Wagate v0.2.0 — Multiple numbers and core WhatsApp messaging (macOS and Windows)

Wagate v0.2.0 runs several WhatsApp numbers side by side, brings the inbox up to the core of WhatsApp Web, and adds CSV broadcasts, a public API over Cloudflare Tunnel, and scheduled AI posts for groups.

Inbox

• Photos, stickers, videos, voice notes and documents. Open photos full size and save attachments to Downloads. Locations, contacts and polls show as cards.
• Reply to a message and see what each reply quotes; click a quote to jump to the original.
• Reactions, sent / delivered / read ticks, and edited and deleted messages.
• Send photos and files up to 16 MB: pick a file, paste an image, or drag it into the chat.
• Unread counts with an Unread filter. Opening a chat marks it read.
• Forward to up to five chats, edit your text within 15 minutes, delete for everyone or just for you, and copy text.
• @mentions shown by name, WhatsApp formatting (bold, italic, strike, code), clickable links, and an emoji picker.
• Scroll up for older messages, or ask your phone for history this device doesn't have yet.
• Contact names instead of numbers, group senders with their own colours, and chats ordered like WhatsApp, with unlimited pins.

Multiple numbers

Add a profile for each WhatsApp number and switch between them. Each has its own chats, connection and settings. API keys can be limited to particular numbers, and requests choose one with the X-Wagate-Profile header.

Broadcasts and groups

• CSV broadcasts: personalised messages with paced sending, pause/resume, delivery tracking, and a send log you can export.
• Bulk add group members from a CSV, or add people straight from a group chat.
• Group automation: scheduled AI-written posts, sent automatically or after your approval.

Public API

• Cloudflare Tunnel gives the API a public HTTPS address without opening a port. Only API-key routes are published.
• New endpoints for replies, sending media, downloading media, reactions, edits, deletes and forwards. Chats include unread counts.
• Fixed: the tunnel no longer stops moments after going online.

Install

Windows (new)

Download Wagate_0.2.0_x64-setup.exe (64-bit Windows 10 or 11) and run it. The installer sets up Microsoft Edge WebView2 if your PC doesn't have it yet.

This build is unsigned. Windows SmartScreen will warn on first run: click More info, then Run anyway. Wagate keeps the key that protects your WhatsApp session in Windows Credential Manager.

The Windows build is new in this release and has had less testing than the Mac one. Please report anything that doesn't work.

macOS (Apple Silicon)

Download Wagate_0.2.0_aarch64.dmg, open it, and drag Wagate to Applications.

This build is unsigned and un-notarized. macOS Gatekeeper will block it on first launch. To open it anyway, right-click the app, choose Open, then Open again, or run

xattr -dr com.apple.quarantine /Applications/Wagate.app

On first launch macOS asks for access to Wagate's key in your keychain. Choose Always Allow; it holds the key that protects your WhatsApp session.

Existing installs keep their database, paired WhatsApp session and stored keys. The database upgrades automatically, and your existing data becomes the Main profile.

Full changelog: v0.1.1...v0.2.0

Wagate v0.1.1 — Copilot request guard

Wagate v0.1.1 adds a request guard to the AI Copilot, so people messaging your WhatsApp account cannot turn your OpenRouter key into a general-purpose assistant.

Copilot request guard

Keep Copilot to chat replies is on by default, in AI Copilot settings. Before any request reaches OpenRouter, the incoming message is screened locally and skipped when it:

• asks for programming help — writing, fixing, or debugging code, scripts, SQL, and the like,
• asks for essays, homework, articles, or other long-form writing, or bulk translation and summarising,
• tries to override or expose Copilot's instructions ("ignore all previous instructions", "what is your system prompt", persona and jailbreak attempts), or
• exceeds 2,000 characters, which is a pasted document rather than a chat message.

A skipped message produces no draft and no API spend; the reason appears in the app's alerts and you reply yourself. Screening happens before the message is queued, so a flood of such requests cannot crowd out real ones.

Two further layers back it up: fixed scope instructions are prepended ahead of your own prompt, where the conversation cannot rewrite them, and a generated reply that comes back as code is discarded rather than offered as a draft.

Matching is pattern-based, running locally at no cost, and is deliberately conservative — ordinary messages such as "send me the OTP code" pass through. English and Malay phrasing are both covered. Clearing the checkbox removes all three layers and restores v0.1.0 behaviour.

Install

Download Wagate_0.1.1_aarch64.dmg (Apple Silicon), open it, and drag Wagate to Applications.

This build is unsigned and un-notarized. macOS Gatekeeper will block it on first launch. To open it anyway: right-click the app → Open → Open, or run

xattr -dr com.apple.quarantine /Applications/Wagate.app

Existing installs keep their database, paired WhatsApp session, and stored keys; the guard is enabled on upgrade.

Full changelog: v0.1.0...v0.1.1

Wagate v0.1.0 — macOS (Apple Silicon)

Wagate v0.1.0 — the first release of the local-first WhatsApp desktop gateway (Tauri 2 + React + a compiled Bun sidecar with Baileys, SQLite, and an OpenRouter Copilot).

What's in it

• WhatsApp pairing via QR (Linked Devices), with the encrypted session restored on launch. Disconnect pauses reconnection while keeping credentials; Reset session removes them.
• Local REST API bound to 127.0.0.1:8787 only, with scoped API keys (chats.read, messages.read, messages.send). Only SHA-256 hashes are stored, and revocation is immediate. Browser-origin requests are rejected, and /internal/* stays desktop-only.
• Chats and history persisted to SQLite (WAL, foreign keys, versioned migration) with stable cursor pagination and an SSE event stream.
• AI Copilot (OpenRouter): opt-in per conversation, draft-only. No tool calls, no autonomous loops, no automatic sends — every draft needs explicit approval.
• Encrypted secrets: WhatsApp/Signal credentials and the OpenRouter key use AES-256-GCM, with the master key held in the macOS Keychain. There is no plaintext fallback.

Install

Download Wagate_0.1.0_aarch64.dmg (Apple Silicon), open it, and drag Wagate to Applications.

This build is unsigned and un-notarized. macOS Gatekeeper will block it on first launch. To open it anyway: right-click the app → Open → Open, or run

xattr -dr com.apple.quarantine /Applications/Wagate.app

Bun and all dependencies are embedded — no Node or Bun installation is needed to run it.

Scope and known limits

This is the v0.1 MVP. Autopilot, webhooks, tunneling, MCP, multiple accounts, and media processing are later milestones.

• Apple Silicon (arm64) macOS only. Windows and Intel macOS builds are not published here, and Windows packaging/credential storage is unverified.
• Account-based acceptance is still pending: real message delivery, paired-session restart, and live Copilot inference remain unverified. See docs/acceptance.md.
• Send success means provider acceptance, not recipient delivery. Do not blindly retry a timed-out send — check delivery first to avoid duplicates.
• SSE is not durable; re-fetch history after reconnecting. Keep the desktop app open for integrations to work.
• Message contents are stored in plaintext in local SQLite; full-disk encryption is a separate concern.

Verified before release: 22 backend tests / 81 assertions, typecheck across app and sidecar, production frontend build, and the optimized native bundle.