Using the Wonda CLI to generate images, videos, music, and audio from the terminal — plus LinkedIn, Reddit, and X/Twitter research and automation
$npx -y skills add degausai/wonda --skill wonda-cliInstalls into the current project.
Run `npx skills use "https://github.com/degausai/wonda" --skill "degausai/wonda/wonda-cli"` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.
Use the skills in "https://github.com/degausai/wonda" that are relevant to the current task. Run `npx skills add "https://github.com/degausai/wonda"` and select the relevant skills, then follow their instructions.
| 1 | # Wonda CLI |
| 2 | |
| 3 | Wonda CLI is a content creation toolkit for terminal-based agents. Use it to generate images, videos, music, and audio; edit and compose media; publish to social platforms; and research/automate across LinkedIn, Reddit, and X/Twitter. |
| 4 | |
| 5 | ## Install |
| 6 | |
| 7 | If `wonda` is not found on PATH, install it first: |
| 8 | |
| 9 | ```bash |
| 10 | # npm |
| 11 | npm i -g @degausai/wonda |
| 12 | |
| 13 | # Homebrew |
| 14 | brew tap degausai/tap && brew install wonda |
| 15 | ``` |
| 16 | |
| 17 | ## Setup |
| 18 | |
| 19 | - **Auth**: `wonda auth login` (opens browser, recommended) or set `WONDA_API_KEY` env var |
| 20 | - **Verify**: `wonda auth check` |
| 21 | |
| 22 | ### OAuth connector auth |
| 23 | |
| 24 | Claude web and Cowork connectors use Wonda's OAuth 2.1 flow instead of a CLI |
| 25 | API key field. The connector signs in through Wonda in the browser, grants the |
| 26 | requested account access, and receives OAuth tokens bound to the Wonda API |
| 27 | resource. The server swaps those tokens to the account's internal API key only |
| 28 | inside Wonda, so agents and connector hosts never see the `sk_...` key. For the |
| 29 | CLI and local stdio MCP path, keep using `wonda auth login` or |
| 30 | `WONDA_API_KEY`. |
| 31 | |
| 32 | ### Claude Cowork local relay |
| 33 | |
| 34 | Claude Cowork (the desktop app) runs local MCP servers on the host, so it can |
| 35 | load the `.mcpb` bundle or a local stdio `wonda-mcp` config directly, WAB |
| 36 | writes included (verified 2026-07-07). Claude web cannot. The Wonda local |
| 37 | relay is the alternative path: it lets the REMOTE connector (web or Cowork) |
| 38 | run actions on the user's own Mac and residential IP without any local MCP |
| 39 | config: |
| 40 | |
| 41 | 1. Open `https://wonda.sh/download` while signed in and install the notarized |
| 42 | Mac package. |
| 43 | 2. Pair the relay with `wonda relay pair` or the first-run browser handoff. This |
| 44 | uses the existing `cli-auth` flow with a relay-scoped `wrelay_...` |
| 45 | credential stored in the macOS Keychain. Do not ask the user to paste an API |
| 46 | key or device code. |
| 47 | 3. Open `https://wonda.sh/setup`, connect LinkedIn, X, and Reddit through the |
| 48 | headful local WAB, then approve the Wonda connector once in Claude. |
| 49 | |
| 50 | The engine policy is `auto | my_machine | cloud`. `auto` uses the local relay |
| 51 | when it is online and cloud otherwise. `my_machine` must not silently fall back: |
| 52 | if the relay is offline, ask whether to switch to cloud. |
| 53 | |
| 54 | ### Organizations & spend context |
| 55 | |
| 56 | Wondercat orgs are shared wallets with their own seats and billing. |
| 57 | Members can spend from the org wallet (instead of their personal credits) |
| 58 | by switching context: |
| 59 | |
| 60 | - `wonda organizations list` (aliases: `wonda orgs list`, `wonda org list`) — see every org you belong to with your role and seat plan in each. |
| 61 | - `wonda use --org <slug>` — sticky org context for this machine. Sets |
| 62 | `X-Wonda-Org` on every request; holds, charges, and `wonda balance` |
| 63 | route through the org wallet. |
| 64 | - `wonda use --personal` — back to personal. |
| 65 | - `wonda usage` — spend-only usage summary (total + per-model + per-project |
| 66 | breakdown) for a period (`--month 2026-05`, or `--from`/`--to`; defaults |
| 67 | to the current month, UTC). `--project <name>` restricts the report to one |
| 68 | project. In org context it reports org-wide usage including a per-member |
