diff --git a/wechat_plain/scripts/.gitignore b/wechat_plain/scripts/.gitignore
new file mode 100644
index 0000000..b400529
--- /dev/null
+++ b/wechat_plain/scripts/.gitignore
@@ -0,0 +1,6 @@
+# 可重新生成的打包产物（用 zip -r / tar 重新打）
+*.tar.gz
+*.zip
+
+# macOS 产物
+.DS_Store
diff --git a/wechat_plain/scripts/GITEOF b/wechat_plain/scripts/GITEOF
deleted file mode 100644
index e69de29..0000000
--- a/wechat_plain/scripts/GITEOF
+++ /dev/null
diff --git a/wechat_plain/scripts/README.md b/wechat_plain/scripts/README.md
new file mode 100644
index 0000000..ff2f114
--- /dev/null
+++ b/wechat_plain/scripts/README.md
@@ -0,0 +1,32 @@
+# wechat_plain/scripts — 目录索引
+
+Pixel 上微信 bot 的脚本与工具，按功能分目录管理。
+
+| 目录 | 功能 | 状态 |
+|------|------|------|
+| [`db-decrypt/`](db-decrypt/) | Frida hook `libWCDB.so` 抓 SQLCipher key + 解密 `EnMicroMsg.db`（Android v1/v2 + Mac 旧路线 + 浏览器解密页） | 可用 |
+| [`search/`](search/) | 解密库之上的 Web 搜索服务（`search_server*.py`）+ 聊天统计生成（`build_chat_stats.py`） | 可用 |
+| [`lsposed-wechat-sendmsg/`](lsposed-wechat-sendmsg/) | **A11y 发送模块 = 当前唯一能把消息真正推进 `message` 表的主发送链路**（`HermesAccessibilityService`，纯 UI 自动化） | 主线 ✅ |
+| [`local-testkit/`](local-testkit/) | Pixel 端部署 / 自启动 / 测试套件（hermes daemon、termux boot、各类 debug/test 脚本） | 可用 |
+| [`platform-tools/`](platform-tools/) | adb / fastboot 等 Android 平台二进制 | 工具 |
+| [`frida-daemon/`](frida-daemon/) | 早期 Frida 发送队列实现 | **已废弃**（注入大 bundle 触发反调试致微信崩溃） |
+| [`archive/`](archive/) | 更早期的 Frida / lldb PoC 脚本 | 归档 |
+| [`docs/`](docs/) | 文档：`HANDOFF.md`、`README_Android.md`、`notes/`（项目/参考笔记） | — |
+
+> 发送链路现状详见仓库根 `CLAUDE.md` §微信集成架构：只有 `lsposed-wechat-sendmsg` 的 A11y service 真正生效，frida-daemon 与 LSPosed 反射 API 两条路径均已废弃。
+
+## 常见入口
+
+```bash
+# 以本目录 (wechat_plain/scripts/) 为工作目录
+
+# 抓 key + 解密（Android）
+python3 db-decrypt/wechat_android_attach.py            # 抓 SQLCipher key
+python3 db-decrypt/wechat_android_attach.py --extract-db
+python3 db-decrypt/wechat_android_attach.py --decrypt
+
+# 启动搜索 Web UI
+python3 search/search_server_android.py ~/wxmoment/dbs/EnMicroMsg.db.decrypted.db
+```
+
+详细操作见 [`docs/README_Android.md`](docs/README_Android.md) 与 [`docs/HANDOFF.md`](docs/HANDOFF.md)。
diff --git a/wechat_plain/scripts/wechat-db-decrypt.html b/wechat_plain/scripts/db-decrypt/wechat-db-decrypt.html
