Skip to content

Wagate v0.1.0 — macOS (Apple Silicon)

Choose a tag to compare

View all tags
@cyberfly cyberfly released this 07 Sep 04:52
· 23 commits to main since this release
v0.1.0
d199096

Wagate v0.1.0 — the first release of the local-first WhatsApp desktop gateway (Tauri 2 + React + a compiled Bun sidecar with Baileys, SQLite, and an OpenRouter Copilot).

What's in it

  • WhatsApp pairing via QR (Linked Devices), with the encrypted session restored on launch. Disconnect pauses reconnection while keeping credentials; Reset session removes them.
  • Local REST API bound to 127.0.0.1:8787 only, with scoped API keys (chats.read, messages.read, messages.send). Only SHA-256 hashes are stored, and revocation is immediate. Browser-origin requests are rejected, and /internal/* stays desktop-only.
  • Chats and history persisted to SQLite (WAL, foreign keys, versioned migration) with stable cursor pagination and an SSE event stream.
  • AI Copilot (OpenRouter): opt-in per conversation, draft-only. No tool calls, no autonomous loops, no automatic sends — every draft needs explicit approval.
  • Encrypted secrets: WhatsApp/Signal credentials and the OpenRouter key use AES-256-GCM, with the master key held in the macOS Keychain. There is no plaintext fallback.

Install

Download Wagate_0.1.0_aarch64.dmg (Apple Silicon), open it, and drag Wagate to Applications.

This build is unsigned and un-notarized. macOS Gatekeeper will block it on first launch. To open it anyway: right-click the app → Open → Open, or run

xattr -dr com.apple.quarantine /Applications/Wagate.app

Bun and all dependencies are embedded — no Node or Bun installation is needed to run it.

Scope and known limits

This is the v0.1 MVP. Autopilot, webhooks, tunneling, MCP, multiple accounts, and media processing are later milestones.

  • Apple Silicon (arm64) macOS only. Windows and Intel macOS builds are not published here, and Windows packaging/credential storage is unverified.
  • Account-based acceptance is still pending: real message delivery, paired-session restart, and live Copilot inference remain unverified. See docs/acceptance.md.
  • Send success means provider acceptance, not recipient delivery. Do not blindly retry a timed-out send — check delivery first to avoid duplicates.
  • SSE is not durable; re-fetch history after reconnecting. Keep the desktop app open for integrations to work.
  • Message contents are stored in plaintext in local SQLite; full-disk encryption is a separate concern.

Verified before release: 22 backend tests / 81 assertions, typecheck across app and sidecar, production frontend build, and the optimized native bundle.

Assets 4
Loading