chainlesschain 0.162.44 → 0.162.46

package/src/commands/agent.js

@@ -1,4 +1,4 @@
-/**
+/**
  * Agentic AI assistant - Claude Code style
  * chainlesschain agent [--model] [--provider]
  *
@@ -44,7 +44,7 @@ export function resolveAddDirs(rawDirs) {
  * thinking `budget_tokens`), or undefined when unset/invalid. Pure; exported for
  * tests. The companion `thinking` toggle comes from --think/--ultrathink; a
  * budget without that toggle is a no-op (chatWithTools only reads it when
- * thinking is on, and only for legacy models — adaptive models use effort).
+ * thinking is on, and only for legacy models 鈥?adaptive models use effort).
  *
  * @param {string|number} [raw]
  * @returns {number|undefined}
@@ -85,7 +85,7 @@ export function registerAgentCommand(program) {
     )
     .argument(
       "[task...]",
-      "Headless task — when given (or with -p / piped stdin), runs non-interactively",
+      "Headless task 鈥?when given (or with -p / piped stdin), runs non-interactively",
     )
     .option("--model <model>", "Model name")
     .option(
@@ -118,11 +118,11 @@ export function registerAgentCommand(program) {
     .option("--session <id>", "Resume a previous agent session")
     .option(
       "-c, --continue",
-      "Resume the most recent session (no id needed — claude --continue parity)",
+      "Resume the most recent session (no id needed 鈥?claude --continue parity)",
     )
     .option(
       "--resume [id]",
-      "Resume a session by id (no id → most recent — claude --resume parity)",
+      "Resume a session by id (no id 鈫?most recent 鈥?claude --resume parity)",
     )
     .option(
       "--fork-session",
@@ -135,7 +135,11 @@ export function registerAgentCommand(program) {
     )
     .option(
       "--checkpoint",
-      "Auto-snapshot the work tree before each mutating tool (git repo; cc checkpoint restore to roll back)",
+      "Auto-snapshot the work tree before each mutating tool (DEFAULT inside a git repo; cc checkpoint restore to roll back)",
+    )
+    .option(
+      "--no-checkpoint",
+      "Disable auto-checkpointing (it is on by default inside git repos)",
     )
     .option("--agent-id <id>", "Agent id for scoped memory recall")
     .option("--recall-limit <n>", "Top-K memories to inject into system prompt")
@@ -150,7 +154,7 @@ export function registerAgentCommand(program) {
       "--bundle <path>",
       "Agent bundle directory (chainless-agent.toml + AGENTS.md + skills/ + mcp.json + USER.md)",
     )
-    // ── Headless / print mode (Claude-Code `claude -p` parity) ───────────
+    // 鈹€鈹€ Headless / print mode (Claude-Code `claude -p` parity) 鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€
     .option(
       "-p, --print [prompt]",
       "Headless: run one non-interactive turn and exit",
@@ -227,6 +231,10 @@ export function registerAgentCommand(program) {
       "Force-enable IDE bridge auto-connect: discover a running editor's MCP server via ~/.chainlesschain/ide/*.json (default: auto inside an IDE integrated terminal)",
     )
     .option("--no-ide", "Disable IDE bridge auto-connect")
+    .option(
+      "--interactive-approvals",
+      "Stream mode: confirm-tier approvals become approval_request/approval stdin-stdout events instead of failing closed (chat-panel UX)",
+    )
     .option(
       "--permission-prompt-tool <tool>",
       "Defer tool approvals to an MCP tool (mcp__<server>__<tool>; requires --mcp-config) instead of headless fail-closed",
@@ -235,7 +243,18 @@ export function registerAgentCommand(program) {
       "--settings <file>",
       "Merge an extra .claude/settings.json-shaped file for this run: permission rules (allow/ask/deny) + native config overrides (model, env)",
     )
-    .action(async (task, options) => {
+    .action(async (task, options, command) => {
+      // Claude-Code parity: auto-checkpoint defaults ON inside a git repo
+      // (shadow-commit engine, zero working-tree touch); explicit
+      // --checkpoint / --no-checkpoint always wins.
+      const { resolveAutoCheckpoint } = await import(
+        "../lib/auto-checkpoint-default.js"
+      );
+      const autoCheckpoint = resolveAutoCheckpoint({
+        flagValue: options.checkpoint,
+        flagSource: command?.getOptionValueSource?.("checkpoint"),
+        cwd: process.cwd(),
+      });
       // `--continue` / `--resume` resolve a session id so the user need not
       // copy it. Explicit `--session <id>` always wins. `--resume <id>` targets
       // a specific session; `--continue` or a bare `--resume` pick the most
@@ -256,7 +275,7 @@ export function registerAgentCommand(program) {
           !process.stdin.isTTY;
         if (headlessIntent) {
           // Headless replays the JSONL store only, so resolve "most recent"
-          // from there — a DB-only id would resume into an empty transcript.
+          // from there 鈥?a DB-only id would resume into an empty transcript.
           const { getLastSessionId } =
             await import("../harness/jsonl-session-store.js");
           options.session = getLastSessionId();
@@ -279,7 +298,7 @@ export function registerAgentCommand(program) {
 
