feat: add cloud-claude binary release pipeline and install script

Release workflow now cross-compiles cloud-claude for linux/darwin
× amd64/arm64, uploads .tar.gz + .sha256 to GitHub Release.

- Add build-binaries job to release.yml (4-platform matrix)
- Add Version variable to cmd/cloud-claude with ldflags injection
- Add scripts/install.sh for one-command install via curl
- Add build-cli / install-cli targets to Makefile
- Update README install section with curl one-liner
- Add /cloud-claude to .gitignore

Made-with: Cursor

Author: ZaneL1u

.github/workflows/release.yml

@@ -116,6 +116,55 @@ jobs:
           git commit -m "docs(changelog): update for v${VERSION}"
           git push origin "HEAD:${DEFAULT_BRANCH}"
 
+  build-binaries:
+    needs: create-release
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+          - goos: linux
+            goarch: arm64
+          - goos: darwin
+            goarch: amd64
+          - goos: darwin
+            goarch: arm64
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build cloud-claude
+        env:
+          CGO_ENABLED: "0"
+          GOOS: ${{ matrix.goos }}
+          GOARCH: ${{ matrix.goarch }}
+        run: |
+          VERSION="${{ needs.create-release.outputs.version }}"
+          LDFLAGS="-s -w -X main.Version=${VERSION}"
+          BINARY="cloud-claude-${{ matrix.goos }}-${{ matrix.goarch }}"
+          go build -ldflags "${LDFLAGS}" -trimpath -o "${BINARY}" ./cmd/cloud-claude
+
+      - name: Compress binary
+        run: |
+          BINARY="cloud-claude-${{ matrix.goos }}-${{ matrix.goarch }}"
+          ARCHIVE="cloud-claude-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz"
+          tar czf "${ARCHIVE}" "${BINARY}"
+          sha256sum "${ARCHIVE}" > "${ARCHIVE}.sha256"
+
+      - name: Upload to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          ARCHIVE="cloud-claude-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz"
+          gh release upload "${{ github.ref_name }}" "${ARCHIVE}" "${ARCHIVE}.sha256" --clobber
+
   publish-images:
     needs: create-release
     uses: ./.github/workflows/build-images.yml

.gitignore

@@ -1,6 +1,7 @@
 # Compiled binaries
 bin/
 /control-plane
+/cloud-claude
 *.exe
 *.dll
 *.so

Makefile

@@ -3,7 +3,7 @@ export
 
 DEV_COMPOSE := docker compose -f deploy/compose/control-plane.dev.yml
 
-.PHONY: dev dev-api dev-web db test test-go test-smoke build clean gateway-image up up-build down logs release
+.PHONY: dev dev-api dev-web db test test-go test-smoke build build-cli install-cli clean gateway-image up up-build down logs release
 
 # ── Development ──────────────────────────────────────────────
 
@@ -67,14 +67,21 @@ gateway-image: ## Build sing-box + iptables sidecar (required for macOS/Windows
 build: ## Build all artifacts
 	go build -o bin/control-plane ./cmd/control-plane
 	GOOS=linux GOARCH=amd64 go build -o bin/host-agent ./cmd/host-agent
+	go build -ldflags "-s -w" -trimpath -o bin/cloud-claude ./cmd/cloud-claude
 	cd web/admin && pnpm build
 
 build-api: ## Build Go backend only
 	go build -o bin/control-plane ./cmd/control-plane
 
+build-cli: ## Build cloud-claude CLI
+	go build -ldflags "-s -w" -trimpath -o bin/cloud-claude ./cmd/cloud-claude
+
 build-web: ## Build frontend only
 	cd web/admin && pnpm build
 
+install-cli: ## Install cloud-claude to /usr/local/bin
+	go build -ldflags "-s -w" -trimpath -o /usr/local/bin/cloud-claude ./cmd/cloud-claude
+
 # ── Production ───────────────────────────────────────────────
 
 up: ## Start production stack (prefer prebuilt latest images)

README.en.md

@@ -15,7 +15,7 @@ Out-of-the-box isolated cloud hosts for Claude Code and dev teams. Pre-installed
 
 [中文](README.md) | [Documentation](https://zanel1u.github.io/cloud-cli-proxy/en/)
 
-**Go · React · PostgreSQL · Docker · WireGuard**
+**Go · React · PostgreSQL · Docker · sing-box**
 