| 69 | breakdown — admin/owner role required. Admins can also download a full |
| 70 | Excel report from the org page on the web. |
| 71 | |
| 72 | ### Projects (spend tagging) |
| 73 | |
| 74 | Projects attribute spend to a named workstream for monitoring. Agents |
| 75 | should check the active project at task start (`wonda use` prints it) and |
| 76 | set one per task when the operator monitors spend by project: |
| 77 | |
| 78 | - `wonda use --project <name>` — sticky: every subsequent charge carries |
| 79 | the project (in `wonda usage`, the API, and the org Excel report). |
| 80 | `wonda use --no-project` stops tagging; switching org/personal context |
| 81 | clears the project automatically (projects are per-scope). |
| 82 | - `--project <name>` on any command — one-off override for that invocation. |
| 83 | - `wonda project list|create|delete` — manage the registry in the active |
| 84 | scope. Org projects are created by org admins/owners only; personal |
| 85 | projects are self-service. Tagging against a name that doesn't exist |
| 86 | fails with `unknown_project` (no silent new buckets, so typos can't |
| 87 | split the monitoring data). |
| 88 | |
| 89 | `wonda topup` always tops up your **personal** wallet, regardless of |
| 90 | context. Topping up the org wallet (and configuring auto top-up) is |
| 91 | admin-only and happens on the web at `/organizations/<slug>`. If a |
| 92 | member runs out of org credits, the error tells them to ask an admin or |
| 93 | switch back to personal — they cannot top up the org wallet from CLI. |
| 94 | |
| 95 | Roles inside an org are separate from the seat plan: |
| 96 | |
| 97 | - **Owner**: the original creator. Cannot be demoted or kicked. Can transfer ownership to another member from the org page (rare). |
| 98 | - **Admin**: can invite (single or bulk via paste), kick, change roles, change seats, top up, configure auto top-up, change monthly limits. |
| 99 | - **User**: can only spend within the org wallet (subject to a per-member monthly limit if the admin set one). |
| 100 | |
| 101 | A paid org seat (`WONDA` / `WONDA_PREMIUM`) grants the same paid feature access (skills, etc.) as a personal paid plan, but only while in org context. `wonda use --personal` falls back to the user's personal account plan. |
| 102 | |
| 103 | ### Access tiers |
| 104 | |
| 105 | Wonda is paid-only: every product surface (generation, media, publishing, scraping, analysis, skills, cloud twin) requires a paid plan. New accounts get no credits and no product access until they subscribe. |
| 106 | |
| 107 | | Tier | Access | |
| 108 | | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |
| 109 | | **Anonymous** (temporary account, no login) | No product access. The CLI mints a temporary account on first run, but it reaches only the local commands below plus the auth/billing endpoints. Run `wonda auth login`, then subscribe. | |
| 110 | | **Free** (logged in, no paid plan) | No product access. Subscribe at https://wonda.sh/account to use the product. | |
| 111 | | **WONDA** (`$19.99/mo`, "Pro") | Everything except cloud twin: generation (`image/generate`, `video/generate`, ...), media upload/download, publishing, scraping, analytics, video analysis, skills (`wonda skill install/list/get`), transitions, clipping, email, reddit/linkedin account creation, styles, brand. | |
| 112 | | **WONDA_PREMIUM** (`$49.99/mo`, "Premium") | Everything in WONDA, plus **cloud twin** (`wonda twin`: provisioning, scheduled runs, streamed login) with antidetect / shadowban protection, no caps, and US account creation. | |
| 113 | | **Flagged** (per-account PostHog kill-switches) | Included in the paid plan but still gateable by a per-account flag: `wonda reddit signup` (redditAccountCreationEnabled), `wonda email` (emailServerApiEnabled), public LinkedIn profile enrichment (linkedinProfileEnrichmentEnabled). | |
| 114 | | **Local** (no API call, no credits, no plan) | Run entirely on your machine, so they work without a plan: `wonda brand extract <url>` (no `--save`), `wonda compose motion`/`wonda compose text`, `wonda wab record <url>`, `wonda edit ...` ffmpeg primitive transforms on local files, and `wonda doctor`. The Chromium-backed ones need a one-time `wonda wab install`. | |
