# Vishow.top draft 0.1.1 — implementation review

Prepared 2026-09-24. **Review draft; not deployed; no production release validation claimed.**

## Approved layout refinement — 2026-10-03

**Changes:** Updated `public/assets/field-notes.css` and its corresponding public source copy. Refined heading, navigation and button contrast, reduced header/hero/tool spacing, straightened the connection panel, and retained narrow-screen wrapping. Updated this review and the file manifest. Version remains 0.1.1-draft.

**Rationale:** Apply the approved corrected preview to the actual site. The chat preview had also suffered host-style interference; its isolation rules are preview-specific and are not copied into the standalone website.

**Fixed:** The connection panel no longer rotates. Headings, navigation, buttons and the connection panel have explicit readable colors. Desktop spacing is more compact, and small screens retain stacked layouts.

**Verification:** Four existing DOM interaction groups, six structure tests, and the Wi-Fi suite passed, including 12 independent PNG/SVG decode checks. A local DOM/CSS check confirmed six navigation links, dark heading/navigation text, white text on the green primary button, and no connection-panel transform. These checks do not establish pixel-level rendering in a real browser.

**Outstanding:** The cloud browser rejected the local preview address with ERR_BLOCKED_BY_CLIENT. The temporary HTTP server was stopped after that attempt. Actual desktop/mobile browser rendering, native downloads, phone scanning, live service checks and VPS deployment remain pending. No production validation is claimed.

**Rollback:** The complete pre-refinement draft is retained locally as `layout-before-refinement`; the previous saved file versions remain the persistent rollback route. No VPS files or configuration were changed.

## Wi-Fi QR and Field Notes update — 2026-10-03

**Changes:** Added `public/wifi.html`, `wifi.js`, `wifi-core.js`, `wifi.css`, the locally bundled `qrcodegen.js`, `field-notes.css`, and `tests/wifi.test.js`. All main/support pages now link Wi-Fi QR and load the selected Field Notes theme. Homepage tool list, privacy/source notices, package metadata, corresponding source and file index are updated. Backend/CLI reports identify version 0.1.1-draft; provider/probe algorithms are unchanged.

**Rationale:** Visitors can share a Wi-Fi network without sending credentials to a QR service. The approved theme now exists in the actual site instead of only the earlier preview. Deliverables remain separate HTML/CSS/JS files.

**Fixed:** Special delimiters are escaped; SSID whitespace is preserved; UTF-8 byte limits are checked. Hex-like ASCII fields are quoted where appropriate. Open-network codes omit passwords. Edits invalidate previous results, and late PNG callbacks cannot download stale credentials. Clear/pagehide reset sensitive state. Exported codes use black modules, a white background and a four-module quiet zone.

**Verification:** The recovered baseline matched all 73 recorded hashes before editing. On this revision, 21 diagnostics tests and 6 structure tests passed; all four existing DOM groups, three cryptography groups and the service-report import test passed. The new Wi-Fi suite passed validation, 12 independent PNG/SVG decode checks (including escaped delimiters, Unicode/emoji, open/WEP and raw WPA keys), and DOM tests for exports, stale callbacks, edits, visibility, clear and navigation. PNG drawing was exercised through an in-memory canvas implementation; SVG was rasterized independently with resvg. These are not substitutes for native-browser canvas/download testing. JavaScript and Bash syntax passed. Existing API tests were not rerun because this update does not change API logic and FastAPI test dependencies are absent.

**Outstanding:** The isolated Chromium download again returned an invalid archive; no browser was installed, and the sole residual file is a Playwright link marker. No retry beyond the installer's own attempts was made. Actual browser rendering, native downloads and physical phone joins remain unverified. Live provider credentials, AI/media availability and deployment validation remain outstanding as previously documented. This is a review draft, not a validated production release. No deployment or server mutation occurred.

**Rollback:** Restore the previous draft files from their saved version history or the local `wifi-baseline` copy. No live website changes require rollback. Final source-tree hashes/modes and `check.sh` executable mode are recorded in MANIFEST.json; no compressed archive is produced.

