Sync repo copy with the actual script on download: adds create_full_list /
create_content_index functions and requires/filelist processing. Pass `--`
to sed so filenames starting with `-` aren't parsed as options (a stray
`--force` file appeared in epm-requires/epm-filelist and broke the run).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Build dependency hints are out of scope here — packaging tasks go to
alt-packaging-agents.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Move memory files from ~/.claude/projects/... into the repo so other
machines/users get them on clone. Credentials stay out of git in
.claude/secrets/ (ignored by the existing .claude/* rule).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Add 7 skills: dns, pve, mail, eterban, vpn, network, sip
- Add reference docs: dhash.ru, epm, nfs
- Remove redundant agents (dns-manager, pve-manager)
- Move SPICE docs from vz/pve-spice-connect.md into pve skill
- Add skills table to CLAUDE.md
- Update .gitignore to track only .claude/skills/ and .claude/docs/
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mv preserves source file group (root), not sgid directory group.
Explicit chgrp+chmod ensures routeweb can always read resolved files.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- _flatten: sorted output for consistent ordering
- JSON lists: sorted(set()) per list
- Ensures no duplicates in text, mikrotik, and json formats
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

When requesting group=gre,egw,zapret the same IP can appear in multiple
lists. _flatten() now uses a set to remove duplicates while preserving order.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

route-update.sh: after writing resolved, run mapcidr -a and -aa
in background to generate resolved.agg1 and resolved.agg2

route-web-api.py: read pre-aggregated files from cache instead of
calling mapcidr on each request. Instant response for aggregate=1|2.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dnsx resolves CNAME chains natively and runs 50 threads in parallel.
Whatsapp (2097 CNAME domains): 74 minutes → 0.06 seconds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

route-web-api.py:
- /api/export endpoint: filter by group/list/proto, text/mikrotik/json formats
- /api/export/groups: list available groups with counts
- aggregate=1 (exact) / aggregate=2 (approx via mapcidr)
- Multiple groups support (group=gre,egw,zapret)
- Resolved data from /var/lib/etersoft-router/state/ with in-memory cache (60s TTL)
- Speed check: don't early-stop before checking first 2 gateways

route-update.sh:
- umask 022 for readable state files
- chmod g+r on resolved after write
- Per-list duration tracking (duration file in state)

functions:
- CNAME fallback: parallel dig (xargs -P 20) instead of sequential

route-stats-metrics.sh:
- New: collect route list counts and push to InfluxDB
- Per-list duration metrics
- Route-update total duration

dns/chat-dns.sh:
- Rewritten for split-view subzone chat.eterfund.ru via SSH to ns1

dns/telemt-metrics.sh:
- Added upstream_success/fail/slow and handshake_timeout metrics
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Round-robin DNS management for MTProto proxy failover:
on  — set all three A records (91.232.225.3, 95.47.184.52, 217.12.37.55)
off — keep only primary IP
Uses nsupdate -l (local) for running on ns1.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

detect_volatile_domains() was resolving every domain via dig on each run,
which took 30+ minutes for large lists (e.g. 2097 whatsapp domains).

Cache domains confirmed as non-volatile (stable TTL, same IPs from
different resolvers) and skip them on subsequent runs. Cache expires
after 7 days and is ignored with --force.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Tool to read, parse, modify and write ZFS vdev labels.
Allows recovering a detached disk back into a mirror
by copying labels between devices.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- route-health.sh: query net_response from InfluxDB for SOCKS5 proxy
  status, include per-gateway proxy field and global proxy map in
  health.json
- route-web-api.py: add proxy-dot indicators in egw/ogw/routers
  sidebar sections, updated from health.json proxy data
- Telegraf net_response on telegraf CT (682) checks port 1080 on all
  gateway IPs every 30s
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Check TCP connectivity to port 1080 on each gateway IP.
Result is included as "proxy":true/false in health.json
for web UI display.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Instead of showing separate egw and egw.v6 groups in health JSON,
merge v6 gateways into the corresponding v4 group for cleaner
web UI display.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

warp gateway uses Cloudflare speedtest instead of iperf3 (no iperf3
server on Cloudflare side). Skip iperf3 check for warp tag to avoid
false dead status.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Process route groups in parallel using background subshells.
Each group runs independently with its own pref base computed
from the group's alphabetical index. Table allocation in
/etc/iproute2/rt_tables is protected by flock to prevent races.

