@chainlesschain/personal-data-hub 0.4.0 → 0.4.2

package/lib/adapters/_pc-local-discovery.js

@@ -0,0 +1,362 @@
+"use strict";
+
+/**
+ * PC local-data auto-discovery — find a desktop App's local SQLite database(s)
+ * on the host WITHOUT the user having to type a path.
+ *
+ * Why this exists: every device-pull desktop IM adapter (wechat-pc / qq-pc /
+ * dingtalk-pc / feishu-pc) used to require an explicit `opts.dbPath`. With no
+ * path the readiness probe reported `DB_NOT_PULLED` and the UI offered no way
+ * to start — so "一键采集" was impossible for these sources even though the
+ * database sits at a well-known location on the very machine running cc.
+ *
+ * This module scans the known default install / data directories for each
+ * supported App and returns the discovered database files, grouped by the
+ * login account, with an `encrypted` flag and the *primary* message DB picked
+ * out. Adapters call it from `authenticate()` (readiness) and `sync()` (auto
+ * path) so the common case becomes truly one-click: install the App, log in,
+ * click 采集.
+ *
+ * Layout knowledge is version-aware where it matters:
+ *   - WeChat 4.x:  ~/Documents/xwechat_files/<wxid>_<n>/db_storage/...
+ *   - WeChat 3.x:  ~/Documents/WeChat Files/<wxid>/Msg/...
+ *   - QQ NT:       ~/Documents/Tencent Files/<uin>/nt_qq/nt_db/nt_msg.db
+ *   - DingTalk:    %APPDATA%/DingTalk/**, ~/Documents/DingTalk/**  (best-effort)
+ *   - Feishu/Lark: %APPDATA%/Feishu | Lark /**                     (best-effort)
+ *
+ * Pure + dependency-injectable: pass { fs, path, platform, home, env } so the
+ * whole thing is unit-testable against a synthetic filesystem with no real
+ * Apps installed. Defaults read the real host.
+ *
+ * Everything is best-effort and defensive: a missing directory, a permission
+ * error, or an unexpected layout yields `{ installed: false }` rather than
+ * throwing — discovery must never break a readiness probe.
+ */
+
+const nodeFs = require("node:fs");
+const nodePath = require("node:path");
+const nodeOs = require("node:os");
+
+/** App keys this module knows how to discover. */
+const SUPPORTED_APPS = Object.freeze([
+  "wechat-pc",
+  "qq-pc",
+  "dingtalk-pc",
+  "feishu-pc",
+]);
+
+// ─── injectable host accessors ─────────────────────────────────────────────
+
+function makeDeps(deps = {}) {
+  const fs = deps.fs || nodeFs;
+  const path = deps.path || nodePath;
+  const platform = deps.platform || process.platform;
+  const home =
+    deps.home || (deps.os && deps.os.homedir ? deps.os.homedir() : nodeOs.homedir());
+  const env = deps.env || process.env;
+  return { fs, path, platform, home, env };
+}
+
+function safeReaddir(fs, dir) {
+  try {
+    return fs.readdirSync(dir, { withFileTypes: true });
+  } catch (_e) {
+    return [];
+  }
+}
+
+function safeExists(fs, p) {
+  try {
+    return fs.existsSync(p);
+  } catch (_e) {
+    return false;
+  }
+}
+
+function safeSize(fs, p) {
+  try {
+    return fs.statSync(p).size;
+  } catch (_e) {
+    return 0;
+  }
+}
+
+/** List immediate subdirectory names of `dir` (empty array on any error). */
+function listSubdirs(fs, path, dir) {
+  return safeReaddir(fs, dir)
+    .filter((e) => e.isDirectory())
+    .map((e) => e.name);
+}
+
+/**
