- references/zero-to-deployed.md: nine phases from eligibility to maintenance,
who runs each one, checkpoints and stop conditions; account work is operator-only
- preflight: read-only readiness report (platform, systemd, bash, clock,
timezone, IPv6, disk, Node, gated/ungated Claude, live exit), PASS/WARN/FAIL
plus blocker count, --json for tooling
- README/README.zh-CN/AGENTS.md: from-zero section ahead of the installer
- 2 new self-tests, 44 total
- install.sh: install from a checkout or via curl|bash, tag-pinned download,
--skill-only / --uninstall / --dry-run / --yes, ends with verify --deep
- set-exit: follow a rotating exit, probe first, rewrite policy only when the
proxy serves the candidate address, then re-verify
- LOG_REFUSALS=1: refusals go to journald under claude-egress-guard
- AGENTS.md, llms.txt, Makefile: machine entry points and make check
- README/README.zh-CN rewritten for two audiences (agents, humans) with a real
verify sample, compatibility table, per-start cost, rotation, logging and an
explicit out-of-scope list (npx, second installs, containers, root, SOCKS)
- default allow list is 127.0.0.0/8 so systemd-resolved keeps working
- 11 new self-tests, 42 total
Fail-closed egress gate for Claude Code on Linux, packaged as an agent skill.
- binary-level gate at /usr/local/bin/claude and /usr/bin/claude with the real
binary pinned under /opt/claude-real, so cron, Python, systemd and absolute
paths are covered
- exit address and country checked before every start; mismatch or timeout
refuses with exit 77 and never falls back to a direct connection
- optional kernel jail (systemd scope, IPAddressDeny=any) for the whole process
tree, with loopback, proxy upstream, DNS resolvers and operator CIDRs allowed
- self-heal after package updates that rewrite /usr/bin/claude
- installer with dry-run, backups and uninstall; verify/verify --deep/status/drill
- sandboxed self-test suite, shellcheck and leak scanner in CI
yinyues2