---

## Service-check follow-up — 2026-09-24

**Changes:** The local checker now follows at most two same-host HTTPS redirects, records separate endpoint evidence, adds the uploaded script's OpenAI API-region, Netflix title and Reddit chat-page probes, and labels YouTube/Prime Video page-region hints. The browser importer, evidence display and Bash output retain the extra results. No credentials or paid requests were added.

**Rationale:** An API restriction cannot establish whether a different web product works. Redirects need a bounded destination policy. Page metadata and title responses can provide evidence without proving playback.

**Fixed:** Malformed redirects no longer crash classification; unrelated redirect hosts are not fetched. Supplementary probes stop after rate limiting or a challenge. Conflicting page-region hints remain unknown. Imported probe fields are bounded and rendered as text.

**Verification:** 21 diagnostic tests and 5 structure tests passed on this revision, including 7 new service-probe tests. The new JavaScript report-import test passed; all 3 cryptography groups and Bash/JavaScript syntax checks passed. Historical API and DOM results below belong to the earlier draft: their isolated dependencies are absent in the restored workspace, so those suites were not rerun. No installation retry was made. Browser rendering and live endpoint checks were skipped because the environment's previously established browser/network limitations remain unresolved.

**Outstanding:** The service probes are not live-validated. Most AI services still have website-response checks only; actual chat/playback availability, authoritative region and Native/ViaDNS detection remain unfinished. This is an incremental draft improvement, not a completed availability tool or production release. The pre-change draft is retained locally as `vishow-top-before-service-update` for rollback.

## Changes

- `public/index.html`: new homepage with the connection overview and four tool links. The previous homepage’s password generator moves to `public/password.html`.
- `public/ip.html`: three tabs; Sections 01 + 02 share a card with two headers. Section 03 retains separate provider scores; Section 04 retains the risk-factor matrix.
- `public/access.html`: Section 05, nine AI services and seven media services, local JSON report import, browser observations, and per-service evidence.
- `public/totp.html`: retained six-digit, 30-second SHA-1 TOTP functionality.
- `public/assets/`: separate CSS/JavaScript; no external fonts or UI libraries. A local service catalog controls the available tests.
- `backend/app.py`: FastAPI lookup API, JSON-safe request properties, bounded memory cache, request limits, explicit local-proxy trust and no access logging in the supplied service command.
- `backend/diagnostics.py`: direct-provider adapters, typed field parsing, curl time/body limits, explicit routing, and conservative service-response classification.
- `check.sh`: Bash interface and terminal Sections 1–5, with JSON output. Structured parsing and request coordination use Python; jq formats the terminal tables.
- `deploy/`: review candidates for Nginx, a systemd Unix-socket service and an empty credential template. No server configuration has been applied.
- `LICENSE`, `NOTICE.md`, `prepare_source.py`: attribution and allowlisted corresponding-source publication.

## Rationale

- Tabs implement the approved layout and avoid a long vertical report. Data-provider disagreements remain visible.
- IPinfo Lite is restricted to the eight selected fields; it is not treated as a source of VPN flags or reputation scores.
- Credentials belong on the server or local checker. The original author’s intermediary query endpoints, scraped demo keys, counters, advertisements and report uploader are removed.
- JSON and numeric parsing use data operations instead of inserting remote text into shell or AWK programs.
- Service tests run locally or in the visitor’s browser. The website backend does not imply that it can test access from an arbitrary IP.
- Successful HTTP responses remain “Response only.” A generic 403, favicon response, timeout or mention of VPN does not establish availability or a regional block.

## Fixed

- Missing/null risk scores no longer become zero or “Low.” Unknown flags remain distinct from false.
- The IPQS score is taken from its own response instead of the wrong exported variable in the uploaded script.
- Explicit-IP queries validate returned IPs where supplied; DB-IP lookup no longer silently checks the backend’s own address.
- Data returned by providers is not evaluated as executable shell/AWK text.
- Source credentials are kept out of curl process arguments and returned errors. Curl ignores `.curlrc` and implicit proxy environment variables.
- TLS errors, challenges, rate limits, transport errors and explicit country errors retain separate statuses.
- `/all.json` uses proper JSON escaping for request headers.
- Untrusted report strings are rendered as text; report files remain local to the browser.
- Stale asynchronous TOTP results cannot overwrite a newer/invalid secret; invalid-secret messages are not replaced by countdown text.
- Empty password-character selections cannot copy a previously generated password.

