[fliaping]

概要 / Summary

将 WeHarbor 迁移到原生 Selkies 2.0 基础镜像，并以 Alpha 0.2.0 作为数据应用；附带 proot-apps 评估结论（WeChat 与 Alpha 继续原生安装）。

Moves WeHarbor to the plain Selkies 2.0 base image and uses Alpha 0.2.0 as the data app (Alpha replaces the previous data app). Also records a proot-apps evaluation (WeChat and Alpha stay natively installed).

变更 / Changes

• 基础镜像 / Base: ghcr.io/linuxserver/baseimage-selkies:debiantrixie (Selkies 2.0.0, Debian trixie), pinned by digest; no longer based on wechat-selkies.
• WeChat 4.1.13.23: official deb, unmodified, sha256-pinned (versions.lock.json), installed natively.
• Alpha 0.2.0: official deb from xunchahaha/alpha-releases v0.2.0, unmodified, sha256-pinned (9d79a56b…80d6). Launched with --password-store=gnome-libsecret; an unencrypted gnome-keyring collection is seeded so no keyring password dialog blocks startup. The previous data app's polkit rules/service are removed.
• API: Alpha binds 127.0.0.1:5031 inside the container; nginx proxy on 5032 rewrites Host and rejects any Origin header (403); compose publishes ${API_PORT:-5031} → 5032 on loopback. Skill is now skills/alpha-api (route parameters not yet verified against a live account).
• Desktop integration: new init-weharbor-profile s6 oneshot migrates old openbox autostart/menu (keeps .legacy-<ts> backups) and settings from the legacy data-app directory → .config/weharbor; dock/window helpers use Alpha window class alpha-desktop; healthcheck checks Alpha /health.
• proot-apps evaluation (docs/proot-apps-evaluation.md, tests/proot/run-proot-eval.sh): Alpha's key helper/worker runtime guard fails (status -103, KEY_RUNTIME_POLICY_REJECTED) under PRoot 5.1.0 and proot-next 0.3.2, so Alpha cannot be a proot app; the catalog wechat app is an unpinned AppImage. Decision: keep both native.
• CI: workflow_dispatch gains an optional image_tag input (rejects latest/edge) for manual non-latest publishes.
• Docs (README, first-run, operations, THIRD_PARTY_NOTICES, AGENTS) rewritten for Alpha + Selkies 2.0.

迁移 / Migration

• .env: the old API port / autostart variables become API_PORT / AUTO_START_ALPHA; auto-login/nightly variables removed. See .env.example.
• Existing /config profiles keep the WeChat login; legacy openbox files are migrated automatically with backups. Back up ./data before upgrading.
• Alpha needs its first-run wizard completed once in the desktop (with WeChat logged in) before key retrieval and API work; its API token is encrypted by Alpha — put a copy in /config/.config/weharbor/alpha-api-token or ALPHA_API_TOKEN for the notification bridge/skill.

验证 / Verification

• scripts/check.py (51 tests) and scripts/smoke-test.sh (fresh profile + restart) pass locally.
• Local container: desktop 401 without / 200 with credentials; WeChat shows the QR or saved account; Alpha reaches its wizard; API proxy rejects Origin (403) and enforces the token.
• Not yet verified: Alpha's actual DB-key retrieval and live API routes (need a completed wizard with a logged-in WeChat).

风险 / Risks

• Alpha 是闭源软件 / Alpha is closed source: an unsigned Electron app; the deb declares License: unknown. It reads WeChat's process memory (ptrace / process_vm_readv) to obtain the database key, contacts its license/update servers (raw.githubusercontent.com/xunchahaha/alpha-releases, a mirror at 189.24.72.59), has a telemetry setting, and enables anti-recall DB writing by default. Review before trusting it with account data.
• 到期 / Expiry: Alpha 0.2.0's key helper has a built-in expiry 2026-11-15T00:00:00Z = 2026-11-15 08:00 (UTC+8); after that key retrieval will stop until Alpha is updated and re-pinned.
• 再分发 / Redistribution: because Alpha's license is unknown, this PR does not re-host the Alpha deb; builds download it from the upstream release URL and verify the sha256. Published images contain the unmodified Alpha and WeChat packages; publishing images publicly may count as redistribution of both, so check the terms before making images public.
• Alpha HTTP API parameters in the skill come from static analysis and may differ.

镜像 / Image

Manual CI publish (workflow_dispatch, image_tag=selkies2-alpha): ghcr.io/fliaping/weharbor:selkies2-alpha = :sha-e1cbddc @ sha256:b5ab9b156ea245b79f1e3777ba81d302b319401fb51504b558264729b31bd6b3. edge/latest unchanged. Later commits only touch the smoke test, scripts/init.sh and .env.example (a password starting with - breaks the base image's openssl passwd htpasswd step).