@pzy560117/codex-harness 0.1.3 → 0.1.5

package/package-source/docs/codex-harness-engineering/templates/package-assets/skills/claude-openrouter-clash-debug/SKILL.md

@@ -1,100 +1,100 @@
----
-name: claude-openrouter-clash-debug
-description: Diagnose Claude Code failures on Windows when OpenRouter, Clash Verge, and a local Hysteria/SOCKS node disagree about the real egress region or auth path. Use when Claude Code returns `403 This model is not available in your region`, when `ANTHROPIC_BASE_URL` points to OpenRouter, when a node label says Japan but external services still see Hong Kong or another region, or when `openrouter.ai`, `anthropic.com`, and `claude.ai` need explicit Clash routing and validation.
----
-
-# Claude OpenRouter Clash Debug
-
-## Overview
-
-Use this skill to debug the full Claude Code -> OpenRouter -> Clash Verge -> local Hysteria route on this Windows machine.
-Prefer the bundled scripts for repeated checks; use the reference playbook when you need the exact files, commands, and the known-good 2026-05-03 fix.
-
-## Quick Start
-
-1. Run the diagnostic script:
-
-```powershell
-powershell -ExecutionPolicy Bypass -File .\.agents\skills\claude-openrouter-clash-debug\scripts\diagnose-openrouter-route.ps1
-```
-
-2. If the output says `openrouter.ai` is missing an explicit Clash rule, add it:
-
-```powershell
-powershell -ExecutionPolicy Bypass -File .\.agents\skills\claude-openrouter-clash-debug\scripts\ensure-openrouter-rule.ps1 -GroupName AI-GitHub-HY2 -RestartMihomo
-```
-
-3. Re-run the diagnostic script.
-
-4. Confirm Claude Code itself works:
-
-```powershell
-claude -p "Reply with ok." --output-format json
-```
-
-## Workflow
-
-### 1. Validate Claude/OpenRouter auth mapping
-
-- Read `C:\Users\pzy666\.claude\settings.json`.
-- When `ANTHROPIC_BASE_URL` is `https://openrouter.ai/api`, the OpenRouter key should live in `ANTHROPIC_AUTH_TOKEN`.
-- Blank `ANTHROPIC_API_KEY` for this path. If the key remains there, Claude Code often stays on the wrong auth mode.
-- Check `claude auth status` before changing network rules.
-
-### 2. Compare the three egress layers
-
-- Direct or TUN egress: what the machine exposes by default.
-- Clash mixed-port egress: what flows through `127.0.0.1:7897`.
-- Dedicated Hysteria SOCKS egress: what the JP node at `127.0.0.1:1082` exposes.
-- If the dedicated SOCKS node is `JP` but the mixed port or default path is `HK`, the server is fine and Clash routing is the likely problem.
-
-### 3. Inspect Clash group and rule selection
-
-- Find the group used by `openai.com` or the intended AI traffic.
-- In this machine's verified case, `openai.com` routes through `AI-GitHub-HY2`.
-- If `openrouter.ai` has no explicit rule, it will usually fall through to `MATCH`.
-- Read the selected groups in `profiles.yaml` before changing anything.
-
-### 4. Apply the narrow fix first
-
-- Update the rules template and the active generated config together:
-  - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\profiles\rPQ84LOFBWXy.yaml`
-  - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\clash-verge.yaml`
-- Add:
-
-```text
-DOMAIN-SUFFIX,openrouter.ai,<target-group>
-```
-
-- Prefer reusing the same group that already carries `openai.com`.
-- Reload or restart `verge-mihomo` after the edit.
-
-### 5. Validate the actual OpenRouter path
-
-- Probe `https://openrouter.ai/api/v1/chat/completions`.
-- A healthy fix changes the response from `403 region` to `200 OK`.
-- A Japan POP often shows `CF-RAY: ...-NRT` after the fix, but trust the status code first.
-- Only after the API probe succeeds should you spend Claude Code tokens on `claude -p`.
-
-## Resources
-
-- `scripts/diagnose-openrouter-route.ps1`
-  - Reads Claude/OpenRouter settings.
-  - Compares direct, Clash mixed-port, and dedicated SOCKS geolocation.
-  - Checks whether `openrouter.ai` has an explicit rule.
-  - Probes OpenRouter through Clash mixed-port and the dedicated SOCKS node.
-
-- `scripts/ensure-openrouter-rule.ps1`
-  - Adds `DOMAIN-SUFFIX,openrouter.ai,<group>` to the rules template and active generated config.