       // --fork-session: branch the resolved session into a NEW id so the
       // ORIGINAL transcript is preserved (Claude-Code parity). One chokepoint
-      // before headless / stream / interactive dispatch — all read
+      // before headless / stream / interactive dispatch 鈥?all read
       // `options.session`. The copy carries the full history, so the branch
       // replays end-to-end on a later --resume. Only meaningful when resuming;
       // a no-op (silent) for a fresh run.
@@ -293,12 +312,12 @@ export function registerAgentCommand(program) {
         );
         if (fork.missing) {
           process.stderr.write(
-            `--fork-session: no headless transcript for "${options.session}" — ` +
+            `--fork-session: no headless transcript for "${options.session}" 鈥?` +
               "nothing to fork; continuing on it.\n",
           );
         } else if (fork.forkedFrom) {
           process.stderr.write(
-            `Forked session ${fork.forkedFrom} → ${fork.sessionId} (original preserved)\n`,
+            `Forked session ${fork.forkedFrom} 鈫?${fork.sessionId} (original preserved)\n`,
           );
           options.session = fork.sessionId;
         }
@@ -328,7 +347,7 @@ export function registerAgentCommand(program) {
       }
 
       // The explicit `--model` the user typed, captured BEFORE the --settings
-      // block below may default options.model — so vision input can tell an
+      // block below may default options.model 鈥?so vision input can tell an
       // explicit model from a settings default.
       const explicitCliModel = options.model;
 
@@ -350,10 +369,10 @@ export function registerAgentCommand(program) {
         }
         if (!options.model && sc.model) options.model = sc.model;
       } catch {
-        // settings overrides are best-effort — never block the run
+        // settings overrides are best-effort 鈥?never block the run
       }
 
-      // Extra workspace roots (--add-dir) — shared by headless + interactive.
+      // Extra workspace roots (--add-dir) 鈥?shared by headless + interactive.
       const additionalDirectories = resolveAddDirs(options.addDir);
 
       // --image <path> (repeatable): read into {mediaType, base64} for the
@@ -372,7 +391,7 @@ export function registerAgentCommand(program) {
       // When an image is attached, default the run to the configured vision LLM
       // (config.llm provider/baseUrl/apiKey + llm.visionModel | --vision-model |
       // doubao default) so `cc agent --image foo.png` works without extra flags.
-      // Explicit --provider/--model/etc. always win; no image → unchanged.
+      // Explicit --provider/--model/etc. always win; no image 鈫?unchanged.
       const visionLlm = resolveVisionLlm({
         hasImage: images.length > 0,
         flags: {
@@ -387,7 +406,7 @@ export function registerAgentCommand(program) {
 
       // Config-default LLM (parity with cc ask/chat): a bare `cc agent` honors
       // config.json `llm` (provider/model/baseUrl/apiKey) instead of silently
-      // assuming local ollama — this is what makes the editor chat panel work
+      // assuming local ollama 鈥?this is what makes the editor chat panel work
       // against a cloud-configured setup. Explicit --provider wins outright;
       // the vision resolution above still overrides for --image runs. Applied
       // AFTER resolveVisionLlm so config defaults don't masquerade as explicit
@@ -401,16 +420,15 @@ export function registerAgentCommand(program) {
         });
       }
 
