Remove three active external data transmission paths:
1. WebFetch domain blocklist (api.anthropic.com/api/web/domain_info)
- src/tools/WebFetchTool/utils.ts
- Was sending every domain a user tried to fetch to Anthropic
- Replaced with always-allowed stub; tool permission dialog is
the primary security boundary
2. Codex API router (chatgpt.com/backend-api/codex/responses)
- src/services/api/codex-fetch-adapter.ts
- Would have forwarded full conversation content to OpenAI
- createCodexFetch now returns HTTP 403 stub
3. OpenAI API adapter (api.openai.com/v1/chat/completions)
- src/utils/codex-fetch-adapter.ts
- Would have forwarded messages to OpenAI
- fetchCodexResponse now throws immediately
Already-disabled paths (no changes needed):
- Analytics logEvent/logEventAsync: empty stubs in services/analytics/index.ts
- GrowthBook/Statsig: local cache only, no outbound requests
- Auto-updater GCS: already guarded by CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC
- MCP registry: already guarded by CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC
- Release notes GitHub: already guarded by isEssentialTrafficOnly()
Add .github/workflows/release.yml:
- Builds self-contained binaries for macOS (x64+arm64), Linux (x64+arm64),
Windows (x64) using bun compile on each native runner
- Triggers on version tags (v*.*.*) or manual workflow_dispatch
- Publishes binaries + SHA256SUMS.txt as a GitHub Release with
per-platform install instructions
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
170 lines
5.3 KiB
YAML
170 lines
5.3 KiB
YAML
name: Build & Release
|
||
|
||
on:
|
||
push:
|
||
tags:
|
||
- 'v*.*.*'
|
||
workflow_dispatch:
|
||
inputs:
|
||
tag:
|
||
description: 'Release tag (e.g. v2.1.88)'
|
||
required: false
|
||
default: ''
|
||
|
||
permissions:
|
||
contents: write
|
||
|
||
jobs:
|
||
build:
|
||
name: Build (${{ matrix.os }})
|
||
runs-on: ${{ matrix.runner }}
|
||
strategy:
|
||
fail-fast: false
|
||
matrix:
|
||
include:
|
||
- os: linux-x64
|
||
runner: ubuntu-latest
|
||
artifact: claude-linux-x64
|
||
- os: linux-arm64
|
||
runner: ubuntu-24.04-arm
|
||
artifact: claude-linux-arm64
|
||
- os: macos-x64
|
||
runner: macos-13
|
||
artifact: claude-macos-x64
|
||
- os: macos-arm64
|
||
runner: macos-latest
|
||
artifact: claude-macos-arm64
|
||
- os: windows-x64
|
||
runner: windows-latest
|
||
artifact: claude-windows-x64.exe
|
||
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Setup Bun
|
||
uses: oven-sh/setup-bun@v2
|
||
with:
|
||
bun-version: '1.3.11'
|
||
|
||
- name: Install dependencies
|
||
run: bun install --frozen-lockfile
|
||
|
||
- name: Build binary
|
||
run: bun run compile
|
||
|
||
- name: Rename binary (Unix)
|
||
if: runner.os != 'Windows'
|
||
run: |
|
||
mkdir -p release
|
||
cp dist/cli release/${{ matrix.artifact }}
|
||
chmod +x release/${{ matrix.artifact }}
|
||
|
||
- name: Rename binary (Windows)
|
||
if: runner.os == 'Windows'
|
||
shell: pwsh
|
||
run: |
|
||
New-Item -ItemType Directory -Force -Path release
|
||
Copy-Item dist/cli.exe release/${{ matrix.artifact }}
|
||
|
||
- name: Upload artifact
|
||
uses: actions/upload-artifact@v4
|
||
with:
|
||
name: ${{ matrix.artifact }}
|
||
path: release/${{ matrix.artifact }}
|
||
retention-days: 7
|
||
|
||
release:
|
||
name: Create GitHub Release
|
||
needs: build
|
||
runs-on: ubuntu-latest
|
||
if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
|
||
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Download all artifacts
|
||
uses: actions/download-artifact@v4
|
||
with:
|
||
path: release/
|
||
|
||
- name: Flatten release directory
|
||
run: |
|
||
find release/ -type f | while read f; do
|
||
mv "$f" release/$(basename "$f")
|
||
done
|
||
find release/ -type d -empty -delete
|
||
|
||
- name: Determine release tag
|
||
id: tag
|
||
run: |
|
||
if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ github.event.inputs.tag }}" ]; then
|
||
echo "tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
|
||
else
|
||
echo "tag=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
|
||
fi
|
||
|
||
- name: Generate checksums
|
||
run: |
|
||
cd release
|
||
sha256sum claude-linux-x64 claude-linux-arm64 claude-macos-x64 claude-macos-arm64 claude-windows-x64.exe > SHA256SUMS.txt 2>/dev/null || true
|
||
cat SHA256SUMS.txt
|
||
|
||
- name: Create Release
|
||
uses: softprops/action-gh-release@v2
|
||
with:
|
||
tag_name: ${{ steps.tag.outputs.tag }}
|
||
name: Claude Code ${{ steps.tag.outputs.tag }}
|
||
draft: false
|
||
prerelease: false
|
||
generate_release_notes: true
|
||
body: |
|
||
## 安装说明 / Installation
|
||
|
||
### macOS (Apple Silicon)
|
||
```bash
|
||
curl -L https://github.com/${{ github.repository }}/releases/download/${{ steps.tag.outputs.tag }}/claude-macos-arm64 -o claude
|
||
chmod +x claude && sudo mv claude /usr/local/bin/claude
|
||
```
|
||
|
||
### macOS (Intel)
|
||
```bash
|
||
curl -L https://github.com/${{ github.repository }}/releases/download/${{ steps.tag.outputs.tag }}/claude-macos-x64 -o claude
|
||
chmod +x claude && sudo mv claude /usr/local/bin/claude
|
||
```
|
||
|
||
### Linux (x64)
|
||
```bash
|
||
curl -L https://github.com/${{ github.repository }}/releases/download/${{ steps.tag.outputs.tag }}/claude-linux-x64 -o claude
|
||
chmod +x claude && sudo mv claude /usr/local/bin/claude
|
||
```
|
||
|
||
### Linux (ARM64)
|
||
```bash
|
||
curl -L https://github.com/${{ github.repository }}/releases/download/${{ steps.tag.outputs.tag }}/claude-linux-arm64 -o claude
|
||
chmod +x claude && sudo mv claude /usr/local/bin/claude
|
||
```
|
||
|
||
### Windows (x64)
|
||
下载 `claude-windows-x64.exe`,将其重命名为 `claude.exe` 并添加到 PATH。
|
||
|
||
### 验证 / Verify
|
||
```bash
|
||
claude --version
|
||
```
|
||
|
||
### 隐私说明 / Privacy
|
||
本构建已移除以下外部数据传输:
|
||
- ✅ 已删除 WebFetch 域名检查(不再向 Anthropic 上报访问域名)
|
||
- ✅ 已禁用 Codex API 路由(不再将对话转发至 OpenAI chatgpt.com)
|
||
- ✅ Analytics/遥测已为空存根(无实际数据发送)
|
||
- ✅ GrowthBook/Statsig 仅使用本地缓存(无远程请求)
|
||
files: |
|
||
release/claude-linux-x64
|
||
release/claude-linux-arm64
|
||
release/claude-macos-x64
|
||
release/claude-macos-arm64
|
||
release/claude-windows-x64.exe
|
||
release/SHA256SUMS.txt
|