+ * Recursively collect *.db / *.sqlite / *.sqlite3 files under `root` up to
+ * `maxDepth`. Used for best-effort Apps (DingTalk / Feishu) whose internal
+ * layout is proprietary and version-volatile. Bounded so a huge tree can't
+ * stall a readiness probe.
+ */
+function collectDbFiles(fs, path, root, maxDepth, out, depth) {
+  if (depth > maxDepth) return out;
+  for (const e of safeReaddir(fs, root)) {
+    const fp = path.join(root, e.name);
+    if (e.isFile() && /\.(db|sqlite|sqlite3)$/i.test(e.name)) {
+      out.push(fp);
+    } else if (e.isDirectory()) {
+      collectDbFiles(fs, path, fp, maxDepth, out, depth + 1);
+    }
+  }
+  return out;
+}
+
+// ─── per-App discovery ─────────────────────────────────────────────────────
+
+/**
+ * WeChat desktop — handles BOTH the 4.x (`xwechat_files`) and 3.x
+ * (`WeChat Files`) layouts. Both store SQLCipher-encrypted DBs.
+ */
+function discoverWeChat({ fs, path, home, env }) {
+  const accounts = [];
+  let layout = null;
+
+  // ── 4.x: ~/Documents/xwechat_files/<wxid>_<n>/db_storage/ ──
+  const v4Root = path.join(home, "Documents", "xwechat_files");
+  if (safeExists(fs, v4Root)) {
+    for (const name of listSubdirs(fs, path, v4Root)) {
+      // account dirs look like wxid_xxx_1234 ; skip all_users / login etc.
+      if (!/^wxid_/.test(name)) continue;
+      const storage = path.join(v4Root, name, "db_storage");
+      if (!safeExists(fs, storage)) continue;
+      const dbs = [];
+      const msgDir = path.join(storage, "message");
+      for (const e of safeReaddir(fs, msgDir)) {
+        if (e.isFile() && /^message_\d+\.db$/i.test(e.name)) {
+          dbs.push(mkDb(path.join(msgDir, e.name), "message", "私聊/群聊消息", true, fs));
+        }
+        if (e.isFile() && /^biz_message_\d+\.db$/i.test(e.name)) {
+          dbs.push(mkDb(path.join(msgDir, e.name), "biz-message", "公众号消息", true, fs));
+        }
+      }
+      const contactDb = path.join(storage, "contact", "contact.db");
+      if (safeExists(fs, contactDb)) {
+        dbs.push(mkDb(contactDb, "contact", "联系人", true, fs));
+      }
+      const snsDb = path.join(storage, "sns", "sns.db");
+      if (safeExists(fs, snsDb)) dbs.push(mkDb(snsDb, "sns", "朋友圈", true, fs));
+      const favDb = path.join(storage, "favorite", "favorite.db");
+      if (safeExists(fs, favDb)) dbs.push(mkDb(favDb, "favorite", "收藏", true, fs));
+      if (dbs.length > 0) {
+        layout = "4.x";
+        accounts.push({ id: name.replace(/_\d+$/, ""), root: path.join(v4Root, name), dbs });
+      }
+    }
+  }
+
+  // ── 3.x: ~/Documents/WeChat Files/<wxid>/Msg/ ──
+  const v3Roots = [
+    path.join(home, "Documents", "WeChat Files"),
+    env.APPDATA ? path.join(env.APPDATA, "Tencent", "WeChat", "WeChat Files") : null,
+  ].filter(Boolean);
+  for (const root of v3Roots) {
+    if (!safeExists(fs, root)) continue;
+    for (const name of listSubdirs(fs, path, root)) {
+      if (name === "All Users" || name === "Applet" || name === "WMPF") continue;
+      const msgDir = path.join(root, name, "Msg");
+      const multiDir = path.join(msgDir, "Multi");
+      const dbs = [];
+      for (const e of safeReaddir(fs, multiDir)) {
+        if (e.isFile() && /^MSG\d+\.db$/i.test(e.name)) {
+          dbs.push(mkDb(path.join(multiDir, e.name), "message", "私聊/群聊消息", true, fs));
