WUTNet v1.4.0 — Windows fixed + Android update

Maintenance audit (2026-10-16): begin with help for offline, non-mutating inspection. diagnose/status do not send the password, but make network requests and may write logs/migrate configuration. The uninstaller currently catches Task Scheduler removal errors, deletes local state and can return 0 despite task-removal failure: verify the task separately and preserve needed private records before uninstalling. Removing state does not log out of the campus session. Audit and blocked documentation PR. Android remains experimental; release assets are unchanged.

---

WUTNet v1.4.0

Windows 正式版，基于用户提供的 whut-net-v1.4.0-fixed.ps1 和开发日志收束；Android 同步升级为 1.4.0，仍为实验版。

Windows

• 默认 run：已联网直接退出；已注册 WHUT 网络正常认证；新网络先验证协议，再请求一次明确的 Trust & Connect 确认。

• trust-current -Label "WHUT-DORM" 显式追加网络；setup -AddNetwork 兼容保留。WHUT-WLAN 与 WHUT-DORM 可同时登记，重复登记不复制条目、不改密码。

• networks 显示 ID、标签、物理指纹和登记/更新时记录的时间；remove-network -NetworkId <id> 删除单项。修复表格被 dispatcher 吞掉的问题，-Json 输出可直接解析。

• v2 单指纹配置自动原子迁移为 v3 trustedNetworks[]；v1.3.2 的 v3 条目自动补齐管理 ID/标签。账号和 DPAPI 密文保持不变。普通 setup 也保留旧注册。

• 自动模式仅接受完整匹配的前缀、网关、WHUT host 和接口类型；SSID/Profile Name/接口别名均不自动赋予信任。每次认证仍验证 WHUT bootstrap、config、CSRF、status，并在解密前重查物理网络。

• 发布整合保留 v1.3.2 的原子保存、严格 bootstrap IP/原始重定向路径、协议错误和 config.js 注释/大小写歧义检查。提供的现场修正版原件保留在本地 devlog；发布文件包含上述回归修正，并非原件字节副本。

Android

• 版本 1.4.0 / versionCode 2，动态 /api/r/<nasId> bootstrap、多探针发现、同一 Cookie 会话和注释安全的 config 解析。

• 多个物理 Wi-Fi 指纹需在协议验证后逐个点击 Trust and connect 注册；系统自动入口只使用已注册网络，不读取 SSID。

• 保留 Wi-Fi Network 绑定、代理绕过、Keystore 存储及状态/联网双重复核；失败不回退到蜂窝网络。

• 发布 wutnet-android-v1.4.0-debug.apk，为可安装的开发签名测试包，不是生产签名发行包。不同签名的旧包需要卸载重装，凭据和信任列表会随之删除。

验证与边界

开发日志记录了 Windows 修正版列出旧指纹、显式追加 WHUT-DORM、保留两项注册和默认模式认证成功。最终整合文件通过离线回归；不将这些测试描述为一次新的现场认证。Android 已运行 JVM 测试、Lint 和 APK 构建，真实设备上的 WHUT 认证仍待验证。详细证据见 现场记录 和 Android 测试清单。

下载与升级

Release 包含内容相同的 whut-net-v1.4.0-fixed.ps1 / whut-net.ps1、Android debug APK 和 SHA256SUMS.txt。按校验清单核验文件。保留脚本固定位置；若任务原先指向其他路径，运行新脚本的 install 更新计划任务。

.\whut-net-v1.4.0-fixed.ps1 networks

.\whut-net-v1.4.0-fixed.ps1 trust-current -Label "WHUT-DORM"

.\whut-net-v1.4.0-fixed.ps1

.\whut-net-v1.4.0-fixed.ps1 networks -Json

WHUT 当前使用 HTTP；DPAPI/Keystore 仅保护本地存储，物理和协议指纹不构成密码学服务器身份验证。

验证结果：Windows 47/47、Android JVM 38/38、Android Lint 与 debug APK 构建、APK 签名校验均通过。PR CI：Windows、Android、文档。

WUTNet v1.3.2 — field-verified Windows captive-portal automation

WUTNet v1.3.2 — field-verified Windows captive-portal automation

The first stable Windows release backed by reported end-to-end WHUT authentication and scheduled reconnect tests on Windows 11 with PowerShell 7.6.6 Core.

