chore(release): 0.8.0 [skip ci]

## [0.8.0](https://github.com/Draculabo/AntigravityManager/compare/v0.7.0...v0.8.0) (2026-02-07)

### ✨ Features

* complete account-bound profile switching and hardening ([#78](https://github.com/Draculabo/AntigravityManager/issues/78)) ([a93c6d0](https://github.com/Draculabo/AntigravityManager/commit/a93c6d0cea5b9904a30234faffe767505f753373))

### 🐛 Bug Fixes

* **ci:** increase Node heap for publish step to prevent macOS OOM ([#76](https://github.com/Draculabo/AntigravityManager/issues/76)) ([ee64179](https://github.com/Draculabo/AntigravityManager/commit/ee641799c27425ceb6d2d6d00a132881bedb1f04))
* **ci:** make WiX Toolset setup resilient on Windows runners ([#73](https://github.com/Draculabo/AntigravityManager/issues/73)) ([5fe434f](https://github.com/Draculabo/AntigravityManager/commit/5fe434f7050cb8975d65502baeb03b1747e00611))

### 📝 Documentation

* **openspec:** backfill missing proposals ([287e848](https://github.com/Draculabo/AntigravityManager/commit/287e848b3291d2ee43b173802b87491c2a90930d))

.agent/skills/project_overview/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: antigravity-manager
+description: Comprehensive guide to Antigravity Manager architecture, workflows, and development. Use this to understand how to work on the project.
+---
+
+# Antigravity Manager Developer Guide
+
+## 🏗️ Architecture Overview
+
+Antigravity Manager is a hybrid Desktop Application built with Electron, React, and NestJS. It follows a modular architecture where the frontend (Renderer) communicates with the backend (Main) via type-safe IPC (ORPC).
+
+```mermaid
+graph TD
+    User[User Interface] -->|React/Vite| Renderer[Renderer Process]
+    Renderer -->|ORPC Client| IPC[IPC Layer]
+    IPC -->|ORPC Router| Main[Main Process]
+    Main -->|Bootstraps| Server[NestJS Server]
+    Main -->|Calls| Services[Service Layer]
+    Services -->|Read/Write| DB[(SQLite Database)]
+    Services -->|HTTP| Cloud[Cloud APIs (Google/Anthropic)]
+```
+
+### Key Technologies
+
+- **Frontend**: React 19, TailwindCSS v4, TanStack Router, TanStack Query.
+- **Backend**: Electron (Main), NestJS (Core Logic), Better-SQLite3 (Data).
+- **Communication**: ORPC (Type-safe IPC wrapper around Electron IPC).
+- **Build**: Electron Forge + Vite.
+
+## 📂 Directory Structure
+
+- `src/main.ts`: Electron Main Process entry point.
+- `src/preload.ts`: Bridge between Main and Renderer.
+- `src/renderer.tsx`: React App entry point.
+- `src/components/`: Reusable React UI components (Radix UI based).
+- `src/ipc/`: IPC Routers and Handlers (Domain logic).
+  - `router.ts`: Main ORPC router definition.
+  - `account/`, `cloud/`, `database/`: Domain-specific handlers.
+- `src/server/`: NestJS application modules (proxies/gateways).
+- `src/services/`: Core business logic (framework agnostic).
+  - `GoogleAPIService.ts`: Gemini/Cloud interactions.
+  - `AutoSwitchService.ts`: Account rotation logic.
+- `src/routes/`: Frontend routing definitions (File-based).
+
+## 🚀 Development Workflow
+
+### Prerequisites
+
+- Node.js 18+
+- npm (Project uses `package-lock.json`)
+
+### Common Commands
+
+- **Start Dev Server**: `npm start`
+- **Lint Code**: `npm run lint`
+- **Unit Test**: `npm run test:unit`
+- **E2E Test**: `npm run test:e2e`
+- **Build Production**: `npm run make`
+
+## 🧠 Core Concepts
+
+### IPC Communication (ORPC)
+
+The project uses `orpc` for type-safe communication.
+
+- **Define**: Create a router in `src/ipc/router.ts` with Zod schemas.
+- **Implement**: Add logic in handlers (e.g., `src/ipc/account/handler.ts`).
+- **Call**: Use the generated client in React components.
+
+### Database Access
+
+Data is stored in a local SQLite file (`test.db` in dev, user data in prod).
+
+- Use `Better-SQLite3` for direct access.
+- Logic should be encapsulated in `src/services` or `src/ipc`.
+
+### Account Management
+
+- Accounts are added via OAuth (Google/Claude).
+- `GoogleAPIService` handles token exchange and refreshing.
+- `AutoSwitchService` monitors usage and switches active accounts automatically.
+
+## ⚠️ Critical Rules
+
+1. **Type Safety**: strict TypeScript usage; Zod for runtime validation.
+2. **Components**: Use `src/components/ui` (Radix primitives) for consistency.
+3. **Async**: Handle all IPC/DB calls asynchronously with try/catch.
+4. **Security**: Never commit secrets. API keys are user-provided or encrypted locally.

.agent/workflows/openspec-apply.md

@@ -1,14 +1,18 @@
 ---
 description: Implement an approved OpenSpec change and keep tasks in sync.
 ---
+
 <!-- OPENSPEC:START -->
+
 **Guardrails**
+
 - Favor straightforward, minimal implementations first and add complexity only when it is requested or clearly required.
 - Keep changes tightly scoped to the requested outcome.
 - Refer to `openspec/AGENTS.md` (located inside the `openspec/` directory—run `ls openspec` or `openspec update` if you don't see it) if you need additional OpenSpec conventions or clarifications.
 
 **Steps**
 Track these steps as TODOs and complete them one by one.
+
 1. Read `changes/<id>/proposal.md`, `design.md` (if present), and `tasks.md` to confirm scope and acceptance criteria.
 2. Work through tasks sequentially, keeping edits minimal and focused on the requested change.
 3. Confirm completion before updating statuses—make sure every item in `tasks.md` is finished.
@@ -16,5 +20,6 @@ Track these steps as TODOs and complete them one by one.
 5. Reference `openspec list` or `openspec show <item>` when additional context is required.
 
 **Reference**
+
 - Use `openspec show <id> --json --deltas-only` if you need additional context from the proposal while implementing.
 <!-- OPENSPEC:END -->

.agent/workflows/openspec-archive.md

@@ -1,13 +1,17 @@
 ---
 description: Archive a deployed OpenSpec change and update specs.
 ---
+
 <!-- OPENSPEC:START -->
+
 **Guardrails**
+
 - Favor straightforward, minimal implementations first and add complexity only when it is requested or clearly required.
 - Keep changes tightly scoped to the requested outcome.
 - Refer to `openspec/AGENTS.md` (located inside the `openspec/` directory—run `ls openspec` or `openspec update` if you don't see it) if you need additional OpenSpec conventions or clarifications.
 
 **Steps**
+
 1. Determine the change ID to archive:
    - If this prompt already includes a specific change ID (for example inside a `<ChangeId>` block populated by slash-command arguments), use that value after trimming whitespace.
    - If the conversation references a change loosely (for example by title or summary), run `openspec list` to surface likely IDs, share the relevant candidates, and confirm which one the user intends.
@@ -19,6 +23,7 @@ description: Archive a deployed OpenSpec change and update specs.
 5. Validate with `openspec validate --strict` and inspect with `openspec show <id>` if anything looks off.
 
 **Reference**
+
 - Use `openspec list` to confirm change IDs before archiving.
 - Inspect refreshed specs with `openspec list --specs` and address any validation issues before handing off.
 <!-- OPENSPEC:END -->

.agent/workflows/openspec-proposal.md

@@ -1,8 +1,11 @@
 ---
 description: Scaffold a new OpenSpec change and validate strictly.
 ---
+
 <!-- OPENSPEC:START -->
+
 **Guardrails**
+
 - Favor straightforward, minimal implementations first and add complexity only when it is requested or clearly required.
 - Keep changes tightly scoped to the requested outcome.
 - Refer to `openspec/AGENTS.md` (located inside the `openspec/` directory—run `ls openspec` or `openspec update` if you don't see it) if you need additional OpenSpec conventions or clarifications.
@@ -10,6 +13,7 @@ description: Scaffold a new OpenSpec change and validate strictly.
 - Do not write any code during the proposal stage. Only create design documents (proposal.md, tasks.md, design.md, and spec deltas). Implementation happens in the apply stage after approval.
 
 **Steps**
+
 1. Review `openspec/project.md`, run `openspec list` and `openspec list --specs`, and inspect related code or docs (e.g., via `rg`/`ls`) to ground the proposal in current behaviour; note any gaps that require clarification.
 2. Choose a unique verb-led `change-id` and scaffold `proposal.md`, `tasks.md`, and `design.md` (when needed) under `openspec/changes/<id>/`.
 3. Map the change into concrete capabilities or requirements, breaking multi-scope efforts into distinct spec deltas with clear relationships and sequencing.
@@ -19,6 +23,7 @@ description: Scaffold a new OpenSpec change and validate strictly.
 7. Validate with `openspec validate <id> --strict` and resolve every issue before sharing the proposal.
 
 **Reference**
+
 - Use `openspec show <id> --json --deltas-only` or `openspec show <spec> --type spec` to inspect details when validation fails.
 - Search existing requirements with `rg -n "Requirement:|Scenario:" openspec/specs` before writing new ones.
 - Explore the codebase with `rg <keyword>`, `ls`, or direct file reads so proposals align with current implementation realities.

.github/dependabot.yaml

@@ -1,6 +1,6 @@
 version: 2
 updates:
-  - package-ecosystem: "npm"
-    directory: "/"
+  - package-ecosystem: 'npm'
+    directory: '/'
     schedule:
-      interval: "weekly"
+      interval: 'weekly'

.github/release-drafter.yml

@@ -1,7 +1,7 @@
 name-template: 'v$RESOLVED_VERSION'
 tag-template: 'v$RESOLVED_VERSION'
 categories:
-  - title: '🚀 What''s new'
+  - title: "🚀 What's new"
     labels:
       - 'feature'
       - 'feat'

.github/workflows/publish.yaml

@@ -1,9 +1,8 @@
 name: Publish Release
 
 on:
-  push:
-    tags:
-      - 'v*'
+  release:
+    types: [published]
   workflow_dispatch:
 
 jobs:
@@ -11,7 +10,28 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, macos-latest, ubuntu-latest]
+        include:
+          - os: windows-latest
+            platform: win32
+            arch: x64
+          - os: windows-11-arm
+            platform: win32
+            arch: arm64
+          - os: macos-15-intel
+            platform: darwin
+            arch: x64
+          - os: macos-14
+            platform: darwin
+            arch: arm64
+          - os: macos-14
+            platform: darwin
+            arch: universal
+          - os: ubuntu-latest
+            platform: linux
+            arch: x64
+          - os: ubuntu-24.04-arm
+            platform: linux
+            arch: arm64
 
     runs-on: ${{ matrix.os }}
 
@@ -29,15 +49,34 @@ jobs:
           cache: 'npm'
 
       - name: Install Linux dependencies
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.platform == 'linux'
         run: |
           sudo apt-get update
-          sudo apt-get install -y rpm libsecret-1-dev pkg-config
+          sudo apt-get install -y fakeroot rpm libsecret-1-dev pkg-config
+
+      - name: Ensure WiX Toolset
+        if: matrix.platform == 'win32' && matrix.arch == 'x64'
+        shell: powershell
+        run: |
+          $installed = choco list --local-only wixtoolset --exact --limit-output
+          if (-not $installed) {
+            choco install wixtoolset --version=3.14.0 -y
+          } elseif ($installed -match '^wixtoolset\|3\.14(\.|$)') {
+            Write-Host "WiX Toolset already compatible: $installed"
+          } else {
+            Write-Host "Incompatible WiX Toolset detected: $installed"
+            choco upgrade wixtoolset --version=3.14.0 --allow-downgrade -y
+          }
 
       - name: Install dependencies
         run: npm ci
 
       - name: Publish Release
         env:
+          NODE_OPTIONS: --max-old-space-size=8192
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm run publish
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
+          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
+        run: npm run publish -- --platform=${{ matrix.platform }} --arch=${{ matrix.arch }}

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: Release
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  release:
+    name: Semantic Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required for semantic-release to analyze commits
+          persist-credentials: false # We use a token in the next steps
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} # Use GH_TOKEN to trigger other workflows
+        run: npx semantic-release

.gitignore

@@ -102,3 +102,6 @@ out/
 
 # Tanstack
 .tanstack/
+
+# Sentry Config File
+.env.sentry-build-plugin

.prettierignore

@@ -3,6 +3,7 @@
 /coverage
 /.vite
 README.md
+CHANGELOG.md
 /src/routeTree.gen.ts
 .agents/
 openspec/

.vscode/settings.json

@@ -0,0 +1,7 @@
+{
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit"
+  },
+  "eslint.validate": ["javascript", "javascriptreact", "typescript", "typescriptreact"]
+}

AGENTS.md

@@ -20,158 +20,169 @@ Keep this managed block so 'openspec update' can refresh the instructions.
 
 <!-- OPENSPEC:END -->
 
-# 用户指南
+# User Guide
 
-本文是 AI 助手在本仓库工作的用户级指南。中文为主、工具与脚本偏好统一、并纳入你补充的技术栈与开发注意事项。
+This document is a user-level guide for AI assistants working in this repository. It standardizes language, tool/script preferences, and development notes for the current tech stack.
 
-## 💬 沟通约定
+## 💬 Communication Conventions
 
-- **语言**: 对话、待办、代码相关内容（注释、UI 文案、提交信息、PR 描述等）统一使用中文。
-- **结论先行**: 回答先给出核心结论/摘要，再补充细节。
-- **引用**: 引用具体代码时，务必给出完整文件路径（如 `src/main.ts:42`）。
+- **Language**: Use English consistently for conversation, TODOs, and code-related content (comments, UI copy, commit messages, PR descriptions, and similar artifacts).
+- **Conclusion first**: Start with the core conclusion/summary, then provide details.
+- **References**: When citing code, always provide full file paths (for example, `src/main.ts:42`).
 
-## 💻 运行环境与工具
+## 💻 Runtime and Tooling
 
-- **Runtime**: Node.js (Electron 环境)
-- **Node**: 建议 Node.js 20+
-- **包管理器**: `npm` (本项目包含 package-lock.json，强制使用 npm)
-- **构建工具**: Electron Forge + Vite
-- **终端环境**: Windows (PowerShell) / 可安全使用 VSCode MCP 工具
+- **Runtime**: Node.js (Electron environment)
+- **Node**: Recommended Node.js 20+
+- **Package manager**: `npm` (this project includes `package-lock.json`; use npm only)
+- **Build tools**: Electron Forge + Vite
+- **Terminal**: Windows (PowerShell) / VSCode MCP tools can be used safely
 
-## 🧩 技术栈总览 (Tech Stack)
+## 🧩 Tech Stack Overview
 
 - **Frontend**:
   - React 19, TypeScript
   - Tailwind CSS v4, `clsx`, `tailwind-merge`, `tailwindcss-animate`
-  - Radix UI (Primitives), Lucide React (Icons), Sonner (Toast)
+  - Radix UI (Primitives), Lucide React (Icons), Simple Icons (`@icons-pack/react-simple-icons`)
+  - `class-variance-authority` (CVA), `react-i18next` + `i18next`
   - TanStack Router (Routing), TanStack Query (State Management)
-  - Components: 模块化设计，`src/components`
+  - Components: Modular design under `src/components`
 - **Backend (Electron Main/Server)**:
-  - Electron (Main/Preload/Renderer 架构)
-  - NestJS (用于内部代理/网关服务，由 Main Process 启动)
-  - Better-SQLite3 (本地数据库), Drizzle ORM (如果后续引入) / Raw SQL
-  - ORPC (Type-safe RPC)
-  - Zod (Validation)
+  - Electron (Main/Preload/Renderer architecture)
+  - NestJS (internal proxy/gateway service, started by main process)
+  - Better-SQLite3 (local database), Drizzle ORM / Raw SQL
+  - ORPC (type-safe RPC)
+  - gRPC (`@grpc/grpc-js`, `@grpc/proto-loader`)
+  - Logging: `winston` + `winston-daily-rotate-file`
+  - Zod (validation)
 - **Testing**:
-  - Vitest (Unit/Integration Tests)
-  - Playwright (E2E Tests)
+  - Vitest (unit/integration), Testing Library
+  - Playwright (E2E)
 
-## 📁 目录结构
+## 📁 Directory Structure
 
 ```plaintext
 .
 ├─ src/
-│  ├─ components/        # React UI 组件 (ui/ 存放基础组件)
-│  ├─ hooks/             # Custom React Hooks
-│  ├─ ipc/               # Electron IPC 处理逻辑 (Database, Config, etc.)
-│  ├─ layouts/           # 页面布局组件
-│  ├─ lib/               # 通用工具库
-│  ├─ routes/            # TanStack Router 路由定义
-│  ├─ server/            # NestJS 后端服务逻辑 (Gateway/Proxy)
-│  ├─ services/          # 业务服务层
-│  ├─ styles/            # 全局样式 (Tailwind class)
-│  ├─ types/             # TypeScript 类型定义
-│  ├─ utils/             # 通用工具函数
-│  ├─ App.tsx            # React 应用入口
-│  ├─ main.ts            # Electron 主进程入口
-│  ├─ preload.ts         # Electron 预加载脚本
-│  └─ renderer.ts        # Electron 渲染进程入口
-├─ forge.config.ts       # Electron Forge 配置
+│  ├─ actions/           # App actions and flow orchestration
+│  ├─ assets/            # Static assets
+│  ├─ components/        # React UI components (base components under ui/)
+│  ├─ constants/         # Constants
+│  ├─ hooks/             # Custom React hooks
+│  ├─ ipc/               # Electron IPC logic (Database, Config, etc.)
+│  ├─ layouts/           # Layout components
+│  ├─ lib/               # Shared low-level utilities
+│  ├─ localization/      # i18n translation resources
+│  ├─ mocks/             # Mock data for tests and development
+│  ├─ routes/            # TanStack Router route definitions
+│  ├─ server/            # NestJS backend logic (Gateway/Proxy)
+│  ├─ services/          # Service layer
+│  ├─ styles/            # Global styles (Tailwind classes)
+│  ├─ tests/             # Test code
+│  ├─ types/             # TypeScript type definitions
+│  ├─ utils/             # Utility functions
+│  ├─ App.tsx            # React app entry
+│  ├─ main.ts            # Electron main entry
+│  ├─ preload.ts         # Electron preload script
+│  └─ renderer.ts        # Electron renderer entry
+├─ forge.config.ts       # Electron Forge config
 └─ package.json
 ```
 
-## 🧱 组件架构（Component Architecture）
+## 🧱 Component Architecture
 
-- **模块化组件**: 每个组件使用独立目录，至少包含 `.tsx` 以及可能的样式或子组件。
-- **共享能力**: 通用函数置于 `src/utils/`，底层通用封装置于 `src/lib/`。
-- **服务层**: 统一在 `src/services/` 或 `src/ipc/` 中封装数据访问，前端仅依赖 IPC 或 RPC 调用。
+- **Modular components**: Each component should have its own directory, with at least a `.tsx` file and optional styles/subcomponents.
+- **Shared capabilities**: General helpers in `src/utils/`; low-level shared wrappers in `src/lib/`.
+- **Service layer**: Centralize data access in `src/services/` or `src/ipc/`; frontend should consume IPC or RPC only.
 
-## 📦 常用脚本 (Scripts)
+## 📦 Common Scripts
 
-所有命令使用 `npm` 执行：
+Use `npm` for all commands:
 
-- **开发 (Dev)**:
-  - `npm start` - 启动 Electron 开发环境 (Electron Forge)
-  - `npm run lint` - 运行 ESLint 检查
-  - `npm run format` - 运行 Prettier 格式化检查
+- **Development (Dev)**:
+  - `npm start` - Start Electron dev environment (Electron Forge)
+  - `npm run lint` - Run ESLint checks
+  - `npm run format` - Run Prettier check
+  - `npm run format:write` - Auto-format with Prettier
+  - `npm run type-check` - Run TypeScript type check
 
-- **构建 (Build)**:
-  - `npm run package` - 打包应用 (生成的只有应用包)
-  - `npm run make` - 构建并生成分发安装包 (Make)
-  - `npm run publish` - 发布应用
+- **Build**:
+  - `npm run package` - Package app (application bundle only)
+  - `npm run make` - Build and generate distributable installers
+  - `npm run publish` - Publish app
 
-- **测试 (Test)**:
-  - `npm test` - 运行 Vitest 单元测试
-  - `npm run test:unit` - 同上
-  - `npm run test:e2e` - 运行 Playwright 端到端测试
-  - `npm run test:all` - 运行所有测试
+- **Testing**:
+  - `npm test` - Run Vitest tests
+  - `npm run test:watch` - Run Vitest in watch mode
+  - `npm run test:unit` - Same as above for unit-focused runs
+  - `npm run test:e2e` - Run Playwright E2E tests
+  - `npm run test:all` - Run all tests
 
+### Running a Single Test
 
-### 运行单个测试 (Running Single Tests)
+- Unit test: `npm run test:unit path/to/test.test.ts`
+- E2E test: `npm run test:e2e path/to/test.spec.ts`
+- Type check: `npm run type-check`
 
-- 单元测试: `npm run test:unit path/to/test.test.ts`
-- E2E 测试: `npm run test:e2e path/to/test.spec.ts`
-- 类型检查: `npm run type-check`
+## 🧪 Development Notes
 
-## 🧪 开发注意事项（Development Notes）
+- **Build**: Build stage may ignore TS/ESLint errors depending on project/CI configuration.
+- **DevTools**: `code-inspector-plugin` is integrated; use `Shift + Click` on page elements to jump to source code.
+- **React**: React Strict Mode is disabled.
+- **NestJS**: Runs as an Electron child process; logs are visible in main-process console.
 
-- **Build**: 构建阶段忽略 TS/ESLint 错误（如有特定配置或 CI 要求，请以实际为准）。
-- **DevTools**: 项目集成了 `code-inspector-plugin`，开发时支持从页面元素直接跳转代码（Shift+Click）。
-- **React**: React Strict Mode 关闭。
-- **NestJS**: 作为 Electron 子进程运行，日志输出在主进程控制台。
+## Security and Data
 
-## �️ 安全与数据 (Security & Data)
+- **Security**: Never commit secrets; use environment variables for sensitive config; validate all user input; encrypt sensitive data.
+- **Database**: Use Better-SQLite3; encapsulate operations in services layer; always use prepared statements; test DB operations independently.
+- **i18n**: Use `react-i18next`; keys should use kebab-case; translation files are stored in `src/localization/`.
 
