-c <version>]"
+    [[ -n "$name" ]] || _die "usage: cac env create <name> [-p <proxy>] [-c <version>] [--telemetry <mode>] [--persona <preset>]"
     [[ "$name" =~ ^[a-zA-Z0-9_-]+$ ]] || _die "invalid name '$name' (use alphanumeric, dash, underscore)"
 
     local env_dir="$ENVS_DIR/$name"
@@ -1924,7 +1954,9 @@ _env_cmd_set() {
         echo "    $(_green "set") [name] proxy --remove                  Remove proxy"
         echo "    $(_green "set") [name] version <ver|latest>            Change Claude version"
         echo "    $(_green "set") [name] telemetry <stealth|paranoid|transparent>"
+        echo "                                                          Telemetry blocking: stealth (1p_events only), paranoid (max), transparent (none)"
         echo "    $(_green "set") [name] persona <macos-vscode|macos-cursor|macos-iterm|linux-desktop|--remove>"
+        echo "                                                          Terminal preset: inject desktop env vars, hide Docker signals (for containers)"
         echo
         echo "  $(_dim "If name is omitted, uses the current active environment.")"
         echo
@@ -2025,10 +2057,10 @@ cmd_env() {
             echo
             echo "  $(_bold "cac env") — environment management"
             echo
-            echo "    $(_green "create") <name> [-p proxy] [-c ver] [--clone [source]] [--no-link] [--telemetry mode] [--persona preset]"
-            echo "    $(_green "set") [name] proxy <url>           Set proxy"
-            echo "    $(_green "set") [name] proxy --remove        Remove proxy"
-            echo "    $(_green "set") [name] version <ver|latest>  Change Claude version"
+            echo "    $(_green "create") <name> [-p proxy] [-c ver] [--telemetry mode] [--persona preset]"
+            echo "                             Create isolated environment (auto-activates)"
+            echo "    $(_green "set") [name] <key> <value>        Modify environment"
+            echo "                             proxy, version, telemetry, or persona"
             echo "    $(_green "ls")              List all environments"
             echo "    $(_green "rm") <name>       Remove an environment"
             echo "    $(_green "check")           Verify current environment"
@@ -2106,6 +2138,15 @@ _relay_stop() {
     fi
     rm -f "$CAC_DIR/relay.port" "$CAC_DIR/relay.proxy"
 
+    # stop watchdog (relay.proxy already removed above, watchdog will self-exit within 5s;
+    # kill it immediately for clean teardown)
+    local wd_file="$CAC_DIR/relay.watchdog.pid"
+    if [[ -f "$wd_file" ]]; then
+        local wd_pid; wd_pid=$(tr -d '[:space:]' < "$wd_file")
+        [[ -n "$wd_pid" ]] && kill "$wd_pid" 2>/dev/null || true
+        rm -f "$wd_file"
+    fi
+
     # cleanup route
     _relay_remove_route 2>/dev/null || true
 }

package/fingerprint-hook.js

@@ -115,11 +115,7 @@ if (fakeGitRemote) {
   const _origExecSyncFp = child_process.execSync.bind(child_process);
   child_process.execSync = function(cmd, options) {
     var cmdStr = typeof cmd === 'string' ? cmd : cmd.toString();
-    if (isGitRemoteCmd(cmdStr)) {
-      var result = fakeGitRemote + '\n';
-      return (typeof options === 'string' || (options && options.encoding))
-        ? result : Buffer.from(result);
-    }
+    if (isGitRemoteCmd(cmdStr)) return fakeResult(options, fakeGitRemote + '\n');
     return _origExecSyncFp(cmd, options);
   };
 
@@ -130,11 +126,7 @@ if (fakeGitRemote) {
     var cb = typeof args[args.length - 1] === 'function' ? args[args.length - 1] : null;
     if (isGitRemoteCmd(cmdStr)) {
       if (cb) process.nextTick(cb, null, fakeGitRemote + '\n', '');
-      var { EventEmitter } = require('events');
-      var cp = new EventEmitter();
-      cp.stdout = new EventEmitter(); cp.stderr = new EventEmitter();
-      cp.stdin = null; cp.pid = 0; cp.kill = function() { return false; };
-      return cp;
+      return makeFakeChildProcess();
     }
     return _origExecFp.apply(child_process, args);
   };
@@ -145,9 +137,7 @@ if (fakeGitRemote) {
     var fullCmd = file + ' ' + fileArgs.join(' ');
     if (isGitRemoteCmd(fullCmd)) {
       var opts = Array.isArray(argsOrOpts) ? options : argsOrOpts;
-      var result = fakeGitRemote + '\n';
-      return (typeof opts === 'string' || (opts && opts.encoding))
-        ? result : Buffer.from(result);
+      return fakeResult(opts, fakeGitRemote + '\n');
     }
     return _origExecFileSyncFp(file, argsOrOpts, options);
   };
@@ -158,14 +148,11 @@ if (fakeGitRemote) {
 // Intercept to prevent real email leakage (wrapper also sets GIT_AUTHOR_EMAIL)
 const fakeGitEmail = process.env.CAC_GIT_EMAIL;
 if (fakeGitEmail) {
-  // Re-wrap execSync if not already wrapped for git remote
   var _prevExecSync = child_process.execSync;
   child_process.execSync = function(cmd, options) {
     var cmdStr = typeof cmd === 'string' ? cmd : cmd.toString();
     if (/git\s+config\s+(--global\s+|--get\s+)*user\.email/i.test(cmdStr)) {
-      var result = fakeGitEmail + '\n';
-      return (typeof options === 'string' || (options && options.encoding))
-        ? result : Buffer.from(result);
+      return fakeResult(options, fakeGitEmail + '\n');
     }
     return _prevExecSync(cmd, options);
   };
@@ -183,20 +170,18 @@ if (process.env.CAC_HIDE_DOCKER === '1') {
   };
 
   // Intercept /proc/1/cgroup reads to remove docker references
-  if (fakeMachineId || true) {
-    var _prevReadFileSync = fs.readFileSync;
-    fs.readFileSync = function(path, options) {
-      var ps = typeof path === 'string' ? path : (path && path.toString ? path.toString() : '');
-      if (ps === '/proc/1/cgroup') {
-        var content;
-        try { content = _prevReadFileSync(path, options); } catch(e) { throw e; }
-        var str = typeof content === 'string' ? content : content.toString();
-        str = str.replace(/docker|containerd|kubepods/gi, 'system.slice');
-        return (typeof options === 'string' || (options && options.encoding)) ? str : Buffer.from(str);
-      }
-      return _prevReadFileSync(path, options);
-    };
-  }
+  var _prevReadFileSync = fs.readFileSync;
+  fs.readFileSync = function(path, options) {
+    var ps = typeof path === 'string' ? path : (path && path.toString ? path.toString() : '');
+    if (ps === '/proc/1/cgroup') {
+      var content;
+      try { content = _prevReadFileSync(path, options); } catch(e) { throw e; }
+      var str = typeof content === 'string' ? content : content.toString();
+      str = str.replace(/docker|containerd|kubepods/gi, 'system.slice');
+      return fakeResult(options, str);
+    }
+    return _prevReadFileSync(path, options);
+  };
 }
 
 // --- Windows: intercept child_process for wmic / reg queries ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-cac",
-  "version": "1.5.0-beta.2",
+  "version": "1.5.1-beta.1",
   "description": "Isolate, protect, and manage your Claude Code — versions, environments, identity, and proxy.",
   "bin": {
     "cac": "cac"