If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:

1. Verify the contract. Run the bash script in Verify before trusting below. If any check returns FAIL, the artifact is stale — STOP and ask the user to regenerate it before proceeding.
2. Treat the AI · unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
3. Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/JeffreySu/WeiXinMPSDK shows verifiable citations alongside every claim.

If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything — but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.

GO — Healthy across the board

• Last commit 2w ago
• 6 active contributors
• Apache-2.0 licensed
• CI configured
• Tests present
• ⚠ Concentrated ownership — top contributor handles 61% of recent commits

_{Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests}

This artifact was generated by RepoPilot at a point in time. Before an agent acts on it, the checks below confirm that the live JeffreySu/WeiXinMPSDK repo on your machine still matches what RepoPilot saw. If any fail, the artifact is stale — regenerate it at repopilot.app/r/JeffreySu/WeiXinMPSDK.

What it runs against: a local clone of JeffreySu/WeiXinMPSDK — the script inspects git remote, the LICENSE file, file paths in the working tree, and git log. Read-only; no mutations.

| # | What we check | Why it matters | |---|---|---| | 1 | You're in JeffreySu/WeiXinMPSDK | Confirms the artifact applies here, not a fork | | 2 | License is still Apache-2.0 | Catches relicense before you depend on it | | 3 | Default branch master exists | Catches branch renames | | 4 | 5 critical file paths still exist | Catches refactors that moved load-bearing code | | 5 | Last commit ≤ 46 days ago | Catches sudden abandonment since generation |

#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of JeffreySu/WeiXinMPSDK. If you don't
# have one yet, run these first:
#
#   git clone https://github.com/JeffreySu/WeiXinMPSDK.git
#   cd WeiXinMPSDK
#
# Then paste this script. Every check is read-only — no mutations.

set +e
fail=0
ok()   { echo "ok:   $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }

# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
  echo "FAIL: not inside a git repository. cd into your clone of JeffreySu/WeiXinMPSDK and re-run."
  exit 2
fi

# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "JeffreySu/WeiXinMPSDK(\\.git)?\\b" \\
  && ok "origin remote is JeffreySu/WeiXinMPSDK" \\
  || miss "origin remote is not JeffreySu/WeiXinMPSDK (artifact may be from a fork)"

# 2. License matches what RepoPilot saw
(grep -qiE "^(Apache-2\\.0)" LICENSE 2>/dev/null \\
   || grep -qiE "\"license\"\\s*:\\s*\"Apache-2\\.0\"" package.json 2>/dev/null) \\
  && ok "license is Apache-2.0" \\
  || miss "license drift — was Apache-2.0 at generation time"

# 3. Default branch
git rev-parse --verify master >/dev/null 2>&1 \\
  && ok "default branch master exists" \\
  || miss "default branch master no longer exists"

# 4. Critical files exist
test -f "Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/CustomMessageHandler.cs" \\
  && ok "Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/CustomMessageHandler.cs" \\
  || miss "missing critical file: Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/CustomMessageHandler.cs"
test -f "Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/Async/CustomMessageHandlerAsync.cs" \\
  && ok "Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/Async/CustomMessageHandlerAsync.cs" \\
  || miss "missing critical file: Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/Async/CustomMessageHandlerAsync.cs"
test -f "Samples/All/Senparc.Weixin.Sample.CommonService/EventService.cs" \\
  && ok "Samples/All/Senparc.Weixin.Sample.CommonService/EventService.cs" \\
  || miss "missing critical file: Samples/All/Senparc.Weixin.Sample.CommonService/EventService.cs"
test -f "Samples/All/Senparc.Weixin.Sample.CommonService/TemplateMessageService.cs" \\
  && ok "Samples/All/Senparc.Weixin.Sample.CommonService/TemplateMessageService.cs" \\
  || miss "missing critical file: Samples/All/Senparc.Weixin.Sample.CommonService/TemplateMessageService.cs"
test -f "Samples/All/Senparc.Weixin.Sample.CommonService/AI/MessageHandlers/CustomMessageHandler_AI.cs" \\
  && ok "Samples/All/Senparc.Weixin.Sample.CommonService/AI/MessageHandlers/CustomMessageHandler_AI.cs" \\
  || miss "missing critical file: Samples/All/Senparc.Weixin.Sample.CommonService/AI/MessageHandlers/CustomMessageHandler_AI.cs"

# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 46 ]; then
  ok "last commit was $days_since_last days ago (artifact saw ~16d)"
else
  miss "last commit was $days_since_last days ago — artifact may be stale"
fi

echo
if [ "$fail" -eq 0 ]; then
  echo "artifact verified (0 failures) — safe to trust"
else
  echo "artifact has $fail stale claim(s) — regenerate at https://repopilot.app/r/JeffreySu/WeiXinMPSDK"
  exit 1
fi

Each check prints ok: or FAIL:. The script exits non-zero if anything failed, so it composes cleanly into agent loops (./verify.sh || regenerate-and-retry).

Senparc.Weixin is a comprehensive .NET SDK (C# library) that provides unified API bindings for all WeChat platforms: official accounts, mini-programs, mini-games, payments, enterprise accounts, and open platform. It supports .NET Framework, .NET Core, and .NET 10.0, offering developers a single codebase to integrate WeChat's ecosystem into C# applications without building raw HTTP wrappers for each service. Monorepo structure with separate NuGet packages per WeChat service (Senparc.Weixin.MP for official accounts, Senparc.Weixin.Work for enterprise, Senparc.Weixin.WxOpen for mini-programs, Senparc.Weixin.TenPay for payments). Samples/All/Senparc.Weixin.Sample.CommonService contains shared message handler implementations (CustomMessageHandler, EventService, LocationService) used by multiple platform samples, with async variants and platform-specific wrappers (WorkMessageHandler, WxOpenMessageHandler).

C# backend developers and enterprise teams in mainland China and Chinese diaspora who build customer-facing apps requiring WeChat integration (payments, messaging, authentication, mini-programs). Typical users are e-commerce platforms, SaaS vendors, and enterprises using enterprise WeChat for internal workflows.

Highly mature and actively maintained. The repo has 9.3M lines of C# code, active CI/CD pipelines (Azure DevOps), recent commit activity, and multi-version .NET support (.NET 10.0 listed explicitly). No clear test suite is visible in the file list, which is a minor concern, but NuGet badge presence and documented sample applications (Samples/All/) indicate production-grade tooling.

Low risk for a single-author SDK, but consider: Jeffrey Su is the primary maintainer (potential single-point-of-failure), the repo depends heavily on undocumented WeChat API stability, and while CI exists, no prominent unit test files are listed in top 60 files—only sample code and message handlers. Breaking changes between WeChat API versions could require rapid SDK updates.

Active development targeting .NET 10.0 support. Recent additions include AI integration samples (Samples with AI/Samples/All/Senparc.Weixin.Sample.CommonService/AI/MessageHandlers/CustomMessageHandler_AI.cs) and WebSocket message handler support for real-time communication (CustomNet45WebSocketMessageHandler.cs, CustomNetCoreWebSocketMessageHandler.cs). Multi-framework .csproj files indicate ongoing support for .NET Framework, .NET Core 3, .NET 8, and .NET 10.

git clone https://github.com/JeffreySu/WeiXinMPSDK.git
cd WeiXinMPSDK
dotnet build
# Or use Visual Studio to open the .sln file
# Review sample projects under Samples/All/ to understand usage patterns

Daily commands: No single 'run' command—this is a library SDK. To test: open solution in Visual Studio 2019+, build with dotnet build, or run sample projects (Samples/All/) which are runnable ASP.NET Core / Console applications. Sample projects are the actual test harnesses for the SDK.

• Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/CustomMessageHandler.cs — Core message handler implementation that processes WeChat messages—essential for understanding the primary request flow and event handling patterns used throughout the SDK.
• Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/Async/CustomMessageHandlerAsync.cs — Async variant of the message handler showing the SDK's asynchronous patterns—critical for developers implementing real-time WeChat integrations.
• Samples/All/Senparc.Weixin.Sample.CommonService/EventService.cs — Event service abstraction that routes WeChat platform events to handlers—foundational for understanding the event-driven architecture.
• Samples/All/Senparc.Weixin.Sample.CommonService/TemplateMessageService.cs — Template message orchestration layer showing how to send structured notifications—essential pattern reused across platforms (public accounts, mini-programs, enterprise).
• Samples/All/Senparc.Weixin.Sample.CommonService/AI/MessageHandlers/CustomMessageHandler_AI.cs — AI-integrated message handler demonstrating modern extensibility with LLM support—shows how to augment core handlers with advanced capabilities.
• Samples/All/Senparc.Weixin.Sample.CommonService/Download/ConfigHelper.cs — Configuration management helper that centralizes SDK initialization and credential handling—critical for multi-tenant or environment-specific deployments.
• Samples/All/Senparc.Weixin.Sample.CommonService/Senparc.Weixin.Net10Sample.CommonService.csproj — Multi-target project file defining support for .NET Framework, .NET Core, and .NET 10.0—shows the build strategy that makes this SDK platform-agnostic.

