dsh-chatnode-wechat

Chat with, monitor, and approve your DSH agents from WeChat.

A DeepSeek Harness bundle that connects a DSH profile to a WeChat personal account over Tencent's unofficial iLink bot gateway (ilinkai.weixin.qq.com) — the same mechanism hermes-agent and OpenClaw use. Text and images go both ways (inbound images are downloaded, decrypted and handed to the agent; /send sends an image back), session targeting works with /sessions /use /new /stop /status, permission requests are answered with /yes / /no right in the chat, and progress is reported as digest-style messages instead of a tool-call firehose.

你 (WeChat)  ⇄  iLink  ⇄  wechat-gateway  ⇄  wechat-conversation-node  ⇄  DSH agent session

The bundle ships two separable Cordis plugins:

⚠️ Read this first

• One poller per account. iLink allows exactly ONE authenticated poller per bot token. If you also run hermes-agent or OpenClaw on the same WeChat account, one of them gets HTTP 403s and drops messages. Use a dedicated WeChat account for the agent, and never run two instances of this bundle against the same token.
• Unofficial gateway. This rides the same unofficial mechanism as hermes/openclaw; Tencent could restrict the account. Again: use a dedicated account you are willing to lose.
• Unofficial protocol. iLink details are reconstructed from hermes-agent source, not Tencent docs. Recorded transcripts live in test/fixtures/inbound.ndjson so CI never needs a live account.

Install

git clone https://github.com/Jesse-njx/dsh-chatnode-wechat.git
cd dsh-chatnode-wechat
pnpm install && pnpm build
dsh plugin --profile <your-profile> add .

Credentials are stored through the dsh credentials service — never in the patch file. Pair your WeChat account once:

pnpm login          # prints a QR URL; scan it with WeChat and confirm

This writes WEIXIN_ACCOUNT_ID / WEIXIN_BOT_TOKEN / WEIXIN_BASE_URL to $DSH_HOME/.credentials.yaml (via dsh-credentials-local). The bundle resolves them at boot and starts polling automatically.

Configuration

# profile patch (cordis.patch.yml)
plugins:
  dsh-chatnode-wechat:
    allowFrom: ["<your-wechat-id>"]   # hard allowlist, REQUIRED, no default
    digestIntervalSec: 300            # heartbeat summary while a turn runs
    approvalTimeoutSec: 600           # approval prompt timeout → default deny
    maxMessageChars: 2000             # WeChat bubble cap (protocol limit)
    sendChunkDelayMs: 1500            # throttle between outbound bubbles
    # cwd: /path/to/workspace         # working dir for `/new` sessions
    # mediaDir: /path/to/media        # inbound image dir (default $DSH_HOME/attachments/wechat)
    # agentPreset: <preset-name>      # agent preset for `/new` sessions
    # agentProvider / agentModel: ... # model route for `/new` agents

allowFrom is mandatory with no permissive default: an agent that accepts instructions from any WeChat contact is a prompt-injection front door. Messages from non-allowlisted senders are logged and ignored — they are never fed to the model.

Usage

Send text or images to the bot. Everything is zero-config once one session exists — the most recent session is the default target.

Images

• Inbound: send an image to the bot; the gateway downloads and decrypts it (encrypted CDN + AES-128-ECB), persists it under mediaDir (default $DSH_HOME/attachments/wechat/), and hands the file path to the agent, which decodes it with its read_image/vision tool.
• Outbound: /send <absolute-path> sends a local image back to the current contact (AES-encrypt → getuploadurl → CDN upload → sendmessage). Sending depends on the peer's context_token, so it runs inside the gateway process.

Outbound is digest-style, never a mirror of every tool call:

• ⏳ 收到，开始处理… when a turn starts,
• a one-line 🔄 仍在处理中… heartbeat every digestIntervalSec,
• the assistant's actual text (chunked to maxMessageChars, throttled),
• ❌ 出错… / ⏹ 已停止 / ⚠️ 输出截断 on turn end,
• 🔐 #N 需要你的确认 permission prompts, answered in-chat.

Approvals

WeChat personal accounts have no buttons. When a DSH permission request fires, the bridge renders it as a numbered text prompt and waits:

🔐 #1 需要你的确认
工具: bash
原因: run a destructive command
回复 /yes 同意，/no 拒绝（仅一条待确认时也可回复 1/2）
10 分钟内未回复将自动拒绝。

/yes (or 1 while exactly one request is pending) grants allowed-once; /no (2) rejects; a timeout falls back to DSH's default deny. The bridge only answers requests for the agent currently driven by the WeChat user — anything else is delegated down the answerer chain.

Development

pnpm install
pnpm -r build
pnpm --filter @dsh-cowork/chatnode-wechat test   # 36 tests, no WeChat account

• test/fake-ilink-server.ts implements the iLink endpoints (getupdates long-poll, sendmessage, sendtyping, getconfig, QR login, encrypted CDN) and replays test/fixtures/inbound.ndjson; the full inbound→session→outbound loop runs in CI.
• pnpm smoke is the manual live-account script (set WEIXIN_ALLOW_FROM).
• Pin the dsh-base family (@deepseek-ai/* at 0.1.0-rc.6 in this repo) — DSH is a developer preview and upstream breaks are expected.

Risks

Roadmap

• v0.1 (this package): QR login, text both directions, session targeting, commands, approvals, digests, allowlist.
• v0.2: images both directions ✅ (see "Images" above), files both directions, outbound voice replies.
• v0.3: group chats (risk-heavy), multi-account, a hermesclaw-style shared-poller proxy so the bundle can coexist with hermes/openclaw.
• Later: WeCom / DingTalk / Feishu bundles sharing the node/ layer.

License

MIT — see LICENSE.