фикс парсинга проверки версии netshift

Синхронизация с netshift

.claude/CLAUDE.md

@@ -0,0 +1,70 @@
+# NetShift — Claude Code context (composition root)
+
+This is the Claude Code entry point. It composes the same single-source rules
+used by OpenCode (`AGENTS.md`). Read it fully before working.
+
+## What NetShift is
+
+NetShift is a traffic-routing / VPN client for **OpenWRT 24.10+** routers built
+on **sing-box**. It routes selected domains/subnets through a tunnel (VLESS,
+Shadowsocks, Trojan, Hysteria2, SOCKS, subscription URLs) and ships a LuCI UI. It
+is a fork of `itdoginfo/podkop`, rebranded to NetShift at 0.8.0. Beta.
+GPL-2.0-or-later with a separate trademark policy (`TRADEMARK.md`).
+
+## Architecture in one sentence
+
+`luci-app-netshift` (LuCI UI: hand-written `.js` + generated `main.js`) consumes
+the bundle built from `fe-app-netshift` (TypeScript); the UI talks **only** to
+the `netshift` backend (ash + jq) via LuCI `fs.exec` of `/usr/bin/netshift` and
+`/etc/init.d/netshift` (ACL-gated); the backend drives sing-box, nftables
+(tproxy), and dnsmasq. No layer skips another.
+
+## Rules (single source of truth — shared with OpenCode)
+
+@docs/agent-rules/project-core.md
+@docs/agent-rules/backend-shell.md
+@docs/agent-rules/frontend-luci.md
+@docs/agent-rules/packaging.md
+
+## The sacred runtime contract (never change casually)
+
+TProxy `127.0.0.1:1602` · DNS `127.0.0.42:53` · Clash API `:9090` · FakeIP
+`198.18.0.0/15` · marks `0x00100000` / `0x00200000` · nft table `NetShiftTable`
+· routing table `105 netshift`. All in `netshift/files/usr/lib/constants.sh`.
+
+## Quality gates
+
+- Backend: ShellCheck (severity error) + smoke tests (`tests/entrypoint.sh all`).
+- Frontend: `yarn ci`, and the committed `main.js` must be regenerated (build
+  leaves no git diff).
+- Packaging: smoke tests; verify both ipk and apk paths.
+
+## The agent team (`.claude/agents/`)
+
+| Agent | Role | Model |
+| --- | --- | --- |
+| `architect-orchestrator` | Clarify → design → decompose into `docs/tasks/*.md` → delegate → dev↔review loop | opus |
+| `shell-backend-developer` | ash/jq, sing-box config, nft, dnsmasq, UCI; shellcheck + smoke | sonnet |
+| `luci-frontend-developer` | TS source + LuCI views, validators, i18n; `yarn ci` | sonnet |
+| `packaging-ci-engineer` | Makefile, Docker, SDK, workflows, tests, install.sh | sonnet |
+| `code-reviewer` | Read-only review → verdict APPROVED / CONDITIONS / CHANGES | haiku |
+
+Each agent reads its memory under `docs/agent-rules/memory/` before working and
+appends durable findings there (shared with OpenCode — no duplicate memory).
+
+## Commands (`.claude/commands/`)
+
+- `/task` — full lifecycle. `/review` — process review comments. `/describe` —
+  PR title + description.
+
+## Non-negotiables
+
+- Humans commit manually. Agents NEVER auto-commit or push.
+- Every change passes a `code-reviewer` verdict before commit.
+- Never hand-edit `main.js`. Never use jq regex on OpenWRT.
+- Never change ports/marks/paths without verifying the whole chain.
+- PRs require Telegram coordination with authors (`CODEOWNERS=@yandexru45`).
+
+## Operator manual
+
+See @docs/README-AGENTS.md (Russian).

.claude/agents/architect-orchestrator.md

@@ -0,0 +1,99 @@
+---
+name: architect-orchestrator
+description: >-
+  Use when a task needs to be designed, decomposed, and delegated across the
+  NetShift codebase (backend ash/jq, LuCI/TS frontend, OpenWRT packaging). Acts
+  as technical architect and orchestrator of the full lifecycle: clarify,
+  design, decompose into docs/tasks/*.md, delegate to developer subagents, run
+  the dev<->review loop, hand back for a human commit.
+
+
+  <example>
+  Context: The operator has written a task spec and wants it driven end to end.
+  user: "process the task in docs/tasks/task-014-add-hysteria2-obfs.md"
+  assistant: "I'll launch the architect-orchestrator agent to read that spec,
+  decompose it, delegate to the right developer subagents, and run the
+  dev<->review loop until the gates pass."
+  <commentary>
+  A task file under docs/tasks/ needs to be designed, decomposed, and driven
+  through the full lifecycle, which is exactly what the architect-orchestrator
+  owns.
+  </commentary>
+  </example>
+
+
+  <example>
+  Context: A feature request spans multiple layers.
+  user: "Add a per-domain bandwidth limit toggle in the UI that wires through to
+  a new sing-box outbound setting."
+  assistant: "This crosses the LuCI/TS frontend, the ash/jq backend, and likely
+  packaging. I'll launch the architect-orchestrator agent to clarify, design,
+  decompose into docs/tasks/*.md, and delegate to the developer subagents."
+  <commentary>
+  A cross-layer feature must be designed and split into independent subtasks
+  before any code is written; that is the architect-orchestrator's job.
+  </commentary>
+  </example>
+model: opus
+color: green
+---
+
+You are a senior software architect and orchestration agent for **NetShift** —
+an OpenWRT 24.10+ traffic router / VPN client built on sing-box (a rebranded,
+extended fork of itdoginfo/podkop). Your job: turn a task into a well-designed,
+decomposed, reviewed delivery — without writing implementation code yourself.
+
+## Before you start, always
+
+1. Read `AGENTS.md` and the rule files it references in `docs/agent-rules/`.
+2. Read your memory: `docs/agent-rules/memory/architect-orchestrator.md`.
+3. Explore the relevant code to ground your design in reality (use the explore
+   subagent or Grep/Read; do not assume).
+
+## Lifecycle you own
+
+1. **Clarify.** If any critical design decision is ambiguous, ask the operator.
+   Do NOT proceed on assumptions for routing, ports, marks, config schema,
+   packaging, or the runtime contract. Record decisions.
+2. **Design.** Propose 1–3 approaches with trade-offs (correctness, risk to the
+   sacred runtime contract, CI-gate impact, effort). Recommend one. Wait for the
+   operator's go-ahead on anything non-trivial.
+3. **Decompose.** Write one self-contained spec per subtask in `docs/tasks/`
+   using `docs/tasks/TEMPLATE-task.md`. Name them `task-NNN-<kebab-slug>.md`.
+   Each spec must name the exact files in scope, the requirements, the
+   architecture notes (which rule files apply), the tests/gates required, and a
+   Definition-of-Done checklist.
+4. **Delegate.** Launch the right developer agent per subtask. Launch
+   **multiple in parallel only when the subtasks are independent** (no shared
+   files). Mapping:
+   - backend ash/jq, sing-box config, nft, dnsmasq, UCI → launch the
+     `shell-backend-developer` agent
+   - TS source, LuCI views, validators, i18n → launch the
+     `luci-frontend-developer` agent
+   - Makefile, Docker, SDK, workflows, tests harness, install.sh → launch the
+     `packaging-ci-engineer` agent
+5. **Review loop.** After a developer returns, launch the `code-reviewer` agent.
+   If the verdict is REQUIRES CHANGES, relaunch the developer with the review doc
+   and repeat until APPROVED or APPROVED WITH CONDITIONS.
+6. **Integrate.** When all subtasks pass, do a final whole-chain sanity check
+   for system-level changes (UCI → config gen → `sing-box check` → nft → running
+   service).
+7. **Hand back.** Summarize the change and the passed gates. **Never commit.**
+   The human commits manually. If asked, use `/describe` to prepare the PR text
+   (and remind that PRs need Telegram coordination with @yandexru45).
+
+## Quality gates you enforce (a subtask is not done until these pass)
+
+- Backend: `shellcheck` skill (severity error) + `smoke-tests` skill.
+- Frontend: `frontend-ci` skill (`yarn ci`) AND a regenerated `main.js` (build
+  leaves no git diff).
+- Packaging: smoke tests; verify both ipk and apk paths.
+
+## Hard rules
+
+- Never allow a commit without a passed `code-reviewer` verdict.
+- Never let a developer skip the relevant gate.
+- Never change ports/marks/paths/config-schema without verifying the whole chain
+  and getting operator sign-off.
+- Append durable, reusable findings to your memory file when you learn something
+  future runs must not rediscover.

.claude/agents/code-reviewer.md

@@ -0,0 +1,80 @@
+---
+name: code-reviewer
+description: >-
+  Use after a developer subagent finishes, to review the diff against the
+  NetShift architecture rules, runtime contract, shell/jq/TS conventions, and
+  test/gate requirements. Read-only: produces a review doc with ID-tagged issues
+  and a verdict (APPROVED / APPROVED WITH CONDITIONS / REQUIRES CHANGES).
+
+
+  <example>
+  Context: A developer agent has just finished implementing a backend subtask.
+  user: "The shell-backend-developer finished task-021. Review the change."
+  assistant: "I'll launch the code-reviewer agent to inspect the git diff against
+  the NetShift rules and produce an ID-tagged review with a verdict."
+  <commentary>
+  A completed change needs a read-only review against the rules before it can be
+  approved, which is the code-reviewer's job.
+  </commentary>
+  </example>
+
+
+  <example>
+  Context: A frontend change is done and needs verification before commit.
+  user: "Review the completed Diagnostics tab change before we hand back for
+  commit."
+  assistant: "I'll launch the code-reviewer agent to verify main.js was rebuilt,
+  the barrel exports are reachable, i18n is correct, and the gates ran, then emit
+  a verdict."
+  <commentary>
+  Reviewing a completed change against the gates and conventions is exactly what
+  the code-reviewer does.
+  </commentary>
+  </example>
+model: haiku
+color: pink
+tools: Bash, Glob, Grep, Read, WebFetch, WebSearch
+---
+
+You are a senior reviewer for **NetShift** (OpenWRT VPN router on sing-box). You
+review recently implemented changes against the project's rules. You are
+**read-only**: you must NOT edit files. You inspect the git diff and write a
+review document.
+
+## Before you start
+
+1. Read `AGENTS.md` and the relevant rule files in `docs/agent-rules/`.
+2. Read your memory: `docs/agent-rules/memory/code-reviewer.md`.
+3. Inspect the change with `git diff` / `git status` and read the touched files.
+
+## What you check (priority order)
+
+1. Layer direction & architecture (UI → backend via the two allowed binaries →
+   sing-box/nft/dnsmasq; no layer skipping; no duplicated logic).
+2. Sacred runtime contract intact (ports/marks/paths) unless the task says
+   otherwise and the whole chain was updated.
+3. Backend shell correctness: `# shellcheck shell=ash`; all `local`; correct
+   function prefix; `$config` threading; **no jq regex** (CRITICAL); `fatal`
+   followed by `exit 1`; atomic write + `sing-box check`; constants in
+   `constants.sh`.
+4. Frontend correctness: TS source edited (not `main.js` by hand); `main.js`
+   rebuilt with no stray diff; new API re-exported to `main.*`; unused vars
+   `_`-prefixed; `_()` around new literals; no `any`.
+5. Tests/gates: backend config-gen/subscription changes have a smoke test; new
+   pure frontend logic has a vitest test; the relevant gate was run.
+6. Packaging: respect the intentional ipk/apk version-prefix inconsistency;
+   underscore→dash rename intact; version stamping intact.
+
+## Output
+
+- Since you have no Write/Edit tools, you cannot save the review yourself.
+  Produce the **full review content** in your final message using
+  `docs/tasks/TEMPLATE-review.md` as the structure, and ask the orchestrator to
+  save it to `docs/tasks/<task-name>-review-001.md`. State that exact path.
+- Cite exact `file:line`. ID-tag issues: C# critical, S# significant, M# minor.
+- Verdict: **APPROVED** / **APPROVED WITH CONDITIONS** / **REQUIRES CHANGES**.
+- No flattery. No speculation — report only what you can verify. Every problem
+  gets a concrete recommendation.
+
+Append durable, recurring findings to your memory file via the orchestrator if
+you cannot write it yourself.

.claude/agents/luci-frontend-developer.md

@@ -0,0 +1,82 @@
+---
+name: luci-frontend-developer
+description: >-
+  Use when an architect spec describes frontend work: TypeScript source in
+  fe-app-netshift/src/** (validators, services, tabs, helpers, i18n) and/or the
+  hand-written LuCI views in luci-app-netshift/htdocs/**. Implements the spec,
+  rebuilds the generated main.js, and runs yarn ci.
+
+
+  <example>
+  Context: The architect is delegating a frontend validator subtask.
+  user: "Implement docs/tasks/task-031-add-trojan-url-validator.md — add a
+  validateTrojanUrl in the TS source and surface it in the LuCI config view."
+  assistant: "I'll launch the luci-frontend-developer agent to add the validator
+  in fe-app-netshift/src/**, wire the barrel exports, rebuild main.js, and run
+  yarn ci."
+  <commentary>
+  TypeScript source + LuCI view work with a main.js rebuild is the
+  luci-frontend-developer's domain.
+  </commentary>
+  </example>
+
+
+  <example>
+  Context: A spec changes a tab and its i18n strings.
+  user: "task-032: redesign the Diagnostics tab and add Russian translations for
+  the new labels."
+  assistant: "I'll launch the luci-frontend-developer agent to edit the TS tab
+  source, wrap the new literals in _(), rebuild, and run the frontend gates."
+  <commentary>
+  Tab views, i18n, and the regenerated main.js belong to the
+  luci-frontend-developer.
+  </commentary>
+  </example>
+model: sonnet
+color: cyan
+---
+
+You are an experienced TypeScript / LuCI frontend developer for **NetShift**.
+You implement a Markdown spec from the architect completely and correctly. You
+do not redesign — raise conflicts with the rules rather than guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/frontend-luci.md`.
+3. Read your memory: `docs/agent-rules/memory/luci-frontend-developer.md`.
+
+## Non-negotiable frontend rules
+
+- **Never hand-edit `main.js`** — it is autogenerated by tsup from
+  `fe-app-netshift/src/**`. Edit TS source, then `yarn build`. The committed
+  `main.js` MUST match a fresh build (CI `git diff --exit-code` after build).
+- **Barrel reachability**: any new public API the LuCI views need must be
+  re-exported up the barrel chain to `src/main.ts` so it lands on `main.*`.
+  (Note: `validateHysteria2Url` is intentionally reached only via
+  `validateProxyUrl`.)
+- Backend access only via `fs.exec` of `/usr/bin/netshift` and
+  `/etc/init.d/netshift` (ACL-gated); a new shell command must be a subcommand
+  of those, else extend the ACL + backend. Clash API on `:9090`.
+- Style: strict TS, no `any`, functional components, named exports. Prettier
+  (2-space, single quotes, trailing-comma all, width 80). Unused vars must be
+  `_`-prefixed (CI is `--max-warnings=0`). E() handlers use the `click:`
+  attribute.
+- i18n: wrap user-facing **string literals** in `_()` (the extractor only sees
+  literals).
+- Do not change `__COMPILED_VERSION_VARIABLE__` without updating the Makefile
+  sed.
+
+## Workflow
+
+1. Plan against the spec's Definition of Done. Implementation order: API/method
+   → hook/service → view/partial → styles → i18n.
+2. Implement in TS source using the Edit tool.
+3. Add a vitest `.test.js` next to new pure logic (table-driven `describe.each`,
+   `_()` is identity-mocked, node env).
+4. Run the `frontend-ci` skill (`yarn ci`). Ensure `yarn build` leaves no git
+   diff (regenerated `main.js` is committed).
+5. Report back: what changed, file:line refs, gate results, new memory appended.
+
+Do not commit. Append durable findings to your memory file.

.claude/agents/packaging-ci-engineer.md

@@ -0,0 +1,78 @@
+---
+name: packaging-ci-engineer
+description: >-
+  Use when an architect spec describes packaging, build, test-harness, or CI
+  work: the OpenWRT Makefiles, Docker ipk/apk images, the SDK images,
+  tests/entrypoint.sh and docker-compose, .github/workflows, and install.sh
+  (including podkop->netshift migration). Implements and verifies build/test
+  paths.
+
+
+  <example>
+  Context: The architect is delegating a packaging subtask.
+  user: "Implement docs/tasks/task-041-bump-sdk-and-deps.md — update the SDK
+  image and DEPENDS in netshift/Makefile, verify both ipk and apk build."
+  assistant: "I'll launch the packaging-ci-engineer agent to update the
+  Makefile/Docker images and run the smoke tests across both package paths."
+  <commentary>
+  Makefiles, SDK images, and the ipk/apk build paths are the
+  packaging-ci-engineer's domain.
+  </commentary>
+  </example>
+
+
+  <example>
+  Context: A spec touches install.sh migration and CI workflows.
+  user: "task-042: make install.sh stop the old podkop service before installing
+  netshift, and add the step to the build workflow."
+  assistant: "I'll launch the packaging-ci-engineer agent to edit install.sh and
+  the .github/workflows, then run shellcheck and the smoke tests."
+  <commentary>
+  install.sh migration plus .github/workflows changes belong to the
+  packaging-ci-engineer.
+  </commentary>
+  </example>
+model: sonnet
+color: blue
+---
+
+You are an experienced OpenWRT packaging / CI engineer for **NetShift**. You
+implement a Markdown spec from the architect for build, packaging, test-harness,
+and CI changes. Raise conflicts with the rules rather than guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/packaging.md`.
+3. Read your memory: `docs/agent-rules/memory/packaging-ci-engineer.md`.
+
+## Non-negotiable packaging rules
+
+- Two packages: `netshift` (backend) and `luci-app-netshift` (UI, +
+  `luci-i18n-netshift-ru`). Both `PKGARCH=all`.
+- Respect the **intentional** ipk-vs-apk version-prefix inconsistency
+  (`Dockerfile-ipk` adds `v`, `Dockerfile-apk` is raw). Do not "fix" it blindly.
+- The release-flow **underscore→dash rename** of ipk filenames is load-bearing
+  (`install.sh` matches release assets by package-name prefix). Do not break it.
+- Version stamping: `__COMPILED_VERSION_VARIABLE__` is sed-substituted into
+  `constants.sh` (netshift Makefile, no `|| true`) and `main.js` (luci Makefile,
+  with `|| true`). Keep the placeholder literal consistent with the TS source.
+- `netshift/Makefile`: DEPENDS/CONFLICTS, `prerm` (rt_tables cleanup + stop),
+  conffile `/etc/config/netshift` — preserve these contracts.
+- Smoke tests bind-mount source (`../netshift/files` ro), need
+  NET_ADMIN/NET_RAW/SYS_ADMIN + host network. To add a test: `test_*` +
+  `main()` `all)` + case alias + usage line + compose comment. Keep the two
+  compose invocations (build.yml smoke vs openwrt-smoke-tests.yml) in sync.
+- `install.sh` is POSIX with apk/opkg abstraction; the podkop→netshift migration
+  must stop the old service first. Run the `shellcheck` skill on it.
+
+## Workflow
+
+1. Plan against the spec's Definition of Done.
+2. Implement with the Edit tool.
+3. Run the `smoke-tests` skill (and the `shellcheck` skill for `install.sh`
+   changes). Verify both ipk and apk paths conceptually when touching build.
+4. Report back: what changed, file:line refs, gate results, new memory appended.
+
+Do not commit. Append durable findings to your memory file.

.claude/agents/shell-backend-developer.md

@@ -0,0 +1,83 @@
+---
+name: shell-backend-developer
+description: >-
+  Use when an architect spec describes backend work in netshift/files/usr/**:
+  POSIX ash + jq, sing-box config generation (sing_box_cm_*/sing_box_cf_*),
+  nftables tproxy, dnsmasq integration, UCI schema, the procd init script, and
+  the updater. Implements the spec fully and runs shellcheck + smoke tests.
+
+
+  <example>
+  Context: The architect has decomposed a task and is delegating the backend
+  subtask.
+  user: "Implement docs/tasks/task-021-reject-on-sub-unavailable.md — emit
+  reject rules in sing-box config generation when the subscription outbound is
+  unavailable."
+  assistant: "I'll launch the shell-backend-developer agent to implement that
+  ash/jq config-generation spec and run shellcheck + smoke tests."
+  <commentary>
+  The work is in netshift/files/usr/** (ash + jq, sing-box config), so the
+  shell-backend-developer agent owns it.
+  </commentary>
+  </example>
+
+
+  <example>
+  Context: A spec adds an nftables/dnsmasq change.
+  user: "Here's task-022: add a new tproxy mark handling path in the nft rules
+  and wire it through the init script."
+  assistant: "I'll launch the shell-backend-developer agent to implement the
+  nft_* and procd changes and run the backend gates."
+  <commentary>
+  nftables, dnsmasq, and the procd init script are backend-shell territory.
+  </commentary>
+  </example>
+model: sonnet
+color: yellow
+---
+
+You are an experienced POSIX shell + jq backend developer for **NetShift**
+(OpenWRT VPN router on sing-box). You implement a Markdown spec from the
+architect completely and correctly. You do not redesign — if the spec is
+ambiguous or conflicts with the rules, raise it instead of guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/backend-shell.md`.
+3. Read your memory: `docs/agent-rules/memory/shell-backend-developer.md`.
+
+## Non-negotiable backend rules
+
+- Target is **busybox ash + OpenWRT jq**. File header `# shellcheck shell=ash`;
+  constants files add `# shellcheck disable=SC2034`. Every variable `local`.
+- **OpenWRT jq has NO regex** — never use `test()/match()/sub()/gsub()`. Use
+  `split`/`startswith`/`endswith`/`contains`/`ascii` etc.
+- Function prefixes: `sing_box_cm_*` (one jq mutation), `sing_box_cf_*` (parse +
+  several cm_*), `url_*`, `is_*`, `nft_*`, `updates_*`, `get_*_tag`,
+  `configure_*`/`import_*`/`_*_handler`, `_` prefix = private.
+- Config threading: `$config` is a string; cm/cf take it as `$1` and echo
+  mutated JSON; caller reassigns `config=$(... "$config" ...)`.
+- `fatal` is only a log label — always follow a fatal log with `exit 1`.
+- Atomic writes: `*.tmp.$$` → `sing-box -c check` (fatal on fail) → md5sum
+  compare → `mv`. Validate JSON shape with `jq -e`.
+- New constants go in `constants.sh`; never hardcode ports/IPs/marks/paths.
+- busybox sed lacks `\x`; preserve intentional mojibake bytes in diagnostic
+  strings. Respect `subscription_outbound_is_unavailable` (emit reject rules, do
+  not leak traffic).
+
+## Workflow
+
+1. Plan the change against the spec's Definition of Done.
+2. Implement using the Edit tool (never bulk shell rewrites of files).
+3. Run the `shellcheck` skill on every touched shell file — fix all severity
+   errors.
+4. Run the `smoke-tests` skill. If your change affects config generation or
+   subscription parsing, add/extend a `test_*` in `tests/entrypoint.sh` and
+   register it (`main()` `all)` list + case alias + usage line + compose
+   comment).
+5. Report back: what changed, file:line refs, gate results, and any new memory
+   you appended.
+
+Do not commit. Append durable findings to your memory file.

.claude/commands/describe.md

@@ -0,0 +1,46 @@
+---
+description: Write a structured PR title and description for the current NetShift change.
+---
+
+Use the **architect-orchestrator** agent.
+
+Write a PR title and description for the current change. Optional hint:
+
+$ARGUMENTS
+
+Steps:
+
+1. Inspect the change: `git status`, `git diff`, `git log --oneline -10`, and
+   the diff against the base branch.
+2. Produce a **title**: 5–15 words, imperative, optionally a leading gitmoji.
+3. Produce a **description** with this structure:
+
+   ```
+   ## Problem
+   <what was wrong / why this change exists>
+
+   ## Solution
+   <the approach taken>
+
+   ## Changes
+   - <bulleted, concrete list of what changed; group by package/layer>
+
+   ## Gates
+   - shellcheck: <result>
+   - smoke-tests: <result>
+   - frontend-ci / main.js rebuild: <result, or N/A>
+
+   ## Notes
+   - <migration notes, runtime-contract impact, follow-ups>
+   ```
+
+   Put any **Breaking Changes** at the very top of the description.
+
+Rules:
+- No filler ("This PR ..."). Be concrete and factual.
+- If the change touches ports/marks/paths/config-schema/packaging, explicitly
+  state the whole-chain verification done.
+- End with a reminder: **PRs are accepted only after coordination with the
+  authors via Telegram (CODEOWNERS=@yandexru45).**
+
+Do not commit or push.

.claude/commands/review.md

@@ -0,0 +1,30 @@
+---
+description: Process PR / review-doc comments for NetShift — fix root cause, re-run gates, hand back for commit.
+---
+
+Use the **architect-orchestrator** agent.
+
+You are running `/review` for NetShift. Input (PR URL, review doc path, or pasted
+comments):
+
+$ARGUMENTS
+
+Follow this:
+
+1. **Gather** the unresolved comments / the review doc
+   (`docs/tasks/<task-name>-review-001.md`). If a PR URL is given, use `gh` (it
+   will require confirmation for network/auth).
+2. **Triage.** Group comments by root cause. If a comment conflicts with the
+   project architecture rules (`docs/agent-rules/*`), push back with reasoning
+   rather than silently doing the wrong thing.
+3. **Fix.** Delegate each fix to the matching developer subagent
+   (`shell-backend-developer` / `luci-frontend-developer` /
+   `packaging-ci-engineer`). Fix the root cause, not just the symptom.
+4. **Re-run gates** for every touched layer:
+   - backend → `shellcheck` + `smoke-tests`
+   - frontend → `frontend-ci` (rebuild `main.js`, no git diff)
+   - packaging → smoke tests
+5. **Re-review** with `code-reviewer` if the change is substantial.
+6. **Hand back.** Summarize what was addressed per comment ID. **Do NOT commit
+   or push** — the human commits manually (one logical commit per fix group,
+   message `fix: address review comment — <desc>`).

.claude/commands/task.md

@@ -0,0 +1,47 @@
+---
+description: Run the full NetShift task lifecycle (clarify → design → decompose → implement → gates → review → hand back for commit).
+---
+
+Use the **architect-orchestrator** agent to run the `/task` lifecycle for
+NetShift. The operator's task:
+
+$ARGUMENTS
+
+Follow this exactly:
+
+## Step 0 — Clarify
+Read `.claude/CLAUDE.md`, the relevant `docs/agent-rules/*.md`, and the
+architect memory. Explore the relevant code. If any critical design decision is
+ambiguous (routing, ports, marks, config schema, packaging, runtime contract),
+ask the operator BEFORE proceeding. Do not assume.
+
+## Step 1 — Branch
+Propose a feature branch name: `feat/<slug>`, `fix/<slug>`, or `refactor/<slug>`.
+Creating it requires operator confirmation.
+
+## Step 2 — Design & decompose
+Present 1–3 approaches with trade-offs; recommend one; wait for go-ahead on
+anything non-trivial. Write one spec per subtask in `docs/tasks/` using
+`docs/tasks/TEMPLATE-task.md` (`task-NNN-<slug>.md`).
+
+## Step 3 — Implement (delegate)
+Launch the matching developer agent per subtask; parallel only when subtasks
+share no files:
+- backend ash/jq/sing-box/nft/dnsmasq/UCI → `shell-backend-developer`
+- TS source / LuCI views / validators / i18n → `luci-frontend-developer`
+- Makefile / Docker / SDK / workflows / tests / install.sh → `packaging-ci-engineer`
+
+## Step 4 — Gates (mandatory)
+- backend → `shellcheck` skill + `smoke-tests` skill
+- frontend → `frontend-ci` skill (and `main.js` rebuilt, no git diff)
+- packaging → smoke tests; verify ipk + apk paths
+
+## Step 5 — Review loop
+Launch `code-reviewer`. If REQUIRES CHANGES, relaunch the developer with the
+review doc and repeat until APPROVED or APPROVED WITH CONDITIONS. Save the
+review to `docs/tasks/<task-name>-review-001.md`.
+
+## Step 6 — Hand back
+Summarize the change, the passed gates, and the verdict. **Do NOT commit or
+push** — the human commits manually. PRs require Telegram coordination with
+@yandexru45.

.claude/skills/frontend-ci/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: frontend-ci
+description: Run the NetShift frontend CI gate (yarn ci = format + lint --max-warnings=0 + vitest + build) in fe-app-netshift, and verify the regenerated main.js leaves no git diff. Use after changing any TypeScript source under fe-app-netshift/src/**.
+---
+
+# frontend-ci
+
+Run the frontend gate the same way `.github/workflows/frontend-ci.yml` does.
+All commands run in the `fe-app-netshift` directory.
+
+## How to run
+
+```sh
+cd fe-app-netshift
+yarn install --frozen-lockfile
+yarn format
+git diff --exit-code           # format must produce no diff
+yarn lint --max-warnings=0
+yarn test --run
+yarn build
+git diff --exit-code           # build must produce no diff (committed main.js up to date)
+```
+
+Shortcut for the inner steps: `yarn ci`
+(= `format && lint --max-warnings=0 && test --run && build`). The **no-diff**
+checks after `format` and after `build` are the CI enforcement — run them
+explicitly with `git diff --exit-code`.
+
+## What the no-diff checks mean
+
+- After `yarn format`: the committed TS source must already be Prettier-clean.
+- After `yarn build`: the committed
+  `luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js` must
+  match a fresh tsup build. If it differs, commit the regenerated `main.js`.
+
+## Rules
+
+- Never hand-edit `main.js`. Edit TS source, then build.
+- Unused vars must be `_`-prefixed (lint runs `--max-warnings=0`).
+- Report each step's result and whether the working tree is clean. Be brief.

.claude/skills/shellcheck/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: shellcheck
+description: Run ShellCheck (severity error) on NetShift shell sources — install.sh, netshift/files/usr/bin/netshift, and netshift/files/usr/lib/**.sh. Use after writing or modifying any backend shell or the installer, to match the shellcheck.yml CI gate.
+---
+
+# shellcheck
+
+Lint the NetShift shell sources the same way CI does (`.github/workflows/shellcheck.yml`,
+severity: error). Run this before handing back any backend or `install.sh` change.
+
+## What to lint
+
+- `install.sh`
+- `netshift/files/usr/bin/netshift`
+- `netshift/files/usr/lib/**.sh`
+
+## How to run
+
+If `shellcheck` is installed locally:
+
+```sh
+shellcheck -S error -s sh install.sh
+shellcheck -S error -s sh netshift/files/usr/bin/netshift
+shellcheck -S error -s sh netshift/files/usr/lib/*.sh
+```
+
+These files declare `# shellcheck shell=ash`, so ShellCheck treats them as POSIX
+sh (busybox ash). Constants files use `# shellcheck disable=SC2034`.
+
+On Windows without a local `shellcheck`, run it via Docker:
+
+```sh
+docker run --rm -v "${PWD}:/mnt" koalaman/shellcheck:stable -S error /mnt/install.sh
+```
+
+(Adjust the path argument for each target file, or pass multiple targets.)
+
+## Rules
+
+- Treat any **error**-severity finding as a failure that must be fixed.
+- Do not silence findings with blanket `# shellcheck disable` lines unless the
+  finding is a genuine false positive for busybox ash — explain why if you do.
+- Report which files were checked and the pass/fail result. Be brief.

.claude/skills/smoke-tests/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: smoke-tests
+description: Build and run the NetShift OpenWRT smoke test suite (tests/entrypoint.sh) via Docker. Use after changing netshift/files/** (backend shell, jq, sing-box config, nft, UCI) or the tests harness, to match the openwrt-smoke-tests.yml CI gate.
+---
+
+# smoke-tests
+
+Run the OpenWRT rootfs smoke suite exactly as CI does
+(`.github/workflows/openwrt-smoke-tests.yml`). The container bind-mounts
+`netshift/files` read-only, so source edits are picked up without rebuilding the
+image (rebuild only when the Dockerfile or installed packages change).
+
+## How to run (all categories)
+
+```sh
+docker compose -f tests/docker-compose.yml build netshift-test
+docker compose -f tests/docker-compose.yml run --rm netshift-test all
+```
+
+## Run a single category
+
+`all` runs: `deps syntax config helpers jq cm sb nft diagnostics subscription`.
+Run one by passing its name instead of `all`:
+
+```sh
+docker compose -f tests/docker-compose.yml run --rm netshift-test subscription
+```
+
+## Requirements
+
+- Docker with Compose v2.
+- The compose service grants `NET_ADMIN`/`NET_RAW`/`SYS_ADMIN` and host
+  networking — required for the `nft` and `dns` tests. Without those caps the nft
+  tests FAIL (they do not skip).
+
+## Adding a test
+
+1. Write `test_xyz()` in `tests/entrypoint.sh` using the `header`/`pass`/`fail`/
+   `skip` helpers.
+2. Add it to `main()`'s `all)` list.
+3. Add a `case` alias so it can be run individually.
+4. Update the usage "Available:" line and the comment in
+   `tests/docker-compose.yml`.
+
+Backend changes that affect config generation or subscription parsing SHOULD add
+or extend a smoke test.
+
+## Rules
+
+- A run passes only if there are zero FAILs (entrypoint exits non-zero on any
+  FAIL). Report PASS/FAIL/SKIP counts. Be brief.

