wx-cli v0.1.11 Released: Making opencli + wx-cli Even More Powerful

The main dish is wx biz-articles — now you can fetch the full content of WeChat Official Account article messages with a single command. With hundreds of unread push notifications piled up in your subscription feed, your Agent no longer requires manual copy-pasting; it can batch-pull them for summarization, archiving, or feeding into a retrieval pipeline.

Group messages now fill the missing piece: the sender’s group nickname / group card will be included. Previously, when an Agent retrieved a group message, it only saw the wxid and text, with no clue who said it or in which group; now it carries full context.

Quoted messages (type=57) previously showed only a bare “quoted” with nothing else; now the original quoted text is fully displayed. The subtype parsing for type=49 appmsg (files / merged chat history / mini-program cards) is also more complete.

For links / article favorites / appmsg cards, previously only the title and thumbnail were available; now the machine-readable url field is exposed. This small change carries a big meaning: it connects wx-cli to the entire opencli ecosystem. A forwarded link in a group → opencli web read gets the full text; a link from Weibo / Zhihu / Xiaohongshu → the corresponding site adapter fetches comments and metadata; after processing, you want to send it out → opencli twitter post or opencli lark message send. This is the greatest value of opencli as a unified CLI — the capabilities of different sites are assembled into a pipeline in the Agent’s hands, without having to hack individual scripts each time.

The foundation has also been polished: sudo wx init, correctness and latency of contacts / search / new-messages, daemon lifecycle, Windows scanner, and full SQLCipher decryption have all been stabilized.

npm i -g @jackwener/wx-cli

jackwener/wx-cli

Source: https://github.com/jackwener/wx-cli

wx-cli

Query local WeChat data from the command line

License: Apache-2.0

Platform · Rust (https://www.rust-lang.org) · Sessions · Chat History · Search · Contacts · Group Members · Group Nicknames · Favorites · Statistics · Export

AI Agent Skill

Installable to Claude Code, Cursor, Codex, and other agents via the skills CLI (https://github.com/vercel-labs/skills) with one command:

npx skills add jackwener/wx-cli

Or global installation:

npx skills add jackwener/wx-cli -g

After installation, the agent will automatically read SKILL.md to understand how to install and call wx-cli.

Features

• Zero-dependency installation — single Rust binary, install with one command
• Millisecond response — background daemon persistently caches decrypted databases; reuses cache if mtime unchanged
• AI-friendly — YAML output by default, more token-efficient and readable; --json switches to JSON (for jq processing, etc.)
• Fully local — data never leaves your machine, real-time decryption, no need for full pre-decryption

Installation

npm (recommended, cross-platform)

npm install -g @jackwener/wx-cli

macOS / Linux (curl)

curl -fsSL https://raw.githubusercontent.com/jackwener/wx-cli/main/install.sh | bash

Windows (PowerShell, run as administrator)

irm https://raw.githubusercontent.com/jackwener/wx-cli/main/install.ps1 | iex

Other installation methods

Manual download

Download the file for your platform from Releases (https://github.com/jackwener/wx-cli/releases):

macOS / Linux: chmod +x wx && sudo mv wx /usr/local/bin/

Build from source

git clone [email protected]:jackwener/wx-cli.git && cd wx-cli
cargo build --release
# output: target/release/wx (Windows: wx.exe)

Quick Start

Keep WeChat running, then initialize (only needed once):

macOS (first do an ad-hoc signature on WeChat to allow memory scanning)

# 1. Sign (only once, redo after WeChat update)
codesign --force --deep --sign - /Applications/WeChat.app

# 2. Clear old TCC authorization records (required after re-signing, otherwise WeChat screenshot/call permissions may silently fail)
for s in ScreenCapture Camera Microphone AppleEvents AddressBook \
         SystemPolicyDocumentsFolder SystemPolicyDownloadsFolder SystemPolicyDesktopFolder; do
  tccutil reset "$s" com.tencent.xinWeChat
done

# 3. Restart WeChat and wait for full login
killall WeChat && open /Applications/WeChat.app

# 4. Initialize
sudo wx init

If codesign reports signature in use, first run:

codesign --remove-signature "/Applications/WeChat.app/Contents/Frameworks/vlc_plugins/librtp_mpeg4_plugin.dylib"
codesign --force --deep --sign - /Applications/WeChat.app

After re-signing, macOS TCC privacy authorizations are re-verified against the new code signature, and old records become invalid. Skipping tccutil reset may cause WeChat screenshot/video call/microphone permissions to appear “enabled” but actually be denied. See macOS Permission & Signing Guide for details.