index 9ef76ca..9ef76ca 100644
--- a/wechat_plain/scripts/wechat-db-decrypt.html
+++ b/wechat_plain/scripts/db-decrypt/wechat-db-decrypt.html
diff --git a/wechat_plain/scripts/wechat_android_attach.py b/wechat_plain/scripts/db-decrypt/wechat_android_attach.py
index 7c196e5..7c196e5 100644
--- a/wechat_plain/scripts/wechat_android_attach.py
+++ b/wechat_plain/scripts/db-decrypt/wechat_android_attach.py
diff --git a/wechat_plain/scripts/wechat_android_attach_v2.py b/wechat_plain/scripts/db-decrypt/wechat_android_attach_v2.py
index 4b59d50..4b59d50 100644
--- a/wechat_plain/scripts/wechat_android_attach_v2.py
+++ b/wechat_plain/scripts/db-decrypt/wechat_android_attach_v2.py
diff --git a/wechat_plain/scripts/wechat_android_full_hunter.js b/wechat_plain/scripts/db-decrypt/wechat_android_full_hunter.js
index 41f7cb0..41f7cb0 100644
--- a/wechat_plain/scripts/wechat_android_full_hunter.js
+++ b/wechat_plain/scripts/db-decrypt/wechat_android_full_hunter.js
diff --git a/wechat_plain/scripts/wechat_android_key_hunter.js b/wechat_plain/scripts/db-decrypt/wechat_android_key_hunter.js
index b8baea5..b8baea5 100644
--- a/wechat_plain/scripts/wechat_android_key_hunter.js
+++ b/wechat_plain/scripts/db-decrypt/wechat_android_key_hunter.js
diff --git a/wechat_plain/scripts/wechat_earlybird.py b/wechat_plain/scripts/db-decrypt/wechat_earlybird.py
index da675c3..da675c3 100644
--- a/wechat_plain/scripts/wechat_earlybird.py
+++ b/wechat_plain/scripts/db-decrypt/wechat_earlybird.py
diff --git a/wechat_plain/scripts/wechat_export_all.py b/wechat_plain/scripts/db-decrypt/wechat_export_all.py
index 7c1b228..7c1b228 100755
--- a/wechat_plain/scripts/wechat_export_all.py
+++ b/wechat_plain/scripts/db-decrypt/wechat_export_all.py
diff --git a/wechat_plain/scripts/wechat_key_hunter.js b/wechat_plain/scripts/db-decrypt/wechat_key_hunter.js
index 785cc75..785cc75 100644
--- a/wechat_plain/scripts/wechat_key_hunter.js
+++ b/wechat_plain/scripts/db-decrypt/wechat_key_hunter.js
diff --git a/wechat_plain/scripts/HANDOFF.md b/wechat_plain/scripts/docs/HANDOFF.md
index 09ea90d..038b8d5 100644
--- a/wechat_plain/scripts/HANDOFF.md
+++ b/wechat_plain/scripts/docs/HANDOFF.md
@@ -11,12 +11,15 @@
 
