413162826/kevinsu-skills

WeChat Official Account Image API

Use only the official api.weixin.qq.com interface to create and verify image message drafts. No browser launch, no publish, broadcast, or delete API calls, and no RPA fallback.

Environment

Requires Windows and PowerShell 7.2+. AppSecret is encrypted using the current Windows user's DPAPI and saved to $env:CODEX_HOME\secrets by default; if CODEX_HOME is not set, it uses $env:USERPROFILE\.codex\secrets. Network requests are made within the PowerShell process; access tokens are never passed to external commands.

Input and Offline Validation

Read references/package-contract.md in full before execution. The asset folder must contain image-post.json and 1–20 images; the account field must be explicitly filled, and the comment field must not be omitted.

First locate the skill, then perform offline validation:

$codexHome = if ($env:CODEX_HOME) { $env:CODEX_HOME } else { Join-Path $env:USERPROFILE '.codex' }
$skill = Join-Path $codexHome 'skills\wechat-image-api'
& (Join-Path $skill 'scripts\Test-WeChatImagePackage.ps1') -InputFolder 'D:\image-assets'

To generate a complete example, create and validate in a new directory without existing example files:

& (Join-Path $skill 'scripts\New-WeChatImagePackageExample.ps1') -OutputFolder 'D:\image-example'

Initial Configuration

Both WeChat API skills can share the same DPAPI credentials. If credentials do not exist, do not ask the user to paste AppSecret in chat; run local interactive configuration:

& (Join-Path $skill 'scripts\Set-WeChatOfficialAccountCredential.ps1')
& (Join-Path $skill 'scripts\Test-WeChatOfficialAccountApi.ps1')

The second command verifies AppID, AppSecret, draft permissions, and IP whitelist. The asset package account must exactly match the Official Account name saved during configuration.

If WeChat returns 40164 invalid ip, stop immediately, inform the user of the public outbound IP in the error, and remind them to add it under "Settings & Development → Development API Management → IP Whitelist". After user confirmation, only retry the same official API; do not switch to browser, RPA, Cookie Profile, or any other publishing channel.

Create and Verify Draft

Only run after the user explicitly requests to write a draft:

& (Join-Path $skill 'scripts\Publish-WeChatImageDraft.ps1') -InputFolder 'D:\image-assets'

The script uploads images one by one to material/add_material, then creates a newspic draft via draft/add; the first image is used as the cover by WeChat. Finally, it reads back using draft/get and verifies account, title, body content, image order, comment settings, and media_id.

Idempotency and Exception Boundaries

• Each asset folder uses an exclusive lock; no concurrent execution on the same directory.
• Checkpoints only advance after confirming receipt of media_id; when a draft ID is already recorded, re-execution only reads back and verifies, without recreating.
• If network or process interruption occurs during image upload or the draft/add submission stage, the result may be indeterminate. Subsequent executions must stop; do not auto-retry. First manually verify the asset library or draft box, then continue with a new directory.
• If asset fingerprints change but old checkpoints exist, stop; do not silently clear state.
• State and receipts use atomic file replacement in the same directory to avoid leaving half-written JSON.
• Only report "Draft created and verified successfully" after all fields are verified via draft/get; do not report "Published".
• Receipts are written to wechat-image-api-receipt.json. If any official API fails, report the error immediately. This skill has no browser/RPA fallback.