+        }
+      }
+      const microMsg = path.join(msgDir, "MicroMsg.db");
+      if (safeExists(fs, microMsg)) {
+        dbs.push(mkDb(microMsg, "contact", "联系人", true, fs));
+      }
+      if (dbs.length > 0) {
+        layout = layout || "3.x";
+        accounts.push({ id: name, root: path.join(root, name), dbs });
+      }
+    }
+  }
+
+  return finalize("wechat-pc", accounts, {
+    layout,
+    encryptedNote:
+      "微信本地库为 SQLCipher 加密，需提取数据库密钥后才能解密读取（见 wechat 密钥提取）",
+  });
+}
+
+/** QQ NT desktop — ~/Documents/Tencent Files/<uin>/nt_qq/nt_db/nt_msg.db */
+function discoverQQ({ fs, path, home, env }) {
+  const accounts = [];
+  const roots = [
+    path.join(home, "Documents", "Tencent Files"),
+    env.APPDATA ? path.join(env.APPDATA, "Tencent", "QQ") : null,
+  ].filter(Boolean);
+  for (const root of roots) {
+    if (!safeExists(fs, root)) continue;
+    for (const name of listSubdirs(fs, path, root)) {
+      // per-uin dirs are all-digit; skip nt_qq (global) etc.
+      if (!/^\d+$/.test(name)) continue;
+      const ntDb = path.join(root, name, "nt_qq", "nt_db", "nt_msg.db");
+      if (safeExists(fs, ntDb)) {
+        const dbs = [mkDb(ntDb, "message", "私聊/群聊消息", true, fs)];
+        const grpInfo = path.join(root, name, "nt_qq", "nt_db", "group_info.db");
+        if (safeExists(fs, grpInfo)) dbs.push(mkDb(grpInfo, "group-info", "群信息", true, fs));
+        const profile = path.join(root, name, "nt_qq", "nt_db", "profile_info.db");
+        if (safeExists(fs, profile)) dbs.push(mkDb(profile, "profile", "好友资料", true, fs));
+        accounts.push({ id: name, root: path.join(root, name, "nt_qq"), dbs });
+      }
+    }
+  }
+  return finalize("qq-pc", accounts, {
+    encryptedNote:
+      "QQ NT 本地库为 SQLCipher 加密（数字混淆列 + protobuf 消息体），需密钥解密",
+  });
+}
+
+/** DingTalk / Feishu — proprietary layout, best-effort recursive scan. */
+function discoverGenericIm(appName, roots, { fs, path }) {
+  const accounts = [];
+  for (const root of roots) {
+    if (!safeExists(fs, root)) continue;
+    const files = collectDbFiles(fs, path, root, 5, [], 0);
+    // Heuristic: message DBs are the larger files whose name hints at chat.
+    const dbs = files
+      .filter((fp) => !/\b(fts|index|cache|emoji|emoticon|head_image)\b/i.test(fp))
+      .map((fp) => {
+        const base = path.basename(fp);
+        const isMsg = /msg|message|chat|conversation|im_/i.test(base);
+        return mkDb(fp, isMsg ? "message" : "other", base, /* encrypted */ false, fs);
+      })
+      .sort((a, b) => b.sizeBytes - a.sizeBytes);
+    if (dbs.length > 0) {
+      accounts.push({ id: "default", root, dbs });
+    }
+  }
+  return finalize(appName, accounts, {
+    encryptedNote:
+      "桌面本地库为私有结构、可能加密、随版本变化；优先尝试明文直读，必要时先解密",
+    bestEffort: true,
+  });
+}
+
+function discoverDingTalk({ fs, path, home, env }) {
+  const roots = [
+    env.APPDATA ? path.join(env.APPDATA, "DingTalk") : null,
+    path.join(home, "Documents", "DingTalk"),
+  ].filter(Boolean);
+  return discoverGenericIm("dingtalk-pc", roots, { fs, path });
+}
+
+function discoverFeishu({ fs, path, home, env }) {
+  const roots = [
+    env.APPDATA ? path.join(env.APPDATA, "Feishu") : null,
+    env.APPDATA ? path.join(env.APPDATA, "Lark") : null,
