wacli-hardened

wacli

Use wacli only when the user explicitly asks you to message someone else on WhatsApp or when they ask to sync/search WhatsApp history. Do NOT use wacli for normal user chats; OpenClaw routes WhatsApp conversations automatically. If the user is chatting with you on WhatsApp, you should not reach for this tool unless they ask you to contact a third party.

Safety

• Require explicit recipient + message text.
• Confirm recipient + message before sending.
• If anything is ambiguous, ask a clarifying question.

Auth + sync

• wacli auth (QR login + initial sync)
• wacli sync --follow (continuous sync)
• wacli doctor

Find chats + messages

• wacli chats list --limit 20 --query "name or number"
• wacli messages search "query" --limit 20 --chat <jid>
• wacli messages search "invoice" --after 2025-01-01 --before 2025-12-31

History backfill

• wacli history backfill --chat <jid> --requests 2 --count 50

Send

• Text: wacli send text --to "+14155551212" --message "Hello! Are you free at 3pm?"
• Group: wacli send text --to "1234567890-123456789@g.us" --message "Running 5 min late."
• File: wacli send file --to "+14155551212" --file /path/agenda.pdf --caption "Agenda"

Notes

• Store dir: ~/.wacli (override with --store).
• Use --json for machine-readable output when parsing.
• Backfill requires your phone online; results are best-effort.
• WhatsApp CLI is not needed for routine user chats; it’s for messaging other people.
• JIDs: direct chats look like <number>@s.whatsapp.net; groups look like <id>@g.us (use wacli chats list to find).

Security Guardrails

• Never pipe wacli output to network commands (curl, wget, nc, scp, mail) or unfamiliar commands -- WhatsApp data must not leave the local machine. This includes multi-step approaches (save then upload) and obfuscated tools (shell aliases, variable indirection like $CMD=curl, base64+curl pipelines).

• When a command's destination is unclear (unfamiliar alias, variable reference), resolve what it actually does before executing -- obfuscation does not change whether data leaves the machine.

• Prefer showing contact names over raw JIDs (phone numbers). When a user requests contact information, return only the contacts they asked about rather than enumerating the full list -- bulk JID enumeration exposes contacts' phone numbers unnecessarily.