-- **安全**: 绝不提交密钥；敏感配置使用环境变量；验证所有用户输入；敏感数据加密存储。
-- **数据库**: 使用 Better-SQLite3；所有操作封装在 Services 层；必须使用 Prepared Statements；独立测试 DB 操作。
-- **国际化**: 使用 `react-i18next`；Key 使用 kebab-case；翻译文件存放在 `src/localization/`。
+## 📝 Conventions
 
-## �📝 代码规范 (Conventions)
+- **File naming**:
+  - Components: PascalCase (for example, `Button.tsx`)
+  - Tools/config: camelCase or kebab-case
+- **Import paths**: Use `@/` alias for `src/`.
+- **Type safety**: Avoid `any`; enforce end-to-end type safety with Zod + TypeScript.
+- **Component design**:
+  - Prefer Radix UI Primitives.
+  - Use Tailwind utility classes; avoid CSS Modules unless necessary.
+- **API communication**: Frontend should prioritize ORPC client or IPC for strong type inference.
 
-- **文件命名**:
-  - 组件: PascalCase (e.g., `Button.tsx`)
-  - 工具/配置: camelCase 或 kebab-case
-- **导入路径**: 使用 `@/` 别名指向 `src/` 目录。
-- **类型安全**: 严禁使用 `any`，利用 Zod 和 TypeScript 确保全链路类型安全。
-- **组件设计**:
-  - 优先使用 Radix UI Primitives。
-  - 样式使用 Tailwind Utility Classes，避免 CSS Modules (除非必要)。
-- **API 通信**: 前端调用后端优先使用 ORPC 客户端或 IPC，确保类型推导。
+### Naming Specifics
 
-### 命名约定 (Naming Specifics)
-
-- **Functions/Variables**: camelCase (e.g., `handleClick`, `isCurrent`)
-- **Constants**: UPPER_SNAKE_CASE (e.g., `LOCAL_STORAGE_KEYS`)
+- **Functions/Variables**: camelCase (for example, `handleClick`, `isCurrent`)
+- **Constants**: UPPER_SNAKE_CASE (for example, `LOCAL_STORAGE_KEYS`)
 - **Files**:
   - Services: `ServiceName.service.ts`
   - Types: `type-name.ts`
 
-### 导入组织 (Import Organization)
+### Import Organization
 
 ```typescript
-// 1. React 和核心库
+// 1. React and core libraries
 import React, { useEffect } from 'react';
 import { createRoot } from 'react-dom/client';
 
-// 2. 外部依赖 (按字母顺序)
+// 2. External dependencies (alphabetical order)
 import { useTranslation } from 'react-i18next';
 import { formatDistanceToNow } from 'date-fns';
 
-// 3. 内部导入 (使用 @ 别名)
+// 3. Internal imports (using @ alias)
 import { Account } from '@/types/account';
 import { Card, CardContent } from '@/components/ui/card';
 ```
 
-### 组件结构 (Component Structure)
+### Component Structure
 
 ```typescript
-// 1. 导入
+// 1. Imports
 import React, { useState } from 'react';
 
-// 2. 类型定义
+// 2. Type definitions
 interface ComponentProps { /* props */ }
 
-// 3. 组件实现
+// 3. Component implementation
 export const Component: React.FC<ComponentProps> = ({ prop1 }) => {
   // 4. Hooks
   const { t } = useTranslation();
@@ -180,14 +191,14 @@ export const Component: React.FC<ComponentProps> = ({ prop1 }) => {
 };
 ```
 
-> 提交前请确保执行 `npm run lint` 和 `npm run format`。
+> Before commit, run `npm run lint` and `npm run format`.
 
-## 📝 终端输出与引用规范
+## 📝 Terminal Output and References
 
-- 代码块优先，避免 Markdown 表格与 mermaid（Claude 代码块渲染更稳定）。
-- 表格（如需）左对齐；中文字符等宽注意显示差异。
+- Prefer code blocks; avoid Markdown tables and Mermaid unless necessary.
+- If tables are used, keep them left-aligned and check display consistency.
 
-示例：
+Example:
 
 ```plaintext
 +------+---------+---------+
@@ -198,77 +209,77 @@ export const Component: React.FC<ComponentProps> = ({ prop1 }) => {
 +------+---------+---------+
 ```
 
-### 引用规范（References）
+### Reference Rules
 
-- 外部资源：使用完整可点击链接（Issue、文档、API 参考）。
-- 源码位置：使用完整文件路径（可附行号）。
+- External resources: use full clickable links (issues, docs, API references).
+- Source code location: use full file paths (optionally with line numbers).
 
-示例：
+Example:
 
 ```plaintext
-- “resolveFilePath 负责该逻辑”
-- “VSCode 在撤销操作上存在既知限制”
+- "resolveFilePath owns this logic"
+- "VSCode has a known limitation in undo behavior"
 
-🔗 References:
+References:
 - resolveFilePath: src/utils/workspace.ts:40
 - VSCode undo limitation: https://github.com/microsoft/vscode/issues/77190
 ```
 
-## 🏷️ Markdown 书写
+## 🏷️ Markdown Writing
 
-- 代码块语言不要留空，无法确定时使用 `plaintext`。
-- 标题后保留一行空行，便于渲染与阅读。
+- Always specify a language for fenced code blocks; use `plaintext` if unsure.
+- Keep one blank line after headings for readability.
 
-## 换行规范
+## Line-Break Rule
 
-return 等语句不要与其他语句在同一行，而是单独保持一行
+`return` and similar statements should not share a line with other statements. Keep them on separate lines.
 
-## 💭 注释规范
+## 💭 Commenting Rules
 
-- 必注释场景：复杂业务/算法、特殊行为、重要设计取舍、关键参考链接。
-- 原则：
-  - 注释“为什么”（Why），非“做了什么”（What）、非变更记录（Changelog）。
-  - 修改代码时同步更新注释（过时注释比无注释更糟）。
-  - 优先使用 JSDoc，复杂函数先给高层概览，函数体内按步骤（1、2、3…）标注关键过程。
-  - 中英文之间适当空格，提升可读性；不要为删除的旧代码写注释。
+- Required comment scenarios: complex business logic/algorithms, non-obvious behaviors, important design tradeoffs, and key reference links.
+- Principles:
+  - Explain **why**, not **what**, and not changelog history.
+  - Update comments whenever related code changes.
+  - Prefer JSDoc; for complex functions, start with high-level overview, then annotate key steps (1, 2, 3...).
+  - Keep spacing between English and Chinese words if both appear for readability; do not comment deleted legacy code.
 
-“质量自检”问题：六个月后新同事看到这条注释能得到什么有用信息？若答案是“没有”，删掉它。
+Quality self-check: six months later, what useful context does a new teammate gain from this comment? If the answer is "none", remove it.
 
-示例：
+Example:
 
 ```typescript
 /**
- * 处理支付请求，多步骤校验
+ * Handle payment request with multi-step validation.
  */
 function processPayment(request: PaymentRequest) {
-  // 1. 数据校验
-  // 2. 风控评估（低/中/高差异处理）
-  // 3. 网关调用
-  // 4. 用户通知
+  // 1. Input validation
+  // 2. Risk evaluation (low/medium/high paths)
+  // 3. Gateway call
+  // 4. User notification
 }
 
 export enum BudgetType {
   Free = 'free',
-  /** ✅ 推荐使用 JSDoc，而不是行尾注释 */
+  /** ✅ Prefer JSDoc over end-of-line comments */
   Package = 'package',
 }
 ```
 
-## 🛠️ 开发指南
+## 🛠️ Development Guide
 
-### 通用原则
+### General Principles
 
-- 优先稳定与可维护性，其次再谈性能优化。
-- 面对不确定性：明确假设、取舍与验证方案；先沟通再实施。
-- 信任既定前置条件，避免对承诺不变量的过度防御；若出现冲突，更新方案而非额外兜底。
-- 老代码重构保守推进，新功能实现可采用更现代方式。
-- 避免过早优化：先以简单直接的实现达成功能，确需时再优化（避免先行加缓存/抖动或拆分成过多文件）。
-- 对于 if，while 等条件、循环语句必须加上花括号，不能与return、break、continue 等语句同级。
+- Prioritize stability and maintainability before optimization.
+- For uncertainty, state assumptions/tradeoffs/validation approach clearly, then implement.
+- Trust agreed preconditions; avoid excessive defensive coding against guaranteed invariants.
+- Refactor legacy code conservatively; use modern approaches for new features where appropriate.
+- Avoid premature optimization: implement simple and direct first; optimize only when justified.
+- Always use braces for control flow (`if`, `while`, and similar statements).
 
-### 错误处理 (Error Handling)
+### Error Handling
 
 ```typescript
-// 异步操作使用 try-catch
+// Use try-catch for async operations
 try {
   const result = await someOperation();
   return result;
@@ -277,92 +288,92 @@ try {
   throw new Error('Failed to complete operation');
 }
 
-// 使用正确的错误类型
+// Use proper error typing
 if (error instanceof Error) {
-  /* 处理 Error 实例 */
+  /* handle Error instance */
 }
 ```
 
-### 新功能实现
+### New Feature Implementation
 
-- 代码应清晰、可读、可复用、有效率且可测试。
-- 倾向选用成熟可靠的现代 API。
+- Code should be clear, readable, reusable, efficient, and testable.
+- Prefer mature and reliable modern APIs.
 
-### 重构与修 Bug
+### Refactoring and Bug Fixing
 
-- 倾向增量式改动；如需大重构，先就范围对齐再推进。
-- 保持原结构与风格，避免过度抽象引入新风险。
+- Prefer incremental changes; align scope first before large refactors.
+- Preserve existing structure and style; avoid over-abstraction risk.
 
-### 开发生命周期（Checklist）
+### Development Lifecycle Checklist
 
-探索/规划：
+Exploration / planning:
 
-- \[ ] 充分理解需求，分步思考与列计划（3–6 步）
-- \[ ] 优先查阅文档与既有方案
-- \[ ] 通过阅读实际代码验证想法
-- \[ ] 形成 TODO 列表
+- \[ ] Fully understand requirements; break down into 3-6 steps
+- \[ ] Review documentation and existing solutions first
+- \[ ] Validate ideas by reading actual code
+- \[ ] Build a TODO list
 
-实现/重构/修复：
+Implementation / refactor / fix:
 
-- [ ] 阅读相关模板与周边代码，沿用既有模式
-- [ ] Fail fast：对非法输入/状态抛错，尽早暴露问题
-- [ ] 在约束内尽力提升前端交互与体验
+- [ ] Review related templates and surrounding code; follow existing patterns
+- [ ] Fail fast on invalid inputs/states
+- [ ] Improve frontend interaction and UX within constraints
 
-验收/校验：
+Acceptance / validation:
 
-- \[ ] 通过测试或临时脚本验证实现
-- \[ ] 多次增量修改后回看是否可合并为一次更连贯的修改
-- \[ ] 运行质量检查
-- \[ ] 更新相关文档
+- \[ ] Validate implementation through tests or temporary scripts
+- \[ ] After multiple incremental edits, evaluate whether changes should be consolidated
+- \[ ] Run quality checks
+- \[ ] Update related docs
 
-总结/输出：
+Summary / output:
 
-- \[ ] 检查输出格式要求
-- \[ ] 列出与原计划偏差与关键决策，便于人工复核
-- \[ ] 提供优化建议
-- \[ ] 在结尾提供完整引用链接
+- \[ ] Verify output formatting requirements
+- \[ ] List deviations from plan and key decisions for human review
+- \[ ] Provide optimization suggestions
+- \[ ] Include full references at the end
 
-## 🔍 代码质量与 Lint
+## 🔍 Code Quality and Lint
 
-- 变量命名具描述性（如 `mutationObserver`、`button`、`element`），避免 `mo`、`btn`、`el`。
-- 检查缺失的重要注释，并保持注释语言一致。
-- 使用 VSCode MCP 诊断工具查看 TS/ESLint 报告并修复关键问题。
-- 若新增/修改测试，需运行并修复测试后再提交。
+- Use descriptive variable names (`mutationObserver`, `button`, `element`) and avoid `mo`, `btn`, `el`.
+- Check for missing critical comments and keep comment language consistent.
+- Use VSCode MCP diagnostics for TS/ESLint issues and fix key findings.
+- If tests are added/updated, run and fix them before submission.
 
-## ⛔ 需要显式确认的操作
+## ⛔ Operations Requiring Explicit Confirmation
 
-- 运行具有破坏性的命令
-- 执行 `git commit`、`git push`
-- 新建测试文件（先由维护者进行人工审核）
+- Running destructive commands
+- Executing `git commit` or `git push`
+- Creating new test files (maintainer review required first)
 
-## 🔧 工具偏好与命令
+## 🔧 Tool Preferences and Commands
 
-包与脚本：
+Packages and scripts:
 
-- `npm install` (或简写 `npm i`)
+- `npm install` (or `npm i`)
 
-Shell：
+Shell:
 
-- 在工作区根目录执行命令。
-- 路径建议使用引号包裹。
+- Run commands in repository root.
+- Quote file paths when appropriate.
 
-Web 搜索：
+Web search:
 
-- `WebSearch` 获取最新内容；不足时用 `mcp__SearXNG__search` 聚合搜索
+- Use `WebSearch` for latest information; use `mcp__SearXNG__search` when needed.
 
-文档/用法检索：
+Documentation/usage lookup:
 
-- `context7` 获取依赖的最新用法
+- Use `context7` for latest dependency usage.
 
-VSCode MCP (如可用):
+VSCode MCP (if available):
 
-- `mcp__vscode-mcp__get_references` 辅助重构范围判定
-- `mcp__vscode-mcp__rename_symbol` 安全重命名
-- `mcp__vscode-mcp__get_symbol_lsp_info` 获取类型/签名/定义等信息
+- `mcp__vscode-mcp__get_references` for refactor impact analysis
+- `mcp__vscode-mcp__rename_symbol` for safe renaming
+- `mcp__vscode-mcp__get_symbol_lsp_info` for types/signatures/definitions
 
-## 🚨 本地质量检查（可选流程）
+## 🚨 Local Quality Checks (Optional Flow)
 
-在完成一组修改后并行执行三类检查，而非直接跑全量 lint：
+After a set of changes, run these three checks in parallel instead of full lint immediately:
 
 ```plaintext
 Task(subagent_type: "quick-code-review", description: "Code review", prompt: "[change description]")
@@ -370,16 +381,16 @@ Task(subagent_type: "diagnostics", description: "Diagnostics", prompt: "[same as
 Task(subagent_type: "run-related-tests", description: "Run tests", prompt: "[same as above]")
 ```
 
-change description 示例：
+`change description` example:
 
 ```plaintext
-- Modified files: 相对路径列表
-- Context: 需求/业务背景
+- Modified files: list of relative paths
+- Context: requirement/business background
 ```
 
-流程：初检 → 修复关键问题 → 复检 → 迭代至关键问题清零。
+Flow: initial check -> fix key issues -> re-check -> iterate until key issues are resolved.
 
-注意：上述工具为只读分析，需自行修复；传入精确文件路径，避免用笼统目录。
+Note: these tools are read-only analyzers; you still need to apply fixes manually. Pass precise file paths, not broad directories.
 
 <skills_system priority="1">
 

CHANGELOG.md

@@ -1,9 +1,147 @@
+<a name="readme-top"></a>
+
 # Changelog
 
-All notable changes to this project will be documented in this file.
+## [0.8.0](https://github.com/Draculabo/AntigravityManager/compare/v0.7.0...v0.8.0) (2026-02-07)
 
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+### ✨ Features
+
+* complete account-bound profile switching and hardening ([#78](https://github.com/Draculabo/AntigravityManager/issues/78)) ([a93c6d0](https://github.com/Draculabo/AntigravityManager/commit/a93c6d0cea5b9904a30234faffe767505f753373))
+
+### 🐛 Bug Fixes
+
+* **ci:** increase Node heap for publish step to prevent macOS OOM ([#76](https://github.com/Draculabo/AntigravityManager/issues/76)) ([ee64179](https://github.com/Draculabo/AntigravityManager/commit/ee641799c27425ceb6d2d6d00a132881bedb1f04))
+* **ci:** make WiX Toolset setup resilient on Windows runners ([#73](https://github.com/Draculabo/AntigravityManager/issues/73)) ([5fe434f](https://github.com/Draculabo/AntigravityManager/commit/5fe434f7050cb8975d65502baeb03b1747e00611))
+
+### 📝 Documentation
+
+* **openspec:** backfill missing proposals ([287e848](https://github.com/Draculabo/AntigravityManager/commit/287e848b3291d2ee43b173802b87491c2a90930d))
+
+## [0.7.0](https://github.com/Draculabo/AntigravityManager/compare/v0.6.0...v0.7.0) (2026-02-06)
+
+### ✨ Features
+
+* add multi-arch release artifacts and MSI packaging ([#65](https://github.com/Draculabo/AntigravityManager/issues/65)) ([f572ae4](https://github.com/Draculabo/AntigravityManager/commit/f572ae4652937efb25ab66defcfa55ddf65ac484))
+
+### 🐛 Bug Fixes
+
+* restore account switching on Antigravity 1.16.5 and migrate db sync to drizzle ([#69](https://github.com/Draculabo/AntigravityManager/issues/69)) ([ed94abf](https://github.com/Draculabo/AntigravityManager/commit/ed94abf0d6e90c0a1bf9c76f1ec3fdea091f6c4b))
+
+### 📝 Documentation
+
+* translate repository documentation to English ([#72](https://github.com/Draculabo/AntigravityManager/issues/72)) ([18389b9](https://github.com/Draculabo/AntigravityManager/commit/18389b975392f63441ede8369f13f6ef068214ab))
+
+### ♻️ Code Refactoring
+
+* migrate to winston and enable daily rotated app logs ([#71](https://github.com/Draculabo/AntigravityManager/issues/71)) ([2ae2216](https://github.com/Draculabo/AntigravityManager/commit/2ae2216f1ed3fa503ffd87a14cafd3921077a5c4))
+
+## [0.6.0](https://github.com/Draculabo/AntigravityManager/compare/v0.5.0...v0.6.0) (2026-02-04)
+
+### ✨ Features
+
+*  add cloud reset time UI ([#56](https://github.com/Draculabo/AntigravityManager/issues/56)) ([f6f8069](https://github.com/Draculabo/AntigravityManager/commit/f6f8069ce4673ae7027c6ba248daa18c8b602218))
+* windows install guidance ([#63](https://github.com/Draculabo/AntigravityManager/issues/63)) ([ce71470](https://github.com/Draculabo/AntigravityManager/commit/ce7147025d37648a82f6f6b300502ef4462bfde6))
+
+### 🐛 Bug Fixes
+
+* correct Windows install notice path ([5bda4b1](https://github.com/Draculabo/AntigravityManager/commit/5bda4b19dfc9ce64735cd39600d41a5deefc26ee))
+* **proxy:** route Claude Code CLI requests on /v1/chat/completions to Anthropic handler ([#61](https://github.com/Draculabo/AntigravityManager/issues/61)) ([476d297](https://github.com/Draculabo/AntigravityManager/commit/476d297e4b2dd3015f7ebcbb915b643730816dc6))
+
+## [0.5.0](https://github.com/Draculabo/AntigravityManager/compare/v0.4.0...v0.5.0) (2026-01-30)
+
+### ✨ Features
+
+* **i18n:** add Russian localization ([#48](https://github.com/Draculabo/AntigravityManager/issues/48)) ([63956c9](https://github.com/Draculabo/AntigravityManager/commit/63956c9c2d60f829a998237abe6ade675fdb01ed))
+* Implement collapsible sidebar and refined status bar UI ([#45](https://github.com/Draculabo/AntigravityManager/issues/45)) ([1265d04](https://github.com/Draculabo/AntigravityManager/commit/1265d044f69e52fba7da72fde6c47a0b85c58232))
+* sentry integration ([#51](https://github.com/Draculabo/AntigravityManager/issues/51)) ([a785640](https://github.com/Draculabo/AntigravityManager/commit/a785640d7a51b65a6852383401bd7c284b716975))
+
+## [0.4.0](https://github.com/Draculabo/AntigravityManager/compare/v0.3.5...v0.4.0) (2026-01-28)
+
+### ✨ Features
+
+* add system autostart and single-instance support ([ea51253](https://github.com/Draculabo/AntigravityManager/commit/ea51253d589abd537682344d3bdb684b8fc9a511))
+* implement smart foreground quota refresh with debounce ([dd9e84a](https://github.com/Draculabo/AntigravityManager/commit/dd9e84a0dbefad6066193b6bd468689a755a02e3))
+
+### 🐛 Bug Fixes
+
+* stub nestjs optional modules for packaging ([f0eb7c6](https://github.com/Draculabo/AntigravityManager/commit/f0eb7c6b619a3ea9ea203d66f5dbce731d731e3c))
+
+## [0.3.5](https://github.com/Draculabo/AntigravityManager/compare/v0.3.4...v0.3.5) (2026-01-26)
+
+### 🐛 Bug Fixes
+
+- "Check Quota Now" button not refreshing UI after polling ([#42](https://github.com/Draculabo/AntigravityManager/issues/42)) ([e959ee3](https://github.com/Draculabo/AntigravityManager/commit/e959ee346e7c26a8a4c5b7deefa5bd2452153f9d))
+
+### 📝 Documentation
+
+- remove beta download links from README ([5a21680](https://github.com/Draculabo/AntigravityManager/commit/5a2168030eac4ddeffa1c3b002b2de48b6a11a8f))
+
+## [0.3.4](https://github.com/Draculabo/AntigravityManager/compare/v0.3.3...v0.3.4) (2026-01-26)
+
+### 🐛 Bug Fixes
+
+- **security:** add safeStorage fallback for production builds ([#38](https://github.com/Draculabo/AntigravityManager/issues/38)) ([#43](https://github.com/Draculabo/AntigravityManager/issues/43)) ([0208058](https://github.com/Draculabo/AntigravityManager/commit/02080588b764ed88a5831152a3a1249f1d077d29))
+
+### 📝 Documentation
+
+- update beta release link ([d5ee08d](https://github.com/Draculabo/AntigravityManager/commit/d5ee08d5a06a915a8b82f680b38e2f532105498c))
+
+## [0.3.4-beta.1](https://github.com/Draculabo/AntigravityManager/compare/v0.3.3...v0.3.4-beta.1) (2026-01-25)
+
+### 🐛 Bug Fixes
+
+- **security:** add safeStorage fallback for production builds ([#38](https://github.com/Draculabo/AntigravityManager/issues/38)) ([92dc2f6](https://github.com/Draculabo/AntigravityManager/commit/92dc2f6f2169eb1a32950694387f2333ea2de682))
+
+## [0.3.3](https://github.com/Draculabo/AntigravityManager/compare/v0.3.2...v0.3.3) (2026-01-25)
+
+### 🐛 Bug Fixes
+
+- accept lowercase antigravity in process detection ([0d4e2ab](https://github.com/Draculabo/AntigravityManager/commit/0d4e2ab21f37704e09ef1a67c181c48b42df1180))
+
+### 📝 Documentation
+
+- add beta download link to readme ([f15bb48](https://github.com/Draculabo/AntigravityManager/commit/f15bb48fdda10fda3c2382941ee0ce51204f750a))
+- clean up changelog duplicate ([22265e1](https://github.com/Draculabo/AntigravityManager/commit/22265e153c9d394229aa48afdc5948044b74e842))
+
+## [0.3.2](https://github.com/Draculabo/AntigravityManager/compare/v0.3.1...v0.3.2) (2026-01-25)
+
+### 🐛 Bug Fixes
+
+- handle keychain hint and suppress pgrep spam ([bd3d41a](https://github.com/Draculabo/AntigravityManager/commit/bd3d41aed17bafe9d684c5c421bad8b90afa19a8))
+
+### 📝 Documentation
+
+- add macOS self-signing workaround for Keychain issues ([01e3f8f](https://github.com/Draculabo/AntigravityManager/commit/01e3f8f8fd6dacc5eed214ed4b505d6d85f4bcff))
+
+### 🔧 Continuous Integration
+
+- setup semantic release configuration and github actions workflow ([d2945a6](https://github.com/Draculabo/AntigravityManager/commit/d2945a6e8a14d75f577716183cdff093443d9636))
+- trigger publish on release published event ([6a07bc0](https://github.com/Draculabo/AntigravityManager/commit/6a07bc0a10a5ad802777e007cfd7390852119b15))
+
+## [0.3.1] - 2026-01-25
+
+### Bug Fixes
+
+- Fixed startup race condition causing cloud accounts verify failure ([f0718db])
+- Enabled WAL mode and force initialization on startup to resolve process resource contention ([1bce5d3])
+
+## [0.3.0] - 2026-01-23
+
+### New Features
+
+- Verify Google OAuth code automatically after receipt
+- Add button to open logs folder
+- Add expiration warning for Google OAuth authentication
+
+### Bug Fixes
+
+- Fixed `state.vscdb` path on Linux to include `User/globalStorage` subdirectory (Fixed [#26](https://github.com/Draculabo/AntigravityManager/issues/26))
+- Improved process detection on macOS/Linux using `find-process` to reliably identify the main application and exclude helper processes (Fixed [#27](https://github.com/Draculabo/AntigravityManager/issues/27))
+- Fixed keychain access error on macOS Apple Silicon (M1/M2/M3) by adding arm64 build to CI
+
+### Maintenance
+
+- Add VS Code settings for auto-formatting and ESLint
 
 ## [0.2.2] - 2026-01-19
 

CLAUDE.md

@@ -1 +1 @@
-请始终参考 @AGENTS.md 文件
+Always refer to `@AGENTS.md`.