+  ].filter(Boolean);
+  return discoverGenericIm("feishu-pc", roots, { fs, path });
+}
+
+// ─── helpers ───────────────────────────────────────────────────────────────
+
+function mkDb(p, purpose, label, encrypted, fs) {
+  return {
+    path: p,
+    purpose, // message | biz-message | contact | sns | favorite | group-info | profile | other
+    label,
+    encrypted: !!encrypted,
+    sizeBytes: safeSize(fs, p),
+  };
+}
+
+/**
+ * Common tail: pick the primary message DB (largest message-purpose file
+ * across all accounts) and compute the installed flag + summary.
+ */
+function finalize(app, accounts, extra = {}) {
+  const allDbs = accounts.flatMap((a) => a.dbs);
+  const messageDbs = allDbs
+    .filter((d) => d.purpose === "message")
+    .sort((a, b) => b.sizeBytes - a.sizeBytes);
+  const primaryDb = (messageDbs[0] || allDbs[0] || null);
+  const anyEncrypted = allDbs.some((d) => d.encrypted);
+  return {
+    app,
+    installed: accounts.length > 0,
+    accounts,
+    primaryDb: primaryDb ? primaryDb.path : null,
+    primaryDbInfo: primaryDb,
+    encrypted: anyEncrypted,
+    dbCount: allDbs.length,
+    layout: extra.layout || null,
+    bestEffort: !!extra.bestEffort,
+    note: accounts.length > 0 ? extra.encryptedNote || null : "未检测到本地数据（可能未安装或未登录）",
+  };
+}
+
+const DISCOVERERS = Object.freeze({
+  "wechat-pc": discoverWeChat,
+  "qq-pc": discoverQQ,
+  "dingtalk-pc": discoverDingTalk,
+  "feishu-pc": discoverFeishu,
+});
+
+/**
+ * Discover one App's local databases.
+ *
+ * @param {string} appKey  one of SUPPORTED_APPS
+ * @param {object} [deps]  { fs, path, platform, home, env } — inject for tests
+ * @returns {DiscoveryResult}
+ *
+ * @typedef {object} DiscoveryResult
+ * @property {string}  app
+ * @property {boolean} installed       any account+DB found?
+ * @property {Array}   accounts        [{ id, root, dbs: [{path,purpose,label,encrypted,sizeBytes}] }]
+ * @property {string|null} primaryDb   best message DB path to point sync at
+ * @property {object|null} primaryDbInfo
+ * @property {boolean} encrypted       any discovered DB is encrypted?
+ * @property {number}  dbCount
+ * @property {string|null} layout      version layout hint (wechat: "4.x"/"3.x")
+ * @property {boolean} bestEffort      heuristic discovery (dingtalk/feishu)?
+ * @property {string|null} note
+ */
+function discover(appKey, deps = {}) {
+  const fn = DISCOVERERS[appKey];
+  if (!fn) {
+    return {
+      app: appKey,
+      installed: false,
+      accounts: [],
+      primaryDb: null,
+      primaryDbInfo: null,
+      encrypted: false,
+      dbCount: 0,
+      layout: null,
+      bestEffort: false,
+      note: `不支持的 App: ${appKey}`,
+    };
+  }
+  try {
+    return fn(makeDeps(deps));
+  } catch (err) {
+    // Discovery must never throw into a readiness probe.
+    return {
+      app: appKey,
+      installed: false,
+      accounts: [],
+      primaryDb: null,
+      primaryDbInfo: null,
+      encrypted: false,
+      dbCount: 0,
+      layout: null,
+      bestEffort: false,
+      note: `自动发现出错：${err && err.message ? err.message : String(err)}`,
+    };
+  }
+}
+
+module.exports = {
+  discover,
+  SUPPORTED_APPS,
+  // exported for unit tests
+  _internals: { collectDbFiles, finalize, mkDb },
+};

