WeChat Chat Export

Give nontechnical users a local, read-only workflow. The user chooses the account, conversation, time range, message types, and whether attachments may be copied. Do not ask them to find database files or run shell commands themselves. Use Codex's bundled workspace Python runtime when available; do not ask a nontechnical user to install Python or packages manually.

1. Run scripts/wechat_export.py onboard --json. If it reports needs_fixed_drive_scan, explain the bounded read-only scan in one sentence, obtain confirmation, and rerun with --scan-fixed-drives.
2. When exactly one usable active account exists, use it without asking the user to interpret paths. If several exist, show opaque IDs, freshness, and path hints. After local-path disclosure is confirmed, rerun onboarding with --show-paths and use every message database in its database_plan.
3. If the user already has a database key, never ask them to paste it into chat or place it on a command line. Use the local hidden-entry flow.
4. Prefer a verified supplied key. Use automatic key discovery only after explicit authorization for the exact read-only method and databases reported by the tool.
5. List conversations and preview counts before reading bodies. Resolve duplicate display names with opaque conversation IDs; do not expose internal usernames. Treat every message_N.db containing the selected Msg_<md5> table as one conversation: merge chronologically and deduplicate by stable message ID. Map ordinary-language media requests strictly: 图片 means image messages only; 表情 means emoticon messages only; 视频 means playable original video only; and 视频封面 means the video's image thumbnail only. Never add neighboring media kinds merely because their files share an image extension. A request for 语音转文字, 语音转写, or equivalent means include audio, copy only the selected voice blobs after attachment confirmation, and enable the bundled local transcriber after separate confirmation to process voice content. Default to language zh; use auto only for clearly mixed-language audio or when the user requests automatic language detection.
6. Export only the approved scope. Attachments and image-key discovery require separate confirmation. Remote media completion requires another explicit network confirmation and stays disabled otherwise. Preserve the original database and media files unchanged.
7. Return a clickable ZIP link and a short summary of included and excluded counts. For mixed or large attachment exports, prefer separate media ZIPs while keeping every selected media message and its attachment mapping in the records ZIP. Translate failures into plain language with one safe next action; keep raw diagnostics redacted and never make the user debug a command line.
8. Report missing, expired, or unsupported media explicitly rather than silently omitting it. Never report not_found when a targeted media directory could not be read completely; use index_incomplete and one safe next action instead.
9. Voice transcription must remain offline. Use the release-bundled SILK decoder, whisper.cpp executable, and multilingual model; never send voice bytes or generated text to an online transcription API. Preserve the original .silk beside the machine-generated transcript for verification. Clearly label the result as machine generated, warn that it may contain errors, and preserve per-message failure statuses without aborting the rest of the export.

Read references/security-modes.md before any key or process operation. Read references/export-contract.md when producing an export. Read references/discovery.md when discovery returns multiple, stale, or no account candidates. Read references/compatibility.md before retaining a decrypted database or interpreting an unknown schema. Read references/selection.md when resolving a contact, time range, or message-type scope. Read references/media.md before searching for or copying attachments. Read references/key-discovery.md before requesting any process-memory access or handling an unknown WeChat build.