0.42.0

Changed — may break callers

• A readonly level no longer stops a sync (cli-core 0.662.0, was 0.659.0). Commands that only fetch from
  WhatsApp into the local store (sync, messages sync, contacts sync, metadata sync, store gaps repair,
  --sync-first) run at readonly; deny still refuses them. Commands that write the owner's files or call another
  service stay blocked by readonly. A profile that used readonly to stop syncing sets the key to deny.
• Dates in list queries read the computer's zone (cli-core 0.661.0). today and a bare date in tasks list,
  chats list and the other list queries started in UTC and now start at local midnight, as search does.
• The MCP tool messages_photo takes attachment, from 1 (cli-core 0.661.0), as attachments_show does. It
  took index from 0.

0.41.0

Changed — may break callers

• Deleting messages no longer asks, and enabled reply rules send (cli-core 0.659.0, was 0.656.0). messages delete
  go ahead without a question or --allow-dangerous; a profile that wants the question
  sets messages.delete: ask. replies.send is now allow, so serve sends the replies of the rules you turned on;
  a new rule still starts off, and replies.send: deny stops every automatic reply. See the
  cli-core changelog.

Fixed

• A shared config with a small slip is mended when it is read. ~/.config/WireCat/config.json with a
  byte-order mark, a comment, a trailing comma or a missing comma between two lines is fixed in place, the old file
  kept beside it as config.json.bak-<time>. Other damage names its line, column and the likely fix.

0.40.0

Added

• The first screen lists pbx, the Asterisk tool, under "Works with" (cli-core 0.651.0).
• contracts/wirecat.json lists the hosts cli-core reaches in any tool: npm for upgrade, the model downloads
  and the hosts they redirect to (cli-base 0.99.0). WireCat Desktop shows them beside wa's own.
• wa guide: short scenarios (catch up, find what was said, an agent that cannot send), and a "What you can do"
  block on the first help screen, as tg and max have. The repeated "Getting started" and "For agents" sections are
  gone.

Changed — may break callers

• Built on cli-core 0.656.0 (was 0.651.0). See the
  cli-core changelog.

Fixed

• The pages said linking stops after 45 seconds of quiet. It stops when the phone says its history is complete,
  or after 5 minutes with nothing new (sessions).
• A shared config that cannot be read no longer makes this tool read-only. A WireCat config
  (~/.config/WireCat/config.json) with a byte-order mark, broken JSON, a folder in its place or an older setup
  shape capped every profile at read-only, and an MCP server hid messages sync. Now only the owner's own "read only"
  answer limits a tool, and even then messages sync is offered over MCP: it only reads the messenger into the local
  store (cli-core 0.656.0).

Security

• A run with moved folders never unlinks a device at WhatsApp. session end there deletes only the run's own
  device keys and says to remove the device on the phone. With only WA_CONFIG_DIR or WA_CACHE_DIR set (or
  another HOME beside your own state folder), the run reads your real linked device: session end then answers
  ended: false and says why, and account remove refuses (device.owners) and deletes nothing
  (sessions).
• A Cloud API media download reaches only the host Meta named for it, redirects included. 0.39.0 held it to
  graph.facebook.com, so a media address on any other host was refused. A fetch handed in passes the host check too.
  contracts/wirecat.json lists wa's hosts for WireCat Desktop, and the package ships it.

0.39.0

Changed — may break callers

• Built on cli-core 0.648.0 and cli-base 0.98.0 (was 0.641.0 and 0.93.0). The store stays at version 66. Details in
  cli-core's changelog.
• Local only keeps every model call on this computer. With the switch on (memo models local-only set on), wa's
  model calls, remote embeddings and OpenAI transcription refuse any address that is not this computer before anything
  is sent (local-only.refused).
• Plain http goes only to this computer, for every model call. Enrichment, search harder, linking, reply drafts,
  attachment OCR and remote embeddings refuse an http:// address on another machine (model.address-refused); use
  https, or run the model on this computer.
• Voice messages are heard by the downloaded model first. auto uses the local speech model when it is downloaded
  and asks the messenger only when it is not, and never under local only.
• A mistyped profile is not_found (reason profile.unknown) with the profiles on this computer, not a request to
  link a device; a profile with a linked device counts as one here. The link hint stays in the message for a profile
  that is new on purpose.
• stats tasks show has no --chat: name the chat in the query, stats tasks show -- chat:"Project room".
• store reset is no longer offered over MCP: it needs --yes, which an MCP call cannot pass.
• The Cloud API bot reaches only graph.facebook.com. Its requests go through the host check every other request
  passes.

0.38.0

Added

• Part of a name in from: and chat:, from @wirecat/cli-core 0.640.0. An unquoted value with * or ? is a
  pattern over names: from:Ana* finds «Ana» and «Ana Lopez», chat:*club* every chat with it in the name. A
  pattern that fits nobody fails with the nearest names; one that fits more than 50 is refused as query.too-large.
• A part inside a word in message text, from @wirecat/cli-core 0.641.0. *contract* finds «Contract»,
  «contracts» and «subcontractor», also on a large store, and inside AND, OR and NOT. The part needs three
  letters in a row.
• participants_count in queries, from @wirecat/cli-core 0.638.0. participants_count<10 matches messages in
  chats of fewer than ten people, as WhatsApp last reported the size.
• A run's log keeps the progress of messages sync as sync.progress events, so runs show tells how far it got
  and when.