Linux

sudo wx init

Windows (run PowerShell as administrator)

wx init

Verify installation:

wx sessions

You should see the most recent sessions. The daemon starts automatically on first call.

Commands

Messages

wx sessions                        # Most recent 20 sessions
wx unread                          # Sessions with unread messages
wx unread --filter private,group   # Only real person unread (exclude official accounts/folded)
wx new-messages                    # New messages since last check (incremental)
wx history "Zhang San"             # Last 50 records
wx history "Zhang San" -n 2000     # Pull more history
wx history "AI Group" --since 2026-04-01 --until 2026-04-15
wx search "keyword"                # Full-database search
wx search "keyword" -n 500         # Increase search result limit
wx search "meeting" --in "Work Group" --since 2026-01-01

history / search / export all support -n / --limit to specify count. The defaults only prevent excessive output in one go; they are not hard caps.

Each session/message output includes a chat_type field with values private / group / official_account / folded. official_account covers official accounts, subscription accounts, service accounts, and system notifications like mphelper / qqsafe; folded corresponds to “Subscription Folded” and “Group Chat Folded” aggregate entries in WeChat.

In group chats, last_sender, sender, and top_senders in stats will prefer the group nickname (group card). If no group nickname exists in the local database, it falls back to contact remark, WeChat nickname, or username.

Quoted messages will appear in history / search / new-messages output showing both the current reply and the quoted original text:

[Quote] Current reply
  ↳ Sender: Quoted content

--type link / --type file will include variants like links, files, merged chat history, and quoted messages from WeChat appmsg; searching also matches the visible quoted original text after decompression.

Moments (SNS)

Three separate commands distinguishing “notifications” and “posts”:

wx sns-notifications               # Like/comment notifications (default unread only)
wx sns-notifications --include-read -n 100  # Include read
wx sns-feed                         # Last 20 Moments (timeline)
wx sns-feed --user "Zhang San"      # Filter by author
wx sns-feed --since 2026-04-01 -n 100  # Filter by time
wx sns-search "keyword"             # Full-text search in Moments content
wx sns-search "wedding" --user "Li Si" --since 2023-01-01

• sns-notifications returns interaction notifications: type (like/comment), from_nickname, content (comment text), feed_preview + feed_author (corresponding original post)
• sns-feed / sns-search returns Moments posts: author, content (text), media, media_count, location, timestamp; the media field includes url/thumb/key/token/md5/enc_idx/size for each image, for downstream image proxy or offline rendering. media_count = media.len(), counted by valid <image> child nodes per DOM parsing (malformed XML returns 0).

Moments data only covers posts you have scrolled through locally (WeChat app downloads on demand).

Official Account Articles

Official account article pushes are stored in an independent biz_message_0.db and can be queried with biz-articles:

wx biz-articles                     # Last 50 articles
wx biz-articles -n 200              # More
wx biz-articles --account "Fanpu"   # Filter by account name (fuzzy match)
wx biz-articles --since 2026-05-01 --until 2026-05-10
wx biz-articles --unread            # Only unread official accounts, latest 1 per account
wx biz-articles --json | jq '.[].url'  # Downstream consume URLs

Each returned entry includes: account / account_username / title / url / digest / cover_url / time / timestamp / recv_time_str. Multiple-image pushes are expanded into multiple lines.

Attachment Extraction (Images)

Attachment bodies in chats are stored as .dat files under xwechat_files/<wxid>/msg/attach/... and must be decoded using the md5 from the corresponding message_resource.db combined with platform-specific image keys to obtain the original image.

# 1) List image attachments in a session, first get the opaque attachment_id
wx attachments "Zhang San"
wx attachments "AI Group" --kind image -n 100
wx attachments "AI Group" --since 2026-04-01 --until 2026-04-15

# 2) Decrypt and write out a single attachment_id (extension recommended: .jpg / .mp4, etc.)
wx extract <attachment_id> -o ~/Desktop/photo.jpg
wx extract <attachment_id> -o /tmp/x.jpg --overwrite

Each attachments output entry includes: attachment_id / kind / type / local_id / timestamp / time; group chats also include sender. Currently kind is fixed to image; the command name remains attachments to allow future extension to other attachment types without breaking the CLI.

