From 126ba66a627a9625fae77c29abe99dce19477e7c Mon Sep 17 00:00:00 2001 From: batsumaru <> Date: Wed, 1 Jul 2026 19:11:15 +0900 Subject: Document abbreviate_rule's nat/rdr blind spot and ddclient's log gap From a fresh-agent review of AGENTS.md against two hypothetical tasks: - abbreviate_rule() in pf.sh has only ever been developed/tested against filter-rule (-sr) syntax, despite also running on -sn (nat/rdr) output. It degrades safely (unshortened passthrough) but a new nat/rdr rule shape isn't guaranteed to compress as tightly - noted both in the code comment and in AGENTS.md's compression writeup so this doesn't need rediscovering. - ddclient logging isn't enabled on the box, so "is the last DNS update actually succeeding" can't be built by tailing a log that doesn't exist - it'd need the cache file or a public-IP comparison instead. Recorded in AGENTS.md's topology section since ddclient.sh currently only checks the process is running, not update success. Co-Authored-By: Claude Sonnet 5 --- AGENTS.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) (limited to 'AGENTS.md') diff --git a/AGENTS.md b/AGENTS.md index d8e35b2..a3cbaeb 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -34,7 +34,13 @@ shaped the way they are: - Host services outside the jails: `wg0`, `caddy`, `ddclient` (dynamic DNS, since the box is on a residential/dynamic IP - this is also why `checks/wg-watcher.sh` exists, to catch the WAN-change-reaction daemon - dying silently). + dying silently). `checks/ddclient.sh` currently only checks the process + is running (`svc_status`), not that updates are actually succeeding - + **ddclient logging isn't enabled on this box**, so a "did the last + update actually succeed" check can't be built by tailing a log file + that doesn't exist. It'd need to read ddclient's cache file (records + the last IP it set) or compare against the box's actual public IP + instead - neither has been explored yet. ## Where code runs vs. where it's edited @@ -141,6 +147,12 @@ approach for any future long-text row: ish bitmap font wrapping doesn't line up with raw string length in an obvious way. +**Known gap**: `abbreviate_rule()`'s regexes were developed and tested +against filter-rule (`-sr`) syntax only. It also runs on `-sn` (nat/rdr) +output, but no nat/rdr rule shape has actually been exercised against it - +a new nat rule may pass through unshortened rather than compressing as +tightly as a filter rule. Check the rendered page after adding one. + ## When cron + static HTML stops being enough This project started as a refactor of a single monolithic cron script -- cgit v1.3