 </div>
 
@@ -26,8 +26,8 @@ Out-of-the-box isolated cloud hosts for Claude Code and dev teams. Pre-installed
 - **One-command access** — `curl | bash` to authenticate, create container, and SSH in. Zero user config
 - **cloud-claude local CLI** — `alias claude=cloud-claude` to transparently run remote Claude Code from your local terminal with real-time directory mapping
 - **Claude Code ready** — Pre-installed in every container. All API requests auto-routed through designated exit IP
-- **Full-tunnel egress** — WireGuard + Linux netns / sing-box tun dual-channel, nftables default-deny, no DNS/WebRTC leaks
-- **Multi-protocol** — WireGuard and 5 proxy protocols (SOCKS5 / VMess / Shadowsocks / Trojan / HTTP)
+- **Full-tunnel egress** — sing-box tun + Linux netns full-tunnel, nftables default-deny, no DNS/WebRTC leaks
+- **Multi-protocol** — 6 proxy protocols (SOCKS5 / VMess / VLESS / Shadowsocks / Trojan / HTTP)
 - **Per-user isolation** — Dedicated Docker containers with KasmVNC remote desktop + Chromium
 - **Admin dashboard** — React SPA for users, hosts, egress IPs, events, and stats
 - **User self-service** — View host status, rebuild hosts, access VNC desktop
@@ -86,7 +86,7 @@ docker compose -f docker-compose.yml -f docker-compose.build.yaml up -d --force-
 
 Log into the admin dashboard, then:
 
-1. **Add egress IPs** — WireGuard config or proxy protocol, with one-click connectivity test
+1. **Add egress IPs** — Multiple proxy protocols, with one-click connectivity test
 2. **Create users** — Set username, password, expiration
 3. **Create hosts** — Create container for user and bind egress IP
 4. **Share access command** — Copy the `curl` command from host detail page
@@ -106,7 +106,11 @@ Besides SSH access, you can use the `cloud-claude` binary on your local machine
 
 **Install:**
 
-Download from [Releases](https://github.com/ZaneL1u/cloud-cli-proxy/releases), or build from source:
+```bash
+curl -fsSL https://raw.githubusercontent.com/ZaneL1u/cloud-cli-proxy/main/scripts/install.sh | bash
+```
+
+Or download manually from [Releases](https://github.com/ZaneL1u/cloud-cli-proxy/releases), or build from source:
 
 ```bash
 go build -o cloud-claude ./cmd/cloud-claude
@@ -175,7 +179,7 @@ Containers include KasmVNC + Chromium. Access the browser desktop via admin or u
 User ──curl──> Control Plane (:8080) ──Docker──>    │ User Container                    │
                     │                                │  SSH + Claude Code + VNC          │
                PostgreSQL                            │  sshfs ← /workspace dir mapping  │
-                    │                                │  WireGuard / sing-box Tunnel      │
+                    │                                │  sing-box tun Tunnel              │
               Admin SPA (:3000)                      │       ↓                           │
                     │                                │  Designated Exit IP               │
               SSH Proxy (:2222)                      └───────────────────────────────────┘
@@ -238,7 +242,7 @@ Full docs on [GitHub Pages](https://zanel1u.github.io/cloud-cli-proxy/en/):
 
 - [Quick Start](https://zanel1u.github.io/cloud-cli-proxy/en/guide/quickstart) — Deploy and first use
 - [Deployment](https://zanel1u.github.io/cloud-cli-proxy/en/guide/deployment) — systemd native deployment
-- [Configuration](https://zanel1u.github.io/cloud-cli-proxy/en/guide/configuration) — Environment variables and WireGuard setup
+- [Configuration](https://zanel1u.github.io/cloud-cli-proxy/en/guide/configuration) — Environment variables and egress proxy setup
 - [Architecture](https://zanel1u.github.io/cloud-cli-proxy/en/guide/architecture) — System design and project structure
 - [API Reference](https://zanel1u.github.io/cloud-cli-proxy/en/reference/api) — Full Admin API
 - [FAQ & Recovery](https://zanel1u.github.io/cloud-cli-proxy/en/reference/faq) — Troubleshooting and disaster recovery

README.md

@@ -15,7 +15,7 @@
 
 [English](README.en.md) | [Documentation](https://zanel1u.github.io/cloud-cli-proxy/)
 
-**Go · React · PostgreSQL · Docker · WireGuard**
+**Go · React · PostgreSQL · Docker · sing-box**
 
 </div>
 
@@ -26,8 +26,8 @@
 - **一条命令接入** — `curl | bash` 自动认证、创建容器、SSH 接入，用户无需任何配置
 - **cloud-claude 本地 CLI** — `alias claude=cloud-claude`，在本地终端透明运行远端 Claude Code，当前目录实时映射
 - **Claude Code 开箱即用** — 容器预装 Claude Code，进入即可使用，所有 API 请求自动走指定出口
-- **全流量强制出口** — WireGuard + Linux netns / sing-box tun 双通道，nftables 默认拒绝策略，杜绝 DNS / WebRTC 泄漏
-- **多协议支持** — 出口 IP 支持 WireGuard 和 5 种代理协议（SOCKS5 / VMess / Shadowsocks / Trojan / HTTP）
+- **全流量强制出口** — sing-box tun + Linux netns 全隧道，nftables 默认拒绝策略，杜绝 DNS / WebRTC 泄漏
+- **多协议支持** — 出口 IP 支持 6 种代理协议（SOCKS5 / VMess / VLESS / Shadowsocks / Trojan / HTTP）
 - **每用户隔离** — 独立 Docker 容器，预装 KasmVNC 远程桌面 + Chromium 浏览器
 - **管理后台** — React SPA 仪表盘，用户、主机、出口 IP、事件日志一站式管理
 - **用户自助面板** — 用户可查看主机状态、重建主机、访问 VNC 桌面
@@ -120,7 +120,7 @@ docker compose -f docker-compose.yml -f docker-compose.build.yaml up -d --force-
 
 登录管理后台，依次完成：
 
-1. **添加出口 IP** — 支持 WireGuard 配置或代理协议，可一键测试连通性
+1. **添加出口 IP** — 支持多种代理协议，可一键测试连通性
 2. **创建用户** — 设置用户名、密码、到期时间
 3. **创建主机** — 为用户创建容器并绑定出口 IP
 4. **分发接入命令** — 在主机详情页复制 `curl` 命令发给用户
@@ -140,7 +140,11 @@ curl -sSf http://YOUR_HOST/entry/abc123 | bash
 
 **安装：**
 
-从 [Releases](https://github.com/ZaneL1u/cloud-cli-proxy/releases) 下载对应平台的二进制文件，或从源码构建：
+```bash
+curl -fsSL https://raw.githubusercontent.com/ZaneL1u/cloud-cli-proxy/main/scripts/install.sh | bash
+```
+
+也可以从 [Releases](https://github.com/ZaneL1u/cloud-cli-proxy/releases) 手动下载，或从源码构建：
 