Changed — may break callers

• wa asks WhatsApp at most 20 times a minute per profile, 10 at once (was 60 a minute, 20 at once). Every request
  counts, across every process of the profile and serve: sends, edits, reactions, contact syncs and requests for
  older history. A script that sends more than 10 messages in a row now waits about 3 seconds before each of the
  rest. requests_per_minute or WA_REQUESTS_PER_MINUTE changes it (the pace).
• Built on cli-core 0.641.0 (was 0.633.0). The store moves to version 66 on first open. What changed in between is
  in cli-core's changelog.
• contacts unlink needs --from person:<uid> or --from person:me, the person the account leaves. Without it
  the command is refused, and the error names who holds the account and the --from to run it again with.
• --pause of messages download --all, attachments download and store gaps repair is 5 seconds by default
  (was 2), the same pause as messages sync, so these commands take about twice as long.
• *part* in message text matches as typed, apart from case and ё/е. It no longer finds «café» for *cafe*.
  Write the letter as the text has it, or search the whole word, which still ignores accents.

Fixed

• Older history comes from the phone more slowly. messages sync <chat> asks for a page 5 to 10 seconds apart
  instead of 2 to 4, as WhatsApp may ban a number that reads fast (limits).
• A clock set back no longer stops wa for hours. A computer that started with its clock ahead refused every
  request to WhatsApp until the corrected clock caught up; the wait is now corrected by the size of the step.
• The engine is built with Go 1.26.11, which fixes GO-2026-6859 in Go's net/http. The engine reaches it through
  whatsmeow's connection and media requests. Nothing changes in how wa behaves.

0.37.0

Added

• muted: in search and stats, from @wirecat/cli-core 0.633.0. muted:false leaves out the chats you muted, so
  stats messages show -- 'date>=30d muted:false' counts only what the sync still reads. stats messages responses
  and stats messages waiting take it too.
• store import, from @wirecat/cli-core 0.633.0. Loads made-up chats, people and messages from a file marked synthetic into a test store, such as Desktop's sandbox; it refuses the owner's real store.

Changed — may break callers

• Built on cli-core 0.624.0 (was 0.618.0). The store moves to version 61 on first open (people ties, additive).
  What changed in between is in cli-core's changelog.
• search messages --timeout 30s may search for up to about 29 seconds. It stopped at 2 seconds whatever time the
  run was given, so a valid query over a large store failed in WireCat Desktop. Without --timeout it stays 2 seconds,
  for agents and MCP too.
• schedule pause <name> and schedule resume <name> take a schedule off its timer and keep it; schedule run
  still runs it. --at repeats: --at 08:30 --at 18:00 runs twice a day.

0.36.0

Added

• A pull request adds its changelog entries as a fragment, changes/<branch>.md. Open pull requests no longer
  conflict under ## Unreleased. pnpm docs:check checks each fragment, and bin/release collects them into the
  version's section. An entry under ## Unreleased still works during the move.

Fixed

• wa serve exits when the build it runs is out of date, so its service starts the new one. Every minute it
  checks whether the shared store moved to a format this build can no longer write, or whether a newer wa is
  installed. If so it logs serve.outdated and exits with code 3, and the systemd unit (Restart=on-failure)
  starts the installed version. Before, a serve ran on 0.30.0 for a day after 0.33.0 was installed and stored nothing.
• After wa store recover run, the store marks what it held from a day before the last deep check that passed as
  not fetched. WhatsApp cannot be asked for its chats, so only what the phone pushes while wa serve runs comes
  back. From cli-core 0.618.0 (was 0.616.0).

0.35.0

Added

• wa account remove --keep-data|--delete-data unlinks a profile and forgets it on this computer. It removes the
  device on WhatsApp's side, then deletes the profile's device keys and folder and what cli-core keeps for it.
  --keep-data leaves the messages in the store, still searchable; --delete-data deletes them. Other profiles stay.
  A profile whose device WhatsApp already dropped is forgotten all the same. A bot profile's Business API token stays:
  it is a separate account. While wa serve holds the profile the command refuses, like session end.
  A run with moved folders only deletes its own keys and does not unlink anything.

0.34.0

Added

• contacts add and contacts rename save a person in your WhatsApp contacts. add uses the name WhatsApp
  shows for them, rename the name you give. It is a WhatsApp contact name: it shows on every device of the account,
  and nothing is sent to the person. For someone saved in the phone's Contacts app, the phone keeps showing that
  app's name. wa refuses the account's own number. contacts remove and import stay refused.

0.33.0

Fixed

• session start waits until the phone says its history sync is done. It used to stop after 45 seconds without a
  push, so a large account that paused longer was cut off while the phone was still linking, and the phone ended with
  "couldn't link device" although wa had reported success. wa now ends the wait on the phone's own completion signal.
  Only when the phone never sends it, wa gives up after five minutes of quiet, says so in a waiting progress line and
  asks you to keep WhatsApp open on the phone until it finishes.
• The guide says a photo and a video group as one album only with text. Without a caption, a phone may show them
  as two messages; with one, they were seen as one album on a phone.