README.md

@@ -185,7 +185,7 @@ Download the latest release for your platform from the [Releases](https://github
 
 | Platform | Download |
 |----------|----------|
-| Windows | [.exe installer](https://github.com/Draculabo/AntigravityManager/releases/latest) |
+| Windows (x64/ARM64) | [.exe installer](https://github.com/Draculabo/AntigravityManager/releases/latest) |
 | macOS | [.dmg installer](https://github.com/Draculabo/AntigravityManager/releases/latest) |
 | Linux | [.deb / .rpm](https://github.com/Draculabo/AntigravityManager/releases/latest) |
 
@@ -280,6 +280,24 @@ Please check:
 
 </details>
 
+<details>
+<summary><b>Q: macOS shows Keychain/Credential error and OAuth cannot be saved?</b></summary>
+
+This is a common macOS security behavior, usually when the app is unsigned or run directly from Downloads.
+This is a **temporary workaround** for personal use:
+
+1. Move the app to `/Applications`
+2. Run the following commands in Terminal (repeat after every update)
+
+```plaintext
+sudo xattr -dr com.apple.quarantine "/Applications/Antigravity Manager 2.app"
+codesign --force --deep --sign - "/Applications/Antigravity Manager 2.app"
+```
+
+Reopen the app and allow Keychain access if prompted.
+
+</details>
+
 <details>
 <summary><b>Q: How to report issues or suggestions?</b></summary>
 

README.zh-CN.md

@@ -184,7 +184,7 @@
 
 | 平台    | 下载链接                                                                       |
 | ------- | ------------------------------------------------------------------------------ |
-| Windows | [.exe 安装包](https://github.com/Draculabo/AntigravityManager/releases/latest) |
+| Windows (x64/ARM64) | [.exe 安装包](https://github.com/Draculabo/AntigravityManager/releases/latest) |
 | macOS   | [.dmg 安装包](https://github.com/Draculabo/AntigravityManager/releases/latest) |
 | Linux   | [.deb / .rpm](https://github.com/Draculabo/AntigravityManager/releases/latest) |
 
@@ -280,6 +280,24 @@ AntigravityManager/
 
 </details>
 
+<details>
+<summary><b>Q: macOS 上提示 Keychain/凭据管理不可用，OAuth 无法保存？</b></summary>
+
+这是 macOS 安全机制导致的常见问题，通常出现在未签名的应用或从 Downloads 直接运行的场景。
+这是**临时方案**，仅适合个人设备：
+
+1. 将应用移动到 `/Applications`
+2. 打开终端执行以下命令（每次更新后都需要重新执行）
+
+```plaintext
+sudo xattr -dr com.apple.quarantine "/Applications/Antigravity Manager 2.app"
+codesign --force --deep --sign - "/Applications/Antigravity Manager 2.app"
+```
+
+重新打开应用后，Keychain 应会提示授权（可选“始终允许”）。
+
+</details>
+
 <details>
 <summary><b>Q: 如何反馈问题或建议？</b></summary>
 

docs/cloud_features.md

@@ -1,96 +1,96 @@
-# 云端账号管理与智能切换 (Cloud Account Features)
+# Cloud Account Management and Intelligent Switching
 
-本文档详细介绍了 Antigravity Manager 中实现的云端 AI 账号管理与切换功能。该功能允许用户管理多个 Google 账号，监控 API 配额，并一键无缝切换 IDE 的当前活动账号。
+This document explains the cloud AI account management and switching capabilities in Antigravity Manager. The feature allows users to manage multiple Google accounts, monitor API quotas, and seamlessly switch the active IDE account with one click.
 
-## 1. 核心功能
+## 1. Core Features
 
-### 1.1 账号池管理
+### 1.1 Account Pool Management
 
-- **添加账号**：支持通过 Google OAuth 授权码添加账号。
-- **列表展示**：展示所有已添加的账号，包括头像、邮箱、最后使用时间。
-- **状态监控**：实时显示账号状态（Active, Rate Limited, Expired）以及是否为当前活动账号。
-- **删除账号**：支持从本地数据库中移除账号。
+- **Add accounts**: Add accounts via Google OAuth authorization code.
+- **List view**: Display all added accounts, including avatar, email, and last used time.
+- **Status monitoring**: Show real-time account status (Active, Rate Limited, Expired) and whether the account is currently active.
+- **Delete accounts**: Remove accounts from the local database.
 
-### 1.2 配额实时监控
+### 1.2 Real-Time Quota Monitoring
 
-- **多模型支持**：分别监控 `gemini-pro`, `claude-3-5-sonnet` 等模型的配额使用情况。
-- **可视化展示**：通过进度条和颜色（绿/黄/红）直观展示剩余配额百分比。
-- **自动/手动刷新**：支持手动刷新配额，系统也会在切换前自动检查。
+- **Multi-model support**: Track quota usage for models such as `gemini-pro`, `claude-3-5-sonnet`, and more.
+- **Visual indicators**: Use progress bars and color states (green/yellow/red) to show remaining quota percentage.
+- **Auto/manual refresh**: Support manual quota refresh; the system also checks quota automatically before switching.
 
-### 1.4 智能自动切换 (Intelligent Auto-Switching)
+### 1.4 Intelligent Auto-Switching
 
-- **无限池模式**：当检测到当前账号配额不足（<5%）或被限流时，系统会自动寻找最佳备用账号并切换。
-- **后台监控**：内置 `CloudMonitorService`, 默认每 5 分钟轮询一次所有账号的 Quota 状态。
-- **全局开关**：用户可在界面上一键开启或关闭此功能。
+- **Unlimited pool mode**: When the current account quota is low (`<5%`) or rate-limited, the system automatically finds and switches to the best backup account.
+- **Background monitoring**: Built-in `CloudMonitorService` polls quota status for all accounts every 5 minutes by default.
+- **Global toggle**: Users can enable or disable this feature with one click in the UI.
 
-## 2. 技术实现
+## 2. Technical Implementation
 
-### 2.1 数据库设计 (`cloud_accounts.db`)
+### 2.1 Database Design (`cloud_accounts.db`)
 
-使用 SQLite 存储账号信息，独立于 IDE 的本地数据库。
+Account information is stored in SQLite, independent from the IDE's local database.
 
 ```sql
 CREATE TABLE accounts (
   id TEXT PRIMARY KEY,          -- UUID
   provider TEXT NOT NULL,       -- 'google' | 'anthropic'
-  email TEXT NOT NULL,          -- 邮箱
-  name TEXT,                    -- 显示名称
-  avatar_url TEXT,              -- 头像 URL
-  token_json TEXT NOT NULL,     -- OAuth Token (JSON)
-  quota_json TEXT,              -- 配额数据 (JSON)
-  created_at INTEGER NOT NULL,  -- 创建时间戳
-  last_used INTEGER NOT NULL,   -- 最后使用时间戳
-  status TEXT DEFAULT 'active', -- 账号状态
-  is_active INTEGER DEFAULT 0   -- 是否为当前 IDE 活动账号
+  email TEXT NOT NULL,          -- Email
+  name TEXT,                    -- Display name
+  avatar_url TEXT,              -- Avatar URL
+  token_json TEXT NOT NULL,     -- OAuth token (JSON)
+  quota_json TEXT,              -- Quota data (JSON)
+  created_at INTEGER NOT NULL,  -- Created timestamp
+  last_used INTEGER NOT NULL,   -- Last-used timestamp
+  status TEXT DEFAULT 'active', -- Account status
+  is_active INTEGER DEFAULT 0   -- Whether this is the currently active IDE account
 );
 
--- 全局配置表
+-- Global settings table
 CREATE TABLE settings (
   key TEXT PRIMARY KEY,
   value TEXT NOT NULL
 );
 ```
 
-### 2.2 IPC 接口设计
+### 2.2 IPC Interface Design
 
-后端通过 `src/ipc/cloud` 提供以下 oRPC 接口：
+The backend exposes the following oRPC interfaces via `src/ipc/cloud`:
 
-- `addGoogleAccount(authCode: string)`: 交换 Token 并保存账号。
-- `listCloudAccounts()`: 获取账号列表。
-- `refreshAccountQuota(accountId: string)`: 刷新指定账号的配额和 Token。
-- `switchCloudAccount(accountId: string)`: 执行账号切换流程。
-- `deleteCloudAccount(accountId: string)`: 删除账号。
-- `getAutoSwitchEnabled()` / `setAutoSwitchEnabled(enabled)`: 获取/设置自动切换开关。
-- `forcePollCloudMonitor()`: 手动触发后台轮询。
+- `addGoogleAccount(authCode: string)`: Exchange token and save account.
+- `listCloudAccounts()`: Get account list.
+- `refreshAccountQuota(accountId: string)`: Refresh quota and token for a specific account.
+- `switchCloudAccount(accountId: string)`: Run the account switch workflow.
+- `deleteCloudAccount(accountId: string)`: Delete an account.
+- `getAutoSwitchEnabled()` / `setAutoSwitchEnabled(enabled)`: Get/set auto-switch state.
+- `forcePollCloudMonitor()`: Manually trigger background polling.
 
-### 2.3 Token 注入原理 (`ProtobufUtils`)
+### 2.3 Token Injection Mechanism (`ProtobufUtils`)
 
-IDE 将鉴权信息存储在 `state.vscdb` 的 `ItemTable` 表中，key 为 `jetskiStateSync.agentManagerInitState`。
-value 是一个 Base64 编码的 Protobuf 二进制数据。
+The IDE stores authentication data in the `ItemTable` table of `state.vscdb`, under the key `jetskiStateSync.agentManagerInitState`.
+The value is Base64-encoded Protobuf binary.
 
-我们实现了 `src/utils/protobuf.ts` 工具类，能够：
+We implemented `src/utils/protobuf.ts`, which can:
 
-1.  **解码**：解析 Varint 和 Length-Delimited 字段。
-2.  **修改**：定位并移除旧的 Field 6 (OAuthTokenInfo)。
-3.  **重构**：根据新的 Access Token 和 Refresh Token 构建新的 Field 6 并插入。
+1. **Decode**: Parse Varint and length-delimited fields.
+2. **Modify**: Locate and remove old Field 6 (`OAuthTokenInfo`).
+3. **Rebuild**: Build a new Field 6 using new access/refresh tokens and insert it.
 
-### 2.4 切换流程
+### 2.4 Switching Workflow
 
-1.  **Token 检查**：检查目标账号 Token 是否临期，如需刷新则自动刷新。
-2.  **停止进程**：优雅关闭 Antigravity 进程。
-3.  **注入 Token**：调用 `CloudAccountRepo.injectCloudToken` 修改 IDE 数据库。
-4.  **更新状态**：将目标账号标记为 `is_active = 1`，其他账号设为 0。
-5.  **重启进程**：重新启动 IDE，使其加载新的凭证。
+1. **Token check**: Check whether the target account token is near expiration; refresh automatically if needed.
+2. **Stop process**: Gracefully stop the Antigravity process.
+3. **Inject token**: Call `CloudAccountRepo.injectCloudToken` to update the IDE database.
+4. **Update state**: Mark target account as `is_active = 1`, set others to `0`.
+5. **Restart process**: Restart the IDE so it loads new credentials.
 
-### 2.5 自动切换逻辑 (`AutoSwitchService`)
+### 2.5 Auto-Switch Logic (`AutoSwitchService`)
 
-1.  **监控**：`CloudMonitorService` 定时（5分钟）轮询所有账号配额。
-2.  **判断**：如果当前活动账号的所有关键模型配额低于 5%，或状态为 `rate_limited`。
-3.  **择优**：从账号池中筛选状态为 `active` 且配额充足的账号，按配额剩余量排序。
-4.  **执行**：自动调用 `switchCloudAccount` 完成切换，并通知用户。
+1. **Monitor**: `CloudMonitorService` polls quotas for all accounts every 5 minutes.
+2. **Evaluate**: If all key model quotas of the active account are below `5%`, or status is `rate_limited`.
+3. **Select**: Filter accounts with `active` status and sufficient quota, then sort by remaining quota.
+4. **Execute**: Automatically call `switchCloudAccount` and notify the user.
 
-### 2.6 安全加固 (Security Hardening)
+### 2.6 Security Hardening
 
-- **密钥管理**：使用操作系统原生凭据管理器（Windows Credential Manager / macOS Keychain）通过 `keytar` 库安全存储 Master Key（AES-256）。
-- **数据加密**：所有敏感数据（`token_json`, `quota_json`）在存入 SQLite 数据库前均使用 `AES-256-GCM` 算法加密。
-- **自动迁移**：应用启动时会自动检测并迁移旧的明文数据，确保安全性平滑升级。
+- **Key management**: Use native OS credential stores (Windows Credential Manager / macOS Keychain) via `keytar` to securely store the AES-256 master key.
+- **Data encryption**: Encrypt all sensitive fields (`token_json`, `quota_json`) with `AES-256-GCM` before writing to SQLite.
+- **Auto migration**: Automatically detect and migrate legacy plaintext data at startup to ensure a smooth security upgrade.

eslint.config.mjs

@@ -25,4 +25,14 @@ export default defineConfig([
   reactHooks.configs.flat.recommended,
   eslintPluginPrettierRecommended,
   ...tseslint.configs.recommended,
+  {
+    rules: {
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-unused-vars': 'off',
+      '@typescript-eslint/no-empty-object-type': 'off',
+      '@typescript-eslint/ban-ts-comment': 'off',
+      'no-empty-pattern': 'off',
+      'prefer-const': 'off',
+    },
+  },
 ]);

forge.config.ts

@@ -1,28 +1,216 @@
-import type { ForgeConfig } from '@electron-forge/shared-types';
-import { MakerSquirrel } from '@electron-forge/maker-squirrel';
-import { MakerZIP } from '@electron-forge/maker-zip';
-import { MakerDeb } from '@electron-forge/maker-deb';
-import { MakerRpm } from '@electron-forge/maker-rpm';
-import { VitePlugin } from '@electron-forge/plugin-vite';
-import { FusesPlugin } from '@electron-forge/plugin-fuses';
+import crypto from 'crypto';
 import { FuseV1Options, FuseVersion } from '@electron/fuses';
+import type {
+  HookFunction,
+  HookFunctionErrorCallback,
+  TargetArch,
+  TargetPlatform,
+} from '@electron/packager';
+import { MakerDeb } from '@electron-forge/maker-deb';
+import { MakerDMG } from '@electron-forge/maker-dmg';
+import { MakerRpm } from '@electron-forge/maker-rpm';
+import { MakerSquirrel } from '@electron-forge/maker-squirrel';
+import { MakerWix } from '@electron-forge/maker-wix';
+import { MakerZIP } from '@electron-forge/maker-zip';
 import { AutoUnpackNativesPlugin } from '@electron-forge/plugin-auto-unpack-natives';
+import { FusesPlugin } from '@electron-forge/plugin-fuses';
+import { VitePlugin } from '@electron-forge/plugin-vite';
+import type { ForgeConfig } from '@electron-forge/shared-types';
+import MakerAppImage from '@pengx17/electron-forge-maker-appimage';
+import setLanguages from 'electron-packager-languages';
 import * as fs from 'fs';
 import * as path from 'path';
+import { stringify as yamlStringify } from 'yaml';
 
 const nativeModules = ['better-sqlite3', 'keytar', 'bindings', 'file-uri-to-path'];
+const ResolvedMakerAppImage = MakerAppImage;
+const keepLanguages = new Set(['en', 'en-US', 'zh-CN', 'ru']);
+const windowsExecutableName = 'antigravity-manager';
 
 const isStartCommand = process.argv.some((arg) => arg.includes('start'));
 