-  - Makes timestamped backups before edits.
-  - Can restart `verge-mihomo` in place.
-
-- `references/windows-openrouter-clash-playbook.md`
-  - Contains the verified 2026-05-03 incident, machine paths, command checklist, and expected results.
-
-## Guardrails
-
-- Back up `settings.json`, `rPQ84LOFBWXy.yaml`, and `clash-verge.yaml` before edits.
-- Do not trust node labels such as `jp`; trust GeoIP and API probes.
-- Do not widen the default `MATCH` group before trying the narrow `openrouter.ai` rule.
-- If `claude auth status` is still in API key mode after switching to OpenRouter, fix auth mapping before changing proxy groups.
+---
+name: claude-openrouter-clash-debug
+description: Diagnose Claude Code failures on Windows when OpenRouter, Clash Verge, and a local Hysteria/SOCKS node disagree about the real egress region or auth path. Use when Claude Code returns `403 This model is not available in your region`, when `ANTHROPIC_BASE_URL` points to OpenRouter, when a node label says Japan but external services still see Hong Kong or another region, or when `openrouter.ai`, `anthropic.com`, and `claude.ai` need explicit Clash routing and validation.
+---
+
+# Claude OpenRouter Clash Debug
+
+## Overview
+
+Use this skill to debug the full Claude Code -> OpenRouter -> Clash Verge -> local Hysteria route on this Windows machine.
+Prefer the bundled scripts for repeated checks; use the reference playbook when you need the exact files, commands, and the known-good 2026-05-03 fix.
+
+## Quick Start
+
+1. Run the diagnostic script:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\.agents\skills\claude-openrouter-clash-debug\scripts\diagnose-openrouter-route.ps1
+```
+
+2. If the output says `openrouter.ai` is missing an explicit Clash rule, add it:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\.agents\skills\claude-openrouter-clash-debug\scripts\ensure-openrouter-rule.ps1 -GroupName AI-GitHub-HY2 -RestartMihomo
+```
+
+3. Re-run the diagnostic script.
+
+4. Confirm Claude Code itself works:
+
+```powershell
+claude -p "Reply with ok." --output-format json
+```
+
+## Workflow
+
+### 1. Validate Claude/OpenRouter auth mapping
+
+- Read `C:\Users\pzy666\.claude\settings.json`.
+- When `ANTHROPIC_BASE_URL` is `https://openrouter.ai/api`, the OpenRouter key should live in `ANTHROPIC_AUTH_TOKEN`.
+- Blank `ANTHROPIC_API_KEY` for this path. If the key remains there, Claude Code often stays on the wrong auth mode.
+- Check `claude auth status` before changing network rules.
+
+### 2. Compare the three egress layers
+
+- Direct or TUN egress: what the machine exposes by default.
+- Clash mixed-port egress: what flows through `127.0.0.1:7897`.
+- Dedicated Hysteria SOCKS egress: what the JP node at `127.0.0.1:1082` exposes.
+- If the dedicated SOCKS node is `JP` but the mixed port or default path is `HK`, the server is fine and Clash routing is the likely problem.
+
+### 3. Inspect Clash group and rule selection
+
+- Find the group used by `openai.com` or the intended AI traffic.
+- In this machine's verified case, `openai.com` routes through `AI-GitHub-HY2`.
+- If `openrouter.ai` has no explicit rule, it will usually fall through to `MATCH`.
+- Read the selected groups in `profiles.yaml` before changing anything.
+
+### 4. Apply the narrow fix first
+
+- Update the rules template and the active generated config together:
+  - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\profiles\rPQ84LOFBWXy.yaml`
+  - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\clash-verge.yaml`
+- Add:
+
+```text
+DOMAIN-SUFFIX,openrouter.ai,<target-group>
+```
+
+- Prefer reusing the same group that already carries `openai.com`.
+- Reload or restart `verge-mihomo` after the edit.
+
+### 5. Validate the actual OpenRouter path
+
+- Probe `https://openrouter.ai/api/v1/chat/completions`.
+- A healthy fix changes the response from `403 region` to `200 OK`.
+- A Japan POP often shows `CF-RAY: ...-NRT` after the fix, but trust the status code first.
+- Only after the API probe succeeds should you spend Claude Code tokens on `claude -p`.
+
+## Resources
+
+- `scripts/diagnose-openrouter-route.ps1`
+  - Reads Claude/OpenRouter settings.
