agent-messenger 2.2.0 → 2.4.0

package/docs/content/docs/sdk/wechatbot.mdx

@@ -0,0 +1,282 @@
+---
+title: WeChat Bot
+description: TypeScript SDK reference for WeChat Bot — Official Account API client, credential management, and types.
+---
+
+## Installation
+
+```bash
+npm install agent-messenger
+```
+
+```typescript
+import {
+  WeChatBotClient,
+  WeChatBotCredentialManager,
+  WeChatBotError,
+} from 'agent-messenger/wechatbot'
+```
+
+## WeChatBotClient
+
+The main client for interacting with the WeChat Official Account API programmatically. Handles access token lifecycle (caching, auto-refresh on expiry), errcode-aware response parsing, and automatic retries on transient errors. All API calls use query-parameter token injection per WeChat convention.
+
+```typescript
+import { WeChatBotClient } from 'agent-messenger/wechatbot'
+
+const client = await new WeChatBotClient().login({ appId, appSecret })
+```
+
+Or use automatic credential extraction, where credentials are read from stored config:
+
+```typescript
+import { WeChatBotClient } from 'agent-messenger/wechatbot'
+
+const client = await new WeChatBotClient().login()
+```
+
+### Verification
+
+```typescript
+// Verify credentials by attempting to obtain an access token
+const valid = await client.verifyCredentials()
+// → boolean
+```
+
+### Customer Service Messages
+
+Customer service messages can be sent to users who have interacted with your Official Account within the last 48 hours.
+
+```typescript
+// Send a text message
+await client.sendTextMessage('oABCD1234', 'Hello from the bot!')
+
+// Send an image message (requires a media ID from WeChat's media upload API)
+await client.sendImageMessage('oABCD1234', 'MEDIA_ID_HERE')
+
+// Send a news/article message
+await client.sendNewsMessage('oABCD1234', [
+  {
+    title: 'Your Order Update',
+    description: 'Your order #12345 has been shipped',
+    url: 'https://example.com/orders/12345',
+    picurl: 'https://example.com/images/shipping.jpg',
+  },
+])
+```
+
+### Template Messages
+
+Template messages can be sent at any time, regardless of the 48-hour interaction window.
+
+```typescript
+// Send a template message
+const result = await client.sendTemplateMessage(
+  'oABCD1234',
+  'TM00001',
+  { order_id: { value: 'ORD-9876' }, customer_name: { value: 'Alice' } },
+  'https://example.com/order/9876', // optional click URL
+)
+console.log(`Message ID: ${result.msgid}`)
+// → { msgid: number }
+
+// List all private templates
+const templates = await client.listTemplates()
+// → WeChatBotTemplate[]
+
+// Delete a template
+await client.deleteTemplate('TM00001')
+```
+
+### Users
+
+```typescript
+// List followers (paginated)
+const followers = await client.getFollowers()
+console.log(`Total: ${followers.total}, This page: ${followers.count}`)
+// → { total: number, count: number, openids: string[], next_openid: string }
+
+// Get next page
+const nextPage = await client.getFollowers(followers.next_openid)
+
+// Get user info
+const user = await client.getUserInfo('oABCD1234', 'en')
+// → WeChatBotUserInfo
+```
+
+## WeChatBotCredentialManager
+
+Manages WeChat Bot credentials stored at `~/.config/agent-messenger/wechatbot-credentials.json`. Files are written with `0o600` permissions. The environment variables `E2E_WECHATBOT_APP_ID` and `E2E_WECHATBOT_APP_SECRET` take precedence when calling `getCredentials()` without an `accountId`.
+
+```typescript
+import { WeChatBotCredentialManager } from 'agent-messenger/wechatbot'
+
+const manager = new WeChatBotCredentialManager()
+// Custom path: new WeChatBotCredentialManager('/custom/config/dir')
+```
+
+```typescript
+// Load full config from disk (returns defaults if file doesn't exist)
+const config = await manager.load()
+// → WeChatBotConfig
+
+// Save full config to disk
+await manager.save(config)
+
+// Get credentials for an account (env vars take precedence)
+const creds = await manager.getCredentials()
+const specific = await manager.getCredentials(accountId)
+// → WeChatBotCredentials | null
+
+// Store credentials for an account
