claude-cn-flag-check 0.1.0

package/src/detect.js

@@ -0,0 +1,233 @@
+'use strict';
+
+/**
+ * Faithful re-implementation of the region-marking logic found inside
+ * Claude Code's bundled binary (verified against @anthropic-ai/claude-code
+ * 2.1.170, feature introduced in 2.1.91).
+ *
+ * The original (de-obfuscated) functions, for reference:
+ *
+ *   var x65 = 91;                                   // XOR key
+ *   function U65() {                                // hostname of ANTHROPIC_BASE_URL
+ *     let H = process.env.ANTHROPIC_BASE_URL;
+ *     if (!H) return null;
+ *     try { return new URL(H).hostname.toLowerCase() } catch { return null }
+ *   }
+ *   function F_() {                                 // "is first party" guard
+ *     if (_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL) return true;
+ *     let H = process.env.ANTHROPIC_BASE_URL;
+ *     if (!H) return true;
+ *     try { return ["api.anthropic.com"].includes(new URL(H).host) } catch { return false }
+ *   }
+ *   function F65() {                                // the three signals
+ *     if (F_()) return null;
+ *     let H = U65(), tz = Wz$(),
+ *         cnTZ = tz === "Asia/Shanghai" || tz === "Asia/Urumqi";
+ *     if (!H) return { known:false, labKw:false, cnTZ, host:null };
+ *     return {
+ *       known: B65().some(k => H === k || H.endsWith("." + k)),
+ *       labKw: p65().some(k => H.includes(k)),
+ *       cnTZ, host: H
+ *     };
+ *   }
+ *   function Q65(known, labKw) {                    // steganographic apostrophe
+ *     if (!known && !labKw) return "'";             // U+0027
+ *     if ( known && !labKw) return "’";        // U+2019
+ *     if (!known &&  labKw) return "ʼ";        // U+02BC
+ *     return "ʹ";                              // U+02B9 (both)
+ *   }
+ *   function MP7(dateStr) {                         // the line actually sent
+ *     let s = F65(), q = Q65(s?.known ?? false, s?.labKw ?? false),
+ *         d = s?.cnTZ ? dateStr.replaceAll("-", "/") : dateStr;
+ *     return `Today${q}s date is ${d}.`;
+ *   }
+ *
+ * Detection only runs for third-party base URLs (relays/proxies). On the
+ * official endpoint (or with no ANTHROPIC_BASE_URL) F_() short-circuits and
+ * nothing is ever embedded — regardless of your timezone.
+ */
+
+const CN_TIMEZONES = new Set(['Asia/Shanghai', 'Asia/Urumqi']);
+
+// Risk weights for the three real CLI signals. The timezone leaks even through
+// a proxy, so it carries the most weight. The score is a graded severity /
+// exposure indicator (0-100); `marked` remains the deterministic yes/no.
+const WEIGHTS = { cnTZ: 40, known: 35, labKw: 25 };
+
+function levelOf(score) {
+  if (score === 0) return 'safe';
+  if (score <= 30) return 'low';
+  if (score <= 60) return 'medium';
+  return 'high';
+}
+
+// The four apostrophe variants and what each encodes. U+0027 is the normal
+// carrier (no China signal); the other three are the covert markers.
+const APOSTROPHE = {
+  none: '\u0027', // U+0027 apostrophe — no domain/lab hit (normal carrier)
+  known: '\u2019', // U+2019 — relay host matches the domain list
+  labKw: '\u02BC', // U+02BC — relay host contains an AI-lab keyword
+  both: '\u02B9', // U+02B9 — matches the list AND a lab keyword
+};
+
+/** Read the timezone exactly the way Claude Code does (Wz$). */
+function resolveTimezone() {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || null;
+  } catch {
+    return null;
+  }
+}
+
+/** Port of U65(): hostname of a base URL, lower-cased, or null. */
+function hostnameOf(baseUrl) {
+  if (!baseUrl) return null;
+  try {
+    return new URL(baseUrl).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Port of F_(): true when the base URL is treated as first-party, meaning the
+ * detection is skipped entirely.
+ */
+function isFirstParty(baseUrl, assumeFirstParty) {
+  if (assumeFirstParty) return true;
+  if (!baseUrl) return true;
+  try {
+    // NB: the original compares URL.host (may include a port), not hostname.