Add a new WeChat message type handler

1. Create a new method in CustomMessageHandler.cs following the pattern: public override IResponseMessageBase OnTextRequest(RequestMessageText requestMessage) (Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/CustomMessageHandler.cs)
2. For async support, add corresponding OnTextRequestAsync method in CustomMessageHandlerAsync.cs (Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/Async/CustomMessageHandlerAsync.cs)
3. Register the message type handling in CustomMessageContext.cs if context-aware processing is needed (Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/CustomMessageContext.cs)
4. Wire event routing in EventService.cs if the new type triggers business logic (Samples/All/Senparc.Weixin.Sample.CommonService/EventService.cs)

Add a new template message type for outbound notifications

1. Create new template class inheriting from WeixinTemplate pattern in TemplateMessage folder (Samples/All/Senparc.Weixin.Sample.CommonService/TemplateMessage/WeixinTemplate_PaySuccess.cs)
2. Define template fields matching WeChat's template schema (e.g., {{first.DATA}}, {{keyword1.DATA}}) (Samples/All/Senparc.Weixin.Sample.CommonService/TemplateMessage/WeixinTemplate_ExceptionAlert.cs)
3. Add template instantiation and sending logic to TemplateMessageService.cs (Samples/All/Senparc.Weixin.Sample.CommonService/TemplateMessageService.cs)
4. For mini-programs, create corresponding template variant in WxOpen subfolder (Samples/All/Senparc.Weixin.Sample.CommonService/TemplateMessage/WxOpen/WxOpenTemplateMessage_PaySuccessNotice.cs)

Integrate AI/LLM-powered message understanding

1. Extend CustomMessageHandler_AI.cs to intercept message text before business logic (Samples/All/Senparc.Weixin.Sample.CommonService/AI/MessageHandlers/CustomMessageHandler_AI.cs)
2. Store conversation history in ChatStore.cs for multi-turn dialogue context (Samples/All/Senparc.Weixin.Sample.CommonService/AI/MessageHandlers/ChatStore.cs)
3. Call LLM API (GPT, Claude, Wenxinyiyan) with message context and conversation history (Samples/All/Senparc.Weixin.Sample.CommonService/AI/MessageHandlers/CustomMessageHandler_AI.cs)

WeChat API tokens expire hourly and require background refresh (handled by OpenTicketHelper but needs deployment awareness). Message payload encryption is platform-specific (MP vs Work vs WxOpen)—wrong handler type will silently fail. Sample ConfigHelper.cs reads from Download/Config.cs config file—local testing requires manually setting WeChat app credentials (AppId, AppSecret) or environment variables. WebSocket handlers (CustomNet45WebSocketMessageHandler vs CustomNetCoreWebSocketMessageHandler) are mutually exclusive per framework—project file mismatch causes runtime errors. AI message handler (CustomMessageHandler_AI.cs) is new and may have unstable dependencies.

• WeChat Message Payload Encryption (AES-128-CBC) — WeChat official accounts can optionally encrypt all incoming/outgoing messages; the SDK must handle both plaintext and encrypted modes transparently, and this is a source of integration bugs
• Access Token & Ticket Lifecycle Management — WeChat issues short-lived tokens (2 hours) and separate JS SDK tickets; the SDK must refresh these automatically and handle race conditions when multiple instances compete for token renewal
• Event-Driven Message Handler Pattern — Rather than polling, WeChat pushes events (subscriptions, clicks, payments) to your server via HTTP POST; the SDK abstracts deserialization and routing to handler methods, critical for async/throughput
• Multi-Tenancy via AppId Isolation — Enterprise deployments often manage dozens of WeChat accounts; the SDK must isolate tokens, message routes, and payment credentials per AppId without cross-contamination
• Async Message Handler Composition — CustomMessageHandlerAsync.cs shows deep async/await patterns with cancellation and timeout handling; incorrectly awaiting handlers can deadlock WeChat's message delivery queue
• XML to Object Deserialization (WeChat Native Format) — WeChat's legacy message format is XML, not JSON; the SDK must deserialize to typed C# objects while preserving field ordering for signature validation during encryption
• Callback URL Security (SHA1 Signature Validation) — WeChat posts messages with a signature; the SDK must validate signatures before processing to prevent spoofed requests, critical for payment and sensitive event handling