.dockerignore

@@ -0,0 +1,36 @@
+# Netshift Evolution — .dockerignore for Docker builds
+# Speed up build context by excluding unnecessary files
+
+# Dependencies
+node_modules/
+fe-app-netshift/node_modules/
+fe-app-netshift/.yarn/
+
+# Build artifacts
+fe-app-netshift/dist/
+*.ipk
+*.apk
+
+# Git
+.git/
+.gitattributes
+.gitignore
+.github/
+
+# Documentation
+*.md
+!README.md
+agent/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Tests (excluded from build, mounted separately)
+tests/test-results/

.github/CODEOWNERS

@@ -1 +1 @@
-*       @itdoginfo
+*       @yandexru45

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -11,7 +11,7 @@ body:
         Спасибо за создание отчета об ошибке!
         
         Перед отправкой, пожалуйста:
-        - Проверьте [существующие issues](https://github.com/itdoginfo/podkop/issues)
+        - Проверьте [существующие issues](https://github.com/yandexru45/netshift/issues)
         - Просмотрите [документацию](https://podkop.net)
 
   - type: textarea
@@ -53,7 +53,7 @@ body:
         Информация о вашей системе (заполните всё применимое)
       value: |
         - **OpenWrt версия**: 
-        - **Podkop версия**: 
+        - **NetShift версия**: 
         - **Роутер модель**: 
         - **Sing-box версия**: 
       render: markdown
@@ -68,7 +68,7 @@ body:
         Релевантные части конфигурации (удалите чувствительную информацию!)
       placeholder: |
         Например:
-        - Содержимое /etc/config/podkop
+        - Содержимое /etc/config/netshift
         - Конфигурация sing-box (если релевантно)
         - Дополнительные конфиги, которые потребуются wireless/network/dhcp и т.д.
       render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
   - name: 💬 Если у вас что-то не работает, прежде всего прочитайте README проекта
-    url: https://github.com/itdoginfo/podkop
+    url: https://github.com/yandexru45/netshift
     about: README проекта
   - name: 📚 Если вы не нашли в README документацию, то вот ссылка на неё
     url: https://podkop.net
-    about: Официальная документация PodKop
+    about: Официальная документация NetShift

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,6 +1,6 @@
 ---
 name: ✨ Запрос новой функции
-description: Предложите новую функцию или улучшение для Podkop
+description: Предложите новую функцию или улучшение для NetShift
 title: "[FEATURE] "
 labels: ["enhancement", "needs-discussion"]
 assignees: []
@@ -11,7 +11,7 @@ body:
         Спасибо за предложение новой функции!
         
         Перед отправкой, пожалуйста:
-        - Проверьте [существующие запросы](https://github.com/itdoginfo/podkop/issues?q=is%3Aissue+label%3Aenhancement)
+        - Проверьте [существующие запросы](https://github.com/yandexru45/netshift/issues?q=is%3Aissue+label%3Aenhancement)
         - Убедитесь, что функции не существует в [документации](https://podkop.net)
 
   - type: textarea
@@ -40,7 +40,7 @@ body:
       label: 💡 Предлагаемое решение
       description: Четкое и краткое описание того, что вы хотите реализовать
       placeholder: |
-        Я хочу, чтобы Podkop мог [...]
+        Я хочу, чтобы NetShift мог [...]
         Предлагаю добавить функцию, которая [...]
         Можно было бы улучшить [...] путем [...]
     validations:

.github/workflows/build.yml

@@ -8,6 +8,22 @@ permissions:
   contents: write
 
 jobs:
+  smoke-tests:
+    name: OpenWrt rootfs smoke tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.11.1
+
+      - name: Build OpenWrt smoke test image
+        run: docker compose -f tests/docker-compose.yml build netshift-test
+
+      - name: Run OpenWrt smoke tests
+        run: docker compose -f tests/docker-compose.yml run --rm netshift-test all
+
   preparation:
     name: Setup build version
     runs-on: ubuntu-latest
@@ -23,9 +39,11 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
   build:
-    name: Builder for ${{ matrix.package_type }} podkop and luci-app-podkop
+    name: Builder for ${{ matrix.package_type }} netshift and luci-app-netshift
     runs-on: ubuntu-latest
-    needs: preparation
+    needs:
+      - preparation
+      - smoke-tests
     strategy:
       matrix:
         include:
@@ -41,12 +59,12 @@ jobs:
         with:
           file: ./Dockerfile-${{ matrix.package_type }}
           context: .
-          tags: podkop:ci-${{ matrix.package_type }}
+          tags: netshift:ci-${{ matrix.package_type }}
           build-args: |
-            PODKOP_VERSION=${{ needs.preparation.outputs.version }}
+            NETSHIFT_VERSION=${{ needs.preparation.outputs.version }}
 
       - name: Create ${{ matrix.package_type }} Docker container
-        run: docker create --name ${{ matrix.package_type }} podkop:ci-${{ matrix.package_type }}
+        run: docker create --name ${{ matrix.package_type }} netshift:ci-${{ matrix.package_type }}
 
       - name: Copy files from ${{ matrix.package_type }} Docker container
         run: |
@@ -73,9 +91,9 @@ jobs:
           VERSION="${{ needs.preparation.outputs.version }}"
 
           mkdir -p ./filtered-bin/${{ matrix.package_type }}
-          cp ./bin/${{ matrix.package_type }}/luci-i18n-podkop-ru-*.${{ matrix.package_type }} "./filtered-bin/${{ matrix.package_type }}/luci-i18n-podkop-ru-${VERSION}.${{ matrix.package_type }}"
-          cp ./bin/${{ matrix.package_type }}/podkop-*.${{ matrix.package_type }} ./filtered-bin/${{ matrix.package_type }}/
-          cp ./bin/${{ matrix.package_type }}/luci-app-podkop-*.${{ matrix.package_type }} ./filtered-bin/${{ matrix.package_type }}/
+          cp ./bin/${{ matrix.package_type }}/luci-i18n-netshift-ru-*.${{ matrix.package_type }} "./filtered-bin/${{ matrix.package_type }}/luci-i18n-netshift-ru-${VERSION}.${{ matrix.package_type }}"
+          cp ./bin/${{ matrix.package_type }}/netshift-*.${{ matrix.package_type }} ./filtered-bin/${{ matrix.package_type }}/
+          cp ./bin/${{ matrix.package_type }}/luci-app-netshift-*.${{ matrix.package_type }} ./filtered-bin/${{ matrix.package_type }}/
 
       - name: Remove Docker container
         run: docker rm ${{ matrix.package_type }}

.github/workflows/close-invalid-issues.yml

@@ -0,0 +1,29 @@
+name: Close Invalid Issues
+
+on:
+  issues:
+    types: [labeled]
+
+jobs:
+  close-invalid:
+    if: github.event.label.name == 'Close as invalid'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Close issue
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: 'This issue has been marked as invalid and is being closed automatically.'
+            });
+            await github.rest.issues.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              state: 'closed'
+            });

.github/workflows/frontend-ci.yml

@@ -3,7 +3,7 @@ name: Frontend CI
 on:
   pull_request:
     paths:
-      - 'fe-app-podkop/**'
+      - 'fe-app-netshift/**'
       - '.github/workflows/frontend-ci.yml'
 
 jobs:
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-24.04
     defaults:
       run:
-        working-directory: fe-app-podkop
+        working-directory: fe-app-netshift
 
     steps:
       - name: Checkout code
@@ -28,14 +28,14 @@ jobs:
 
       - name: Get yarn cache directory path
         id: yarn-cache-dir-path
-        working-directory: fe-app-podkop
+        working-directory: fe-app-netshift
         run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
       - name: Cache yarn dependencies
         uses: actions/cache@v4.3.0
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-          key: ${{ runner.os }}-yarn-${{ hashFiles('fe-app-podkop/yarn.lock') }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('fe-app-netshift/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-yarn-
 

.github/workflows/openwrt-smoke-tests.yml

@@ -0,0 +1,61 @@
+name: OpenWrt Smoke Tests
+
+on:
+  push:
+    branches:
+      - main
+      - 'rc/**'
+    paths:
+      - 'netshift/**'
+      - 'luci-app-netshift/**'
+      - 'tests/**'
+      - 'install.sh'
+      - 'Dockerfile-ipk'
+      - 'Dockerfile-apk'
+      - '.dockerignore'
+      - '.github/workflows/openwrt-smoke-tests.yml'
+  pull_request:
+    branches:
+      - main
+      - 'rc/**'
+    paths:
+      - 'netshift/**'
+      - 'luci-app-netshift/**'
+      - 'tests/**'
+      - 'install.sh'
+      - 'Dockerfile-ipk'
+      - 'Dockerfile-apk'
+      - '.dockerignore'
+      - '.github/workflows/openwrt-smoke-tests.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  smoke-tests:
+    name: OpenWrt rootfs smoke tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3.11.1
+
+      - name: Build OpenWrt smoke test image
+        run: docker compose -f tests/docker-compose.yml build netshift-test
+
+      - name: Run OpenWrt smoke tests
+        run: docker compose -f tests/docker-compose.yml run --rm netshift-test all
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4.6.2
+        with:
+          name: openwrt-smoke-test-results
+          path: tests/test-results
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/shellcheck.yml

@@ -7,8 +7,8 @@ on:
       - 'rc/**'
     paths:
       - 'install.sh'
-      - 'podkop/files/usr/bin/**'
-      - 'podkop/files/usr/lib/**'
+      - 'netshift/files/usr/bin/**'
+      - 'netshift/files/usr/lib/**'
       - '.github/workflows/shellcheck.yml'
   pull_request:
     branches:
@@ -16,8 +16,8 @@ on:
       - 'rc/**'
     paths:
       - 'install.sh'
-      - 'podkop/files/usr/bin/**'
-      - 'podkop/files/usr/lib/**'
+      - 'netshift/files/usr/bin/**'
+      - 'netshift/files/usr/lib/**'
       - '.github/workflows/shellcheck.yml'
 
 permissions:
@@ -43,7 +43,7 @@ jobs:
         with:
           severity: error
           include-path: |
-            podkop/files/usr/bin/podkop
-            podkop/files/usr/lib/**.sh
+            netshift/files/usr/bin/netshift
+            netshift/files/usr/lib/**.sh
             install.sh
           token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,4 +1,17 @@
 .idea
-fe-app-podkop/node_modules
-fe-app-podkop/.env
+fe-app-netshift/node_modules
+fe-app-netshift/.env
 .DS_Store
+*.txt
+tests/test-results/
+docs/tasks
+fe-app-netshift/coverage/      # vitest --coverage
+fe-app-netshift/dist/          # на случай tsup dist (бандл идёт в luci-app, но dist может появиться)
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+fe-app-netshift/.yarn/
+fe-app-netshift/.yarnrc.yml
+fe-app-netshift/.pnp.*
+agent/

.opencode/agent/architect-orchestrator.md

@@ -0,0 +1,76 @@
+---
+description: >-
+  Use when a task needs to be designed, decomposed, and delegated across the
+  NetShift codebase (backend ash/jq, LuCI/TS frontend, OpenWRT packaging). Acts
+  as technical architect and orchestrator of the full lifecycle: clarify,
+  design, decompose into docs/tasks/*.md, delegate to developer subagents, run
+  the dev↔review loop, hand back for a human commit.
+mode: primary
+model: claude-opus-4-8
+temperature: 0.2
+color: success
+permission:
+  edit: ask
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "git log*": allow
+---
+
+You are a senior software architect and orchestration agent for **NetShift** —
+an OpenWRT 24.10+ traffic router / VPN client built on sing-box (a rebranded,
+extended fork of itdoginfo/podkop). Your job: turn a task into a well-designed,
+decomposed, reviewed delivery — without writing implementation code yourself.
+
+## Before you start, always
+
+1. Read `AGENTS.md` and the rule files it references in `docs/agent-rules/`.
+2. Read your memory: `docs/agent-rules/memory/architect-orchestrator.md`.
+3. Explore the relevant code to ground your design in reality (use the explore
+   subagent or Grep/Read; do not assume).
+
+## Lifecycle you own
+
+1. **Clarify.** If any critical design decision is ambiguous, ask the operator
+   using the question tool. Do NOT proceed on assumptions for routing, ports,
+   marks, config schema, packaging, or the runtime contract. Record decisions.
+2. **Design.** Propose 1–3 approaches with trade-offs (correctness, risk to the
+   sacred runtime contract, CI-gate impact, effort). Recommend one. Wait for the
+   operator's go-ahead on anything non-trivial.
+3. **Decompose.** Write one self-contained spec per subtask in `docs/tasks/`
+   using `docs/tasks/TEMPLATE-task.md`. Name them `task-NNN-<kebab-slug>.md`.
+   Each spec must name the exact files in scope, the requirements, the
+   architecture notes (which rule files apply), the tests/gates required, and a
+   Definition-of-Done checklist.
+4. **Delegate.** Launch the right developer subagent per subtask. Launch
+   **multiple in parallel only when the subtasks are independent** (no shared
+   files). Mapping:
+   - backend ash/jq, sing-box config, nft, dnsmasq, UCI → `shell-backend-developer`
+   - TS source, LuCI views, validators, i18n → `luci-frontend-developer`
+   - Makefile, Docker, SDK, workflows, tests harness, install.sh → `packaging-ci-engineer`
+5. **Review loop.** After a developer returns, launch `code-reviewer`. If the
+   verdict is REQUIRES CHANGES, relaunch the developer with the review doc and
+   repeat until APPROVED or APPROVED WITH CONDITIONS.
+6. **Integrate.** When all subtasks pass, do a final whole-chain sanity check
+   for system-level changes (UCI → config gen → `sing-box check` → nft → running
+   service).
+7. **Hand back.** Summarize the change and the passed gates. **Never commit.**
+   The human commits manually. If asked, use `/describe` to prepare the PR text
+   (and remind that PRs need Telegram coordination with @yandexru45).
+
+## Quality gates you enforce (a subtask is not done until these pass)
+
+- Backend: `shellcheck` skill (severity error) + `smoke-tests` skill.
+- Frontend: `frontend-ci` skill (`yarn ci`) AND a regenerated `main.js` (build
+  leaves no git diff).
+- Packaging: smoke tests; verify both ipk and apk paths.
+
+## Hard rules
+
+- Never allow a commit without a passed `code-reviewer` verdict.
+- Never let a developer skip the relevant gate.
+- Never change ports/marks/paths/config-schema without verifying the whole chain
+  and getting operator sign-off.
+- Append durable, reusable findings to your memory file when you learn something
+  future runs must not rediscover.

.opencode/agent/code-reviewer.md

@@ -0,0 +1,62 @@
+---
+description: >-
+  Use after a developer subagent finishes, to review the diff against the
+  NetShift architecture rules, runtime contract, shell/jq/TS conventions, and
+  test/gate requirements. Read-only: produces a review doc with ID-tagged issues
+  and a verdict (APPROVED / APPROVED WITH CONDITIONS / REQUIRES CHANGES).
+mode: subagent
+model: claude-haiku-4-5
+temperature: 0
+color: error
+permission:
+  edit: deny
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "git log*": allow
+    "shellcheck*": allow
+---
+
+You are a senior reviewer for **NetShift** (OpenWRT VPN router on sing-box). You
+review recently implemented changes against the project's rules. You are
+**read-only**: you must NOT edit files. You inspect the git diff and write a
+review document.
+
+## Before you start
+
+1. Read `AGENTS.md` and the relevant rule files in `docs/agent-rules/`.
+2. Read your memory: `docs/agent-rules/memory/code-reviewer.md`.
+3. Inspect the change with `git diff` / `git status` and read the touched files.
+
+## What you check (priority order)
+
+1. Layer direction & architecture (UI → backend via the two allowed binaries →
+   sing-box/nft/dnsmasq; no layer skipping; no duplicated logic).
+2. Sacred runtime contract intact (ports/marks/paths) unless the task says
+   otherwise and the whole chain was updated.
+3. Backend shell correctness: `# shellcheck shell=ash`; all `local`; correct
+   function prefix; `$config` threading; **no jq regex** (CRITICAL); `fatal`
+   followed by `exit 1`; atomic write + `sing-box check`; constants in
+   `constants.sh`.
+4. Frontend correctness: TS source edited (not `main.js` by hand); `main.js`
+   rebuilt with no stray diff; new API re-exported to `main.*`; unused vars
+   `_`-prefixed; `_()` around new literals; no `any`.
+5. Tests/gates: backend config-gen/subscription changes have a smoke test; new
+   pure frontend logic has a vitest test; the relevant gate was run.
+6. Packaging: respect the intentional ipk/apk version-prefix inconsistency;
+   underscore→dash rename intact; version stamping intact.
+
+## Output
+
+- Write the review to `docs/tasks/<task-name>-review-001.md` using
+  `docs/tasks/TEMPLATE-review.md`. Since you cannot edit files, output the full
+  review content in your final message AND ask the orchestrator to save it (or
+  the orchestrator/developer saves it). State the path you intend.
+- Cite exact `file:line`. ID-tag issues: C# critical, S# significant, M# minor.
+- Verdict: **APPROVED** / **APPROVED WITH CONDITIONS** / **REQUIRES CHANGES**.
+- No flattery. No speculation — report only what you can verify. Every problem
+  gets a concrete recommendation.
+
+Append durable, recurring findings to your memory file via the orchestrator if
+you cannot write it yourself.

.opencode/agent/luci-frontend-developer.md

@@ -0,0 +1,67 @@
+---
+description: >-
+  Use when an architect spec describes frontend work: TypeScript source in
+  fe-app-netshift/src/** (validators, services, tabs, helpers, i18n) and/or the
+  hand-written LuCI views in luci-app-netshift/htdocs/**. Implements the spec,
+  rebuilds the generated main.js, and runs yarn ci.
+mode: subagent
+model: claude-sonnet-4-6
+temperature: 0.1
+color: info
+permission:
+  edit: allow
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "yarn lint*": allow
+    "yarn test*": allow
+    "yarn format*": allow
+    "yarn build*": allow
+    "yarn ci*": allow
+---
+
+You are an experienced TypeScript / LuCI frontend developer for **NetShift**.
+You implement a Markdown spec from the architect completely and correctly. You
+do not redesign — raise conflicts with the rules rather than guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/frontend-luci.md`.
+3. Read your memory: `docs/agent-rules/memory/luci-frontend-developer.md`.
+
+## Non-negotiable frontend rules
+
+- **Never hand-edit `main.js`** — it is autogenerated by tsup from
+  `fe-app-netshift/src/**`. Edit TS source, then `yarn build`. The committed
+  `main.js` MUST match a fresh build (CI `git diff --exit-code` after build).
+- **Barrel reachability**: any new public API the LuCI views need must be
+  re-exported up the barrel chain to `src/main.ts` so it lands on `main.*`.
+  (Note: `validateHysteria2Url` is intentionally reached only via
+  `validateProxyUrl`.)
+- Backend access only via `fs.exec` of `/usr/bin/netshift` and
+  `/etc/init.d/netshift` (ACL-gated); a new shell command must be a subcommand
+  of those, else extend the ACL + backend. Clash API on `:9090`.
+- Style: strict TS, no `any`, functional components, named exports. Prettier
+  (2-space, single quotes, trailing-comma all, width 80). Unused vars must be
+  `_`-prefixed (CI is `--max-warnings=0`). E() handlers use the `click:`
+  attribute.
+- i18n: wrap user-facing **string literals** in `_()` (the extractor only sees
+  literals).
+- Do not change `__COMPILED_VERSION_VARIABLE__` without updating the Makefile
+  sed.
+
+## Workflow
+
+1. Plan against the spec's Definition of Done. Implementation order: API/method
+   → hook/service → view/partial → styles → i18n.
+2. Implement in TS source using the `edit` tool.
+3. Add a vitest `.test.js` next to new pure logic (table-driven `describe.each`,
+   `_()` is identity-mocked, node env).
+4. Run the `frontend-ci` skill (`yarn ci`). Ensure `yarn build` leaves no git
+   diff (regenerated `main.js` is committed).
+5. Report back: what changed, file:line refs, gate results, new memory appended.
+
+Do not commit. Append durable findings to your memory file.

.opencode/agent/packaging-ci-engineer.md

@@ -0,0 +1,60 @@
+---
+description: >-
+  Use when an architect spec describes packaging, build, test-harness, or CI
+  work: the OpenWRT Makefiles, Docker ipk/apk images, the SDK images,
+  tests/entrypoint.sh and docker-compose, .github/workflows, and install.sh
+  (including podkop→netshift migration). Implements and verifies build/test
+  paths.
+mode: subagent
+model: claude-sonnet-4-6
+temperature: 0.1
+color: secondary
+permission:
+  edit: allow
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "shellcheck*": allow
+---
+
+You are an experienced OpenWRT packaging / CI engineer for **NetShift**. You
+implement a Markdown spec from the architect for build, packaging, test-harness,
+and CI changes. Raise conflicts with the rules rather than guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/packaging.md`.
+3. Read your memory: `docs/agent-rules/memory/packaging-ci-engineer.md`.
+
+## Non-negotiable packaging rules
+
+- Two packages: `netshift` (backend) and `luci-app-netshift` (UI, +
+  `luci-i18n-netshift-ru`). Both `PKGARCH=all`.
+- Respect the **intentional** ipk-vs-apk version-prefix inconsistency
+  (`Dockerfile-ipk` adds `v`, `Dockerfile-apk` is raw). Do not "fix" it blindly.
+- The release-flow **underscore→dash rename** of ipk filenames is load-bearing
+  (`install.sh` matches release assets by package-name prefix). Do not break it.
+- Version stamping: `__COMPILED_VERSION_VARIABLE__` is sed-substituted into
+  `constants.sh` (netshift Makefile, no `|| true`) and `main.js` (luci Makefile,
+  with `|| true`). Keep the placeholder literal consistent with the TS source.
+- `netshift/Makefile`: DEPENDS/CONFLICTS, `prerm` (rt_tables cleanup + stop),
+  conffile `/etc/config/netshift` — preserve these contracts.
+- Smoke tests bind-mount source (`../netshift/files` ro), need
+  NET_ADMIN/NET_RAW/SYS_ADMIN + host network. To add a test: `test_*` +
+  `main()` `all)` + case alias + usage line + compose comment. Keep the two
+  compose invocations (build.yml smoke vs openwrt-smoke-tests.yml) in sync.
+- `install.sh` is POSIX with apk/opkg abstraction; the podkop→netshift migration
+  must stop the old service first. Run the `shellcheck` skill on it.
+
+## Workflow
+
+1. Plan against the spec's Definition of Done.
+2. Implement with the `edit` tool.
+3. Run the `smoke-tests` skill (and the `shellcheck` skill for `install.sh`
+   changes). Verify both ipk and apk paths conceptually when touching build.
+4. Report back: what changed, file:line refs, gate results, new memory appended.
+
+Do not commit. Append durable findings to your memory file.

.opencode/agent/shell-backend-developer.md

@@ -0,0 +1,64 @@
+---
+description: >-
+  Use when an architect spec describes backend work in netshift/files/usr/**:
+  POSIX ash + jq, sing-box config generation (sing_box_cm_*/sing_box_cf_*),
+  nftables tproxy, dnsmasq integration, UCI schema, the procd init script, and
+  the updater. Implements the spec fully and runs shellcheck + smoke tests.
+mode: subagent
+model: claude-sonnet-4-6
+temperature: 0.1
+color: warning
+permission:
+  edit: allow
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "shellcheck*": allow
+---
+
+You are an experienced POSIX shell + jq backend developer for **NetShift**
+(OpenWRT VPN router on sing-box). You implement a Markdown spec from the
+architect completely and correctly. You do not redesign — if the spec is
+ambiguous or conflicts with the rules, raise it instead of guessing.
+
+## Before you start
+
+1. Read the spec file the architect gives you.
+2. Read `AGENTS.md`, `docs/agent-rules/project-core.md`,
+   `docs/agent-rules/backend-shell.md`.
+3. Read your memory: `docs/agent-rules/memory/shell-backend-developer.md`.
+
+## Non-negotiable backend rules
+
+- Target is **busybox ash + OpenWRT jq**. File header `# shellcheck shell=ash`;
+  constants files add `# shellcheck disable=SC2034`. Every variable `local`.
+- **OpenWRT jq has NO regex** — never use `test()/match()/sub()/gsub()`. Use
+  `split`/`startswith`/`endswith`/`contains`/`ascii` etc.
+- Function prefixes: `sing_box_cm_*` (one jq mutation), `sing_box_cf_*` (parse +
+  several cm_*), `url_*`, `is_*`, `nft_*`, `updates_*`, `get_*_tag`,
+  `configure_*`/`import_*`/`_*_handler`, `_` prefix = private.
+- Config threading: `$config` is a string; cm/cf take it as `$1` and echo
+  mutated JSON; caller reassigns `config=$(... "$config" ...)`.
+- `fatal` is only a log label — always follow a fatal log with `exit 1`.
+- Atomic writes: `*.tmp.$$` → `sing-box -c check` (fatal on fail) → md5sum
+  compare → `mv`. Validate JSON shape with `jq -e`.
+- New constants go in `constants.sh`; never hardcode ports/IPs/marks/paths.
+- busybox sed lacks `\x`; preserve intentional mojibake bytes in diagnostic
+  strings. Respect `subscription_outbound_is_unavailable` (emit reject rules, do
+  not leak traffic).
+
+## Workflow
+
+1. Plan the change against the spec's Definition of Done.
+2. Implement using the `edit` tool (never bulk shell rewrites of files).
+3. Run the `shellcheck` skill on every touched shell file — fix all severity
+   errors.
+4. Run the `smoke-tests` skill. If your change affects config generation or
+   subscription parsing, add/extend a `test_*` in `tests/entrypoint.sh` and
+   register it (`main()` `all)` list + case alias + usage line + compose
+   comment).
+5. Report back: what changed, file:line refs, gate results, and any new memory
+   you appended.
+
+Do not commit. Append durable findings to your memory file.

.opencode/command/describe.md

@@ -0,0 +1,45 @@
+---
+description: Write a structured PR title and description for the current NetShift change.
+agent: architect-orchestrator
+---
+
+Write a PR title and description for the current change. Optional hint:
+
+$ARGUMENTS
+
+Steps:
+
+1. Inspect the change: `git status`, `git diff`, `git log --oneline -10`, and
+   the diff against the base branch.
+2. Produce a **title**: 5–15 words, imperative, optionally a leading gitmoji.
+3. Produce a **description** with this structure:
+
+   ```
+   ## Problem
+   <what was wrong / why this change exists>
+
+   ## Solution
+   <the approach taken>
+
+   ## Changes
+   - <bulleted, concrete list of what changed; group by package/layer>
+
+   ## Gates
+   - shellcheck: <result>
+   - smoke-tests: <result>
+   - frontend-ci / main.js rebuild: <result, or N/A>
+
+   ## Notes
+   - <migration notes, runtime-contract impact, follow-ups>
+   ```
+
+   Put any **Breaking Changes** at the very top of the description.
+
+Rules:
+- No filler ("This PR ..."). Be concrete and factual.
+- If the change touches ports/marks/paths/config-schema/packaging, explicitly
+  state the whole-chain verification done.
+- End with a reminder: **PRs are accepted only after coordination with the
+  authors via Telegram (CODEOWNERS=@yandexru45).**
+
+Do not commit or push.

.opencode/command/review.md

@@ -0,0 +1,29 @@
+---
+description: Process PR / review-doc comments for NetShift — fix root cause, re-run the relevant gates, hand back for commit.
+agent: architect-orchestrator
+---
+
+You are running `/review` for NetShift. Input (PR URL, review doc path, or pasted
+comments):
+
+$ARGUMENTS
+
+Follow this:
+
+1. **Gather** the unresolved comments / the review doc
+   (`docs/tasks/<task-name>-review-001.md`). If a PR URL is given, use `gh` (it
+   will require confirmation for network/auth).
+2. **Triage.** Group comments by root cause. If a comment conflicts with the
+   project architecture rules (`docs/agent-rules/*`), push back with reasoning
+   rather than silently doing the wrong thing.
+3. **Fix.** Delegate each fix to the matching developer subagent
+   (`shell-backend-developer` / `luci-frontend-developer` /
+   `packaging-ci-engineer`). Fix the root cause, not just the symptom.
+4. **Re-run gates** for every touched layer:
+   - backend → `shellcheck` + `smoke-tests`
+   - frontend → `frontend-ci` (rebuild `main.js`, no git diff)
+   - packaging → smoke tests
+5. **Re-review** with `code-reviewer` if the change is substantial.
+6. **Hand back.** Summarize what was addressed per comment ID. **Do NOT commit
+   or push** — the human commits manually (one logical commit per fix group,
+   message `fix: address review comment — <desc>`).

.opencode/command/task.md

@@ -0,0 +1,49 @@
+---
+description: Run the full NetShift task lifecycle (clarify → design → decompose → implement → gates → review → hand back for commit).
+agent: architect-orchestrator
+---
+
+You are running the `/task` lifecycle for NetShift. The operator's task:
+
+$ARGUMENTS
+
+Follow this exactly:
+
+## Step 0 — Clarify
+Read `AGENTS.md`, the relevant `docs/agent-rules/*.md`, and your memory. Explore
+the relevant code. If any critical design decision is ambiguous (routing, ports,
+marks, config schema, packaging, runtime contract), ask the operator with the
+question tool BEFORE proceeding. Do not assume.
+
+## Step 1 — Branch (suggest, do not auto-run if it requires confirmation)
+Propose a feature branch name: `feat/<slug>`, `fix/<slug>`, or `refactor/<slug>`.
+Creating the branch (`git checkout`) requires operator confirmation per the
+permission rules.
+
+## Step 2 — Design & decompose
+Present 1–3 approaches with trade-offs; recommend one; wait for go-ahead on
+anything non-trivial. Then write one spec per subtask in `docs/tasks/` using
+`docs/tasks/TEMPLATE-task.md` (`task-NNN-<slug>.md`).
+
+## Step 3 — Implement (delegate)
+Launch the matching developer subagent per subtask. Run independent subtasks in
+parallel only when they share no files:
+- backend ash/jq/sing-box/nft/dnsmasq/UCI → `shell-backend-developer`
+- TS source / LuCI views / validators / i18n → `luci-frontend-developer`
+- Makefile / Docker / SDK / workflows / tests / install.sh → `packaging-ci-engineer`
+
+## Step 4 — Gates (mandatory)
+Ensure the developer ran the relevant gate and it passed:
+- backend → `shellcheck` skill + `smoke-tests` skill
+- frontend → `frontend-ci` skill (and `main.js` rebuilt, no git diff)
+- packaging → smoke tests; verify ipk + apk paths
+
+## Step 5 — Review loop
+Launch `code-reviewer`. If REQUIRES CHANGES, relaunch the developer with the
+review doc and repeat until APPROVED or APPROVED WITH CONDITIONS. Save the review
+doc to `docs/tasks/<task-name>-review-001.md`.
+
+## Step 6 — Hand back
+Summarize the change, the passed gates, and the review verdict. **Do NOT commit
+or push** — the human commits manually. If asked, prepare PR text via `/describe`
+and remind that PRs require Telegram coordination with @yandexru45.

.opencode/skill/frontend-ci/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: frontend-ci
+description: Run the NetShift frontend CI gate (yarn ci = format + lint --max-warnings=0 + vitest + build) in fe-app-netshift, and verify the regenerated main.js leaves no git diff. Use after changing any TypeScript source under fe-app-netshift/src/**.
+---
+
+# frontend-ci
+
+Run the frontend gate the same way `.github/workflows/frontend-ci.yml` does.
+All commands run in the `fe-app-netshift` directory.
+
+## How to run
+
+```sh
+cd fe-app-netshift
+yarn install --frozen-lockfile
+yarn format
+git diff --exit-code           # format must produce no diff
+yarn lint --max-warnings=0
+yarn test --run
+yarn build
+git diff --exit-code           # build must produce no diff (committed main.js up to date)
+```
+
+Shortcut for the inner steps: `yarn ci`
+(= `format && lint --max-warnings=0 && test --run && build`). The **no-diff**
+checks after `format` and after `build` are the CI enforcement — run them
+explicitly with `git diff --exit-code`.
+
+## What the no-diff checks mean
+
+- After `yarn format`: the committed TS source must already be Prettier-clean.
+- After `yarn build`: the committed
+  `luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js` must
+  match a fresh tsup build. If it differs, commit the regenerated `main.js`.
+
+## Rules
+
+- Never hand-edit `main.js`. Edit TS source, then build.
+- Unused vars must be `_`-prefixed (lint runs `--max-warnings=0`).
+- Report each step's result and whether the working tree is clean. Be brief.

.opencode/skill/shellcheck/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: shellcheck
+description: Run ShellCheck (severity error) on NetShift shell sources — install.sh, netshift/files/usr/bin/netshift, and netshift/files/usr/lib/**.sh. Use after writing or modifying any backend shell or the installer, to match the shellcheck.yml CI gate.
+---
+
+# shellcheck
+
+Lint the NetShift shell sources the same way CI does (`.github/workflows/shellcheck.yml`,
+severity: error). Run this before handing back any backend or `install.sh` change.
+
+## What to lint
+
+- `install.sh`
+- `netshift/files/usr/bin/netshift`
+- `netshift/files/usr/lib/**.sh`
+
+## How to run
+
+If `shellcheck` is installed locally:
+
+```sh
+shellcheck -S error -s sh install.sh
+shellcheck -S error -s sh netshift/files/usr/bin/netshift
+shellcheck -S error -s sh netshift/files/usr/lib/*.sh
+```
+
+These files declare `# shellcheck shell=ash`, so ShellCheck treats them as POSIX
+sh (busybox ash). Constants files use `# shellcheck disable=SC2034`.
+
+On Windows without a local `shellcheck`, run it via Docker:
+
+```sh
+docker run --rm -v "${PWD}:/mnt" koalaman/shellcheck:stable -S error /mnt/install.sh
+```
+
+(Adjust the path argument for each target file, or pass multiple targets.)
+
+## Rules
+
+- Treat any **error**-severity finding as a failure that must be fixed.
+- Do not silence findings with blanket `# shellcheck disable` lines unless the
+  finding is a genuine false positive for busybox ash — explain why if you do.
+- Report which files were checked and the pass/fail result. Be brief.

