claude-cac 1.5.2 → 1.5.3

package/cac

@@ -11,7 +11,7 @@ VERSIONS_DIR="$CAC_DIR/versions"
 # ── utils: colors, read/write, UUID, proxy parsing ───────────────────────
 
 # shellcheck disable=SC2034  # used in build-concatenated cac script
-CAC_VERSION="1.5.2"
+CAC_VERSION="1.5.3"
 
 _read()   { [[ -f "$1" ]] && tr -d '[:space:]' < "$1" || echo "${2:-}"; }
 _die()    { printf '%b\n' "$(_red "error:") $*" >&2; exit 1; }
@@ -1273,7 +1273,9 @@ if [[ -f "$_env_dir/persona" ]]; then
 fi
 
 # ── NS-level DNS interception ──
-if [[ -f "$CAC_DIR/cac-dns-guard.js" ]]; then
+# Use -r (readable) not -f (exists) — root-owned files with mode 600 exist but
+# can't be read by normal user, causing bun/node to crash silently.
+if [[ -r "$CAC_DIR/cac-dns-guard.js" ]]; then
     case "${NODE_OPTIONS:-}" in
         *cac-dns-guard.js*) ;; # already injected, skip
         *) export NODE_OPTIONS="${NODE_OPTIONS:-} --require $CAC_DIR/cac-dns-guard.js" ;;
@@ -1284,7 +1286,7 @@ if [[ -f "$CAC_DIR/cac-dns-guard.js" ]]; then
     esac
 fi
 # fallback layer: HOSTALIASES (gethostbyname level)
-[[ -f "$CAC_DIR/blocked_hosts" ]] && export HOSTALIASES="$CAC_DIR/blocked_hosts"
+[[ -r "$CAC_DIR/blocked_hosts" ]] && export HOSTALIASES="$CAC_DIR/blocked_hosts"
 
 # ── mTLS client certificate ──
 if [[ -f "$_env_dir/client_cert.pem" ]] && [[ -f "$_env_dir/client_key.pem" ]]; then
@@ -1312,7 +1314,7 @@ fi
 [[ -f "$_env_dir/machine_id" ]]  && export CAC_MACHINE_ID=$(tr -d '[:space:]' < "$_env_dir/machine_id")
 export CAC_USERNAME="user-$(echo "$_name" | cut -c1-8)"
 export USER="$CAC_USERNAME" LOGNAME="$CAC_USERNAME"
-if [[ -f "$CAC_DIR/fingerprint-hook.js" ]]; then
+if [[ -r "$CAC_DIR/fingerprint-hook.js" ]]; then
     case "${NODE_OPTIONS:-}" in
         *fingerprint-hook.js*) ;;
         *) export NODE_OPTIONS="--require $CAC_DIR/fingerprint-hook.js ${NODE_OPTIONS:-}" ;;
@@ -1581,9 +1583,24 @@ _ensure_initialized() {
     if [[ -z "$_self_dir" ]] || [[ ! -f "$_self_dir/relay.js" ]]; then
         _self_dir="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
     fi
-    [[ -f "$_self_dir/fingerprint-hook.js" ]] && cp "$_self_dir/fingerprint-hook.js" "$CAC_DIR/fingerprint-hook.js"
-    [[ -f "$_self_dir/relay.js" ]] && cp "$_self_dir/relay.js" "$CAC_DIR/relay.js"
+    # Warn if running as root — files written here become root-owned and break
+    # normal-user invocations (wrapper has set -e and will silently exit).
+    if [[ $EUID -eq 0 ]]; then
+        echo "[cac] warning: running as root may corrupt ~/.cac/ file ownership" >&2
+        echo "[cac] hint: run as your normal user instead" >&2
+    fi
+    # rm -f first: user owns ~/.cac/ dir so can delete root-owned files even if can't overwrite them
+    if [[ -f "$_self_dir/fingerprint-hook.js" ]]; then
+        rm -f "$CAC_DIR/fingerprint-hook.js" 2>/dev/null || true
+        cp "$_self_dir/fingerprint-hook.js" "$CAC_DIR/fingerprint-hook.js" 2>/dev/null || true
+    fi
+    if [[ -f "$_self_dir/relay.js" ]]; then
+        rm -f "$CAC_DIR/relay.js" 2>/dev/null || true
+        cp "$_self_dir/relay.js" "$CAC_DIR/relay.js" 2>/dev/null || true
+    fi
+    rm -f "$CAC_DIR/cac-dns-guard.js" 2>/dev/null || true
     _write_dns_guard_js 2>/dev/null || true
+    rm -f "$CAC_DIR/blocked_hosts" 2>/dev/null || true
     _write_blocked_hosts 2>/dev/null || true
 
