Expand AGENTS.md with current repo and reporting rules

.agent/skills/subscriptions-routing/SKILL.md

@@ -0,0 +1,87 @@
+# Skill: Subscriptions and Routing
+
+## Когда использовать
+
+Используй этот skill при изменениях в external SOCKS5 flow, Local sing-box flow, subscription fetching/parsing, server selection, ping/check route, ProxiFyre config generation или sing-box config generation.
+
+## Mental model
+
+Supported route shapes:
+
+```text
+selected Windows apps -> ProxiFyre -> external SOCKS5 proxy
+```
+
+```text
+selected Windows apps -> ProxiFyre -> 127.0.0.1:1080 Local sing-box -> selected subscription server
+```
+
+ProxiFyre is the per-app router. Sing-box is optional local outbound runtime.
+
+## Invariants
+
+- External SOCKS5 must work without Local sing-box.
+- Local sing-box route requires installed/configured/running sing-box and selected server.
+- UI route chain must match generated backend config.
+- Subscription URL is secret.
+- Server identity should not rely only on non-unique human tag forever.
+- Generated config should be validated before apply/start where possible.
+
+## Subscription rules
+
+When changing subscription parsing:
+
+- Preserve JSON outbound support.
+- Do not claim support for link formats that parser does not implement.
+- If adding VMess/Trojan/Shadowsocks link parsing, add tests for each.
+- Keep unsupported outbound types visible as unsupported, not silently dropped if this affects user expectation.
+- Redact subscription URL and outbound secrets in logs/UI.
+
+## Ping/check rules
+
+- Network checks should have timeout.
+- Checks should be cancel-safe where possible.
+- Do not make route check mutate config/service state.
+- Do not store external IP probe result as secret, but avoid over-logging.
+- Make it clear if check verifies local sing-box only, external proxy only, or full route.
+
+## Config generation
+
+For ProxiFyre:
+
+- Respect selected app targets.
+- Deduplicate carefully, preferably case-insensitive where Windows semantics apply.
+- Validate target kind semantics: process name vs exe path vs folder.
+- Write config atomically.
+
+For sing-box:
+
+- Validate selected server/outbound exists.
+- Avoid duplicate tag ambiguity by introducing stable id if needed.
+- Run `sing-box check` when binary is available.
+- Avoid writing secrets to temp files outside safe app directories.
+
+## Tests to add for changes
+
+- External route without sing-box.
+- Local route with selected server.
+- Missing ProxiFyre blocks apply.
+- Missing sing-box blocks local route apply.
+- Duplicate server tags.
+- Redacted subscription display.
+- Unsupported subscription formats.
+- Timeout/fetch failure.
+- Config generation produces expected route chain.
+
+## Как отчитываться
+
+Перед финальным ответом применить `.agent/skills/communication-reporting/SKILL.md` и `.agent/checklists/communication.md`.
+
+Минимум для нетривиальной задачи:
+
+- короткая сводка;
+- таблица файлов `Файл / Что изменилось / Зачем`;
+- важные места без пересказа каждой строки;
+- что проверено;
+- что не проверено;
+- конкретные риски.