ai-native-mihomolisted

# AI-native mihomo proxy stack ## The pattern Every GUI clash client (FlClash, Clash Verge Rev, ...) is a thin shell over the **mihomo core**. The AI-native move is to drop the shell and keep the core, because the core already exposes everything a GUI does as a **REST API** (`external-controller`). The GUI is a disposable human convenience; the API is the contract agents build on. ``` airport profile (yaml) ──security patch──▶ config.yaml ◀── mihomo binary (headless) │ │ (setcap: TUN without root) systemd --user service REST API 127.0.0.1:9090 │ │ TUN gvisor + auto-route agent: curl / jq / MCP ``` Properties that matter: - **Rootless**: `systemd --user` + file capabilities. No root-owned configs, so agents can manage everything without sudo. - **Declarative**: one yaml = whole state. Reproduce = copy 3 files. - **Observable**: every dial, rule match, and delay is one GET away. ## Complexity doctrine — native config first The default answer to "mihomo keeps picking the wrong exit" is a **config change**, not a program. Escalate only as far as the problem forces you: 1. **Native config**: a `select` group you pin by API; `url-test` nominally "fastest wins"; `fallback` nominally "first healthy in list order"; `load-balance` for spread. These are *intended* semanti