     # PATH (idempotent — always ensure it's in rc file)
@@ -1730,7 +1747,7 @@ _env_cmd_create() {
     mkdir -p "$env_dir"
     [[ -n "$proxy_url" ]] && echo "$proxy_url" > "$env_dir/proxy"
     echo "$(_new_uuid)"       > "$env_dir/uuid"
-    echo "$(_new_user_id)"    > "$env_dir/user_id"
+    touch "$env_dir/user_id"
     echo "$(_new_machine_id)" > "$env_dir/machine_id"
     echo "$(_new_hostname)"   > "$env_dir/hostname"
     echo "$(_new_mac)"        > "$env_dir/mac_address"
@@ -1823,7 +1840,6 @@ MERGE_EOF
     if [[ -d "$env_dir/.claude" ]]; then
         export CLAUDE_CONFIG_DIR="$env_dir/.claude"
     fi
-    _update_claude_json_user_id "$(_read "$env_dir/user_id")" 2>/dev/null || true
 
     local elapsed; elapsed=$(_timer_elapsed)
     echo
@@ -1919,7 +1935,6 @@ _env_cmd_activate() {
         export CLAUDE_CONFIG_DIR="$ENVS_DIR/$name/.claude"
     fi
 
-    _update_claude_json_user_id "$(_read "$ENVS_DIR/$name/user_id")"
 
     # Relay lifecycle
     _relay_stop 2>/dev/null || true
@@ -2429,23 +2444,18 @@ cmd_check() {
     else
         _id_issues+=("repo hash not spoofed")
     fi
-    # user_id consistency
+    # user_id tracking: sync from .claude.json after login (real userID wins)
     local _uid_ok=true
-    local _env_uid; _env_uid=$(_read "$env_dir/user_id" "")
-    if [[ -n "$_env_uid" ]]; then
-        local _config_dir="${CLAUDE_CONFIG_DIR:-$ENVS_DIR/$current/.claude}"
-        local _cj="$_config_dir/.claude.json"
-        [[ -f "$_cj" ]] || _cj="$HOME/.claude.json"
-        if [[ -f "$_cj" ]]; then
-            local _actual_uid
-            _actual_uid=$(python3 -c "import json,sys; print(json.load(open(sys.argv[1])).get('userID',''))" "$_cj" 2>/dev/null || true)
+    local _config_dir="${CLAUDE_CONFIG_DIR:-$ENVS_DIR/$current/.claude}"
+    local _cj="$_config_dir/.claude.json"
+    [[ -f "$_cj" ]] || _cj="$HOME/.claude.json"
+    if [[ -f "$_cj" ]]; then
+        local _actual_uid
+        _actual_uid=$(python3 -c "import json,sys; print(json.load(open(sys.argv[1])).get('userID',''))" "$_cj" 2>/dev/null || true)
+        if [[ -n "$_actual_uid" ]]; then
             (( _id_total++ )) || true
-            if [[ -n "$_actual_uid" ]] && [[ "$_actual_uid" != "$_env_uid" ]]; then
-                _uid_ok=false
-                _id_issues+=("user_id mismatch")
-            else
-                (( _id_ok++ )) || true
-            fi
+            echo "$_actual_uid" > "$env_dir/user_id" 2>/dev/null || true
+            (( _id_ok++ )) || true
         fi
     fi
     # billing header

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-cac",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "Isolate, protect, and manage your Claude Code — versions, environments, identity, and proxy.",
   "bin": {
     "cac": "cac"