# Update WireGuard Policy Sync to Use AllowedIPs for Target Parsing Implementation Plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Modify `wg-sync-policy.sh` to extract access targets from a peer's `AllowedIPs` list instead of using `#Access` comments.

**Architecture:** The AWK script inside `wg-sync-policy.sh` currently reads the first IP of `AllowedIPs` as the client IP and looks for an `#Access` line for targets. We will change the AWK script to read the first IP as the client IP, and any subsequent IPs in the comma-separated `AllowedIPs` list as the access targets. We will remove the parsing of `#Access` entirely.

**Tech Stack:** Bash, AWK, jq

---

### Task 1: Update wg-sync-policy.sh AWK Parsing

**Files:**
- Modify: `D:\www-project\wireguard-vpn\03.wireguard-policy\wg-sync-policy.sh`

- [ ] **Step 1: Modify the AWK parsing logic**
Change the awk script in `wg-sync-policy.sh` to extract the rest of the IPs from `AllowedIPs` instead of reading `#Access`.

```bash
# In D:\www-project\wireguard-vpn\03.wireguard-policy\wg-sync-policy.sh, find the awk block (around line 46):

    awk '
    BEGIN { RS="\n\\[Peer\\]\n"; FS="\n" }
    NR>1 {
        ip=""; access=""
        for(i=1;i<=NF;i++){
            if($i ~ /^AllowedIPs/) {
                split($i,a," = ")
                gsub(/ /,"",a[2])
                split(a[2],b,",")
                
                # First IP is the client IP (strip CIDR for ip output if needed, but the original kept it and stripped it later or just kept the IP)
                split(b[1],c,"/")
                ip=c[1]
                
                # The rest of the IPs are access targets
                access_arr=""
                for(j=2;j<=length(b);j++) {
                    if(access_arr=="") access_arr = b[j]
                    else access_arr = access_arr "," b[j]
                }
                access = access_arr
            }
        }
        if(ip!="" && ip!="0.0.0.0" && ip!="::") {
            printf "%s|%s\n", ip, access
        }
    }
    ' "$WG_CONF" | while IFS="|" read -r ip access_string; do
```

- [ ] **Step 2: Commit the changes**

```bash
git add wg-sync-policy.sh
git commit -m "feat: parse access targets from AllowedIPs instead of #Access"
```