+    return ['api.anthropic.com'].includes(new URL(baseUrl).host);
+  } catch {
+    return false;
+  }
+}
+
+function matchesDomain(host, domains) {
+  return domains.some((d) => host === d || host.endsWith('.' + d));
+}
+
+function matchesLabKeyword(host, keywords) {
+  return keywords.some((k) => host.includes(k));
+}
+
+/** Port of Q65(). */
+function pickApostrophe(known, labKw) {
+  if (!known && !labKw) return APOSTROPHE.none;
+  if (known && !labKw) return APOSTROPHE.known;
+  if (!known && labKw) return APOSTROPHE.labKw;
+  return APOSTROPHE.both;
+}
+
+function toCodepoint(ch) {
+  return 'U+' + ch.codePointAt(0).toString(16).toUpperCase().padStart(4, '0');
+}
+
+/**
+ * Assemble the full report from resolved signals + carrier bits. Shared by the
+ * computed path (analyze) and the observed path (real capture).
+ */
+function assembleReport(o) {
+  const { baseUrl, host, timezone, assumeFirstParty, date, firstParty, cnTZ, known, labKw, observed = false } = o;
+  const embeddedSignal = !firstParty;
+  const apostrophe = o.apostrophe != null ? o.apostrophe : embeddedSignal ? pickApostrophe(known, labKw) : APOSTROPHE.none;
+  const separatorSwapped = o.separatorSwapped != null ? o.separatorSwapped : embeddedSignal && cnTZ;
+  const dateOut = separatorSwapped ? date.replaceAll('-', '/') : date;
+  const dateLine = o.dateLine != null ? o.dateLine : `Today${apostrophe}s date is ${dateOut}.`;
+
+  const marked = embeddedSignal && (cnTZ || known || labKw);
+  const score = embeddedSignal
+    ? (cnTZ ? WEIGHTS.cnTZ : 0) + (known ? WEIGHTS.known : 0) + (labKw ? WEIGHTS.labKw : 0)
+    : 0;
+  const level = levelOf(score);
+
+  const features = [];
+  if (embeddedSignal) {
+    if (cnTZ) features.push({ id: 'cnTZ', weight: 'date separator' });
+    if (known) features.push({ id: 'known', weight: 'apostrophe' });
+    if (labKw) features.push({ id: 'labKw', weight: 'apostrophe' });
+  }
+
+  return {
+    input: { baseUrl, host, timezone, assumeFirstParty, date },
+    firstParty,
+    embeddedSignal,
+    observed,
+    signals: { cnTZ, known, labKw },
+    carrier: {
+      apostrophe,
+      apostropheCodepoint: toCodepoint(apostrophe),
+      separatorSwapped,
+      dateLine,
+      dateLineHex: [...dateLine].map((c) => c.codePointAt(0).toString(16).padStart(4, '0')).join(' '),
+    },
+    marked,
+    score,
+    level,
+    weights: WEIGHTS,
+    features,
+  };
+}
+
+/**
+ * Analyse (compute) what Claude Code *would* embed for the given inputs.
+ * This is the prediction path; the observed path lives in capture.js.
+ *
+ * @param {object}   opts
+ * @param {string=}  opts.baseUrl           value of ANTHROPIC_BASE_URL
+ * @param {string=}  opts.timezone          IANA zone (defaults to live system zone)
+ * @param {boolean=} opts.assumeFirstParty  _CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL
+ * @param {string[]} opts.domains           the 147-entry domain list
+ * @param {string[]} opts.labKeywords       the AI-lab keyword list
+ * @param {string=}  opts.date              date string to template (YYYY-MM-DD)
+ * @returns {object} full report
+ */
+function analyze(opts) {
+  const {
+    baseUrl = process.env.ANTHROPIC_BASE_URL || null,
+    timezone = resolveTimezone(),
+    assumeFirstParty = false,
+    domains = [],
+    labKeywords = [],
+    date = isoDate(),
+  } = opts || {};
+
+  const host = hostnameOf(baseUrl);
+  const cnTZ = timezone != null && CN_TIMEZONES.has(timezone);
+  const firstParty = isFirstParty(baseUrl, assumeFirstParty);
+
+  let known = false;
+  let labKw = false;
+  if (!firstParty && host) {
+    known = matchesDomain(host, domains);
+    labKw = matchesLabKeyword(host, labKeywords);
+  }
+
+  return assembleReport({ baseUrl, host, timezone, assumeFirstParty, date, firstParty, cnTZ, known, labKw, observed: false });
+}
+
+/** Local calendar date as YYYY-MM-DD (the shape Claude Code templates). */
+function isoDate(d = new Date()) {
+  const y = d.getFullYear();
+  const m = String(d.getMonth() + 1).padStart(2, '0');
+  const day = String(d.getDate()).padStart(2, '0');
+  return `${y}-${m}-${day}`;
+}
+
+module.exports = {
+  CN_TIMEZONES,
+  WEIGHTS,
+  APOSTROPHE,
+  levelOf,
+  resolveTimezone,
+  hostnameOf,
+  isFirstParty,
+  matchesDomain,
+  matchesLabKeyword,
+  pickApostrophe,
+  toCodepoint,
+  isoDate,
+  assembleReport,
+  analyze,
+};

package/src/extract.js

@@ -0,0 +1,155 @@
+'use strict';
+
+/**
+ * Extract the live domain / lab-keyword lists from an installed Claude Code
+ * binary, so the checker always reflects the version you actually run.