 ```bash
 go build -o cloud-claude ./cmd/cloud-claude
@@ -209,7 +213,7 @@ claude
 用户 ──curl──> Control Plane (:8080) ──Docker──>     │ 用户容器                          │
                     │                                │  SSH + Claude Code + VNC          │
                PostgreSQL                            │  sshfs ← /workspace 目录映射      │
-                    │                                │  WireGuard / sing-box 隧道        │
+                    │                                │  sing-box tun 隧道                │
               Admin SPA (:3000)                      │       ↓                           │
                     │                                │  指定出口 IP                      │
               SSH Proxy (:2222)                      └───────────────────────────────────┘
@@ -327,7 +331,7 @@ make release VERSION=1.5.0
 
 - [快速开始](https://zanel1u.github.io/cloud-cli-proxy/zh/guide/quickstart) — 部署和首次使用
 - [部署指南](https://zanel1u.github.io/cloud-cli-proxy/zh/guide/deployment) — systemd 原生部署
-- [配置参考](https://zanel1u.github.io/cloud-cli-proxy/zh/guide/configuration) — 环境变量和 WireGuard 配置
+- [配置参考](https://zanel1u.github.io/cloud-cli-proxy/zh/guide/configuration) — 环境变量和出口代理配置
 - [架构说明](https://zanel1u.github.io/cloud-cli-proxy/zh/guide/architecture) — 系统设计和项目结构
 - [API 参考](https://zanel1u.github.io/cloud-cli-proxy/zh/reference/api) — 完整 Admin API
 - [故障排查](https://zanel1u.github.io/cloud-cli-proxy/zh/reference/faq) — 常见问题和灾难恢复

cmd/cloud-claude/main.go

@@ -11,6 +11,8 @@ import (
 	"github.com/zanel1u/cloud-cli-proxy/internal/cloudclaude"
 )
 