## Initial draft verification (before the service-check follow-up)

| Check | Result |
| --- | --- |
| Python backend/diagnostic/structure tests | 27 passed |
| JavaScript cryptography groups | 3 passed, including all six RFC 6238 SHA-1 vectors |
| DOM interaction groups | 4 passed: IP report/tabs, service reports/observations, passwords, TOTP state |
| Bash syntax | Passed |
| JavaScript syntax | Passed for the page modules |
| Python compilation | Passed |
| Local CLI JSON report | Passed with an explicit public test IP and all provider credentials absent; no provider requests made |
| Local page/asset/source links and service CSP origins | Passed structural checks |
| Script mode | `check.sh` is 0755 in the prepared tree |
| Direct-network smoke check | ChatGPT request returned `dns_error` in the temporary build environment; no availability conclusion drawn |

The test runtime was Python 3.12.14, Node.js 24.19.0, Bash 5.2.21 and curl 8.5.0. FastAPI 0.141.1, Uvicorn 0.53.0 and HTTPX 0.28.1 were installed in an isolated project environment. The API tests emitted a non-failing upstream test-client deprecation notice about HTTPX; the production API does not use HTTPX.

## Baseline comparison

The supplied archive contains three HTML files and one CSS file, all mode 0644, under `vishowTool/`. Those source bytes were not changed. The draft is a separate tree.

| Baseline | SHA-256 |
| --- | --- |
| `vishowtop.tar.gz` | `832aeadcb991418ea2ee72924f1a26fdc97e7c3082a4a1d13c2b5d68d63e52a7` |
| `vishow.top.conf` | `1fbed02b79268a4e337eb3906883e521c5a451b637a9897058756ccda628a6c5` |
| `Pasted markdown(5).md` | `d2b00132c2f5390625f84cd04bab1f59abbbb49f0df249870657fb70bfa984be` |

Preserved endpoint names: `/ip`, `/ua`, `/port`, `/lang`, `/referer`, `/encoding`, `/mime`, `/forwarded`, `/host`, `/all.json`. The homepage changes purpose; the password generator’s new route is `/password.html`. TOTP stays at `/totp.html`; IP reports stay at `/ip.html`.

No release archive is supplied, following the preference for separate files. `MANIFEST.json` records the prepared file tree, hashes and modes. No archive-based production-release validation is claimed.

## Outstanding

1. **API credentials and real responses:** no user provider credentials were supplied. Keyed integrations and account-specific entitlements have not been verified live. Scamalytics requires the operator’s exact account endpoint. Missing integrations remain visible and disabled, not silently substituted.
2. **Section 05 functionality:** this draft provides response/connectivity diagnostics and limited page-region hints, not authenticated chat/playback verification. Authoritative service-region and Native/ViaDNS detection are not implemented. This is a material difference from the original script’s advertised unlock report.
3. **Real-browser rendering:** the Chromium download returned an invalid/empty archive. It was not installed; only a Playwright link marker remained in the isolated test directory. No further browser-download retry or global browser installation was performed. DOM checks passed, but visual layout, actual browser CSP behaviour and mobile rendering remain unverified.
4. **Target-server validation:** Nginx is not installed in the build environment. `nginx -t`, systemd startup, the Unix socket, real-client-IP propagation and the production HTTPS endpoints have not been tested. The supplied deployment files must be checked against the live server before installation.
5. **Live service availability:** a direct-network smoke request failed at DNS resolution in the restricted build environment. Further direct live service checks were therefore not performed here. No build-environment result establishes availability on the user’s IP. Run the checker from the intended connection and review ambiguous results.
6. **Source publication and credentials:** the generated public source tree must accompany deployment. The credential file must stay outside both the public root and the source tree.
7. **Release approval:** delivery/deployment as a production release remains subject to the user’s final approval and completion of the relevant checks above.

The prepared work is suitable for source review and further integration testing. It is not labelled a validated production release.