Add AmneziaWG mode (wireproxy-awg userspace SOCKS)

Third mode alongside proxy and VLESS+Reality. Bundles wireproxy-awg built from a pinned, audited source commit (fork of wireproxy over the official amneziawg-go), exposing a local SOCKS5 tunnel with no TUN/driver/admin. User picks their AmneziaWG .conf; the app appends a [Socks5] section and routes Claude through it with the same fail-closed firewall. build-wireproxy.ps1 reproducibly builds the binary (portable Go + pinned commit); it is embedded as a resource and not stored in git. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-10 14:58:21 +03:00
parent 88d5486607
commit 39b58e1a77
8 changed files with 266 additions and 39 deletions
@@ -0,0 +1,55 @@
+<#
+  build-wireproxy.ps1 - reproducibly build wireproxy-awg.exe from a pinned, audited commit.
+  Output: wireproxy-awg.exe in the repo root (embedded into ClaudeProxy.exe by build-native.ps1).
+  Uses a portable Go toolchain in a temp cache (does not touch the system Go).
+#>
+$ErrorActionPreference = 'Stop'
+$root = Split-Path -Parent $MyInvocation.MyCommand.Path
+$out = Join-Path $root 'wireproxy-awg.exe'
+
+# pinned, audited source
+$repo = 'https://github.com/artem-russkikh/wireproxy-awg.git'
+$commit = '5d12c1937a72591342f1c78bc92a8e50e7ee92bb'   # v1.0.17
+$goVer = 'go1.26.5'
+
+$cache = Join-Path $env:TEMP 'claude-proxy-gobuild'
+New-Item -ItemType Directory -Force -Path $cache | Out-Null
+[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
+
+# portable Go
+$goExe = Join-Path $cache 'goroot\go\bin\go.exe'
+if (-not (Test-Path $goExe)) {
+  Write-Host "Fetching portable $goVer..." -ForegroundColor Cyan
+  $zip = Join-Path $cache 'go.zip'
+  Invoke-WebRequest "https://go.dev/dl/$goVer.windows-amd64.zip" -OutFile $zip -UseBasicParsing
+  Expand-Archive $zip -DestinationPath (Join-Path $cache 'goroot') -Force
+  Remove-Item $zip
+}
+
+# fetch the exact pinned commit
+$src = Join-Path $cache 'wireproxy-awg'
+if (Test-Path $src) { Remove-Item $src -Recurse -Force }
+New-Item -ItemType Directory -Force -Path $src | Out-Null
+Push-Location $src
+try {
+  git init -q
+  git remote add origin $repo
+  git fetch -q --depth 1 origin $commit
+  git checkout -q FETCH_HEAD
+  $head = (git rev-parse HEAD).Trim()
+  if ($head -ne $commit) { throw "commit mismatch: got $head, expected $commit" }
+  Write-Host "Source pinned at $commit" -ForegroundColor DarkGray
+
+  $env:GOROOT = Join-Path $cache 'goroot\go'
+  $env:GOPATH = Join-Path $cache 'gopath'
+  $env:GOCACHE = Join-Path $cache 'gocache'
+  $env:GOTOOLCHAIN = 'local'
+  $env:GOOS = 'windows'; $env:GOARCH = 'amd64'; $env:CGO_ENABLED = '0'
+  Write-Host "Building wireproxy-awg.exe..." -ForegroundColor Cyan
+  & $goExe build -trimpath -ldflags '-s -w' -o $out ./cmd/wireproxy
+  if ($LASTEXITCODE -ne 0) { throw "go build failed ($LASTEXITCODE)" }
+}
+finally { Pop-Location }
+
+$sz = [math]::Round((Get-Item $out).Length / 1MB, 1)
+Write-Host "OK: $out ($sz MB)" -ForegroundColor Green