 ## 文件位置（全部在 Termux 主目录下）
 
+部署到手机后这些文件**平铺**在一个目录里（下方命令均假设当前目录就是它）。
+仓库源码则按功能分目录：`scripts/db-decrypt/`（解密套件）、`scripts/search/`（搜索服务）、`scripts/docs/`（本文档）。
+
 ```
 ~/.hermes/tools/wechat/
-├── wechat_android_key_hunter.js    # Frida 脚本：hook libWCDB.so 截获 SQLCipher key
-├── wechat_android_attach.py        # Python 控制脚本：attach / extract / decrypt
-├── search_server_android.py        # Web 搜索服务器：读取解密后的 EnMicroMsg.db
-└── README_Android.md               # 完整操作文档
+├── wechat_android_key_hunter.js    # Frida 脚本：hook libWCDB.so 截获 SQLCipher key   ← 源: db-decrypt/
+├── wechat_android_attach.py        # Python 控制脚本：attach / extract / decrypt       ← 源: db-decrypt/
+├── search_server_android.py        # Web 搜索服务器：读取解密后的 EnMicroMsg.db        ← 源: search/
+└── README_Android.md               # 完整操作文档                                       ← 源: docs/
 ```
 
 ## 关键成果（已通过测试验证）
diff --git a/wechat_plain/scripts/README_Android.md b/wechat_plain/scripts/docs/README_Android.md
index 40fae48..5413d1c 100644
--- a/wechat_plain/scripts/README_Android.md
+++ b/wechat_plain/scripts/docs/README_Android.md
@@ -1,12 +1,14 @@
 # WeChat Android EnMicroMsg.db 解密读取工具链
 
+> 下面命令均以 `wechat_plain/scripts/` 为工作目录。解密套件在 `db-decrypt/`，搜索服务在 `search/`。
+
 ## 文件清单
 
 | 文件 | 用途 | 运行环境 |
 |------|------|----------|
-| `wechat_android_key_hunter.js` | Frida 脚本：hook `libWCDB.so` 的 `sqlite3_key` / `sqlite3_key_v2`，截获 SQLCipher 密码 | Android 微信进程 |
-| `wechat_android_attach.py` | Python 控制脚本：attach 微信、收集 key、提取 DB、自动解密 | Termux / Debian proot / Mac |
-| `search_server_android.py` | Web 搜索服务器：读取解密后的 `EnMicroMsg.db`，提供会话/联系人/聊天记录搜索 | 任意有 Python 的环境 |
+| `db-decrypt/wechat_android_key_hunter.js` | Frida 脚本：hook `libWCDB.so` 的 `sqlite3_key` / `sqlite3_key_v2`，截获 SQLCipher 密码 | Android 微信进程 |
+| `db-decrypt/wechat_android_attach.py` | Python 控制脚本：attach 微信、收集 key、提取 DB、自动解密 | Termux / Debian proot / Mac |
+| `search/search_server_android.py` | Web 搜索服务器：读取解密后的 `EnMicroMsg.db`，提供会话/联系人/聊天记录搜索 | 任意有 Python 的环境 |
 
 ## 工作原理
 
@@ -23,7 +25,7 @@ adb shell su -c cat 复制 DB 文件到本地
   ↓
 sqlcipher 解密：PRAGMA key="e03ce81"; PRAGMA cipher_compatibility=1; PRAGMA cipher_page_size=1024;
   ↓
-SQLite 明文库 → search_server_android.py 提供 Web UI
+SQLite 明文库 → search/search_server_android.py 提供 Web UI
 ```
 
 ## 关键发现（WeChat 8.0.72 on Android）
@@ -82,7 +84,7 @@ pip install frida==17.9.10
 ### 2. 捕获 SQLCipher key
 
 ```bash
-python3 wechat_android_attach.py
+python3 db-decrypt/wechat_android_attach.py
 ```
 
 - 脚本会自动 kill 微信、重新启动、attach Frida
@@ -92,7 +94,7 @@ python3 wechat_android_attach.py
 ### 3. 提取 DB 文件
 
 ```bash
-python3 wechat_android_attach.py --extract-db
+python3 db-decrypt/wechat_android_attach.py --extract-db
 ```
 
 - 复制 `EnMicroMsg.db` + `-shm` + `-wal` 到 `~/wxmoment/dbs/`
@@ -101,7 +103,7 @@ python3 wechat_android_attach.py --extract-db
 ### 4. 解密 DB
 
 ```bash
-python3 wechat_android_attach.py --decrypt
+python3 db-decrypt/wechat_android_attach.py --decrypt
 ```
 
 - 自动尝试字符串密码 / hex key + 多种 cipher 配置组合
@@ -110,7 +112,7 @@ python3 wechat_android_attach.py --decrypt
 ### 5. 启动搜索服务器
 
