way/pigway-frame-flow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 29 Wiki Activity

Record live WeChat widget discovery and verified proxy cleanup

Browse Source
This commit is contained in:
Pigway
2026-10-02 16:12:07 +08:00
parent 63058e979a
commit bfef1ad28d
2 changed files with 874 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/research/KOKONNA_CONTENT_SUBSCRIPTIONS.md
+12
View File
@@ -50,3 +50,15 @@ Client category keys: Weather (天气), Lunar (农历), Calendar (单向历), Co
Authentication paths observed: `app.login` with username/password; `app.wxlogin` with WeChat login code returns user token. Frame Flow login account is unrelated. App code alone does not prove Android and WeChat versions use identical methods, nor guarantee this private API stays compatible.
No authenticated requests or live widget writes were sent. Next step is official-account read-only verification of device discovery and `getFrameCovers`; requires legitimate official session/account access. Keep session secret server-side and out of logs, front-end, SQLite plaintext, and Git. Do not send existing OpenAPI key to this separately authenticated transport speculatively.
## Live WeChat verification (2026-10-02)
With explicit user authorization, a temporary localhost observer chained through the existing VPN proxy at 127.0.0.1:7890. Only robot/api.galaxyguide.cn were routed to the observer; other domains and original bypass entries retained their prior routing. Mutating RPC calls were blocked. An automatic three-minute rollback disabled/removed the PAC configuration and removed certificate trust.
Observed the user's own WeChat mini-program send `appFrame.getFrame` (parameter key `id`) and `appFrame.getFrameCovers` (parameter key `robotId`) to the RPC transport. The latter returned `frameCoverRobot`, `tags`, `rows`, `robot`. **75 widgets** were returned; sanitized IDs/names/categories and argument names are retained in `KOKONNA_WIDGET_CATALOG.json`. No user session, device key, account credentials, photos, device IDs or actual argument values are retained.
The selected-widget metadata extractor returned null for cover ID/name during this session. This alone is insufficient to conclude the device has no widget: current-selection shape/actual state requires another focused verification. The directory's 古诗词名句 has ID 29; this must not be assumed equivalent to the user's described 每天一首诗词 without checking the actual selected item.
Cleanup verified: PAC URL `(null)`, disabled; zero observer CA certificate entries in System keychain; observer terminated; private CA files removed; user session only existed in process memory and was discarded. Original HTTP/HTTPS/SOCKS proxy remains 127.0.0.1:7890. No official subscription/upload/display/delete writes were sent. Other NAS services and VPN application configuration were untouched.
Integration is now technically supported by live read evidence, not blocked on interface discovery. Remaining work is authenticated current-selection verification and an explicit maintainable official-session login/renewal strategy. Do not silently persist the captured WeChat session or commit it as configuration. Official RPC is undocumented and may change independently of OpenAPI.