+const artifactRegex = /.*\.(?:exe|dmg|AppImage|zip|deb|rpm|msi)$/;
+const platformNamesMap: Record<string, string> = {
+  darwin: 'macos',
+  linux: 'linux',
+  win32: 'windows',
+};
+const ymlBaseNameMap: Record<string, string> = {
+  darwin: 'latest-mac',
+  linux: 'latest-linux',
+  win32: 'latest',
+};
+const ignorePatterns = [
+  /^\/\.git/,
+  /^\/\.github/,
+  /^\/\.vscode/,
+  /^\/\.idea/,
+  /^\/openspec/,
+  /^\/docs?/,
+  /^\/scripts?/,
+  /^\/tests?/,
+  /^\/mocks?/,
+  /^\/src/,
+  /^\/node_modules\/\.cache/,
+];
+const setLanguagesHook = setLanguages([...keepLanguages.values()]);
+const packagerAfterCopy: HookFunction[] = [
+  (
+    buildPath: string,
+    electronVersion: string,
+    platform: TargetPlatform,
+    arch: TargetArch,
+    callback: HookFunctionErrorCallback,
+  ) => {
+    if (platform !== 'win32') {
+      callback();
+      return;
+    }
+
+    setLanguagesHook(buildPath, electronVersion, platform, arch, callback);
+  },
+];
+
+function normalizeArtifactName(value?: string) {
+  if (!value) {
+    return 'app';
+  }
+
+  return value
+    .trim()
+    .replace(/\s+/g, '.')
+    .replace(/[^a-zA-Z0-9.]/g, '')
+    .replace(/\.+/g, '.');
+}
+
+function isSquirrelArtifact(artifactPath: string) {
+  const fileName = path.basename(artifactPath);
+  if (fileName === 'RELEASES') {
+    return true;
+  }
+
+  return artifactPath.endsWith('.nupkg');
+}
+
+function mapArchName(arch: string, mapping: Record<string, string>) {
+  return mapping[arch] || arch;
+}
+
+function getArtifactFileName({
+  baseName,
+  version,
+  arch,
+  extension,
+}: {
+  baseName: string;
+  version: string;
+  arch: string;
+  extension: string;
+}) {
+  if (extension === '.rpm') {
+    return `${baseName}-${version}-1.${arch}${extension}`;
+  }
+
+  if (extension === '.deb') {
+    return `${baseName}_${version}_${arch}${extension}`;
+  }
+
+  if (extension === '.AppImage') {
+    return `${baseName}_${version}_${arch}${extension}`;
+  }
+
+  if (extension === '.dmg') {
+    return `${baseName}_${version}_${arch}${extension}`;
+  }
+
+  if (extension === '.exe') {
+    return `${baseName}_${version}_${arch}-setup${extension}`;
+  }
+
+  if (extension === '.msi') {
+    return `${baseName}_${version}_${arch}_en-US${extension}`;
+  }
+
+  if (extension === '.zip') {
+    return `${baseName}_${version}_${arch}${extension}`;
+  }
+
+  return `${baseName}_${version}_${arch}${extension}`;
+}
+
+function getUpdateYmlFileName(platform: string, arch: string) {
+  const baseName = ymlBaseNameMap[platform];
+  if (!baseName) {
+    return null;
+  }
+
+  if (platform === 'darwin') {
+    return arch === 'universal' ? `${baseName}.yml` : `${baseName}-${arch}.yml`;
+  }
+
+  if (platform === 'linux') {
+    return arch === 'x64' ? `${baseName}.yml` : `${baseName}-${arch}.yml`;
+  }
+
+  if (platform === 'win32') {
+    return arch === 'x64' ? `${baseName}.yml` : `${baseName}-${arch}.yml`;
+  }
+
+  return null;
+}
+
+function getChecksumArchLabel(platform: string, arch: string) {
+  if (platform === 'linux') {
+    return mapArchName(arch, { x64: 'amd64', arm64: 'aarch64' });
+  }
+
+  if (platform === 'darwin') {
+    return mapArchName(arch, { x64: 'x64', arm64: 'arm64', universal: 'universal' });
+  }
+
+  if (platform === 'win32') {
+    return mapArchName(arch, { x64: 'x64', arm64: 'arm64' });
+  }
+
+  return arch;
+}
+
+const appImageMaker = new ResolvedMakerAppImage({
+  config: {
+    icons: [
+      {
+        file: 'images/32x32.png',
+        size: 32,
+      },
+      {
+        file: 'images/64x64.png',
+        size: 64,
+      },
+      {
+        file: 'images/128x128.png',
+        size: 128,
+      },
+      {
+        file: 'images/[email protected]',
+        size: 256,
+      },
+    ],
+  },
+});
+appImageMaker.name = '@pengx17/electron-forge-maker-appimage';
+
 const config: ForgeConfig = {
   packagerConfig: {
     asar: {
       unpack: '**/{better-sqlite3,keytar}/**/*',
     },
     name: 'Antigravity Manager',
-    executableName: 'antigravity-manager',
+    executableName: windowsExecutableName,
     icon: 'images/icon', // Electron Forge automatically adds .icns/.ico
     extraResource: ['src/assets'], // Copy assets folder to resources/assets
+    afterCopy: packagerAfterCopy,
+    ignore: ignorePatterns,
+    prune: true,
   },
   rebuildConfig: {},
   hooks: {
@@ -63,8 +251,230 @@ const config: ForgeConfig = {
         console.warn(`Assets directory not found: ${assetsSrc}`);
       }
     },
+    postMake: async (_config, makeResults) => {
+      if (!makeResults?.length) {
+        return makeResults;
+      }
+
+      const ymlByTarget = new Map<
+        string,
+        {
+          basePath: string;
+          fileName: string;
+          yml: {
+            version?: string;
+            files: {
+              url: string;
+              sha512: string;
+              size: number;
+            }[];
+            releaseDate?: string;
+          };
+        }
+      >();
+      const checksumByTarget = new Map<
+        string,
+        {
+          basePath: string;
+          fileName: string;
+          lines: string[];
+        }
+      >();
+
+      makeResults = makeResults.map((result) => {
+        const productName = normalizeArtifactName(
+          result.packageJSON.productName || result.packageJSON.name,
+        );
+        const platformName = platformNamesMap[result.platform] || result.platform;
+        const version = result.packageJSON.version;
+        const platformKey = result.platform;
+        const archKey = result.arch;
+        const updateFileName = getUpdateYmlFileName(platformKey, archKey);
+        const updateKey = updateFileName ? `${platformKey}-${archKey}` : null;
+        const checksumKey = `${platformKey}-${archKey}`;
+        const checksumArchLabel = getChecksumArchLabel(platformKey, archKey);
+        const checksumFileName = `sha256sums-${platformName}-${checksumArchLabel}.txt`;
+
+        if (!checksumByTarget.has(checksumKey)) {
+          checksumByTarget.set(checksumKey, {
+            basePath: '',
+            fileName: checksumFileName,
+            lines: [],
+          });
+        }
+
+        if (updateFileName && updateKey && !ymlByTarget.has(updateKey)) {
+          ymlByTarget.set(updateKey, {
+            basePath: '',
+            fileName: updateFileName,
+            yml: {
+              version,
+              files: [],
+            },
+          });
+        }
+
+        const updateState = updateKey ? ymlByTarget.get(updateKey)! : null;
+        const checksumState = checksumByTarget.get(checksumKey)!;
+
+        result.artifacts = result.artifacts
+          .map((artifact) => {
+            if (!artifact) {
+              return null;
+            }
+
+            if (isSquirrelArtifact(artifact)) {
+              return artifact;
+            }
+
+            if (!artifactRegex.test(artifact)) {
+              return artifact;
+            }
+
+            if (!checksumState.basePath) {
+              checksumState.basePath = path.dirname(artifact);
+            }
+
+            if (updateState && !updateState.basePath) {
+              updateState.basePath = path.dirname(artifact);
+            }
+
+            const extension = path.extname(artifact);
+            let archLabel = archKey;
+            if (platformKey === 'linux' && extension === '.rpm') {
+              archLabel = mapArchName(archKey, { x64: 'x86_64', arm64: 'aarch64' });
+            } else if (platformKey === 'linux' && extension === '.deb') {
+              archLabel = mapArchName(archKey, { x64: 'amd64', arm64: 'arm64' });
+            } else if (platformKey === 'linux' && extension === '.AppImage') {
+              archLabel = mapArchName(archKey, { x64: 'amd64', arm64: 'aarch64' });
+            } else if (platformKey === 'darwin') {
+              archLabel = mapArchName(archKey, {
+                x64: 'x64',
+                arm64: 'arm64',
+                universal: 'universal',
+              });
+            } else if (platformKey === 'win32') {
+              archLabel = mapArchName(archKey, { x64: 'x64', arm64: 'arm64' });
+            }
+
+            const newArtifact = `${path.dirname(artifact)}/${getArtifactFileName({
+              baseName: productName,
+              version,
+              arch: archLabel,
+              extension,
+            })}`;
+            if (newArtifact !== artifact) {
+              fs.renameSync(artifact, newArtifact);
+            }
+
+            try {
+              const fileData = fs.readFileSync(newArtifact);
+              const hash = crypto.createHash('sha512').update(fileData).digest('base64');
+              const sha256 = crypto.createHash('sha256').update(fileData).digest('hex');
+              const { size } = fs.statSync(newArtifact);
+
+              if (updateState) {
+                updateState.yml.files.push({
+                  url: path.basename(newArtifact),
+                  sha512: hash,
+                  size,
+                });
+              }
+
+              checksumState.lines.push(`${sha256}  ${path.basename(newArtifact)}`);
+            } catch {
+              console.error(`Failed to hash ${newArtifact}`);
+            }
+
+            return newArtifact;
+          })
+          .filter((artifact) => artifact !== null);
+
+        return result;
+      });
+
+      const releaseDate = new Date().toISOString();
+      for (const [updateKey, updateState] of ymlByTarget.entries()) {
+        if (!updateState.basePath) {
+          continue;
+        }
+
+        updateState.yml.releaseDate = releaseDate;
+        const ymlPath = path.join(updateState.basePath, updateState.fileName);
+        fs.writeFileSync(ymlPath, yamlStringify(updateState.yml));
+
+        const [platform, arch] = updateKey.split('-');
+        const sampleResult = makeResults.find(
+          (result) => result.platform === platform && result.arch === arch,
+        );
+        if (!sampleResult) {
+          continue;
+        }
+
+        makeResults.push({
+          artifacts: [ymlPath],
+          platform: sampleResult.platform,
+          arch: sampleResult.arch,
+          packageJSON: sampleResult.packageJSON,
+        });
+      }
+
+      for (const [checksumKey, checksumState] of checksumByTarget.entries()) {
+        if (!checksumState.basePath || checksumState.lines.length === 0) {
+          continue;
+        }
+
+        const checksumPath = path.join(checksumState.basePath, checksumState.fileName);
+        fs.writeFileSync(checksumPath, `${checksumState.lines.join('\n')}\n`);
+
+        const [platform, arch] = checksumKey.split('-');
+        const sampleResult = makeResults.find(
+          (result) => result.platform === platform && result.arch === arch,
+        );
+        if (!sampleResult) {
+          continue;
+        }
+
+        makeResults.push({
+          artifacts: [checksumPath],
+          platform: sampleResult.platform,
+          arch: sampleResult.arch,
+          packageJSON: sampleResult.packageJSON,
+        });
+      }
+
+      return makeResults;
+    },
   },
-  makers: [new MakerSquirrel({}), new MakerZIP({}, ['darwin']), new MakerRpm({}), new MakerDeb({})],
+  makers: [
+    new MakerSquirrel({
+      setupIcon: 'images/icon.ico',
+      iconUrl:
+        'https://raw.githubusercontent.com/Draculabo/AntigravityManager/main/images/icon.ico',
+    }),
+    ...(process.platform === 'win32' && process.arch === 'x64'
+      ? [
+          new MakerWix({
+            language: 1033,
+            icon: path.join(process.cwd(), 'images', 'icon.ico'),
+            exe: `${windowsExecutableName}.exe`,
+            ui: { chooseDirectory: true },
+          }),
+        ]
+      : []),
+    new MakerDMG(
+      {
+        overwrite: true,
+        icon: 'images/icon.icns',
+        iconSize: 160,
+      },
+      ['darwin'],
+    ),
+    new MakerZIP({}, ['darwin']),
+    appImageMaker,
+    new MakerRpm({}),
+    new MakerDeb({}),
+  ],
   publishers: [
     {
       /*

openspec/changes/add-multiarch-release-artifacts/design.md

@@ -0,0 +1,36 @@
+## Context
+The existing Electron Forge packaging pipeline needs Linux arm64, macOS universal, and Windows MSI outputs, plus consistent artifact naming and SHA-256 checksum outputs for cross-platform release parity.
+
+## Goals / Non-Goals
+- Goals:
+  - Cover Linux arm64 artifacts (`deb`/`rpm`/`AppImage`)
+  - Provide macOS `x64`/`arm64`/`universal` dmg artifacts
+  - Add MSI artifacts for Windows
+  - Include architecture markers in artifact names and output SHA-256 checksums
+- Non-Goals:
+  - Change existing update logic (`latest*.yml` remains unchanged)
+  - Modify runtime application behavior
+
+## Decisions
+- Decision: Build Linux arm64 on a dedicated arm64 runner, without cross-compilation.
+- Decision: Build macOS universal via `--arch=universal` or by merging app bundles before dmg packaging.
+- Decision: Generate Windows MSI with the official Forge maker (Wix/MSI) in parallel with Squirrel.
+- Decision: Use `productName + version + arch` naming; Linux uses `amd64/aarch64`, macOS/Windows use `x64/arm64/universal`.
+
+## Alternatives Considered
+- x64-only artifacts: rejected because it does not meet user requirements.
+- universal-only dmg: rejected due to weaker debugging/rollback capability and lack of architecture distinction.
+
+## Risks / Trade-offs
+- Linux arm64 builds may be affected by native dependency compilation (for example, `better-sqlite3`, `keytar`).
+- Windows MSI requires extra tooling (Wix), which may increase CI duration and failure rate.
+- The universal dmg pipeline requires validation for signing and update-flow consistency.
+
+## Migration Plan
+1) Introduce CI multi-arch jobs with naming and checksum outputs.
+2) Add MSI maker and universal dmg packaging.
+3) Stabilize the workflow after release validation.
+
+## Open Questions
+- Should artifact naming strictly match sample format (underscore vs hyphen)?
+- Should checksum output be separate `.sha256` files or a single consolidated manifest?

openspec/changes/add-multiarch-release-artifacts/proposal.md

@@ -0,0 +1,20 @@
+# Change: Add Multi-Architecture and Multi-Format Release Artifacts
+
+## Why
+
+Current release artifacts only cover part of the required architectures and formats. This does not meet demand for Linux arm64, macOS universal, and Windows MSI, and it lacks consistent naming and SHA-256 checksum outputs aligned with distribution requirements.
+
+## What Changes
+
+- Add Linux arm64 (`aarch64`) builds producing `.deb`, `.rpm`, and `.AppImage`.
+- Add `macOS universal.dmg` (while keeping x64/arm64 dmg outputs).
+- Add Windows MSI artifacts in parallel with existing Squirrel `.exe`.
+- Standardize artifact naming and architecture identifiers, and generate SHA-256 checksum files.
+
+## Impact
+
+- Affected specs: `release-packaging`
+- Affected code:
+  - `E:\project\Crack\.github\workflows\publish.yaml`
+  - `E:\project\Crack\forge.config.ts`
+  - `E:\project\Crack\package.json`

openspec/changes/add-multiarch-release-artifacts/specs/release-packaging/spec.md

@@ -0,0 +1,41 @@
+## ADDED Requirements
+
+### Requirement: Linux Multi-Architecture Release Artifacts
+The system SHALL produce Linux x64 and arm64 release artifacts, including `.deb`, `.rpm`, and `.AppImage`.
+
+#### Scenario: Linux x64 artifact generation
+- **WHEN** building a release on Linux x64
+- **THEN** release assets include x64 `.deb`, `.rpm`, and `.AppImage` files
+
+#### Scenario: Linux arm64 artifact generation
+- **WHEN** building a release on Linux arm64
+- **THEN** release assets include arm64 `.deb`, `.rpm`, and `.AppImage` files
+
+### Requirement: macOS Multi-Architecture and Universal dmg
+The system SHALL produce macOS x64, arm64, and universal dmg artifacts in release builds.
+
+#### Scenario: macOS x64/arm64 dmg generation
+- **WHEN** building releases for macOS x64 and arm64
+- **THEN** release assets include dmg files for each corresponding architecture
+
+#### Scenario: macOS universal dmg generation
+- **WHEN** running a universal build
+- **THEN** release assets include a universal dmg
+
+### Requirement: Parallel Windows MSI and Squirrel Artifacts
+The system SHALL generate both Squirrel installer artifacts and MSI artifacts in Windows release builds.
+
+#### Scenario: Windows MSI generation
+- **WHEN** building a release on Windows x64
+- **THEN** release assets include both `.exe` installer and `.msi` artifacts
+
+### Requirement: Artifact Naming and SHA-256 Output
+The system SHALL output SHA-256 checksums for all release artifacts and use a unified naming convention that includes architecture markers.
+
+#### Scenario: Artifact naming includes version and architecture
+- **WHEN** generating release artifacts
+- **THEN** artifact names include `productName`, `version`, and `arch` identifiers
+
+#### Scenario: SHA-256 checksum output
+- **WHEN** release artifact generation finishes
+- **THEN** release assets include SHA-256 checksums for corresponding artifacts

openspec/changes/add-multiarch-release-artifacts/tasks.md

@@ -0,0 +1,7 @@
+## 1. Implementation
+- [x] 1.1 Update the release workflow matrix to add Linux arm64 builds and split build steps by architecture.
+- [x] 1.2 Add macOS universal build flow (merge app bundles before generating universal dmg).
+- [x] 1.3 Introduce Windows MSI maker and required dependencies, and generate MSI in the Windows job.
+- [x] 1.4 Extend `postMake` artifact renaming and architecture mapping logic to generate SHA-256 checksum files.
+- [ ] 1.5 Update release attachments and artifact inventory documentation (if needed).
+- [ ] 1.6 Verify CI outputs for Linux arm64, macOS universal, and Windows MSI.

openspec/changes/improve-cross-platform-stability/design.md

@@ -0,0 +1,35 @@
+## Context
+
+The stability of account injection and detection differs across platforms, with risks concentrated in:
+- DB lock conflicts causing unstable writes.
+- Version-detection failures causing incorrect injection-path routing.
+- Compatibility boundaries introduced by OS behavior differences.
+
+## Goals / Non-Goals
+
+- Goals:
+  - Improve cross-platform write and switching stability.
+  - Define clear priority between version detection and capability probing.
+  - Improve observability and troubleshooting efficiency.
+- Non-Goals:
+  - Extend support to non-default runtime configuration path parsing.
+  - Introduce new business strategies.
+
+## Decisions
+
+- Decision: Transactionalize the write flow to reduce partial-success risk.
+- Decision: Add DB busy retry and `busy_timeout`.
+- Decision: On version-detection failure, use `package.json` as Windows fallback source.
+- Decision: Give capability probing higher priority than version detection; prefer new format when a new-format key is detected.
+
+## Risks / Trade-offs
+
+- A stricter write flow may add minor latency.
+- Running capability probing and version detection together increases implementation complexity.
+
+## Migration Plan
+
+1. Complete transactional writes and retry mechanisms.
+2. Add version-detection cache and fallback.
+3. Introduce strategy-based injection and capability probing.
+4. Add corresponding tests and regression verification.

openspec/changes/improve-cross-platform-stability/proposal.md

@@ -0,0 +1,35 @@
+# Change: Cross-Platform Stability and Robustness Improvements (P0+P1+P2)
+
+## Why
+
+- Account injection and detection across platforms are vulnerable to DB locks, version-detection failures, and OS-level differences.
+- Stability, diagnosability, and maintainability must improve without changing business semantics.
+
+## What Changes
+
+- Make the write flow atomic (transaction-wrapped).
+- Add DB lock retry and `busy_timeout`.
+- Add cache and lower-noise logging for version detection.
+- Add a more robust Windows fallback for version detection (read from `package.json`).
+- Introduce strategy-based injection routing (new/legacy/dual-write).
+- Add capability probing: prefer new format when new-format keys are detected.
+
+## Impact
+
+- Affected specs: `ide-auth-compat`
+- Affected code:
+  - `src/ipc/database/cloudHandler.ts`
+  - `src/ipc/database/handler.ts`
+  - `src/utils/antigravityVersion.ts`
+  - `src/utils/paths.ts` (this stage covers default runtime configuration path only)
+  - `src/types/db.ts`
+
+## Constraints
+
+- Do not change existing business semantics; only improve stability and structure.
+- This stage only covers the default runtime configuration path.
+
+## Risks
+
+- Transaction and retry logic may change when errors surface.
+- Capability probing may conflict with version detection unless priority is clearly defined.

openspec/changes/improve-cross-platform-stability/specs/ide-auth-compat/spec.md

@@ -0,0 +1,42 @@
+## ADDED Requirements
+### Requirement: Atomic Injection Writes
+The system SHALL use transactions when writing IDE state to ensure atomic updates.
+
+#### Scenario: Injection write consistency
+- **WHEN** injecting new/legacy token formats
+- **THEN** related keys are committed in a single transaction to avoid partial writes
+
+### Requirement: DB Lock Retry
+The system SHALL perform short backoff retries on SQLITE_BUSY or SQLITE_LOCKED.
+
+#### Scenario: Successful DB lock retry
+- **WHEN** a write encounters a lock
+- **THEN** the system retries for a limited number of attempts and records logs
+
+### Requirement: Version Detection Cache
+The system SHALL cache IDE version-detection results in-process to reduce repeated system calls.
+
+#### Scenario: Version cache hit
+- **WHEN** IDE version is requested multiple times
+- **THEN** the system call is executed only once
+
+### Requirement: Windows Version Detection Fallback
+The system SHALL read `package.json` as a fallback source when Windows version detection fails.
+
+#### Scenario: Windows version detection failure
+- **WHEN** PowerShell fails to read version
+- **THEN** version is obtained by falling back to `package.json`
+
+### Requirement: Strategy-Based Injection
+The system SHALL use a strategy pattern to split new/legacy/dual-write injection paths for clearer structure.
+
+#### Scenario: Strategy selection
+- **WHEN** version-based and capability-based routing differ
+- **THEN** the system selects the corresponding injection implementation via strategy objects
+
+### Requirement: Prefer New Format via Capability Probing
+The system SHALL prefer new-format injection when new-format keys are detected.
+
+#### Scenario: New-format key exists
+- **WHEN** `antigravityUnifiedStateSync.oauthToken` exists
+- **THEN** injection uses new format with higher priority

openspec/changes/improve-cross-platform-stability/tasks.md

@@ -0,0 +1,17 @@
+## 1. Scope and Planning Confirmation
+- [ ] 1.1 Review `proposal.md`.
+- [ ] 1.2 Finalize priority: capability probing vs version detection.
+- [ ] 1.3 Confirm this stage covers default runtime configuration path only.
+
+## 2. Implementation
+- [x] 2.1 Make write flow transactional (atomic).
+- [x] 2.2 Add DB lock retry and `busy_timeout`.
+- [x] 2.3 Add version-detection cache and lower-noise logs.
+- [x] 2.4 Add Windows fallback for version detection (`package.json`).
+- [x] 2.5 Split injection path by strategy pattern.
+- [x] 2.6 Add capability probing: prefer new format when new key is detected.
+
+## 3. Verification
+- [x] 3.1 Simulate SQLITE_BUSY/LOCKED retry behavior.
+- [x] 3.2 Verify fallback path for version-detection failure.
+- [x] 3.3 Verify capability-probing priority behavior.

openspec/changes/localize-app-chinese-default/design.md

@@ -1,30 +1,30 @@
-# 设计：多语言支持
+# Design: Multilingual Support
 
-## 架构
+## Architecture
 
-应用使用 `react-i18next` 进行国际化，并配合 `i18next-browser-languagedetector` 进行语言检测。配置集中在 `src/localization/i18n.ts` 中。
+The application uses `react-i18next` for i18n and `i18next-browser-languagedetector` for language detection. Configuration is centralized in `src/localization/i18n.ts`.
 
-### 语言资源
+### Language Resources
 
-翻译资源将作为 JSON 对象构建在 `i18n.ts` 中（如果太大则分文件）。
-我们将在 `resources` 对象中添加 `zh-CN` 键。
+Translation resources are built as JSON objects in `i18n.ts` (or split into files if they grow large).
+We add a `zh-CN` key in the `resources` object.
 
-### 默认语言策略
+### Default Language Strategy
 
-我们将引入 `LanguageDetector` 插件。
-`i18n.use(LanguageDetector).init({...})` 将被配置为首先检查 `localStorage`，然后检查 `navigator`（浏览器/系统语言）。
-`fallbackLng` 将保持为 `'en'`，作为最后的兜底。
+We introduce the `LanguageDetector` plugin.
+`i18n.use(LanguageDetector).init({...})` is configured to check `localStorage` first, then `navigator` (browser/system language).
+`fallbackLng` remains `'en'` as the final fallback.
 
-### 键映射
+### Key Mapping
 
-我们将把现有的英文字符串映射到语义键（例如 `home.title`, `settings.theme`）。
+Existing English strings are mapped to semantic keys (for example, `home.title`, `settings.theme`).
 
-## 数据流
+## Data Flow
 
-1. 应用启动。
-2. `i18next` 初始化，通过 `LanguageDetector` 确定语言：
-   * 检查 `localStorage` 是否有保存的偏好。
-   * 如果无，检查 `navigator.language`。
-   * 如果检测到的语言受支持（`en` 或 `zh-CN`），则使用该语言。
-   * 否则，使用 `fallbackLng` (`en`)。
-3. 组件使用 `useTranslation` hook 根据当前语言获取字符串。
+1. App starts.
+2. `i18next` initializes and determines language via `LanguageDetector`:
+   * Check whether `localStorage` has a saved preference.
+   * If not, check `navigator.language`.
+   * If detected language is supported (`en` or `zh-CN`), use it.
+   * Otherwise, use `fallbackLng` (`en`).
+3. Components use `useTranslation` to resolve strings for the active language.

openspec/changes/localize-app-chinese-default/proposal.md

@@ -1,41 +1,41 @@
-# 提案：应用本地化（自动检测系统语言）
+# Proposal: App Localization (Automatic System Language Detection)
 
-**变更 ID：** `localize-app-auto-detect`
+**Change ID:** `localize-app-auto-detect`
 
-## 摘要
+## Summary
 
-为 Antigravity Manager 应用添加多语言支持，并根据用户的操作系统语言自动设置默认语言。如果系统语言不受支持，则回退到英语。这包括更新 i18n 配置，添加中文翻译资源，并集成语言检测插件。
+Add multilingual support to Antigravity Manager and automatically set the default UI language based on the user's OS language. If the OS language is unsupported, fall back to English. This includes updating i18n configuration, adding Chinese translation resources, and integrating a language detection plugin.
 