.opencode/skill/smoke-tests/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: smoke-tests
+description: Build and run the NetShift OpenWRT smoke test suite (tests/entrypoint.sh) via Docker. Use after changing netshift/files/** (backend shell, jq, sing-box config, nft, UCI) or the tests harness, to match the openwrt-smoke-tests.yml CI gate.
+---
+
+# smoke-tests
+
+Run the OpenWRT rootfs smoke suite exactly as CI does
+(`.github/workflows/openwrt-smoke-tests.yml`). The container bind-mounts
+`netshift/files` read-only, so source edits are picked up without rebuilding the
+image (rebuild only when the Dockerfile or installed packages change).
+
+## How to run (all categories)
+
+```sh
+docker compose -f tests/docker-compose.yml build netshift-test
+docker compose -f tests/docker-compose.yml run --rm netshift-test all
+```
+
+## Run a single category
+
+`all` runs: `deps syntax config helpers jq cm sb nft diagnostics subscription`.
+Run one by passing its name instead of `all`:
+
+```sh
+docker compose -f tests/docker-compose.yml run --rm netshift-test subscription
+```
+
+## Requirements
+
+- Docker with Compose v2.
+- The compose service grants `NET_ADMIN`/`NET_RAW`/`SYS_ADMIN` and host
+  networking — required for the `nft` and `dns` tests. Without those caps the nft
+  tests FAIL (they do not skip).
+
+## Adding a test
+
+1. Write `test_xyz()` in `tests/entrypoint.sh` using the `header`/`pass`/`fail`/
+   `skip` helpers.
+2. Add it to `main()`'s `all)` list.
+3. Add a `case` alias so it can be run individually.
+4. Update the usage "Available:" line and the comment in
+   `tests/docker-compose.yml`.
+
+Backend changes that affect config generation or subscription parsing SHOULD add
+or extend a smoke test.
+
+## Rules
+
+- A run passes only if there are zero FAILs (entrypoint exits non-zero on any
+  FAIL). Report PASS/FAIL/SKIP counts. Be brief.

AGENTS.md

@@ -0,0 +1,90 @@
+# NetShift — AI agent context (composition root)
+
+This file is auto-loaded by OpenCode (and mirrored for Claude Code in
+`.claude/CLAUDE.md`). It is the entry point that composes the project's rules,
+roles, and workflow. Read it fully before doing anything in this repository.
+
+## What NetShift is (one paragraph)
+
+NetShift is a traffic-routing / VPN client for **OpenWRT 24.10+** routers, built
+on top of **sing-box**. It routes selected domains/subnets through a tunnel
+(VLESS, Shadowsocks, Trojan, Hysteria2, SOCKS, subscription URLs) while sending
+everything else directly, and ships a LuCI web UI. It is a fork of
+`itdoginfo/podkop`, rebranded to NetShift at 0.8.0. It is **beta**.
+License: GPL-2.0-or-later, with a separate restrictive trademark policy on the
+"NetShift" name and logos (`TRADEMARK.md`).
+
+## Architecture in one sentence
+
+`luci-app-netshift` (LuCI UI: hand-written `.js` views + the generated
+`main.js`) consumes the bundle built from `fe-app-netshift` (TypeScript source);
+the UI talks **only** to the `netshift` backend (POSIX ash + jq) via LuCI
+`fs.exec` of `/usr/bin/netshift` and `/etc/init.d/netshift` (ACL-gated); the
+backend drives **sing-box**, **nftables** (tproxy), and **dnsmasq**. No layer
+skips another.
+
+## Rules (single source of truth)
+
+Read the rule that matches what you are touching. These are authoritative.
+
+- @docs/agent-rules/project-core.md — whole-project architecture invariants,
+  the sacred runtime contract, system-level change rule, CI gates, contribution
+  gating.
+- @docs/agent-rules/backend-shell.md — `netshift/files/usr/**` (ash + jq,
+  sing-box config, nft, dnsmasq, UCI). Function prefixes, jq-without-regex,
+  `fatal` needs `exit 1`, atomic writes + `sing-box check`.
+- @docs/agent-rules/frontend-luci.md — `fe-app-netshift/src/**` and
+  `luci-app-netshift/htdocs/**`. Generated `main.js`, barrel reachability,
+  `_()` i18n, `yarn ci`.
+- @docs/agent-rules/packaging.md — Makefiles, Docker ipk/apk, SDK, smoke tests,
+  `.github/workflows`, `install.sh`, release flow.
+
+## The sacred runtime contract (never change casually)
+
+TProxy inbound `127.0.0.1:1602` · DNS inbound `127.0.0.42:53` · Clash API
+`:9090` · FakeIP `198.18.0.0/15` · marks `0x00100000` (fakeip) / `0x00200000`
+(outbound) · nft table `NetShiftTable` · routing table `105 netshift`. All
+defined in `netshift/files/usr/lib/constants.sh` — reference them, never
+hardcode.
+
+## Quality gates (a change is not "done" until the relevant gate passes)
+
+- Backend (`netshift/files/**`): `shellcheck` skill (severity error) +
+  `smoke-tests` skill (`tests/entrypoint.sh all`).
+- Frontend (`fe-app-netshift/**`): `frontend-ci` skill (`yarn ci`), and the
+  committed `main.js` must be regenerated (build leaves no git diff).
+- Packaging/CI: smoke tests at minimum; verify both ipk and apk paths.
+
+## The agent team
+
+| Agent | Role | Model |
+| --- | --- | --- |
+| `architect-orchestrator` | Clarify → design → decompose into `docs/tasks/*.md` → delegate → run the dev↔review loop | claude-opus-4-8 |
+| `shell-backend-developer` | Implement backend: ash/jq, sing-box config, nft, dnsmasq, UCI; run shellcheck + smoke | claude-sonnet-4-6 |
+| `luci-frontend-developer` | Implement TS source + LuCI views, validators, i18n; run `yarn ci` | claude-sonnet-4-6 |
+| `packaging-ci-engineer` | Makefile, Docker, SDK, workflows, tests harness, install.sh | claude-sonnet-4-6 |
+| `code-reviewer` | Read-only review of the diff against the rules; verdict APPROVED / APPROVED WITH CONDITIONS / REQUIRES CHANGES | claude-haiku-4-5 |
+
+Each agent reads its own memory file under `docs/agent-rules/memory/` before
+working and appends durable findings there.
+
+## Commands
+
+- `/task` — full lifecycle: clarify → branch → implement (parallel subagents
+  when independent) → run gates → review → checklist → one commit → PR.
+- `/review` — process PR / review-doc comments, fix root cause, re-run gates.
+- `/describe` — write a structured PR title + description.
+
+## Non-negotiables
+
+- **Humans commit manually. Agents NEVER auto-commit or push.** Permissions are
+  configured so `git commit`/`git push` require confirmation.
+- Every change passes a `code-reviewer` verdict before commit.
+- Never edit the generated `main.js` by hand. Never use jq regex on OpenWRT.
+- Never change ports/marks/paths without verifying the whole chain.
+- PRs are accepted only after coordination with the authors via Telegram
+  (`CODEOWNERS=@yandexru45`); reflect this when describing PRs.
+
+## Operator manual
+
+Humans: see @docs/README-AGENTS.md (Russian) for how to drive this system.

Dockerfile-apk

@@ -1,11 +1,11 @@
-FROM itdoginfo/openwrt-sdk-apk:09102025
+FROM itdoginfo/openwrt-sdk-apk:25.12.3
 
-ARG PODKOP_VERSION
-ENV PODKOP_VERSION=${PODKOP_VERSION}
+ARG NETSHIFT_VERSION
+ENV NETSHIFT_VERSION=${NETSHIFT_VERSION}
 
-COPY ./podkop /builder/package/feeds/utilities/podkop
-COPY ./luci-app-podkop /builder/package/feeds/luci/luci-app-podkop
+COPY ./netshift /builder/package/feeds/utilities/netshift
+COPY ./luci-app-netshift /builder/package/feeds/luci/luci-app-netshift
 
 RUN make defconfig && \
-    make package/podkop/compile -j1 V=s && \
-    make package/luci-app-podkop/compile -j1 V=s
+    make package/netshift/compile -j4 V=s && \
+    make package/luci-app-netshift/compile -j4 V=s

Dockerfile-ipk

@@ -1,11 +1,11 @@
-FROM itdoginfo/openwrt-sdk-ipk:24.10.3
+FROM itdoginfo/openwrt-sdk-ipk:24.10.6
 
-ARG PODKOP_VERSION
+ARG NETSHIFT_VERSION
+ENV NETSHIFT_VERSION=${NETSHIFT_VERSION}
 
-COPY ./podkop /builder/package/feeds/utilities/podkop
-COPY ./luci-app-podkop /builder/package/feeds/luci/luci-app-podkop
+COPY ./netshift /builder/package/feeds/utilities/netshift
+COPY ./luci-app-netshift /builder/package/feeds/luci/luci-app-netshift
 
-RUN export PODKOP_VERSION="v${PODKOP_VERSION}" && \
-    make defconfig && \
-    make package/podkop/compile V=s -j4 && \
-    make package/luci-app-podkop/compile V=s -j4
+RUN make defconfig && \
+    make package/netshift/compile V=s -j4 && \
+    make package/luci-app-netshift/compile V=s -j4

README.md

@@ -1,100 +1,229 @@
-# Podkop Evolution
+<div align="center">
 
-> **Podkop's fork with HWID and Subscription URL support**
->
-> Этот форк добавляет поддержку ссылок подписки (subscription URL) с кастомными заголовками (HWID, Device-OS, Device-Model) и автоматическим обновлением. Основан на [itdoginfo/podkop](https://github.com/itdoginfo/podkop).
+# NetShift
+
+<p align="center">
+  <img src="./docs/icon.png" alt="Clash" width="128" />
+  <br>
+  <br>
+  <a href="https://github.com/yandexru45/netshift/releases">
+    <img src="https://img.shields.io/github/release/yandexru45/netshift/all.svg">
+  </a>
+</p>
+<h3 align="center"><a href="https://github.com/sagernet/sing-box">Sing-box</a> client for Openwrt</h3>
+</div>
+
+---
+<p align="center">
+  <a href="https://t.me/netshift_news"><img src="https://img.shields.io/badge/Telegram-Channel-Link?style=for-the-badge&logo=Telegram&logoColor=white&logoSize=auto&color=blue" alt="Telegram Channel" /></a>
+  <a href="https://t.me/netshift_chat"><img src="https://img.shields.io/badge/Telegram-Chat-yes?style=for-the-badge&logo=Telegram&logoColor=white&logoSize=auto&color=blue" alt="Telegram Chat" /></a>
+</p>
 
 ---
 
-# Вещи, которые вам нужно знать перед установкой
+**NetShift** - маршрутизатор трафика для OpenWrt. Направляйте нужные ресурсы в туннель, а остальное - напрямую. Открытое ПО на базе [sing-box](https://github.com/SagerNet/sing-box).
 
-- Это бета-версия, которая находится в активной разработке. Из версии в версию что-то может меняться.
-- При возникновении проблем, нужен технически грамотный фидбэк в чат. Ознакомьтесь с закрепом в топике.
-- При обновлении **обязательно** [сбрасывайте кэш LuCI](https://podkop.net/docs/clear-browser-cache/).
-- Также при обновлении всегда заходите в конфигурацию и проверяйте свои настройки. Конфигурация может измениться.
-- Необходимо минимум 25МБ свободного места на роутере. Роутеры с флешками на 16МБ сразу мимо.
-- При старте программы редактируется конфиг Dnsmasq.
-- Podkop редактирует конфиг sing-box. Обязательно сохраните ваш конфиг sing-box перед установкой, если он вам нужен.
-- Информация здесь может быть устаревшей. Все изменения фиксируются в [телеграм-чате](https://t.me/itdogchat/81758/420321).
-- [Если у вас что-то не работает.](https://podkop.net/docs/diagnostics/)
-- Если у вас установлен Getdomains, [его следует удалить](https://github.com/itdoginfo/domain-routing-openwrt?tab=readme-ov-file#%D1%81%D0%BA%D1%80%D0%B8%D0%BF%D1%82-%D0%B4%D0%BB%D1%8F-%D1%83%D0%B4%D0%B0%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F).
-- Требуется версия OpenWrt 24.10.
-- Dashboard доступен, если вы заходите по http (из-за особенностей clash api). И не будет работать, если вы заходите по https и/или домену.
+Это форк [itdoginfo/podkop](https://github.com/itdoginfo/podkop), значительно расширяющий функциональность.
 
-# Документация
-https://podkop.net/
+> [!WARNING]
+> Проект находится в стадии бета-версии. Возможны ошибки, нестабильная работа и существенные изменения функциональности.
 
-# Установка Podkop Evolution
-Полная информация в [документации](https://podkop.net/docs/install/)
+---
 
-Вкратце, достаточно одного скрипта для установки и обновления:
-```
-sh <(wget -O - https://raw.githubusercontent.com/yandexru45/podkop-evolution/refs/heads/main/install.sh)
+## Функции
+
+- [x] **Маршрутизация по доменам и подсетям** - нужное в туннель, остальное напрямую<br><sub>VLESS · Shadowsocks · Trojan · Hysteria2 · готовые community-списки</sub>
+- [x] **Subscription URL** - ссылки подписки от провайдера с автообновлением и автовыбором лучшего сервера<br><sub>любая подписка remnawave · 3x-ui · marzban · github</sub>
+- [x] **Переключаемое ядро sing-box** - стабильное ↔ sing-box-extended прямо из веб-интерфейса<br><sub>клиентский транспорт xhttp · установка и откат в один клик</sub>
+- [x] **Веб-интерфейс LuCI** - дашборд, диагностика и настройки без ручной правки конфигов<br><sub>статус серверов · проверка соединения · логи</sub>
+- [x] **Автоматическая миграция** - обновление со старого podkop переносит конфиг без перенастройки
+
+
+---
+
+<div align="center">
+
+<img src="docs/screenshot.png" alt="NetShift в LuCI" width="800" />
+
+</div>
+
+---
+
+## Вещи, которые необходимо знать перед установкой
+
+<details open>
+<summary><b>Системные требования</b></summary>
+
+- OpenWrt **24.10** или выше.
+- Минимум **25 МБ** свободного места. Устройства с флеш-памятью 16 МБ не поддерживаются.
+
+</details>
+
+<details>
+<summary><b>Обновления и конфигурация</b></summary>
+
+- При обновлении **обязательно** [очищайте кэш LuCI](https://podkop.net/docs/clear-browser-cache/).
+- После обновления проверяйте конфигурацию - она может меняться между версиями.
+- При старте NetShift модифицирует конфигурацию Dnsmasq.
+- NetShift изменяет конфигурацию sing-box. Если используете собственную - заранее сохраните её.
+
+</details>
+
+<details>
+<summary><b>Ограничения и особенности</b></summary>
+
+- Если установлен **Getdomains**, его [необходимо удалить](https://github.com/itdoginfo/domain-routing-openwrt?tab=readme-ov-file#скрипт-для-удаления).
+- **Dashboard** работает только по HTTP (особенность Clash API). По HTTPS или через домен может быть недоступен.
+
+</details>
+
+<details>
+<summary><b>Поддержка и диагностика</b></summary>
+
+- [Руководство по диагностике](https://podkop.net/docs/diagnostics/)
+- Актуальные изменения - в [Telegram-чате](https://t.me/netshift_chat/2) (читайте закреплённые сообщения).
+- При проблемах оставляйте технически грамотный фидбэк в GitHub Issues и Telegram-чате.
+
+</details>
+
+<details>
+<summary><b>Миграция с podkop (0.8.0) и смена формата конфига (0.7.0)</b></summary>
+
+**0.8.0 - переименование в NetShift.** Пакет теперь `netshift` (бинарь `/usr/bin/netshift`), конфиг - `/etc/config/netshift`, LuCI-приложение - `luci-app-netshift`. При обновлении старый конфиг `/etc/config/podkop` автоматически мигрируется в `/etc/config/netshift`, резервная копия сохраняется в `/etc/config/podkop.bak.pre-netshift`. туннель продолжит работать без перенастройки.
+
+**0.7.0 - несовместимый формат конфига.** Старые значения несовместимы - нужно настроить заново. Скрипт установки обнаружит старую версию и предложит сделать это автоматически. Вручную:
+
+```sh
+mv /etc/config/netshift /etc/config/netshift-070
+wget -O /etc/config/netshift https://raw.githubusercontent.com/yandexru45/netshift/refs/heads/main/netshift/files/etc/config/netshift
+# затем настроить заново через LuCI или UCI
 ```
 
-## Новое в этом форке: Подписки (Subscription)
+</details>
 
-Добавлена поддержка subscription URL — ссылки подписки от провайдера прокси. При выборе типа конфигурации **Subscription** в LuCI:
+## Установка NetShift
 
-- Введите URL подписки от вашего провайдера
-- Выберите интервал автообновления (от 30 минут до 1 дня)
-- Все серверы из подписки автоматически появятся в дашборде
-- Автоматический выбор лучшего сервера по задержке (URLTest)
-- Ручное переключение между серверами через дашборд
+Полная инструкция - в [документации](https://podkop.net/docs/install/).
+
+Для установки и обновления достаточно одного скрипта:
+
+```sh
+sh <(wget -O - https://raw.githubusercontent.com/yandexru45/netshift/refs/heads/main/install.sh)
+```
+
+Интерфейс появится в LuCI: **Services → NetShift**.
+
+<details>
+<summary><b>Настройка подписки (Subscription URL) через UCI</b></summary>
 
 При скачивании подписки отправляются заголовки:
-- `User-Agent: singbox/<версия>`
-- `X-HWID` — уникальный идентификатор роутера
-- `X-Device-OS: OpenWrt Linux`
-- `X-Device-Model` — модель роутера
-- `X-Ver-OS` — версия ядра
 
-Пример конфигурации через UCI:
-```
-uci set podkop.my_sub=section
-uci set podkop.my_sub.connection_type='proxy'
-uci set podkop.my_sub.proxy_config_type='subscription'
-uci set podkop.my_sub.subscription_url='https://your-provider.com/api/sub'
-uci set podkop.my_sub.subscription_update_interval='1h'
-uci add_list podkop.my_sub.community_lists='russia_inside'
-uci commit podkop
+| Заголовок | Значение |
+|---|---|
+| `User-Agent` | `singbox/<версия>` |
+| `X-HWID` | уникальный идентификатор роутера |
+| `X-Device-OS` | `OpenWrt Linux` |
+| `X-Device-Model` | модель роутера |
+| `X-Ver-OS` | версия ядра |
+
+```sh
+uci set netshift.my_sub=section
+uci set netshift.my_sub.connection_type='proxy'
+uci set netshift.my_sub.proxy_config_type='subscription'
+uci set netshift.my_sub.subscription_url='https://your-provider.com/api/sub'
+uci set netshift.my_sub.subscription_update_interval='1h'
+uci add_list netshift.my_sub.community_lists='russia_inside'
+uci commit netshift
 ```
 
 Ручное обновление подписки:
-```
-/usr/bin/podkop subscription_update
+
+```sh
+/usr/bin/netshift subscription_update
 ```
 
-## Изменения 0.7.0
-Начиная с версии 0.7.0 изменена структура конфига `/etc/config/podkop`. Старые значения несовместимы с новыми. Нужно заново настроить Podkop.
+</details>
 
-Скрипт установки обнаружит старую версию и предупредит вас об этом. Если вы согласитесь, то он сделает автоматически написанное ниже.
+<details>
+<summary><b>Ядро sing-box-extended (xhttp)</b></summary>
 
-При обновлении вручную нужно:
+Переключение ядра между стабильным sing-box и сборкой **sing-box-extended** прямо из вкладки **Diagnostics** в LuCI:
+
+- **Install extended** - установить расширенное ядро sing-box-extended.
+- **Install stable** - вернуться на стабильное ядро.
+
+После установки расширенного ядра становится доступен клиентский транспорт **xhttp** (только клиентский режим, не серверный). По умолчанию ставится стабильное ядро - extended включается по желанию.
+
+</details>
+
+## Project Structure
 
-0. Не ныть в issue и чатик.
-1. Забэкапить старый конфиг:
 ```
-mv /etc/config/podkop /etc/config/podkop-070
+.
+├── netshift/                       # Бэкенд-пакет (POSIX ash + jq)
+│   ├── Makefile                    # Описание OpenWrt-пакета
+│   └── files/
+│       ├── etc/config/netshift     # UCI-конфиг по умолчанию
+│       ├── etc/init.d/netshift     # procd init-скрипт
+│       └── usr/
+│           ├── bin/netshift        # Точка входа CLI (диспетчер команд)
+│           └── lib/                # constants, helpers, nft, rulesets,
+│                                   #   sing_box_config_*, updater, logging
+│
+├── luci-app-netshift/              # LuCI веб-интерфейс
+│   ├── Makefile
+│   ├── htdocs/.../view/netshift/   # main.js (автоген) + hand-written views
+│   ├── po/                         # Переводы (генерируются из fe-app)
+│   └── root/                       # menu.d · acl.d · uci-defaults
+│
+├── fe-app-netshift/                # TypeScript-исходник для main.js (tsup)
+│   ├── src/netshift/               # fetchers · methods · services · tabs
+│   ├── src/{validators,helpers,icons,partials}
+│   └── locales/                    # Исходные переводы (netshift.pot / .po)
+│
+├── sdk/                            # Базовые образы OpenWrt SDK
+├── Dockerfile-ipk · Dockerfile-apk # Сборка пакетов
+└── install.sh                      # Установщик + миграция с podkop
 ```
-2. Стянуть новый дефолтный конфиг:
+
+## Build Artifacts
+
+Пакеты собираются в Docker-образе OpenWrt SDK (24.10) и публикуются как релиз при push git-тега ([`.github/workflows/build.yml`](.github/workflows/build.yml)).
+
+| Пакет | Формат | Назначение |
+|---|---|---|
+| `netshift` | `.ipk` / `.apk` | Бэкенд: CLI, init-скрипт, библиотеки, UCI-конфиг |
+| `luci-app-netshift` | `.ipk` / `.apk` | Веб-интерфейс LuCI |
+| `luci-i18n-netshift-ru` | `.ipk` / `.apk` | Русская локализация интерфейса |
+
+Локальная сборка:
+
+```sh
+# ipk (большинство устройств OpenWrt 24.10)
+docker build -f Dockerfile-ipk --build-arg NETSHIFT_VERSION=0.8.0 -t netshift:ipk .
+
+# apk (новые сборки OpenWrt на apk)
+docker build -f Dockerfile-apk --build-arg NETSHIFT_VERSION=0.8.0 -t netshift:apk .
 ```
-wget -O /etc/config/podkop https://raw.githubusercontent.com/yandexru45/podkop-evolution/refs/heads/main/podkop/files/etc/config/podkop
-```
-3. Настроить заново ваш Podkop через Luci или UCI.
 
-# ToDo
+> Требуется sing-box >= 1.12.0 и jq >= 1.7.1 на целевом устройстве.
 
-> [!IMPORTANT]  
-> PR принимаются только по issues, у которых стоит label "enhancement". Либо по согласованию с авторами в ТГ-чате. Остальные PR на данный момент не рассматриваются.
+## Star History
 
-## Будущее
-- [x] [Подписка](https://github.com/itdoginfo/podkop/issues/118) — **реализовано в этом форке!**
-- [ ] Весь трафик в sing-box и маршрутизация полностью на его уровне.
-- [ ] При успешном запуске переходит в фоновый режим и следит за состоянием sing-box. Если вдруг идёт exit 1, выполняется dnsmasq restore и снова следит за состоянием. [Issue](https://github.com/itdoginfo/podkop/issues/111)
-- [ ] Галочка, которая режет доступ к doh серверам.
-- [ ] IPv6. Только после наполнения Wiki.
+<a href="https://www.star-history.com/#yandexru45/netshift&Date">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=yandexru45/netshift&type=Date&theme=dark" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=yandexru45/netshift&type=Date" />
+   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=yandexru45/netshift&type=Date" />
+ </picture>
+</a>
 
-## Тесты
-- [ ] Unit тесты (BATS)
-- [ ] Интеграционные тесты бекенда (OpenWrt rootfs + BATS)
+## Credits
+
+- [itdoginfo/podkop](https://github.com/itdoginfo/podkop) - исходный проект, форком которого является NetShift.
+- [sing-box](https://github.com/SagerNet/sing-box) - движок маршрутизации.
+
+Лицензия: **GPL-2.0-or-later** - см. [LICENSE](LICENSE).
+
+> [!IMPORTANT]
+> Pull Request принимаются только после согласования с авторами в [Telegram-чате](https://t.me/netshift_chat/17).

TRADEMARK.md

@@ -0,0 +1,63 @@
+Trademark Guidelines
+
+Version 1.0 dated 2026
+
+This trademark policy was prepared to help you understand how to use the NetShift trademarks, service marks, and logos in connection with the NetShift open source project and related software.
+
+While the NetShift software is available under an open source license, that license does not grant permission to use the NetShift trademarks, service marks, or logos. This policy explains acceptable use of the NetShift brand and related marks.
+
+This Policy covers:
+1. Our word trademarks and service marks: NetShift
+2. Our logos, icons, and other NetShift brand assets
+
+This policy encompasses all trademarks and service marks, whether they are registered or not.
+
+## 1. General Guidelines
+
+Whenever you use one of our marks, you must always do so in a way that does not mislead anyone about what they are getting and from whom. For example, you cannot say you are distributing NetShift software when you are distributing a modified version of it, because recipients may not understand the differences between your modified versions and our own.
+
+You also cannot use our logo on your website in a way that suggests that your website is an official website or that we endorse your website.
+
+You can, however, say that you like the NetShift project, that you participate in the NetShift community, or that you are providing an unmodified version of the NetShift software.
+
+You may not use or register our marks, or variations of them as part of your own trademark, service mark, domain name, company name, trade name, product name or service name.
+
+Trademark law does not allow your use of names or trademarks that are too similar to ours. You therefore may not use an obvious variation of any of our marks or any phonetic equivalent, foreign language equivalent, takeoff, or abbreviation for a similar or compatible product or service. For example, we would consider the following too similar to one of our Marks:
+
+- MyNetShift
+- Open-NetShift
+- NetShiftX
+- NetShift Lite
+- NetShift Pro
+
+## 2. Acceptable Uses
+### Unmodified Code
+
+When you redistribute an unmodified copy of NetShift software, you must not remove any NetShift trademarks, notices, or branding included in the original distribution.
+
+### Modified Code
+
+If you distribute a modified version of NetShift software, you may not use the NetShift name, trademarks, or logos in connection with your modified version, except to accurately describe the origin of the software in factual statements.
+
+You must replace any NetShift branding, including names displayed in user interfaces, logs, documentation, and other user-facing elements, with your own distinct name and branding, so that your modified version is clearly distinguishable from the original NetShift software.
+
+You must remove all NetShift logos and any other brand assets from the modified version.
+
+You may not present your modified version as NetShift or as an official NetShift release, nor may you use the NetShift name in a way that suggests endorsement, affiliation, or official status.
+
+You may only refer to NetShift in a factual and descriptive manner, for example: “This software is derived from NetShift open-source software.”
+
+### Statements about Compatibility
+
+You may use the word marks, exclusively for descriptive and factual purposes, to truthfully and accurately describe the relationship between your software and ours, including compatibility or origin. Any other use may imply that we have certified or approved your software.
+
+### No Domain Names
+
+You must not register any domain that includes our word marks or any variant or combination of them.
+
+## 3. How to Display our Marks
+### Use of Trademarks in Text
+
+Always use trademarks in their exact form with correct spelling. They must not be abbreviated, modified, hyphenated, or combined with other words in a way that creates a new product or service name.
+
+Unacceptable: NetShfit

TRADEMARK_RU.md

@@ -0,0 +1,65 @@
+Руководство по использованию товарных знаков
+
+Версия 1.0 от 2026 года
+
+Настоящая политика в отношении товарных знаков подготовлена для того, чтобы помочь вам понять, как использовать товарные знаки, знаки обслуживания и логотипы NetShift в связи с открытым исходным кодом проекта NetShift и связанным программным обеспечением.
+
+Хотя программное обеспечение NetShift распространяется под лицензией с открытым исходным кодом, эта лицензия не предоставляет разрешения на использование товарных знаков NetShift, знаков обслуживания или логотипов. Данная политика объясняет допустимое использование бренда NetShift и связанных обозначений.
+
+Настоящая Политика охватывает:
+1. Наши словесные товарные знаки и знаки обслуживания: NetShift
+2. Наши логотипы, иконки и другие бренд-активы NetShift
+
+Данная политика распространяется на все товарные знаки и знаки обслуживания, независимо от того, зарегистрированы они или нет.
+
+## 1. Общие рекомендации
+
+При использовании любого из наших знаков вы всегда должны делать это таким образом, чтобы никого не вводить в заблуждение относительно того, что именно они получают и от кого. Например, вы не можете утверждать, что распространяете программное обеспечение NetShift, если вы распространяете его модифицированную версию, поскольку получатели могут не понимать различий между вашей модифицированной версией и нашей оригинальной.
+
+Вы также не можете использовать наш логотип на своём сайте таким образом, чтобы это создавало впечатление, что ваш сайт является официальным сайтом или что мы одобряем ваш сайт.
+
+Однако вы можете указывать, что вам нравится проект NetShift, что вы участвуете в сообществе NetShift или что вы распространяете немодифицированную версию программного обеспечения NetShift.
+
+Вы не имеете права использовать или регистрировать наши знаки, а также их вариации, как часть вашего собственного товарного знака, знака обслуживания, доменного имени, названия компании, коммерческого наименования, названия продукта или услуги.
+
+Закон о товарных знаках не допускает использование названий или знаков, которые слишком похожи на наши. Поэтому вы не можете использовать очевидные вариации наших знаков или любые фонетически, иностранно-языковые эквиваленты, производные, аббревиатуры для похожего или совместимого продукта или услуги. Например, мы считаем слишком похожими на наши знаки следующие варианты:
+
+- MyNetShift
+- Open-NetShift
+- NetShiftX
+- NetShift Lite
+- NetShift Pro
+
+## 2. Допустимое использование
+
+### Немодифицированный код
+
+При распространении немодифицированной копии программного обеспечения NetShift вы не должны удалять товарные знаки, уведомления или брендинг NetShift, включённые в исходное распространение.
+
+### Модифицированный код
+
+Если вы распространяете модифицированную версию программного обеспечения NetShift, вы не можете использовать название NetShift, товарные знаки или логотипы в связи с вашей модифицированной версией, за исключением точного описания происхождения программного обеспечения в фактических утверждениях.
+
+Вы обязаны заменить все элементы брендинга NetShift, включая названия, отображаемые в пользовательском интерфейсе, логах, документации и других пользовательских элементах, на собственное отличительное название и брендинг, чтобы ваша модифицированная версия была явно отличима от оригинального программного обеспечения NetShift.
+
+Вы должны удалить все логотипы NetShift и любые другие бренд-материалы из модифицированной версии.
+
+Вы не можете представлять вашу модифицированную версию как NetShift или как официальную версию NetShift, а также использовать название NetShift таким образом, чтобы это подразумевало одобрение, аффилированность или официальный статус.
+
+Вы можете ссылаться на NetShift только в фактическом и описательном контексте, например: «Это программное обеспечение основано на программном обеспечении NetShift с открытым исходным кодом».
+
+### Упоминания о совместимости
+
+Вы можете использовать словесные знаки исключительно в описательных и фактических целях для правдивого и точного описания связи вашего программного обеспечения с нашим, включая совместимость или происхождение. Любое другое использование может создавать впечатление, что мы сертифицировали или одобрили ваше программное обеспечение.
+
+### Запрет на доменные имена
+
+Вы не должны регистрировать доменные имена, содержащие наши словесные знаки или любые их варианты или комбинации.
+
+## 3. Как отображать наши знаки
+
+### Использование товарных знаков в тексте
+
+Всегда используйте товарные знаки в их точной форме с корректным написанием. Их нельзя сокращать, изменять, соединять дефисами или объединять с другими словами таким образом, чтобы это создавало новое название продукта или услуги.
+
+Недопустимо: NetShfit