+ *
+ * The lists are stored as base64 blobs that are XOR-encoded with a single-byte
+ * key (91 in 2.1.170). Minified identifiers change between releases, so instead
+ * of grepping for a specific variable name we scan every long base64 literal,
+ * brute-force the XOR key, and keep whichever blob decodes to a plausible list
+ * containing a known sentinel token.
+ */
+
+const fs = require('fs');
+const { execFileSync } = require('child_process');
+
+const DOMAIN_SENTINELS = ['baidu.com', 'alibaba-inc.com', 'bytedance.net'];
+const KEYWORD_SENTINELS = ['deepseek', 'moonshot', 'dashscope'];
+
+/** Best-effort resolve the path of the installed `claude` binary. */
+function resolveBinaryPath() {
+  const envPath = process.env.CLAUDE_BINARY;
+  if (envPath && fs.existsSync(envPath)) return fs.realpathSync(envPath);
+
+  const candidates = [];
+  try {
+    const which = execFileSync(process.platform === 'win32' ? 'where' : 'which', ['claude'], {
+      encoding: 'utf8',
+    })
+      .split(/\r?\n/)
+      .filter(Boolean);
+    for (const p of which) {
+      try {
+        candidates.push(fs.realpathSync(p));
+      } catch {
+        candidates.push(p);
+      }
+    }
+  } catch {
+    /* `which`/`where` not available or claude not on PATH */
+  }
+
+  candidates.push(
+    '/usr/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe',
+    '/usr/local/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe',
+    `${process.env.HOME || ''}/.local/share/claude/claude.exe`,
+  );
+
+  for (const p of candidates) {
+    try {
+      if (p && fs.statSync(p).size > 0) return p;
+    } catch {
+      /* not here */
+    }
+  }
+  return null;
+}
+
+function xorDecode(buf, key) {
+  let s = '';
+  for (const b of buf) s += String.fromCharCode(b ^ key);
+  return s;
+}
+
+function looksLikeList(str, sentinels) {
+  if (!str.includes(',')) return false;
+  const parts = str.split(',');
+  if (parts.length < 3) return false;
+  // Reject blobs that decoded to garbage: entries should be host-ish tokens.
+  const clean = parts.filter((p) => /^[a-z0-9][a-z0-9.\-]*$/.test(p));
+  if (clean.length / parts.length < 0.8) return false;
+  return sentinels.some((s) => parts.includes(s) || str.includes(s));
+}
+
+/**
+ * @param {string=} binaryPath  path to claude binary (auto-detected if omitted)
+ * @returns {{domains:string[], labKeywords:string[], xorKey:number,
+ *            binaryPath:string, version:?string} | null}
+ */
+function extractLists(binaryPath) {
+  const bin = binaryPath || resolveBinaryPath();
+  if (!bin) return null;
+
+  let text;
+  try {
+    text = fs.readFileSync(bin, 'latin1');
+  } catch {
+    return null;
+  }
+
+  // Candidate base64 literals. The keyword list is short (~116 chars); the
+  // domain list is large. Keep the floor low enough to catch both.
+  const blobs = new Set();
+  const re = /["'`]([A-Za-z0-9+/]{80,}={0,2})["'`]/g;
+  let m;
+  while ((m = re.exec(text)) !== null) blobs.add(m[1]);
+
+  // Candidate XOR keys: prefer any that appear in `fromCharCode(x ^ N)`, then
+  // fall back to the full byte range.
+  const keyHints = new Set();
+  const keyRe = /fromCharCode\([^)]*\^\s*(\d{1,3})\s*\)/g;
+  while ((m = keyRe.exec(text)) !== null) keyHints.add(Number(m[1]));
+  const keys = [...keyHints, ...Array.from({ length: 256 }, (_, i) => i)];
+
+  let domains = null;
+  let labKeywords = null;
+  let usedKey = null;
+
+  for (const b64 of blobs) {
+    let raw;
+    try {
+      raw = Buffer.from(b64, 'base64');
+    } catch {
+      continue;
+    }
+    if (raw.length < 8) continue;
+    // Once we know the real key (from the domain blob), try it first so the
+    // short keyword blob resolves on the first attempt instead of brute force.