-      // --think / --ultrathink → options.thinking for the agent loop (Anthropic
-      // extended thinking; ignored by other providers). --think with no value →
-      // true; --think <level> → that level; --ultrathink wins as "ultra".
+      // --think / --ultrathink 鈫?options.thinking for the agent loop (Anthropic
+      // extended thinking; ignored by other providers). --think with no value 鈫?      // true; --think <level> 鈫?that level; --ultrathink wins as "ultra".
       const thinking = options.ultrathink
         ? "ultra"
         : options.think === true
           ? true
           : options.think || undefined;
       // --thinking-budget <n>: legacy-model thinking budget (no-op without
-      // --think/--ultrathink and on adaptive models). undefined → engine default.
+      // --think/--ultrathink and on adaptive models). undefined 鈫?engine default.
       const thinkingBudget = resolveThinkingBudget(options.thinkingBudget);
 
       // --fallback-model: a chatFn that retries once on the backup model when
@@ -427,7 +445,7 @@ export function registerAgentCommand(program) {
           })
         : undefined;
 
-      // ── Streaming-input mode (--input-format stream-json) ────────────────
+      // 鈹€鈹€ Streaming-input mode (--input-format stream-json) 鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€鈹€
       // A persistent multi-turn conversation driven by NDJSON user events on
       // stdin; output is always NDJSON. Routed before single-prompt handling
       // so stdin is consumed as events, not as one prompt.
@@ -465,6 +483,7 @@ export function registerAgentCommand(program) {
             ide: options.ide,
             cwd,
             permissionPromptTool: options.permissionPromptTool || null,
+            interactiveApprovals: options.interactiveApprovals === true,
             settingsFile: options.settings || null,
             outputStyle: options.outputStyle || null,
             chatFn: fallbackChatFn,
@@ -484,7 +503,7 @@ export function registerAgentCommand(program) {
       }
 
       // Resolve the headless prompt from: --print value, positional task, or
-      // piped stdin (in that precedence). Any of them → headless mode.
+      // piped stdin (in that precedence). Any of them 鈫?headless mode.
       const positional =
         Array.isArray(task) && task.length > 0 ? task.join(" ") : "";
       let prompt = "";
@@ -506,7 +525,7 @@ export function registerAgentCommand(program) {
 
       if (prompt) {
         // Resume requested onto a session with no headless (JSONL) transcript?
-        // Warn instead of silently starting empty — headless resume rebuilds
+        // Warn instead of silently starting empty 鈥?headless resume rebuilds
         // from the JSONL store only (DB-only sessions are not replayable here).
         const resumeRequested =
           Boolean(options.continue) || options.resume !== undefined;
@@ -515,7 +534,7 @@ export function registerAgentCommand(program) {
             await import("../harness/jsonl-session-store.js");
           if (!sessionExists(options.session)) {
             process.stderr.write(
-              `Note: no headless transcript for session "${options.session}" — ` +
+              `Note: no headless transcript for session "${options.session}" 鈥?` +
                 "starting fresh (headless resume reads JSONL sessions only).\n",
             );
           }
@@ -544,9 +563,9 @@ export function registerAgentCommand(program) {
           allowedTools: parseToolList(options.allowedTools),
           disallowedTools: parseToolList(options.disallowedTools),
           additionalDirectories,
-          autoCheckpoint: options.checkpoint === true,
+          autoCheckpoint,
           maxTurns,
-          // commander maps --no-file-refs → options.fileRefs === false
+          // commander maps --no-file-refs 鈫?options.fileRefs === false
           expandFileRefs: options.fileRefs !== false,
           // --system-prompt / --append-system-prompt (literal or @file)
           systemPrompt: resolvePromptText(options.systemPrompt, {
@@ -577,7 +596,7 @@ export function registerAgentCommand(program) {
           chatFn: fallbackChatFn,
         };
 
-        // --json-schema: structured output — wrap the runner with capture +
+        // --json-schema: structured output 鈥?wrap the runner with capture +
         // validate + retry (json-schema-output.js); prints only the
         // validated JSON. Incompatible with stream-json (event stream and a
         // single JSON contract don't mix).
@@ -616,7 +635,7 @@ export function registerAgentCommand(program) {
       }
 