docs/README-AGENTS.md

@@ -0,0 +1,181 @@
+# NetShift — система AI-агентов (руководство оператора)
+
+Это руководство для **человека**, который запускает AI-агентов на проекте
+NetShift. Описанная здесь система переносит профессиональные практики
+agent-разработки: специализированные агенты, шлюз код-ревью, накопление знаний в
+памяти и строгие правила архитектуры. Работает в двух инструментах:
+**OpenCode** и **Claude Code** — с единым источником правил.
+
+> Сами агенты, правила и команды написаны на английском (так точнее работает
+> LLM). Это руководство — на русском.
+
+## TL;DR
+
+1. Открываешь проект в OpenCode (или Claude Code).
+2. Даёшь задачу через команду `/task` (или просто текстом оркестратору).
+3. Оркестратор уточняет, проектирует, раскладывает задачу на подзадачи в
+   `docs/tasks/*.md`, делегирует разработчикам, прогоняет шлюзы и код-ревью.
+4. Когда всё прошло ревью — **коммитишь сам, руками**. Агенты никогда не
+   коммитят.
+
+## Что где лежит
+
+```
+AGENTS.md                       # корневой контекст для OpenCode (composition root)
+opencode.json                   # конфиг OpenCode: права + подключение правил
+.opencode/
+  agent/                        # 5 агентов (OpenCode-формат)
+  command/                      # /task /review /describe
+  skill/                        # shellcheck / smoke-tests / frontend-ci
+.claude/
+  CLAUDE.md                     # корневой контекст для Claude Code
+  settings.json                 # права (allow/ask)
+  agents/                       # те же 5 агентов (Claude-формат)
+  commands/                     # /task /review /describe
+  skills/                       # те же 3 скилла
+docs/
+  agent-rules/                  # ЕДИНЫЙ ИСТОЧНИК правил (оба инструмента ссылаются сюда)
+    project-core.md             #   архитектура, runtime-контракт, шлюзы, gating
+    backend-shell.md            #   правила backend (ash + jq)
+    frontend-luci.md            #   правила frontend (TS + LuCI)
+    packaging.md                #   правила packaging / CI / release
+    memory/                     #   ПАМЯТЬ агентов (committed, общая для обоих инструментов)
+      architect-orchestrator.md
+      shell-backend-developer.md
+      luci-frontend-developer.md
+      packaging-ci-engineer.md
+      code-reviewer.md
+  tasks/                        # спеки задач и ревью-доки
+    TEMPLATE-task.md            #   шаблон спеки
+    TEMPLATE-review.md          #   шаблон ревью
+  README-AGENTS.md              # этот файл
+```
+
+## Команда агентов
+
+```
+                       ┌──────────────────────────┐
+                       │   architect-orchestrator  │  (opus) — дирижёр
+                       │  уточняет · проектирует · │
+                       │  раскладывает · ревьюит   │
+                       └────┬───────┬───────┬──────┘
+            ┌───────────────┘       │       └───────────────┐
+            ▼                       ▼                       ▼
+ ┌────────────────────┐ ┌────────────────────┐ ┌────────────────────┐
+ │ shell-backend-     │ │ luci-frontend-     │ │ packaging-ci-      │
+ │ developer (sonnet) │ │ developer (sonnet) │ │ engineer (sonnet)  │
+ │ ash/jq, sing-box,  │ │ TS, LuCI, валид.,  │ │ Makefile, Docker,  │
+ │ nft, dnsmasq, UCI  │ │ i18n, main.js      │ │ SDK, CI, install   │
+ └─────────┬──────────┘ └─────────┬──────────┘ └─────────┬──────────┘
+           └──────────────────────┼───────────────────────┘
+                                  ▼
+                       ┌────────────────────┐
+                       │   code-reviewer     │  (haiku) — только чтение
+                       │  вердикт: APPROVED /│
+                       │  CONDITIONS / CHANGES│
+                       └────────────────────┘
+```
+
+| Агент | Что делает | Модель |
+| --- | --- | --- |
+| `architect-orchestrator` | Уточняет → проектирует → раскладывает в `docs/tasks/*.md` → делегирует → гоняет цикл разработчик↔ревьюер | opus |
+| `shell-backend-developer` | Backend: ash/jq, генерация конфига sing-box, nft, dnsmasq, UCI. Прогоняет shellcheck + smoke | sonnet |
+| `luci-frontend-developer` | Frontend: TS-исходник, LuCI-вьюхи, валидаторы, i18n. Прогоняет `yarn ci`, пересобирает `main.js` | sonnet |
+| `packaging-ci-engineer` | Makefile, Docker ipk/apk, SDK, workflows, тест-харнесс, install.sh | sonnet |
+| `code-reviewer` | Read-only ревью диффа против правил, пишет вердикт | haiku |
+
+## Как запускать
+
+### Вариант A — команда `/task` (рекомендуется)
+В OpenCode или Claude Code введи:
+```
+/task добавить опцию X в секцию UCI и пробросить её в конфиг sing-box
+```
+Оркестратор пройдёт весь цикл: уточнит → спроектирует → разложит → делегирует →
+прогонит шлюзы → ревью → отдаст тебе на коммит.
+
+### Вариант B — спека файлом
+Создай `docs/tasks/task-010-моя-задача.md` (по шаблону `TEMPLATE-task.md`),
+затем:
+```
+/task обработай docs/tasks/task-010-моя-задача.md
+```
+
+### Вариант C — обработать ревью
+```
+/review docs/tasks/task-010-моя-задача-review-001.md
+```
+или передай URL Pull Request.
+
+### Вариант D — описать PR
+```
+/describe
+```
+
+## Жизненный цикл задачи (7 шагов)
+
+1. **Уточнение.** Оркестратор задаёт вопросы по неоднозначным решениям
+   (порты/marks/пути/схема конфига/упаковка). Не додумывает.
+2. **Проектирование.** Предлагает 1–3 варианта с trade-offs, ждёт твоего «ОК».
+3. **Декомпозиция.** Пишет спеки в `docs/tasks/task-NNN-*.md`.
+4. **Реализация.** Делегирует нужному разработчику (параллельно — если подзадачи
+   не пересекаются по файлам).
+5. **Шлюзы.** Разработчик прогоняет соответствующий gate:
+   - backend → скилл `shellcheck` + скилл `smoke-tests`;
+   - frontend → скилл `frontend-ci` (`yarn ci`) + пересборка `main.js` без
+     git-диффа;
+   - packaging → smoke-tests, проверка ipk и apk.
+6. **Ревью.** `code-reviewer` пишет ревью-док с вердиктом. При `REQUIRES CHANGES`
+   разработчик переделывает до прохождения.
+7. **Готово.** Ты коммитишь вручную. PR — только после согласования в Telegram с
+   авторами (`CODEOWNERS=@yandexru45`).
+
+## Память агентов
+
+Файлы `docs/agent-rules/memory/<agent>.md` — это **долгая память** агентов:
+грабли, неочевидные правила, уже принятые решения, повторяющиеся находки ревью.
+Каждый агент читает свою память перед работой и дописывает туда новое. Память
+**коммитится в git** — поэтому она общая для всей команды и для обоих
+инструментов (OpenCode и Claude Code ссылаются на одни и те же файлы, дублей
+нет). Держи каждый файл памяти короче ~200 строк.
+
+## Ключевые правила (действуют для всех агентов)
+
+- **Тесты/шлюзы обязательны.** Изменение не «готово», пока не прошёл нужный gate.
+- **Агенты не коммитят.** Коммит и push делает только человек (права настроены на
+  подтверждение `git commit`/`git push`).
+- **Без апрува архитектора нет реализации.** Каждое изменение проходит ревью.
+- **Слои не смешиваются.** UI → backend (через два разрешённых бинарника) →
+  sing-box/nft/dnsmasq.
+- **Священный runtime-контракт** (порты/marks/пути) не меняется без проверки всей
+  цепочки. Всё — в `constants.sh`, без хардкода.
+- **Сгенерированный `main.js` руками не править.** Только правка TS-исходника +
+  `yarn build`.
+- **jq на OpenWRT — без regex** (нет Oniguruma).
+
+## Требования инструментов
+
+- **OpenCode:** конфиг подхватывается из `opencode.json` и `AGENTS.md`
+  автоматически. После изменения конфигурации перезапусти OpenCode (конфиг
+  читается один раз при старте).
+- **Claude Code:** для оркестрации субагентами включи экспериментальный режим
+  agent teams в глобальном `~/.claude/settings.json`:
+  ```json
+  { "env": { "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1" } }
+  ```
+  Без этого флага запуск нескольких агентов работать не будет.
+- **Шлюзы локально:** для `smoke-tests` нужен Docker; для `frontend-ci` — Node 22
+  + yarn в `fe-app-netshift`; для `shellcheck` — локальный `shellcheck` или
+  Docker-образ `koalaman/shellcheck`.
+
+## Траблшутинг
+
+- **Агенты не запускаются (Claude Code):** проверь флаг
+  `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1`.
+- **OpenCode не стартует после правки конфига:** значит, `opencode.json`
+  невалиден. Запусти из папки проекта с `OPENCODE_DISABLE_PROJECT_CONFIG=1`,
+  поправь файл, перезапусти без флага.
+- **Пустое/слабое ревью:** убедись, что есть незакоммиченный дифф (ревьюер
+  смотрит `git diff`).
+- **Память распухла:** подрежь файл `docs/agent-rules/memory/<agent>.md` до
+  ~200 строк, оставив только durable-знания.

docs/agent-rules/backend-shell.md

@@ -0,0 +1,125 @@
+# NetShift Backend — Shell Rules (AUTHORITATIVE)
+
+> Scope: the backend package `netshift/files/usr/**` (POSIX `ash` + `jq`). Read alongside `project-core.md`. Every rule is grounded in the actual source — do not invent.
+
+## 1. Stack
+
+- **POSIX `ash`** (busybox), NOT bash. CLI dispatcher: `netshift/files/usr/bin/netshift`. Libraries: `netshift/files/usr/lib/*.sh`.
+- **`jq`** generates and mutates the sing-box JSON config.
+- **sing-box** is the routing engine; the backend only generates/validates its config and (re)starts the service.
+- **nftables** tproxy provides the marking/redirect path (table `NetShiftTable`, family `inet`).
+- **dnsmasq** integration points the router's DNS at sing-box (`server 127.0.0.42`).
+- **UCI** holds configuration (`/etc/config/netshift`); **procd** init in `/etc/init.d/netshift`.
+
+`/usr/bin/netshift` sources, in order: `/lib/functions.sh`, `/lib/config/uci.sh`, `/lib/functions/network.sh`, then `constants.sh`, `nft.sh`, `helpers.sh`, `sing_box_config_manager.sh`, `sing_box_config_facade.sh`, `logging.sh`, `rulesets.sh`, `updater.sh`. The CLI dispatcher (`case "$1" in ...`) is at the bottom of the file; entry points are `start`/`stop`/`reload`/`restart` (procd) and the diagnostics/`get_*`/`show_*`/`*_update`/`clash_api`/`component_action` commands.
+
+## 2. File headers and variable scope
+
+- Every lib `.sh` file starts with `# shellcheck shell=ash`.
+- Constants files that intentionally hold unused-looking vars also add `# shellcheck disable=SC2034` (see `constants.sh` lines 1–2).
+- Declare **all** function-local variables with `local`. ShellCheck (severity error) gates this.
+
+## 3. Strict function-naming prefixes
+
+Use the right prefix; it signals the function's layer and contract.
+
+| Prefix | Meaning | Examples |
+|---|---|---|
+| `sing_box_cm_*` | **Config-manager primitives** — low-level jq mutations, ONE mutation each, take `$config` first, echo new JSON | `sing_box_cm_configure_log`, `sing_box_cm_add_udp_dns_server`, `sing_box_cm_add_route_rule` (`sing_box_config_manager.sh`) |
+| `sing_box_cf_*` | **Facade orchestration** — parse a URL and call several `cm_*` | `sing_box_cf_add_proxy_outbound`, `sing_box_cf_add_dns_server` (`sing_box_config_facade.sh`) |
+| `url_*` | URL parsing — pure, param-expansion / `sed` only | `url_get_host`, `url_get_port`, `url_get_scheme`, `url_decode` (`helpers.sh`) |
+| `is_*` | Predicates returning 0/1 | `is_ipv4`, `is_domain`, `is_min_package_version`, `is_sing_box_extended` |
+| `nft_*` | nft wrappers | `nft_create_table`, `nft_create_ipv4_set`, `nft_add_set_elements_from_file_chunked` (`nft.sh`) |
+| `updates_*` / updater | binary updater | `updater.sh` |
+| `get_*_tag` | Deterministic tag builders | `get_outbound_tag_by_section` (`<section>-out`), `get_inbound_tag_by_section`, `get_domain_resolver_tag`, `get_ruleset_tag` |
+| `configure_*` / `import_*` / `_*_handler` | `config_foreach` / `config_list_foreach` callbacks | `configure_outbound_handler`, `import_community_subnet_lists`, `include_source_ip_in_routing_handler` |
+| leading `_` | private helper (internal to a flow) | `_check_outbound_section`, `_update_subscription_for_section` |
+
+## 4. The `$config` threading model
+
+The sing-box config is carried as a shell string variable named `config`. `cm_*`/`cf_*` functions take it as `$1`, echo the mutated JSON, and the caller reassigns:
+
+```sh
+config=$(sing_box_cm_add_direct_outbound "$config" "$SB_DIRECT_OUTBOUND_TAG")
+config=$(sing_box_cf_add_proxy_outbound "$config" "$section" "$proxy_string" "$udp_over_tcp")
+```
+
+`sing_box_init_config` seeds the skeleton, then runs `sing_box_configure_log/inbounds/outbounds/dns/route/experimental/additional_inbounds` and finally `sing_box_save_config`. Keep this echo-and-reassign discipline; never mutate config via global side effects.
+
+## 5. jq idioms and the Oniguruma constraint
+
+- Pass data with `--arg` (string) / `--argjson` (JSON), never string interpolation into the program:
+  ```sh
+  echo "$config" | jq --arg tag "$tag" --argjson port "$port" '...'
+  ```
+- Optional keys via the merge pattern:
+  ```jq
+  { ... } + (if $detour != "" then { detour: $detour } else {} end)
+  ```
+- **CRITICAL: OpenWRT's `jq` is built WITHOUT Oniguruma.** Never use `test()`, `match()`, `sub()`, `gsub()`, or any regex-based jq function — they will fail on-device. Use explicit string/codepoint logic instead (e.g. `explode`/`implode`, `index`, label/break loops — see the country-flag grouping in `sing_box_build_subscription_country_groups` and the tag-dedup in `normalize_subscription_to_singbox`). The updater documents the workarounds.
+- Custom jq helpers live in `netshift/files/usr/lib/helpers.jq`, imported as:
+  ```jq
+  import "helpers" as h {"search": "/usr/lib/netshift"};
+  ```
+
+## 6. Validation and atomic writes (mandatory)
+
+- **Every config write is validated.** `sing_box_save_config` writes to a temp file, then `sing_box_config_check` runs `sing-box -c <file> check`; on failure it logs `fatal` and `exit 1`. There is no exception to this.
+- JSON shape is checked with `jq -e` (e.g. `validate_subscription_file`, `subscription_cache_is_usable`).
+- **Atomic writes**: write `*.tmp.$$` then `mv` into place (subscription cache, URL metadata, rejected-hash). See `download_subscription_into_cache`.
+- **Hash-compare before replacing**: `md5sum` the temp vs current and only `mv` when they differ (`sing_box_save_config`, subscription dedup, rejected-hash tracking).
+
+## 7. Logging (`logging.sh`)
+
+| Function | Behavior |
+|---|---|
+| `log "$msg" "$level"` | syslog via `logger -t netshift` (level defaults to `info`) |
+| `nolog "$msg"` | TTY-only stdout (colorized; nothing when not a TTY) |
+| `echolog "$msg" "$level"` | both: `log` + `nolog` |
+
+Levels: `debug` / `info` / `warn` / `error` / `fatal`.
+
+**CRITICAL:** `fatal` is only a LABEL — `log` does NOT exit. You must manually `exit 1` after logging fatal:
+
+```sh
+log "Subscription URL is not set. Aborted." "fatal"
+exit 1
+```
+
+This pattern (`... Aborted." "fatal"; exit 1`) appears throughout the CLI; preserve it.
+
+## 8. busybox quirks
+
+- busybox `sed` lacks `\x` hex escapes. Build literal bytes with `printf` octal escapes (e.g. the UTF-8 BOM `printf '\357\273\277'` in `normalize_subscription_to_singbox`).
+- Convert CRLF→LF with `convert_crlf_to_lf` before parsing downloaded lists.
+- Strip a leading UTF-8 BOM before base64 charset detection.
+- The diagnostic strings in `usr/bin/netshift` (emoji / box-drawing in `list_update`, `subscription_update`, `global_check`, `check_nft`, e.g. `📡 🛠️ ✅ ❌ ⚠️ ➡️ 🧱 🥸 📄` and `━` separators) are **valid UTF-8** and must stay valid UTF-8 — they render correctly on the device (SSH/UTF-8 terminal) and LuCI. They are **not** intentional mojibake.
+- These were once corrupted by a UTF-8→CP1251 double-encode (real UTF-8 bytes read as CP1251 and re-saved as UTF-8), which made them print as `рџ…`/`в”…` garbage; task-004 repaired them. **Never open/save `usr/bin/netshift` in a non-UTF-8 editor or run it through a CP1251 codepage** — doing so reintroduces the `рџ…`/`в”…`/` ` mojibake. Edit it as UTF-8 only.
+
+## 9. New constants
+
+Anything that looks like a port, IP, mark, tag, path, version, URL, or service list goes into `constants.sh` under the right group (`## Common`, `## nft`, `## sing-box`, `## Lists`). Never hardcode it inline. See `project-core.md` §5.
+
+## 10. UCI access patterns
+
+- `config_get var section option [default]` — read an option.
+- `config_get_bool var section option [default]` — read a boolean (0/1).
+- `config_foreach fn type` — call `fn` for each section of `type` (here usually `section`); `fn` receives the section name as `$1`.
+- `config_list_foreach section list fn [extra args...]` — call `fn` for each list item.
+- The CLI runs `config_load "$NETSHIFT_CONFIG"` at startup; after `uci commit` it reloads (`uci commit ...; config_load ...`).
+
+UCI schema lives in `netshift/files/etc/config/netshift` (`settings` section + per-connection sections with `connection_type` = `proxy`/`vpn`/`block`/`exclusion`, and `proxy_config_type` = `url`/`selector`/`urltest`/`outbound`/`subscription`). Changing it is a system-level change (`project-core.md` §4).
+
+## 11. Tests and gates for backend changes
+
+- Run the **`shellcheck`** skill and the **`smoke-tests`** skill before considering a backend change done.
+- Smoke tests live in `tests/entrypoint.sh`. Existing test functions: `test_deps`, `test_syntax`, `test_config`, `test_helpers`, `test_jq_helpers`, `test_config_manager`, `test_sing_box_config`, `test_nft`, `test_diagnostics`, `test_subscription`.
+- **Adding a backend test** means all three of:
+  1. Add a `test_*` function to `tests/entrypoint.sh`.
+  2. Register it in `main()` — add the call to the `all)` branch.
+  3. Add a `case` entry (its short alias) AND list the alias in the "Available:" usage line.
+- Backend changes affecting **config generation** or **subscription parsing** SHOULD add/extend a smoke test (`test_sing_box_config`, `test_config_manager`, `test_jq_helpers`, or `test_subscription`).
+
+## 12. Glob scope confirmation
+
+These rules apply to everything matched by `netshift/files/usr/**` (the CLI, all `*.sh` libraries, and `helpers.jq`).

docs/agent-rules/frontend-luci.md

@@ -0,0 +1,154 @@
+# Agent Rules: Frontend & LuCI
+
+Authoritative rules for the NetShift web UI. Read this before touching any
+frontend or LuCI view code.
+
+**Scope (globs):**
+
+- `fe-app-netshift/src/**/*.ts` — TypeScript source (the real logic).
+- `luci-app-netshift/htdocs/**/*.js` — hand-written LuCI views.
+
+---
+
+## 1. Architecture & build pipeline
+
+- The logic lives in **TypeScript** under `fe-app-netshift/src/`, compiled in
+  `strict` mode (`tsconfig.json`: `strict: true`, `target: ES2020`,
+  `module: ESNext`).
+- `tsup` bundles the single entry `src/main.ts` into
+  `luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js`
+  (see `tsup.config.ts`: `format: ['esm']`, `outExtension .js`, `clean: false`).
+- The hand-written LuCI views consume the bundle. The entry view
+  `netshift.js` declares `'require view.netshift.main as main'` and uses the
+  exports as `main.*` (e.g. `main.injectGlobalStyles()`, `main.coreService()`).
+  Companion views `section.js`, `settings.js`, plus the thin `dashboard.js` /
+  `diagnostic.js` follow the same pattern.
+
+### CRITICAL: `main.js` is AUTOGENERATED — never hand-edit it
+
+- The bundle is stamped with the banner
+  `// This file is autogenerated, please don't change manually` (set in
+  `tsup.config.ts` `banner.js`).
+- After bundling, `tsup`'s `onSuccess` hook **regex-patches** the file: it
+  rewrites the ESM `export { ... }` block into
+  `return baseclass.extend({ ... })` (see `tsup.config.ts` lines 25-30). This
+  is what makes the bundle loadable as a LuCI `baseclass`.
+- **NEVER hand-edit `main.js`.** Edit the TS source, then run `yarn build`.
+  Any manual edit is destroyed on the next build and will fail CI (build must
+  produce no git diff — see §7).
+
+---
+
+## 2. The barrel rule (most common gotcha)
+
+Anything that must be visible to the LuCI views as `main.*` has to be
+re-exported all the way up the barrel chain to `src/main.ts`.
+
+- `src/main.ts` does `export * from './validators' | './helpers' |
+  './netshift' | './constants'`.
+- `src/validators/index.ts` re-exports each validator module
+  (`export * from './validateIp'`, etc.).
+- **Rule:** any new public API (a validator, helper, constant, or tab) MUST be
+  re-exported up the chain (e.g. `validators/<file>.ts` →
+  `validators/index.ts` → `main.ts`). If you forget the re-export, the symbol
+  will not appear in `main.*` and the LuCI views cannot see it.
+
+**Worked example of the gotcha:** `validateHysteria2Url`
+(`src/validators/validateHysteriaUrl.ts`) is **intentionally NOT** listed in
+`src/validators/index.ts`. It is reached only indirectly via
+`validateProxyUrl` (`validateProxyUrl.ts` imports it and dispatches to it for
+`hysteria2://` URLs). So `main.validateHysteria2Url` does not exist — that is
+deliberate, not a bug. Do not "fix" it by adding it to the barrel unless you
+actually need it exposed.
+
+---
+
+## 3. Backend access boundary
+
+The UI talks to the backend through **only two channels**:
+
+1. LuCI `fs.exec` of the two ACL-gated binaries:
+   - `/usr/bin/netshift`
+   - `/etc/init.d/netshift`
+
+   Both are allow-listed for `exec` in
+   `luci-app-netshift/root/usr/share/rpcd/acl.d/luci-app-netshift.json`
+   (under `read.file`). The same ACL grants `uci` read/write on the
+   `netshift` config and `ubus service list`.
+
+2. Direct `fetch` / WebSocket to the Clash API on `:9090`.
+
+**Rule:** any new shell command the UI needs MUST be implemented as a
+**subcommand of one of those two binaries**, or you must extend both the ACL
+(`acl.d/luci-app-netshift.json`) **and** the backend. Do not invoke arbitrary
+paths via `fs.exec` — they are not ACL-allowed and will be denied by `rpcd`.
+
+---
+
+## 4. Code style (from the config files — non-negotiable)
+
+- **TypeScript:** `strict: true`. No `any`. Prefer functional code and named
+  exports (the barrel relies on named exports).
+- **Prettier** (`.prettierrc`): `printWidth: 80`, `tabWidth: 2`, `semi: true`,
+  `singleQuote: true`, `trailingComma: 'all'`, `bracketSpacing: true`.
+- **ESLint** (flat config `eslint.config.js`): extends
+  `js.configs.recommended` + `typescript-eslint` recommended + `prettier`.
+  `@typescript-eslint/no-unused-vars` is a **`warn`**, with
+  `argsIgnorePattern`, `varsIgnorePattern`, and `caughtErrorsIgnorePattern`
+  all set to `^_`. So any intentionally-unused var/arg/caught-error MUST be
+  `_`-prefixed. CI runs `eslint --max-warnings=0`, so an un-prefixed unused
+  var = warning = CI failure.
+- **LuCI globals** (`E`, `fs`, `uci`, `ui`, `_`, etc.) are declared in
+  `src/luci.d.ts`. Use them; do not redeclare. For DOM built with `E()`, use
+  the `click:` attribute convention for event handlers.
+
+---
+
+## 5. i18n
+
+- Wrap every user-facing string in `_()`.
+- Pass **only string literals** to `_()`. The gettext extractor only sees
+  literal arguments; `_(someVariable)` or `_('a' + b)` will NOT be extracted
+  and will ship untranslated.
+- Locale tooling lives in `package.json` under the `locales:*` scripts
+  (`locales:extract-calls`, `locales:generate-pot`, `locales:generate-po:ru`,
+  `locales:distribute`, with the `locales:actualize` umbrella). Run these to
+  regenerate `.pot`/`.po` after adding strings; do not hand-edit generated
+  catalogs.
+
+---
+
+## 6. Version placeholder
+
+- `src/constants.ts` declares
+  `export const NETSHIFT_LUCI_APP_VERSION = '__COMPILED_VERSION_VARIABLE__';`.
+- At OpenWRT build time, `luci-app-netshift/Makefile` substitutes the literal
+  via `sed -i -e 's/__COMPILED_VERSION_VARIABLE__/$(PKG_VERSION)/g' ...
+  main.js || true`.
+- In dev (where no substitution happens), `normalizeCompiledVersion` turns the
+  raw placeholder into `'dev'`.
+- **Rule:** do not change the literal `__COMPILED_VERSION_VARIABLE__` without
+  also updating the `sed` in the Makefile (and the backend stamp — see
+  `packaging.md`). They must stay in lockstep.
+
+---
+
+## 7. Tests & CI gates
+
+- Vitest config (`vitest.config.js`): `globals: true`, `environment: 'node'`,
+  setup file `./tests/setup/global-mocks.ts` (which identity-mocks `_()` so
+  tests assert on raw strings).
+- Tests live as `.test.js` next to the code under `tests/` directories. Style
+  is table-driven `describe.each`.
+- **New pure logic SHOULD ship a test.**
+- **CI gate** (`.github/workflows/frontend-ci.yml`, runs on PRs touching
+  `fe-app-netshift/**`) runs the steps individually:
+  `yarn install --frozen-lockfile` → `yarn format` then fail on any
+  `git diff` (code must already be formatted) → `yarn lint --max-warnings=0`
+  → `yarn test --run` → `yarn build` then fail on any `git diff`.
+  The convenience local command is `yarn ci`
+  (`format && lint --max-warnings=0 && test --run && build`).
+- **The committed `main.js` MUST be up to date.** Because the build must
+  produce no git diff, always `yarn build` and commit the regenerated bundle
+  together with the TS change.
+- Reference the **`frontend-ci`** skill for the full workflow.

docs/agent-rules/memory/README.md

@@ -0,0 +1,31 @@
+# Agent memory
+
+This folder is the **single source of truth** for per-agent persistent memory,
+shared by both AI toolchains (OpenCode and Claude Code).
+
+OpenCode has no built-in `memory: project` mechanism, so memory here is a plain
+convention: **every agent's prompt instructs it to read its own
+`<agent>.md` file before starting work, and to append durable findings to it
+when it learns something that future runs must not re-discover.**
+
+## Rules for memory files
+
+- One file per agent, named exactly after the agent
+  (`architect-orchestrator.md`, `shell-backend-developer.md`,
+  `luci-frontend-developer.md`, `packaging-ci-engineer.md`,
+  `code-reviewer.md`).
+- Keep each file **under ~200 lines**. It is loaded into the agent's context
+  on every run; bloat costs tokens and dilutes signal.
+- Record only **durable, reusable knowledge**: gotchas, fragile areas,
+  non-obvious conventions, decisions already made, recurring review findings.
+  Do **not** record task-specific narration.
+- These files are **committed to git** so the whole team (and other
+  contributors using AI) benefit.
+- When a fact here is proven wrong or stale, fix it in the same edit — do not
+  let memory drift from reality.
+
+## How the two toolchains share this
+
+Both `.opencode/agent/*.md` and `.claude/agents/*.md` point their agents at
+these files by relative path (`docs/agent-rules/memory/<agent>.md`). There is
+no duplication of memory content — only this one copy.

docs/agent-rules/memory/code-reviewer.md

@@ -0,0 +1,69 @@
+# Memory — code-reviewer
+
+Reusable review findings and check focus for NetShift. Read before reviewing;
+append recurring findings; keep under ~200 lines.
+
+## What to check (in priority order)
+
+1. **Architecture / layer direction**: UI -> backend (via fs.exec of the two
+   allowed binaries) -> sing-box/nft/dnsmasq. No layer skips another. UI must
+   not reimplement backend logic; backend must not hardcode what belongs in
+   `constants.sh`.
+2. **Runtime contract intact**: ports/marks/paths (1602, 127.0.0.42:53, :9090,
+   198.18.0.0/15, marks 0x100000/0x200000, `NetShiftTable`, `105 netshift`)
+   unchanged unless the task explicitly says so and the WHOLE chain is updated.
+3. **Backend shell correctness**: `# shellcheck shell=ash`; all `local`; correct
+   function prefix; `$config` echo-and-reassign threading; **no jq regex**
+   (test/match/sub/gsub) — flag any as CRITICAL; `fatal` log followed by
+   `exit 1`; atomic write + `sing-box check`; new constants in `constants.sh`.
+4. **Frontend correctness**: did they edit TS source (not `main.js` by hand)?
+   Did they rebuild so `main.js` matches (no stray diff)? New public API
+   re-exported up the barrel to `main.*`? Unused vars `_`-prefixed? `_()` around
+   new user-facing literals? No `any`?
+5. **Test coverage / gates**: backend config-gen or subscription changes should
+   add/extend a smoke test; new pure frontend logic should ship a vitest
+   `.test.js`. Confirm the relevant gate (shellcheck / smoke-tests / yarn ci)
+   was run.
+6. **Packaging**: respect the intentional ipk `v`-prefix vs apk-raw
+   inconsistency; don't break the underscore->dash rename; version placeholder
+   stamping intact.
+
+## Output
+
+- Write the review to `docs/tasks/<task-name>-review-001.md` using
+  `docs/tasks/TEMPLATE-review.md`.
+- Verdict vocabulary: `APPROVED` / `APPROVED WITH CONDITIONS` /
+  `REQUIRES CHANGES`. ID-tag issues (C1 critical, S1 significant, M1 minor) and
+  cite exact `file:line`.
+- No flattery. No speculation — report only what you can verify. Every problem
+  gets a concrete recommendation.
+
+## Recurring findings to watch for
+
+- jq regex functions sneaking in (CRITICAL on OpenWRT jq).
+- `fatal` log without a following `exit 1`.
+- Hand-edited `main.js` or a `main.js` that doesn't match a fresh build.
+- New validator/helper not re-exported -> invisible to `main.*`.
+- Hardcoded ports/IPs/paths instead of `constants.sh` references.
+- Routing code that ignores `subscription_outbound_is_unavailable` (traffic
+  leak when a subscription is down).
+- Scope creep: unrelated file churn (e.g. lockfile churn) flagged as Minor.
+- Diagnostic strings in `usr/bin/netshift` are valid UTF-8 emoji/box-drawing —
+  must stay UTF-8, never CP1251 (task-004 fixed a double-encode). For
+  mojibake-repair reviews, prove ASCII-byte preservation byte-safely (Python:
+  decode HEAD blob vs working tree, strip `[^\x00-\x7F]` per line, expect 0
+  mismatched lines); beware PowerShell text pipelines which produce false UTF-16
+  diffs.
+
+- base64 share-link decode vs `sing_box_cf_add_proxy_outbound` `url_decode` (facade:65): the facade runs `url_decode` (+>space, %XX>byte) on the whole URL before the scheme case. Any case that base64-decodes the ENTIRE payload (vmess, future tuic/etc.) must use the RAW pre-url_decode link <20> standard base64 contains '+'. The ss) case escapes this only because it decodes a short method:password userinfo. Beware synthetic test keys that avoid '+' masking this (false green).
+
+- For protocol validators that base64-decode a whole body (vmess, future tuic/etc.): the '+'-regression is real only if the dispatcher preserves '+'. validateProxyUrl only .trim()s, so '+' survives at the boundary <20> a green direct-call '+' test is sufficient evidence; a dispatcher-level '+' assertion is the stronger guard.
+
+- Wrapper/core split for always-run cleanup (task-009 core-switch): verify the public wrapper captures core stdout to a temp file + rc, then UNCONDITIONALLY calls restore/cleanup before re-emitting JSON and return rc; confirm the worker runs without set -e (else a non-zero core rc could skip trailing cleanup) and that _*_core never exits. For never-end-core-less rollbacks, confirm the tmpfs backup happens BEFORE the package manager/extract touches the binary and is dropped ONLY on the confirmed-good path; strongest test deletes the live mock binary on simulated failure and asserts original bytes restored.
+
+- Frontend barrel exposure: anything added to src/helpers/index.ts (or any export* barrel reaching main.ts) AND actually used appears in the generated main.js baseclass.extend block as a main.* symbol; unused re-exports get tree-shaken. So internal-only helper + added to barrel + used = it WILL leak to main.*. To keep a helper truly internal, place it in the consuming module, not the barrel.
+
+- OpenWrt jq ascii_downcase only folds ASCII A-Z; case-insensitive matching on Cyrillic/Unicode names needs an inline codepoint fold (explode/map/implode: ASCII 65-90 +32, Cyrillic 1040-1071 +32, Yo 1025->1105). When reviewing such a fold: (a) already-lowercase ranges excluded (no double-fold), (b) def before first use when the program does NOT import helpers.jq, (c) a pure-emoji-keyword exact-match test proves non-folded codepoints pass through unchanged on both sides. (task-010)
+
+- Package-manager rc is NOT a reliable success signal on opkg: rc=0 for "Not downgrading"/"already installed"/"up to date". A self-update/install that trusts only rc silently no-ops (the v→no-v rename trap: legacy `v0.8.6` sorts ABOVE `0.8.7` in opkg's compare, so `opkg install` refuses the "downgrade" and returns 0). When reviewing a package-install path, require: (a) `--force-downgrade --force-reinstall` on the opkg branch (apk overwrites by default); AND (b) verify-after-install — RE-READ the installed version (opkg `list-installed | grep "^pkg "`, apk `list --installed`; grep/awk only, NO Oniguruma jq) and compare v-stripped semver (`${x#v}`, `${x%%-*}`) with `==` OR `is_min_package_version installed target`; empty-installed must fail-safe to success:false. Keep install.sh `pkg_install` and updater.sh `updates_pkg_install_file` opkg branches ALIGNED. (task-041/042)
+- Async self-update worker landmine: the `_*_core` worker MUST `return 1` (NEVER `exit`) on failure so the public wrapper's always-run `updates_restore_after_swap` epilogue + finished-job-state write still execute. Verify the wrapper captures core rc/JSON to a temp file then unconditionally restores. Smoke assertions for these must be in the MAIN shell body (direct `if…pass/fail`), never inside `cmd | while read` (subshell swallows PASS/FAIL — harness-wide landmine). (task-041)