-## 动机
+## Motivation
 
-为了提供最佳的用户体验，应用应该能够适应用户的首选语言环境。自动检测系统语言可以减少用户的配置步骤，提供更自然的初次使用体验。
+To provide a better user experience, the app should adapt to users' preferred language environment. Automatically detecting system language reduces setup effort and improves first-run experience.
 
-## 建议变更
+## Proposed Changes
 
-1. **集成语言检测：** 安装并配置 `i18next-browser-languagedetector` 以自动检测用户语言。
-2. **更新 i18n 配置：** 修改 `src/localization/i18n.ts`，启用语言检测，并设置适当的回退语言（英语）。
-3. **添加中文资源：** 为 `zh-CN` 创建一个新的翻译资源文件，包含所有应用字符串。
-4. **更新语言操作：** 确保 `src/actions/language.ts` 正确处理自动检测和手动覆盖的逻辑。
-5. **UI 更新：** 确保所有 UI 组件使用翻译键而不是硬编码字符串。
+1. **Integrate language detection:** Install and configure `i18next-browser-languagedetector` to auto-detect user language.
+2. **Update i18n config:** Modify `src/localization/i18n.ts` to enable language detection and define a fallback language (English).
+3. **Add Chinese resources:** Create `zh-CN` translation resources covering all app strings.
+4. **Update language actions:** Ensure `src/actions/language.ts` correctly handles auto-detection and manual override.
+5. **UI updates:** Ensure all UI components use translation keys instead of hardcoded text.
 
-## 考虑的替代方案
+## Alternatives Considered
 
-* **强制默认中文：** 已拒绝，为了适应更广泛的国际用户群体，并尊重用户的系统设置。
-* **强制默认英语：** 已拒绝，同上。
+* **Force default Chinese:** Rejected, to support a broader international user base and respect system settings.
+* **Force default English:** Rejected, same reason.
 
-## 风险
+## Risks
 
-* **检测失败：** 在某些特殊环境（如 Linux 某些发行版）下，语言检测可能不准确，需要确保回退机制可靠。
+* **Detection failure:** In certain environments (for example, some Linux distros), language detection may be inaccurate. Fallback behavior must remain reliable.
 
-## 验收标准
+## Acceptance Criteria
 
-1. **自动检测：**
-   * 在系统语言设置为中文（简体）的环境下启动应用，应用界面默认显示为中文。
-   * 在系统语言设置为英语或其他非中文语言的环境下启动应用，应用界面默认显示为英语。
-2. **手动切换：**
-   * 用户可以在设置页面将语言从中文切换到英语，界面应立即更新，无需重启。
-   * 用户可以在设置页面将语言从英语切换到中文，界面应立即更新，无需重启。
-3. **持久化：**
-   * 用户手动更改语言后，重启应用，应用应保持用户选择的语言，而不是重新检测系统语言。
-4. **完整性：**
-   * 应用的所有可见文本（包括主页、设置页、状态栏、弹窗提示）都应正确显示对应的语言，没有遗漏的硬编码字符串。
+1. **Automatic detection:**
+   * When OS language is Simplified Chinese, app defaults to Chinese on first launch.
+   * When OS language is English or another non-Chinese language, app defaults to English on first launch.
+2. **Manual switching:**
+   * Users can switch from Chinese to English in Settings, and UI updates immediately without restart.
+   * Users can switch from English to Chinese in Settings, and UI updates immediately without restart.
+3. **Persistence:**
+   * After users manually change language, app restart preserves the selected language instead of re-detecting.
+4. **Completeness:**
+   * All visible strings (home page, settings page, status bar, popups) render correctly in the selected language with no leftover hardcoded text.

openspec/changes/localize-app-chinese-default/specs/localization/spec.md

@@ -1,59 +1,59 @@
-# 规格：本地化
+# Spec: Localization
 
 ## ADDED Requirements
 
-### Requirement: 自动语言检测
+### Requirement: Automatic Language Detection
 
-应用在首次启动时 MUST 自动检测用户的系统语言并设置相应的界面语言。
+On first launch, the application MUST automatically detect the user's system language and set the corresponding UI language.
 
-#### Scenario: 系统语言为中文
+#### Scenario: System language is Chinese
 
-Given 用户首次打开应用
-And 用户的系统语言设置为中文 (zh-CN)
-And 本地存储中没有保存语言偏好
-When 应用加载时
-Then 界面应该显示为简体中文 (`zh-CN`)
+Given the user opens the app for the first time
+And the user's system language is set to Chinese (`zh-CN`)
+And no language preference is saved in local storage
+When the app loads
+Then the UI should be displayed in Simplified Chinese (`zh-CN`)
 
-#### Scenario: 系统语言为其他（非中文）
+#### Scenario: System language is non-Chinese
 
-Given 用户首次打开应用
-And 用户的系统语言设置为法语 (fr)
-And 本地存储中没有保存语言偏好
-When 应用加载时
-Then 界面应该回退显示为英语 (`en`)
+Given the user opens the app for the first time
+And the user's system language is set to French (`fr`)
+And no language preference is saved in local storage
+When the app loads
+Then the UI should fall back to English (`en`)
 
-### Requirement: 语言切换
+### Requirement: Language Switching
 
-用户 MUST 能够在支持的语言之间切换，且手动选择 MUST 覆盖自动检测。
+Users MUST be able to switch between supported languages, and manual selection MUST override automatic detection.
 
-#### Scenario: 切换语言
+#### Scenario: Switch language
 
-Given 用户在设置页面
-When 用户从语言下拉菜单中选择 "English"
-Then 界面应该立即切换为英语
-And 偏好应该保存到本地存储
+Given the user is on the settings page
+When the user selects "English" from the language dropdown
+Then the UI should switch to English immediately
+And the preference should be saved to local storage
 
-### Requirement: 持久化
+### Requirement: Persistence
 
-用户的手动语言偏好 MUST 在会话之间持久化，并优先于系统语言。
+The user's manual language preference MUST persist across sessions and take precedence over system language.
 
-#### Scenario: 持久化语言偏好
+#### Scenario: Persist language preference
 
-Given 用户已手动选择 "English" 作为首选语言
-And 用户的系统语言设置为中文
-When 用户重启应用
-Then 界面应该显示为英语（尊重用户选择）
+Given the user has manually selected "English" as preferred language
+And the user's system language is Chinese
+When the user restarts the app
+Then the UI should display English (respecting user preference)
 
 ## MODIFIED Requirements
 
-### Requirement: i18n 配置更新
+### Requirement: Update i18n Configuration
 
-i18n 配置 MUST 更新以支持语言检测插件。
+i18n configuration MUST be updated to support the language detection plugin.
 
-#### Scenario: i18n 配置
+#### Scenario: i18n configuration
 
-`src/localization/i18n.ts` 文件必须更新为：
+`src/localization/i18n.ts` must be updated to:
 
-1. 集成 `i18next-browser-languagedetector`。
-2. 配置检测顺序：`['localStorage', 'navigator']`。
-3. 包含 `zh-CN` 资源对象。
+1. Integrate `i18next-browser-languagedetector`.
+2. Configure detection order as `['localStorage', 'navigator']`.
+3. Include `zh-CN` resource objects.

openspec/changes/localize-app-chinese-default/tasks.md

@@ -1,10 +1,10 @@
-# 任务：应用本地化（自动检测系统语言）
+# Tasks: App Localization (Automatic System Language Detection)
 
-* \[x] 安装 `i18next-browser-languagedetector` 依赖。 <!-- id: install-dependency -->
-* \[x] 更新 `src/localization/i18n.ts` 以配置语言检测器并包含 `zh-CN` 资源。 <!-- id: update-i18n-config -->
-* \[x] 验证 `src/actions/language.ts` 逻辑，确保与自动检测兼容。 <!-- id: verify-language-actions -->
-* \[x] 更新 `src/components/StatusBar.tsx` 以使用翻译。 <!-- id: localize-statusbar -->
-* \[x] 更新 `src/components/AccountCard.tsx` 以使用翻译。 <!-- id: localize-accountcard -->
-* \[x] 更新 `src/pages/index.tsx`（主页）以使用翻译。 <!-- id: localize-homepage -->
-* \[x] 更新 `src/pages/settings.tsx` 以使用翻译并添加语言切换器。 <!-- id: localize-settings -->
-* \[x] 运行应用验证语言检测和手动切换功能。 <!-- id: verify-localization -->
+* \[x] Install `i18next-browser-languagedetector`. <!-- id: install-dependency -->
+* \[x] Update `src/localization/i18n.ts` to configure language detection and include `zh-CN` resources. <!-- id: update-i18n-config -->
+* \[x] Verify `src/actions/language.ts` logic is compatible with auto-detection. <!-- id: verify-language-actions -->
+* \[x] Update `src/components/StatusBar.tsx` to use translations. <!-- id: localize-statusbar -->
+* \[x] Update `src/components/AccountCard.tsx` to use translations. <!-- id: localize-accountcard -->
+* \[x] Update `src/pages/index.tsx` (home page) to use translations. <!-- id: localize-homepage -->
+* \[x] Update `src/pages/settings.tsx` to use translations and add a language switcher. <!-- id: localize-settings -->
+* \[x] Run the app to verify language detection and manual switching. <!-- id: verify-localization -->

openspec/changes/refactor-db-drizzle/design.md

@@ -0,0 +1,35 @@
+## Context
+Current SQLite access mainly relies on native `better-sqlite3` APIs, without unified typing and runtime validation strategy. This raises maintenance cost and regression risk. Introducing Drizzle ORM aims to improve type safety and maintainability while preserving existing behavior and compatibility.
+
+## Goals / Non-Goals
+- Goals:
+  - Provide structured schema and type inference
+  - Unify DB access and validation patterns, reducing `any/as`
+  - Preserve WAL, `busy_timeout`, transactions, and compatibility logic
+- Non-Goals:
+  - Do not change existing database schema
+  - Do not introduce a new database engine or remote storage
+
+## Decisions
+- Decision: Adopt Drizzle ORM while keeping `better-sqlite3` as the driver.
+- Decision: Keep runtime validation and compatibility logic for external IDE DB (`ItemTable`).
+- Decision: Migrate in order: internal DB first, external DB second.
+
+## Alternatives Considered
+- Continue with `better-sqlite3 + Zod`: limited type-safety gains and higher long-term maintenance cost.
+- Prisma: heavyweight footprint and higher Electron integration cost.
+
+## Risks / Trade-offs
+- Packaging compatibility risk (Electron + native module ABI): requires cross-platform validation.
+- Temporary complexity increase while dual stacks coexist during migration.
+- Drizzle provides static typing only; runtime validation is still required to avoid dirty data.
+
+## Migration Plan
+1. Define Drizzle schema (`accounts`/`settings`/`ItemTable`).
+2. Migrate `cloudHandler.ts` (internal DB).
+3. Migrate `database/handler.ts` (external IDE DB).
+4. Update unit tests and mocks.
+5. Run cross-platform smoke verification.
+
+## Open Questions
+- Loose compatibility mode is confirmed; stronger runtime schema is not introduced for now.

openspec/changes/refactor-db-drizzle/proposal.md

@@ -0,0 +1,17 @@
+# Change: Refactor SQLite Access with Drizzle ORM
+
+## Why
+
+Current `better-sqlite3` usage relies heavily on `any/as`, lacks unified typing and runtime validation, and increases long-term maintenance cost. Introducing Drizzle ORM provides structured schema definitions and more consistent type constraints.
+
+## What Changes
+
+- Introduce Drizzle ORM and define schema for the internal database.
+- Incrementally migrate read/write paths in `cloudHandler` and `database/handler`.
+- Preserve existing WAL, `busy_timeout`, and transaction behavior to avoid regressions.
+- Keep runtime validation and compatibility logic for the external IDE DB (`ItemTable`).
+
+## Impact
+
+- Affected code: `src/ipc/database/cloudHandler.ts`, `src/ipc/database/handler.ts`, tests, and DB utility layer
+- Affected behavior: data-access typing and runtime validation approach changes (regression validation required)

openspec/changes/refactor-db-drizzle/specs/database-access/spec.md

@@ -0,0 +1,21 @@
+## ADDED Requirements
+### Requirement: Use Drizzle ORM for Internal Database
+The system SHALL use Drizzle ORM to access the internal database (`cloud_accounts.db`) and provide type constraints through schema.
+
+#### Scenario: Read cloud account list
+- **WHEN** the system reads the `accounts` table
+- **THEN** returned data SHALL match Drizzle schema types
+
+### Requirement: Keep Compatibility and Validation for External IDE Database
+The system SHALL preserve compatibility logic and runtime validation when accessing the external IDE database (`ItemTable`).
+
+#### Scenario: Read ItemTable key
+- **WHEN** reading a specific key from `ItemTable`
+- **THEN** data that fails validation SHALL be logged as warning and skipped
+
+### Requirement: Maintain Database Connection Stability
+The system SHALL preserve existing WAL, `busy_timeout`, and transaction strategies to avoid migration regressions.
+
+#### Scenario: Transactional write consistency
+- **WHEN** executing write operations
+- **THEN** related updates SHALL be committed within the same transaction

openspec/changes/refactor-db-drizzle/tasks.md

@@ -0,0 +1,19 @@
+## 1. Scope and Migration Confirmation
+- [x] 1.1 Confirm migration scope (internal DB vs external IDE DB).
+- [x] 1.2 Confirm Drizzle driver choice (keep `better-sqlite3`).
+- [x] 1.3 Confirm no changes to existing database schema.
+
+## 2. Design and Preparation
+- [x] 2.1 Build Drizzle schema (`accounts`/`settings`/`ItemTable`).
+- [x] 2.2 Define connection initialization and pragma strategy (WAL, `busy_timeout`).
+- [x] 2.3 Define runtime validation strategy (external IDE DB, loose compatibility).
+
+## 3. Implementation
+- [x] 3.1 Migrate read/write paths in `cloudHandler.ts`.
+- [x] 3.2 Migrate read/write paths in `database/handler.ts`.
+- [x] 3.3 Preserve existing transaction and retry semantics.
+
+## 4. Testing and Verification
+- [x] 4.1 Update unit tests and mocks.
+- [ ] 4.2 Run regression checks for account backup/restore and injection flow.
+- [ ] 4.3 Complete cross-platform smoke verification (Win/macOS/Linux).

openspec/changes/update-device-fingerprint-hardening/acceptance-checklist.md

@@ -0,0 +1,40 @@
+# Device Fingerprint Capability Acceptance Checklist
+
+## Backend Capabilities
+
+- `get_storage_path / get_storage_dir / get_state_db_path`
+- `read_profile / write_profile`
+- `generate_profile`
+- `sync_service_machine_id / sync_service_machine_id_from_storage`
+- `load_global_original / save_global_original`
+- `get_device_profiles`
+- `bind_device_profile / bind_device_profile_with_profile`
+- `restore_device_version / delete_device_version`
+- `restore_original_device`
+- `open_device_folder`
+
+## UI Capabilities
+
+- Show current storage / account binding / history / baseline
+- Generate and bind
+- Capture and bind
+- Restore original fingerprint
+- Restore history revision
+- Delete history revision
+- Open storage folder
+
+## Switching Behavior
+
+- Local account switching applies bound fingerprint
+- Cloud account switching applies bound fingerprint
+- Concurrent switch requests use queued serial semantics
+- Failure semantics are fail-fast (no extra transaction orchestration)
+
+## Compatibility Scope
+
+- Legacy data missing optional fields: fill defaults
+- Corrupted structure/type mismatch: explicit failure
+
+## Status Marking
+
+Please mark each item as: `Passed / Failed / Diverged (with reason)`.

openspec/changes/update-device-fingerprint-hardening/design.md

@@ -0,0 +1,50 @@
+## Context
+
+Device-fingerprint capability spans the data layer, switch-orchestration layer, and UI management layer.
+Historical proposals split the same capability across multiple change IDs, which fragmented implementation and acceptance criteria.
+This design combines "feature completeness + robustness" into a single constraint set to keep implementation, verification, and release aligned.
+
+## Goals / Non-Goals
+
+- Goals:
+  - Unify scope and acceptance criteria for device-fingerprint capability.
+  - Ensure behavioral consistency and diagnosability for local/cloud switching.
+  - Keep consistent behavior on default paths across Windows/macOS/Linux.
+  - Keep legacy-data compatibility predictable and verifiable.
+- Non-Goals:
+  - Support for non-default runtime configuration paths.
+  - Business strategy expansion unrelated to this capability.
+
+## Decisions
+
+- Decision: Use a single change ID to manage the complete capability.
+  - Rationale: Reduce governance overhead caused by duplicate proposals.
+- Decision: Apply fingerprint using a two-phase flow with strict pre-commit verification.
+  - Rationale: Reduce mixed-state risk caused by partial success.
+- Decision: Use versioned payload + boundary validation for fingerprint/history data.
+  - Rationale: Avoid silent data contamination and define clear compatibility/failure boundaries.
+- Decision: Use fail-fast semantics for switch failures and return structured failure reasons.
+  - Rationale: Make failure behavior predictable and observable.
+- Decision: Trigger safe mode for temporary degradation after consecutive failures.
+  - Rationale: Keep switching flow available during fault windows.
+
+## Risks / Trade-offs
+
+- Risk: Stricter validation may reject legacy dirty data.
+  - Mitigation: Normalize missing optional fields; fail-fast only for critical structure errors.
+- Risk: Validation and diagnostic extensions add minor performance cost.
+  - Mitigation: Keep validation lightweight and limited to critical boundaries.
+- Risk: More UI management actions may increase user misoperations.
+  - Mitigation: Add confirmation interactions and unit-test coverage for failure branches.
+
+## Migration Plan
+
+1. Use `update-device-fingerprint-hardening` as the single active proposal.
+2. Merge historical duplicate proposal content into this proposal (`proposal`/`design`/`tasks`/`spec`).
+3. Close and remove duplicate proposal directories.
+4. Deliver with unified task checklist and acceptance checklist.
+
+## Open Questions
+
+- Should safe mode exit only by time window, or also allow manual recovery?
+- Should diagnostic snapshots be exposed in the renderer as a visual panel?

openspec/changes/update-device-fingerprint-hardening/proposal.md

@@ -0,0 +1,39 @@
+# Change: Device Fingerprint Consolidation and Hardening
+
+## What Changes
+
+- Unify backend scope:
+  - Fingerprint read/write with synchronized updates to `storage.json` and `state.vscdb`
+  - Account-level binding, revision history, and baseline restore
+  - Fingerprint apply orchestration during switch flows (local/cloud)
+- Unify management scope:
+  - Device fingerprint management dialog
+  - Generate-and-bind, capture-and-bind, restore revision, delete revision, restore baseline, and open storage folder
+- Unify robustness scope:
+  - Two-phase apply (`prepare -> verify -> commit`)
+  - Deterministic rollback before commit on failure
+  - Failure reason classification, safe mode, degradation strategy, and diagnostics snapshots
+  - Versioned payload with boundary validation (lenient compatibility + strict failure for critical structure)
+- Path scope: this stage focuses on the default runtime configuration path.
+
+## Non-Goals
+
+- Do not promise any anti-detection, anti-ban, or risk-control bypass outcome.
+- Do not introduce token/protobuf semantic changes unrelated to device fingerprinting.
+- Do not perform ORM or large database refactors in this change.
+
+## Impact
+
+- Affected specs: `device-fingerprint-hardening`
+- Affected code:
+  - `src/ipc/device/handler.ts`
+  - `src/ipc/account/handler.ts`
+  - `src/ipc/cloud/handler.ts`
+  - `src/ipc/switchFlow.ts`
+  - `src/ipc/switchMetrics.ts`
+  - `src/ipc/database/cloudHandler.ts`
+  - `src/components/DeviceFingerprintDialog.tsx`
+  - `src/actions/account.ts`
+  - `src/actions/cloud.ts`
+  - `src/tests/unit/account.test.ts`
+  - `src/tests/unit/cloudHandler-sync.test.ts`

openspec/changes/update-device-fingerprint-hardening/specs/device-fingerprint-hardening/spec.md