       // Reached only for an interactive session, where --image has no turn to
-      // attach to — warn instead of silently dropping the attachment.
+      // attach to 鈥?warn instead of silently dropping the attachment.
       if (images.length) {
         process.stderr.write(
           "--image is only used in headless mode (-p / a task / piped stdin); ignoring for the interactive session.\n",
@@ -639,7 +658,7 @@ export function registerAgentCommand(program) {
         parkOnExit: options.parkOnExit, // false when --no-park-on-exit
         bundlePath: options.bundle || null,
         additionalDirectories,
-        autoCheckpoint: options.checkpoint === true,
+        autoCheckpoint,
         // --system-prompt / --append-system-prompt (literal or @file) also
         // apply to interactive sessions, composed in startAgentRepl.
         systemPrompt: resolvePromptText(options.systemPrompt, {

package/src/commands/hub.js

@@ -1732,6 +1732,65 @@ async function cmdDouyinAdbSync(options) {
   }
 }
 
+async function cmdDouyinWatchSync(options) {
+  try {
+    const hub = await (options._getHub || getHub)();
+    const result = await hub.douyinWatchSync({
+      uid: options.uid,
+      stagingDir: options.stagingDir,
+      displayName: options.displayName,
+      limit: parsePositiveInt(options.limit),
+      resolveTitles: !!options.resolveTitles,
+      titleLimit: parsePositiveInt(options.titleLimit),
+    });
+    if (options.json) {
+      printJson(result);
+      return;
+    }
+    if (!result.ok) {
+      logger.log(chalk.red(`✗ douyin-watch-sync failed: ${result.reason}`));
+      logger.log(chalk.gray(`  ${result.message || ""}`));
+      if (result.reason === "DOUYIN_NO_ROOT") {
+        logger.log(
+          chalk.gray(
+            "  Phone needs Magisk root — Douyin release APK isn't debuggable",
+          ),
+        );
+      } else if (result.reason === "DOUYIN_VIDEO_RECORD_MISSING") {
+        logger.log(
+          chalk.gray(
+            "  Open Douyin + watch a few videos to populate video_record.db, then retry",
+          ),
+        );
+      } else if (result.reason === "BRIDGE_UNAVAILABLE") {
+        logger.log(
+          chalk.gray(
+            "  Install Android Platform Tools or set ADB_PATH=/path/to/adb",
+          ),
+        );
+      }
+      process.exitCode = 1;
+      return;
+    }
+    const report = result.report || {};
+    const dy = report.douyin || {};
+    const counts = dy.eventCounts || {};
+    logger.log(chalk.green(`✓ douyin-watch-sync succeeded`));
+    logger.log(`  uid:        ${chalk.cyan(dy.uid || "?")}`);
+    logger.log(`  watched:    ${counts.history || 0}`);
+    if (options.resolveTitles) {
+      logger.log(`  titles:     ${dy.titlesResolved || 0} resolved`);
+    }
+    logger.log(`  status:     ${report.status || "?"}`);
+    logger.log(`  rawCount:   ${report.rawCount || 0}`);
+    if (dy.cleanupFailed) {
+      logger.log(chalk.gray(`  (note: staging cleanup failed — non-fatal)`));
+    }
+  } catch (err) {
+    fail(null, err, options.json);
+  }
+}
+
 /**
  * Phase 1e — `cc hub bilibili-adb-doctor`
  *
@@ -2309,6 +2368,33 @@ export function registerHubCommand(program) {
     .option("--json", "Output JSON")
     .action(cmdDouyinAdbSync);
 