package/lib/adapters/qq-pc/index.js

@@ -61,17 +61,46 @@ class QQPcAdapter {
     };
   }
 
+  _autoDiscover() {
+    if (this._discovered !== undefined) return this._discovered;
+    try {
+      // eslint-disable-next-line global-require
+      const { discover } = require("../_pc-local-discovery");
+      this._discovered = discover("qq-pc", this._deps.discoveryDeps || {});
+    } catch (_e) {
+      this._discovered = null;
+    }
+    return this._discovered;
+  }
+
+  _resolveDiscoveredDbPath() {
+    const disc = this._autoDiscover();
+    return disc && disc.installed && disc.primaryDb ? disc.primaryDb : null;
+  }
+
   async authenticate(ctx = {}) {
     if (ctx && ctx.readinessOnly) {
       if (this._dbPath) return { ok: true, mode: "configured" };
+      const disc = this._autoDiscover();
+      if (disc && disc.installed) {
+        return {
+          ok: false,
+          reason: "DB_FOUND_NEEDS_KEY",
+          message: `已找到本机 QQ 库（${disc.accounts.length} 个账号，主库 ${disc.primaryDb}）`,
+          discovered: disc,
+        };
+      }
       return {
         ok: false,
-        reason: "DB_NOT_PULLED",
-        message:
-          "qq-pc: 需提供电脑版 QQ 的 nt_msg.db 路径（加密库需先解密或提供 key）",
+        reason: "APP_NOT_INSTALLED",
+        message: (disc && disc.note) || "未检测到本机 QQ NT 数据（可能未安装或未登录）",
       };
     }
-    const dbPath = (ctx && ctx.inputPath) || (ctx && ctx.dbPath) || this._dbPath;
+    const dbPath =
+      (ctx && ctx.inputPath) ||
+      (ctx && ctx.dbPath) ||
+      this._dbPath ||
+      this._resolveDiscoveredDbPath();
     if (dbPath) {
       try {
         this._deps.fs.accessSync(dbPath, this._deps.fs.constants.R_OK);
@@ -84,10 +113,19 @@ class QQPcAdapter {
       }
       return { ok: true, mode: "sqlite" };
     }
+    const disc = this._autoDiscover();
+    if (disc && disc.installed) {
+      return {
+        ok: false,
+        reason: "DB_FOUND_NEEDS_KEY",
+        message: `已找到本机 QQ 库（主库 ${disc.primaryDb}），需解密密钥`,
+        discovered: disc,
+      };
+    }
     return {
       ok: false,
-      reason: "DB_NOT_PULLED",
-      message: "qq-pc.authenticate: needs opts.dbPath / inputPath (nt_msg.db)",
+      reason: "APP_NOT_INSTALLED",
+      message: "qq-pc.authenticate: 未检测到本机 QQ NT 库，也未提供 dbPath / inputPath",
     };
   }
 
@@ -96,9 +134,10 @@ class QQPcAdapter {
   }
 
   async *sync(opts = {}) {
-    const dbPath = opts.dbPath || opts.inputPath || this._dbPath;
+    const dbPath =
+      opts.dbPath || opts.inputPath || this._dbPath || this._resolveDiscoveredDbPath();
     if (!dbPath) {
-      throw new Error("qq-pc.sync: needs opts.dbPath / opts.inputPath (nt_msg.db)");
+      throw new Error("qq-pc.sync: 未找到本机 QQ NT 库且未提供 opts.dbPath / opts.inputPath");
     }
     if (!this._deps.fs.existsSync(dbPath)) return;
 

package/lib/adapters/social-douyin-adb/db-extension.js

@@ -37,8 +37,29 @@ const crypto = require("node:crypto");
 const DOUYIN_DB_REMOTE_DIR =
   "/data/data/com.ss.android.ugc.aweme/databases";
 
+// Legacy plaintext social-DM IM db (Brignoni 2018 TikTok era, `<19-digit-uid>_im.db`).
 const IM_DB_PATTERN = /^(\d{19})_im\.db$/;
 
+// Real-device verification 2026-06-08 (Xiaomi chopin / MIUI 13, Douyin
+// v??-2026 logged in) found CURRENT Douyin no longer ships a plaintext
+// social-DM IM db. Two new on-disk shapes coexist in databases/:
+//
+//   encrypted_<uid>_im.db   — the social DM store, now SQLCipher-ENCRYPTED
+//                             (header is NOT `SQLite format 3`). Reading it
+//                             needs the per-user key, which only the frida
+//                             key-hook path (Phase 2b, libmsaoaidsec.so
+//                             anti-debug bypass) can recover — the plaintext
+//                             C-path here cannot.
+//   im_database_<uid>       — a Room db, but it is the in-app 豆包/Doubao AI
+//                             ASSISTANT chat (tables im_message / im_conversation
+//                             / im_bot), NOT person-to-person social DMs.
+//
+// We classify all three so the handler can emit a precise, actionable error
+// instead of a misleading DOUYIN_NO_IM_DB. See memory
+// [[pdh_douyin_c_path_phase_2a]] / [[pdh_social_cookie_endpoint_drift_2026_05]].
+const ENCRYPTED_IM_DB_PATTERN = /^encrypted_(\d+)_im\.db$/;
+const DOUBAO_IM_DB_PATTERN = /^im_database_(\d{6,})$/;
+
 /**
  * List candidate IM db filenames + uid via `adb shell su -c "ls databases/"`.
  *
@@ -64,15 +85,27 @@ async function listImDbs(adb, serial, opts) {
     return { candidates: [], dirMissing: true };
   }
   const candidates = [];
+  const encryptedCandidates = [];
+  const doubaoCandidates = [];
   for (const line of lines) {
     const fileName = line.trim();
     if (!fileName) continue;
     const m = fileName.match(IM_DB_PATTERN);
     if (m) {
       candidates.push({ uid: m[1], fileName });
+      continue;
+    }
+    const enc = fileName.match(ENCRYPTED_IM_DB_PATTERN);
+    if (enc) {
+      encryptedCandidates.push({ uid: enc[1], fileName });
+      continue;
+    }
+    const doubao = fileName.match(DOUBAO_IM_DB_PATTERN);
+    if (doubao) {
+      doubaoCandidates.push({ uid: doubao[1], fileName });
     }
   }
-  return { candidates, dirMissing: false };
+  return { candidates, encryptedCandidates, doubaoCandidates, dirMissing: false };
 }
 
