yinyues2
3fe43b7ddc
- install.sh: install from a checkout or via curl|bash, tag-pinned download, --skill-only / --uninstall / --dry-run / --yes, ends with verify --deep - set-exit: follow a rotating exit, probe first, rewrite policy only when the proxy serves the candidate address, then re-verify - LOG_REFUSALS=1: refusals go to journald under claude-egress-guard - AGENTS.md, llms.txt, Makefile: machine entry points and make check - README/README.zh-CN rewritten for two audiences (agents, humans) with a real verify sample, compatibility table, per-start cost, rotation, logging and an explicit out-of-scope list (npx, second installs, containers, root, SOCKS) - default allow list is 127.0.0.0/8 so systemd-resolved keeps working - 11 new self-tests, 42 total
32 lines
833 B
Makefile
32 lines
833 B
Makefile
SHELL := /bin/bash
|
|
SCRIPTS := skills/claude-egress-guard/scripts
|
|
SHELLCHECK ?= shellcheck
|
|
SHELLCHECK_FLAGS ?= -x -S warning
|
|
|
|
.PHONY: help lint test scan check install skill
|
|
|
|
help:
|
|
@printf '%s\n' \
|
|
'make check shellcheck + self-tests + leak scan (what CI runs)' \
|
|
'make lint shellcheck on every script' \
|
|
'make test 42 sandboxed assertions, no root and no network' \
|
|
'make scan privacy/secret scan' \
|
|
'make skill copy the skill into ~/.hermes/skills'
|
|
|
|
lint:
|
|
$(SHELLCHECK) $(SHELLCHECK_FLAGS) install.sh $(wildcard $(SCRIPTS)/*)
|
|
|
|
test:
|
|
@bash $(SCRIPTS)/selftest.sh
|
|
|
|
scan:
|
|
@python3 tools/leak-scan.py
|
|
|
|
check: lint test scan
|
|
|
|
install:
|
|
@sudo ./install.sh --help >/dev/null && echo 'run: sudo ./install.sh --proxy URL --exit-ip ADDR'
|
|
|
|
skill:
|
|
@./install.sh --skill-only --dest "$${DEST:-$$HOME/.hermes/skills}"
|