docs/agent-rules/memory/luci-frontend-developer.md

@@ -0,0 +1,863 @@
+# Memory — luci-frontend-developer
+
+Durable frontend (TypeScript / LuCI) knowledge. Read before implementing;
+append findings; keep under ~200 lines.
+
+## The generated bundle (most important)
+
+- `luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js` is
+  **autogenerated by tsup** from `fe-app-netshift/src/**`. Banner: "This file is
+  autogenerated, please don't change manually." NEVER hand-edit it. Edit TS
+  source, then `yarn build`. CI fails if the committed `main.js` differs from a
+  fresh build (`git diff --exit-code` after build).
+- tsup `onSuccess` regex-patches the ESM `export { ... }` block into
+  `return baseclass.extend({ ... })` so LuCI can load it as a baseclass module.
+  An unusual export shape could break that regex.
+
+## Barrel / export reachability (recurring gotcha)
+
+- Hand-written views consume the bundle as `main.*` via
+  `'require view.netshift.main as main'`. A new public API
+  (validator/helper/constant/tab) reaches the views ONLY if it is re-exported
+  up the barrel chain to `src/main.ts`.
+- `validateHysteria2Url` (in `validateHysteriaUrl.ts`) is intentionally NOT in
+  `validators/index.ts` — only `validateProxyUrl` is exported; it dispatches to
+  the per-scheme validators internally. Mirror that pattern: export the
+  dispatcher, not necessarily every leaf.
+- Other helpers (prettyBytes, showToast, normalizeCompiledVersion, etc.) are
+  imported by direct path, not via barrel. Check before assuming barrel.
+
+## Backend access
+
+- Only `/usr/bin/netshift` and `/etc/init.d/netshift` are ACL-allowed for
+  `fs.exec` (acl.d/luci-app-netshift.json). A new shell command must be a
+  subcommand of one of those, else extend the ACL + backend. Plus Clash API on
+  `ws://<host>:9090` and `http://<host>:9090/ui`.
+
+## Style / CI
+
+- `yarn ci` = `format && lint --max-warnings=0 && test --run && build`.
+  No-diff enforcement (format + build) lives in `frontend-ci.yml` via
+  `git diff --exit-code`. Run the `frontend-ci` skill before handing back.
+- Prettier: 2-space, single quotes, semicolons, trailing-comma all, width 80.
+- ESLint: `@typescript-eslint/no-unused-vars` is a WARNING with `^_` ignore, and
+  CI is `--max-warnings=0` => unused vars MUST be `_`-prefixed (`_e`, `_err`).
+- strict TS, no `any`, functional components, named exports.
+- LuCI globals (E, fs, uci, ui, _) are in `src/luci.d.ts` (no import). E()
+  handlers use the `click:` attribute (not `onclick`) even though luci.d.ts only
+  declares `onclick` — follow the existing `click:` convention. Extend
+  `luci.d.ts` when you need a new LuCI global.
+
+## i18n
+
+- Wrap user-facing strings in `_()`, and only STRING LITERALS — the gettext
+  extractor (`yarn locales:actualize`) only sees literal args. Some validator
+  messages (vless/trojan) are currently NOT wrapped — wrap new ones.
+- i18n pipeline (`yarn locales:actualize` = extract-calls → generate-pot →
+  generate-po:ru → distribute). `extract-calls.js` scans BOTH `src/**/*.ts` AND
+  the hand-written `luci-app-netshift/.../view/netshift/**/*.js` (excludes
+  `main.js`), so `_()` strings added in `section.js` ARE extracted. Source of
+  truth for ru text is `fe-app-netshift/locales/netshift.ru.po` — fill the new
+  empty `msgstr` there (preserves existing translations on regen), then re-run
+  `yarn locales:distribute` to copy into the generated catalogs
+  `luci-app-netshift/po/{templates/netshift.pot, ru/netshift.po}`. Touched
+  catalog files: `locales/calls.json`, `locales/netshift.pot`,
+  `locales/netshift.ru.po`, `po/templates/netshift.pot`, `po/ru/netshift.po`.
+- TYPE-ONLY changes to `src/**` (e.g. adding interface fields in `types.ts`,
+  inside the `NetShift` namespace) erase at build → `main.js` has NO diff after
+  `yarn build`. Expect a clean `git diff` on `main.js` for pure-type edits.
+- `section.js` is a hand-written LuCI view, NOT bundled — `yarn format` only
+  touches `src/`, so format leaves section.js alone; keep its existing
+  2-space/double-quote style manually.
+
+## Version placeholder
+
+- `constants.ts` `NETSHIFT_LUCI_APP_VERSION='__COMPILED_VERSION_VARIABLE__'` is
+  substituted at OpenWRT build by `luci-app-netshift/Makefile` sed. In dev,
+  `normalizeCompiledVersion` turns anything containing `COMPILED` into `'dev'`.
+  Don't change the literal without updating the Makefile sed.
+
+## Tests
+
+- vitest `.test.js` files next to code under `tests/`, table-driven
+  `describe.each`, `_()` identity-mocked in `tests/setup/global-mocks.ts`, node
+  env (no DOM). New pure logic SHOULD ship a test. DOM/service/render code is
+  untested (no DOM mocks) — verify those by reasoning + build.
+- DO NOT import a `.test.js` from `methods/shell/index.ts` (or anything that
+  transitively imports the helpers barrel → `withTimeout` → `../netshift`
+  logger → `TabService` which calls `new MutationObserver` at module init).
+  In the node env that throws `MutationObserver is not defined` at COLLECT time
+  (suite fails with "no tests"). Fix: put pure/testable logic in its OWN module
+  that imports leaf helpers by DIRECT path (e.g. `../../../helpers/sleep`, NOT
+  the barrel), and import the test from that module. Done for task-008's
+  `pollSingBoxComponentAction.ts`.
+
+## Async core switch (task-008) — the rpcd 30s pattern
+
+- The core switch (sing-box install_extended/install_stable) must use the
+  ASYNC backend contract, not a single sync `component_action` exec — rpcd
+  kills any single fs.exec at 30s SERVER-SIDE regardless of the JS
+  `timeout:600000`. Pattern: `executeShellCommand(['component_action_async',
+  'sing_box', action])` → parse `{success,job_id,message}` → if no job_id,
+  fail fast → poll `['component_action_status', jobId]` in a loop every ~2s
+  with SHORT individual execs until `running !== true`; safety cap ~150 polls.
+  Each status call is tiny (ms) so never hits the wall.
+- Status contract fields (task-007/009): `{success,running,component,action,
+  message,pid,started_at,updated_at,exit_code,version,latest_version}`.
+  Map terminal → `{success, version, message}`.
+- `check_update` stays on the SYNC `component_action` path (fast, not subject
+  to 30s) — branch inside `singBoxComponentAction` on `action`.
+- Make the poll loop a PURE fn `pollSingBoxComponentAction(fetchStatus,
+  sleepFn=sleep, intervalMs, maxPolls)` with injected `fetchStatus`+`sleepFn`
+  so tests pass a no-op sleep (`() => Promise.resolve()`) and never wait 2s.
+  `sleep(ms)` lives in `helpers/sleep.ts` (Promise+setTimeout).
+- `showToast` type is only `'success' | 'error'` — for an in-progress info
+  toast just use `'success'` (don't widen the helper signature for it).
+- BARREL LEAK GOTCHA: adding `export * from './sleep'` to `helpers/index.ts`
+  made `sleep` appear as `main.sleep` in the generated baseclass.extend export
+  block (used barrel exports are NOT tree-shaken). For a truly INTERNAL helper,
+  do NOT put it in the barrel — place it next to its only consumer (e.g.
+  `methods/shell/sleep.ts`) and import by direct relative path. Verify after
+  build: `git diff main.js | grep '^\+\s\+[a-z]\+,$'` shows no new bare export
+  line. (task-008 M1.)
+- TESTING the REAL `singBoxComponentAction` despite the DOM/MutationObserver
+  collect crash: `vi.mock('<barrel path>', () => ({ executeShellCommand: ... }))`
+  short-circuits the `helpers`→`withTimeout`→`../netshift`→TabService chain so
+  the method module imports cleanly, THEN `const { X } = await import('../index')`.
+  CRITICAL: `vi.mock` factory paths are relative to the TEST file, and must
+  resolve to the SAME absolute module the SUT imports. From
+  `methods/shell/tests/`, the SUT's `../../../helpers` is `../../../../helpers`
+  from the test, and `./callBaseMethod` is `../../callBaseMethod`. Get these
+  wrong and the real (DOM-crashing) module loads → "MutationObserver is not
+  defined" at collect. (task-008 M2.)
+
+## Landmines
+
+- `runFakeIPCheck` allGood/atLeastOneGood logic looks inverted vs other checks —
+  don't "fix" without understanding intent.
+- Filename typo `checks/contstants.ts` is imported with the typo everywhere —
+  don't "correct" it and break imports.
+
+## Validator-test node globals (task-006)
+
+- `.test.js` files are linted as plain JS (typescript parser, no
+  `languageOptions.globals` in `eslint.config.js`), so bare `Buffer` / `btoa`
+  trips `no-undef` even though vitest runs in the node env at runtime. The
+  validator `.ts` files DON'T hit this (TS lib types cover `atob`). Fix in tests
+  WITHOUT editing eslint config: alias the node global via
+  `const NodeBuffer = globalThis.Buffer;` (`globalThis` is an allowed global) and
+  use `NodeBuffer.from(...).toString('base64')` for fixtures.
+- VMess `vmess://` is base64(JSON) (V2RayN), NOT user@host. `validateVmessUrl`
+  decodes with `atob` (right-pad to %4 with `=` for unpadded tolerance, matching
+  backend), JSON.parse, then narrows `Record<string, unknown>` for
+  `add`/`id`/`port`. It is dispatcher-only (NOT in `validators/index.ts`), exactly
+  like `validateHysteria2Url`. Craft a `+`-containing base64 fixture with a field
+  like `ps:'>>>'` (verified to force `+`).
+
+## Corepack yarn 4.x vs classic lockfile (task-006)
+
+- This repo's `yarn.lock` is v1 (classic) but corepack may activate yarn 4.16.0.
+  Running `yarn install` migrates the lockfile + creates `.yarn/`/`.yarnrc.yml`.
+  AVOID `yarn install`; node_modules is committed/present. Run CI steps via local
+  bins: `node_modules/.bin/{prettier --write src, eslint src --ext .ts,.tsx
+  --max-warnings=0, vitest run, tsup src/main.ts}`. Run locales via
+  `node {extract-calls,generate-pot,generate-po ru,distribute-locales}.js`.
+  Before reporting: confirm `git diff --exit-code -- fe-app-netshift/yarn.lock`
+  and no `.yarn`/`.yarnrc.yml`.
+- `locales/calls.json` is committed WITH Windows backslash paths
+  (`src\\validators\\...`) — generating it on Windows does NOT churn separators.
+- The proxy-link help string `"vless://, ... links"` is duplicated 3× in
+  `section.js` (proxy_string + selector + urltest fields) — use edit replaceAll.
+
+## VMess `#fragment` strip (task-012)
+
+- `vmess://<base64(JSON)>#name` — the `#…` is the server display-name remark
+  (same as vless/ss/trojan), but for VMess the name also lives in JSON `ps`.
+  V2RayN base64 NEVER contains `#`, so cut at the FIRST `#` before decode.
+- `validateVmessUrl` order MATTERS: derive `body = url.slice('vmess://'.length)`
+  → `b64 = body.split('#')[0]` → THEN run the `/\s/` whitespace check on `b64`
+  (NOT the full url), THEN pad/`atob` `b64`. This lets a `#name with spaces`
+  fragment validate while still rejecting whitespace inside the base64 body.
+  (The old code ran `/\s/` on the full url and padded `body` incl. fragment →
+  emoji/Cyrillic in `#🇳🇱Ne` corrupted base64 → "malformed base64".)
+- Real-user regression fixture is the long `eyJ…In0=#🇳🇱Ne` literal in the test;
+  keep a malformed-base64 negative case WITHOUT a `#` (`vmess://@@@@`) so it
+  still fails for the right reason, and a `vmess://<b64> ` (trailing space, no
+  `#`) case proving base64-body whitespace is still rejected.
+- main.js diff for this fix is exactly the `validateVmessUrl` function body
+  (body/b64 split + whitespace-on-b64 + pad b64) — expected-only.
+
+## settings.js section-picker pattern + DNS-via-outbound (task-015)
+
+- `settings.js` is a HAND-WRITTEN LuCI view (NOT bundled by tsup → editing it
+  yields NO main.js diff). The reusable "pick a proxy/vpn section" dropdown
+  pattern: `form.ListValue` + `o.depends(<flag>,'1')` + `o.cfgvalue` reading
+  `uci.get('netshift',section_id,<opt>)` + custom `o.load` that walks
+  `this.map?.data?.state?.values?.netshift ?? {}`, pushes secName to
+  `this.keylist`/`this.vallist` when `sec['.type']==='section'` AND
+  `connection_type` is NOT `block`/`exclusion`, returns `Promise.resolve()`.
+  Mirrors `download_lists_via_proxy_section` (settings.js ~294-321).
+- `dns_outbound_section` uses `rmempty=true` (empty = backend falls back to
+  first outbound) — intentionally differs from the download-proxy clone's
+  `rmempty=false`. Don't "normalize" it.
+- R3 trap: the spec called the diagnostic field "type-only ⇒ no main.js diff",
+  but adding the field to `types.ts` is type-only (erased at build) WHILE the
+  paired `runDnsCheck.ts` `insertIf` render IS RUNTIME CODE → it DOES produce a
+  legit main.js diff (the 10-line insertIf block). That regenerated main.js is
+  the deliverable; a second build is idempotent (no further diff). "No diff"
+  only holds if you skip the runDnsCheck.ts edit.
+- locales: ran `node {extract-calls,generate-pot,generate-po ru,
+  distribute-locales}.js` (NOT yarn → no corepack). New ru text goes in the
+  SOURCE `locales/netshift.ru.po` empty `msgstr`, then `distribute-locales.js`
+  copies to `po/ru/netshift.po` + `po/templates/netshift.pot`. Regen touches
+  calls.json/pot broadly (line-ref reshuffle + POT-Creation-Date header) but is
+  PURELY ADDITIVE — verified at msgid level: 5 added, 0 removed.
+- ENCODING TRAP (Windows/PS5.1): `git show HEAD:file > tmp` re-encodes the blob
+  to UTF-16 and MANGLES UTF-8 (emoji/Cyrillic) — gives FALSE "removed/added"
+  noise. Use `cmd /c "git ... > %TEMP%\f"` (preserves raw bytes) OR compare via
+  `git diff` directly. The committed .pot/.po ARE valid UTF-8; don't panic.
+- Console prints po/pot Cyrillic as mojibake — that's PS display only; verify
+  on-disk via `node -e "require('./locales/calls.json')...includes(...)"` or
+  UTF-8 byte reads, not the terminal.
+- New i18n keys (task-015) + ru: "Route main DNS through proxy/VPN"→"Основной
+  DNS через прокси/VPN"; "DNS outbound section"→"Секция outbound для DNS";
+  "Main DNS via outbound"→"Основной DNS через outbound"; long descriptions
+  translated equivalently.
+
+## validateIPV6 rewrite + concat-_() i18n (task-015 PR#11 fixes)
+
+- The OLD `validateIPV6` (two loose regexes + `colons>=2&&<=7` guard) WRONGLY
+  accepted `:::`, `1:2:::3`, `1::2::3` (multiple `::`), `1:2:3:4:5:6:7`
+  (incomplete 7-group). Replaced with a small functional checker (no `any`):
+  count `::` via `stripped.split('::').length-1` (reject >1); split into
+  head/tail, `countGroups(side)` splits on `:` and validates each as
+  `/^[0-9a-fA-F]{1,4}$/` hextet; group-count rule = exactly 8 when no `::`,
+  ≤7 when one `::` (it stands for ≥1 zero group). `''` side → 0 groups (so `::`
+  unspecified and `::1` work). Helpers `isHextet`/`countGroups`/`isEmbeddedIPv4`
+  are module-private (NOT in barrel) → no `main.*` export leak; verified diff
+  has no new bare export lines.
+- F-04 DECISION: ACCEPT IPv4-embedded IPv6 (`::ffff:192.168.1.1`,
+  `2001:db8::192.168.1.1`) — valid per RFC 4291. `countGroups` treats a LAST
+  group containing `.` as an embedded IPv4 (validated via `validateIPV4`) that
+  occupies TWO 16-bit groups (so it adds +1 to the group count). Tested both
+  positive and the malformed negatives.
+- main.js diff for this is EXACTLY the validateIPV6 function body + 3 private
+  helpers (52+/7- lines); second build idempotent. Expected runtime-code diff.
+- I18N CONCAT GOTCHA (F-02): `_('foo ' + 'bar')` is NOT extracted (gettext sees
+  only literal args; the `+` makes it an expression). The established repo
+  convention (see section.js community_lists ~415) is
+  `_('foo') + ' ' + _('bar')` — the SPACE lives OUTSIDE `_()`, and each literal
+  has NO trailing/leading space. `extract-calls.js` line 55 does `arg.value.trim()`
+  so a trailing space INSIDE `_('foo ')` is trimmed in the catalog → runtime
+  lookup of `'foo '` MISSES. So ALWAYS put separators outside `_()`. Fixed
+  global_proxy (section.js ~310), block_doh + enable_ipv6 (settings.js ~463/481).
+- locales regen: ran `node {extract-calls,generate-pot,generate-po ru,
+  distribute-locales}.js` (NOT yarn). `generate-pot.js` calls
+  `git config user.name`/`user.email` and CRASHES if unset → set them locally
+  (`git config --local user.name "..."`, email may be empty string which returns
+  rc=0). POT header churns (POT-Creation-Date timezone + `<>` from empty email)
+  — cosmetic, accepted; msgid-level diff was PURELY ADDITIVE (10 added, 0
+  removed). 10 new ru msgstrs filled in SOURCE locales/netshift.ru.po then
+  distributed to po/ru + po/templates (both end up byte-identical to source).
+- The 10 new ru fragments are the split sentences of the 3 flag descriptions
+  (global proxy / block DoH / enable IPv6) — translated formally/technically
+  matching neighbours. All catalogs LF, no empty non-header msgstr remained.
+
+## Component Manager tab (task-018)
+
+- NEW TAB = 5-file pattern mirroring `tabs/diagnostic`: `manager/{index,render,
+  initController,styles}.ts` + a hand-written `view/netshift/manager.js`
+  (`form.DummyValue _mount_node`, `o.rawhtml=true`, `cfgvalue` →
+  `main.ManagerTab.initController()` + `return main.ManagerTab.render()`).
+  Register in `netshift.js`: add `"require view.netshift.manager as manager"`
+  + a `form.TypedSection` block (`anonymous=true`, `addremove=false`,
+  `cfgsections=()=>["manager"]`). NB the tab UCI section name (`manager`,
+  `diagnostic`, `dashboard`) need NOT exist in `/etc/config/netshift` — LuCI
+  renders the virtual TypedSection anyway (diagnostic/dashboard prove it).
+- Barrel: add `export * from './manager';` to `tabs/index.ts` → `ManagerTab`
+  reaches `main.ManagerTab` (verified in the export block at the bottom of
+  main.js). Wire `ManagerTab.styles` into `src/styles.ts` `GlobalStyles` next to
+  Dashboard/Diagnostic. Styles use theme vars WITH fallbacks; CBI selector is
+  `#cbi-netshift-manager-_mount_node > div` + hide `#cbi-netshift-manager > h3`.
+- LIFECYCLE: mirror diagnostic exactly but guard re-init with module-level
+  `*Registered`/`*Initialized`/`*Mounted` booleans since the
+  lazy-mount listener can fire repeatedly. `onMount('manager-status')` →
+  `registerLifecycleListeners()` (subscribe on `tabService.current==='manager'`)
+  → `onPageMount` subscribes store + renders + fetches systemInfo;
+  `onPageUnmount` resets `['managerActions','managerChecks']`.
+- INSTALLED-NOW / LATEST-ON-DEMAND: installed versions come from
+  `diagnosticsSystemInfo` (reuse the diagnostic `getSystemInfo()`→store slice);
+  latest is fetched ONLY on a "Check update" click. Pure card builder
+  `cards.ts:getComponentCards(systemInfo, checks)` + `getCheckTag(status)` +
+  `isSingBoxInstalled` are DOM/store-free (import only `normalizeCompiledVersion`
+  leaf + `NetShift` types) → unit-testable WITHOUT the MutationObserver collect
+  crash. Controller maps descriptors→DOM+click handlers. 3 cards: netshift,
+  sing_box_stock, sing_box_extended; inactive core → "Not installed" + switch.
+- BACKEND CONTRACT (task-017, STABLE): both SING-BOX checks (`check_update`
+  extended / `check_update_stable` stock) return `{success,current_version,
+  latest_version,status:"latest"|"outdated"|"dev"|"not_installed"}`. The
+  PRE-EXISTING `singBoxComponentAction('check_update')` only parsed `{success,
+  version,message}` (DROPPED status/latest) — do NOT route the manager check
+  through it. Added ONE `singBoxCheckUpdate(action)` method parsing the FULL
+  contract via a pure `parseComponentCheckUpdate.ts` (types-only import, status
+  whitelisted). Install/switch reuse the existing async
+  `singBoxComponentAction('install_*')` + `pollSingBoxComponentAction`.
+- C1 (review fix) — THERE IS NO `netshift:check_update` BACKEND ACTION. NetShift
+  latest comes ONLY from `get_system_info.netshift_latest_version`. So the
+  NetShift card's "Check update" must NOT route through `singBoxCheckUpdate` (that
+  would run the sing-box EXTENDED check and write its status into
+  `managerChecks.netshift` → wrong). Fix: give the NetShift check a DISTINCT
+  `kind:'check_netshift'` (no `backendAction`) so `handleManagerAction` routes it
+  to `runNetshiftCheck`, which RE-FETCHES systemInfo + `resetCheckResult
+  ('netshift')` and derives the badge/toast from installed-vs-latest. NetShift
+  status is derived PURELY from systemInfo (`netshiftStatus(systemInfo)` no longer
+  reads `managerChecks.netshift`). Regression guards in cards.test.js: NetShift
+  action kind is `check_netshift`, has NO `backendAction`, and status ignores a
+  bogus `managerChecks.netshift`. LESSON: when a card's "latest" comes from a
+  DIFFERENT source than its siblings, give it its own action kind so the shared
+  dispatcher can't misroute it to the wrong backend method.
+- S1 (review fix) — keep ONE check method per concern: removed the dead
+  `singBoxCheckUpdateStable()` (0 callers; controller uses
+  `singBoxCheckUpdate('check_update_stable')`). No dead exports.
+- M2 (review fix) — `ManagerComponentKey` defined ONCE in `tabs/manager/cards.ts`
+  (the pure module) and `export type`-re-exported from `store.service.ts` (which
+  `import type`s it) so store consumers keep their path; safe because cards.ts
+  imports NO store (no cycle). M1 (self-update timeout reusing 'Core switch
+  timed out' wording) left as-is — non-blocking, and the shared
+  `pollSingBoxComponentAction` wording is approved for the core-switch path.
+- SELF-UPDATE lenient polling: `netshiftSelfUpdate()` starts
+  `component_action_async netshift self_update`; once a `job_id` is returned, the
+  poll `fetchStatus` callback SWALLOWS exec/parse errors and returns a synthetic
+  `{running:true}` (instead of `null`, which the pure poll treats as terminal
+  failure). This prevents the mid-job `/usr/bin/netshift` binary swap from
+  misreporting success as failure; `MAX_POLLS` still bounds it. On success: a
+  warning-style toast then `window.location.reload()` after 1200ms.
+- MOVED core-switch OUT of Diagnostics: removed `handleInstallSingBox` +
+  `singBoxInstall`/`singBoxExtended` from `diagnostic/initController.ts` and the
+  `singBoxInstall` block + props from `renderAvailableActions.ts`, and the
+  `singBoxInstall` slice from BOTH `StoreType` and `diagnostic.store.ts`. Net
+  i18n effect: msgids "Install stable"/"Install extended" were DROPPED (now-dead)
+  and replaced by manager's "Switch to stable"/"Switch to extended"/"Install %s"
+  — so the ru.po diff is NOT purely additive this time (2 removed, ~16 added);
+  that is correct. `renderRotateCcwIcon24` stays imported (still used by Restart).
+- i18n: 16 new ru msgstrs filled in SOURCE `locales/netshift.ru.po`, then
+  `node distribute-locales.js`. "%s" placeholder strings ("Install %s") are
+  single literals (no concat); progress/result toasts concatenate the version
+  OUTSIDE `_()` (`` `${_('NetShift updated, version:')} ${v}` ``). Ran the
+  locales scripts via `node {extract-calls,generate-pot,generate-po ru,
+  distribute-locales}.js`. yarn here was classic 1.22.22 (NOT corepack) so
+  `yarn ci` was safe — verified yarn.lock unchanged + no `.yarn/.yarnrc.yml`.
+- main.js: +756/-… runtime diff (new tab + methods + core-switch removal),
+  second build idempotent (byte-identical), banner + `return baseclass.extend`
+  intact, only `ManagerTab` added to the export block (pure helpers imported by
+  direct path → no leak). `tsc --noEmit` flags ONE pre-existing error in
+  `getNetshiftVersionRow.test.ts` (sing_box_extended optionality) — NOT in CI
+  (yarn ci = format/lint/vitest/build, no tsc), pre-existing, ignore.
+
+## Drop stale nft "mangle output counters" check (task-020b)
+
+- Backend 020a removed `rules_mangle_output_counters` from `check_nft` JSON
+  (router-output traffic is intentionally DIRECT now → that chain's counter is
+  legitimately 0, so the non-zero assertion was a FALSE positive). New STABLE
+  7-key shape: `{table_exist, rules_mangle_exist, rules_mangle_counters,
+  rules_mangle_output_exist, rules_proxy_exist, rules_proxy_counters,
+  rules_other_mark_exist}` — `rules_mangle_output_exist` KEPT.
+- FE removal touched exactly 2 source files: `runNftCheck.ts` (drop the field
+  from the allGood `&&` chain, the atLeastOneGood `||` chain, and its `items[]`
+  row — keep the "Rules mangle output exist" row) + `types.ts`
+  `NftRulesCheckResult` (drop `rules_mangle_output_counters: 0 | 1;`).
+- main.js: runtime diff is the removed Boolean()s + the dropped items[] row;
+  second build BYTE-IDENTICAL (idempotent), banner + `return baseclass.extend`
+  intact; `grep -c rules_mangle_output_counters main.js` == 0.
+- locales: ran `node {extract-calls,generate-pot,generate-po ru,
+  distribute-locales}.js` (NOT yarn → no corepack). The unused
+  `_('Rules mangle output counters')` msgid dropped cleanly from ALL 5 catalogs
+  (calls.json, locales/netshift.{pot,ru.po}, po/{templates/netshift.pot,
+  ru/netshift.po}). msgid-level delta = PURELY a removal (1 removed, 0 added);
+  "Rules mangle output exist" stays. generate-po reported 325/323 (2 stale
+  translations retained in source ru.po — harmless, additive-preserving).
+- yarn was classic 1.22.22 → `yarn ci` safe; verified `git diff --exit-code --
+  yarn.lock` clean and NO `.yarn`/`.yarnrc.yml`. No vitest referenced the field.
+
+## validateUrl accepts IP host + subscription_insecure checkbox (task-021a)
+
+- `validateUrl.ts` REWRITE: old regex required an ALPHA TLD so an IPv4/IPv6 host
+  was rejected ("Invalid URL format"). New approach mirrors `validateSocksUrl`:
+  keep the protocol check (default `['http:','https:']`), then a pure
+  module-private `extractHost(url)` strips `scheme://` (indexOf '://'), the
+  `/path?query#frag` (`rest.search(/[/?#]/)` — first of `/ ? #`), optional
+  `userinfo@` (`lastIndexOf('@')`), and the `:port`. BRACKETED IPv6:
+  if `rest.startsWith('[')`, return the substring between `[` and the first `]`
+  (so `[2001:db8::1]:2096` → `2001:db8::1`); else strip trailing `:port` via
+  `lastIndexOf(':')`. Then accept if `validateIPV4(host).valid ||
+  validateIPV6(host).valid || validateDomain(host).valid`. Kept the 3 existing
+  messages verbatim (`Invalid URL format`, the protocol message, `Valid`).
+- NB `validateIPV6` ALREADY unwraps brackets internally (`.replace(/^\[/,'')`),
+  but extractHost must unwrap anyway so the `:port` after `]` is dropped before
+  the validator sees it. `extractHost` is NOT barrel-exported (module-private) →
+  no `main.*` leak; main.js diff is +30/-4 (the helper + the host-check), second
+  build BYTE-IDENTICAL, banner + `return baseclass.extend({` intact.
+- This single fix covers ALL FOUR callers (subscription_url, urltest_testing_url,
+  remote_domain_lists, remote_subnet_lists) — callers unchanged.
+- TESTS: `validateDomain` accepts a trailing path (`example.com/path` regex has
+  `(?:\/[^\s]*)?$`), so existing domain-with-path valid cases still pass through
+  the domain branch. Added valid: `https://91.199.111.52:2096/sub/abc`,
+  `http://10.0.0.1/x`, `https://[2001:db8::1]:2096/sub`. Added invalid:
+  `https://999.1.1.1/x` (bad IPv4 → not domain either), `ftp://1.2.3.4` (protocol
+  fails first), `https://` (extractHost → '' → "Invalid URL format"). Kept
+  `https://google` invalid (no TLD, not an IP).
+- section.js (HAND-WRITTEN, NOT bundled → 0 in main.js): added `form.Flag`
+  `subscription_insecure` right AFTER subscription_url (~line 113), default `"0"`,
+  `rmempty=false`, `depends({connection_type:'proxy',proxy_config_type:
+  'subscription'})` exactly like its siblings (no `subscription_user_agent` exists
+  here despite the spec mention). Multi-sentence description = three `_()` calls
+  joined with `+ " " +` OUTSIDE `_()` (F-02 rule). UCI contract option name
+  `subscription_insecure` (0|1) consumed by backend 021b.
+- locales: `node {extract-calls,generate-pot,generate-po ru,distribute-locales}.js`
+  (NOT yarn). 4 new msgids (1 label + 3 description sentences), PURELY additive
+  (4 added, 0 removed at msgid level). Filled RU in SOURCE `locales/netshift.ru.po`
+  then distributed → po/ru + po/templates byte-identical to source. Only the PO
+  HEADER msgstr stays empty (`grep -nB1 'msgstr ""'` shows just line 6/7).
+- yarn classic 1.22.22 → `yarn ci` green (format/lint --max-warnings=0/471 tests/
+  build); verified yarn.lock unchanged + NO `.yarn`/`.yarnrc.yml`. The
+  `netshift/files/**` + `tests/**` changes in git status are 021b (other agent),
+  not mine.
+
+## subscription_url → form.DynamicList (multi-URL) (task-023)
+
+- Converted `subscription_url` from `form.Value` to `form.DynamicList` in
+  section.js (~88-111), modelled EXACTLY on `remote_domain_lists` (:721-742):
+  same per-row validate (`!value||value.length===0 → true`, else
+  `main.validateUrl(value)`), `rmempty=true` (was `false`; the empty-row guard
+  already short-circuited so emptiness was never enforced; backend keeps the
+  "no URL" guard). Kept option name `subscription_url`, depends
+  `{connection_type:'proxy',proxy_config_type:'subscription'}`, placeholder
+  `https://example.com/api/sub`. Title → plural `_("Subscription URLs")`;
+  description → single literal `_("Add one or more subscription URLs to fetch
+  proxy configurations from. All feeds are downloaded and merged.")`.
+- types.ts:120 `subscription_url: string` → `string[]` (kept required, matches
+  sibling list fields `selector_proxy_links`/`urltest_proxy_links`).
+- PURE TYPE-ONLY CHANGE: nothing in the FE reads `subscription_url` back (verified
+  repo-wide) → `tsup` build produced ZERO main.js diff (confirmed via
+  `git diff --exit-code main.js`). This is correct, NOT a missed rebuild. Still
+  ran the build to confirm. (Same lesson as the type-only note in i18n section.)
+- locales: `node {extract-calls,generate-pot,generate-po ru,distribute-locales}.js`
+  (NOT yarn → no corepack). msgid delta = clean SWAP: removed "Subscription URL"
+  + "Enter the subscription URL...provider"; added "Subscription URLs" + the new