+var Version = "dev"
+
 const (
 	exitOK             = 0
 	exitAuthFailed     = 1
@@ -25,6 +27,7 @@ func main() {
 		Use:                "cloud-claude",
 		Short:              "透明远程 Claude Code CLI",
 		Long:               "连接远端云主机并启动 Claude Code 交互会话。\n首次使用请先运行 cloud-claude init 配置网关与凭证。",
+		Version:            Version,
 		SilenceUsage:       true,
 		SilenceErrors:      true,
 		DisableFlagParsing: true,
@@ -108,6 +111,10 @@ func runInit(cmd *cobra.Command, args []string) error {
 }
 
 func runRoot(cmd *cobra.Command, args []string) error {
+	if len(args) > 0 && (args[0] == "--version" || args[0] == "-v" || args[0] == "version") {
+		fmt.Printf("cloud-claude %s\n", Version)
+		return nil
+	}
 	if len(args) > 0 && args[0] == "--" {
 		args = args[1:]
 	}

scripts/install.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO="ZaneL1u/cloud-cli-proxy"
+BINARY="cloud-claude"
+INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}"
+
+info()  { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
+warn()  { printf '\033[1;33m警告:\033[0m %s\n' "$*"; }
+error() { printf '\033[1;31m错误:\033[0m %s\n' "$*" >&2; exit 1; }
+
+detect_platform() {
+  local os arch
+  os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+  arch="$(uname -m)"
+
+  case "${os}" in
+    linux)  OS="linux" ;;
+    darwin) OS="darwin" ;;
+    *)      error "不支持的操作系统: ${os}" ;;
+  esac
+
+  case "${arch}" in
+    x86_64|amd64)   ARCH="amd64" ;;
+    aarch64|arm64)  ARCH="arm64" ;;
+    *)              error "不支持的架构: ${arch}" ;;
+  esac
+}
+
+get_latest_version() {
+  local url="https://api.github.com/repos/${REPO}/releases/latest"
+  VERSION="$(curl -fsSL "${url}" | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"//;s/".*//')"
+  if [ -z "${VERSION}" ]; then
+    error "无法获取最新版本号，请检查网络连接"
+  fi
+}
+
+download_and_install() {
+  local archive="${BINARY}-${OS}-${ARCH}.tar.gz"
+  local url="https://github.com/${REPO}/releases/download/${VERSION}/${archive}"
+  local tmpdir
+  tmpdir="$(mktemp -d)"
+  trap 'rm -rf "${tmpdir}"' EXIT
+
+  info "下载 ${BINARY} ${VERSION} (${OS}/${ARCH})..."
+  curl -fsSL -o "${tmpdir}/${archive}" "${url}" \
+    || error "下载失败: ${url}\n请确认该版本存在: https://github.com/${REPO}/releases"
+
+  info "校验完整性..."
+  local sha_url="${url}.sha256"
+  if curl -fsSL -o "${tmpdir}/${archive}.sha256" "${sha_url}" 2>/dev/null; then
+    (cd "${tmpdir}" && sha256sum -c "${archive}.sha256" --quiet 2>/dev/null) \
+      || (cd "${tmpdir}" && shasum -a 256 -c "${archive}.sha256" --quiet 2>/dev/null) \
+      || warn "sha256 校验失败，继续安装"
+  fi
+
+  info "解压..."
+  tar xzf "${tmpdir}/${archive}" -C "${tmpdir}"
+
+  local src="${tmpdir}/${BINARY}-${OS}-${ARCH}"
+  chmod +x "${src}"
+
+  info "安装到 ${INSTALL_DIR}/${BINARY}..."
+  if [ -w "${INSTALL_DIR}" ]; then
+    mv "${src}" "${INSTALL_DIR}/${BINARY}"
+  else
+    sudo mv "${src}" "${INSTALL_DIR}/${BINARY}"
+  fi
+}
+
+verify_install() {
+  if command -v "${BINARY}" &>/dev/null; then
+    local installed_version
+    installed_version="$("${BINARY}" --version 2>/dev/null || echo "unknown")"
+    info "安装成功! ${installed_version}"
+  else
+    warn "${BINARY} 已安装到 ${INSTALL_DIR}/${BINARY}，但不在 PATH 中"
+    warn "请将 ${INSTALL_DIR} 加入 PATH，或运行: export PATH=\"${INSTALL_DIR}:\$PATH\""
+  fi
+}
+
+main() {
+  info "Cloud CLI Proxy — cloud-claude 安装脚本"
+  echo ""
+
+  detect_platform
+
+  if [ -n "${1:-}" ]; then
+    VERSION="$1"
+  else
+    get_latest_version
+  fi
+
+  download_and_install
+  verify_install
+
+  echo ""
+  info "快速开始："
+  echo "  cloud-claude init        # 配置网关地址与凭证"
+  echo "  alias claude=cloud-claude"
+  echo "  claude                   # 像本地一样使用 Claude Code"
+}
+
+main "$@"