feat(agent): WARP 域名分流 —— 命中域名走 Cloudflare 干净出口(#29)

节点 sing-box 渲染新增可选 WARP 分流:节点本地 warp.json(默认
<StateDir>/warp.json)配 WARP 凭证 + 域名清单 → 渲染时注入一个 userspace
WireGuard(WARP)endpoint + route(sniff 取 SNI/Host → domain_suffix 命中走
warp,其余 final=direct)。sing-box 1.11+ endpoints 语法,system=false 用户态
不依赖内核 wg 模块。

- 运营改域名只需编辑 warp.json + 重启 agent(sing-box 无热重载),即「配置的方式」。
- warp.json 不存在/enabled=false/域名空/凭证缺/坏 JSON → 一律按未启用,配置与旧
  节点逐字节一致,坏配置绝不产出无法启动的 sing-box config(渲染读失败仅记日志)。
- WARP 凭证节点私有(wgcf 注册免费匿名账号),不入 git、不经控制面。
- 测试:注入 endpoint+route/无配置无 route/禁用或残缺不注入/坏 JSON 优雅退化。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/agentd/render.go

@@ -21,13 +21,17 @@ const (
 	clashAPIAddr   = "127.0.0.1:19090"
 	clashAPISecret = "pangolin-local-stats"
 	v2rayAPIAddr   = "127.0.0.1:19091"
+
+	// sing-box outbound/endpoint tags used in route rules.
+	directOutboundTag = "direct"
+	warpOutboundTag   = "warp"
 )
 
-func renderSingboxConfig(creds []Cred, reality *agentv1.RealityInbound, hy2 *agentv1.Hy2Inbound, deriveKey string) ([]byte, error) {
+func renderSingboxConfig(creds []Cred, reality *agentv1.RealityInbound, hy2 *agentv1.Hy2Inbound, deriveKey string, warp *WarpConfig) ([]byte, error) {
 	cfg := map[string]any{
 		"log":       map[string]any{"level": "warn", "timestamp": true},
 		"inbounds":  buildInbounds(creds, reality, hy2, deriveKey),
-		"outbounds": []any{map[string]any{"type": "direct", "tag": "direct"}},
+		"outbounds": []any{map[string]any{"type": "direct", "tag": directOutboundTag}},
 		"experimental": map[string]any{
 			"clash_api": map[string]any{
 				"external_controller": clashAPIAddr,
@@ -42,6 +46,14 @@ func renderSingboxConfig(creds []Cred, reality *agentv1.RealityInbound, hy2 *age
 			},
 		},
 	}
+
+	// WARP 分流(#29):命中配置域名的流量走 Cloudflare WARP 干净出口,其余直连。
+	// warp 为 nil 或未 active 时完全不加 endpoints/route → 与旧配置逐字节一致(向后兼容)。
+	if warp.active() {
+		cfg["endpoints"] = []any{warp.warpEndpoint()}
+		cfg["route"] = warp.warpRoute()
+	}
+
 	return json.MarshalIndent(cfg, "", "  ")
 }