On local-test with 3 groups: 163% CPU utilization confirms
parallel execution.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

route-update.sh:
- After loading routes, detect and remove routes via gateways that were
  commented out or removed from the gateway file. Previously only stale
  destination IPs were cleaned up, leaving routes via disabled gateways.

route-health.sh:
- For tunnel gateways (ikev2/gre/openconnect/ovpn/xray/amneziawg/cloak/warp),
  require VPN status and iperf3 data — missing data means dead, not skip.
- Use base (v4) tag for VPN/iperf3 lookups on .v6 gateways (they share tunnel).
- Reduce ping query window from 3m to 1m (matches Telegraf 30s interval).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Remove old parallel gateway check (check_site, _check_one, _find_assets,
_check_throttle) and dead JS SSE handlers (gateway, throttle events).
Both SSE and JSON paths now use the same run_speed_test with identical
gateway order and early-exit logic.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

All check operations use curl to /dev/null with -w for results,
no temp files or shared state between requests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Browser fires two parallel requests:
- POST /api/check (SSE) — streams gateway availability live
- POST /api/resolve (JSON) — returns IPs, routes, whois independently

No SSE dependency between columns — each loads on its own.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Send initial "check" event immediately (just domain name), then
resolve IPs, find routes, fetch whois and gateway checks all run
in parallel. Each result streams via its own SSE event:
- resolve: IPs + routes
- gateway: per-gateway availability
- whois: domain registration info
- throttle: slow download detection

Eliminates all delay before first visible response.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Split check_site into phases for SSE mode:
1. IPs + routes sent instantly (check event)
2. Each gateway result streamed as it completes (gateway event)
3. Whois streamed when ready (whois event)
4. Throttle results streamed per gateway (throttle event)

This eliminates the 10-18s spinner delay before any results appear.
JSON mode (/api/check without Accept: text/event-stream) unchanged.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Reorder check results: gateways first, then IPs, routes, whois.
Change gateway layout from horizontal badges to vertical list.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When file URL is given, speed test replaces gateway HTTP checks as the
availability indicator — one unified section instead of two separate lists.

Support dual response format: SSE for browsers (Accept: text/event-stream),
JSON for curl/scripts (default). This prevents breaking existing API clients.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace batch speed check with Server-Sent Events. Gateway check
results appear immediately, then speed test results stream in
one by one as each gateway is tested. Colors applied after all
tests complete.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Test gateways one by one in order: igw, dgw, gre.hetzner,
gre.beget, ikev2.hetzner, warp. Stop after two consecutive
successful downloads. Reduces total check time from ~2min to ~15s.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Mark gateway as SLOW (instead of OK) in accessibility section when
file download speed is less than 10% of the fastest gateway.
Also show speed in the gateway status line.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When a file URL is entered (e.g. https://xpra.org/src/xpra-6.4.3.tar.xz),
download it via curl through each gateway proxy in parallel and display
speed comparison. Highlights slow gateways (<10% of max) in red and
fast ones (>50% of max) in green.

Also add dark mode CSS support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove check_passwords/ (john the ripper scripts) and nx/get-list.pl
(contains hardcoded DB credentials).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Kernels 6.x output "I/O error, dev sde, sector ..." without the
blk_update_request/end_request prefix. Add this format to the grep
pattern so --list works on modern kernels.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Remove "direct" gateway, use socks5:// proxies for all checks
- Add IPv6 proxy addresses for dual-stack gateway checking
- beget nodes have no IPv6 (proxy_v6=None), correctly shown as NOIP
- Add egw/dgw/igw to sidebar under Маршрутизаторы section
- Sort all sidebar items alphabetically within sections
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>