| 115 | |
| 116 | If a command returns a `403` (`paid_plan_required`), subscribe at https://wonda.sh/account. |
| 117 | |
| 118 | ### Voice cloning |
| 119 | |
| 120 | Clone a voice from a 10s+ audio clip and use it in TTS. Hard limit: 20 cloned voices per account. Cost: $1.50 per clone. |
| 121 | |
| 122 | ```bash |
| 123 | # Clone from a local file (auto-uploads to media library first) |
| 124 | wonda voice create "Andu" --file ./sample.mp3 --description "My voice" |
| 125 | |
| 126 | # Clone from existing wonda media |
| 127 | wonda voice create "Brand" --media-id <uuid> |
| 128 | |
| 129 | # Optional source-audio preprocessing |
| 130 | wonda voice create "Clean" --file ./raw.wav --noise-reduction --normalize-volume |
| 131 | |
| 132 | # List cloned voices (each row reports isExpired and expiresInDays) |
| 133 | wonda voice list |
| 134 | |
| 135 | # One voice |
| 136 | wonda voice get <voice-id> |
| 137 | |
| 138 | # Rename / re-describe (local only, no provider call) |
| 139 | wonda voice update <voice-id> --name "New Name" --description "..." |
| 140 | |
| 141 | # Delete |
| 142 | wonda voice delete <voice-id> |
| 143 | ``` |
| 144 | |
| 145 | **Use a cloned voice in TTS** by passing the `providerVoiceId` from `voice get` as `voiceId` to `/audio/speech`: |
| 146 | |
| 147 | ```bash |
| 148 | wonda audio speech "Hello world" \ |
| 149 | --model minimax-speech-2-8-hd \ |
| 150 | --params '{"voiceId":"<providerVoiceId>"}' |
| 151 | ``` |
| 152 | |
| 153 | **7-day expiry**: cloned voices that haven't been used in TTS within 7 days are automatically expired. Running TTS with a cloned voice automatically refreshes its expiry. Idle voices that lapse must be re-cloned ($1.50 again). |
| 154 | |
| 155 | ### Credentials vault |
| 156 | |
| 157 | Persist logins created on external platforms (Instagram, TikTok, Twitter, etc.) so they can be reused on the next run. Passwords are AES-256-GCM encrypted with a server-side key and only decrypted on `get`. |
| 158 | |
| 159 | ```bash |
| 160 | # Create |
| 161 | wonda credentials create --website instagram.com --username myhandle \ |
| 162 | --email me@example.com --password-stdin <<< "hunter2" \ |
| 163 | --metadata '{"signup_source":"wonda-email"}' |
| 164 | |
| 165 | # List (passwords omitted) |
| 166 | wonda credentials list --website instagram.com |
| 167 | |
| 168 | # Get full record including decrypted password |
| 169 | wonda credentials get <id> |
| 170 | |
| 171 | # Update any field (use --password-stdin to rotate; --username "" to clear) |
| 172 | wonda credentials update <id> --username newhandle |
| 173 | |
| 174 | # Delete |
| 175 | wonda credentials delete <id> |
| 176 | |
| 177 | # Fetch + record why you're using it in one call — POST, not GET, because |
| 178 | # it writes a 'used' event with the reason. Prefer this over `get` whenever |
| 179 | # you can articulate the reason. |
| 180 | wonda credentials use <id> --reason "instagram signup flow" |
| 181 | |
| 182 | # See recent events (created / used / rotated / updated) for audit |
| 183 | wonda credentials events <id> |
| 184 | ``` |
| 185 | |
| 186 | Fields: `website` (required — typed input like `insta` is canonicalized to `instagram.com`), `username`, `email`, `password` (required), `metadata` (arbitrary JSON). At least one of `username` / `email` must be present. Multiple records per `(website, username)` are allowed — dedupe on your side if you need to. |
| 187 | |
| 188 | **Event log**: every `credentials get`/`use`, `create`, password rotate, and other updates are recorded as events on the credential (actor: `cli` | `web` | `system`). Use `credentials events <id>` or the web UI's history icon to audit. The event log is append-only and cascades on credential delete. |
| 189 | |
| 190 | ### Global output flags |
| 191 | |
| 192 | All commands support these output control flags: |
| 193 | |
| 194 | - `--json` — Force JSON output (auto-enabled when stdout is piped) |
| 195 | - `--quiet` — Only output the primary identifier (job ID, media ID, etc.) — ideal for scripting |
| 196 | - `-o <path>` — Download output to file (implies `--wait`) |
