1# Multi-Account Support
2 
3Details for managing multiple WeChat Official Accounts through one EXTEND.md. SKILL.md only covers single-account flow and the selection prompt — read this file when the user has an `accounts:` block, asks to publish to a specific account, or needs per-account credentials.
4 
5## Compatibility
6 
7| Condition | Mode | Behavior |
8|-----------|------|----------|
9| No `accounts` block | Single-account | Original behavior, no changes |
10| `accounts` with 1 entry | Single-account | Auto-select, no prompt |
11| `accounts` with 2+ entries | Multi-account | Prompt to select before publishing |
12| `accounts` with `default: true` | Multi-account | Pre-select default; user can switch |
13 
14## EXTEND.md Example
15 
16```md
17default_theme: default
18default_color: blue
19 
20accounts:
21  - name: 宝玉的技术分享
22    alias: baoyu
23    default: true
24    default_publish_method: api
25    default_author: 宝玉
26    need_open_comment: 1
27    only_fans_can_comment: 0
28    app_id: your_wechat_app_id
29    app_secret: your_wechat_app_secret
30  - name: AI工具集
31    alias: ai-tools
32    default_publish_method: browser
33    default_author: AI工具集
34    need_open_comment: 1
35    only_fans_can_comment: 0
36```
37 
38## Per-Account vs Global Keys
39 
40**Per-account** (also accepted globally as fallback): `default_publish_method`, `default_author`, `need_open_comment`, `only_fans_can_comment`, `app_id`, `app_secret`, `chrome_profile_path`, `remote_publish_host`, `remote_publish_user`, `remote_publish_port`, `remote_publish_identity_file`, `remote_publish_known_hosts_file`, `remote_publish_strict_host_key_checking`, `remote_publish_connect_timeout`, `remote_publish_proxy_jump`.
41 
42**Global-only** (always shared): `default_theme`, `default_color`.
43 
44## Account Selection (Step 0.5)
45 
46Insert between Step 0 (Load EXTEND.md) and Step 1 (Determine input type):
47 
48```
49if no accounts block:
50    → single-account mode (original behavior)
51elif accounts.length == 1:
52    → auto-select the only account
53elif --account <alias> CLI arg:
54    → select matching account
55elif one account has default: true:
56    → pre-select, display: "Using account: <name> (--account to switch)"
57else:
58    → prompt user to choose from the list
59```
60 
61## Credential Resolution (API Method)
62 
63For the selected account with alias `{alias}`, try in this order (first hit wins):
64 
651. `app_id` / `app_secret` inline in the EXTEND.md account block
662. Env vars `WECHAT_{ALIAS}_APP_ID` / `WECHAT_{ALIAS}_APP_SECRET` (alias uppercased, hyphens → underscores)
673. `.baoyu-skills/.env` with the prefixed key `WECHAT_{ALIAS}_APP_ID`
684. `~/.baoyu-skills/.env` with the prefixed key
695. Fallback to unprefixed `WECHAT_APP_ID` / `WECHAT_APP_SECRET`
70 
71### .env Multi-Account Example
72 
73```bash
74# Account: baoyu
75WECHAT_BAOYU_APP_ID=your_wechat_app_id
76WECHAT_BAOYU_APP_SECRET=your_wechat_app_secret
77 
78# Account: ai-tools
79WECHAT_AI_TOOLS_APP_ID=your_ai_tools_wechat_app_id
80WECHAT_AI_TOOLS_APP_SECRET=your_ai_tools_wechat_app_secret
81```
82 
83## Chrome Profile (Browser Method)
84 
85Each account uses an isolated Chrome profile so logins don't collide.
86 
87| Source | Path |
88|--------|------|
89| Account `chrome_profile_path` in EXTEND.md | Use as-is |
90| Auto-generated from alias | `{shared_profile_parent}/wechat-{alias}/` |
91| Single-account fallback | Shared default profile |
92 
93## CLI `--account` Flag
94 
95All publishing scripts accept `--account <alias>`:
96 
97```bash
98${BUN_X} {baseDir}/scripts/wechat-api.ts <file> --theme default --account ai-tools
99${BUN_X} {baseDir}/scripts/wechat-article.ts --markdown <file> --theme default --account baoyu
100${BUN_X} {baseDir}/scripts/wechat-browser.ts --markdown <file> --images ./photos/ --account baoyu
101```
102 
103## Remote API Publishing
104 
105`wechat-api.ts` supports a `remote-api` mode that tunnels WeChat API calls through an SSH SOCKS5 dynamic port forward to a server whose IP is on WeChat's allowlist. Markdown rendering, image processing, draft assembly, and HTML rewriting still happen locally; only outbound HTTPS calls to `api.weixin.qq.com` traverse the tunnel. No files are written to the remote host and `AppSecret` never leaves the local process. The remote host needs only `sshd` and outbound network access.
106 
107### Per-Account Configuration
108 
109```md
110default_theme: default
111default_color: blue
112default_publish_method: browser   # browser remains the default
113 
114accounts:
115  - name: 宝玉的技术分享
116    alias: baoyu
117    default: true
118    default_publish_method: api
119    default_author: 宝玉
120    app_id: your_wechat_app_id
121    app_secret: your_wechat_app_secret
122  - name: AI工具集
123    alias: ai-tools
124    default_publish_method: remote-api
125    default_author: AI工具集
126    app_id: your_ai_tools_app_id
127    app_secret: your_ai_tools_app_secret
128    remote_publish_host: ai-tools-server.example.com
129    remote_publish_user: deploy
130    remote_publish_port: 22
131    remote_publish_identity_file: /home/me/.ssh/id_ed25519
132    remote_publish_known_hosts_file: /home/me/.ssh/known_hosts
133    remote_publish_strict_host_key_checking: accept-new
134```
135 
136Account-level `remote_publish_*` values override top-level globals. CLI `--remote-*` flags override both.
137 
138### CLI Usage
139 
140```bash
141# Use the account's default_publish_method (remote-api here):
142${BUN_X} {baseDir}/scripts/wechat-api.ts <file> --theme default --account ai-tools
143 
144# Force remote mode regardless of default_publish_method:
145${BUN_X} {baseDir}/scripts/wechat-api.ts <file> --theme default --account baoyu --remote --remote-host other-server.example.com
146```
147 
148### Security Notes
149 
150- Authentication is SSH key only. Passwords and `ssh-askpass` are not used.
151- Only the typed `remote_publish_*` keys are read; raw `ssh` / `scp` options are intentionally not supported.
152- The tunnel forwards raw TCP; TLS verification for `api.weixin.qq.com` is still performed end-to-end by the local process.
153