Add clean Windows WeChat local vault skill

[xuewei-ai]

Summary

This is a clean, independent Windows counterpart to yichen-wechat-local-vault, replacing the rejected approach in #10.

• No wx-cli dependency and no code reuse from the rejected Windows implementation.
• No Frida, injection, hooks, drivers, UI automation, message sending, or process-control APIs.
• Read-only key capture uses only PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, behind explicit current-task consent and a mandatory CLI flag.
• Capture aggregates validated matches across every readable Weixin subprocess.
• Keys are accepted only after SQLCipher page-HMAC and SQLite-header validation, then protected with current-user DPAPI.
• DB/WAL/SHM are copied as stable sets only after the user manually exits Weixin.
• WAL headers and native-endian SHM wal-index/checkpoint state are validated. maxFrame and nBackfill prevent stale post-reset WAL capacity from being mistaken for active frames.
• Full and incremental immutable generations are supported. Required Mac-equivalent capability databases gate promotion; unavailable auxiliary databases remain explicitly disclosed.
• The read-only query/export surface matches the Mac skill: contacts, sessions, unread/new messages, members, history, search, stats, Markdown export, digest sources, Favorites, and Moments.

Safety and privacy

• Source Weixin files are never modified.
• Plaintext snapshot connections enforce SQLite URI mode=ro plus PRAGMA query_only.
• Output and key-store paths cannot overlap the source account tree.
• Exports are atomic and refuse existing targets unless --overwrite is explicitly supplied; digest collisions receive a -run-N suffix.
• Raw keys, salts, account names, memory addresses, databases, and chat content are never logged or committed.
• Key storage uses DPAPI plus account-binding entropy.
• Old generations are never deleted automatically.
• Runtime dependencies and transitives are exactly pinned, documented, and represented in an SPDX 2.3 SBOM.

Validation

• skill-creator validation: passed.
• Python compilation and diff checks: passed.
• Windows unit tests: 20 passed in a clean isolated runtime with exactly pinned product dependencies; DPAPI was verified in the current-user Windows security context.
• Coverage includes page HMAC validation, public codec-geometry discovery, multi-process capture aggregation, WAL-only committed updates, validated SHM reset handling, corrupt active-frame rejection, DPAPI round trip/account binding, consent gating, required/optional promotion behavior, per-database SQLite error isolation, output/source path separation, forbidden API scanning, incremental reuse invalidation, enforced read-only query rejection, collision-safe export, every Mac-equivalent CLI subcommand, and Markdown export.

Privacy-safe real local acceptance

Validated locally on Windows 11 / official Weixin 4.1.13.7 with explicit user consent:

• discovered 19 database/WAL sets without publishing the account path;
• captured and DPAPI-protected 11 strictly validated database keys;
• promoted a full generation with 0 required gaps, 9 integrity-checked plaintext databases, and 10 disclosed optional gaps;
• 8 optional gaps had no active key; 2 were FTS databases whose codec extension is unavailable in the standard Python SQLite runtime;
• contacts, sessions, history, Favorites, and Moments all returned non-empty results through read-only/query-only connections;
• a following incremental generation integrity-checked and reused 9/9 unchanged plaintext databases;
• no keys, databases, account paths, snapshots, names, identifiers, or chat content were uploaded or attached.

Implementation lineage

New Windows capture, DPAPI, codec, WAL, and snapshot modules were independently implemented from public Tencent SQLCipher/WCDB source and documentation, SQLCipher design documentation, SQLite WAL/wal-index documentation, and Microsoft Windows API documentation. The query CLI is adapted only from this repository's own Mac skill to preserve its command surface. See PROVENANCE.md and THIRD_PARTY_NOTICES.md.

Remaining external gate

This PR remains a draft only because GitHub Actions for a first-time fork contribution requires an upstream maintainer to approve the workflow run.

[mcncarl]

Maintainer review — head f51cc0cc2a60bdfaf8b824aea38cb0a2168d88e8

Decision: CHANGES REQUIRED — DO NOT MERGE. Do not approve the workflow for this head.

The redesign contains meaningful improvements over #10/#12: I did not find Frida, injection, Weixin launch/suspend/resume control, UI automation, or message sending in the submitted source; the read-only SQLite and page-authentication direction is also better. However, the exact submitted tree is not runnable and still fails the privacy, correctness, provenance, and public-distribution gates below.

1. P0 delivery blocker: the submitted tree is missing secret_store.py

• scripts/windows_vault.py imports KeyStore, account_binding, and fingerprint from secret_store.
• tests/test_secret_store.py imports KeyStore and WindowsDPAPI.
• .github/workflows/windows-wechat-vault.yml explicitly compiles scripts/secret_store.py.
• The root .gitignore contains **/*secret*; git check-ignore confirms that a file named scripts/secret_store.py is ignored.

