Christ9038/Ydisks-Xianyu-Helper

What it does

Ydisks Xianyu Helper is a self-hosted management system for Xianyu sellers who run one or more accounts. It puts account runtimes, instant messaging, orders, product listing, card inventory, automation rules, AI replies, and exception notifications into a single web console. Typical use is delivering virtual goods such as codes, links, or images, and answering buyers without switching between many logins.

The Go client handles the Xianyu side of the work: QR login, cookie renewal, MTOP requests, and the WebSocket message path. Most business logic runs server-side, while Chromium is used where a browser environment is required, such as fingerprint or token-slider flows. Storage can be SQLite, MySQL, or PostgreSQL, and sensitive fields are encrypted with AES-256-GCM (2).

Quick start

Docker Compose is the recommended path and works on Linux x86_64, Linux ARM64, and Apple Silicon with Docker Engine or Docker Desktop plus Compose v2 (31).

git clone https://github.com/Christ9038/Ydisks-Xianyu-Helper.git
cd Ydisks-Xianyu-Helper
cp .env.example .env

Fill in at least POSTGRES_DB, POSTGRES_USER, POSTGRES_PASSWORD, DATABASE_URL, XIANYU_DATA_KEY, and XIANYU_ADMIN_PASSWORD in .env; the example values should be replaced with generated secrets. Then start the stack and open the console:

docker compose up -d

Browse to http://localhost:59188 and sign in as administrator with the configured password (36). The queue file uses persistent PostgreSQL, application-data, and browser-data volumes, so back up the database and .env before upgrades.

After login, scan the QR code in Account Management with the Xianyu app, complete any verification through the official flow, wait for the account to come online, then sync products and orders, create delivery content in Card Inventory, and link products, cards, and triggers in Automation (44).

To run from source instead, you need Go 1.26.4 or compatible, Node.js 24 with npm, and Chromium system dependencies (38):

npm --prefix frontend ci
npm --prefix frontend run build
go run ./cmd/server -db data/xianyu_data.db -addr 127.0.0.1:59188

On an empty database the first visit shows an administrator initialization form. Headless environments can initialize with -init-admin and -admin-password instead (59).

Configuration and operations

Database precedence is DATABASE_URL over -db-url over -db (46). The key settings to get right are XIANYU_DATA_KEY (must stay fixed and be backed up, since losing it means protected credentials cannot be decrypted) and XIANYU_ADMIN_PASSWORD. Playwright and Chromium paths are auto-discovered but can be overridden for external runtimes or skipped browser downloads (2).

A health endpoint at /health reports status, database, version, commit, and build time, and is useful after upgrades (51). For production, pin the image to a release or SHA tag rather than latest, and put HTTPS in front with a reverse proxy or load balancer using the -secure flag (53).

Constraints

• The project has no authorization from Xianyu or Alibaba and is an unofficial community tool (2). Use it only within applicable law, platform rules, and your own account authorization.
• Only QR login is supported by the Go client; do not share cookies, passwords, QR codes, or verification URLs (44).
• Restarting frequently while accounts are logged in can trigger risk controls because each restart requests login credentials (2).
• Running without Chromium (-no-browser) disables browser-fingerprint and token-slider features (43).
• Account state, automation, reply rules, AI settings, and administrator credentials live in the database; data sent to external AI, SMTP, webhook, or verification services should be reviewed against their trust and data flow.
• Licensed under Apache-2.0, with notice preservation and modification marking required for distribution (15).

HotRepo's take

The project recorded a best rank of 16 on the all-language GitHub daily list for November 3, 2026, when it showed 2,196 stars and 612 forks with 16 stars gained that day in the Go list. That is a single snapshot, so it supports noting that the repository drew concentrated attention on that day, but not a trend claim. For a self-hosted seller tool, the notable engineering choices are the per-account runtime isolation, idempotency checkpoints for delivery actions, and the explicit credential encryption and redaction guidance—features that matter more for multi-account operations than raw feature count.