 /**
@@ -159,9 +192,10 @@ function createDouyinDbExtension(factoryOpts = {}) {
     }
 
     // Step 1: discover candidate IM dbs.
-    const { candidates, dirMissing } = await listImDbs(ctx.adb, serial, {
-      timeoutMs,
-    });
+    const { candidates, encryptedCandidates, doubaoCandidates, dirMissing } =
+      await listImDbs(ctx.adb, serial, {
+        timeoutMs,
+      });
     if (dirMissing) {
       throw new Error(
         "DOUYIN_NOT_INSTALLED: " +
@@ -170,6 +204,32 @@ function createDouyinDbExtension(factoryOpts = {}) {
       );
     }
     if (candidates.length === 0) {
+      // No legacy plaintext IM db. Distinguish the modern layouts so the UI
+      // can tell the user the truth instead of "no db found". Real-device
+      // verification 2026-06-08 — see ENCRYPTED_IM_DB_PATTERN comment above.
+      if (encryptedCandidates && encryptedCandidates.length > 0) {
+        throw new Error(
+          "DOUYIN_IM_DB_ENCRYPTED: this Douyin version stores its social DM db as " +
+            `\`encrypted_<uid>_im.db\` (SQLCipher) — found ${encryptedCandidates
+              .map((c) => c.fileName)
+              .join(", ")}. The plaintext C-path can't read it; the per-user ` +
+            "key must be recovered via the frida key-hook path (Phase 2b, " +
+            "libmsaoaidsec.so anti-debug bypass). Plaintext direct-read is no " +
+            "longer possible on current Douyin.",
+        );
+      }
+      if (doubaoCandidates && doubaoCandidates.length > 0) {
+        throw new Error(
+          "DOUYIN_ONLY_DOUBAO_AI_CHAT: the only readable `im_database_<uid>` db " +
+            `(${doubaoCandidates
+              .map((c) => c.fileName)
+              .join(", ")}) is the in-app 豆包/Doubao AI ASSISTANT chat ` +
+            "(tables im_message / im_conversation / im_bot), not person-to-person " +
+            "social DMs. Social DMs live in the SQLCipher `encrypted_<uid>_im.db` " +
+            "and need the frida key path. (Collecting Doubao AI chat would be a " +
+            "separate, net-new adapter.)",
+        );
+      }
       throw new Error(
         "DOUYIN_NO_IM_DB: no `<19-digit-uid>_im.db` found in databases/. Open the Douyin App + log in once + open any chat thread to materialize the IM database, then retry.",
       );
@@ -273,6 +333,8 @@ module.exports = {
   createDouyinDbExtension,
   DOUYIN_DB_REMOTE_DIR,
   IM_DB_PATTERN,
+  ENCRYPTED_IM_DB_PATTERN,
+  DOUBAO_IM_DB_PATTERN,
   // Exposed for tests
   _internals: {
     listImDbs,

package/lib/adapters/social-weibo-adb/cookies-extension.js

@@ -53,6 +53,22 @@ const {
 const WEIBO_COOKIES_REMOTE_PATH =
   "/data/data/com.sina.weibo/app_webview/Default/Cookies";
 