The extract output report includes: md5 / dat_path / dat_size / output / output_size / format (actual detected image format: jpg/png/gif/webp/hevc, etc.) / decoder (actual decoder used: legacy_xor / v1_aes / v2).

Supported decoding levels:

• legacy XOR: Early single-byte XOR, no magic (auto-deduct format by probing the first byte of the file)
• V1 fixed-AES (07 08 V1 08 07): AES-128-ECB + fixed key cfcd208495d565ef
• V2 AES + XOR (07 08 V2 08 07): AES-128-ECB + raw + XOR; AES key derived from platform-specific V2 image key extraction:
  • macOS: kvcomm cache (take uin from filename key__*.statistic → md5(str(uin) + wxid)[:16]) + brute-force fallback (md5(str(uin))[:4] == wxid_suffix enumerate 2^24); xor_key = uin & 0xff, not hard-coded 0x88
  • Windows: Scan Weixin.exe memory matching [A-Za-z0-9]{32|16} candidates, verified against V2 template ciphertext block
  • Linux: No upstream implementation; encountering V2 .dat will report unsupported

Contacts & Groups

wx contacts                        # Contact list
wx contacts --query "Li"           # Search by name
wx members "AI Discussion Group"    # Group member list

The wx members --json output includes:

• username: WeChat internal username
• display: Name used for display, prefers group nickname
• contact_display: Contact remark or WeChat nickname
• group_nickname: Group nickname; empty string if not recorded locally
• is_owner: Whether the member is the group owner

Favorites & Statistics

wx favorites                       # All favorites
wx favorites --type image          # Filter by type (text/image/article/card/video)
wx favorites --query "keyword"     # Search favorite content
wx stats "AI Group"                # Chat statistics
wx stats "AI Group" --since 2026-01-01  # Specify time range

Export

wx export "Zhang San" --format markdown -o chat.md
wx export "Zhang San" -n 2000 --format markdown -o chat.md
wx export "AI Group" --since 2026-01-01 --format json

Output Format

Default output is YAML, which is more token-efficient and readable; --json switches to JSON (for jq processing, etc.):

wx sessions --json
wx search "keyword" --json | jq '.[0].content'
wx new-messages --json

Daemon Management

wx daemon status
wx daemon stop
wx daemon logs --follow

Architecture

wx (CLI) ──Unix socket──▶ wx-daemon (background process)
                              │
                      ┌───────┴──────────┐
                   DBCache        Contact Cache
                (mtime-aware reuse)

The daemon decrypts databases on first use and persists both database and mtime to ~/.wx-cli/cache/. On restart, if mtime is unchanged, it reuses the cache without re-decryption.

~/.wx-cli/
├── config.json          # Configuration
├── all_keys.json        # Database keys
├── daemon.sock          # Unix socket
├── daemon.pid / .log    # PID and logs
└── cache/
    ├── _mtimes.json     # mtime index
    └── *.db             # Decrypted databases

Principle

WeChat 4.x uses SQLCipher 4 to encrypt local databases (AES-256-CBC + HMAC-SHA512, PBKDF2 256,000 iterations). WCDB caches the derived raw key in the process memory, formatted as x'<64hex_key><32hex_salt>'.

wx-cli scans the WeChat process memory via macOS Mach VM API (mach_vm_region + mach_vm_read), Linux /proc/<pid>/mem, or Windows VirtualQueryEx + ReadProcessMemory (requires PROCESS_VM_READ | PROCESS_QUERY_INFORMATION permissions), matches this pattern to extract the key, and the daemon decrypts and caches on demand.

Acknowledgements

This project is inspired by ylytdeng/wechat-decrypt (https://github.com/ylytdeng/wechat-decrypt) and has been redesigned and re-implemented on top of it. Thanks to the original author for their research and exploration.

Disclaimer

This tool is intended for learning and research purposes only, for decrypting your own WeChat data. Please comply with applicable laws and regulations and do not use it for unauthorized data access.