wacli.me alpha

Changelog

Every release and every incident, dated. The project is young — this list starts where the project starts, and it is not padded.

18 September 2026

0.2.0 — link it yourself current

  • Self-service linking at /connect: scan a QR code, get an endpoint. No operator in the loop.
  • The QR is streamed live with a visible countdown and replaced automatically when WhatsApp expires it.
  • OAuth 2.1 with dynamic client registration and PKCE — add the server in a client, authorize in the browser, done. Nothing to copy.
  • Unauthenticated requests now answer with WWW-Authenticate pointing at the resource metadata, so clients find the authorization server themselves.
  • Sending is chosen at link time instead of being requested afterwards.
18 September 2026

0.1.0 — first running alpha

  • MCP gateway over Streamable HTTP, stateless, one server instance per request.
  • Bearer-token authentication; one isolated wacli store per token, constant-time comparison.
  • Five read tools: account_status, list_chats, list_messages, search_messages, search_contacts.
  • send_message implemented but registered only for accounts with explicit write access.
  • Reads invoke the CLI with its read-only guard, so a tool call cannot mutate a store.
  • Pinned to wacli 0.18.2, built from source with the sqlite_fts5 tag.
  • Website, documentation, tool reference and self-hosting guide published.
18 September 2026

Fixed: JSON envelope leaked into tool results

  • The CLI wraps responses in {success, data, error}. Tools returned that wrapper verbatim, so clients had to unwrap it and a failed call still looked successful.
  • The gateway now unwraps the envelope and turns success: false into a real tool error.
18 September 2026

Fixed: stale pages behind the edge cache

  • HTML was served with a five-minute cache lifetime, so updates did not appear.
  • HTML is now no-cache; static assets keep their cache lifetime.
Unreleased

In progress

  • Per-account sync daemons managed by the service instead of by hand.
  • Publishing the gateway repository under MIT.
  • Token rotation and revocation from a page instead of by email.

Dates are the day a change went live, not the day it was written. Incidents are listed with the same weight as features — see status for what is running right now.