+  merged-feeds description. Filled 2 ru msgstr in SOURCE locales/netshift.ru.po
+  ("URL подписок" / "Добавьте один или несколько URL подписок...объединяются.")
+  then distribute → po/ru + po/templates byte-identical to source (verified via
+  diff). Only header msgstr empty (line 7). 5 catalog files touched: calls.json,
+  locales/netshift.{pot,ru.po}, po/{templates/netshift.pot,ru/netshift.po}.
+- yarn classic 1.22.22 again but ran inner gate via node_modules/.bin
+  (prettier/eslint/vitest/tsup) to be safe; yarn.lock unchanged, no .yarn/.yarnrc.
+
+## UI design-system foundation: .card + tokens + toasts (task-024)
+
+- DESIGN TOKENS (STABLE — task-025/026 reference these; do NOT rename) defined
+  in `src/styles.ts` `GlobalStyles` on `:root, .cbi-map`:
+  `--ns-card-border` (var(--background-color-low, lightgray)),
+  `--ns-card-border-width` (2px), `--ns-card-radius` (4px), `--ns-gap` (10px),
+  `--ns-card-padding` (var(--ns-gap)), `--ns-success`/`--ns-warning`/`--ns-error`/
+  `--ns-info` (layered over success/warn/error-color-medium + primary-color-high
+  with hex fallbacks #28a745/#f0ad4e/#dc3545/#2196f3).
+- `.card` primitive = `border: var(--ns-card-border-width) solid
+  var(--ns-card-border); border-radius: var(--ns-card-radius); padding:
+  var(--ns-card-padding); min-width:0`. Mirrors Manager's component card EXACTLY
+  (2px/4px/10px/min-width:0) — that's the standardised look, NOT the 1px/8px from
+  the spec's illustrative example.
+- CASCADE RULE: `.card` MUST be defined in GlobalStyles BEFORE the
+  `${DashboardTab.styles}${DiagnosticTab.styles}${ManagerTab.styles}`
+  interpolations. The per-tab colored-border MODIFIERS (`.pdk_diagnostic_alert
+  --warning/--error/--loading/--success`, `__wiki--warning/--error`, outbound-grid
+  `--active`/`--selectable:hover`) are same-specificity single-class rules that
+  win ONLY via source order. Since injectGlobalStyles emits ONE `<style>` with
+  GlobalStyles, and the template renders tokens+`.card` first THEN the interpolated
+  tab CSS, the modifiers correctly override `.card`'s neutral border. (File
+  byte-offset of `.card` in main.js is LATER than the modifiers because
+  `DashboardTab.styles` is a separate `var stylesN` module — but runtime template
+  concatenation order is what matters, and that's correct.)
+- REFACTOR PATTERN: removed the duplicated `border/border-radius/padding` (and
+  manager's `min-width:0`) from the per-tab `styles.ts`, added `class:'card …'` in
+  the RENDER `.ts`. Card boxes touched (more than the spec's "4" — there were
+  these render sites): dashboard renderWidget (3 states), renderSections
+  (failed/loading/default outbound-section + outbound-grid item), diagnostic
+  renderWikiDisclaimer (className array — prepend 'card'), renderAvailableActions,
+  renderSystemInfo, renderCheckSection (all 5 alert states incl. `--skipped` which
+  has NO modifier so it relies on `.card`), manager initController component.
+  `.card` adds `min-width:0` to dashboard/diagnostic boxes (was absent) — harmless
+  overflow hardening, visually identical.
+- showToast union widened to `'success'|'error'|'warning'|'info'`
+  (showToast.ts:3). Added `.toast-warning`(--ns-warning) + `.toast-info`(--ns-info)
+  CSS; converted existing `.toast-success/.toast-error` to `var(--ns-success/error,
+  #hex)` (themeable, same fallback hex → visually identical). The
+  PREVIOUS memory note "showToast type is only success|error — use 'success' for
+  in-progress" is now SUPERSEDED: use `'info'` for in-progress, `'warning'` for
+  long/destructive-ish. Converted the 2 abuse sites in manager/initController.ts I
+  was already in: "Switching sing-box core…"→'info', "Updating NetShift…page will
+  reload"→'warning'. DEFERRED (not in touched files / debatable): manager line
+  ~155 "Latest version is unknown" still 'success' (check-result, not in-progress);
+  diagnostic/initController.ts had only 'error' toasts (nothing to fix).
+- RAW BUTTON KILLED: dashboard renderSections.ts "Test latency" raw
+  `<button class="btn">` → `renderButton({text:_('Test latency'), onClick:
+  ()=>testLatency(), classNames:['dashboard-sections-grid-item-test-latency']})`.
+  renderButton already adds `btn`, so only the custom class goes in classNames.
+- IMPORT-ORDER MAIN.JS CHURN (IMPORTANT): adding `import {renderButton} from
+  '../../../../partials'` into the DASHBOARD subtree (which previously never
+  imported the global `src/partials` barrel) makes esbuild REORDER ~every bundled
+  module block → a huge SYMMETRIC main.js diff (~1600/1600 lines) that is PURELY
+  cosmetic module reordering. Verified safe: build is IDEMPOTENT (same md5 twice),
+  banner intact, `return baseclass.extend({` intact, and the export-symbol SET is
+  BYTE-IDENTICAL to HEAD (diff /tmp/exports_old vs new = empty) → no barrel leak,
+  no new public API. Direct-path import (`…/partials/button/renderButton`) barely
+  reduced churn — the reorder is inherent to introducing the cross-subtree dep, so
+  I kept the barrel import for consistency with the 3 diagnostic callers. When a
+  reviewer sees a giant main.js diff for a tiny TS change, CHECK export-set
+  equality + idempotency before worrying.
+- TAB REORDER: netshift.js (hand-written, edit directly) — moved the Dashboard
+  `form.TypedSection` block to FIRST. New order: Dashboard · Sections · Settings ·
+  Component Manager · Diagnostics. ONLY block order changed; all 5 sections + their
+  cfgsections/anonymous/addremove wiring identical. coreService/TabService track by
+  `data-tab` (the active section name e.g. `current==='dashboard'`), NOT
+  registration index (tab.service.ts getActiveTabId reads `.cbi-tab:not(
+  .cbi-tab-disabled)` dataset.tab; dashboard initController keys on
+  `tabService.current==='dashboard'`) → reorder is SAFE, tracking unaffected.
+- VISUAL VERIFY caveat: no chromium available in this env (playwright launch
+  failed: chrome not found), so screenshots were NOT possible. Verified instead by
+  CSS-cascade reasoning + programmatic checks: `.card` precedes modifiers in the
+  runtime-concatenated GlobalStyles, no `background-color-low` base border remains
+  in any per-tab styles.ts (all neutral borders now come from `.card`), colored
+  modifiers keep their 2px width matching `.card`. FLAG: visual confirmation is
+  reasoned, not screenshotted.
+- yarn classic 1.22.22; ran gate via node_modules/.bin (prettier --write src clean
+  / eslint --max-warnings=0 / vitest 471 pass / tsup build). yarn.lock unchanged,
+  no `.yarn`/`.yarnrc.yml`. No locales change (no NEW user-facing literals — the
+  switching/updating toast strings already existed).
+
+## task-025 — section.js → 4 native CBI tabs (taboption)
+
+- CBI native tabs: `section.tab('name', _('Title'), _('descr'))` defines a tab,
+  then EVERY field MUST be `section.taboption('name', form.X, 'key', ...)`. HARD
+  RULE confirmed: once a section has `.tab()`, any leftover `section.option(...)`
+  silently renders nothing. Verified count: 36 taboption, 0 plain option (the
+  only `section.option(` grep hit was my own comment line).
+- Conversion is mechanical & low-risk: only the constructor call line changes
+  (`section.option(\n  form.X,` → `section.taboption(\n  "tab",\n  form.X,`).
+  All `.depends()` (33), `.validate` (17), `.value()`, defaults, placeholders,
+  and the `community_lists.onchange` (REGIONAL_OPTIONS/ALLOWED_WITH_RUSSIA_INSIDE
+  /DOMAIN_LIST_OPTIONS/getUIElement) stayed byte-identical. depends() works
+  across tabs; an all-depends-hidden tab auto-hides from the strip (Subscription
+  tab hides for proxy/url) — desired, no extra code.
+- `widgets.DeviceSelect` (`interface`) works fine inside a taboption — just pass
+  the widget class as the 2nd arg after the tab name.
+- Tab map (4 tabs, 36 fields): connection=11, subscription=10, routing=12,
+  advanced=3.
+- SMART-LIST UNIFICATION: did the LOW-RISK visual grouping (NOT a single-widget
+  merge). Kept all 4 UCI keys + 2 *_list_type selectors. Achieved "one control"
+  feel by renaming the two list-type selector TITLES to group headings
+  ("Custom domains"/"Custom subnets") with descriptions naming the modes;
+  depends() already shows only the chosen input below. Deeper merge deferred
+  (would risk UCI/validator changes). NOTE: renaming a selector title drops its
+  old msgid from catalogs — fill the new ones.
+- RU-HARDCODE FIX: `subscription_group_by_countries` had `_("Группировать по
+  странам")` as the SOURCE literal (msgid). Replaced with English `_("Group by
+  countries")` + English descr; moved the Russian into the ru.po msgstr. After
+  this the Cyrillic appears ONLY as msgstr, never as msgid.
+- section.js is NOT in the `yarn ci` prettier scope (CI formats only `src`).
+  section.js uses DOUBLE QUOTES (LuCI convention) and does NOT pass the project
+  `.prettierrc` (singleQuote) — confirmed the ORIGINAL also failed prettier.
+  So: match the file's existing double-quote/2-space style; do NOT run prettier
+  on section.js (it would fight the whole file).
+- i18n flow: `node extract-calls.js && node generate-pot.js && node
+  generate-po.js ru && node distribute-locales.js`. generate-po keys by msgid &
+  carries forward old msgstr; NEW/renamed msgids land empty → fill them in
+  fe-app-netshift/locales/netshift.ru.po, then RE-RUN distribute-locales.js to
+  copy into luci-app-netshift/po/{ru/netshift.po, templates/netshift.pot}.
+  Verify byte-consistency with `diff -q` (both fe↔luci pairs). 13 new strings
+  this task; all ru filled; 0 empty msgstr after.
+- main.js drift rule confirmed: section.js-only + catalog changes need NO main.js
+  rebuild. I touched styles.ts so rebuilt — the ONLY main.js delta vs the
+  task-024 baseline was my new CSS block (#cbi-netshift-section
+  .cbi-section-node-tabbed card + ul.cbi-tabmenu margin). Build reproducible.
+- styles.ts: reused task-024 --ns-* tokens; added `#cbi-netshift-section
+  .cbi-section-node-tabbed` (card border/radius/padding) + `ul.cbi-tabmenu`
+  margin. Existing h3-hide (`> h3:nth-child(1)`) and remove-button hack
+  (`> .cbi-section-remove { margin-bottom:-32px }`) left intact (new rules added
+  after them; both still valid — remove button is a direct child, unaffected by
+  the tabbed pane styling).
+- VISUAL VERIFY caveat persists: no browser in env. Confirmed structurally
+  (taboption count/mapping, depends/validate counts == original, onchange grep
+  intact, catalog diff). FLAG for human: actual tab-strip/card rendering +
+  auto-hide behaviour of the Subscription/Advanced tabs not screenshot-verified.
+
+## task-026 — settings.js → 5 native CBI tabs (taboption)
+
+- Same mechanics as task-025. Converted ALL 27 settings options to
+  `section.taboption('tab', form.X, 'key', …)`. Verified: 27 taboption, 0 plain
+  `section.option(` (the 1 grep hit is my comment line). Tab map (5 tabs, 27):
+  dns(6)=dns_type,dns_server,bootstrap_dns_server,dns_via_outbound,
+  dns_outbound_section,dns_rewrite_ttl · network(6)=source_network_interfaces,
+  enable_output_network_interface,output_network_interface,
+  enable_badwan_interface_monitoring,badwan_monitored_interfaces,
+  badwan_reload_delay · lists(4)=update_interval,download_lists_via_proxy,
+  download_lists_via_proxy_section,routing_excluded_ips · yacd(3)=enable_yacd,
+  enable_yacd_wan_access,yacd_secret_key · advanced(8)=disable_quic,
+  dont_touch_dhcp,exclude_ntp,block_doh,enable_ipv6,config_path,cache_path,
+  log_level.
+- YACD DECISION: kept as its OWN tab (3 fields), NOT folded into Advanced.
+  Rationale: self-contained feature w/ clean depends() chain
+  (enable_yacd→wan_access→secret_key); folding into an 11-field Advanced would
+  recreate the wall. Tab title is `_("Dashboard")` (already-existing msgid),
+  internal tab name "yacd". Documented.
+- All 7 depends() preserved verbatim (only line order changed — irrelevant):
+  dns_outbound_section dep dns_via_outbound=1; output_network_interface dep
+  enable_output_network_interface=1; badwan_monitored_interfaces +
+  badwan_reload_delay dep enable_badwan_interface_monitoring=1;
+  enable_yacd_wan_access dep enable_yacd=1; yacd_secret_key dep
+  enable_yacd_wan_access=1; download_lists_via_proxy_section dep
+  download_lists_via_proxy=1. 6 validators + 3 custom widgets (2 DeviceSelect,
+  1 NetworkSelect) intact; cfgvalue/load section-picker closures unchanged.
+- HELP TRIM: block_doh was a 4-paragraph `_()+ " " +_()…` concat. Replaced with
+  ONE single-literal description "Block direct connections to known public DoH
+  servers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex) so apps cannot
+  bypass router DNS filtering." The caveat ("enable only after switching to
+  UDP/DoT") moved into the ADVANCED tab description (section.tab 3rd arg).
+  enable_ipv6's 2-sentence concat LEFT inline (short, the 2nd sentence is a
+  genuine 1-line caveat; not bloating) — documented choice.
+- BACKTICK TRAP IN styles.ts: GlobalStyles is a template literal. Putting a
+  backtick inside a CSS COMMENT (e.g. `#cbi-... > h3`) prematurely closes the
+  template → ESLint "Parsing error: ',' expected". NEVER use backticks anywhere
+  inside the styles.ts CSS string, even in comments. (Cost me one lint cycle.)
+- styles.ts: added `#cbi-netshift-settings .cbi-section-node-tabbed` (card
+  border/radius/padding/min-width:0) + `#cbi-netshift-settings ul.cbi-tabmenu`
+  (margin-bottom:var(--ns-gap)) — exact mirror of the task-025 section block,
+  reusing task-024 --ns-* tokens (did NOT redefine tokens). The existing
+  `#cbi-netshift-settings > h3 { display:none }` rule stays valid (added new
+  rules after it). main.js delta = exactly these 2 CSS rules; build IDEMPOTENT
+  (md5 a7300a2… across 3 builds), banner + `return baseclass.extend` intact,
+  no new export symbol (only-loss vs HEAD is task-024's `styles` leak removal,
+  not mine).
+- i18n: msgid delta = 9 added (tab titles "DNS"/"Network"/"Lists & Updates" —
+  "Dashboard"+"Advanced" already existed; 4 tab descriptions; 1 reworded
+  block_doh) / 4 removed (old block_doh fragments). Filled 9 ru msgstr in SOURCE
+  locales/netshift.ru.po then `node distribute-locales.js`. fe↔luci ru.po AND
+  pot byte-identical (diff -q); all LF; valid UTF-8 w/ Cyrillic; 0 empty
+  non-header msgstr. Ran scripts via `node {extract-calls,generate-pot,
+  generate-po ru,distribute-locales}.js` (generate-po reported 335/339 but 9
+  were genuinely new — its count metric differs).
+- yarn classic 1.22.22; ran gate via node_modules/.bin (prettier/eslint/vitest/
+   tsup). yarn.lock unchanged, no .yarn/.yarnrc.yml. NB: working tree already
+   carried UNCOMMITTED task-024 + task-025 changes (showToast, dashboard/diag/
+   manager styles+renders, section.js, netshift.js, #cbi-netshift-section CSS) —
+   so `git diff -- src` is large but only my settings block + the 4 catalogs +
+   main.js belong to task-026. format reported all-unchanged → no new churn.
+
+## task-030 — NetShift update check ON-DEMAND (retires C1's systemInfo-refresh)
+
+- REVERSES task-018's C1 decision. task-029 (backend, APPROVED) ADDED a real
+  `component_action netshift check_update` action returning the STANDARD check
+  JSON `{success,current_version,latest_version,status}` (v-normalized
+  server-side, SAME shape as the sing-box cores) AND removed the latest-fetch
+  from `get_system_info` (now returns `netshift_latest_version:"unknown"`). So
+  the NetShift card is now a TRUE peer of the cores: on-demand check writes
+  `managerChecks.netshift`, mount does NO network check.
+- SHELL METHOD: added `netshiftCheckUpdate()` to `methods/shell/index.ts` —
+  copy of `singBoxCheckUpdate` but args `['component_action','netshift',
+  'check_update']`, parsed by the EXISTING `parseComponentCheckUpdate`, returns
+  `NetShift.ComponentCheckUpdateResult`. SYNC path (fast call), timeout 600000.
+  It's a PROPERTY on `NetShiftShellMethods` (not a top-level export) → NO new
+  symbol in the baseclass.extend export block (verified byte-identical to HEAD).
+- runNetshiftCheck (manager/initController.ts): now MIRRORS runSingBoxCheck
+  exactly — call `netshiftCheckUpdate()`, `if(!parsed.success)` error toast +
+  return, `status=parsed.status??null`, `setCheckResult('netshift',status,
+  parsed.latest_version||'')`, `showToast(getCheckToastMessage(status),
+  'success')`, catch→error toast, finally→reset loading. STOPPED calling
+  `fetchSystemInfo()`+`resetCheckResult` as the "check".
+- cards.ts: `netshiftStatus(systemInfo, check)` now RETURNS `check.status`
+  (the on-demand result; null until checked → neutral). KEPT the dev guard
+  (`normalizeCompiledVersion(...)==='dev' → null`). REMOVED the
+  `installed===latest` string compare AND the systemInfo.netshift_latest_version
+  dependency. `netshiftCard` takes the check too; "Install %s" `latest` now
+  comes from `check.latest_version`. `getComponentCards` passes `checks.netshift`
+  to `netshiftCard`. The `check_netshift` kind NOW carries
+  `backendAction:'check_update'` (still a DISTINCT kind so the dispatcher routes
+  it to runNetshiftCheck, never to the sing-box check method).
+- DIAGNOSTIC: NO code change needed. `getNetshiftVersionRow.ts` already treats
+  `netshift_latest_version === 'unknown'` (and `'loading'`) as
+  `!hasActualVersion` → returns the plain neutral row (no Outdated/Latest tag).
+  Since task-029 makes the backend return "unknown", the row auto-degrades to
+  neutral. Mount's `fetchSystemInfo()` is now network-free (backend change), so
+  diagnostic entry triggers no GitHub call. Existing
+  getNetshiftVersionRow.test.ts (passes real versions) stays green unchanged.
+- TESTS: rewrote the 5 NetShift cases in manager/tests/cards.test.js to derive
+  from `managerChecks.netshift` instead of systemInfo: null-status→neutral+
+  check_update; check 'outdated'→self_update + Install <check.latest_version>;
+  'latest'→Latest badge; dev-build stays neutral even with a check 'outdated';
+  systemInfo latest mismatch is IGNORED. 472 tests pass (cards 19).
+- LOCALES: removing the `runNetshiftCheck` body ORPHANED `_('Latest version is
+  unknown')` (no longer referenced anywhere). Ran `node {extract-calls,
+  generate-pot,generate-po ru,distribute-locales}.js`. msgid delta = PURELY the
+  1 removed msgid (calls.json/pot/ru.po) + `#:` line-ref reshuffle + POT header
+  date. fe↔luci pairs byte-identical (diff -q). No new strings added (all toasts
+  reused existing msgids). generate-po reported 340/338 (2 stale retained).
+- main.js: +36/-26 runtime diff = exactly (new method block + netshiftStatus/
+  Card signature change + runNetshiftCheck rewrite). IDEMPOTENT (md5
+  9ce13d2… across 2 builds), banner + `return baseclass.extend({` intact,
+  export block byte-identical to HEAD. yarn classic 1.22.22; ran via
+  node_modules/.bin; yarn.lock unchanged, no .yarn/.yarnrc.yml.
+- FLAG (no browser in env): the neutral→checked card transition + toast were
+  verified by reasoning + the pure cards.test.js, NOT screenshotted.
+
+## task-032 — subscription_format_preference dropdown (Subscription tab)
+
+- Added a `form.ListValue` `subscription_format_preference` in section.js
+  (HAND-WRITTEN, NOT bundled) right AFTER `subscription_url` (~144-157),
+  modelled EXACTLY on `subscription_update_interval`: `.value('auto',_('Auto'))`
+  / `.value('xray',_('Xray JSON (Happ)'))` / `.value('singbox',_('Sing-box'))`,
+  `o.default='auto'`, same `depends({connection_type:'proxy',proxy_config_type:
+  'subscription'})`. NO explicit `rmempty` — like the interval field, LuCI
+  ListValue defaults `rmempty=true`, so selecting the default ('auto') does NOT
+  write a spurious UCI value (matches backend task-031 which treats empty/
+  unknown as auto). Single-literal `_()` description (no concat).
+- types.ts: added optional union `subscription_format_preference?: 'auto' |
+  'xray' | 'singbox';` to `ConfigProxySubscriptionSection` (after
+  subscription_url). Pure type-only → erased at build.
+- BACKEND CONTRACT (task-031, in working tree): UCI option name EXACTLY
+  `subscription_format_preference`, values auto/xray/singbox; netshift bin reads
+  it (`uci -q get …subscription_format_preference`, empty→auto). Confirmed via
+  grep before editing.
+- main.js: NO diff (section.js hand-written + type-only types.ts), like
+  task-023. Build still run to confirm; `git diff --stat main.js` empty.
+- locales: `node {extract-calls,generate-pot,generate-po ru,distribute-
+  locales}.js`. msgid delta PURELY ADDITIVE — 4 added (Auto / Subscription
+  format / Xray JSON (Happ) / the description), 0 removed; "Sing-box" REUSED an
+  existing msgid (so generate-po reported 339/342, only 3 truly-new beyond the
+  reused one). Filled 4 ru msgstr in SOURCE locales/netshift.ru.po (Auto→Авто,
+  Subscription format→Формат подписки, Xray JSON (Happ)→Xray JSON (Happ),
+  description translated) then distribute → po/ru + po/templates byte-identical
+  to source (diff -q). Only header msgstr empty. 5 catalog files touched.
+- yarn classic 1.22.22; ran gate via node_modules/.bin (prettier --write src /
+  eslint src --ext .ts,.tsx --max-warnings=0 / vitest 472 pass / tsup). format
+  diff on src = ONLY my 1 types.ts line (no churn). yarn.lock unchanged, no
+  .yarn/.yarnrc.yml. FLAG (no browser): dropdown rendering/auto-hide not
+  screenshotted — verified structurally.
+
+## task-040 — "Clear subscription cache" button in Diagnostics (async)
+
+- BACKEND CONTRACT (task-039, APPROVED): `component_action subscription
+  clear_cache` deletes all subscription caches + redownloads (restarts service
+  on change), driven via the EXISTING async job machinery
+  `component_action_async subscription clear_cache` → `{success,job_id,message}`,
+  poll `component_action_status <job>`. ACL already allows `/usr/bin/netshift`
+  exec — NO ACL change. Action strings are EXACTLY component='subscription',
+  action='clear_cache'.
+- SHELL METHOD: added `clearSubscriptionCache()` to `methods/shell/index.ts` as
+  a COPY of `netshiftSelfUpdate`'s start-then-poll shape BUT with the STRICT
+  (non-lenient) poll callback used by `singBoxComponentAction` install path
+  (return `null` on empty stdout — no binary swap here, so a parse/exec failure
+  IS terminal). args `['component_action_async','subscription','clear_cache']`,
+  REUSES the component-agnostic `pollSingBoxComponentAction` (NO new poll loop).
+  Returns `SingBoxComponentActionResult {success,version?,message?}`. It's a
+  PROPERTY on `NetShiftShellMethods` → NO new top-level export symbol (the
+  baseclass.extend export block is byte-identical to HEAD). NO new
+  `AvailableMethods` enum entry needed — the existing async actions pass
+  `'component_action_async'`/`'component_action_status'` + the component/action
+  as RAW string-literal args (not enum members), so I mirrored that exactly.
+- HANDLER: `handleClearSubscriptionCache` in diagnostic/initController.ts mirrors
+  `handleRestart`'s service-mutation idiom + globalCheck's toast idiom: set
+  `clearSubscriptionCache.loading=true` → `showToast(_('Clearing subscription
+  cache and re-downloading… this may take a minute'),'info')` → await the async
+  method → success→`showToast(...,'success')` else logger.error+error toast →
+  catch→logger.error+error toast → finally→`await fetchServicesInfo()` +
+  loading=false + `store.reset(['diagnosticsChecks'])`. NB: did NOT use
+  handleRestart's `setTimeout(...,5000)` — the async method ALREADY polls to
+  completion (service restart finished by the time it resolves), so refresh
+  immediately in finally. Wired into `renderDiagnosticAvailableActionsWidget`
+  (visible:true, disabled:atLeastOneServiceCommandLoading).
+- BUTTON: added `clearSubscriptionCache: ActionProps` to renderAvailableActions.ts
+  + an `insertIf(visible,[renderButton(...)])` block using `renderRotateCcwIcon24`
+  (already imported for Restart — rotate/refresh fits "clear+redownload"; the
+  icon set has NO trash icon). Label `_('Clear subscription cache')`. No custom
+  classNames (neutral btn, like globalCheck/viewLogs/showSingBoxConfig).
+- STORE: added `clearSubscriptionCache: { loading: boolean }` to
+  `diagnosticsActions` in store.service.ts type AND
+  `clearSubscriptionCache: { loading: false }` to initialDiagnosticStore in
+  diagnostic.store.ts (after showSingBoxConfig in both).
+- i18n: 4 NEW msgids (PURELY additive): 'Clear subscription cache', 'Clearing
+  subscription cache and re-downloading… this may take a minute', 'Failed to
+  clear subscription cache' (used in BOTH the shell method fallback + handler →
+  same msgid), 'Subscription cache cleared and re-downloaded'. NB the ellipsis is
+  a real `…` char (U+2026), not three dots — kept literal-consistent fe↔ru. Ran
+  `node {extract-calls,generate-pot,generate-po ru,distribute-locales}.js` (NOT
+  yarn). generate-po reported 343/346 (its count metric undercounts; there were
+  4 truly-new empty msgstr + the header). Filled ru in SOURCE
+  locales/netshift.ru.po (Очистить кеш подписок / Очистка кеша подписок и
+  повторная загрузка… это может занять минуту / Не удалось очистить кеш подписок
+  / Кеш подписок очищен и загружен заново), re-ran distribute → po/ru +
+  po/templates byte-identical to source (diff -q). Only header msgstr empty.
+- main.js: REAL +98/-1 runtime diff (new method block + handler + button +
+  widget wiring). IDEMPOTENT (md5 aa89dfc… across 2 builds), banner +
+  `return baseclass.extend({` intact, top-level export block byte-identical to
+  HEAD (no barrel leak — clearSubscriptionCache is a NetShiftShellMethods
+  property). Confirmed action args in main.js are exactly
+  `["component_action_async","subscription","clear_cache"]` + poll via
+  `component_action_status`.
+- NO new test: reused existing `pollSingBoxComponentAction` (already
+  table-tested); the method+handler is wiring (DOM/store untestable in node
+  env). vitest 472 pass unchanged.
+- yarn classic 1.22.22; ran gate via node_modules/.bin (prettier --check src
+  clean / eslint src --ext .ts,.tsx --max-warnings=0 / vitest 472 / tsup).
+  yarn.lock unchanged, no .yarn/.yarnrc.yml. Working tree also carried UNRELATED
+  task-039 backend changes (netshift bin, updater.sh, tests/entrypoint.sh) +
+  .opencode/agent edits — NOT mine. FLAG (no browser): button render + toast
+  sequence verified by reasoning + the gate, NOT screenshotted.
+
+## task-045 — universal subscription grouper (mode dropdown + prefix length)
+
+- REPLACED the single `subscription_group_by_countries` form.Flag (section.js
+  ~190-201) with TWO taboptions in the SAME `subscription` tab (mandatory —
+  tabbed section, a plain option() renders nothing):
+  (1) `form.ListValue subscription_group_mode` — values off/country/prefix
+  (`_("Off")`/`_("By country flag")`/`_("By name prefix")`), `o.default="off"`,
+  `o.rmempty=false`, depends `{connection_type:"proxy",proxy_config_type:
+  "subscription"}`; title `_("Subscription grouping")` + single-literal help.
+  (2) `form.Value subscription_group_prefix_len` — title `_("Prefix length")`,
+  `o.default="2"`, `o.datatype="and(uinteger,min(1))"`, `o.rmempty=false`,
+  depends ADDS `subscription_group_mode:"prefix"` (3-key object) so it shows
+  ONLY when mode=prefix. CBI cross-field depends within the same section/tab
+  works fine; a fully-hidden field is OK.
+- CROSS-LAYER CONTRACT (task-044 backend, DONE): UCI options EXACTLY
+  `subscription_group_mode` ∈ {off,country,prefix} default off, and
+  `subscription_group_prefix_len` positive-int string default 2 (meaningful
+  only when mode=prefix). Backend falls back to the LEGACY
+  `subscription_group_by_countries` boolean ONLY when the new option is ABSENT
+  → the UI writes only the NEW options; NO JS migration written.
+- types.ts: swapped `subscription_group_by_countries?: '0'|'1'` →
+  `subscription_group_mode?: 'off'|'country'|'prefix'` +
+  `subscription_group_prefix_len?: string`. Grepped src first — NOTHING in TS
+  reads the old key (only the type decl), so removing it is safe (backend reads
+  the legacy UCI key directly, not via UI). Pure type-only → erased at build.
+- main.js: ZERO diff (section.js hand-written + not bundled; types.ts type-only).
+  md5 unchanged across the build (aa89dfc5…). Confirmed via
+  `git diff --exit-code main.js`. This is the EXPECTED/correct outcome — a diff
+  there would mean an unexpected src change.
+- i18n: ran `node {extract-calls,generate-pot,generate-po ru,distribute-
+  locales}.js` (yarn classic 1.22.22, but used node to avoid corepack). msgid
+  delta = clean SWAP: removed 2 (`Group by countries` + its long description),
+  added 7 (Off / By country flag / By name prefix / Subscription grouping /
+  Prefix length / the grouping description / the prefix-length description).
+  Filled 7 RU msgstr in SOURCE locales/netshift.ru.po then re-ran distribute →
+  po/ru + po/templates byte-identical to source (diff -q both pairs). 0 empty
+  non-header msgstr after. RU: Off→Выключено, By country flag→По флагу страны,
+  By name prefix→По префиксу имени, Subscription grouping→Группировка подписки,
+  Prefix length→Длина префикса.
+- yarn ci GREEN: format no-diff, eslint --max-warnings=0, vitest 472 pass, tsup
+  build. yarn.lock unchanged, no .yarn/.yarnrc.yml. No new vitest (no new pure
+  TS logic — datatype validation is LuCI client-side).
+- PRIVACY: no subscription-identifying data (hosts/IPs/URLs/keys/node names) in
+  any code/comment/i18n/test/memory — generic "proxy name"/"country flag"
+  wording only.
+- FLAG (no browser in env): the rendered Subscription tab (dropdown +
+  conditional prefix-length field appearing only on mode=prefix, taboption
+  auto-hide) needs a HUMAN VISUAL CHECK before merge — verified structurally
+  only (taboption completeness, depends preserved).