+await manager.setCredentials({
+  app_id: 'wx1234567890',
+  app_secret: '...',
+  account_name: 'wx1234567890',
+})
+
+// Remove an account's credentials
+const removed = await manager.removeAccount('wx1234567890')
+// → boolean
+
+// Set the current default account
+const ok = await manager.setCurrent('wx1234567890')
+// → boolean
+
+// List all saved accounts with current marker
+const all = await manager.listAll()
+// → Array<WeChatBotAccountEntry & { is_current: boolean }>
+
+// Clear all stored credentials
+await manager.clearCredentials()
+```
+
+## Types
+
+```typescript
+import type {
+  WeChatBotAccountEntry,
+  WeChatBotConfig,
+  WeChatBotCredentials,
+  WeChatBotNewsArticle,
+  WeChatBotTemplate,
+  WeChatBotUserInfo,
+} from 'agent-messenger/wechatbot'
+```
+
+## WeChatBotError
+
+Thrown on authentication failures, network errors, rate limits, and API errors. Includes a `code` string for programmatic handling.
+
+```typescript
+import { WeChatBotError } from 'agent-messenger/wechatbot'
+
+try {
+  await client.sendTextMessage('oABCD1234', 'Hello')
+} catch (error) {
+  if (error instanceof WeChatBotError) {
+    console.error(`${error.code}: ${error.message}`)
+    // e.g. "40001: Invalid credential"
+    // e.g. "45009: Reach max API daily quota limit"
+    // e.g. "40164: Invalid ip, not in whitelist"
+  }
+}
+```
+
+### Zod Schemas
+
+Runtime-validated schemas are also exported for parsing API responses:
+
+```typescript
+import {
+  WeChatBotAccountEntrySchema,
+  WeChatBotConfigSchema,
+  WeChatBotCredentialsSchema,
+  WeChatBotNewsArticleSchema,
+  WeChatBotTemplateSchema,
+  WeChatBotUserInfoSchema,
+} from 'agent-messenger/wechatbot'
+```
+
+## Examples
+
+### Send Template Notification
+
+Send a template message with dynamic data to a follower.
+
+```typescript
+import { WeChatBotClient } from 'agent-messenger/wechatbot'
+
+const client = await new WeChatBotClient().login({ appId, appSecret })
+
+const result = await client.sendTemplateMessage(
+  'oABCD1234',
+  'order_confirmation',
+  {
+    order_id: { value: 'ORD-5678' },
+    status: { value: 'Shipped' },
+    date: { value: 'March 30, 2026' },
+  },
+  'https://example.com/orders/5678',
+)
+console.log(`Sent template, msgid: ${result.msgid}`)
+```
+
+### Broadcast to All Followers
+
+Iterate through paginated follower list and send template messages.
+
+```typescript
+import { WeChatBotClient } from 'agent-messenger/wechatbot'
+
+const client = await new WeChatBotClient().login({ appId, appSecret })
+
+let nextOpenId: string | undefined
+do {
+  const page = await client.getFollowers(nextOpenId)
+  for (const openId of page.openids) {
+    await client.sendTemplateMessage(openId, 'weekly_update', {
+      content: { value: 'New features released this week!' },
+    })
+  }
+  nextOpenId = page.next_openid || undefined
+} while (nextOpenId)
+```
+
+### Multi-Account Management
+
+Set up and switch between multiple Official Account credentials.
+
+```typescript
+import { WeChatBotCredentialManager, WeChatBotClient } from 'agent-messenger/wechatbot'
+
+const manager = new WeChatBotCredentialManager()
+
+// Store credentials for two accounts
+await manager.setCredentials({
+  app_id: 'wx1111111111',
+  app_secret: 'secret1...',
+  account_name: 'wx1111111111',
+})
+
+await manager.setCredentials({
+  app_id: 'wx2222222222',
+  app_secret: 'secret2...',
+  account_name: 'wx2222222222',
+})
+
+// List all accounts
+const accounts = await manager.listAll()
+for (const acct of accounts) {
+  const marker = acct.is_current ? '(current)' : ''
+  console.log(`${acct.account_name} [${acct.app_id}] ${marker}`)
+}
+
+// Switch to a specific account
+await manager.setCurrent('wx1111111111')
+
+// Login picks up the current account automatically
+const client = await new WeChatBotClient().login()
+const valid = await client.verifyCredentials()
+console.log(`Credentials valid: ${valid}`)
+```

package/docs/content/docs/tui.mdx

@@ -113,7 +113,7 @@ This means adding a new platform to the TUI is just implementing one adapter —
 
