# Skill: Subscriptions and Routing

## Когда использовать

Используй этот skill при изменениях в external SOCKS5 flow, Local sing-box flow, subscription fetching/parsing, server selection, ping/check route, ProxiFyre config generation или sing-box config generation.

## Mental model

Supported route shapes:

```text
selected Windows apps -> ProxiFyre -> external SOCKS5 proxy
```

```text
selected Windows apps -> ProxiFyre -> 127.0.0.1:1080 Local sing-box -> selected subscription server
```

ProxiFyre is the per-app router. Sing-box is optional local outbound runtime.

## Invariants

- External SOCKS5 must work without Local sing-box.
- Local sing-box route requires installed/configured/running sing-box and selected server.
- UI route chain must match generated backend config.
- Subscription URL is secret.
- Server identity should not rely only on non-unique human tag forever.
- Generated config should be validated before apply/start where possible.

## Subscription rules

When changing subscription parsing:

- Preserve JSON outbound support.
- Do not claim support for link formats that parser does not implement.
- If adding VMess/Trojan/Shadowsocks link parsing, add tests for each.
- Keep unsupported outbound types visible as unsupported, not silently dropped if this affects user expectation.
- Redact subscription URL and outbound secrets in logs/UI.

## Ping/check rules

- Network checks should have timeout.
- Checks should be cancel-safe where possible.
- Do not make route check mutate config/service state.
- Do not store external IP probe result as secret, but avoid over-logging.
- Make it clear if check verifies local sing-box only, external proxy only, or full route.

## Config generation

For ProxiFyre:

- Respect selected app targets.
- Deduplicate carefully, preferably case-insensitive where Windows semantics apply.
- Validate target kind semantics: process name vs exe path vs folder.
- Write config atomically.

For sing-box:

- Validate selected server/outbound exists.
- Avoid duplicate tag ambiguity by introducing stable id if needed.
- Run `sing-box check` when binary is available.
- Avoid writing secrets to temp files outside safe app directories.

## Tests to add for changes

- External route without sing-box.
- Local route with selected server.
- Missing ProxiFyre blocks apply.
- Missing sing-box blocks local route apply.
- Duplicate server tags.
- Redacted subscription display.
- Unsupported subscription formats.
- Timeout/fetch failure.
- Config generation produces expected route chain.

## Как отчитываться

Перед финальным ответом применить `.agent/skills/communication-reporting/SKILL.md` и `.agent/checklists/communication.md`.

Минимум для нетривиальной задачи:

- короткая сводка;
- таблица файлов `Файл / Что изменилось / Зачем`;
- важные места без пересказа каждой строки;
- что проверено;
- что не проверено;
- конкретные риски.