+    const tryKeys = usedKey != null ? [usedKey, ...keys] : keys;
+    for (const key of tryKeys) {
+      const decoded = xorDecode(raw, key);
+      if (!domains && looksLikeList(decoded, DOMAIN_SENTINELS)) {
+        domains = decoded.split(',');
+        usedKey = key;
+      } else if (!labKeywords && looksLikeList(decoded, KEYWORD_SENTINELS)) {
+        labKeywords = decoded.split(',');
+        usedKey = usedKey ?? key;
+      }
+      if (domains && labKeywords) break;
+    }
+    if (domains && labKeywords) break;
+  }
+
+  if (!domains && !labKeywords) return null;
+
+  return {
+    domains: domains || [],
+    labKeywords: labKeywords || [],
+    xorKey: usedKey,
+    binaryPath: bin,
+    version: detectVersion(bin),
+  };
+}
+
+function detectVersion(bin) {
+  // Try the package.json that ships next to the binary.
+  try {
+    const pkg = bin.replace(/bin[\\/][^\\/]+$/, 'package.json');
+    return JSON.parse(fs.readFileSync(pkg, 'utf8')).version || null;
+  } catch {
+    return null;
+  }
+}
+
+module.exports = { resolveBinaryPath, extractLists };

package/src/index.js

@@ -0,0 +1,197 @@
+'use strict';
+
+const detect = require('./detect');
+const snapshot = require('./snapshot');
+const { extractLists, resolveBinaryPath } = require('./extract');
+const { resolveConfig } = require('./resolve');
+const { captureReal, CaptureError } = require('./capture');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+/**
+ * Resolve the signal lists. By default we extract them live from the installed
+ * Claude Code binary (so the answer matches the version you actually run) and
+ * fall back to the bundled snapshot if extraction fails.
+ *
+ * @param {object=} opts
+ * @param {boolean=} opts.preferSnapshot  skip extraction, use the bundled lists
+ * @param {string=}  opts.binaryPath      explicit path to the claude binary
+ * @returns {{domains,labKeywords,xorKey,source,version,binaryPath}}
+ */
+function getSignalLists(opts = {}) {
+  if (!opts.preferSnapshot) {
+    const live = extractLists(opts.binaryPath);
+    if (live && live.domains.length) {
+      return { ...live, source: 'binary' };
+    }
+  }
+  return {
+    domains: snapshot.domains,
+    labKeywords: snapshot.labKeywords,
+    xorKey: snapshot.xorKey,
+    version: snapshot.sourceVersion,
+    binaryPath: null,
+    source: 'snapshot',
+  };
+}
+
+/**
+ * High-level check of the current (or a hypothetical) environment.
+ *
+ * Base URL / timezone are resolved from real config sources (settings.json env
+ * blocks, system timezone) — not just process.env — unless overridden via opts.
+ *
+ * @param {object=} opts  overrides for analyze() plus list-loading options
+ * @returns {object} report with `.lists` and `.resolution` metadata attached
+ */
+function check(opts = {}) {
+  const lists = getSignalLists(opts);
+  const resolved = resolveConfig({ cwd: opts.cwd, home: opts.home });
+
+  const baseUrl = opts.baseUrl !== undefined ? opts.baseUrl : resolved.baseUrl.value || null;
+  const timezone = opts.timezone !== undefined ? opts.timezone : resolved.timezone.value;
+  const assumeFirstParty =
+    opts.assumeFirstParty !== undefined ? opts.assumeFirstParty : resolved.assumeFirstParty.value;
+
+  const report = detect.analyze({
+    baseUrl,
+    timezone,
+    assumeFirstParty,
+    domains: lists.domains,
+    labKeywords: lists.labKeywords,
+    date: opts.date,
+  });
+  report.lists = {
+    source: lists.source,
+    version: lists.version,
+    binaryPath: lists.binaryPath,
+    domainCount: lists.domains.length,
+    keywordCount: lists.labKeywords.length,
+  };
+  report.resolution = resolved;
+  report.overrides = {
+    baseUrl: opts.baseUrl !== undefined,
+    timezone: opts.timezone !== undefined,
+    assumeFirstParty: opts.assumeFirstParty !== undefined,
+  };
+  return report;
+}
+
+/** Convenience boolean: would this environment be flagged as a China request? */
+function isClaudeChinaUser(opts = {}) {
+  return check(opts).marked;
+}
+
+// Map an observed apostrophe character back to the domain/keyword signals.