 ## Source
 
-The TUI source lives in [`src/tui/`](https://github.com/devxoul/agent-messenger/tree/main/src/tui):
+The TUI source lives in [`src/tui/`](https://github.com/agent-messenger/agent-messenger/tree/main/src/tui):
 
 ```
 src/tui/

package/docs/src/app/page.tsx

@@ -543,7 +543,7 @@ const HOW_IT_WORKS = [
   {
     step: 3,
     title: 'Teach Your Agent',
-    code: 'npx skills add devxoul/agent-messenger',
+    code: 'npx skills add agent-messenger/agent-messenger',
     description: 'Install Agent Skills via Skills CLI, Claude Code, OpenCode, or SkillPad — your agent learns every command and starts messaging on its own.',
   },
 ]
@@ -617,7 +617,7 @@ export default function Home() {
             docs
           </Link>
           <a
-            href="https://github.com/devxoul/agent-messenger"
+            href="https://github.com/agent-messenger/agent-messenger"
             target="_blank"
             rel="noopener noreferrer"
             className="rounded-lg px-3 py-2 font-mono text-xs text-zinc-500 transition-colors hover:text-zinc-900 dark:text-zinc-400 dark:hover:text-zinc-100"
@@ -661,7 +661,7 @@ export default function Home() {
               Get Started
             </Link>
             <a
-              href="https://github.com/devxoul/agent-messenger"
+              href="https://github.com/agent-messenger/agent-messenger"
               target="_blank"
               rel="noopener noreferrer"
               className="inline-flex items-center justify-center rounded-xl border border-zinc-300 px-6 py-3 text-sm font-medium text-zinc-700 transition-all duration-300 hover:bg-zinc-50 dark:border-white/[0.06] dark:text-zinc-300 dark:hover:border-white/15 dark:hover:bg-white/[0.05]"
@@ -1002,7 +1002,7 @@ export default function Home() {
                 Read the Docs
               </Link>
               <a
-                href="https://github.com/devxoul/agent-messenger"
+                href="https://github.com/agent-messenger/agent-messenger"
                 target="_blank"
                 rel="noopener noreferrer"
                 className="inline-flex items-center justify-center rounded-xl border border-zinc-300 px-6 py-3 text-sm font-medium text-zinc-700 transition-all duration-300 hover:bg-white dark:border-white/[0.06] dark:text-zinc-300 dark:hover:border-white/15 dark:hover:bg-white/[0.05]"
@@ -1024,7 +1024,7 @@ export default function Home() {
               docs
             </Link>
             <a
-              href="https://github.com/devxoul/agent-messenger"
+              href="https://github.com/agent-messenger/agent-messenger"
               target="_blank"
               rel="noopener noreferrer"
               className="transition-colors duration-300 hover:text-zinc-700 dark:hover:text-zinc-300"

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "agent-messenger",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Multi-platform messaging CLI for AI agents (Slack, Discord, Teams, Webex, Telegram, WhatsApp, LINE, Instagram, KakaoTalk, Channel Talk)",
   "repository": {
     "type": "git",
-    "url": "https://github.com/devxoul/agent-messenger"
+    "url": "https://github.com/agent-messenger/agent-messenger"
   },
   "bin": {
     "agent-messenger": "dist/src/cli.js",
@@ -19,6 +19,7 @@
     "agent-whatsapp": "dist/src/platforms/whatsapp/cli.js",
     "agent-whatsappbot": "dist/src/platforms/whatsappbot/cli.js",
     "agent-line": "dist/src/platforms/line/cli.js",
+    "agent-wechatbot": "dist/src/platforms/wechatbot/cli.js",
     "agent-instagram": "dist/src/platforms/instagram/cli.js",