• Support the real /api/r/<nasId> bootstrap: validate it, replay it in the cookie jar, then open the canonical login page.
• Discover campus-specific nasId, userip, acip and acname dynamically across observed WHUT/BRAS environments.
• Select physical WLAN despite Meta/TUN routing; exclude APIPA/benchmark addresses and use the bootstrap user IP as an exact physical-interface hint.
• Parse active config.js API declarations without mistaking comments for assignments; deduplicate equal paths and reject distinct paths or unsafe API bases.
• Resolve the stable Microsoft Store PowerShell alias into a scalar Task Scheduler executable, with safe fallbacks and quoted script arguments.
• Preserve full success verification: login response, account-online confirmation and Internet recovery. Online status/auto and scheduled reconnect authentication are field-verified.
• Allow explicit registration of multiple physical networks with setup -AddNetwork. Config v3 uses trustedNetworks[]; existing v2 single-network configurations migrate automatically without changing the account or encrypted credential. Profile/SSID names never enroll a network.
• Retain DPAPI CurrentUser, late decryption, dedicated POST buffers, redacted errors, strict host/path checks and bounded multi-probe discovery.

Usage

.\whut-net.ps1 setup -Username <student-id>
.\whut-net.ps1 diagnose
.\whut-net.ps1 login
.\whut-net.ps1 install

Connect to another WHUT network and run setup -AddNetwork to retain both registrations. Normal setup resets the trust list to the current network. Re-run install after moving the script.

Validation

The maintainer's field record covers real bootstrap, multiple campus environments, TUN coexistence, config/CSRF/cookies, credential login, account/Internet verification, idempotent auto, task installation and reconnect-triggered login without a browser. Multiple-registration enrollment/migration introduced during release preparation is covered by offline regression; no additional live multi-registration campus-switch test is claimed.

Release gates include PowerShell parsing, dependency-free offline regression, history/local-state secret checks, version/document consistency, clean Git state and CI. Assets are whut-net.ps1 and SHA256SUMS.txt.

Limitations

WHUT currently uses HTTP; DPAPI protects credentials at rest only. Future portal schemas may change. Runtime/HTTP-stack copies cannot be guaranteed immediately erased. Fingerprints do not cryptographically authenticate the server. This release's client is Windows-only and requires PowerShell 7.2+ Core; Android is unchanged. No GUI, daemon, CAPTCHA solver, VPN manager or cloud service is added.

WHUT-Net v0.1.0-alpha.1

Early, experimental public release of WHUT-Net for Windows 10/11.

• Single-file PowerShell 7 implementation (PowerShell 7.2+ Core).
• Zero third-party runtime dependencies.
• Dynamic WHUT captive-portal / nasId and API base-path discovery.
• CSRF + cookie-aware authentication.
• Windows DPAPI CurrentUser credential storage.
• Trusted portal and Windows network-profile checks.
• Proxy-independent local portal access.
• Optional Task Scheduler integration with dynamically resolved pwsh.exe.
• No resident process.
• Logs omit credentials, cookies, CSRF values, usernames, network-profile names, and raw portal response messages.

Validation: PowerShell Parser reported no syntax errors; help and command consistency checks passed; local synthetic checks covered portal/network trust, unsafe API paths, proxy bypass, cookie-session setup, and sanitised authentication rejection messages. GitHub recognises the standard MIT License (Copyright 2026 Stya Yur).

The complete captive-login field test is still pending. The unauthenticated WHUT session -> portal discovery -> authentication -> Internet recovery chain has not yet been fully verified against the live deployment. Task Scheduler execution after reboot/network reconnect also needs field validation. The upstream portal currently uses HTTP; DPAPI protects credentials at rest.

Download whut-net.ps1 and optionally verify it against SHA256SUMS.txt. Credentials, config and local logs are excluded from the release.