/op-proxy

description: Configure and manage proxy chains, VPN connections, and Tor routing
allowed-tools: ToolSearch, Bash, Read, Write, AskUserQuestion
argument-hint: <setup|rotate|test|status|kill> [--chain tor+proxy|direct|multi-hop]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to /tmp/ or any system temporary directory.

Proxy Chain Management

Target and options: `$ARGUMENTS`

1. Parse `$ARGUMENTS` for the subcommand (`setup`, `rotate`, `test`, `status`, or `kill`) and `--chain` flag. Dispatch to the appropriate operation.

2. **setup**: Configure the full proxy chain:

• Generate or update `/etc/proxychains4.conf` with the selected chain type (`tor+proxy`, `direct`, `multi-hop`)
• Start the Tor service: `systemctl start tor` and verify SOCKS proxy on port 9050
• Configure VPN connection (WireGuard via `wg-quick up` or OpenVPN via `openvpn --config`)
• Set up a killswitch via iptables to block all traffic if the VPN/Tor connection drops:

     iptables -A OUTPUT -o tun0 -j ACCEPT
     iptables -A OUTPUT -o lo -j ACCEPT
     iptables -A OUTPUT -d <vpn-server-ip> -j ACCEPT
     iptables -A OUTPUT -j DROP

• Ask the user for VPN credentials or config path via `AskUserQuestion` if not provided

3. **rotate**: Cycle to a new identity/endpoint:

• Request a new Tor circuit: `echo -e 'AUTHENTICATE ""\r\nSIGNAL NEWNYM\r\n' | nc 127.0.0.1 9051`
• Cycle to the next VPN endpoint if multi-hop is configured
• Flush DNS cache to prevent leaks
• Verify the new external IP after rotation

4. **test**: Verify the proxy chain integrity:

• Check external IP: `curl -s --socks5 127.0.0.1:9050 ifconfig.me` (Tor) or `curl -s ifconfig.me` (VPN)
• DNS leak test: resolve a unique hostname and verify the DNS server is not the ISP's
• WebRTC leak check: verify no local IP exposure via WebRTC-capable tools
• Killswitch verification: temporarily disconnect VPN/Tor and confirm traffic is blocked

5. **status**: Display current proxy chain state:

• Show active proxychains configuration
• Display Tor circuit path and exit node country
• Show VPN connection status, endpoint, and assigned IP
• Display current external IP address

6. **kill**: Tear down all proxy infrastructure:

• Disconnect VPN: `wg-quick down` or kill OpenVPN process
• Stop Tor service: `systemctl stop tor`
• Remove iptables killswitch rules and restore original network configuration
• Flush DNS cache
• Ask the user for confirmation before tearing down via `AskUserQuestion`

7. Log all proxy operations to the ops tracker:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add <target> proxy-chain <subcommand> "<chain-type>" <result> <severity>