+  - Compares direct, Clash mixed-port, and dedicated SOCKS geolocation.
+  - Checks whether `openrouter.ai` has an explicit rule.
+  - Probes OpenRouter through Clash mixed-port and the dedicated SOCKS node.
+
+- `scripts/ensure-openrouter-rule.ps1`
+  - Adds `DOMAIN-SUFFIX,openrouter.ai,<group>` to the rules template and active generated config.
+  - Makes timestamped backups before edits.
+  - Can restart `verge-mihomo` in place.
+
+- `references/windows-openrouter-clash-playbook.md`
+  - Contains the verified 2026-05-03 incident, machine paths, command checklist, and expected results.
+
+## Guardrails
+
+- Back up `settings.json`, `rPQ84LOFBWXy.yaml`, and `clash-verge.yaml` before edits.
+- Do not trust node labels such as `jp`; trust GeoIP and API probes.
+- Do not widen the default `MATCH` group before trying the narrow `openrouter.ai` rule.
+- If `claude auth status` is still in API key mode after switching to OpenRouter, fix auth mapping before changing proxy groups.

package/package-source/docs/codex-harness-engineering/templates/package-assets/skills/claude-openrouter-clash-debug/references/windows-openrouter-clash-playbook.md

@@ -1,94 +1,94 @@
-# Windows Claude OpenRouter Clash Playbook
-
-## Verified Incident
-
-Date: `2026-05-03`
-
-Symptom:
-
-```text
-Please run /login · API Error: 403
-{"error":{"message":"This model is not available in your region.","code":403}}
-```
-
-What was true on this machine:
-
-- `C:\Users\pzy666\.claude\settings.json` pointed `ANTHROPIC_BASE_URL` to OpenRouter.
-- The OpenRouter key initially lived in `ANTHROPIC_API_KEY` instead of `ANTHROPIC_AUTH_TOKEN`.
-- The dedicated Hysteria node at `127.0.0.1:1082` exited in `JP` as `207.148.115.43`.
-- The generic Clash mixed-port path at `127.0.0.1:7897` still exited in `HK` as `192.142.4.97`.
-- `anthropic.com` and `claude.ai` already had explicit rules, but `openrouter.ai` did not.
-- `openrouter.ai` therefore fell through to `MATCH,狗狗加速.com`, whose selected group was a Hong Kong node.
-
-## Known-Good Fix
-
-1. In `C:\Users\pzy666\.claude\settings.json`:
-   - Keep `ANTHROPIC_BASE_URL=https://openrouter.ai/api`
-   - Move the OpenRouter key to `ANTHROPIC_AUTH_TOKEN`
-   - Blank `ANTHROPIC_API_KEY`
-2. Add `DOMAIN-SUFFIX,openrouter.ai,AI-GitHub-HY2` to:
-   - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\profiles\rPQ84LOFBWXy.yaml`
-   - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\clash-verge.yaml`
-3. Restart `verge-mihomo`
-4. Re-probe OpenRouter and then run `claude -p`
-
-Expected result after the fix:
-
-- OpenRouter returns `200 OK`
-- `CF-RAY` often ends with `NRT`
-- `claude -p "Reply with ok." --output-format json` succeeds
-
-## Important Paths
-
-- Claude settings:
-  - `C:\Users\pzy666\.claude\settings.json`
-- Clash Verge state:
-  - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\profiles.yaml`
-  - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\profiles\rPQ84LOFBWXy.yaml`
-  - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\clash-verge.yaml`
-- Local Hysteria JP client:
-  - `C:\Users\pzy666\AppData\Roaming\hysteria\config-jp.yaml`
-
-## Command Checklist
-
-Inspect Claude auth mode:
-
-```powershell
-claude auth status
-```
-
-Inspect direct or TUN egress:
-
-```powershell
-curl.exe -s https://ipinfo.io/json
-```
-
-Inspect Clash mixed-port egress:
-
-```powershell
-curl.exe -s --proxy http://127.0.0.1:7897 https://ipinfo.io/json
-```
-
-Inspect dedicated JP Hysteria egress:
-
-```powershell
-curl.exe -s --socks5-hostname 127.0.0.1:1082 https://ipinfo.io/json
-```
-
-Probe OpenRouter through Clash mixed-port:
-
-```powershell
-curl.exe -sS --proxy http://127.0.0.1:7897 -D - -X POST https://openrouter.ai/api/v1/chat/completions ...