| 197 | - `--fields status,outputs` — Select specific JSON fields |
| 198 | - `--jq '.outputs[0].media.url'` — Filter JSON output with a jq expression |
| 199 | |
| 200 | ### CLI announcements & deprecation warnings |
| 201 | |
| 202 | On every command the CLI polls `GET /api/v1/updates` (anonymous, 1h cache in `~/.wonda/state.json`) for active announcements: deprecation notices, incident heads-ups, upgrade prompts. Messages are printed to stderr only, so stdout/JSON stays clean for piping. |
| 203 | |
| 204 | Per-request deprecation hints arrive as the standard `Warning: 299 - "<message>"` HTTP header and are surfaced to stderr by the CLI's HTTP client as `[deprecated METHOD /path] <message>`. |
| 205 | |
| 206 | Silence both channels with `WONDA_QUIET=1` (env var) or `--quiet` (flag). Disable just the network checks with `WONDA_NO_UPDATE_CHECK=1`. |
| 207 | |
| 208 | ### WAB / Wonda Automation Browser (`wonda wab`) |
| 209 | |
| 210 | The Wonda Automation Browser (WAB) is a premium stealth antidetect browser, hardened so platforms cannot fingerprint it as automation. `wonda wab` is the one command for the antidetect Chromium stack (an undetected Playwright fork). It has two faces: |
| 211 | |
| 212 | - **Authenticated sessions.** One persistent headful Chromium per persona that holds signed-in sessions for LinkedIn, X, Reddit, and friends. The CLI spawns it on demand, lets it idle out, and routes platform reads/writes through it whenever a command runs `--via wab`. Cookies live in the persona's Chromium profile, not in `~/.wonda/config.json`. |
| 213 | - **Anonymous capture.** `wonda wab record <url>` (and `wonda brand extract`) drive an ephemeral Chromium with a fresh fingerprint, no persona, no cookies. See the `record` block below. |
| 214 | |
| 215 | The mental model: you have **accounts** (one identity per platform). Each platform command routes to that account's cookies via either the flat JSON store (`--via cookies`, fast, no Chromium) or the account's **persona** (`--via wab`, live antidetect Chromium). A persona is the Chromium envelope that can hold multiple accounts under one fingerprint. In almost every case the persona is auto-created on first `--via wab` use, named after the account, so you never type a persona name. |
| 216 | |
| 217 | The local `wonda.mcpb` Desktop Extension uses this same local WAB path from Claude Desktop or Claude Code: platform cookies stay on-device, reads use local cookies, and writes use the local WAB. Claude web and Cowork need the remote MCP connector instead. |
| 218 | |
| 219 | **Native login is the default for a new persona.** `wonda wab login <persona> <platform>` opens a headful WAB window and you log in there. The session is minted INSIDE the WAB, so it is independent (logging out of the same account in an unrelated Chrome cannot revoke it) and the cookies are born under the WAB's own fingerprint, so session and browser identity stay coherent. A brand-new persona auto-created on first `--via wab` use chains straight into this flow on a TTY. After an X login, Wonda detects the signed-in `screen_name` and records it as the persona's X account binding. Existing bindings are never silently changed; a different detected handle produces a warning. Pasting cookies from another browser (`wonda linkedin auth set`, `wonda x auth set`, ...) still works and is the explicit fallback, but a hand-pasted `li_at` on a novel WAB fingerprint is the highest-risk shape. |
| 220 | |
| 221 | ```bash |
| 222 | wonda wab install # one-time: npm install + stealth-browser Chromium (shared by sessions, record, brand extract) |
| 223 | wonda wab start [account] # spawn (offscreen by default; --visible to show) |
| 224 | wonda wab stop [account] # graceful shutdown |
| 225 | wonda wab show [account] # peek a background WAB on-screen to watch it (suspends the macOS focus guard); starts it offscreen first if needed |
| 226 | wonda wab hide [account] # send a surfaced WAB back offscreen, resume silent background operation |
| 227 | wonda wab screenshot [account] # capture the persona's current page as a PNG without surfacing the window; --json returns inline base64, --output writes a file, --tab/--full-page optional |