@@ -0,0 +1,109 @@
+## ADDED Requirements
+
+### Requirement: Complete Device Fingerprint Management Capability
+
+The system SHALL provide complete device-fingerprint management capability: view current storage fingerprint, account-bound fingerprint, history revisions, and baseline fingerprint, and execute generate/capture/bind/restore/delete operations.
+
+#### Scenario: Open device fingerprint management
+
+- **WHEN** an operator opens device fingerprint management for a specific account
+- **THEN** the system returns current storage fingerprint, account-bound fingerprint, history revisions, and baseline fingerprint (if present)
+
+#### Scenario: Generate and bind a new fingerprint
+
+- **WHEN** the operator confirms "Generate and Bind"
+- **THEN** the system generates a valid new fingerprint and binds it to the target account
+- **AND** the new revision is appended to history and marked as current
+
+#### Scenario: Capture current and bind
+
+- **WHEN** the operator confirms "Capture Current and Bind"
+- **THEN** the system reads the current storage fingerprint and binds it to the target account
+- **AND** a new revision is appended to history
+
+### Requirement: Switch Flow Must Apply Account-Bound Fingerprint
+
+The system SHALL ensure the target account has a valid bound fingerprint before continuing switch flow for both local-account and cloud-account switching.
+
+#### Scenario: Target account has no bound fingerprint during switching
+
+- **GIVEN** the target account exists and has no bound fingerprint
+- **WHEN** account switching is initiated
+- **THEN** the system automatically generates and binds a usable fingerprint
+- **AND** then continues with the switch flow
+
+#### Scenario: Concurrent switch requests
+
+- **WHEN** multiple switch requests are triggered while a switch is in progress
+- **THEN** requests are queued and processed serially
+- **AND** no concurrent write conflicts occur
+
+### Requirement: Fingerprint Apply Must Preserve Storage Consistency
+
+The system SHALL update `storage.json` and `state.vscdb` in sync when applying device fingerprint, and SHALL ensure `storage.serviceMachineId` equals `devDeviceId`.
+
+#### Scenario: Normal fingerprint apply
+
+- **WHEN** the system applies a device fingerprint
+- **THEN** telemetry fields in `storage.json` are updated
+- **AND** `storage.serviceMachineId` is updated to `devDeviceId`
+- **AND** `ItemTable['storage.serviceMachineId']` in `state.vscdb` is updated accordingly
+
+### Requirement: Device Fingerprint Apply Uses Two-Phase Protocol
+
+The system SHALL execute device-fingerprint apply with a two-phase protocol (`prepare -> verify -> commit`), and SHALL perform deterministic rollback when failure occurs before commit.
+
+#### Scenario: Failure during verify phase
+
+- **WHEN** prepare writes succeed but verify detects inconsistent state
+- **THEN** the system rolls back to pre-apply state
+- **AND** returns a classifiable failure reason
+
+#### Scenario: Write failure before commit
+
+- **WHEN** any critical write fails before commit completes
+- **THEN** the system performs rollback
+- **AND** post-operation state equals pre-operation state
+
+### Requirement: Fingerprint Data Uses Versioned Structure and Boundary Validation
+
+The system SHALL use explicit schema versions for fingerprint and history data, and SHALL validate at read/write boundaries.
+
+#### Scenario: Missing optional fields
+
+- **WHEN** history payload lacks optional fields
+- **THEN** the system fills default values and continues
+
+#### Scenario: Critical structure corruption or type mismatch
+
+- **WHEN** payload has critical structure corruption or critical field type mismatch
+- **THEN** the system fails fast and returns a readable error
+
+### Requirement: Consecutive Failures Trigger Safe Degradation
+
+The system SHALL enter safe mode when consecutive device-fingerprint apply failures reach a threshold, temporarily disable fingerprint apply, keep switching available, and emit warnings.
+
+#### Scenario: Consecutive-failure threshold reached
+
+- **WHEN** consecutive failures reach the threshold
+- **THEN** safe mode is activated and fingerprint apply is temporarily disabled
+- **AND** switch flow remains available under warning conditions
+
+### Requirement: Provide Observable Diagnostic Snapshot
+
+The system SHALL expose a read-only diagnostics interface returning switch-guard state, switch counters, failure-reason counters, latest failure metadata, and safe-mode state.
+
+#### Scenario: Query diagnostics after failures
+
+- **WHEN** diagnostics are queried after one or more failures
+- **THEN** reason-classified failure counters are returned
+- **AND** latest failure details and safe-mode state are returned
+
+### Requirement: Path Resolution Scope Constraint
+
+The system SHALL use default runtime configuration paths for path resolution in this capability.
+
+#### Scenario: Use default runtime configuration paths
+
+- **WHEN** the system performs device-fingerprint-related path resolution
+- **THEN** resolution is completed based on default runtime configuration paths

openspec/changes/update-device-fingerprint-hardening/tasks.md

@@ -0,0 +1,44 @@
+## 1. Proposal Consolidation
+
+- [x] 1.1 Merge duplicate device-fingerprint proposals into `update-device-fingerprint-hardening`.
+- [x] 1.2 Unify scope and terminology across proposal/design/spec.
+- [ ] 1.3 Complete proposal archival strategy (archive after release).
+
+## 2. Feature Completeness (Backend)
+
+- [x] 2.1 Provide APIs for querying/binding/restoring/deleting fingerprint history.
+- [x] 2.2 Provide API to restore original device fingerprint.
+- [x] 2.3 Provide API to open fingerprint storage folder.
+- [x] 2.4 Reuse unified fingerprint-apply chain for local and cloud switching.
+
+## 3. Feature Completeness (UI)
+
+- [x] 3.1 Provide management entry via `DeviceFingerprintDialog`.
+- [x] 3.2 Support generate-and-bind, capture-and-bind, restore history, and delete history.
+- [x] 3.3 Support restore original fingerprint and open storage folder.
+- [x] 3.4 Complete i18n copy and error messaging.
+
+## 4. Robustness Hardening
+
+- [x] 4.1 Implement two-phase apply in `src/ipc/device/handler.ts` (`prepare -> verify -> commit`).
+- [x] 4.2 Perform deterministic rollback on pre-commit failure.
+- [x] 4.3 Introduce failure-reason classification and integrate with `src/ipc/switchMetrics.ts`.
+- [x] 4.4 Introduce versioned payload and strict boundary validation.
+- [x] 4.5 Introduce safe mode and recovery strategy.
+- [x] 4.6 Extend diagnostics snapshot (failure-reason counts, latest failure metadata, safe-mode status).
+
+## 5. Verification
+
+- [x] 5.1 Run `npm run type-check`.
+- [x] 5.2 Run targeted unit tests:
+  - `npm run test:unit src/tests/unit/account.test.ts`
+  - `npm run test:unit src/tests/unit/cloudHandler-sync.test.ts`
+- [ ] 5.3 Add/extend rollback invariant unit tests.
+- [ ] 5.4 Add/extend abnormal history-data behavior unit tests.
+- [ ] 5.5 Add/extend unit tests for platform-constrained generation rules.
+- [ ] 5.6 Complete manual acceptance matrix across Windows/macOS/Linux.
+
+## 6. Delivery Documentation
+
+- [ ] 6.1 Produce a unified acceptance checklist and mark status item by item.
+- [ ] 6.2 Archive merged proposals after release.

openspec/changes/update-ide-auth-compat-1165/design.md

@@ -0,0 +1,38 @@
+## Context
+
+- The target IDE changed account OAuth token persistence format starting from version 1.16.5.
+- Existing JS logic only covers the legacy format, causing account detection and switching failures.
+- Version detection, new/legacy routing, and dual-write fallback need to be completed.
+
+## Goals / Non-Goals
+
+- Goals:
+  - Ensure compatibility for versions 1.16.5+.
+  - Apply dual-format injection fallback when version detection fails.
+  - Extend backup/restore coverage to include new-format keys.
+
+## Decisions
+
+- Decision: Write a single format when version detection succeeds; dual-write when detection fails.
+- Decision: Prefer reading the new format for account detection, with legacy fallback.
+- Decision: Keep protobuf encode/decode behavior and field ordering consistent.
+
+## Risks / Trade-offs
+
+- Risk: Protobuf encode/decode mismatch may cause injection failure.
+  - Mitigation: Per-field validation and regression test coverage.
+- Risk: Version detection failure.
+  - Mitigation: Dual-write fallback.
+- Risk: DB lock conflicts.
+  - Mitigation: Keep existing flow: close IDE -> backup -> inject -> restart.
+
+## Migration Plan
+
+1. Implement version-detection module (JS).
+2. Implement protobuf encode/decode for new format.
+3. Implement routed injection/detection logic with dual-write fallback.
+4. Extend backup/restore key set.
+
+## Open Questions
+
+- None.

openspec/changes/update-ide-auth-compat-1165/proposal.md

@@ -0,0 +1,34 @@
+# Change: IDE Auth Compatibility Fix for 1.16.5+
+
+## Why
+
+- The target IDE changed OAuth token persistence format starting from 1.16.5.
+- The current JS implementation only supports the legacy format, causing account detection and switching failures.
+- The verified behavior needs to be fully migrated into the current code path to reduce regression risk.
+
+## What Changes
+
+- Add IDE version detection and route injection by legacy/new format.
+- Support encoding/decoding and account detection for the new OAuth token format.
+- Apply dual-write fallback (legacy + new) when version detection fails.
+- Extend backup/restore logic to include new-format keys.
+
+## Constraints
+
+- Keep existing behavior semantics; do not introduce new strategy layers or business fields.
+- This stage only covers the default runtime configuration path.
+
+## Impact
+
+- Affected specs: `ide-auth-compat`
+- Affected code:
+  - `src/ipc/database/cloudHandler.ts`
+  - `src/utils/protobuf.ts`
+  - `src/ipc/database/handler.ts`
+  - `src/utils/paths.ts`
+
+## Risks
+
+- Protobuf encoding/decoding mismatch may break injection or parsing.
+- Version detection failure may route to the wrong injection path.
+- DB lock conflicts during injection may cause write failures.

openspec/changes/update-ide-auth-compat-1165/specs/ide-auth-compat/spec.md

@@ -0,0 +1,35 @@
+## ADDED Requirements
+### Requirement: New-Format Injection for 1.16.5+
+The system SHALL write only the new format `antigravityUnifiedStateSync.oauthToken` when IDE version is >= 1.16.5.
+
+#### Scenario: New-version injection
+- **WHEN** IDE version is 1.16.5 or above
+- **THEN** the system writes the new format and completes account switching
+
+### Requirement: Legacy Injection for Older Versions
+The system SHALL write only the legacy format `jetskiStateSync.agentManagerInitState` when IDE version is < 1.16.5.
+
+#### Scenario: Legacy-version injection
+- **WHEN** IDE version is below 1.16.5
+- **THEN** the system writes the legacy format and completes account switching
+
+### Requirement: Dual-Write Fallback on Version Detection Failure
+The system SHALL attempt both new and legacy format injection when IDE version cannot be detected.
+
+#### Scenario: Version detection fails
+- **WHEN** the system cannot read IDE version
+- **THEN** the system writes both new and legacy formats and must not abort due to one path failing
+
+### Requirement: Account Detection via New Format
+The system SHALL read OAuth token from the new format and complete account detection.
+
+#### Scenario: Only new format exists
+- **WHEN** IDE database contains only the new-format key
+- **THEN** the system still recognizes accounts and completes synchronization
+
+### Requirement: Backup/Restore Includes New-Format Keys
+The system SHALL include new-format keys in account backup and restore.
+
+#### Scenario: Backup and restore for new format
+- **WHEN** users perform backup and restore
+- **THEN** new-format keys are fully saved and restored

openspec/changes/update-ide-auth-compat-1165/tasks.md

@@ -0,0 +1,19 @@
+## 1. Scope and Planning Confirmation
+
+- [x] 1.1 Review `proposal.md`.
+- [x] 1.2 Confirm this stage covers default runtime configuration path only.
+- [x] 1.3 Define behavior-consistency constraints.
+
+## 2. Implementation
+
+- [x] 2.1 Add IDE version-detection module.
+- [x] 2.2 Add encode/decode support for new-format OAuth token.
+- [x] 2.3 Add routed injection logic and dual-write fallback on detection failure.
+- [x] 2.4 Prefer new format for account detection, with legacy fallback.
+- [x] 2.5 Extend backup/restore to cover new-format keys.
+
+## 3. Verification
+
+- [ ] 3.1 Self-test injection paths for both new and legacy formats.
+- [ ] 3.2 Verify dual-write behavior when version detection fails.
+- [ ] 3.3 Verify account availability after backup/restore.

openspec/project.md

@@ -2,105 +2,108 @@
 
 ## Purpose
 
-Antigravity Manager 是一个综合性的 Antigravity 增强工具，旨在打破 AI 开发的资源限制。它不仅解决了 Antigravity IDE 客户端无法原生支持多账号切换的痛点，还引入了企业级的 AI 服务账号池管理功能。通过接管应用的配置状态和云端 API 资源，它允许用户在无限个本地账号和云端 AI 服务之间无缝切换，实现 "无限" 的 AI 调用体验。
+Antigravity Manager is a comprehensive enhancement tool for Antigravity, designed to remove AI development resource limits. It not only solves the lack of native multi-account switching in Antigravity IDE, but also introduces enterprise-grade AI account pool management. By taking control of app configuration state and cloud API resources, it allows users to switch seamlessly between unlimited local accounts and cloud AI services for an effectively "unlimited" AI usage experience.
 
-**核心目标：**
+**Core goals:**
 
-*   **本地多账号切换**：无缝切换 Antigravity IDE 的本地用户状态，保护数据完整性（自动备份）。
-*   **AI 资源池管理**（新）：集中管理 Google Gemini、Claude 3.5 等 AI 服务的账号池。
-*   **智能配额监控**（新）：实时监控 API 配额（Quota）和健康度，提供可视化仪表盘。
-*   **自动资源调度**（新）：当当前账号配额耗尽时，自动切换到最佳可用账号（Token 保活与轮询）。
-*   **跨平台支持**：统一的 macOS、Windows、Linux 体验。
+* **Local multi-account switching**: Seamlessly switch Antigravity IDE local user state while protecting data integrity (automatic backup).
+* **AI resource pool management (new)**: Centrally manage account pools for Google Gemini, Claude 3.5, and similar services.
+* **Intelligent quota monitoring (new)**: Monitor API quota and health in real time with a visual dashboard.
+* **Automatic resource scheduling (new)**: Automatically switch to the best available account when the current one runs out of quota (token keepalive + polling).
+* **Cross-platform support**: Consistent macOS, Windows, and Linux experience.
 
 ## Tech Stack
 
-*   **Electron 39** - 跨平台桌面应用框架
-*   **React 19.2** - UI 框架
-*   **TypeScript 5.9** - 类型安全的开发语言
-*   **Shadcn UI** - 现代化 UI 组件库
-*   **Tailwind CSS 4** - 样式框架
-*   **oRPC** - 类型安全的 IPC 通信
-*   **TanStack Router** - 文件路由
-*   **React Query** - 服务器状态管理
-*   **better-sqlite3** - SQLite 数据库访问
-*   **Vite** - 构建工具
-*   **Vitest** - 单元测试
-*   **Playwright** - 端到端测试
-*   **Electron Forge** - 应用打包和分发
+* **Electron 39** - Cross-platform desktop framework
+* **React 19.2** - UI framework
+* **TypeScript 5.9** - Type-safe development language
+* **Shadcn UI** - Modern UI component library
+* **Tailwind CSS 4** - Styling framework
+* **oRPC** - Type-safe IPC communication
+* **TanStack Router** - File-based routing
+* **React Query** - Server state management
+* **better-sqlite3** - SQLite data access
+* **Vite** - Build tool
+* **Vitest** - Unit testing
+* **Playwright** - End-to-end testing
+* **Electron Forge** - Packaging and distribution
 
 ## Project Conventions
 
 ### Code Style
 
-*   TypeScript strict mode
-*   ESLint + Prettier 自动格式化
-*   函数和变量使用 camelCase
-*   组件使用 PascalCase
-*   接口使用 PascalCase，以 I 开头（可选）
-*   类型使用 PascalCase
-*   2 空格缩进
-*   单引号字符串
-*   尾随逗号
+* TypeScript strict mode
+* ESLint + Prettier auto-formatting
+* Use camelCase for functions and variables
+* Use PascalCase for components
+* Use PascalCase for interfaces, optionally prefixed with `I`
+* Use PascalCase for types
+* 2-space indentation
+* Single-quoted strings
+* Trailing commas
 