-```
-
-Probe OpenRouter through the dedicated JP Hysteria SOCKS node:
-
-```powershell
-curl.exe -sS --socks5-hostname 127.0.0.1:1082 -D - -X POST https://openrouter.ai/api/v1/chat/completions ...
-```
-
-## Interpretation Rules
-
-- If the JP SOCKS node shows `JP` but the generic mixed-port path shows `HK`, the server is not the problem; the route selection is.
-- If `openrouter.ai` has no explicit rule, expect it to fall through to the default group.
-- If OpenRouter succeeds through the dedicated JP SOCKS node but fails through the mixed-port path, fix the Clash rule before changing providers or rotating keys.
+# Windows Claude OpenRouter Clash Playbook
+
+## Verified Incident
+
+Date: `2026-05-03`
+
+Symptom:
+
+```text
+Please run /login · API Error: 403
+{"error":{"message":"This model is not available in your region.","code":403}}
+```
+
+What was true on this machine:
+
+- `C:\Users\pzy666\.claude\settings.json` pointed `ANTHROPIC_BASE_URL` to OpenRouter.
+- The OpenRouter key initially lived in `ANTHROPIC_API_KEY` instead of `ANTHROPIC_AUTH_TOKEN`.
+- The dedicated Hysteria node at `127.0.0.1:1082` exited in `JP` as `207.148.115.43`.
+- The generic Clash mixed-port path at `127.0.0.1:7897` still exited in `HK` as `192.142.4.97`.
+- `anthropic.com` and `claude.ai` already had explicit rules, but `openrouter.ai` did not.
+- `openrouter.ai` therefore fell through to `MATCH,狗狗加速.com`, whose selected group was a Hong Kong node.
+
+## Known-Good Fix
+
+1. In `C:\Users\pzy666\.claude\settings.json`:
+   - Keep `ANTHROPIC_BASE_URL=https://openrouter.ai/api`
+   - Move the OpenRouter key to `ANTHROPIC_AUTH_TOKEN`
+   - Blank `ANTHROPIC_API_KEY`
+2. Add `DOMAIN-SUFFIX,openrouter.ai,AI-GitHub-HY2` to:
+   - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\profiles\rPQ84LOFBWXy.yaml`
+   - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\clash-verge.yaml`
+3. Restart `verge-mihomo`
+4. Re-probe OpenRouter and then run `claude -p`
+
+Expected result after the fix:
+
+- OpenRouter returns `200 OK`
+- `CF-RAY` often ends with `NRT`
+- `claude -p "Reply with ok." --output-format json` succeeds
+
+## Important Paths
+
+- Claude settings:
+  - `C:\Users\pzy666\.claude\settings.json`
+- Clash Verge state:
+  - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\profiles.yaml`
+  - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\profiles\rPQ84LOFBWXy.yaml`
+  - `C:\Users\pzy666\AppData\Roaming\io.github.clash-verge-rev.clash-verge-rev\clash-verge.yaml`
+- Local Hysteria JP client:
+  - `C:\Users\pzy666\AppData\Roaming\hysteria\config-jp.yaml`
+
+## Command Checklist
+
+Inspect Claude auth mode:
+
+```powershell
+claude auth status
+```
+
+Inspect direct or TUN egress:
+
+```powershell
+curl.exe -s https://ipinfo.io/json
+```
+
+Inspect Clash mixed-port egress:
+
+```powershell
+curl.exe -s --proxy http://127.0.0.1:7897 https://ipinfo.io/json
+```
+
+Inspect dedicated JP Hysteria egress:
+
+```powershell
+curl.exe -s --socks5-hostname 127.0.0.1:1082 https://ipinfo.io/json
+```
+
+Probe OpenRouter through Clash mixed-port:
+
+```powershell
+curl.exe -sS --proxy http://127.0.0.1:7897 -D - -X POST https://openrouter.ai/api/v1/chat/completions ...
+```
+
+Probe OpenRouter through the dedicated JP Hysteria SOCKS node:
+
+```powershell
+curl.exe -sS --socks5-hostname 127.0.0.1:1082 -D - -X POST https://openrouter.ai/api/v1/chat/completions ...
+```
+
+## Interpretation Rules
+
+- If the JP SOCKS node shows `JP` but the generic mixed-port path shows `HK`, the server is not the problem; the route selection is.
+- If `openrouter.ai` has no explicit rule, expect it to fall through to the default group.
+- If OpenRouter succeeds through the dedicated JP SOCKS node but fails through the mixed-port path, fix the Clash rule before changing providers or rotating keys.