     "agent-kakaotalk": "dist/src/platforms/kakaotalk/cli.js",
     "agent-channeltalk": "dist/src/platforms/channeltalk/cli.js",
@@ -58,6 +59,10 @@
       "types": "./dist/src/platforms/line/index.d.ts",
       "default": "./dist/src/platforms/line/index.js"
     },
+    "./wechatbot": {
+      "types": "./dist/src/platforms/wechatbot/index.d.ts",
+      "default": "./dist/src/platforms/wechatbot/index.js"
+    },
     "./instagram": {
       "types": "./dist/src/platforms/instagram/index.d.ts",
       "default": "./dist/src/platforms/instagram/index.js"
@@ -101,6 +106,9 @@
       "line": [
         "./dist/src/platforms/line/index.d.ts"
       ],
+      "wechatbot": [
+        "./dist/src/platforms/wechatbot/index.d.ts"
+      ],
       "instagram": [
         "./dist/src/platforms/instagram/index.d.ts"
       ],
@@ -129,7 +137,7 @@
     "postpublish": "git checkout package.json"
   },
   "dependencies": {
-    "@evex/linejs": "npm:@jsr/evex__linejs",
+    "@evex/linejs": "https://npm.jsr.io/~/11/@jsr/evex__linejs/2.3.7.tgz",
     "@hapi/boom": "^10.0.1",
     "@slack/web-api": "^6.9.0",
     "@whiskeysockets/baileys": "^7.0.0-rc.9",
@@ -138,6 +146,7 @@
     "bson": "^7.2.0",
     "classic-level": "^3.0.0",
     "commander": "^11.1.0",
+    "node-jose": "^2.2.0",
     "pino": "^10.3.1",
     "qrcode": "^1.5.4",
     "ws": "^8.19.0",
@@ -153,6 +162,7 @@
     "@types/bun": "latest",
     "@types/hapi__boom": "^9.0.1",
     "@types/node": "^20.10.6",
+    "@types/node-jose": "^1.1.13",
     "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",
     "oxfmt": "^0.36.0",

package/skills/agent-channeltalk/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-channeltalk
 description: Interact with Channel Talk using extracted desktop app or browser credentials - read chats, send messages, search messages, manage groups
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-channeltalk:*)
 metadata:
   openclaw:

package/skills/agent-channeltalkbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-channeltalkbot
 description: Interact with Channel Talk workspaces using API credentials - send messages, read chats, manage groups and bots
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-channeltalkbot:*)
 metadata:
   openclaw:

package/skills/agent-discord/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-discord
 description: Interact with Discord servers - send messages, read channels, manage reactions
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-discord:*)
 metadata:
   openclaw:

package/skills/agent-discordbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-discordbot
 description: Interact with Discord servers using bot tokens - send messages, read channels, manage reactions
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-discordbot:*)
 metadata:
   openclaw:

package/skills/agent-instagram/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-instagram
 description: Interact with Instagram DMs - send messages, read conversations, manage accounts
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-instagram:*)
 metadata:
   openclaw:

package/skills/agent-kakaotalk/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-kakaotalk
 description: Interact with KakaoTalk - send messages, read chats, manage conversations
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-kakaotalk:*)
 metadata:
   openclaw:
@@ -46,6 +46,9 @@ agent-kakaotalk message send <chat-id> "Hello from AI agent!"
 
 # List messages in a chat
 agent-kakaotalk message list <chat-id>
+
+# Show your profile
+agent-kakaotalk profile
 ```
 