 ```bash
-python3 search_server_android.py ~/wxmoment/dbs/EnMicroMsg.db.decrypted.db
+python3 search/search_server_android.py ~/wxmoment/dbs/EnMicroMsg.db.decrypted.db
 ```
 
 - 访问 http://localhost:5002
@@ -131,7 +133,7 @@ DETACH DATABASE plain;
 
 ## Frida 脚本 API 说明
 
-`wechat_android_key_hunter.js` 的 Hook 点：
+`db-decrypt/wechat_android_key_hunter.js` 的 Hook 点：
 
 | Hook 函数 | 模块 | 用途 |
 |-----------|------|------|
diff --git a/wechat_plain/scripts/md/MEMORY.md b/wechat_plain/scripts/docs/notes/MEMORY.md
index b56e077..b56e077 100644
--- a/wechat_plain/scripts/md/MEMORY.md
+++ b/wechat_plain/scripts/docs/notes/MEMORY.md
diff --git a/wechat_plain/scripts/md/project-claude-code-termux.md b/wechat_plain/scripts/docs/notes/project-claude-code-termux.md
index fd5bd57..fd5bd57 100644
--- a/wechat_plain/scripts/md/project-claude-code-termux.md
+++ b/wechat_plain/scripts/docs/notes/project-claude-code-termux.md
diff --git a/wechat_plain/scripts/md/project-hermes-setup.md b/wechat_plain/scripts/docs/notes/project-hermes-setup.md
index cd8741b..cd8741b 100644
--- a/wechat_plain/scripts/md/project-hermes-setup.md
+++ b/wechat_plain/scripts/docs/notes/project-hermes-setup.md
diff --git a/wechat_plain/scripts/md/reference-wechat-android-re.md b/wechat_plain/scripts/docs/notes/reference-wechat-android-re.md
index 3495a52..3495a52 100644
--- a/wechat_plain/scripts/md/reference-wechat-android-re.md
+++ b/wechat_plain/scripts/docs/notes/reference-wechat-android-re.md
diff --git a/wechat_plain/scripts/md/user-profile.md b/wechat_plain/scripts/docs/notes/user-profile.md
index 0c05d2a..0c05d2a 100644
--- a/wechat_plain/scripts/md/user-profile.md
+++ b/wechat_plain/scripts/docs/notes/user-profile.md
diff --git a/wechat_plain/scripts/md/wechat-auto-reply-status.md b/wechat_plain/scripts/docs/notes/wechat-auto-reply-status.md
index d0b9fb8..d0b9fb8 100644
--- a/wechat_plain/scripts/md/wechat-auto-reply-status.md
+++ b/wechat_plain/scripts/docs/notes/wechat-auto-reply-status.md
diff --git a/wechat_plain/scripts/local-testkit.tar.gz b/wechat_plain/scripts/local-testkit.tar.gz
deleted file mode 100644
index b86a199..0000000
--- a/wechat_plain/scripts/local-testkit.tar.gz
+++ /dev/null
diff --git a/wechat_plain/scripts/local-testkit.zip b/wechat_plain/scripts/local-testkit.zip
deleted file mode 100644
index 5a79e5c..0000000
--- a/wechat_plain/scripts/local-testkit.zip
+++ /dev/null
diff --git a/wechat_plain/scripts/build_chat_stats.py b/wechat_plain/scripts/search/build_chat_stats.py
index e8754b8..e8754b8 100644
--- a/wechat_plain/scripts/build_chat_stats.py
+++ b/wechat_plain/scripts/search/build_chat_stats.py
diff --git a/wechat_plain/scripts/search_server.py b/wechat_plain/scripts/search/search_server.py
index 964c66d..964c66d 100644
--- a/wechat_plain/scripts/search_server.py
+++ b/wechat_plain/scripts/search/search_server.py
diff --git a/wechat_plain/scripts/search_server_android.py b/wechat_plain/scripts/search/search_server_android.py
index 48145fe..48145fe 100644
--- a/wechat_plain/scripts/search_server_android.py
+++ b/wechat_plain/scripts/search/search_server_android.py
diff --git a/wechat_plain/scripts/wechat_android_toolkit.tar.gz b/wechat_plain/scripts/wechat_android_toolkit.tar.gz
deleted file mode 100644
index 263643f..0000000
--- a/wechat_plain/scripts/wechat_android_toolkit.tar.gz
+++ /dev/null