+  // Douyin watch-history (video_record.db, plaintext — no X-Bogus / no SQLCipher)
+  hub
+    .command("douyin-watch-sync")
+    .description(
+      "Douyin 观看历史 C 路径: pull video_record.db via ADB from the user's Android Douyin App (com.ss.android.ugc.aweme), read record_<uid> (aid + view_time_timestamp + enter_from), ingest as `history` (BROWSE) events. Plaintext — no X-Bogus signing, no SQLCipher. Needs rooted Android + Douyin App with watch history. Add --resolve-titles to enrich each event with the video's desc/author/duration via the web detail endpoint (also no signing).",
+    )
+    .option(
+      "--uid <id>",
+      "Douyin uid to disambiguate multiple accounts (default: largest record_<uid> table)",
+    )
+    .option("--limit <n>", "Cap watch records (default 2000)")
+    .option(
+      "--resolve-titles",
+      "Resolve aweme ids → desc/author/duration via the web detail endpoint (no signing) so events show WHAT was watched",
+    )
+    .option(
+      "--title-limit <n>",
+      "Cap unique videos to title-resolve (default 60; dedup'd, ~200ms/call)",
+    )
+    .option("--display-name <s>", "Account displayName for the snapshot")
+    .option(
+      "--staging-dir <path>",
+      "Custom dir for the temp snapshot JSON (default os.tmpdir())",
+    )
+    .option("--json", "Output JSON")
+    .action(cmdDouyinWatchSync);
+
   hub
     .command("rederive")
     .description(
@@ -2555,6 +2641,7 @@ export const _internal = {
   cmdBilibiliAdbSync,
   cmdBilibiliAdbDoctor,
   cmdDouyinAdbSync,
+  cmdDouyinWatchSync,
   cmdWeiboAdbSync,
   cmdXhsAdbSync,
   cmdToutiaoAdbSync,

package/src/harness/mcp-client.js

@@ -70,6 +70,23 @@ export function isHttpTransport(transportKind) {
   );
 }
 
+/**
+ * Heuristic: does this error look like the server went away (vs. the tool
+ * itself failing)? Used to gate reconnect-and-retry for servers that have a
+ * registered reconnector (e.g. the IDE bridge after a window reload, which
+ * comes back on a NEW port with a NEW token).
+ *
+ * Covers: fetch-level network failures, auth rejection after a token
+ * rotation (401/403), an unknown session on a restarted server (404), and
+ * this client's own "server gone" states.
+ */
+export function isLikelyConnectionError(err) {
+  const msg = String((err && err.message) || err || "");
+  return /fetch failed|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EPIPE|socket hang up|network error|HTTP 40[134]\b|not connected|not found|not available/i.test(
+    msg,
+  );
+}
+
 /**
  * MCP Client — manages connections to MCP servers.
  */
@@ -78,6 +95,23 @@ export class MCPClient extends EventEmitter {
     super();
     this.servers = new Map(); // name → { process, state, tools, resources, config }
     this._nextId = 1;
+    this._reconnectors = new Map(); // name → async () => config|null
+    this._reconnecting = new Map(); // name → in-flight reconnect promise
+  }
+
+  /**
+   * Register a reconnector for a server: an async function that returns a
+   * FRESH connection config (or null when the server can't be found anymore).
+   * When a `callTool` on that server fails with a connection-shaped error,
+   * the client re-resolves the config, reconnects, and retries the call once.
+   *
+   * Used by the IDE bridge: a window reload / extension update restarts the
+   * editor's MCP server on a new port with a new token, so the original
+   * config is permanently dead but a lockfile re-scan finds the new one.
+   */
+  setReconnector(name, fn) {
+    if (typeof fn === "function") this._reconnectors.set(name, fn);
+    else this._reconnectors.delete(name);
   }
 
   /**
@@ -286,12 +320,31 @@ export class MCPClient extends EventEmitter {
   }
 
   /**
-   * Call a tool on a specific server.
+   * Call a tool on a specific server. If the server has a registered
+   * reconnector and the call fails with a connection-shaped error (server
+   * restarted / token rotated / entry dropped), re-resolve the config,
+   * reconnect, and retry the call exactly once.
    * @param {string} serverName - Server name
    * @param {string} toolName - Tool name
    * @param {object} args - Tool arguments
    */
   async callTool(serverName, toolName, args = {}) {
+    try {
+      return await this._callToolOnce(serverName, toolName, args);
+    } catch (err) {
+      if (
+        !this._reconnectors.has(serverName) ||
+        !isLikelyConnectionError(err)
+      ) {
+        throw err;
+      }
+      const reconnected = await this._tryReconnect(serverName);
+      if (!reconnected) throw err;
+      return await this._callToolOnce(serverName, toolName, args);
+    }
+  }
+
+  async _callToolOnce(serverName, toolName, args) {
     const entry = this.servers.get(serverName);
     if (!entry) throw new Error(`Server "${serverName}" not found`);
     if (entry.state !== ServerState.CONNECTED) {
@@ -306,6 +359,38 @@ export class MCPClient extends EventEmitter {
     return result;
   }
 