 ## Authentication
@@ -285,6 +288,23 @@ agent-kakaotalk auth status --account <account-id>
 agent-kakaotalk auth logout --account <account-id>
 ```
 
+### Profile Command
+
+```bash
+# Show your KakaoTalk profile
+agent-kakaotalk profile
+agent-kakaotalk profile --pretty
+agent-kakaotalk profile --account <account-id>
+```
+
+Output includes:
+- `user_id` — your KakaoTalk user ID
+- `nickname` — your display name
+- `profile_image_url` — profile image thumbnail URL
+- `original_profile_image_url` — original profile image URL
+- `status_message` — your status message
+- `account_display_id` — your KakaoTalk ID (may be null if not set)
+
 ### Chat Commands
 
 ```bash
@@ -468,6 +488,9 @@ const client = await new KakaoTalkClient().login({ oauthToken: account.oauth_tok
 
 ```typescript
 try {
+  // Get your profile
+  const profile = await client.getProfile()
+
   // List chats
   const chats = await client.getChats()
 

package/skills/agent-line/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-line
 description: Interact with LINE - send messages, read chats, manage conversations
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-line:*)
 metadata:
   openclaw:
@@ -117,18 +117,14 @@ agent-line auth login
 
 Possible responses:
 
-- `{"authenticated": true, ...}` -> Success. Retry original command.
-- `{"next_action": "run_interactive", "message": "..."}` -> QR login requires an interactive terminal. **Tell the user** to run `agent-line auth login` in their own terminal and scan the QR code with the LINE mobile app. Then retry `auth status` to check completion.
-- `{"error": "not_connected", ...}` -> Network issue. Check connectivity and retry.
-- `{"error": "not_authenticated", ...}` -> Credentials expired. Re-run `auth login`.
+- `{"authenticated": true, ...}` → Success. Retry original command.
+- `{"next_action": "scan_qr", "qr_url": "...", "qr_html_path": "/tmp/line-qr-xxx.html", ...}` → QR code has been generated. The CLI attempts to open it in the user's browser automatically. If it didn't open, run `open <qr_html_path>` (macOS) to show the QR code. Tell the user to scan the QR code with the LINE mobile app. The command blocks until the user scans — once scanned, it outputs `{"authenticated": true, ...}`.
+- `{"error": "not_connected", ...}` → Network issue. Check connectivity and retry.
+- `{"error": "not_authenticated", ...}` → Credentials expired. Re-run `auth login`.
 
-**Important**: QR login renders a QR code in the terminal that must be scanned by the LINE mobile app. It only works in interactive terminals (TTY). When running as an AI agent, the CLI detects non-interactive mode and returns a `next_action` response instead of blocking.
+**Important**: QR login works in both interactive and non-interactive (agent) sessions. The CLI generates an HTML page with the QR code and opens it in the user's default browser. No TTY is required.
 
-**Step 3: If `next_action` was returned, ask the user to login manually**
-
-Tell the user: "Please run `agent-line auth login` in your terminal and scan the QR code with your LINE app." Then periodically check `agent-line auth status` until credentials appear.
-
-**Step 4: Retry the original command**
+**Step 3: Retry the original command**
 
 After successful auth, immediately execute whatever the user originally asked for.
 

package/skills/agent-line/references/authentication.md

@@ -33,16 +33,25 @@ The CLI opens the QR code in your default browser and prints an ASCII version in
 
 ### Non-Interactive Mode (AI Agents)
 
-QR code login requires a TTY. When running outside an interactive terminal, the CLI returns:
+QR code login works in both interactive and non-interactive sessions. In non-interactive mode (e.g., AI agent), the CLI:
+
+1. Generates an HTML page with the QR code
+2. Attempts to open it in the user's default browser
+3. Outputs the QR URL and HTML file path to stdout:
 