| 228 | wonda wab browse [url] --persona <persona> # load a page and scroll it like a person: pause, scroll, pause, scroll; stops early once the scrolled element stops advancing, see below (plain text output, not JSON) |
| 229 | wonda wab menubar # macOS menu-bar control (🐱): click to Show/Hide running WABs; --stop to remove |
| 230 | # macOS Dock menu: right-click a running WAB's Dock tile (the 🐱) for "Show on screen" / "Send to background" (same as wab show/hide). Each running persona has its own Dock tile and its menu controls only that persona. Opt out with WAB_DOCK_MENU=0. |
| 231 | # macOS: a background WAB no longer steals focus or flashes the menu bar / Dock when it opens a new tab; the Dock tile stays, it just never comes to the foreground until you `wab show` it. |
| 232 | wonda wab status # list personas + last activity + browser-context health (a running daemon whose Chromium died shows browser-dead with a restart hint instead of a misleading plain "running") |
| 233 | wonda wab login <account> <linkedin|x|reddit|instagram> # RECOMMENDED for a new persona: open headful window, user logs in, session minted in-WAB (independent + fingerprint-coherent) |
| 234 | wonda wab check <account> <linkedin|x|reddit|instagram> # non-interactive session-alive probe |
| 235 | wonda wab bind <persona> --x <acct> --reddit <acct> --linkedin <acct> # multi-account power-user path: bind N accounts to ONE persona |
| 236 | wonda wab record <url> # anonymous one-shot capture (no account, no cookies), see below |
| 237 | wonda wab sync-cookies [account] # force wab → disk cookie sync now (don't wait for the 10-min timer) |
| 238 | wonda wab logs [account] --tail 100 # tail driver.log (--audit for structured per-command log) |
| 239 | wonda wab errors --tail 20 --since 24h # tail the cross-persona action-failure log |
| 240 | wonda wab top-failures --since 7d # rank local WAB failures by platform/action/reason, joined with DOM recovery stats |
| 241 | wonda wab top-failures --platform x --json # machine-readable local failure ranking |
| 242 | wonda wab bundle-failures list # recent action failure bundles (one per failed run: screenshot, dom, visible-elements, cookies-summary REDACTED) |
| 243 | wonda wab bundle-failures show <id> # print manifest + file tree for a bundle (id = unix-ms-ts prefix) |
| 244 | wonda wab bundle-failures ship <id> # zip to ~/Downloads/wonda-failure-<id>.zip for sharing |
| 245 | wonda wab bundle-failures prune # remove bundles older than 30d (or --max-per-persona, --all) |
| 246 | # Telemetry: on every wab action failure we report (action, platform, reason, error-string, has_bundle, cli_version) as a wab_action_failed PostHog event so maintainers can spot platform rotations across users. NO bundle contents, NO cookies, NO DOM, NO screenshots leave the user's machine. Opt out: WONDA_TELEMETRY_DISABLED=1. For server-side breakdowns, group `wab_action_failed` by `platform`, `action`, `reason`, and `has_bundle` in PostHog. Locally, `wonda wab top-failures` reads only `~/.wonda/wab/errors.jsonl` and persona-local `dom-recoveries.jsonl`, then shows count, last seen, recovered rate, bundle count, and a sample bundle id. |
| 247 | wonda wab migrate-legacy # copy a legacy WAB-driver profile into a persona slot |
| 248 | wonda wab restore <persona> [timestamp] # restore from an hourly snapshot (--list to enumerate) |
| 249 | wonda wab backup disable # opt out of auto-push (on by default; existing cloud backups untouched) |
| 250 | wonda wab backup enable # opt back in (auto-push synced cookie JSON to wondercat after every disk sync) |
| 251 | wonda wab backup status # show config + remote inventory |
| 252 | wonda wab backup push [account] # one-shot manual push for all platform bindings |
| 253 | wonda wab backup pull [account] # guarded restore to ~/.wonda/<platform>-cookies/<account>.json; refuses non-empty local unless --force |
| 254 | wonda wab backup pull [account] --dry-run # preview restores without writing |
| 255 | wonda wab backup list # inventory of cloud backups, including device/provenance metadata when available |
| 256 | wonda wab b |