From 96294f5137d8a03b415889496bfe6df430273814 Mon Sep 17 00:00:00 2001 From: Alex Southwell Date: Wed, 28 Oct 2026 23:13:01 +0000 Subject: [PATCH] Clarify two official Framey compatibility limits (#394) Co-authored-by: SAPHID --- .../framey-static-limits-2026-10-28.md | 27 +++++++++++++++++++ docs/framey-compatibility.md | 4 +-- ui/framey-compatibility.json | 4 +-- 3 files changed, 31 insertions(+), 4 deletions(-) create mode 100644 docs/evidence/framey-static-limits-2026-10-28.md diff --git a/docs/evidence/framey-static-limits-2026-10-28.md b/docs/evidence/framey-static-limits-2026-10-28.md new file mode 100644 index 0000000..c3ae157 --- /dev/null +++ b/docs/evidence/framey-static-limits-2026-10-28.md @@ -0,0 +1,27 @@ +# Static limits for two official Decky archives, 28 October 2026 + +The published archives below were downloaded from Decky's version CDN and +checked against the catalog's exact SHA-256 before inspection. No plugin code, +backend, plugin-initiated network request or headset operation ran in this +audit. Their status labels remain unchanged. + +## IsThereAnyDeal for Deck 1.1.1 + +Store ID 81, SHA-256 +`18e133b2e6203f16fd1ee2ed83b5a90bad34491515bef7ec1c82d525f0bfadef`. +The backend exposes settings load/save. The published frontend uses +`fetchNoCors` for deal lookups with an embedded upstream API key and attempts +to find a Steam store debugger tab through `localhost:8080/json`. The key was +not decoded or used. The existing real Frame country read and local settings +render remain the verified scope; live deals, settings writes and Steam page +integration remain unverified. Status stays **partial**. + +## Decky Clipboard 1.0.1 + +Store ID 119, SHA-256 +`d283bd9a5c35b3fac3788391736a6763f3e8c4615831a7c560c9fa6e6c0950ac`. +The manifest requests root and the ZIP bundles an x86-64 `bin/xclip`. In the +published `main.py`, `auto_start` defaults to true; `WebServer.start` binds +`0.0.0.0:8765`, and the clipboard GET/POST routes have no authentication +check. A managed adaptation would need to address that behavior before any +Frame install. The archive remains **broken** and was not installed or run. diff --git a/docs/framey-compatibility.md b/docs/framey-compatibility.md index b6a18db..47281b2 100644 --- a/docs/framey-compatibility.md +++ b/docs/framey-compatibility.md @@ -97,7 +97,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say | 78: Brightness Bar 1.0.4 | legacy / legacy | N/A | Not supported on Frame: Targets Steam/QAM brightness shortcuts and a global Steam overlay; neither is attached to the Framey panel. | static archive, local browser, fake-Frame | | 79: Decky Notifications 1.0.1 | legacy / legacy | partial | Initializer succeeds; device/account setup and notification delivery unverified. | static archive, local browser, fake-Frame | | 80: MagicBlack 2.0.2 | 1 / 2 | N/A | Not supported on Frame: Targets a global Steam Deck screen-black overlay; the isolated panel cannot black out the Frame compositor. | static archive, local browser, fake-Frame | -| 81: IsThereAnyDeal for Deck 1.1.1 | legacy / legacy | partial | Country settings render and select the real Frame Steam country through the read-only bridge. Settings writes, deal lookups and Steam page integration remain unverified; plugin backend calls were denied. | static archive, local browser, fake-Frame, real Frame SSH | +| 81: IsThereAnyDeal for Deck 1.1.1 | legacy / legacy | partial | Country settings render and select the real Frame Steam country through the read-only bridge. The published frontend attempts deal lookups with an embedded upstream API key and a Steam store CDP tab; neither was exercised in Framey. Settings writes and Steam page integration remain unverified. | static archive, local browser, fake-Frame, real Frame SSH | | 82: MagicPods 2.0.21 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: MagicPodsDecky/bin/magicpodscore. Frontend audit failed: Audit blocks WebSocket. | static archive, local browser, fake-Frame | | 84: Junk-Store 1.1.13 | legacy / legacy | partial | Official Decky 3.3.0 ARM64 static menu/backend calls pass; local Chromium Games/Epic navigation, About/Dependencies tabs, Back and reopen render with real Frame library metadata. Legendary is absent; dependency install, login, game operations, RSS, optional websocket and worn VR remain unverified. Existing installs need update/reinstall for script permissions. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH | | 85: Decky-Undervolt 1.0.8 | 1 / 2 | N/A | Not supported on Frame: RyzenAdj Curve Optimizer requires an AMD CPU; Frame is ARM64. | static archive, local browser, fake-Frame | @@ -133,7 +133,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say | 116: Muon 0.2.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame | | 117: DeckyParty File Manager 1.0.0 | legacy / legacy | partial | Initializer succeeds; privileged file operations and backend are unverified. No file changes were run. | static archive, local browser, fake-Frame | | 118: Speed Test 1.0.2 | 1 / 2 | partial | Initializer succeeds; automatic bandwidth tests were blocked by the audit network policy. | static archive, local browser, fake-Frame | -| 119: Decky Clipboard 1.0.1 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-clipboard/bin/xclip. | static archive, local browser, fake-Frame | +| 119: Decky Clipboard 1.0.1 | 1 / 2 | broken | The exact archive is blocked by its x86-64 xclip binary and root request. Its published backend defaults to auto-starting an unauthenticated clipboard GET/POST API on 0.0.0.0:8765; this was inspected statically and never run on Frame. | static archive, local browser, fake-Frame | | 120: Reroll 0.2.1 | 1 / 2 | broken | Frontend now initializes with inert game-action subscriptions, but the archive contains x86_64 memscan.so and requests root. No process-memory access was run. | static archive, local browser, fake-Frame | | 121: DeckPass 1.1.1 | 1 / 2 | partial | Initializer succeeds; KeePass Flatpak discovery and secrets integration were not exercised. | static archive, local browser, fake-Frame | | 123: Steam Status 1.2.3 | 2 / 2 | partial | Settings/public status rendered locally; cache errors fixed. Read-only get_settings RPC returned actual Decky 3.3.0 defaults on ARM64 Frame. Persistence, live backend diagnostics and VR controls unverified. | static archive, local browser, fake-Frame, real Frame SSH | diff --git a/ui/framey-compatibility.json b/ui/framey-compatibility.json index c51b8a8..92947e0 100644 --- a/ui/framey-compatibility.json +++ b/ui/framey-compatibility.json @@ -6322,7 +6322,7 @@ "https://github.com/JtdeGraaf/IsThereAnyDeal-DeckyPlugin.git" ], "status": "partial", - "reason": "Country settings render and select the real Frame Steam country through the read-only bridge. Settings writes, deal lookups and Steam page integration remain unverified; plugin backend calls were denied.", + "reason": "Country settings render and select the real Frame Steam country through the read-only bridge. The published frontend attempts deal lookups with an embedded upstream API key and a Steam store CDP tab; neither was exercised in Framey. Settings writes and Steam page integration remain unverified.", "blockInstall": false, "verification": [ "static archive", @@ -10546,7 +10546,7 @@ "https://github.com/astrand/xclip" ], "status": "broken", - "reason": "Plugin contains a non-ARM64 Linux binary: decky-clipboard/bin/xclip.", + "reason": "The exact archive is blocked by its x86-64 xclip binary and root request. Its published backend defaults to auto-starting an unauthenticated clipboard GET/POST API on 0.0.0.0:8765; this was inspected statically and never run on Frame.", "blockInstall": true, "verification": [ "static archive",