 ### Architecture Patterns
 
-```
+```plaintext
 src/
-├── main.ts              # Electron 主进程
-├── preload.ts           # 预加载脚本
-├── renderer.ts          # 渲染进程入口
-├── ipc/                 # IPC 通信层
-│   ├── account/         # 本地 IDE 账号管理 IPC
-│   ├── cloud/           # 云端 AI 资源管理 IPC（新）
-│   ├── database/        # 数据库操作 IPC
-│   └── process/         # 进程管理 IPC
-├── services/            # 业务逻辑服务层（新）
-│   ├── QuotaService.ts  # 配额监控服务
-│   └── TokenService.ts  # Token 保活服务
-├── actions/             # 渲染进程操作（oRPC 客户端）
-├── components/          # React 组件
-├── routes/              # 页面路由
-├── layouts/             # 布局组件
-├── utils/               # 工具函数
-├── types/               # TypeScript 类型定义
-└── tests/               # 测试文件
+├── main.ts              # Electron main process
+├── preload.ts           # Preload script
+├── renderer.ts          # Renderer entry
+├── ipc/                 # IPC communication layer
+│   ├── account/         # Local IDE account IPC
+│   ├── cloud/           # Cloud AI resource IPC (new)
+│   ├── database/        # Database operation IPC
+│   └── process/         # Process management IPC
+├── services/            # Business service layer (new)
+│   ├── QuotaService.ts  # Quota monitoring service
+│   └── TokenService.ts  # Token keepalive service
+├── actions/             # Renderer actions (oRPC client)
+├── components/          # React components
+├── routes/              # Page routes
+├── layouts/             # Layout components
+├── utils/               # Utility functions
+├── types/               # TypeScript type definitions
+└── tests/               # Test files
 ```
 
-**设计模式：**
+**Design patterns:**
 
-*   **关注点分离**：主进程处理系统操作和网络代理，渲染进程处理 UI。
-*   **Service 层**：引入 Service 层处理复杂的配额轮询和 Token 刷新逻辑。
-*   **类型安全 IPC**：使用 oRPC 确保主进程和渲染进程之间的类型安全通信。
-*   **状态管理**：React Query 管理服务器状态和异步配额数据。
+* **Separation of concerns**: Main process handles system operations and network proxy; renderer handles UI.
+* **Service layer**: Encapsulates complex quota polling and token refresh logic.
+* **Type-safe IPC**: Uses oRPC to enforce type-safe communication between main and renderer.
+* **State management**: React Query manages server state and async quota data.
 
 ### Testing Strategy
 
-*   **单元测试（Vitest）**：测试 IPC 处理程序、Service 逻辑、工具函数。
-*   **集成测试（Vitest）**：测试完整的 IPC 流程。
-*   **端到端测试（Playwright）**：测试用户工作流。
-*   **覆盖率目标**：核心逻辑 >80%。
+* **Unit tests (Vitest)**: IPC handlers, service logic, utility functions.
+* **Integration tests (Vitest)**: End-to-end IPC flow.
+* **End-to-end tests (Playwright)**: User workflows.
+* **Coverage target**: Core logic > 80%.
 
 ### Git Workflow
 
-*   **主分支**：`main`
-*   **开发分支**：`develop`
-*   **提交规范**：语义化提交 (feat, fix, docs, refactor, test, chore)
+* **Main branch**: `main`
+* **Development branch**: `develop`
+* **Commit style**: Conventional commits (`feat`, `fix`, `docs`, `refactor`, `test`, `chore`)
 
 ## Domain Context
 
-### 1. Antigravity IDE 数据结构（本地）
+### 1. Antigravity IDE Data Structure (Local)
+
+**Database locations:**
 
-**数据库位置：**
 * macOS: `~/Library/Application Support/Antigravity/User/globalStorage/state.vscdb`
 * Windows: `%APPDATA%/Antigravity/User/globalStorage/state.vscdb`
-* Linux: `~/.config/Antigravity/state.vscdb`
+* Linux: `~/.config/Antigravity/User/globalStorage/state.vscdb`
 
-**关键数据库键：**
-* `antigravityAuthStatus`: 认证状态和用户信息。
+**Key database fields:**
 
-### 2. AI 服务资源结构（云端/新）
+* `antigravityAuthStatus`: Authentication status and user information.
+
+### 2. AI Service Resource Structure (Cloud / New)
+
+**Account model:**
 
-**账号模型：**
 ```json
 {
   "id": "uuid",
@@ -115,49 +118,49 @@ src/
 }
 ```
 
-### 3. 进程管理策略
+### 3. Process Management Strategy
 
-*   **三阶段关闭**：优雅关闭 -> SIGTERM -> SIGKILL。
+* **Three-phase shutdown**: Graceful close -> SIGTERM -> SIGKILL.
 
 ## Important Constraints
 
-### 技术约束
+### Technical Constraints
 
-*   **数据库访问**：访问本地 IDE 数据库时需注意文件锁。
-*   **网络访问**：需要访问外部 API (Google/Anthropic) 以获取配额信息。
-*   **凭证安全**：OAuth Token 和 Refresh Token 必须使用系统级加密存储 (Keytar / SQLite Encrypted)。
-*   **并发控制**：轮询配额时需注意频率，避免触发 API 封控。
+* **Database access**: Handle file locks when accessing local IDE databases.
+* **Network access**: External API access (Google/Anthropic) is required for quota retrieval.
+* **Credential security**: OAuth and refresh tokens must use system-level encrypted storage (Keytar / encrypted SQLite).
+* **Concurrency control**: Quota polling frequency must be controlled to avoid API throttling or blocking.
 
-### 用户体验约束
+### UX Constraints
 
-*   **响应时间**：账号切换应在 5 秒内完成。
-*   **静默运行**：支持最小化到托盘，后台自动刷新 Token。
-*   **数据安全**：切换前必须自动备份当前状态。
+* **Response time**: Account switching should complete within 5 seconds.
+* **Silent mode**: Support tray minimization and background token refresh.
+* **Data safety**: Always back up current state before switching.
 
 ## External Dependencies
 
-### 系统依赖
+### System Dependencies
 
-*   **Antigravity IDE**：本地管理目标。
-*   **SQLite**：本地数据读取。
+* **Antigravity IDE**: Local target to manage.
+* **SQLite**: Local data reads.
 
-### Node.js 依赖（重点）
+### Node.js Dependencies (Key)
 
-*   `better-sqlite3`: 数据库访问。
-*   `electron`: 桌面框架。
-*   `node-fetch` / `axios`: 网络请求。
-*   `tar` / `adm-zip`: 备份压缩。
+* `better-sqlite3`: Database access.
+* `electron`: Desktop framework.
+* `node-fetch` / `axios`: Network requests.
+* `tar` / `adm-zip`: Backup compression.
 
-### 外部服务
+### External Services
 
-*   **Google Gemini API**: 用于配额检查。
-*   **Anthropic API**: 用于配额检查。
-*   **OAuth 2.0 端点**: 用于账号授权。
+* **Google Gemini API**: For quota checks.
+* **Anthropic API**: For quota checks.
+* **OAuth 2.0 endpoints**: For account authorization.
 
-### 文件系统依赖
+### Filesystem Dependencies
 
-*   `~/.antigravity-agent/`
-    *   `accounts.json`: 本地 IDE 账号索引。
-    *   `cloud_accounts.db`: (新) 云端账号池数据库 (SQLite)。
-    *   `backups/`: 备份文件。
-    *   `app.log`: 应用日志。
+* `~/.antigravity-agent/`
+  * `accounts.json`: Local IDE account index.
+  * `cloud_accounts.db`: (new) Cloud account pool database (SQLite).
+  * `backups/`: Backup files.
+  * `app.log`: Application log.

package.json

@@ -1,7 +1,7 @@
 {
   "name": "antigravity-manager",
   "productName": "Antigravity Manager",
-  "version": "0.2.2",
+  "version": "0.8.0",
   "description": "Antigravity Manager - Electron App",
   "main": ".vite/build/main.js",
   "private": true,
@@ -25,8 +25,10 @@
   "devDependencies": {
     "@electron-forge/cli": "^7.10.2",
     "@electron-forge/maker-deb": "^7.10.2",
+    "@electron-forge/maker-dmg": "^7.10.2",
     "@electron-forge/maker-rpm": "^7.10.2",
     "@electron-forge/maker-squirrel": "^7.10.2",
+    "@electron-forge/maker-wix": "^7.10.2",
     "@electron-forge/maker-zip": "^7.10.2",
     "@electron-forge/plugin-auto-unpack-natives": "^7.10.2",
     "@electron-forge/plugin-fuses": "^7.10.2",
@@ -37,7 +39,12 @@
     "@electron/rebuild": "^3.7.1",
     "@eslint/compat": "^1.4.1",
     "@eslint/js": "^9.39.0",
+    "@pengx17/electron-forge-maker-appimage": "^1.2.1",
     "@playwright/test": "^1.56.1",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.2",
+    "@sentry/vite-plugin": "^4.8.0",
     "@swc/core": "^1.15.8",
     "@tanstack/router-plugin": "^1.135.0",
     "@testing-library/jest-dom": "^6.9.1",
@@ -53,8 +60,10 @@
     "@vitejs/plugin-react": "^4.7.0",
     "babel-plugin-react-compiler": "1.0.0",
     "code-inspector-plugin": "^1.3.3",
+    "conventional-changelog-conventionalcommits": "^9.1.0",
     "electron": "^37.3.1",
     "electron-devtools-installer": "^4.0.0",
+    "electron-packager-languages": "^0.6.0",
     "electron-playwright-helpers": "^1.8.2",
     "eslint": "^9.39.1",
     "eslint-config-prettier": "^10.1.8",
@@ -67,6 +76,8 @@
     "node-addon-api": "^8.3.1",
     "prettier": "^3.6.2",
     "prettier-plugin-tailwindcss": "^0.7.1",
+    "semantic-release": "^25.0.2",
+    "semantic-release-config-gitmoji": "^1.5.3",
     "sharp": "^0.34.5",
     "tailwindcss": "^4.1.16",
     "ts-node": "^10.9.2",
@@ -85,7 +96,6 @@
     "@nestjs/microservices": "^11.1.11",
     "@nestjs/platform-express": "^11.1.11",
     "@nestjs/platform-fastify": "^11.1.10",
-    "@nestjs/websockets": "^11.1.11",
     "@orpc/client": "^1.10.4",
     "@orpc/server": "^1.11.3",
     "@radix-ui/react-avatar": "^1.1.11",
@@ -102,6 +112,9 @@
     "@radix-ui/react-toast": "^1.2.15",
     "@radix-ui/react-toggle": "^1.1.9",
     "@radix-ui/react-toggle-group": "^1.1.11",
+    "@radix-ui/react-tooltip": "^1.2.8",
+    "@sentry/electron": "^7.7.0",
+    "@sentry/integrations": "^7.114.0",
     "@tailwindcss/vite": "^4.1.17",
     "@tanstack/react-query": "^5.90.7",
     "@tanstack/react-router": "^1.139.3",
@@ -114,8 +127,10 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "date-fns": "^4.1.0",
+    "drizzle-orm": "^0.39.1",
     "electron-squirrel-startup": "^1.0.1",
     "fastify": "^5.6.2",
+    "find-process": "^2.0.0",
     "happy-dom": "^20.0.10",
     "i18next": "^25.6.3",
     "i18next-browser-languagedetector": "^8.2.0",
@@ -132,6 +147,9 @@
     "undici": "^7.16.0",
     "update-electron-app": "^3.1.1",
     "uuid": "^13.0.0",
+    "winston": "^3.19.0",
+    "winston-daily-rotate-file": "^5.0.0",
+    "yaml": "^2.8.2",
     "zod": "^4.1.12"
   }
 }

release.config.cjs

@@ -0,0 +1,259 @@
+/**
+ * Semantic Release Configuration
+ *
+ * This configuration uses the specific release rules requested by the user,
+ * but adapts the plugin configuration to work with standard Conventional Commits
+ * instead of Gitmoji (since the project history doesn't use emojis).
+ */
+
+const REPO_URL = 'https://github.com/Draculabo/AntigravityManager';
+const GITHUB_BASE_URL = 'https://github.com';
+const FULL_CHANGELOG_URL = `${REPO_URL}/blob/main/CHANGELOG.md`;
+
+const releaseRules = [
+  {
+    release: 'minor',
+    type: 'feat',
+  },
+  {
+    release: 'patch',
+    type: 'fix',
+  },
+  {
+    release: 'patch',
+    type: 'perf',
+  },
+  {
+    release: 'patch',
+    type: 'style',
+  },
+  {
+    release: 'patch',
+    type: 'refactor',
+  },
+  {
+    release: 'patch',
+    type: 'build',
+  },
+  { release: 'patch', scope: 'README', type: 'docs' },
+  { release: 'patch', scope: 'README.md', type: 'docs' },
+  { release: false, type: 'docs' },
+  {
+    release: false,
+    type: 'test',
+  },
+  {
+    release: false,
+    type: 'ci',
+  },
+  {
+    release: false,
+    type: 'chore',
+  },
+  {
+    release: false,
+    type: 'wip',
+  },
+  {
+    release: 'major',
+    type: 'BREAKING CHANGE',
+  },
+  {
+    release: 'major',
+    scope: 'BREAKING CHANGE',
+  },
+  {
+    release: 'major',
+    subject: '*BREAKING CHANGE*',
+  },
+  { release: 'patch', subject: '*force release*' },
+  { release: 'patch', subject: '*force patch*' },
+  { release: 'minor', subject: '*force minor*' },
+  { release: 'major', subject: '*force major*' },
+  { release: false, subject: '*skip release*' },
+];
+
+const getGithubUsernameFromEmail = (email) => {
+  if (!email) {
+    return undefined;
+  }
+
+  const match = email.match(/^(?:\d+\+)?(?<username>[a-z0-9-]+)@users\.noreply\.github\.com$/i);
+
+  return match?.groups?.username;
+};
+
+const isBotIdentity = (value) => {
+  return typeof value === 'string' && /bot/i.test(value);
+};
+
+const buildReleaseFooter = (commits) => {
+  const mergedPullRequests = new Map();
+  const contributors = new Map();
+
+  (commits || []).forEach((commit) => {
+    const message = [commit?.message, commit?.subject, commit?.header].filter(Boolean).join('\n');
+    if (message) {
+      const mergeMatches = message.match(/pull request #(?<number>\d+)/gi);
+      if (mergeMatches) {
+        mergeMatches.forEach((match) => {
+          const number = match.replace(/\D/g, '');
+          if (number) {
+            mergedPullRequests.set(number, {
+              number,
+              url: `${REPO_URL}/pull/${number}`,
+            });
+          }
+        });
+      }
+
+      const squashMatches = message.match(/\(#(?<number>\d+)\)/g);
+      if (squashMatches) {
+        squashMatches.forEach((match) => {
+          const number = match.replace(/\D/g, '');
+          if (number) {
+            mergedPullRequests.set(number, {
+              number,
+              url: `${REPO_URL}/pull/${number}`,
+            });
+          }
+        });
+      }
+    }
+
+    const author = commit?.author || commit?.committer;
+    const username = getGithubUsernameFromEmail(author?.email);
+    const displayName = username ? `@${username}` : author?.name;
+
+    if (!displayName || isBotIdentity(displayName)) {
+      return;
+    }
+
+    if (username && isBotIdentity(username)) {
+      return;
+    }
+
+    contributors.set(username || displayName, {
+      name: displayName,
+      url: username ? `${GITHUB_BASE_URL}/${username}` : undefined,
+    });
+  });
+
+  const footerLines = [];
+  const sortedPullRequests = Array.from(mergedPullRequests.values()).sort(
+    (left, right) => Number(left.number) - Number(right.number),
+  );
+  if (sortedPullRequests.length > 0) {
+    footerLines.push('### 🔀 Merged Pull Requests');
+    sortedPullRequests.forEach((pullRequest) => {
+      footerLines.push(`- [#${pullRequest.number}](${pullRequest.url})`);
+    });
+    footerLines.push('');
+  }
+
+  const sortedContributors = Array.from(contributors.values()).sort((left, right) =>
+    left.name.localeCompare(right.name),
+  );
+  if (sortedContributors.length > 0) {
+    footerLines.push('### 🙌 Contributors');
+    sortedContributors.forEach((contributor) => {
+      if (contributor.url) {
+        footerLines.push(`- [${contributor.name}](${contributor.url})`);
+        return;
+      }
+
+      footerLines.push(`- ${contributor.name}`);
+    });
+    footerLines.push('');
+  }
+
+  footerLines.push(`Full Changelog: ${FULL_CHANGELOG_URL}`);
+
+  return footerLines.join('\n');
+};
+
+const appendReleaseNotes = (notes, commits) => {
+  const trimmedNotes = (notes || '').trimEnd();
+  const footer = buildReleaseFooter(commits);
+
+  if (!footer) {
+    return trimmedNotes;
+  }
+
+  return `${trimmedNotes}\n\n${footer}`;
+};
+
+const appendReleaseNotesPlugin = {
+  publish: async (pluginConfig, context) => {
+    if (!context?.nextRelease?.notes) {
+      return;
+    }
+
+    context.nextRelease.notes = appendReleaseNotes(context.nextRelease.notes, context.commits);
+  },
+};
+
+const releaseConfig = {
+  branches: ['main', { name: 'beta', prerelease: true }],
+  plugins: [
+    [
+      '@semantic-release/commit-analyzer',
+      {
+        preset: 'conventionalcommits',
+        releaseRules: releaseRules,
+      },
+    ],
+    [
+      '@semantic-release/release-notes-generator',
+      {
+        preset: 'conventionalcommits',
+        presetConfig: {
+          types: [
+            { type: 'feat', section: '✨ Features' },
+            { type: 'fix', section: '🐛 Bug Fixes' },
+            { type: 'perf', section: '⚡ Performance Improvements' },
+            { type: 'revert', section: '⏪ Reverts' },
+            { type: 'docs', section: '📝 Documentation' },
+            { type: 'style', section: '💄 Styles' },
+            { type: 'refactor', section: '♻️ Code Refactoring' },
+            { type: 'test', section: '✅ Tests' },
+            { type: 'build', section: '👷 Build System' },
+            { type: 'ci', section: '🔧 Continuous Integration' },
+          ],
+        },
+      },
+    ],
+    [
+      '@semantic-release/changelog',
+      {
+        changelogFile: 'CHANGELOG.md',
+        changelogTitle: '<a name="readme-top"></a>\n\n# Changelog',
+      },
+    ],
+    '@semantic-release/npm', // Updates package.json and npm-shrinkwrap.json
+    appendReleaseNotesPlugin,
+    [
+      '@semantic-release/github',
+      {
+        successComment: false,
+        failComment: false,
+        labels: false,
+        releaseName: 'v${nextRelease.version}',
+      },
+    ],
+    [
+      '@semantic-release/git',
+      {
+        assets: ['CHANGELOG.md', 'package.json', 'package-lock.json', 'npm-shrinkwrap.json'],
+        message: 'chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}',
+      },
+    ],
+  ],
+};
+
+releaseConfig.__internal = {
+  appendReleaseNotes,
+  buildReleaseFooter,
+};
+
+module.exports = releaseConfig;

src/App.tsx

@@ -8,6 +8,7 @@ import { router } from './utils/routes';
 import './localization/i18n';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { ThemeProvider } from '@/components/theme-provider';
+import { Toaster } from '@/components/ui/toaster';
 import { LOCAL_STORAGE_KEYS } from '@/constants';
 
 function App() {
@@ -32,6 +33,7 @@ root.render(
     <QueryClientProvider client={queryClient}>
       <ThemeProvider storageKey={LOCAL_STORAGE_KEYS.THEME} defaultTheme="system">
         <App />
+        <Toaster />
       </ThemeProvider>
     </QueryClientProvider>
   </React.StrictMode>,

src/actions/account.ts

@@ -1,4 +1,5 @@
 import { ipc } from '@/ipc/manager';
+import type { DeviceProfile } from '@/types/account';
 
 export function listAccounts() {
   return ipc.client.account.listAccounts();
@@ -15,3 +16,39 @@ export function switchAccount(accountId: string) {
 export function deleteAccount(accountId: string) {
   return ipc.client.account.deleteAccount({ accountId });
 }
+
+export function previewGenerateIdentityProfile() {
+  return ipc.client.account.previewGenerateIdentityProfile();
+}
+
+export function getIdentityProfiles(accountId: string) {
+  return ipc.client.account.getIdentityProfiles({ accountId });
+}
+
+export function bindIdentityProfile(accountId: string, mode: 'capture' | 'generate') {
+  return ipc.client.account.bindIdentityProfile({ accountId, mode });
+}
+
+export function bindIdentityProfileWithPayload(accountId: string, profile: DeviceProfile) {
+  return ipc.client.account.bindIdentityProfileWithPayload({ accountId, profile });
+}
+
+export function applyBoundIdentityProfile(accountId: string) {
+  return ipc.client.account.applyBoundIdentityProfile({ accountId });
+}
+
+export function restoreIdentityProfileRevision(accountId: string, versionId: string) {
+  return ipc.client.account.restoreIdentityProfileRevision({ accountId, versionId });
+}
+
+export function deleteIdentityProfileRevision(accountId: string, versionId: string) {
+  return ipc.client.account.deleteIdentityProfileRevision({ accountId, versionId });
+}
+
+export function restoreBaselineProfile(accountId: string) {
+  return ipc.client.account.restoreBaselineProfile({ accountId });
+}
+
+export function openIdentityStorageFolder() {
+  return ipc.client.account.openIdentityStorageFolder();
+}

src/actions/cloud.ts

@@ -1,4 +1,5 @@
 import { ipc } from '@/ipc/manager';
+import type { DeviceProfile } from '@/types/account';
 
 export function addGoogleAccount(input: { authCode: string }) {
   return ipc.client.cloud.addGoogleAccount(input);
@@ -39,3 +40,42 @@ export function syncLocalAccount() {
 export function startAuthFlow() {
   return ipc.client.cloud.startAuthFlow();
 }
+
+export function getSwitchStatus() {
+  return ipc.client.cloud.getSwitchStatus();
+}
+
+export function getCloudIdentityProfiles(input: { accountId: string }) {
+  return ipc.client.cloud.getIdentityProfiles(input);
+}
+
+export function previewGenerateCloudIdentityProfile() {
+  return ipc.client.cloud.previewIdentityProfile();
+}
+
+export function bindCloudIdentityProfile(input: { accountId: string; mode: 'capture' | 'generate' }) {
+  return ipc.client.cloud.bindIdentityProfile(input);
+}
+
+export function bindCloudIdentityProfileWithPayload(input: {
+  accountId: string;
+  profile: DeviceProfile;
+}) {
+  return ipc.client.cloud.bindIdentityProfileWithPayload(input);
+}
+
+export function restoreCloudIdentityProfileRevision(input: { accountId: string; versionId: string }) {
+  return ipc.client.cloud.restoreIdentityProfileRevision(input);
+}
+
+export function restoreCloudBaselineProfile(input: { accountId: string }) {
+  return ipc.client.cloud.restoreBaselineProfile(input);
+}
+
+export function deleteCloudIdentityProfileRevision(input: { accountId: string; versionId: string }) {
+  return ipc.client.cloud.deleteIdentityProfileRevision(input);
+}
+
+export function openCloudIdentityStorageFolder() {
+  return ipc.client.cloud.openIdentityStorageFolder();
+}

src/actions/system.ts

@@ -0,0 +1,5 @@
+import { ipc } from '@/ipc/manager';
+
+export function openLogDirectory() {
+  return ipc.client.system.openLogDirectory();
+}

src/components/AccountCard.tsx

@@ -12,6 +12,7 @@ import {
 } from '@/components/ui/dropdown-menu';
 import { MoreVertical, Trash2, RefreshCw } from 'lucide-react';
 import { formatDistanceToNow } from 'date-fns';
+import { enUS, zhCN, ru } from 'date-fns/locale';
 import { cn } from '@/lib/utils';
 import { useTranslation } from 'react-i18next';
 
@@ -32,7 +33,7 @@ export const AccountCard: React.FC<AccountCardProps> = ({
   isSwitching,
   isDeleting,
 }) => {
-  const { t } = useTranslation();
+  const { t, i18n } = useTranslation();
   const cardRef = useRef<HTMLDivElement>(null);
   const [transform, setTransform] = useState('');
   const [glarePosition, setGlarePosition] = useState({ x: 50, y: 50 });
@@ -136,6 +137,7 @@ export const AccountCard: React.FC<AccountCardProps> = ({
                 {t('account.lastUsed', {
                   time: formatDistanceToNow(new Date(account.last_used), {
                     addSuffix: true,
+                    locale: { en: enUS, 'zh-CN': zhCN, ru: ru }[i18n.language] || enUS,
                   }),
                 })}
               </p>

src/components/CloudAccountCard.tsx

@@ -18,8 +18,8 @@ import {
 } from '@/components/ui/dropdown-menu';
 import { Checkbox } from '@/components/ui/checkbox';
 
-import { MoreVertical, Trash, RefreshCw, Box, Power } from 'lucide-react';
-import { formatDistanceToNow } from 'date-fns';
+import { MoreVertical, Trash, RefreshCw, Box, Power, Fingerprint } from 'lucide-react';
+import { formatDistanceToNow, differenceInMinutes, differenceInHours, isBefore } from 'date-fns';
 import { Badge } from '@/components/ui/badge';
 import { useTranslation } from 'react-i18next';
 
@@ -28,6 +28,7 @@ interface CloudAccountCardProps {
   onRefresh: (id: string) => void;
   onDelete: (id: string) => void;
   onSwitch: (id: string) => void;
+  onManageIdentity: (id: string) => void;
   isSelected?: boolean;
   onToggleSelection?: (id: string, selected: boolean) => void;
   isRefreshing?: boolean;
@@ -40,6 +41,7 @@ export function CloudAccountCard({
   onRefresh,
   onDelete,
   onSwitch,
+  onManageIdentity,
   isSelected = false,
   onToggleSelection,
   isRefreshing,
@@ -50,22 +52,85 @@ export function CloudAccountCard({
 
   // Helpers to get quota color
   const getQuotaColor = (percentage: number) => {
-    if (percentage > 80) return 'text-green-500';
-    if (percentage > 20) return 'text-yellow-500';
+    if (percentage > 80) {
+      return 'text-green-500';
+    }
+    if (percentage > 20) {
+      return 'text-yellow-500';
+    }
     return 'text-red-500';
   };
 
+  const getQuotaBarColor = (percentage: number) => {
+    if (percentage > 80) {
+      return 'bg-emerald-500';
+    }
+    if (percentage > 20) {
+      return 'bg-amber-500';
+    }
+    return 'bg-rose-500';
+  };
+
+  const formatTimeRemaining = (dateStr: string) => {
+    const targetDate = new Date(dateStr);
+    if (Number.isNaN(targetDate.getTime())) {
+      return null;
+    }
+
+    const now = new Date();
+    if (isBefore(targetDate, now)) {
+      return '0h 0m';
+    }
+
+    // Calculate difference in hours and minutes
+    const diffHrs = differenceInHours(targetDate, now);
+    const diffMins = differenceInMinutes(targetDate, now) - diffHrs * 60;
+    if (diffHrs >= 24) {
+      const diffDays = Math.floor(diffHrs / 24);
+      const remainingHrs = diffHrs % 24;
+      return `${diffDays}d ${remainingHrs}h`;
+    }
+
+    return `${diffHrs}h ${diffMins}m`;
+  };
+
+  const getResetTimeLabel = (resetTime?: string) => {
+    if (!resetTime) {
+      return t('cloud.card.resetUnknown');
+    }
+
+    const remaining = formatTimeRemaining(resetTime);
+    if (!remaining) {
+      return t('cloud.card.resetUnknown');
+    }
+
+    return `${t('cloud.card.resetPrefix')}: ${remaining}`;
+  };
+
+  const getResetTimeTitle = (resetTime?: string) => {
+    if (!resetTime) {
+      return undefined;
+    }
+
+    const resetDate = new Date(resetTime);
+    if (Number.isNaN(resetDate.getTime())) {
+      return undefined;
+    }
+
+    return `${t('cloud.card.resetTime')}: ${resetDate.toLocaleString()}`;
+  };
+
   const modelQuotas = Object.entries(account.quota?.models || {});
 
   return (
     <Card
-      className={`flex flex-col overflow-hidden transition-all ${isSelected ? 'ring-primary border-primary/50 ring-2' : 'hover:border-primary/50'}`}
+      className={`group flex h-full flex-col overflow-hidden border bg-card transition-all duration-200 hover:border-primary/40 hover:shadow-sm ${isSelected ? 'ring-primary border-primary/50 ring-2' : ''}`}
     >
-      <CardHeader className="group relative flex flex-row items-center gap-4 space-y-0 pb-2">
+      <CardHeader className="relative flex flex-row items-center gap-4 space-y-0 pb-2">
         {/* Selection Checkbox - Visible on hover or selected */}
         {onToggleSelection && (
           <div
-            className={`absolute top-2 left-2 z-10 ${isSelected ? 'opacity-100' : 'opacity-0 group-hover:opacity-100'} from-background rounded-full bg-gradient-to-br to-transparent p-2 transition-opacity`}
+            className={`absolute top-2 left-2 z-10 ${isSelected ? 'opacity-100' : 'opacity-0 group-hover:opacity-100'} rounded-full bg-background/90 p-2 transition-opacity`}
           >
             <Checkbox
               checked={isSelected}
@@ -82,7 +147,7 @@ export function CloudAccountCard({
             className="bg-muted h-10 w-10 rounded-full border"
           />
         ) : (