+  /**
+   * Re-resolve a server's config via its reconnector and reconnect.
+   * Single-flight per server: concurrent failing calls share one attempt
+   * (the IDE context injector fires getSelection + getOpenEditors in
+   * parallel — a double connect would throw "already connected").
+   * Resolves true on success, false on any failure (original error wins).
+   */
+  _tryReconnect(name) {
+    const inFlight = this._reconnecting.get(name);
+    if (inFlight) return inFlight;
+    const p = (async () => {
+      try {
+        const fresh = await this._reconnectors.get(name)();
+        if (!fresh) return false;
+        try {
+          await this.disconnect(name);
+        } catch {
+          // entry may already be gone — connect() below is what matters
+        }
+        await this.connect(name, fresh);
+        this.emit("server-reconnected", { name, url: fresh.url || null });
+        return true;
+      } catch {
+        return false;
+      } finally {
+        this._reconnecting.delete(name);
+      }
+    })();
+    this._reconnecting.set(name, p);
+    return p;
+  }
+
   /**
    * List resources from a specific server or all servers. Each resource is
    * annotated with its owning `server` (mirrors `listTools`).

package/src/lib/auto-checkpoint-default.js

@@ -0,0 +1,49 @@
+/**
+ * Auto-checkpoint default resolution — Claude-Code parity: checkpoints are ON
+ * by default inside a git repository (the shadow-commit engine never touches
+ * the working tree or real index, so the only cost is a plumbing commit per
+ * mutating tool), OFF elsewhere (the copy-based fallback writes real files
+ * under the user home — too surprising as a silent default).
+ *
+ * Explicit flags always win: `--checkpoint` forces on anywhere (copy engine
+ * included), `--no-checkpoint` forces off.
+ */
+
+import fsDefault from "fs";
+import pathDefault from "path";
+
+export const _deps = { fs: fsDefault, path: pathDefault };
+
+/** Walk up from cwd looking for a `.git` marker. */
+export function isInsideGitRepo(cwd, deps = _deps) {
+  let dir = deps.path.resolve(cwd || ".");
+  for (;;) {
+    try {
+      if (deps.fs.existsSync(deps.path.join(dir, ".git"))) return true;
+    } catch {
+      /* keep walking */
+    }
+    const parent = deps.path.dirname(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+
+/**
+ * @param {object} opts
+ * @param {boolean} [opts.flagValue]  commander's options.checkpoint
+ * @param {string}  [opts.flagSource] commander getOptionValueSource("checkpoint")
+ *                                    ("cli" when --checkpoint/--no-checkpoint given)
+ * @param {string}  [opts.cwd]
+ * @param {object}  [opts.deps]
+ * @returns {boolean}
+ */
+export function resolveAutoCheckpoint({
+  flagValue,
+  flagSource,
+  cwd = process.cwd(),
+  deps = _deps,
+} = {}) {
+  if (flagSource === "cli") return flagValue === true;
+  return isInsideGitRepo(cwd, deps);
+}

package/src/lib/personal-data-hub-wiring.js

@@ -363,7 +363,7 @@ async function initHub() {
       // Phase 2a: register `douyin.pull-im-db` extension so the
       // douyinAdbSync hub method can pull <uid>_im.db cohort from the
       // user's Android Douyin App.
-      const { createDouyinDbExtension } =
+      const { createDouyinDbExtension, createDouyinWatchExtension } =
         await import("@chainlesschain/personal-data-hub/adapters/social-douyin-adb");
       // Phase 3a: register `weibo.cookies` extension for the Weibo
       // C-path collector (m.weibo.cn cookies + 4 HTTP endpoints).
@@ -377,7 +377,7 @@ async function initHub() {
       // C-path collector (www.toutiao.com cookies + 4 endpoints, 3 of
       // which need _signature signing — CLI context falls back to -99
       // short-circuit, desktop wiring upgrades via ToutiaoSignBridge).
-      const { createToutiaoCookiesExtension } =
+      const { createToutiaoCookiesExtension, createToutiaoAccountExtension } =
         await import("@chainlesschain/personal-data-hub/adapters/social-toutiao-adb");
       // Phase 6d: register `kuaishou.cookies` extension. Profile from
       // cookie's api_ph payload (no HTTP); 3 GraphQL POST endpoints need
@@ -389,9 +389,11 @@ async function initHub() {
         extensions: {
           "bilibili.cookies": createBilibiliCookiesExtension(),
           "douyin.pull-im-db": createDouyinDbExtension(),
+          "douyin.watch-history": createDouyinWatchExtension(),
           "weibo.cookies": createWeiboCookiesExtension(),
           "xhs.cookies": createXhsCookiesExtension(),
           "toutiao.cookies": createToutiaoCookiesExtension(),
+          "toutiao.account": createToutiaoAccountExtension(),
           "kuaishou.cookies": createKuaishouCookiesExtension(),
         },
       });
@@ -1037,6 +1039,46 @@ async function initHub() {
       }
     },
 