• imsdk/MiniProgramSDK — Official WeChat mini-program SDK alternative; useful for comparing API design and feature coverage in the mini-program space
• dotnetcore/CAP — Distributed event bus often used with Senparc.Weixin in production to reliably handle WeChat message persistence and retry
• SkyAPM/SkyAPM-dotnet — Observability/tracing for .NET SDK; essential for monitoring WeChat API call latency and failures in production deployments
• polly-dotnet/Polly — Resilience library commonly paired with Senparc.Weixin to handle WeChat API rate limits and transient failures gracefully
• ASP-NET-Core-Boilerplate/ASP.NET-Core-Boilerplate — Example .NET Core web architecture that demonstrates how to structure a WeChat integration project at scale

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Add comprehensive unit tests for CustomMessageHandler and async variants

The repo contains multiple message handler implementations (CustomMessageHandler, CustomMessageHandlerAsync, WorkCustomMessageHandler, CustomWxOpenMessageHandler) in Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/ but there's no evidence of unit tests for these critical components. These handlers process WeChat messages and events, making them high-risk for regressions. Adding tests would improve code quality and serve as documentation for new contributors.

• [ ] Create Senparc.Weixin.Tests project if it doesn't exist
• [ ] Add unit tests for CustomMessageHandler.cs covering all event types (OnLocationRequest, OnScanCodeWaitMsg, etc.)
• [ ] Add unit tests for CustomMessageHandlerAsync.cs with async/await patterns
• [ ] Add integration tests for WorkCustomMessageHandler.cs
• [ ] Add tests for CustomWxOpenMessageHandler.cs covering mini-program scenarios
• [ ] Ensure tests cover message deserialization, event routing, and response generation

Create unit tests for AI MessageHandler (ChatStore and CustomMessageHandler_AI)

The repo includes new AI-powered message handling in Samples/All/Senparc.Weixin.Sample.CommonService/AI/MessageHandlers/ (ChatStore.cs and CustomMessageHandler_AI.cs). These appear to integrate with external AI services, which requires robust testing for request/response handling, error cases, and state management. This is a high-value area with minimal existing test coverage.

• [ ] Create Senparc.Weixin.AI.Tests project
• [ ] Add unit tests for ChatStore.cs covering store/retrieve operations and persistence
• [ ] Add tests for CustomMessageHandler_AI.cs covering AI service integration
• [ ] Add error handling tests for failed AI API calls
• [ ] Add tests for conversation context management and chat history
• [ ] Mock external AI service dependencies

Add GitHub Actions workflow for multi-framework test matrix (.NET 6, 8, 10)

The repo supports multiple .NET versions (Framework, Core 3, .NET 6, 8, 10) as evidenced by multiple .csproj files (Senparc.Weixin.Net45Sample.CommonService.csproj, Senparc.Weixin.Net8Sample.CommonService.csproj, Senparc.Weixin.Net10Sample.CommonService.csproj), but the existing workflow in .github/workflows/master_SenparcWeixinSampleNetCore3.yml only covers .NET Core 3. This creates a blind spot for framework-specific bugs.

• [ ] Review current .github/workflows/master_SenparcWeixinSampleNetCore3.yml structure
• [ ] Create new comprehensive workflow file (e.g., test-multi-framework.yml)
• [ ] Add matrix strategy testing .NET 6.0, 8.0, and 10.0
• [ ] Include .NET Framework 4.5+ testing if possible (via Windows runner)
• [ ] Configure workflow to run on pull_request, push to master, and schedule nightly builds
• [ ] Add build status badges to README.md for each framework version