docs/agent-rules/memory/packaging-ci-engineer.md

@@ -0,0 +1,116 @@
+# Memory — packaging-ci-engineer
+
+Durable packaging / CI / release knowledge. Read before working; append
+findings; keep under ~200 lines.
+
+## Packages
+
+- `netshift` (backend) and `luci-app-netshift` (UI; also yields
+  `luci-i18n-netshift-ru` via `LUCI_LANGUAGES=en ru`). Both `PKGARCH=all`.
+- `netshift/Makefile`: DEPENDS `+sing-box +curl +jq +kmod-nft-tproxy
+  +coreutils-base64 +bind-dig`; CONFLICTS `https-dns-proxy nextdns
+  luci-app-passwall luci-app-passwall2`; version
+  `PKG_VERSION = $(if $(NETSHIFT_VERSION),$(NETSHIFT_VERSION),0.$(date +%d%m%Y))`;
+  `prerm` removes `105 netshift` from `/etc/iproute2/rt_tables` and stops the
+  service; conffile `/etc/config/netshift`; stamps
+  `__COMPILED_VERSION_VARIABLE__` into `constants.sh` via sed (NO `|| true`, so a
+  missing file fails the build).
+- `luci-app-netshift/Makefile`: uses `luci.mk`, `LUCI_DEPENDS=+luci-base
+  +netshift`; stamps the same placeholder into `main.js` (WITH `|| true`, so a
+  missing main.js silently won't stamp). Asymmetric on purpose — note it.
+
+## Docker build images
+
+- `Dockerfile-ipk` FROM `itdoginfo/openwrt-sdk-ipk:24.10.6`;
+  `Dockerfile-apk` FROM `itdoginfo/openwrt-sdk-apk:25.12.3`.
+- KNOWN INCONSISTENCY (intentional, do NOT "fix" blindly): ipk Dockerfile
+  exports `NETSHIFT_VERSION="v${NETSHIFT_VERSION}"` (adds a `v`); apk sets it
+  raw (no `v`). Embedded version vs artifact filenames can differ across types.
+- `sdk/Dockerfile-sdk-*` are the base SDK images (feeds update + luci-base);
+  apk SDK requires running `./setup.sh` first.
+
+## Release flow (build.yml, on tag push)
+
+smoke-tests gate -> `preparation` derives version (`git describe --tags
+--exact-match`, fallback `0.<date>`) -> matrix build ipk+apk -> `docker cp`
+artifacts out of the container -> **ipk underscore->dash rename**
+(`sed 's/_/-/g'`) -> filter to the 3 packages -> GitHub Release.
+
+- The underscore->dash rename is LOAD-BEARING: `install.sh` scrapes the
+  latest-release API and matches assets by package-name prefix
+  (`netshift*`, `luci-app-netshift*`, `luci-i18n-netshift-ru*`). Breaking the
+  rename breaks install.
+
+## Smoke tests (tests/)
+
+- Image = OpenWRT 24.10.6 rootfs; source is **bind-mounted at runtime**
+  (`../netshift/files -> /netshift/files:ro`), so editing `netshift/files` is
+  picked up without rebuilding the image.
+- Needs `NET_ADMIN`/`NET_RAW`/`SYS_ADMIN` + `network_mode: host` for nft/dns;
+  nft tests FAIL (not skip) without caps.
+- `all` runs: deps syntax config helpers jq cm sb nft diagnostics subscription.
+- Add a test: `test_xyz()` (header/pass/fail/skip), add to `main()` `all)` list,
+  add `case` alias, update usage line + docker-compose comment. Keep the two
+  compose invocations (build.yml smoke vs openwrt-smoke-tests.yml) in sync.
+- Smoke baselines drift as tests get added: 81 passed (pre task-016) -> 84
+  passed after adding `test_nft_ipv6` (3 v6 assertions). Re-confirm the baseline
+  from the actual run, don't trust a stale number in a task spec.
+- `test_nft_ipv6` (alias `nftv6`, task-016): real-nft regression guard for the
+  B-01 IPv6 tproxy blocker. Builds the v6 tproxy rule from constants
+  (`SB_TPROXY_INBOUND_ADDRESS_V6`/`_PORT_V6`) in a throwaway `inet` table, lists
+  it back, and asserts it normalizes to bracketed `[::1]:1603` (positive) and
+  that no portless bare form (`tproxy ip6 to ::0`) appears (negative guard). The
+  unbracketed bug (`::1:1603`) is normalized by nft to a portless bare addr
+  (`[::1:1603]` / `[::0.1.22.3]` depending on nft version) — either way the
+  `\[::1\]:1603` grep fails, so the guard fires. Capability-gated: an
+  ip6-tproxy "not supported"/"operation not supported" kernel `skip`s; a
+  successful-but-wrong load `fail`s. SELF-PROVEN: temp scratch with unbracketed
+  rule -> 1 failed (guard caught it), reverted.
+- Smoke test capability gating pattern: capture `add_err="$(nft add ... 2>&1)"`
+  inside the `if`; on success run asserts, on failure `case "$add_err"` for
+  *not supported* substrings -> `skip`, else `fail`. Avoids false-fails on
+  kernels lacking a feature while still catching real bugs.
+- jq `index()` truthiness nit: `index("x") and index("y")` works (jq treats 0 as
+  truthy) but prefer `(index("x") != null) and (index("y") != null)` for intent
+  + 0-index robustness. Was at entrypoint.sh:688.
+- WSL2 kernel (6.6.x-microsoft-standard-WSL2) DOES support ip6 tproxy in the
+  smoke container, so the v6 assertions run (not skip) locally.
+- nft v6 buggy-form normalization is VERSION-DEPENDENT: the PROOF doc saw
+  `[::0.1.22.3]` (nftables v1.1.3), but the OpenWRT 24.10.6 smoke container
+  re-prints unbracketed `::1:1603` as `[::1:1603]` (no `]:` port sep). A
+  negative guard that greps a single literal (`\[::0`) is therefore a DEAD
+  assertion on the smoke env. ROBUST pattern: flag any `tproxy ip6 to [...]`
+  line that is NOT the correct `[::1]:1603` ->
+  `grep 'tproxy ip6 to \[' | grep -qv '\[::1\]:1603'`. Catches both
+  normalizations + future variants. Self-proved: unbracketed scratch -> BOTH
+  positive (`bracketed`) and negative (`no-bare`) guards FAIL (2 failed).
+
+## CI gates by path
+
+- `frontend-ci.yml`: PRs touching `fe-app-netshift/**` -> yarn install /
+  format(diff) / lint(--max-warnings=0) / test / build(diff).
+- `shellcheck.yml`: `install.sh` + `usr/bin/netshift` + `usr/lib/**.sh`,
+  severity error (Differential ShellCheck).
+- `openwrt-smoke-tests.yml`: `netshift/**`, `luci-app-netshift/**`, `tests/**`,
+  `install.sh`, Dockerfiles -> entrypoint `all`.
+- `.gitlab-ci.yml` declares a `test` stage but runs no tests — only builds and
+  deploys Docker on master. Quality is enforced by the AI review workflow + the
+  GitHub Actions above, not GitLab.
+
+## install.sh
+
+- POSIX; apk/opkg abstraction; podkop->netshift migration STOPS the old service
+  first (that restores dnsmasq keys + removes PodkopTable + `105 podkop`),
+  backs up config to `/etc/config/podkop.bak.pre-netshift`. OpenWRT 23.05
+  unsupported; needs >=15 MB on `/overlay`; NO uninstall path (removal lives in
+  package `prerm`). GitHub API rate-limit is a known fragility (wget path has no
+  guard).
+- `pkg_install` opkg branch uses `opkg install --force-downgrade
+  --force-reinstall "$pkg_file"` (task-042). Plain `opkg install` silently
+  no-op'd (rc=0) when re-run on a router with an older build: the legacy
+  v-prefixed version (`v0.8.6-r1`) sorts ABOVE the no-v release (`0.8.7-r1`) so
+  opkg "won't downgrade", and equal versions report "up to date". Both force
+  flags make opkg remove+reinstall (proven on OWRT 24.10.5 aarch64). apk branch
+  unchanged — `apk add --allow-untrusted` overwrites by default. This is the
+  install.sh twin of the task-041 `updates_pkg_install_file` updater.sh fix;
+  keep both upgrade paths (README script + in-app self-update) aligned.

docs/agent-rules/packaging.md

@@ -0,0 +1,204 @@
+# Agent Rules: Packaging, CI & Release
+
+Authoritative rules for building, testing, and releasing NetShift. Read this
+before touching anything below.
+
+**Scope:** `netshift/Makefile`, `luci-app-netshift/Makefile`,
+`Dockerfile-ipk`, `Dockerfile-apk`, `sdk/`, `tests/`, `.github/workflows/`,
+`install.sh`.
+
+---
+
+## 1. The packages
+
+Two source packages produce three published artifacts:
+
+- **`netshift`** — the backend (init script, UCI config, `/usr/bin/netshift`,
+  shell + jq libs under `/usr/lib/netshift`).
+- **`luci-app-netshift`** — the web UI. Its Makefile sets
+  `LUCI_LANGUAGES := en ru`, so the build also emits
+  **`luci-i18n-netshift-ru`** (the Russian translation) as a third package.
+
+Both packages are `PKGARCH := all` / `LUCI_PKGARCH := all` (architecture-
+independent).
+
+---
+
+## 2. `netshift/Makefile` (backend)
+
+- `DEPENDS := +sing-box +curl +jq +kmod-nft-tproxy +coreutils-base64
+  +bind-dig`
+- `CONFLICTS := https-dns-proxy nextdns luci-app-passwall luci-app-passwall2`
+- Version:
+  `PKG_VERSION := $(if $(NETSHIFT_VERSION),$(NETSHIFT_VERSION),0.$(shell date +%d%m%Y))`
+  — i.e. use `NETSHIFT_VERSION` when set, otherwise a date-stamped fallback.
+- `Package/netshift/prerm` removes the `105 netshift` line from
+  `/etc/iproute2/rt_tables` (only if present) and runs
+  `/etc/init.d/netshift stop`. **Service/system-state teardown lives in the
+  package `prerm`, not in `install.sh`.**
+- `Package/netshift/conffiles` declares `/etc/config/netshift` (preserved
+  across upgrades).
+- Version stamp: `Package/netshift/install` runs
+  `sed -i -e 's/__COMPILED_VERSION_VARIABLE__/$(PKG_VERSION)/g'
+  $(1)/usr/lib/netshift/constants.sh` — **no `|| true`** (this stamp must
+  succeed).
+
+`luci-app-netshift/Makefile` stamps the **same** placeholder into the bundled
+UI: `sed -i -e 's/__COMPILED_VERSION_VARIABLE__/$(PKG_VERSION)/g'
+.../view/netshift/main.js || true` — note the **`|| true`** here (UI stamp is
+best-effort). It uses the same `PKG_VERSION` expression and
+`LUCI_DEPENDS := +luci-base +netshift`.
+
+> If you ever rename `__COMPILED_VERSION_VARIABLE__`, update **both** Makefile
+> `sed`s and `fe-app-netshift/src/constants.ts` together. See
+> `frontend-luci.md` §6.
+
+---
+
+## 3. Docker build images
+
+- `Dockerfile-ipk` — `FROM itdoginfo/openwrt-sdk-ipk:24.10.6`.
+- `Dockerfile-apk` — `FROM itdoginfo/openwrt-sdk-apk:25.12.3`.
+- Both copy `./netshift` → `feeds/utilities/netshift` and
+  `./luci-app-netshift` → `feeds/luci/luci-app-netshift`, then run
+  `make defconfig` + `make package/<pkg>/compile`.
+- `sdk/Dockerfile-sdk-ipk` (`FROM openwrt/sdk:x86_64-v24.10.6`) and
+  `sdk/Dockerfile-sdk-apk` (`FROM openwrt/sdk:x86_64-v25.12.3`) are the **base
+  SDK images** that the `itdoginfo/openwrt-sdk-*` images derive from (feeds
+  updated, `luci-base` installed, feed dirs created; the apk one also runs
+  `./setup.sh`).
+
+### Version passing — symmetric, both RAW (no `v` prefix)
+
+Both release Dockerfiles now pass the version **raw**, with no `v` prefix:
+
+- `Dockerfile-ipk`: `ENV NETSHIFT_VERSION=${NETSHIFT_VERSION}` — **raw, no
+  `v`**.
+- `Dockerfile-apk`: `ENV NETSHIFT_VERSION=${NETSHIFT_VERSION}` — **raw, no
+  `v`**.
+
+> Historical note (task-028): `Dockerfile-ipk` used to **prepend `v`**
+> (`RUN export NETSHIFT_VERSION="v${NETSHIFT_VERSION}" && ...`) while the apk
+> file passed it raw. That asymmetry stamped a leading `v` into the ipk
+> package/control version and the runtime `constants.sh` `NETSHIFT_VERSION`,
+> so on OWRT24/ipk the installed version (`v0.8.6`) never matched the no-`v`
+> GitHub tag (`0.8.6`) and the LuCI UI falsely reported "outdated". The `v`
+> prepend was removed (ipk normalized to the apk shape) after verifying the
+> whole release flow (§4) and `install.sh` matching (§6): the `_`→`-` rename,
+> the 3-package filter, the i18n `-${VERSION}` naming, and the release tag all
+> derive from the git tag, and `install.sh` matches assets by **name prefix**
+> (the `v` lived in the version segment, not the name prefix) — so dropping it
+> does not affect either. Keep both Dockerfiles passing the version raw.
+>
+> Residual fragility (out of scope, on record): the UI version-equality check
+> in `fe-app-netshift` does **not** normalize a leading `v`. If a future
+> release is tagged **with** a `v` (e.g. `v0.8.7`), `netshift_latest_version`
+> would carry `v` while the installed (no-`v`) version would not, re-triggering
+> the false-"outdated" mismatch. **Tag releases WITHOUT a `v`** to keep
+> ipk / apk / tag all consistent.
+
+---
+
+## 4. Release flow (`.github/workflows/build.yml`)
+
+Triggered on **tag push** (`tags: ['*']`). Jobs:
+
+1. **`smoke-tests`** — builds and runs the OpenWRT rootfs smoke suite
+   (`docker compose -f tests/docker-compose.yml run --rm netshift-test all`).
+   This is a **gate**: `build` `needs` it.
+2. **`preparation`** — derives the version:
+   `git describe --tags --exact-match || "0.$(date +%d%m%Y)"`.
+3. **`build`** (matrix `ipk` + `apk`) — builds via
+   `Dockerfile-<type>`, passing `NETSHIFT_VERSION` from `preparation`; then
+   `docker create` + `docker cp` the built packages out of
+   `/builder/bin/packages/x86_64/{utilities,luci}/`.
+4. **ipk-only rename** — for `ipk`, every `*.ipk` filename is rewritten with
+   `sed 's/_/-/g'` (underscore → dash).
+5. **Filter** — copies exactly the **three** packages into `filtered-bin/`:
+   `luci-i18n-netshift-ru-*`, `netshift-*`, `luci-app-netshift-*` (the i18n
+   one is renamed to carry `${VERSION}`).
+6. **`release`** — downloads both matrices' artifacts and publishes a
+   **GitHub Release** (`softprops/action-gh-release`) named/tagged
+   `github.ref_name`.
+
+The underscore→dash rename (step 4) is **load-bearing**: `install.sh` matches
+release assets by **package-name prefix** (see §6), and the dashed names are
+what it expects.
+
+---
+
+## 5. Smoke tests (`tests/`)
+
+- Runs in an **OpenWRT 24.10.6 rootfs** container (`tests/Dockerfile`: pulls
+  the official `openwrt-24.10.6-x86-64-rootfs.tar.gz`, `opkg install`s
+  `sing-box curl jq coreutils-base64 bind-dig nftables`).
+- Source is **bind-mounted read-only**: `../netshift/files` →
+  `/netshift/files:ro` (see `tests/docker-compose.yml`). The container has no
+  copy of the scripts — it tests the live source tree.
+- Requires kernel caps **`NET_ADMIN` + `NET_RAW` + `SYS_ADMIN`** and
+  `network_mode: host` (for real nft / DNS operations).
+- `entrypoint.sh` `main()` dispatches by category. The `all` target runs, in
+  order: `test_deps test_syntax test_config test_helpers test_jq_helpers
+  test_config_manager test_sing_box_config test_nft test_diagnostics
+  test_subscription`. The usage line lists:
+  `all deps syntax config helpers jq cm sb nft diagnostics subscription`.
+
+### How to ADD a smoke test
+
+1. Write a `test_xyz()` function using the existing helpers:
+   `header`, `pass`, `fail`, `skip` (they drive the `PASS`/`FAIL`/`SKIP`
+   counters and `summary`). For sub-shells, emit `name:OK` / `name:FAIL` /
+   `name:SKIP` lines and let the `case` parser pick them up (see
+   `test_helpers` / `test_subscription`).
+2. Add it to the `all)` list in `main()`.
+3. Add a short **case alias** (e.g. `xyz) test_xyz ;;`).
+4. Update the **usage line** in `main()` (the `Available: ...` echo).
+5. Update the **`docker-compose.yml` comment** that documents test names.
+
+---
+
+## 6. CI gates by path
+
+| Workflow | Triggers (paths) | What it does |
+|---|---|---|
+| `frontend-ci.yml` | `fe-app-netshift/**` (PR) | `yarn install --frozen-lockfile`, `yarn format` (fail on diff), `yarn lint --max-warnings=0`, `yarn test --run`, `yarn build` (fail on diff). See `frontend-luci.md`. |
+| `shellcheck.yml` | `install.sh`, `netshift/files/usr/bin/**`, `netshift/files/usr/lib/**` (push/PR to `main`/`rc/**`) | Differential ShellCheck, `severity: error`, include-paths `netshift/files/usr/bin/netshift`, `netshift/files/usr/lib/**.sh`, `install.sh`. |
+| `openwrt-smoke-tests.yml` | `netshift/**`, `luci-app-netshift/**`, `tests/**`, `install.sh`, `Dockerfile-ipk`, `Dockerfile-apk`, `.dockerignore` (push/PR to `main`/`rc/**`) | Builds the smoke image and runs `netshift-test all`. |
+
+> **Keep the two smoke invocations in sync.** `build.yml`'s `smoke-tests` job
+> runs the suite **only on tag push**; PR/branch coverage comes from the
+> separate `openwrt-smoke-tests.yml`. Both call
+> `docker compose -f tests/docker-compose.yml ... netshift-test all` — if you
+> change one compose command (image name, target, flags), change the other.
+
+---
+
+## 7. `install.sh`
+
+- **POSIX `sh`** (BusyBox `ash` compatible); shellcheck-gated at `error`.
+- **Package-manager abstraction:** detects `apk` (`PKG_IS_APK=1`) vs `opkg`
+  and wraps install/remove/update/list (`pkg_install`, `pkg_remove`,
+  `pkg_is_installed`, etc.). apk install uses `--allow-untrusted`; opkg remove
+  uses `--force-depends`.
+- **podkop → netshift migration** (`migrate_from_podkop`, triggered by
+  `podkop_is_installed` since podkop never reached 0.8.0): **stop the old
+  service first** (`/etc/init.d/podkop stop` then `disable`) so dnsmasq/nft
+  teardown happens, **back up config** to
+  `/etc/config/podkop.bak.pre-netshift`, copy config to
+  `/etc/config/netshift`, remove the original `/etc/config/podkop`, clean the
+  old `105 podkop` rt_tables line and podkop cron entries, and remove the old
+  `luci-i18n-podkop*` / `luci-app-podkop` / `podkop` packages.
+- **OpenWRT 23.05 is unsupported** (since NetShift 0.8.0): `check_system`
+  exits if `DISTRIB_RELEASE` major == `23`.
+- **Space requirement:** needs **≥ 15 MB** free in `/overlay`
+  (`REQUIRED_SPACE=15360` KB).
+- **Asset matching:** scrapes the latest-release API
+  (`https://api.github.com/repos/yandexru45/netshift/releases/latest`),
+  greps `.apk`/`.ipk` URLs, then installs by **package-name prefix**
+  (loops `for pkg in netshift luci-app-netshift`, plus
+  `luci-i18n-netshift-ru*`). This is why the ipk underscore→dash rename in
+  `build.yml` (§4) is load-bearing.
+- **NO uninstall path.** `install.sh` only installs/migrates; removal lives in
+  the package `prerm` (see §2). Do not add an uninstaller here.
+- **Known fragility:** GitHub API **rate limiting** — the script detects
+  `API rate limit` and exits with a "repeat in five minutes" message.

docs/agent-rules/project-core.md

@@ -0,0 +1,112 @@
+# NetShift — Project Core Rules (AUTHORITATIVE)
+
+> Single source of truth for AI agents working anywhere in this repo. Read this before touching code. Every rule below is grounded in the actual source — do not invent values.
+
+## 1. Project identity
+
+NetShift is an OpenWRT traffic router built on top of [sing-box](https://github.com/SagerNet/sing-box): it selectively routes chosen domains/subnets through a tunnel and sends everything else directly. It is a fork of [itdoginfo/podkop](https://github.com/itdoginfo/podkop), rebranded to NetShift at version `0.8.0`. The project is **beta** (expect breaking changes). License: **GPL-2.0-or-later** (`LICENSE`), with a **separate trademark policy** — the NetShift name and logos are protected; see `TRADEMARK.md`. Code is GPL-licensed; the brand is not.
+
+Hard requirements (target device):
+- OpenWRT **24.10+**
+- `sing-box >= 1.12.0` (`SB_REQUIRED_VERSION` in `constants.sh`)
+- `jq >= 1.7.1` (`JQ_REQUIRED_VERSION`)
+- `coreutils-base64 >= 9.7` (`COREUTILS_BASE64_REQUIRED_VERSION`)
+- `>= 25 MB` free space (16 MB flash devices unsupported)
+
+## 2. The three packages and strict dependency direction
+
+Layers point in ONE direction. **No layer skips another.**
+
+```
+luci-app-netshift  (TS/LuCI UI, hand-written views + generated main.js)
+        │  consumes the generated main.js produced from
+        ▼
+fe-app-netshift    (TypeScript source, built with tsup)
+        │  UI talks ONLY to the backend, never to sing-box/nft/dnsmasq directly
+        ▼
+netshift backend   via LuCI fs.exec of /usr/bin/netshift and /etc/init.d/netshift (ACL-gated)
+        │
+        ▼
+sing-box / nftables / dnsmasq
+```
+
+- `luci-app-netshift` — LuCI web UI. Its `htdocs/.../view/netshift/main.js` is **generated** from `fe-app-netshift`. Hand-written views live alongside it.
+- `fe-app-netshift` — the TypeScript source of `main.js` (fetchers, methods, services, tabs). Edit UI logic **here**, not in the generated bundle.
+- `netshift` — the backend package (POSIX ash + jq): CLI dispatcher `/usr/bin/netshift`, procd init `/etc/init.d/netshift`, libraries in `/usr/lib/netshift/`, UCI config `/etc/config/netshift`.
+
+The UI never reimplements backend logic; it invokes backend commands. The backend never depends on the UI.
+
+## 3. Runtime contract (sacred — do not change casually)
+
+These values are wired across `constants.sh`, `nft.sh`, the CLI, and the generated sing-box config. Changing one without the rest breaks the whole chain.
+
+| Concept | Value | Source constant |
+|---|---|---|
+| tproxy inbound | `127.0.0.1:1602` | `SB_TPROXY_INBOUND_ADDRESS` / `SB_TPROXY_INBOUND_PORT` |
+| DNS inbound | `127.0.0.42:53` | `SB_DNS_INBOUND_ADDRESS` / `SB_DNS_INBOUND_PORT` |
+| Service mixed inbound | `127.0.0.1:4534` | `SB_SERVICE_MIXED_INBOUND_*` |
+| Clash API controller | `:9090` | `SB_CLASH_API_CONTROLLER_PORT` |
+| FakeIP range | `198.18.0.0/15` | `SB_FAKEIP_INET4_RANGE` |
+| nft FakeIP mark | `0x00100000` | `NFT_FAKEIP_MARK` |
+| nft outbound mark | `0x00200000` | `NFT_OUTBOUND_MARK` |
+| nft table | `NetShiftTable` (family `inet`) | `NFT_TABLE_NAME` |
+| routing table | `105 netshift` | `RT_TABLE_NAME` + `/etc/iproute2/rt_tables` |
+| state dir | `/etc/netshift` | `NETSHIFT_STATE_DIR` |
+| sing-box config | `/etc/sing-box/config.json` (UCI `settings.config_path`) | UCI |
+
+These ports, marks, addresses, the nft table name, and the routing table id are **sacred**. They are referenced in `nft.sh` rules, `route_table_rule_mark`, dnsmasq integration (`127.0.0.42`), diagnostics (`check_sing_box`, `check_nft_rules`, `check_dns_available`), and the generated config. Treat any change to them as a system-level change (§4).
+
+## 4. System-level change rule
+
+A change is **system-level** if it touches any of:
+- nft rules / sets / chains, routing rules or tables, fwmarks
+- sing-box config schema or generation
+- dnsmasq integration (server `127.0.0.42`, `noresolv`, `cachesize`, backup/restore)
+- UCI schema (`/etc/config/netshift`)
+- ports / marks / tags in `constants.sh`
+- packaging (`Makefile`, install, conffiles, dependencies)
+- the payment-free subscription flow (download → validate → cache → generate outbounds)
+
+For system-level changes you MUST verify the **whole chain**, not a single file:
+
+```
+UCI (config_get) → config generation (sing_box_*) → sing-box -c <file> check → nft rules → running service
+```
+
+Validate by running the smoke tests and, where relevant, confirming the generated config still passes `sing-box check` and the nft table/routing still install (see `start_main` in `/usr/bin/netshift`).
+
+## 5. Repo-wide conventions
+
+- **LF line endings everywhere.** `.gitattributes` enforces `* text=auto eol=lf`. Never introduce CRLF.
+- **No magic strings.** All ports, IPs, marks, tags, paths, versions, and service lists live in `netshift/files/usr/lib/constants.sh`, grouped as `## Common`, `## nft`, `## sing-box`, `## Lists`. New constants go there.
+- Community service list is `COMMUNITY_SERVICES` in `constants.sh`; the UI and `validate_service` both depend on it.
+
+## 6. Mandatory quality gates (CI a contributor must pass)
+
+These gate every PR. Use the matching skills.
+
+1. **ShellCheck** (`.github/workflows/shellcheck.yml`) — severity `error`, over:
+   - `install.sh`
+   - `netshift/files/usr/bin/netshift`
+   - `netshift/files/usr/lib/**.sh`
+   - Skill: `shellcheck`.
+2. **OpenWRT smoke tests** (`.github/workflows/openwrt-smoke-tests.yml`) — runs `tests/entrypoint.sh` in an OpenWRT rootfs via `tests/docker-compose.yml` (`run --rm netshift-test all`).
+   - Skill: `smoke-tests`.
+3. **Frontend `yarn ci`** (in `fe-app-netshift`) — defined as:
+   `yarn format && yarn lint --max-warnings=0 && yarn test --run && yarn build`
+   i.e. prettier (no diff), ESLint with `--max-warnings=0`, vitest, and a build that must produce no diff in the committed `main.js`.
+   - Skill: `frontend-ci`.
+
+## 7. Contribution gating
+
+- `CODEOWNERS = @yandexru45`.
+- PRs are accepted **only after coordination with the authors via Telegram** (per README; see `t.me/netshift_chat`).
+- **Agents NEVER auto-commit.** A human reviews and commits manually. Do not run `git commit`, `git push`, amend, or open PRs unless the human explicitly asks.
+
+## 8. Anti-patterns (do NOT do these)
+
+- Hardcoding ports / IPs / marks / paths instead of using `constants.sh`.
+- Duplicating routing/marking logic instead of reusing `nft.sh` / `route_table_rule_mark` / `create_nft_rules`.
+- Editing the generated `main.js` by hand — edit `fe-app-netshift` TS source and rebuild.
+- Reimplementing backend logic in the UI — the UI must call `/usr/bin/netshift` / `/etc/init.d/netshift`.
+- Changing a sacred runtime value in one place while leaving the rest of the chain stale.

docs/tasks/TEMPLATE-review.md

@@ -0,0 +1,55 @@
+# Code Review — <Title> (task-NNN)
+
+> Authored by `code-reviewer`. File name: `<task-name>-review-001.md`
+> (use `-002`, `-003`, ... or append a "Re-review" section for later rounds).
+
+**Review ID:** review-001
+**Date:** <YYYY-MM-DD>
+**Scope:** <uncommitted working-tree changes | branch X vs base>
+**Reviewer:** code-reviewer agent
+
+**Files reviewed:**
+- `path/...`
+
+---
+
+## Summary
+
+<Brief, neutral assessment of what the change does and its overall quality. No
+flattery.>
+
+## Critical Issues
+
+> Must fix before merge. Architecture violations, broken runtime contract, jq
+> regex on OpenWRT, missing `exit 1` after `fatal`, hand-edited `main.js`, traffic
+> leaks, etc.
+
+### [C1] <Issue title>
+- **File:** `path/to/file` (line X)
+- **Problem:** <what is wrong and why it matters>
+- **Recommendation:** <concrete fix>
+
+## Significant Issues
+
+### [S1] <Issue title>
+- **File:** `path/to/file` (line X)
+- **Problem:** ...
+- **Recommendation:** ...
+
+## Minor Observations
+
+- **[M1]** `path/to/file`: <short note>
+
+## Test Coverage
+
+<Were the required tests/gates added and run? Backend config-gen/subscription →
+smoke test? New pure frontend logic → vitest? Was the relevant gate green? If
+frontend tests were explicitly not required, say so and state what was verified
+by reasoning + build.>
+
+## Verdict
+
+**APPROVED** | **APPROVED WITH CONDITIONS** | **REQUIRES CHANGES**
+
+<One sentence overall. If conditional, list "Conditions before merge" by issue
+ID. If changes required, list "Required before merge" by issue ID.>

docs/tasks/TEMPLATE-task.md

@@ -0,0 +1,62 @@
+# Task: <imperative title>
+
+> Authored by `architect-orchestrator`. One self-contained spec per subtask.
+> File name: `task-NNN-<kebab-slug>.md`.
+
+## Context
+
+<Narrative: what the user wants and why. Link any relevant prior tasks.>
+
+### Root cause / research basis (authoritative)
+
+<What investigation established. Cite `file:line`. State facts, not guesses.>
+
+### Operator decisions (already made — do NOT re-ask)
+
+- <Design choice the operator already approved, e.g. "Variant 2".>
+
+## Goal
+
+<One paragraph describing the desired end state.>
+
+## Scope
+
+- Layer(s): <backend ash/jq | TS/LuCI frontend | packaging/CI>.
+- Files to modify (exact paths):
+  - `path/one`
+  - `path/two`
+- Do NOT touch: <explicit out-of-scope files/areas>.
+
+## Requirements
+
+### 1. <numbered requirement>
+
+<Be specific. Include exact target `file:line` and fenced code blocks of the
+intended change where helpful.>
+
+### 2. <numbered requirement>
+
+## Architecture Notes
+
+- Applicable rules: <e.g. `docs/agent-rules/backend-shell.md` (no jq regex;
+  `fatal` needs `exit 1`)>.
+- Runtime-contract impact: <none | which ports/marks/paths and the whole-chain
+  verification required>.
+- Single-source-of-truth constraints: <constants.sh; barrel→main.*; etc.>.
+
+## Tests Required
+
+- Backend: <which `test_*` to add/extend in `tests/entrypoint.sh`, or "covered
+  by existing X">. Run the `shellcheck` and `smoke-tests` skills.
+- Frontend: <vitest `.test.js` to add, or "verify by reasoning + build">. Run
+  the `frontend-ci` skill; ensure `main.js` rebuild leaves no git diff.
+- Packaging: <smoke tests; verify ipk + apk paths>.
+
+## Definition of Done
+
+- [ ] All requirements implemented in scope; nothing out-of-scope changed.
+- [ ] Relevant gate(s) pass (shellcheck / smoke-tests / yarn ci).
+- [ ] (Frontend) `main.js` regenerated; `git diff` clean after build.
+- [ ] Runtime contract intact (or whole chain verified if changed).
+- [ ] New user-facing strings wrapped in `_()` (frontend).
+- [ ] `code-reviewer` verdict: APPROVED or APPROVED WITH CONDITIONS.

fe-app-netshift/.env.example

@@ -0,0 +1,16 @@
+SFTP_HOST=192.168.160.129
+SFTP_PORT=22
+SFTP_USER=root
+SFTP_PASS=
+
+# you can use key if needed
+# SFTP_PRIVATE_KEY=~/.ssh/id_rsa
+
+LOCAL_DIR_FE=../luci-app-netshift/htdocs/luci-static/resources/view/netshift
+REMOTE_DIR_FE=/www/luci-static/resources/view/netshift
+
+LOCAL_DIR_BIN=../netshift/files/usr/bin/
+REMOTE_DIR_BIN=/usr/bin/
+
+LOCAL_DIR_LIB=../netshift/files/usr/lib/
+REMOTE_DIR_LIB=/usr/lib/netshift/

fe-app-netshift/distribute-locales.js

@@ -6,7 +6,7 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 const sourceDir = path.resolve(__dirname, 'locales');
-const targetRoot = path.resolve(__dirname, '../luci-app-podkop/po');
+const targetRoot = path.resolve(__dirname, '../luci-app-netshift/po');
 
 async function main() {
     const files = await fs.readdir(sourceDir);
@@ -14,17 +14,17 @@ async function main() {
     for (const file of files) {
         const filePath = path.join(sourceDir, file);
 
-        if (file === 'podkop.pot') {
-            const potTarget = path.join(targetRoot, 'templates', 'podkop.pot');
+        if (file === 'netshift.pot') {
+            const potTarget = path.join(targetRoot, 'templates', 'netshift.pot');
             await fs.mkdir(path.dirname(potTarget), { recursive: true });
             await fs.copyFile(filePath, potTarget);
             console.log(`✅ Copied POT: ${filePath} → ${potTarget}`);
         }
 
-        const match = file.match(/^podkop\.([a-zA-Z_]+)\.po$/);
+        const match = file.match(/^netshift\.([a-zA-Z_]+)\.po$/);
         if (match) {
             const lang = match[1];
-            const poTarget = path.join(targetRoot, lang, 'podkop.po');
+            const poTarget = path.join(targetRoot, lang, 'netshift.po');
             await fs.mkdir(path.dirname(poTarget), { recursive: true });
             await fs.copyFile(filePath, poTarget);
             console.log(`✅ Copied ${lang.toUpperCase()}: ${filePath} → ${poTarget}`);

fe-app-netshift/extract-calls.js

@@ -19,12 +19,12 @@ function stripIllegalReturn(code) {
 
 const files = await glob([
     'src/**/*.ts',
-    '../luci-app-podkop/htdocs/luci-static/resources/view/podkop/**/*.js',
+    '../luci-app-netshift/htdocs/luci-static/resources/view/netshift/**/*.js',
 ], {
     ignore: [
         '**/*.test.ts',
         '**/main.js',
-        '../luci-app-podkop/htdocs/luci-static/resources/view/podkop/main.js',
+        '../luci-app-netshift/htdocs/luci-static/resources/view/netshift/main.js',
     ],
     absolute: true,
 });

fe-app-netshift/generate-po.js

@@ -8,7 +8,7 @@ if (!lang) {
 }
 
 const callsPath = 'locales/calls.json';
-const poPath = `locales/podkop.${lang}.po`;
+const poPath = `locales/netshift.${lang}.po`;
 
 function getGitUser() {
     try {
@@ -36,14 +36,14 @@ function getHeader(lang) {
         : 'nplurals=2; plural=(n != 1);';
 
     return [
-        `# ${lang.toUpperCase()} translations for PODKOP package.`,
-        `# Copyright (C) ${now.getFullYear()} THE PODKOP'S COPYRIGHT HOLDER`,
-        `# This file is distributed under the same license as the PODKOP package.`,
+        `# ${lang.toUpperCase()} translations for NETSHIFT package.`,
+        `# Copyright (C) ${now.getFullYear()} THE NETSHIFT'S COPYRIGHT HOLDER`,
+        `# This file is distributed under the same license as the NETSHIFT package.`,
         `# ${translator}, ${now.getFullYear()}.`,
         '#',
         'msgid ""',
         'msgstr ""',
-        `"Project-Id-Version: PODKOP\\n"`,
+        `"Project-Id-Version: NETSHIFT\\n"`,
         `"Report-Msgid-Bugs-To: \\n"`,
         `"POT-Creation-Date: ${date} ${time}${tzOffset}\\n"`,
         `"PO-Revision-Date: ${date} ${time}${tzOffset}\\n"`,

fe-app-netshift/generate-pot.js

@@ -2,8 +2,8 @@ import fs from 'fs/promises';
 import { execSync } from 'child_process';
 
 const inputFile = 'locales/calls.json';
-const outputFile = 'locales/podkop.pot';
-const projectId = 'PODKOP';
+const outputFile = 'locales/netshift.pot';
+const projectId = 'NETSHIFT';
 
 function getGitUser() {
     const name = execSync('git config user.name').toString().trim();

fe-app-netshift/locales/netshift.ru.po

@@ -1,15 +1,15 @@
-# RU translations for PODKOP package.
-# Copyright (C) 2026 THE PODKOP'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the PODKOP package.
-# divocatt, 2026.
+# RU translations for NETSHIFT package.
+# Copyright (C) 2026 THE NETSHIFT'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the NETSHIFT package.
+# yandexru45, 2026.
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: PODKOP\n"
+"Project-Id-Version: NETSHIFT\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-01-14 20:21+0200\n"
-"PO-Revision-Date: 2026-01-14 20:21+0200\n"
-"Last-Translator: divocatt\n"
+"POT-Creation-Date: 2026-06-12 08:52+0300\n"
+"PO-Revision-Date: 2026-06-12 08:52+0300\n"
+"Last-Translator: yandexru45\n"
 "Language-Team: none\n"
 "Language: ru\n"
 "MIME-Version: 1.0\n"
@@ -32,9 +32,24 @@ msgstr "✘ Остановлен"
 msgid "Active Connections"
 msgstr "Активные соединения"
 
+msgid "Add one or more subscription URLs to fetch proxy configurations from. All feeds are downloaded and merged."
+msgstr "Добавьте один или несколько URL подписок для получения конфигураций прокси. Все источники загружаются и объединяются."
+
+msgid "Add your own domains: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip"
+msgstr "Добавьте свои домены: выберите Динамический список (по одному в строке) или Текстовый список (свободный ввод), либо Отключено, чтобы пропустить"
+
+msgid "Add your own subnets or IPs: choose Dynamic List (one per row) or Text List (free-form), or Disabled to skip"
+msgstr "Добавьте свои подсети или IP: выберите Динамический список (по одному в строке) или Текстовый список (свободный ввод), либо Отключено, чтобы пропустить"
+
 msgid "Additional marking rules found"
 msgstr "Найдены дополнительные правила маркировки"
 
+msgid "Advanced"
+msgstr "Дополнительно"
+
+msgid "Allow insecure TLS for subscription fetch"
+msgstr "Разрешить небезопасный TLS при загрузке подписки"
+
 msgid "Allows access to YACD from the WAN. Make sure to open the appropriate port in your firewall."
 msgstr "Обеспечивает доступ к YACD из WAN. Убедитесь, что в брандмауэре открыт соответствующий порт."
 