+    // ─── Douyin watch-history (video_record.db, plaintext, no X-Bogus) ───
+    // Pulls video_record.db via the douyin.watch-history extension → reads
+    // record_<uid> (aid + view_time_timestamp + enter_from) → history events
+    // → syncAdapter("social-douyin") snapshot mode. Distinct from
+    // douyinAdbSync (IM db). No SQLCipher, no signing.
+    async douyinWatchSync(opts = {}) {
+      if (!hostAdbBridge) {
+        return {
+          ok: false,
+          reason: "BRIDGE_UNAVAILABLE",
+          message:
+            "host-adb-bridge failed to initialize at hub boot — check `adb` is on PATH or set ADB_PATH env var",
+        };
+      }
+      let collector;
+      try {
+        const mod =
+          await import("@chainlesschain/personal-data-hub/adapters/social-douyin-adb");
+        collector = mod.default ? mod.default : mod;
+      } catch (err) {
+        return {
+          ok: false,
+          reason: "MODULE_LOAD_FAILED",
+          message: err && err.message ? err.message : String(err),
+        };
+      }
+      try {
+        const report = await collector.collectWatchHistoryAndSync(
+          hostAdbBridge,
+          registry,
+          opts,
+        );
+        return { ok: true, report };
+      } catch (err) {
+        const msg = err && err.message ? err.message : String(err);
+        const m = msg.match(/^(DOUYIN_[A-Z_]+)/);
+        return { ok: false, reason: m ? m[1] : "SYNC_FAILED", message: msg };
+      }
+    },
+
     // ─── Phase 3a — Weibo C 路径 one-shot sync ──────────────────────────
     //
     // Pulls m.weibo.cn cookies via the weibo.cookies extension → fetchUid

package/src/lib/repl-completer.js

@@ -86,7 +86,10 @@ export function fileCandidates(prefix, { cwd = process.cwd(), deps } = {}) {
  *                        slashCommands?: string[], deps? }
  */
 export function makeAtCompleter(opts = {}) {
-  const cwd = opts.cwd || process.cwd();
+  // Lazy when not pinned: `/cd` mid-session moves process.cwd() and the
+  // completer must follow (explicit opts.cwd stays static for tests).
+  const baseCwd = opts.cwd || null;
+  const getCwd = () => baseCwd || process.cwd();
   const getIde = opts.getIdeOpenFiles || null;
   const now = opts.deps?.now || Date.now;
   let ideFiles = [];
@@ -105,7 +108,7 @@ export function makeAtCompleter(opts = {}) {
           ? files
               .filter((f) => typeof f === "string" && f.length > 0)
               .map((f) => {
-                const rel = path.relative(cwd, f);
+                const rel = path.relative(getCwd(), f);
                 // Keep workspace files relative (the natural @ref form);
                 // out-of-workspace files keep their absolute path. On
                 // Windows a cross-drive relative() returns an *absolute*
@@ -145,7 +148,7 @@ export function makeAtCompleter(opts = {}) {
     refreshIde(); // async top-up for the NEXT tab; this one uses the cache
     const norm = fwd(at.prefix).toLowerCase();
     const fromIde = ideFiles.filter((f) => f.toLowerCase().startsWith(norm));
-    const fromFs = fileCandidates(at.prefix, { cwd, deps: opts.deps });
+    const fromFs = fileCandidates(at.prefix, { cwd: getCwd(), deps: opts.deps });
     const merged = [...new Set([...fromIde, ...fromFs])].slice(
       0,
       MAX_CANDIDATES,