• Add unit test suite covering CustomMessageHandler deserialization for all message types (text, image, event, etc.)—currently only samples exist, no automated tests in top files
• Document WeChat API version compatibility matrix: create a table in README mapping SDK version → supported WeChat API versions → .NET target frameworks
• Implement typed config validation in ConfigHelper.cs—add schema validation and early-fail error messages for missing AppId/AppSecret instead of runtime 401 errors

The WeiXinMPSDK codebase shows moderate security posture with typical SDK implementation concerns. Primary risks include: (1) potential credential exposure in sample configuration files, (2) WeChat webhook signature validation requirements, (3) input validation in message handlers processing external data, and (4) standard web application security headers in sample projects. The codebase appears well-structured with no obvious critical vulnerabilities visible from file analysis alone. However, the integration with external WeChat APIs and processing of payment/user data requires careful implementation of signature validation, HTTPS enforcement, and input sanitization. Recommended immediate actions: conduct source code review of message handlers and API integration points, implement security header configuration in web samples, and

• Medium · Potential Hardcoded Credentials in Configuration Files — Samples/All/Senparc.Weixin.Sample.CommonService/app.config, Download/Config.cs, Download/ConfigHelper.cs. The presence of app.config and packages.config files in sample projects suggests potential for hardcoded credentials, API keys, or connection strings. While not directly visible in the file listing, these configuration files in sample code are commonly sources of leaked secrets. Fix: Ensure all sensitive configuration (API keys, tokens, connection strings) are stored in environment variables or secure configuration providers (.NET User Secrets, Azure Key Vault). Never commit credentials to version control. Implement pre-commit hooks to prevent accidental commits of sensitive data.
• Medium · Sample Code Security Exposure — Samples/All/Senparc.Weixin.Sample.CommonService/AI/MessageHandlers/, MessageHandlers/. The repository contains extensive sample/demo code that may include example credentials, test tokens, or security-relevant code patterns that could be misused if not properly sanitized. The AI-related samples and message handlers process external input without visible validation. Fix: Audit all sample code to ensure no real credentials are present. Add clear warnings in documentation about securing credentials. Implement comprehensive input validation and sanitization for all message handlers, especially those processing user input or AI interactions.
• Medium · WeChat API Integration Trust Boundary Issues — Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomMessageHandler/. As a WeChat SDK, the codebase handles sensitive operations including payment processing, OAuth tokens, and user data. The presence of CustomMessageHandler files suggests processing of WeChat API responses and webhooks without immediately visible validation of webhook signatures. Fix: Ensure all WeChat webhook signatures are properly validated before processing. Implement strict certificate pinning for API communications. Use HTTPS only for all API calls. Validate and sanitize all data received from WeChat platform. Implement rate limiting on webhook endpoints.
• Low · Missing Security Headers in Web Samples — Samples/All/Senparc.Weixin.Sample.Shared/wwwroot/. The presence of wwwroot with CSS and JavaScript files suggests web application samples. No visible security header configuration (CSP, X-Frame-Options, etc.) in the file structure. Fix: Configure security headers (Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security) in ASP.NET Core middleware. Implement proper CORS policies. Ensure all JavaScript is from trusted sources.
• Low · Potential XSS Risks in Chat Interface — Samples/All/Senparc.Weixin.Sample.Shared/wwwroot/Content/chat-interface.css, AI/MessageHandlers/CustomMessageHandler_AI.cs. The presence of chat-interface.css and AI message handlers suggests dynamic content rendering. HTML content from user messages or AI responses must be properly escaped. Fix: Ensure all user-generated content and API responses are HTML-encoded before rendering. Use templating engines with auto-escaping enabled. Implement Content Security Policy. Never use dangerouslySetInnerHTML or equivalent unsafe DOM methods.
• Low · Third-Party Message Handler Trust — Samples/All/Senparc.Weixin.Sample.CommonService/MessageHandlers/CustomThirdPartyMessageHandlers/. The codebase includes CustomThirdPartyMessageHandler which processes external data/webhooks from third parties. Insufficient validation could lead to security issues. Fix: Implement strict validation for all third-party webhook data. Verify signatures and timestamps. Implement strict type checking. Log all third-party integration activities for audit purposes.

LLM-derived; treat as a starting point, not a security audit.

• Open issues — current backlog
• Recent PRs — what's actively shipping
• Source on GitHub

Generated by RepoPilot. Verdict based on maintenance signals — see the live page for receipts. Re-run on a new commit to refresh.