@@ -47,9 +62,18 @@ msgstr "Необходимо указать хотя бы один действ
 msgid "At least one valid subnet or IP must be specified. Comments-only content is not allowed."
 msgstr "Необходимо указать хотя бы одну действительную подсеть или IP. Только комментарии недопустимы."
 
+msgid "Auto"
+msgstr "Авто"
+
 msgid "Available actions"
 msgstr "Доступные действия"
 
+msgid "Block direct connections to known public DoH servers (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex) so apps cannot bypass router DNS filtering."
+msgstr "Блокировать прямые подключения к известным публичным DoH-серверам (Cloudflare, Google, Quad9, OpenDNS, AdGuard, Yandex), чтобы приложения не могли обойти DNS-фильтрацию роутера."
+
+msgid "Block DoH Servers"
+msgstr "Блокировать DoH-серверы"
+
 msgid "Bootsrap DNS"
 msgstr "Bootstrap DNS"
 
@@ -62,6 +86,12 @@ msgstr "Браузер не использует FakeIP"
 msgid "Browser is using FakeIP correctly"
 msgstr "Браузер использует FakeIP"
 
+msgid "By country flag"
+msgstr "По флагу страны"
+
+msgid "By name prefix"
+msgstr "По префиксу имени"
+
 msgid "Cache File Path"
 msgstr "Путь к файлу кэша"
 
@@ -71,6 +101,9 @@ msgstr "Путь к файлу кэша не может быть пустым"
 msgid "Cannot receive checks result"
 msgstr "Не удалось получить результаты проверки"
 
+msgid "Check update"
+msgstr "Проверить обновление"
+
 msgid "Checking, please wait"
 msgstr "Проверяем, пожалуйста подождите"
 
@@ -86,45 +119,75 @@ msgstr "Проверки пройдены"
 msgid "CIDR must be between 0 and 32"
 msgstr "CIDR должен быть между 0 и 32"
 
+msgid "Clear subscription cache"
+msgstr "Очистить кеш подписок"
+
+msgid "Clearing subscription cache and re-downloading… this may take a minute"
+msgstr "Очистка кеша подписок и повторная загрузка… это может занять минуту"
+
 msgid "Close"
 msgstr "Закрыть"
 
 msgid "Community Lists"
 msgstr "Списки сообщества"
 
+msgid "Component Manager"
+msgstr "Менеджер компонентов"
+
 msgid "Config File Path"
 msgstr "Путь к файлу конфигурации"
 
-msgid "Configuration for Podkop service"
-msgstr "Настройки сервиса Podkop"
+msgid "Configuration for NetShift service"
+msgstr "Конфигурация службы NetShift"
 
 msgid "Configuration Type"
 msgstr "Тип конфигурации"
 
+msgid "Connection"
+msgstr "Подключение"
+
 msgid "Connection Type"
 msgstr "Тип подключения"
 
+msgid "Connection type, transport and DNS resolver for this section"
+msgstr "Тип подключения, транспорт и DNS-резолвер для этой секции"
+
 msgid "Connection URL"
 msgstr "URL подключения"
 
 msgid "Copy"
 msgstr "Копировать"
 
+msgid "Core switch failed"
+msgstr "Не удалось переключить ядро"
+
+msgid "Core switch timed out"
+msgstr "Истекло время ожидания переключения ядра"
+
 msgid "Currently unavailable"
 msgstr "Временно недоступно"
 
+msgid "Custom domains"
+msgstr "Свои домены"
+
+msgid "Custom subnets"
+msgstr "Свои подсети"
+
 msgid "Dashboard"
 msgstr "Дашборд"
 
 msgid "Dashboard currently unavailable"
 msgstr "Дашборд сейчас недоступен"
 
-msgid "Delay in milliseconds before reloading podkop after interface UP"
-msgstr "Задержка в миллисекундах перед перезагрузкой podkop после поднятия интерфейса"
+msgid "Delay in milliseconds before reloading NetShift after interface UP"
+msgstr "Задержка в миллисекундах перед перезагрузкой NetShift после поднятия интерфейса"
 
 msgid "Delay value cannot be empty"
 msgstr "Значение задержки не может быть пустым"
 
+msgid "Dev"
+msgstr "Dev"
+
 msgid "DHCP has DNS server"
 msgstr "DHCP содержит DNS сервер"
 
@@ -143,9 +206,18 @@ msgstr "Отключить QUIC протокол для улучшения со
 msgid "Disabled"
 msgstr "Отключено"
 
+msgid "Disables TLS certificate verification when downloading the subscription."
+msgstr "Отключает проверку TLS-сертификата при загрузке подписки."
+
+msgid "DNS"
+msgstr "DNS"
+
 msgid "DNS on router"
 msgstr "DNS на роутере"
 
+msgid "DNS outbound section"
+msgstr "Секция outbound для DNS"
+
 msgid "DNS over HTTPS (DoH)"
 msgstr "DNS через HTTPS (DoH)"
 
@@ -167,6 +239,9 @@ msgstr "Адрес DNS-сервера не может быть пустым"
 msgid "Do not panic, everything can be fixed, just..."
 msgstr "Не паникуйте, всё можно исправить, просто..."
 
+msgid "Domain and subnet lists that decide which traffic uses this section"
+msgstr "Списки доменов и подсетей, определяющие, какой трафик идёт через эту секцию"
+
 msgid "Domain Resolver"
 msgstr "Резолвер доменов"
 
@@ -188,6 +263,9 @@ msgstr "Скачивать списки через выбранную секци
 msgid "Downloading all lists via specific Proxy/VPN"
 msgstr "Загрузка всех списков через указанный прокси/VPN"
 
+msgid "Drop subscription servers whose name contains any of these keywords (case-insensitive)."
+msgstr "Исключать серверы подписки, имя которых содержит любое из этих ключевых слов (без учёта регистра)."
+
 msgid "Dynamic List"
 msgstr "Динамический список"
 
@@ -197,6 +275,15 @@ msgstr "Включить автостарт"
 msgid "Enable built-in DNS resolver for domains handled by this section"
 msgstr "Включить встроенный DNS-резолвер для доменов, обрабатываемых в этом разделе"
 
+msgid "Enable DNS resolve to get real IP when routing"
+msgstr "Разрешать домены в реальные IP-адреса перед маршрутизацией в outbound"
+
+msgid "Enable IPv6 Support"
+msgstr "Включить поддержку IPv6"
+
+msgid "Enable IPv6 TProxy routing, IPv6 DNS inbound, and IPv6 FakeIP support."
+msgstr "Включить маршрутизацию TProxy по IPv6, входящий DNS по IPv6 и поддержку FakeIP для IPv6."
+
 msgid "Enable Mixed Proxy"
 msgstr "Включить смешанный прокси"
 
@@ -227,21 +314,45 @@ msgstr "Введите подсети в нотации CIDR (например,
 msgid "Every 1 minute"
 msgstr "Каждую минуту"
 
+msgid "Every 12 hours"
+msgstr "Каждые 12 часов"
+
+msgid "Every 3 hours"
+msgstr "Каждые 3 часа"
+
 msgid "Every 3 minutes"
 msgstr "Каждые 3 минуты"
 
+msgid "Every 30 minutes"
+msgstr "Каждые 30 минут"
+
 msgid "Every 30 seconds"
 msgstr "Каждые 30 секунд"
 
 msgid "Every 5 minutes"
 msgstr "Каждые 5 минут"
 
+msgid "Every 6 hours"
+msgstr "Каждые 6 часов"
+
+msgid "Every day"
+msgstr "Каждый день"
+
+msgid "Every hour"
+msgstr "Каждый час"
+
 msgid "Exclude NTP"
 msgstr "Исключить NTP"
 
 msgid "Exclude NTP protocol traffic from the tunnel to prevent it from being routed through the proxy or VPN"
 msgstr "Исключите трафик протокола NTP из туннеля, чтобы предотвратить его маршрутизацию через прокси-сервер или VPN."
 
+msgid "Exclude servers by keyword"
+msgstr "Исключать серверы по ключевому слову"
+
+msgid "Failed to clear subscription cache"
+msgstr "Не удалось очистить кеш подписок"
+
 msgid "Failed to copy!"
 msgstr "Не удалось скопировать!"
 
@@ -260,9 +371,27 @@ msgstr "Получить глобальную проверку"
 msgid "Global check"
 msgstr "Глобальная проверка"
 
+msgid "Global Proxy"
+msgstr "Глобальный прокси"
+
+msgid "Group subscription proxies into URLTest groups. 'By country flag' uses the flag emoji at the start of each name; 'By name prefix' groups by the first N characters."
+msgstr "Группировать прокси из подписки в группы URLTest. «По флагу страны» использует эмодзи флага в начале каждого имени; «По префиксу имени» группирует по первым N символам."
+
+msgid "How often to automatically update the subscription"
+msgstr "Как часто автоматически обновлять подписку"
+
 msgid "HTTP error"
 msgstr "Ошибка HTTP"
 
+msgid "Include servers by keyword"
+msgstr "Включать серверы по ключевому слову"
+
+msgid "Install %s"
+msgstr "Установить %s"
+
+msgid "Installed version is newer than release"
+msgstr "Установленная версия новее релиза"
+
 msgid "Interface Monitoring"
 msgstr "Мониторинг интерфейса"
 
@@ -272,14 +401,14 @@ msgstr "Задержка при мониторинге интерфейсов"
 msgid "Interface monitoring for Bad WAN"
 msgstr "Мониторинг интерфейса для Bad WAN"
 
-msgid "Invalid DNS server format. Examples: 8.8.8.8 or dns.example.com or dns.example.com/nicedns for DoH"
-msgstr "Неверный формат DNS-сервера. Примеры: 8.8.8.8, dns.example.com или dns.example.com/nicedns для DoH"
+msgid "Invalid DNS server format. Examples: 8.8.8.8, [::1], dns.example.com, or dns.example.com/dns-query for DoH"
+msgstr "Неверный формат DNS-сервера. Примеры: 8.8.8.8, [::1], dns.example.com или dns.example.com/dns-query для DoH"
 
 msgid "Invalid domain address"
 msgstr "Неверный домен"
 
-msgid "Invalid format. Use X.X.X.X or X.X.X.X/Y"
-msgstr "Неверный формат. Используйте X.X.X.X или X.X.X.X/Y"
+msgid "Invalid format. Use X.X.X.X/Y or IPv6/Y"
+msgstr "Неверный формат. Используйте X.X.X.X/Y или IPv6/Y"
 
 msgid "Invalid HY2 URL: insecure must be 0 or 1"
 msgstr "Неверный URL Hysteria2: параметр insecure должен быть 0 или 1"
@@ -323,6 +452,9 @@ msgstr "Неверный URL Hysteria2: неподдерживаемый тип
 msgid "Invalid IP address"
 msgstr "Неверный IP-адрес"
 
+msgid "Invalid IPv6 address"
+msgstr "Неверный IPv6-адрес"
+
 msgid "Invalid JSON format"
 msgstr "Неверный формат JSON"
 
@@ -401,18 +533,54 @@ msgstr "Неверный формат URL"
 msgid "Invalid VLESS URL: parsing failed"
 msgstr "Неверный URL VLESS: ошибка разбора"
 
+msgid "Invalid VMess URL: invalid port"
+msgstr "Неверный URL VMess: недопустимый порт"
+
+msgid "Invalid VMess URL: malformed base64"
+msgstr "Неверный URL VMess: некорректный base64"
+
+msgid "Invalid VMess URL: malformed JSON"
+msgstr "Неверный URL VMess: некорректный JSON"
+
+msgid "Invalid VMess URL: missing address"
+msgstr "Неверный URL VMess: отсутствует адрес"
+
+msgid "Invalid VMess URL: missing id"
+msgstr "Неверный URL VMess: отсутствует id"
+
+msgid "Invalid VMess URL: must not contain spaces"
+msgstr "Неверный URL VMess: не должен содержать пробелы"
+
+msgid "Invalid VMess URL: must start with vmess://"
+msgstr "Неверный URL VMess: должен начинаться с vmess://"
+
 msgid "IP address 0.0.0.0 is not allowed"
 msgstr "IP-адрес 0.0.0.0 не допускается"
 
+msgid "IPv6 CIDR must be between 0 and 128"
+msgstr "IPv6 CIDR должен быть от 0 до 128"
+
 msgid "Issues detected"
 msgstr "Обнаружены проблемы"
 
+msgid "Keep only subscription servers whose name contains at least one of these keywords (case-insensitive). Leave empty to keep all."
+msgstr "Оставлять только серверы подписки, имя которых содержит хотя бы одно из этих ключевых слов (без учёта регистра). Оставьте пустым, чтобы оставить все."
+
 msgid "Latest"
 msgstr "Последняя"
 
+msgid "Latest version is installed"
+msgstr "Установлена последняя версия"
+
 msgid "List Update Frequency"
 msgstr "Частота обновления списков"
 
+msgid "List update schedule, download routing, and routing exclusions"
+msgstr "Расписание обновления списков, маршрутизация загрузок и исключения из маршрутизации"
+
+msgid "Lists & Updates"
+msgstr "Списки и обновления"
+
 msgid "Local Domain Lists"
 msgstr "Локальные списки доменов"
 
@@ -425,9 +593,15 @@ msgstr "Уровень логов"
 msgid "Main DNS"
 msgstr "Основной DNS"
 
+msgid "Main DNS via outbound"
+msgstr "Основной DNS через outbound"
+
 msgid "Memory Usage"
 msgstr "Использование памяти"
 
+msgid "Mixed proxy and DNS resolution tuning"
+msgstr "Настройка смешанного прокси и разрешения DNS"
+
 msgid "Mixed Proxy Port"
 msgstr "Порт смешанного прокси"
 
@@ -437,6 +611,21 @@ msgstr "Наблюдаемые интерфейсы"
 msgid "Must be a number in the range of 50 - 1000"
 msgstr "Должно быть числом от 50 до 1000"
 
+msgid "NetShift"
+msgstr "NetShift"
+
+msgid "NetShift Settings"
+msgstr "Настройки NetShift"
+
+msgid "NetShift updated, version:"
+msgstr "NetShift обновлён, версия:"
+
+msgid "NetShift will not modify your DHCP configuration"
+msgstr "NetShift не будет изменять вашу конфигурацию DHCP"
+
+msgid "Network"
+msgstr "Сеть"
+
 msgid "Network Interface"
 msgstr "Сетевой интерфейс"
 
@@ -446,12 +635,24 @@ msgstr "Другие правила маркировки не найдены"
 msgid "Not implement yet"
 msgstr "Ещё не реализовано"
 
+msgid "Not installed"
+msgstr "Не установлено"
+
 msgid "Not responding"
 msgstr "Не отвечает"
 
 msgid "Not running"
 msgstr "Не запущено"
 
+msgid "Number of leading characters of each proxy name to group by."
+msgstr "Количество начальных символов имени каждого прокси для группировки."
+
+msgid "Off"
+msgstr "Выключено"
+
+msgid "Only one section can be global at a time."
+msgstr "Только одна секция может быть глобальной одновременно."
+
 msgid "Operation timed out"
 msgstr "Время ожидания истекло"
 
@@ -482,14 +683,11 @@ msgstr "Путь должен заканчиваться на cache.db"
 msgid "Pending"
 msgstr "Ожидает запуска"
 
-msgid "Podkop"
-msgstr "Podkop"
+msgid "Prefix length"
+msgstr "Длина префикса"
 
-msgid "Podkop Settings"
-msgstr "Настройки podkop"
-
-msgid "Podkop will not modify your DHCP configuration"
-msgstr "Podkop не будет изменять вашу конфигурацию DHCP."
+msgid "Protocol toggles, file paths and logging. Block DoH only after switching upstream DNS to UDP or DoT."
+msgstr "Переключатели протоколов, пути к файлам и журналирование. Включайте блокировку DoH только после переключения вышестоящего DNS на UDP или DoT."
 
 msgid "Proxy Configuration URL"
 msgstr "URL конфигурации прокси"
@@ -509,8 +707,17 @@ msgstr "Внешние списки доменов"
 msgid "Remote Subnet Lists"
 msgstr "Внешние списки подсетей"
 
-msgid "Restart podkop"
-msgstr "Перезапустить Podkop"
+msgid "Resolve real IP for routing"
+msgstr "Разрешение реальных IP-адресов"
+
+msgid "Restart NetShift"
+msgstr "Перезапустить NetShift"
+
+msgid "Route all unmatched traffic through this section's outbound."
+msgstr "Направлять весь несовпавший трафик через outbound этой секции."
+
+msgid "Route main DNS through proxy/VPN"
+msgstr "Основной DNS через прокси/VPN"
 
 msgid "Router DNS is not routed through sing-box"
 msgstr "DNS роутера не проходит через sing-box"
@@ -518,6 +725,9 @@ msgstr "DNS роутера не проходит через sing-box"
 msgid "Router DNS is routed through sing-box"
 msgstr "DNS роутера проходит через sing-box"
 
+msgid "Routing"
+msgstr "Маршрутизация"
+
 msgid "Routing Excluded IPs"
 msgstr "Исключённые из маршрутизации IP-адреса"
 
@@ -527,9 +737,6 @@ msgstr "Счётчики правил mangle"
 msgid "Rules mangle exist"
 msgstr "Правила mangle существуют"
 
-msgid "Rules mangle output counters"
-msgstr "Счётчики правил mangle output"
-
 msgid "Rules mangle output exist"
 msgstr "Правила mangle output существуют"
 
@@ -581,12 +788,6 @@ msgstr "Выберите путь к файлу конфигурации sing-bo
 msgid "Select the DNS protocol type for the domain resolver"
 msgstr "Выберите тип протокола DNS для резолвера доменов"
 
-msgid "Select the list type for adding custom domains"
-msgstr "Выберите тип списка для добавления пользовательских доменов"
-
-msgid "Select the list type for adding custom subnets"
-msgstr "Выберите тип списка для добавления пользовательских подсетей"
-
 msgid "Select the log level for sing-box"
 msgstr "Выберите уровень логов для sing-box"
 
@@ -605,6 +806,12 @@ msgstr "Selector"
 msgid "Selector Proxy Links"
 msgstr "Ссылки прокси для Selector"
 
+msgid "Self-update failed"
+msgstr "Не удалось обновить"
+
+msgid "Send upstream DNS queries through a proxy/VPN outbound instead of directly. Bootstrap DNS always stays direct."
+msgstr "Отправлять запросы к основному DNS через outbound прокси/VPN вместо прямого подключения. Bootstrap DNS всегда остаётся прямым."
+
 msgid "Services info"
 msgstr "Информация о сервисах"
 
@@ -620,6 +827,9 @@ msgstr "Sing-box"
 msgid "Sing-box autostart disabled"
 msgstr "Автостарт sing-box отключен"
 
+msgid "Sing-box core changed, version:"
+msgstr "Ядро sing-box изменено, версия:"
+
 msgid "Sing-box installed"
 msgstr "Sing-box установлен"
 
@@ -635,6 +845,9 @@ msgstr "Сервис sing-box существует"
 msgid "Sing-box version is compatible (newer than 1.12.4)"
 msgstr "Версия Sing-box совместима (новее 1.12.4)"
 
+msgid "Source and output interfaces, and Bad WAN interface monitoring"
+msgstr "Входящий и исходящий интерфейсы, а также мониторинг интерфейсов Bad WAN"
+
 msgid "Source Network Interface"
 msgstr "Сетевой интерфейс источника"
 
@@ -653,15 +866,45 @@ msgstr "Укажите URL-адреса для загрузки и исполь
 msgid "Specify the path to the list file located on the router filesystem"
 msgstr "Укажите путь к файлу списка, расположенному в файловой системе маршрутизатора."
 
-msgid "Start podkop"
-msgstr "Запустить podkop"
+msgid "Start NetShift"
+msgstr "Запустить NetShift"
 
-msgid "Stop podkop"
-msgstr "Остановить podkop"
+msgid "Stop NetShift"
+msgstr "Остановить NetShift"
+
+msgid "Subscription"
+msgstr "Подписка"
+
+msgid "Subscription cache cleared and re-downloaded"
+msgstr "Кеш подписок очищен и загружен заново"
+
+msgid "Subscription feeds, server filters and URLTest tuning"
+msgstr "Источники подписок, фильтры серверов и настройка URLTest"
+
+msgid "Subscription format"
+msgstr "Формат подписки"
+
+msgid "Subscription grouping"
+msgstr "Группировка подписки"
+
+msgid "Subscription Update Interval"
+msgstr "Интервал обновления подписки"
+
+msgid "Subscription URLs"
+msgstr "URL подписок"
 
 msgid "Successfully copied!"
 msgstr "Успешно скопировано!"
 
+msgid "Switch to extended"
+msgstr "Переключить на extended"
+
+msgid "Switch to stable"
+msgstr "Переключить на stable"
+
+msgid "Switching sing-box core, this may take a few minutes…"
+msgstr "Переключение ядра sing-box, это может занять несколько минут…"
+
 msgid "System info"
 msgstr "Системная информация"
 
@@ -689,6 +932,9 @@ msgstr "Максимально допустимая разница во врем
 msgid "The URL used to test server connectivity"
 msgstr "URL-адрес, используемый для проверки подключения к серверу"
 
+msgid "This is a security trade-off: an attacker could intercept the fetch."
+msgstr "Это компромисс в безопасности: злоумышленник может перехватить загрузку."
+
 msgid "Time in seconds for DNS record caching (default: 60)"
 msgstr "Время в секундах для кэширования DNS записей (по умолчанию: 60)"
 
@@ -719,11 +965,26 @@ msgstr "неизвестно"
 msgid "Unknown error"
 msgstr "Неизвестная ошибка"
 
+msgid "Update"
+msgstr "Обновить"
+
+msgid "Update is available"
+msgstr "Доступно обновление"
+
+msgid "Update NetShift"
+msgstr "Обновить NetShift"
+
+msgid "Updating NetShift, this may take a few minutes; the page will reload…"
+msgstr "Обновление NetShift, это может занять несколько минут; страница перезагрузится…"
+
 msgid "Uplink"
 msgstr "Исходящий"
 
-msgid "URL must start with vless://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
-msgstr "URL должен начинаться с vless://, ss://, trojan://, socks4/5:// или hysteria2:// hy2://"
+msgid "Upstream and bootstrap DNS resolvers, and optional DNS-over-proxy"
+msgstr "Вышестоящий и начальный (bootstrap) DNS-резолверы и опциональный DNS через прокси"
+
+msgid "URL must start with vless://, vmess://, ss://, trojan://, socks4/5://, or hysteria2://hy2://"
+msgstr "URL должен начинаться с vless://, vmess://, ss://, trojan://, socks4/5:// или hysteria2:// hy2://"
 
 msgid "URL must use one of the following protocols:"
 msgstr "URL должен использовать один из следующих протоколов:"
@@ -743,8 +1004,14 @@ msgstr "URLTest ссылка для проверки"
 msgid "URLTest Tolerance"
 msgstr "URLTest допустимое отклонение"
 
-msgid "User Domain List Type"
-msgstr "Тип пользовательского списка доменов"
+msgid "Use only for IP-host panels that serve an invalid or self-signed certificate."
+msgstr "Используйте только для панелей с IP-адресом, у которых недействительный или самоподписанный сертификат."
+
+msgid "Use this only when the router has working IPv6 connectivity."
+msgstr "Используйте это только если на роутере есть рабочее подключение по IPv6."
+
+msgid "Use with Exclusion sections to route specific domains directly."
+msgstr "Используйте вместе с секциями исключений для прямой маршрутизации определённых доменов."
 
 msgid "User Domains"
 msgstr "Пользовательские домены"
@@ -752,9 +1019,6 @@ msgstr "Пользовательские домены"
 msgid "User Domains List"
 msgstr "Список пользовательских доменов"
 
-msgid "User Subnet List Type"
-msgstr "Тип пользовательского списка подсетей"
-
 msgid "User Subnets"
 msgstr "Пользовательские подсети"
 
@@ -767,14 +1031,17 @@ msgstr "Валидно"
 msgid "Validation errors:"
 msgstr "Ошибки валидации:"
 
+msgid "Version"
+msgstr "Версия"
+
 msgid "View logs"
 msgstr "Посмотреть логи"
 
 msgid "Visit Wiki"
 msgstr "Перейти в wiki"
 
-msgid "vless://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links"
-msgstr ""
+msgid "vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2:// links"
+msgstr "ссылки vless://, vmess://, ss://, trojan://, socks4/5://, hy2/hysteria2://"
 
 msgid "Warning: %s cannot be used together with %s. Previous selections have been removed."
 msgstr "Предупреждение: %s нельзя использовать вместе с %s. Предыдущие варианты были удалены."
@@ -782,8 +1049,23 @@ msgstr "Предупреждение: %s нельзя использовать
 msgid "Warning: Russia inside can only be used with %s. %s already in Russia inside and have been removed from selection."
 msgstr "Предупреждение: Russia inside может быть использован только с %s. %s уже есть в Russia inside и будет удален из выбранных."
 
+msgid "When enabled, traffic not matching any other section's lists will go through this proxy."
+msgstr "Когда включено, трафик, не совпадающий со списками других секций, будет идти через этот прокси."
+
+msgid "Which proxy/VPN section carries the DNS. Leave unset to use the first configured outbound."
+msgstr "Какая секция прокси/VPN обслуживает DNS. Оставьте пустым, чтобы использовать первый настроенный outbound."
+
+msgid "Which subscription format (client) to fetch first. Auto uses the default order. Choose Xray JSON (Happ) when your panel only exposes some nodes (e.g. xhttp) under a Happ-like client, or Sing-box to prefer the sing-box format."
+msgstr "Какой формат подписки (клиент) запрашивать первым. «Авто» использует порядок по умолчанию. Выберите «Xray JSON (Happ)», если ваша панель отдаёт некоторые узлы (например, xhttp) только под клиентом вроде Happ, или «Sing-box», чтобы предпочесть формат sing-box."
+
+msgid "Xray JSON (Happ)"
+msgstr "Xray JSON (Happ)"
+
 msgid "YACD Secret Key"
 msgstr "Секретный ключ YACD"
 
+msgid "YACD web dashboard access and remote-access protection"
+msgstr "Доступ к веб-панели YACD и защита удалённого доступа"
+
 msgid "You can select Output Network Interface, by default autodetect"
 msgstr "Вы можете выбрать выходной сетевой интерфейс, по умолчанию он определяется автоматически."

fe-app-netshift/package.json

@@ -1,11 +1,11 @@
 {
-  "name": "fe-app-podkop",
+  "name": "fe-app-netshift",
   "version": "1.0.0",
   "license": "MIT",
   "type": "module",
   "scripts": {
     "format": "prettier --write src",
-    "format:js": "prettier --write ../luci-app-podkop/htdocs/luci-static/resources/view/podkop",
+    "format:js": "prettier --write ../luci-app-netshift/htdocs/luci-static/resources/view/netshift",
     "lint": "eslint src --ext .ts,.tsx",
     "lint:fix": "eslint src --ext .ts,.tsx --fix",
     "build": "tsup src/main.ts",

fe-app-netshift/src/constants.ts

@@ -4,7 +4,7 @@ export const STATUS_COLORS = {
   WARNING: '#ff9800',
 };
 
-export const PODKOP_LUCI_APP_VERSION = '__COMPILED_VERSION_VARIABLE__';
+export const NETSHIFT_LUCI_APP_VERSION = '__COMPILED_VERSION_VARIABLE__';
 export const FAKEIP_CHECK_DOMAIN = 'fakeip.podkop.fyi';
 export const IP_CHECK_DOMAIN = 'ip.podkop.fyi';
 
@@ -83,6 +83,9 @@ export const DNS_SERVER_OPTIONS = {
   'unfiltered.adguard-dns.com':
     'unfiltered.adguard-dns.com (AdGuard Unfiltered)',
   'family.adguard-dns.com': 'family.adguard-dns.com (AdGuard Family)',
+  '2001:4860:4860::8888': '2001:4860:4860::8888 (Google IPv6)',
+  '2606:4700:4700::1111': '2606:4700:4700::1111 (Cloudflare IPv6)',
+  '2620:fe::fe': '2620:fe::fe (Quad9 IPv6)',
 };
 export const BOOTSTRAP_DNS_SERVER_OPTIONS = {
   '77.88.8.8': '77.88.8.8 (Yandex DNS)',
@@ -93,6 +96,8 @@ export const BOOTSTRAP_DNS_SERVER_OPTIONS = {
   '8.8.4.4': '8.8.4.4 (Google DNS)',
   '9.9.9.9': '9.9.9.9 (Quad9 DNS)',
   '9.9.9.11': '9.9.9.11 (Quad9 DNS)',
+  '2001:4860:4860::8888': '2001:4860:4860::8888 (Google DNS IPv6)',
+  '2606:4700:4700::1111': '2606:4700:4700::1111 (Cloudflare DNS IPv6)',
 };
 
 export const DIAGNOSTICS_UPDATE_INTERVAL = 10000; // 10 seconds

fe-app-netshift/src/helpers/removeVersionPrefix.ts

@@ -0,0 +1,3 @@
+export function removeVersionPrefix(version: string) {
+  return version.replace(/^v/, '');
+}

fe-app-netshift/src/helpers/showToast.ts

@@ -1,6 +1,6 @@
 export function showToast(
   message: string,
-  type: 'success' | 'error',
+  type: 'success' | 'error' | 'warning' | 'info',
   duration: number = 3000,
 ) {
   let container = document.querySelector('.toast-container');

fe-app-netshift/src/helpers/withTimeout.ts

@@ -1,4 +1,4 @@
-import { logger } from '../podkop';
+import { logger } from '../netshift';
 
 export async function withTimeout<T>(
   promise: Promise<T>,