sift-check

name	sift-check
description	Validate the Sift Mihomo templates under rules/ against project invariants — strategy-group & rule-set referential integrity, node-free rules, DNS allowance per template, canonical group scopes, geodata purity, and optional mihomo/yamllint checks. Use before committing template, rule-provider, or documentation changes.

sift-check

Statically validates the templates in rules/ against the conventions in AGENTS.md (including the ShellCrash geo-keyword constraint). Pure bash + awk, no new dependencies; mihomo -t and yamllint are used only if those binaries are on PATH.

Run

bash .claude/skills/sift-check/check.sh

.agents/skills/sift-check/check.sh is a compatibility entry point that delegates to the canonical .claude implementation.

It cds to the repo root, so it can be invoked from anywhere. Exit 0 = PASS, 1 = at least one [FAIL].

What it checks

Project invariants that mihomo -t cannot catch:

• Referential integrity — every proxies: entry and every rule policy resolves to a defined group or a builtin (DIRECT/REJECT); every RULE-SET,<x> and DNS rule-set:<x> resolves to a defined rule-providers key.
• Node-free — no top-level proxies: in any template.
• DNS scope — Full and Core templates may carry top-level dns: blocks and must use fake-IP whitelist semantics; Nano templates stay DNS-free. DNS fake-ip-filter / nameserver-policy refs are integrity-checked and must use behavior: domain providers. Grouped Mihomo selectors such as "rule-set:cn,private" are parsed as references to both cn and private; MetaCubeX Full/Core use geosite selectors directly and define no rule-providers.
• Note — ShellCrash URL heuristics that treat geosite/geoip path substrings as “must download Geo databases” are not enforced; templates may use MetaCubeX .../geosite/... provider URLs.
• Canonical groups — required strategy-group names must be present; Core must not contain service/brand UI groups, region node groups, or the separate 漏网之鱼 group, and Nano must not contain its forbidden Full/Core-only groups.
• Orphan providers ([WARN]) and key ≠ file basename ([INFO], e.g. blackmatrix7 service keys mapping to capitalized upstream paths — informational only).

Toolchain (auto-skipped if not installed): mihomo -t -f, yamllint -d relaxed, git diff --check.

Acting on results

• PASS → invariants hold; safe to commit.
• Any [FAIL] → read the message, fix the named file, re-run until PASS. Do not commit while failing.
• [WARN] / [INFO] don't fail the run but should be eyeballed.

Keeping the contract in sync

The canonical required / forbidden group sets live at the top of check.sh (FULL_REQ, CORE_REQ, CORE_FORB, NANO_REQ, NANO_FORB). When a strategy group is intentionally added, renamed, or removed, update those lists in the same commit so the checker stays accurate.