wxkey v1.4.8

更新

• 加固 WeChat 4.1.10+ PBKDF fallback 与诊断路径。
• 配置写入采用跨进程锁、0600 原子替换，并避免 DB key 与 image key 并发覆盖。
• 收紧提权配置、系统 sudo 与 Shadow WeChat staging/发布边界。
• Go 构建基线升级到 1.26.5。

验证

• 单元测试、race detector、go vet、模块校验与 govulncheck 均通过。
• GitHub Actions CI 已通过。

普通用户无需单独下载本仓；wechat-cli v1.6.20 的 macOS 发布包已固定集成此版本。

wxkey v1.4.6

Highlights

• Add wxkey image-key for deriving WeChat V4 image decode keys without a fresh process-memory scan when local kvcomm data is available.
• Reuse the existing sudo/Keychain no-SIP bootstrap path when a live scan is needed.
• Add tests for image-key derivation and CLI behavior.

Verification

• go test ./... passed locally.
• GitHub Actions CI passed for commit 1c4005b.

wxkey v1.4.5

No-SIP bootstrap hardening.\n\n- Bootstrap now uses a wx-mcp-managed ad-hoc signed WeChat shadow copy by default when the installed WeChat app has official Hardened Runtime.\n- Keeps SIP enabled and preserves the one-time sudo-to-Keychain flow for unattended future setup runs.\n- Leaves explicit resign-wechat as an operator diagnostic command instead of the default bootstrap path.

v1.4.3 — bootstrap diagnostics + elevated home fix

Highlights

Fixes a first-run install failure where wxkey bootstrap reported "no WeChat account directory found under known roots" even when WeChat was correctly installed and logged in, plus diagnostic improvements for common bootstrap failures.

Fixes

• Elevated-child home lookup — when wxkey bootstrap self-elevates via osascript with administrator privileges, the root child now receives the invoking user's HOME and USER through WXKEY_ORIG_HOME / WXKEY_ORIG_USER env vars. Previously the elevated child relied on stat /dev/console to guess the original user, which fails under fast user switching / locked-screen / headless sessions and silently fell back to /var/root — making /Users/<you>/Library/Containers/com.tencent.xinWeChat/... invisible.

Diagnostics

• re-elevate failure detects SSH sessions and prints actionable guidance ("don't add sudo, don't pipe through an AI agent, respond to the desktop password prompt on the Mac itself") instead of surfacing osascript: exit status 1.
• pickAccountRoot not-found error now lists every scanned root with per-subdirectory status (boring / missing db_storage / unrecognized), so users can immediately tell whether their account dir is missing entirely or merely missing db_storage/ (the latter means "open WeChat, send/receive a message to initialize the local DB").

Internal

• Removed leftover developer-workspace path fallbacks and /Applications/WeFlow.app/... legacy dylib fallback from findBundledDylib. Binaries built locally no longer probe these paths.

Used by

r266-tech/wx-mcp v1.4.6+ pins to this release. go install github.com/r266-tech/wxkey/cmd/wxkey@v1.4.3 also picks it up.

---

🤖 Generated with Claude Code

v1.4.2 - wxkey security guidance

• Add SECURITY.md for local key-extraction safety boundaries.\n- Pin README install command to v1.4.2 for reproducible agent installs.