+const APOSTROPHE_SIGNALS = {
+  [detect.APOSTROPHE.none]: { known: false, labKw: false },
+  [detect.APOSTROPHE.known]: { known: true, labKw: false },
+  [detect.APOSTROPHE.labKw]: { known: false, labKw: true },
+  [detect.APOSTROPHE.both]: { known: true, labKw: true },
+};
+
+function readUserModel(home) {
+  try {
+    const j = JSON.parse(fs.readFileSync(path.join(home || os.homedir(), '.claude', 'settings.json'), 'utf8'));
+    return typeof j.model === 'string' ? j.model : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * REAL check: run Claude Code once and observe the marker it actually emits.
+ * Falls back to computed analysis only for what-if overrides, first-party
+ * endpoints (certain-safe, nothing to observe), or when explicitly allowed.
+ *
+ * @param {object=} opts
+ *   opts.noCapture   — skip capture, use computed prediction
+ *   opts.captureTimeoutMs, opts.log — passthrough to captureReal
+ * @returns {Promise<object>} report (report.observed indicates real capture)
+ */
+async function checkLive(opts = {}) {
+  const lists = getSignalLists(opts);
+  const resolved = resolveConfig({ cwd: opts.cwd, home: opts.home });
+
+  const whatIf = opts.baseUrl !== undefined || opts.timezone !== undefined;
+  const baseUrl = opts.baseUrl !== undefined ? opts.baseUrl : resolved.baseUrl.value || null;
+  const timezone = opts.timezone !== undefined ? opts.timezone : resolved.timezone.value;
+  const assumeFirstParty =
+    opts.assumeFirstParty !== undefined ? opts.assumeFirstParty : resolved.assumeFirstParty.value;
+
+  const attach = (report, extra) => {
+    report.lists = {
+      source: lists.source,
+      version: lists.version,
+      binaryPath: lists.binaryPath,
+      domainCount: lists.domains.length,
+      keywordCount: lists.labKeywords.length,
+    };
+    report.resolution = resolved;
+    report.overrides = {
+      baseUrl: opts.baseUrl !== undefined,
+      timezone: opts.timezone !== undefined,
+      assumeFirstParty: opts.assumeFirstParty !== undefined,
+    };
+    report.capture = extra;
+    return report;
+  };
+
+  const firstParty = detect.isFirstParty(baseUrl, assumeFirstParty);
+
+  // Cases where a real capture is impossible or pointless → computed result.
+  if (whatIf) {
+    return attach(check({ ...opts }), { mode: 'computed', reason: 'what-if 覆盖,无法实测假设环境' });
+  }
+  if (firstParty) {
+    // First-party is certain-safe by the guard logic (verified in the binary);
+    // there is no marker to observe.
+    return attach(check({ ...opts }), { mode: 'first-party', reason: '第一方端点,确定不打标记,无需实测' });
+  }
+  if (opts.noCapture) {
+    return attach(check({ ...opts }), { mode: 'computed', reason: '--no-capture 指定,使用计算预测' });
+  }
+
+  // Real capture.
+  const host = detect.hostnameOf(baseUrl);
+  const obs = await captureReal({
+    host,
+    baseUrl,
+    model: readUserModel(opts.home),
+    timeoutMs: opts.captureTimeoutMs,
+    log: opts.log,
+  });
+
+  const sig = APOSTROPHE_SIGNALS[obs.apostrophe] || { known: false, labKw: false };
+  const report = detect.assembleReport({
+    baseUrl,
+    host,
+    timezone,
+    assumeFirstParty,
+    date: obs.date.replace(/\//g, '-'),
+    firstParty: false,
+    cnTZ: obs.separatorSwapped,
+    known: sig.known,
+    labKw: sig.labKw,
+    apostrophe: obs.apostrophe,
+    separatorSwapped: obs.separatorSwapped,
+    dateLine: obs.dateLine,
+    observed: true,
+  });
+  return attach(report, { mode: 'observed', reason: '真实运行 claude 并捕获其发出的 system prompt' });
+}
+
+module.exports = {
+  ...detect,
+  extractLists,
+  resolveBinaryPath,
+  resolveConfig,
+  captureReal,
+  CaptureError,
+  snapshot,
+  getSignalLists,
+  check,
+  checkLive,
+  isClaudeChinaUser,
+};