In a clean checkout, test discovery runs five query tests but three test modules fail to import with ModuleNotFoundError: secret_store; the advertised compile command also fails because the file does not exist. Therefore the PR statement "20 tests passed in a clean isolated runtime" does not apply to this commit.

Required fix: submit the complete implementation under a non-ignored source name such as dpapi_store.py or key_store.py, then update every import, test, workflow, document, notice, and SBOM reference. Do not weaken secret-file ignore coverage globally just to force-add the source.

2. Privacy and object-scope blockers

• digest-source defaults to <cwd>/wechat and persists complete message-bearing JSON/Markdown. This can place private chat content directly inside a Git or synchronized project.
• Chat export defaults to ~/Documents/YichenWeChatVault/exports; Windows Documents may be redirected to OneDrive or another sync provider.
• resolve_chat() silently returns the first exact/fuzzy match. Duplicate display names can cause a command authorized for one chat to read or export another chat.
• Default JSON/Markdown includes sender_username, group username, and conversation identifiers despite the Skill promising not to expose wxid/internal identifiers.

Required fix: use a private %LOCALAPPDATA%\YichenWeChatVault\exports default or require an explicit output path; require separate runtime confirmation for repository, Documents, cloud, network, or synchronized destinations; reject all ambiguous names until one stable internal identity is selected; keep that identity internal and redact it from default replies/logs/exports.

3. Snapshot and query correctness blockers

• Required-database promotion checks only records produced for files that were discovered. A completely absent required DB can produce no failure record and an incomplete generation can still be promoted.
• Query discovery scans only message_*.db, not the required biz_message_*.db family.
• Compressed keyword content can be omitted before decoding, single-chat search applies a limit before Python keyword filtering, and sender_id == "2" remains an unverified direction fallback.
• WAL/SHM checkpoint handling needs independent fixtures covering reset, backfill, corrupt/partial frames, and all committed-frame boundaries; SQLite integrity alone does not prove message completeness.

Required fix: compute the expected required set first and fail closed for every missing item; cover both message DB families; search decoded compressed content without pre-filter truncation; derive sender direction from verified schema/account identity; add adversarial WAL/SHM fixtures independent from the implementation under test.

4. Process-target, CI, dependency, and evidence gates

• Consent is a boolean flag while capture scans every readable process named Weixin.exe; bind authorization to a verified official image path/signature, user/session, and explicit PID set.
• The latest Actions run is action_required with zero jobs, so it is not test evidence.
• Actions are version-tag pinned rather than commit-SHA pinned; Python versions are exact but artifacts have no hashes; the SBOM contains no package checksums.
• The Windows 11 / Weixin 4.1.13.7 acceptance result exists only as prose. No sanitized, reproducible artifact binds it to this exact head.

Required fix: provide a successful clean-clone Windows 10/11 run for the exact new SHA, with sanitized logs/artifacts and no private user data; SHA-pin Actions; install dependencies from a hash-locked file; update SBOM checksums and source references.

5. Provenance, contribution rights, and public-distribution gate

Our comparison did not find evidence of direct textual copying from #10/#11/#12 beyond the documented adaptation of this repository's Mac query CLI. That is useful positive evidence, but it does not prove clean-room separation. The same fork/history, floating upstream references, unsigned commits, and lack of an exposure/access record leave independent provenance and contribution authority unverified.

Provide pinned upstream commit IDs/URLs/access dates, an independent-development record explaining prior-code exposure and separation, and an explicit contributor grant covering use, modification, redistribution, sublicensing, and relicensing by the repository owner.

There is also a separate public-distribution risk: Tencent's 2026-07-27 notice specifically describes the capability class "extract encryption keys from process memory and decrypt local WCDB databases": https://github.com/github/dmca/blob/master/2026/07/2026-07-27-wechat-4.md . This is a rights-holder allegation, not a judicial finding, and GitHub does not endorse the merits of posted notices. Nevertheless, retaining that capability requires an independent legal/repository-risk decision. The lower-risk scope is a read-only tool that consumes a user-provided decrypted snapshot and performs no process-memory key extraction or database decryption.

Evidence required before requesting another review

Please push a new commit only after all of the following are true:

1. A fresh clone contains every imported source file; git status --ignored shows no required source being ignored.
2. Compile, full unittest discovery, privacy tests, adversarial fixtures, and Skill validation pass on the exact head.
3. GitHub Windows CI executes real jobs and succeeds; attach sanitized logs tied to the SHA.
4. Output destinations, ambiguity handling, identifier redaction, required-DB coverage, query completeness, and process targeting are fixed and tested.
5. Provenance, contributor rights, dependency hashes, SBOM, and public-distribution review are documented.

Keep this PR in Draft. If the capability is materially narrowed (recommended), open a new clean PR and include a requirement-to-evidence table. Do not request workflow approval or maintainer review for the current head.