Add protonvpn domain skill: WireGuard config generation

[hkrathore]

Adds domain-skills/protonvpn/wireguard-config.md covering free-account WireGuard config generation on account.protonvpn.com/downloads:

• The standalone "best server" Create button is the only one not inside a tr — DOM-click it by text; coordinate clicks miss because the async server tables shift layout by hundreds of px.
• The result modal shows the private key once; extract before closing. If the user clicks Download instead, the modal closes and the file lands in ~/Downloads as <name>-<SERVER>.conf (# flattened to -).
• On macOS, sandboxed shells often can't read TCC-protected ~/Downloads; Chrome can, via a file:///Users/<user>/Downloads/ directory listing + document.body.innerText.
• SPA scrolls in an inner container (window.scrollY stays 0) — use scrollIntoView.
• Free tier: one active VPN device; configs expire after ~1 year.

https://claude.ai/code/session_016dcUmaEtNZicEGWwRiFnbv

---

Summary by cubic

Adds a practical guide for generating server-pinned WireGuard configs on account.protonvpn.com/downloads for free accounts. Covers reliable DOM interaction, one-time key extraction, and macOS download access.

• New Features
  • Added domain-skills/protonvpn/wireguard-config.md with steps to create a specific server .conf.
  • Use DOM-click on the standalone "Create" (not inside a tr) to avoid async table reflow misses.
  • Extract the private key from the modal before closing; downloads save as <name>-<SERVER>.conf with # flattened to -.
  • macOS workaround: read ~/Downloads via Chrome file:// directory listing when sandboxed shells can’t access TCC-protected paths.
  • Notes on inner-container scrolling (scrollIntoView), free-tier single-device limit, config expiry (~1 year), and defaults (AllowedIPs = 0.0.0.0/0, ::/0, DNS 10.2.0.1).

^{Written for commit b365ddc. Summary will update on new commits.}

[browser-harness-review]

✅ Skill review passed

Reviewed 1 file(s) — no findings.

[cubic-dev-ai]

2 issues found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="domain-skills/protonvpn/wireguard-config.md">

<violation number="1" location="domain-skills/protonvpn/wireguard-config.md:13">
P2: The free-tier country list is incomplete: Norway, Switzerland, Singapore, and Mexico are also free locations. Agents following this list can incorrectly reject valid countries or fail to find their server; the choices should come from the rendered free-server list instead of this fixed set.</violation>

<violation number="2" location="domain-skills/protonvpn/wireguard-config.md:20">
P2: Free-account generation never explicitly selects the `Free server configs` radio before choosing a server. If another tier is selected by default, the documented Create path can target an unavailable paid server and fail; make this selection an explicit step.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The free-tier country list is incomplete: Norway, Switzerland, Singapore, and Mexico are also free locations. Agents following this list can incorrectly reject valid countries or fail to find their server; the choices should come from the rendered free-server list instead of this fixed set.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At domain-skills/protonvpn/wireguard-config.md, line 13:

<comment>The free-tier country list is incomplete: Norway, Switzerland, Singapore, and Mexico are also free locations. Agents following this list can incorrectly reject valid countries or fail to find their server; the choices should come from the rendered free-server list instead of this fixed set.</comment>

<file context>
@@ -0,0 +1,55 @@
+  (heading "WireGuard configuration"). Unauthenticated visits redirect to
+  `/login`; stop and let the user sign in.
+- Free accounts CAN generate configs, but only for free servers
+  ("Free server configs" radio; countries as of 2026: US, NL, JP, PL, RO, CA).
+
+## Page structure / flow
</file context>

[cubic-dev-ai]

P2: Free-account generation never explicitly selects the Free server configs radio before choosing a server. If another tier is selected by default, the documented Create path can target an unavailable paid server and fail; make this selection an explicit step.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At domain-skills/protonvpn/wireguard-config.md, line 20:

<comment>Free-account generation never explicitly selects the `Free server configs` radio before choosing a server. If another tier is selected by default, the documented Create path can target an unavailable paid server and fail; make this selection an explicit step.</comment>

<file context>
@@ -0,0 +1,55 @@
+1. Text input "Device/certificate name" (placeholder mentions "certificate") — required.
+2. Platform radios (Android preselected; pick the real target — file is identical, choice
+   only tracks guides).
+3. "4. Select a server to connect to" shows "Use the best server according to current
+   load and position: <SERVER>" with a standalone **Create** button — this is the
+   fastest path when the suggested server is already the right country. Otherwise
</file context>