While still trying to figure out how to create a menu, I'm here to share a new idea...
Some WAFs use kindle.messaging.sendMessage to send messages to lipc. Here's how the adviewer does it:
kindle.messaging.sendMessage('com.lab126.adManager', 'adViewerMessage', buildMsgReq(START_BROWSE, params));
As lipc it something outside the WAF, this is used to send messages for logs and for performing actions.
If we could bind our WAFs lipcId to some properties, we could use lipc to run a script from inside a WAF by sending the corresponding message.
The point is I can't find where all services and all properties are declared.
NB We can already do the opposite by reading messages in a WAF from lipc.
This works, for example, for getting interactions with the search bar