 ```json
 {
-  "next_action": "run_interactive",
-  "message": "QR code login requires an interactive terminal. Run agent-line auth login in a terminal with TTY support."
+  "next_action": "scan_qr",
+  "qr_url": "https://line.me/R/au/q/...",
+  "qr_html_path": "/tmp/line-qr-1234567890.html",
+  "message": "QR code opened in browser. Scan with LINE mobile app to complete login."
 }
 ```
 
-For non-interactive environments, use email/password or token login instead.
+4. Blocks until the user scans the QR code with the LINE mobile app
+5. Outputs the final authentication result
+
+If the browser did not open automatically, the agent can open the HTML file manually (e.g., `open <qr_html_path>` on macOS).
 
 ## Method 2: Email/Password Login
 

package/skills/agent-slack/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-slack
 description: Interact with Slack workspaces - send messages, read channels, manage reactions
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-slack:*)
 metadata:
   openclaw:

package/skills/agent-slackbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-slackbot
 description: Interact with Slack workspaces using bot tokens - send messages, read channels, manage reactions
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-slackbot:*)
 metadata:
   openclaw:

package/skills/agent-teams/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-teams
 description: Interact with Microsoft Teams - send messages, read channels, manage reactions
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-teams:*)
 metadata:
   openclaw:

package/skills/agent-telegram/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-telegram
 description: Interact with Telegram through TDLib - authenticate, inspect chats, and send messages
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-telegram:*)
 ---
 

package/skills/agent-webex/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-webex
 description: Interact with Cisco Webex - send messages, read spaces, manage memberships
-version: 2.2.0
+version: 2.4.0
 allowed-tools: Bash(agent-webex:*)
 metadata:
   openclaw:

package/skills/agent-webex/references/authentication.md

@@ -4,7 +4,7 @@
 
 agent-webex supports four authentication methods against the Webex REST API (`https://webexapis.com/v1`):
 
-1. **Browser Token Extraction**: Extracts your first-party token from a Chromium browser where you're logged into web.webex.com. Currently supports read operations (spaces, members, auth). Zero-config.
+1. **Browser Token Extraction**: Extracts your first-party token and cached encryption keys from a Chromium browser where you're logged into web.webex.com. Supports all operations including encrypted messaging via the internal API. Zero-config.
 2. **OAuth Device Grant** (recommended for messaging): Zero-config. Run `auth login`, approve in browser, done. Tokens refresh automatically. Supports all operations including sending messages (shows "via agent-messenger").
 3. **Bot Token**: Pass via `auth login --token`. Never expires. Best for CI/CD.
 4. **Personal Access Token (PAT)**: Pass via `auth login --token`. Expires in 12 hours. For quick testing.
@@ -13,12 +13,13 @@ agent-webex supports four authentication methods against the Webex REST API (`ht
 
 ### Browser Token Extraction
 
-Extracts your first-party Webex session token from a Chromium-based browser where you're logged into web.webex.com. Currently supports read operations (authentication, listing spaces/members, snapshots). Sending messages via the REST API is not yet supported because the web client's token lacks `spark:messages_write` scope — the web client uses internal Cisco APIs for messaging instead.
+Extracts your first-party Webex session token from a Chromium-based browser where you're logged into web.webex.com. Supports full messaging with end-to-end encryption. The extracted token uses Webex's internal conversation API for sending messages. Encryption keys are also extracted from the browser's cached KMS key store, enabling client-side JWE encryption so messages appear as encrypted in the Webex client.
 
-- **How it works**: Run `agent-webex auth extract`. The CLI scans Chromium browser profiles for Webex localStorage data (LevelDB files). It finds the `webex-storage` key containing `Credentials.@.supertoken` and extracts the access token. No browser automation, no password prompts.
+- **How it works**: Run `agent-webex auth extract`. The CLI scans Chromium browser profiles for Webex localStorage data (LevelDB files). It finds the `webex-storage` key containing `Credentials.@.supertoken` and extracts the access token. It also extracts `userId` from the Device namespace and cached KMS encryption keys from the unbounded storage — these keys enable end-to-end encrypted messaging via the internal API. No browser automation, no password prompts.
 - **Supported browsers**: Chrome, Chrome Canary, Edge, Arc, Brave, Vivaldi, Chromium
 - **Token lifetime**: Depends on Webex session policy (typically hours to days). Re-extract when expired.
 - **Auto-extraction**: The CLI attempts browser extraction automatically when no valid token is stored, so you often don't need to run `auth extract` manually.
+- **End-to-end encryption**: When encryption keys are found in the browser's cache, messages are encrypted client-side (JWE with AES-256-GCM) before sending via the internal conversation API. This ensures messages appear as encrypted in the Webex client. If no keys are found (e.g., the conversation hasn't been opened in the browser), messages fall back to plaintext.
 - **Best for**: Interactive use, sending messages as yourself without the "via" label
 
 ```bash

package/skills/agent-webex/references/common-patterns.md

@@ -28,7 +28,7 @@ agent-webex auth login --token "YOUR_BOT_TOKEN_HERE"
 agent-webex auth login --token "YOUR_PAT_HERE"
 ```
 
-**When to use**: Before any other command, if not already authenticated. Browser extraction is preferred — it auto-runs when no valid token is stored.
+**When to use**: Before any other command, if not already authenticated. Browser extraction is preferred — it auto-runs when no valid token is stored. It also extracts cached KMS encryption keys from the browser, enabling end-to-end encrypted messaging via the internal API.
 
 ### Pattern 2: Check Auth Status