+/**
+ * Glob the WebView profile dir at pull time. Real-device verification
+ * (2026-06-08, Xiaomi chopin / MIUI 13 / Weibo logged in) showed current
+ * Weibo stores cookies under a SUFFIXED profile dir
+ * `app_webview_com.sina.weibo/Default/Cookies`, NOT the standard
+ * `app_webview/Default/Cookies` — so the old hardcoded path made the
+ * collector throw WEIBO_NOT_INSTALLED even though Weibo was installed and
+ * logged in. Chromium names the WebView data dir after the WebView
+ * `dataDirectorySuffix` the host app sets; Weibo sets it to its own
+ * package name. We glob `app_webview*` and take the first match (Default
+ * profile) so both the legacy and suffixed layouts resolve. See memory
+ * [[pdh_social_cookie_endpoint_drift_2026_05]].
+ */
+const WEIBO_COOKIES_REMOTE_GLOB =
+  "/data/data/com.sina.weibo/app_webview*/Default/Cookies";
+
 const WEIBO_COOKIE_HOST_DOMAIN = "m.weibo.cn";
 
 /** Minimum required cookie name — without SUB, /api/config returns login=false. */
@@ -60,21 +76,31 @@ const WEIBO_REQUIRED_COOKIE = "SUB";
 
 async function pullCookiesViaSu(adb, serial, opts) {
   const adbOpts = { serial, timeoutMs: opts?.timeoutMs || 60_000 };
+  // Resolve the actual Cookies path — glob `app_webview*` so the suffixed
+  // profile dir (app_webview_com.sina.weibo, observed on real devices) is
+  // found as well as the legacy `app_webview`. `ls -d <glob>` prints every
+  // match; we take the first (Default profile). When nothing matches the
+  // shell prints the unexpanded glob, so we sentinel-guard NOT_FOUND.
   const lsOut = await adb(
     [
       "shell",
       "su",
       "-c",
-      `ls ${WEIBO_COOKIES_REMOTE_PATH} 2>/dev/null || echo NOT_FOUND`,
+      `ls -d ${WEIBO_COOKIES_REMOTE_GLOB} 2>/dev/null | head -n1 || echo NOT_FOUND`,
     ],
     adbOpts,
   );
   const lsLine = lsOut.replace(/\r+$/gm, "").trim();
-  if (lsLine === "NOT_FOUND" || lsLine === "") {
+  const remotePath =
+    lsLine && lsLine !== "NOT_FOUND" && !lsLine.includes("*") ? lsLine : null;
+  if (!remotePath) {
     throw new Error(
-      "WEIBO_NOT_INSTALLED: " +
-        WEIBO_COOKIES_REMOTE_PATH +
-        " not found. Install Weibo App + log in once on the phone, then retry. (Some Weibo App versions store cookies in a non-default WebView profile dir; if Weibo is installed but the path is missing, file a bug to track the actual path.)",
+      "WEIBO_NOT_INSTALLED: no Cookies DB under " +
+        WEIBO_COOKIES_REMOTE_GLOB +
+        " (globbed `app_webview*` to cover both the legacy and the suffixed " +
+        "`app_webview_com.sina.weibo` profile layouts). Install Weibo App + " +
+        "log in once on the phone, then retry. If Weibo is installed but no " +
+        "match exists, the WebView dataDirectorySuffix changed again — file a bug.",
     );
   }
   // Probe root.
@@ -93,7 +119,7 @@ async function pullCookiesViaSu(adb, serial, opts) {
       "shell",
       "su",
       "-c",
-      `base64 ${WEIBO_COOKIES_REMOTE_PATH} | tr -d '\\n\\r'`,
+      `base64 ${remotePath} | tr -d '\\n\\r'`,
     ],
     { ...adbOpts, timeoutMs: opts?.timeoutMs || 60_000 },
   );
@@ -241,6 +267,7 @@ function createWeiboCookiesExtension(factoryOpts = {}) {
 module.exports = {
   createWeiboCookiesExtension,
   WEIBO_COOKIES_REMOTE_PATH,
+  WEIBO_COOKIES_REMOTE_GLOB,
   WEIBO_COOKIE_HOST_DOMAIN,
   WEIBO_REQUIRED_COOKIE,
   assembleWeiboCookieHeader,