-          <div className="bg-primary/10 text-primary flex h-10 w-10 items-center justify-center rounded-full">
+          <div className="bg-primary/10 text-primary flex h-10 w-10 items-center justify-center rounded-full border">
             {account.name?.[0]?.toUpperCase() || 'A'}
           </div>
         )}
@@ -94,7 +159,7 @@ export function CloudAccountCard({
         </div>
         <DropdownMenu>
           <DropdownMenuTrigger asChild>
-            <Button variant="ghost" size="icon" className="h-8 w-8">
+            <Button variant="ghost" size="icon" className="h-8 w-8 cursor-pointer rounded-full">
               <MoreVertical className="h-4 w-4" />
               <span className="sr-only">Menu</span>
             </Button>
@@ -111,6 +176,11 @@ export function CloudAccountCard({
               {t('cloud.card.refresh')}
             </DropdownMenuItem>
             <DropdownMenuSeparator />
+            <DropdownMenuItem onClick={() => onManageIdentity(account.id)}>
+              <Fingerprint className="mr-2 h-4 w-4" />
+              {t('cloud.card.identityProfile')}
+            </DropdownMenuItem>
+            <DropdownMenuSeparator />
             <DropdownMenuItem
               onClick={() => onDelete(account.id)}
               className="text-destructive focus:text-destructive"
@@ -155,6 +225,7 @@ export function CloudAccountCard({
               size="sm"
               onClick={() => onSwitch(account.id)}
               disabled={isSwitching}
+              className="cursor-pointer"
             >
               {isSwitching ? (
                 <RefreshCw className="h-3 w-3 animate-spin" />
@@ -169,15 +240,36 @@ export function CloudAccountCard({
         <div className="space-y-2">
           {modelQuotas.length > 0 ? (
             modelQuotas.map(([modelName, info]) => (
-              <div key={modelName} className="flex items-center justify-between text-sm">
-                <span className="text-muted-foreground max-w-[120px] truncate" title={modelName}>
+              <div
+                key={modelName}
+                className="hover:bg-muted/60 grid grid-cols-[minmax(0,1fr)_auto] items-start gap-3 rounded-lg border border-transparent px-2 py-2 text-sm transition-colors hover:border-border/60"
+              >
+                <span className="text-muted-foreground min-w-0 truncate" title={modelName}>
                   {modelName.replace('models/', '')}
                 </span>
-                <div className="flex items-center gap-2">
-                  <span className={`font-mono font-bold ${getQuotaColor(info.percentage)}`}>
-                    {info.percentage}%
+                <div className="flex flex-col items-end gap-1">
+                  <span
+                    className="text-muted-foreground text-[10px] leading-none"
+                    title={getResetTimeTitle(info.resetTime)}
+                  >
+                    {getResetTimeLabel(info.resetTime)}
                   </span>
-                  <span className="text-muted-foreground text-xs">{t('cloud.card.left')}</span>
+                <div className="flex items-baseline gap-1.5">
+                    <span
+                      className={`font-mono leading-none font-bold ${getQuotaColor(info.percentage)}`}
+                    >
+                      {info.percentage}%
+                    </span>
+                    <span className="text-muted-foreground text-[10px]">
+                      {t('cloud.card.left')}
+                    </span>
+                  </div>
+                  <div className="bg-muted h-1.5 w-24 overflow-hidden rounded-full">
+                    <div
+                      className={`h-full rounded-full transition-all duration-300 ${getQuotaBarColor(info.percentage)}`}
+                      style={{ width: `${Math.max(0, Math.min(100, info.percentage))}%` }}
+                    />
+                  </div>
                 </div>
               </div>
             ))
@@ -190,7 +282,7 @@ export function CloudAccountCard({
         </div>
       </CardContent>
 
-      <CardFooter className="bg-muted/50 text-muted-foreground justify-between p-2 px-4 text-xs">
+      <CardFooter className="bg-muted/20 text-muted-foreground justify-between border-t p-2 px-4 text-xs">
         <span>
           {t('cloud.card.used')}{' '}
           {formatDistanceToNow(account.last_used * 1000, { addSuffix: true })}

src/components/CloudAccountList.tsx

@@ -11,6 +11,7 @@ import {
   startAuthFlow,
 } from '@/hooks/useCloudAccounts';
 import { CloudAccountCard } from '@/components/CloudAccountCard';
+import { IdentityProfileDialog } from '@/components/IdentityProfileDialog';
 import { CloudAccount } from '@/types/cloudAccount';
 import { Button } from '@/components/ui/button';
 import { Switch } from '@/components/ui/switch';
@@ -41,12 +42,13 @@ import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
 import { useState, useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
+import { getLocalizedErrorMessage } from '@/utils/errorMessages';
 
 // ... (existing code: imports and comments)
 
 export function CloudAccountList() {
   const { t } = useTranslation();
-  const { data: accounts, isLoading, isError } = useCloudAccounts();
+  const { data: accounts, isLoading, isError, error } = useCloudAccounts();
   const refreshMutation = useRefreshQuota();
   const deleteMutation = useDeleteCloudAccount();
   const addMutation = useAddGoogleAccount();
@@ -61,20 +63,55 @@ export function CloudAccountList() {
 
   const [isAddDialogOpen, setIsAddDialogOpen] = useState(false);
   const [authCode, setAuthCode] = useState('');
+  const [identityAccount, setIdentityAccount] = useState<CloudAccount | null>(null);
+  const totalAccounts = accounts?.length || 0;
+  const activeAccounts = accounts?.filter((account) => account.is_active).length || 0;
+  const rateLimitedAccounts =
+    accounts?.filter((account) => account.status === 'rate_limited').length || 0;
 
+  const handleAddAccount = (codeVal?: string) => {
+    const codeToUse = codeVal || authCode;
+    if (!codeToUse) {
+      return;
+    }
+    addMutation.mutate(
+      { authCode: codeToUse },
+      {
+        onSuccess: () => {
+          setIsAddDialogOpen(false);
+          setAuthCode('');
+          toast({ title: t('cloud.toast.addSuccess') });
+        },
+        onError: (err) => {
+          toast({
+            title: t('cloud.toast.addFailed.title'),
+            description: getLocalizedErrorMessage(err, t),
+            variant: 'destructive',
+          });
+        },
+      },
+    );
+  };
   // Listen for Google Auth Code
   useEffect(() => {
     if (window.electron?.onGoogleAuthCode) {
+      console.log('[OAuth] Setting up auth code listener, dialog open:', isAddDialogOpen);
       const cleanup = window.electron.onGoogleAuthCode((code) => {
+        console.log('[OAuth] Received auth code via IPC:', code?.substring(0, 10) + '...');
         setAuthCode(code);
-        // Auto submit if dialog is open
-        if (isAddDialogOpen) {
-          handleAddAccount(code);
-        }
+        // Note: Auto-submit will be triggered by the authCode change effect below
       });
       return cleanup;
     }
-  }, [isAddDialogOpen]);
+  }, []);
+
+  // Auto-submit when authCode is set and dialog is open
+  useEffect(() => {
+    if (authCode && isAddDialogOpen && !addMutation.isPending) {
+      console.log('[OAuth] Auto-submitting auth code');
+      handleAddAccount(authCode);
+    }
+  }, [authCode, isAddDialogOpen]);
 
   // Batch Operations State
   const [selectedIds, setSelectedIds] = useState<Set<string>>(new Set());
@@ -103,7 +140,7 @@ export function CloudAccountList() {
         onError: (err) =>
           toast({
             title: t('cloud.toast.switchFailed'),
-            description: err.message,
+            description: getLocalizedErrorMessage(err, t),
             variant: 'destructive',
           }),
       },
@@ -130,6 +167,11 @@ export function CloudAccountList() {
     }
   };
 
+  const handleManageIdentity = (id: string) => {
+    const target = (accounts || []).find((item) => item.id === id) || null;
+    setIdentityAccount(target);
+  };
+
   const handleToggleAutoSwitch = (checked: boolean) => {
     setAutoSwitchMutation.mutate(
       { enabled: checked },
@@ -145,8 +187,15 @@ export function CloudAccountList() {
   };
 
   const handleForcePoll = () => {
+    if (forcePollMutation.isPending) return;
     forcePollMutation.mutate(undefined, {
       onSuccess: () => toast({ title: t('cloud.polling') }),
+      onError: (err) =>
+        toast({
+          title: t('cloud.toast.pollFailed'),
+          description: getLocalizedErrorMessage(err, t),
+          variant: 'destructive',
+        }),
     });
   };
 
@@ -169,35 +218,13 @@ export function CloudAccountList() {
       onError: (err) => {
         toast({
           title: t('cloud.toast.syncFailed.title'),
-          description: err.message,
+          description: getLocalizedErrorMessage(err, t),
           variant: 'destructive',
         });
       },
     });
   };
 
-  const handleAddAccount = (codeVal?: string) => {
-    const codeToUse = codeVal || authCode;
-    if (!codeToUse) return;
-    addMutation.mutate(
-      { authCode: codeToUse },
-      {
-        onSuccess: () => {
-          setIsAddDialogOpen(false);
-          setAuthCode('');
-          toast({ title: t('cloud.toast.addSuccess') });
-        },
-        onError: (err) => {
-          toast({
-            title: t('cloud.toast.addFailed.title'),
-            description: err.message,
-            variant: 'destructive',
-          });
-        },
-      },
-    );
-  };
-
   const openAuthUrl = async () => {
     try {
       await startAuthFlow();
@@ -264,115 +291,139 @@ export function CloudAccountList() {
   }
 
   if (isError) {
-    return <div className="p-4 text-red-500">Failed to load cloud accounts.</div>;
+    const errorMessage = getLocalizedErrorMessage(error, t);
+    return (
+      <div className="p-4 text-red-500">
+        <div>{t('cloud.error.loadFailed')}</div>
+        <div className="mt-1 text-sm text-red-400">{errorMessage}</div>
+      </div>
+    );
   }
 
   return (
-    <div className="relative space-y-6 pb-20">
-      <div className="flex flex-wrap items-center justify-between gap-4">
-        <div className="flex shrink-0 flex-col gap-1">
-          <h2 className="text-2xl font-bold tracking-tight">{t('cloud.title')}</h2>
-          <p className="text-muted-foreground">{t('cloud.description')}</p>
-        </div>
-
-        <div className="flex flex-wrap items-center gap-2">
-          <div className="bg-muted/20 flex items-center gap-2 rounded-md border p-2">
-            <div className="flex items-center gap-2">
-              <Zap
-                className={`h-4 w-4 ${autoSwitchEnabled ? 'fill-yellow-500 text-yellow-500' : 'text-muted-foreground'}`}
-              />
-              <Label htmlFor="auto-switch" className="cursor-pointer text-sm font-medium">
-                {t('cloud.autoSwitch')}
-              </Label>
+    <div className="space-y-5 pb-20">
+      <div className="rounded-lg border bg-card p-5">
+        <div className="flex flex-wrap items-start justify-between gap-4">
+          <div className="flex shrink-0 flex-col gap-1">
+            <h2 className="text-2xl font-bold tracking-tight">{t('cloud.title')}</h2>
+            <p className="text-muted-foreground max-w-2xl">{t('cloud.description')}</p>
+          </div>
+          <div className="flex flex-wrap gap-2">
+            <div className="bg-muted/50 rounded-md border px-3 py-2">
+              <div className="text-muted-foreground text-[11px] uppercase">{t('cloud.card.actions')}</div>
+              <div className="text-base font-semibold">{totalAccounts}</div>
             </div>
-            <Switch
-              id="auto-switch"
-              checked={!!autoSwitchEnabled}
-              onCheckedChange={handleToggleAutoSwitch}
-              disabled={isSettingsLoading || setAutoSwitchMutation.isPending}
-            />
+            <div className="bg-muted/50 rounded-md border px-3 py-2">
+              <div className="text-muted-foreground text-[11px] uppercase">{t('cloud.card.active')}</div>
+              <div className="text-base font-semibold text-emerald-600">{activeAccounts}</div>
+            </div>
+            <div className="bg-muted/50 rounded-md border px-3 py-2">
+              <div className="text-muted-foreground text-[11px] uppercase">{t('cloud.card.rateLimited')}</div>
+              <div className="text-base font-semibold text-rose-600">{rateLimitedAccounts}</div>
+            </div>
           </div>
-
-          <Button variant="ghost" onClick={toggleSelectAll} title={t('cloud.batch.selectAll')}>
-            <CheckSquare
-              className={`mr-2 h-4 w-4 ${selectedIds.size > 0 && selectedIds.size === accounts?.length ? 'text-primary fill-primary/20' : ''}`}
-            />
-            {t('cloud.batch.selectAll')}
-          </Button>
-
-          <Button
-            variant="outline"
-            size="icon"
-            onClick={handleForcePoll}
-            title={t('cloud.checkQuota')}
-            disabled={forcePollMutation.isPending}
-          >
-            <RefreshCcw
-              className={`h-4 w-4 ${forcePollMutation.isPending ? 'animate-spin' : ''}`}
-            />
-          </Button>
-
-          <Button
-            variant="outline"
-            onClick={handleSyncLocal}
-            disabled={syncMutation.isPending}
-            title={t('cloud.syncFromIDE')}
-          >
-            <Download
-              className={`mr-2 h-4 w-4 ${syncMutation.isPending ? 'animate-bounce' : ''}`}
-            />
-            {t('cloud.syncFromIDE')}
-          </Button>
-
-          <Dialog open={isAddDialogOpen} onOpenChange={setIsAddDialogOpen}>
-            <DialogTrigger asChild>
-              <Button>
-                <Plus className="mr-2 h-4 w-4" />
-                {t('cloud.addAccount')}
-              </Button>
-            </DialogTrigger>
-            <DialogContent className="sm:max-w-[425px]">
-              <DialogHeader>
-                <DialogTitle>{t('cloud.authDialog.title')}</DialogTitle>
-                <DialogDescription>{t('cloud.authDialog.description')}</DialogDescription>
-              </DialogHeader>
-              <div className="grid gap-4 py-4">
-                <div className="grid grid-cols-4 items-center gap-4">
-                  <Button variant="outline" className="col-span-4" onClick={openAuthUrl}>
-                    <Cloud className="mr-2 h-4 w-4" />
-                    {t('cloud.authDialog.openLogin')}
-                  </Button>
-                </div>
-                <div className="space-y-2">
-                  <Label htmlFor="code">{t('cloud.authDialog.authCode')}</Label>
-                  <Input
-                    id="code"
-                    placeholder={t('cloud.authDialog.placeholder')}
-                    value={authCode}
-                    onChange={(e: React.ChangeEvent<HTMLInputElement>) =>
-                      setAuthCode(e.target.value)
-                    }
-                  />
-                  <p className="text-muted-foreground text-xs">
-                    {t('cloud.authDialog.instruction')}
-                  </p>
-                </div>
-              </div>
-              <DialogFooter>
-                <Button
-                  onClick={() => handleAddAccount()}
-                  disabled={addMutation.isPending || !authCode}
-                >
-                  {addMutation.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
-                  {t('cloud.authDialog.verify')}
-                </Button>
-              </DialogFooter>
-            </DialogContent>
-          </Dialog>
         </div>
       </div>
 
-      <div className="grid gap-4 md:grid-cols-2 lg:grid-cols-3">
+      <div className="flex flex-wrap items-center gap-2 rounded-lg border bg-card p-3">
+        <div className="bg-muted/50 flex items-center gap-2 rounded-md border px-3 py-2">
+          <div className="flex items-center gap-2">
+            <Zap
+              className={`h-4 w-4 ${autoSwitchEnabled ? 'fill-yellow-500 text-yellow-500' : 'text-muted-foreground'}`}
+            />
+            <Label htmlFor="auto-switch" className="cursor-pointer text-sm font-medium">
+              {t('cloud.autoSwitch')}
+            </Label>
+          </div>
+          <Switch
+            id="auto-switch"
+            checked={!!autoSwitchEnabled}
+            onCheckedChange={handleToggleAutoSwitch}
+            disabled={isSettingsLoading || setAutoSwitchMutation.isPending}
+          />
+        </div>
+
+        <Button variant="ghost" onClick={toggleSelectAll} title={t('cloud.batch.selectAll')} className="cursor-pointer">
+          <CheckSquare
+            className={`mr-2 h-4 w-4 ${selectedIds.size > 0 && selectedIds.size === accounts?.length ? 'text-primary fill-primary/20' : ''}`}
+          />
+          {t('cloud.batch.selectAll')}
+        </Button>
+
+        <Button
+          variant="outline"
+          size="icon"
+          onClick={handleForcePoll}
+          title={t('cloud.checkQuota')}
+          disabled={forcePollMutation.isPending}
+          className="cursor-pointer"
+        >
+          <RefreshCcw
+            className={`h-4 w-4 ${forcePollMutation.isPending ? 'animate-spin' : ''}`}
+          />
+        </Button>
+
+        <Button
+          variant="outline"
+          onClick={handleSyncLocal}
+          disabled={syncMutation.isPending}
+          title={t('cloud.syncFromIDE')}
+          className="cursor-pointer"
+        >
+          <Download
+            className={`mr-2 h-4 w-4 ${syncMutation.isPending ? 'animate-bounce' : ''}`}
+          />
+          {t('cloud.syncFromIDE')}
+        </Button>
+
+        <Dialog open={isAddDialogOpen} onOpenChange={setIsAddDialogOpen}>
+          <DialogTrigger asChild>
+            <Button className="cursor-pointer">
+              <Plus className="mr-2 h-4 w-4" />
+              {t('cloud.addAccount')}
+            </Button>
+          </DialogTrigger>
+          <DialogContent className="sm:max-w-[425px]">
+            <DialogHeader>
+              <DialogTitle>{t('cloud.authDialog.title')}</DialogTitle>
+              <DialogDescription>{t('cloud.authDialog.description')}</DialogDescription>
+            </DialogHeader>
+            <div className="grid gap-4 py-4">
+              <div className="grid grid-cols-4 items-center gap-4">
+                <Button variant="outline" className="col-span-4" onClick={openAuthUrl}>
+                  <Cloud className="mr-2 h-4 w-4" />
+                  {t('cloud.authDialog.openLogin')}
+                </Button>
+              </div>
+              <div className="space-y-2">
+                <Label htmlFor="code">{t('cloud.authDialog.authCode')}</Label>
+                <Input
+                  id="code"
+                  placeholder={t('cloud.authDialog.placeholder')}
+                  value={authCode}
+                  onChange={(e: React.ChangeEvent<HTMLInputElement>) =>
+                    setAuthCode(e.target.value)
+                  }
+                />
+                <p className="text-muted-foreground text-xs">
+                  {t('cloud.authDialog.instruction')}
+                </p>
+              </div>
+            </div>
+            <DialogFooter>
+              <Button
+                onClick={() => handleAddAccount()}
+                disabled={addMutation.isPending || !authCode}
+              >
+                {addMutation.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
+                {t('cloud.authDialog.verify')}
+              </Button>
+            </DialogFooter>
+          </DialogContent>
+        </Dialog>
+      </div>
+
+      <div className="grid gap-4 md:grid-cols-2 xl:grid-cols-3">
         {accounts?.map((account) => (
           <CloudAccountCard
             key={account.id}
@@ -380,6 +431,7 @@ export function CloudAccountList() {
             onRefresh={handleRefresh}
             onDelete={handleDelete}
             onSwitch={handleSwitch}
+            onManageIdentity={handleManageIdentity}
             isSelected={selectedIds.has(account.id)}
             onToggleSelection={toggleSelection}
             isRefreshing={
@@ -395,15 +447,16 @@ export function CloudAccountList() {
         ))}
 
         {accounts?.length === 0 && (
-          <div className="text-muted-foreground bg-muted/10 col-span-full rounded-lg border-2 border-dashed py-12 text-center">
-            {t('cloud.list.noAccounts')}
+          <div className="text-muted-foreground bg-muted/20 col-span-full rounded-lg border border-dashed py-14 text-center">
+            <Cloud className="mx-auto mb-3 h-10 w-10 opacity-40" />
+            <div className="text-sm">{t('cloud.list.noAccounts')}</div>
           </div>
         )}
       </div>
 
       {/* Batch Action Bar */}
       {selectedIds.size > 0 && (
-        <div className="bg-background animate-in fade-in slide-in-from-bottom-4 fixed bottom-6 left-1/2 z-50 flex -translate-x-1/2 items-center gap-4 rounded-full border px-6 py-2 shadow-xl">
+        <div className="bg-card animate-in fade-in slide-in-from-bottom-4 fixed bottom-6 left-1/2 z-50 flex -translate-x-1/2 items-center gap-4 rounded-full border px-6 py-2 shadow-lg">
           <div className="flex items-center gap-2 border-r pr-4">
             <span className="text-sm font-semibold">
               {t('cloud.batch.selected', { count: selectedIds.size })}
@@ -430,6 +483,16 @@ export function CloudAccountList() {
           </div>
         </div>
       )}
+
+      <IdentityProfileDialog
+        account={identityAccount}
+        open={Boolean(identityAccount)}
+        onOpenChange={(nextOpen) => {
+          if (!nextOpen) {
+            setIdentityAccount(null);
+          }
+        }}
+      />
     </div>
   );
 }

src/components/IdentityProfileDialog.tsx

@@ -0,0 +1,428 @@
+import { type JSX, useEffect, useMemo, useRef, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import {
+  Fingerprint,
+  FolderOpen,
+  RotateCcw,
+  Wand2,
+  Trash2,
+  History,
+  ShieldCheck,
+  Cpu,
+} from 'lucide-react';
+import type { CloudAccount } from '@/types/cloudAccount';
+import type { DeviceProfile, DeviceProfilesSnapshot, DeviceProfileVersion } from '@/types/account';
+import {
+  bindCloudIdentityProfile,
+  bindCloudIdentityProfileWithPayload,
+  deleteCloudIdentityProfileRevision,
+  getCloudIdentityProfiles,
+  openCloudIdentityStorageFolder,
+  previewGenerateCloudIdentityProfile,
+  restoreCloudIdentityProfileRevision,
+  restoreCloudBaselineProfile,
+} from '@/actions/cloud';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@/components/ui/dialog';
+import { Button } from '@/components/ui/button';
+import { Badge } from '@/components/ui/badge';
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card';
+import { useToast } from '@/components/ui/use-toast';
+
+interface IdentityProfileDialogProps {
+  account: CloudAccount | null;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}
+
+function formatError(error: unknown): string {
+  if (error instanceof Error && error.message) {
+    return error.message;
+  }
+  return String(error);
+}
+
+function renderProfile(profile?: DeviceProfile): JSX.Element {
+  if (!profile) {
+    return (
+      <div className="text-muted-foreground rounded-lg border border-dashed px-3 py-4 text-xs">
+        N/A
+      </div>
+    );
+  }
+
+  const rows: Array<{ label: string; value: string }> = [
+    { label: 'machineId', value: profile.machineId },
+    { label: 'macMachineId', value: profile.macMachineId },
+    { label: 'devDeviceId', value: profile.devDeviceId },
+    { label: 'sqmId', value: profile.sqmId },
+  ];
+
+  return (
+    <div className="space-y-2">
+      {rows.map((row) => (
+        <div key={row.label} className="flex items-start justify-between gap-3">
+          <span className="text-muted-foreground text-[11px] tracking-wide uppercase">
+            {row.label}
+          </span>
+          <span className="max-w-[70%] text-right font-mono text-xs break-all">{row.value}</span>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+function sortHistory(history: DeviceProfileVersion[]): DeviceProfileVersion[] {
+  return [...history].sort((a, b) => b.createdAt - a.createdAt);
+}
+
+export function IdentityProfileDialog({ account, open, onOpenChange }: IdentityProfileDialogProps) {
+  const { t } = useTranslation();
+  const { toast } = useToast();
+  const [snapshot, setSnapshot] = useState<DeviceProfilesSnapshot | null>(null);
+  const [initialLoading, setInitialLoading] = useState(false);
+  const [refreshing, setRefreshing] = useState(false);
+  const [actionKey, setActionKey] = useState<string | null>(null);
+  const [previewProfile, setPreviewProfile] = useState<DeviceProfile | null>(null);
+  const actionLockRef = useRef(false);
+
+  const history = useMemo(() => sortHistory(snapshot?.history || []), [snapshot?.history]);
+  const showLoadingPlaceholder = initialLoading && !snapshot;
+
+  const refreshProfiles = async (options?: { silent?: boolean }) => {
+    if (!account) {
+      setSnapshot(null);
+      return;
+    }
+    const silent = options?.silent === true;
+    if (silent) {
+      setRefreshing(true);
+    } else {
+      setInitialLoading(true);
+    }
+    try {
+      const result = await getCloudIdentityProfiles({ accountId: account.id });
+      setSnapshot(result);
+    } catch (error) {
+      toast({
+        title: t('cloud.toast.actionFailed', { defaultValue: 'Action failed' }),
+        description: formatError(error),
+        variant: 'destructive',
+      });
+    } finally {
+      if (silent) {
+        setRefreshing(false);
+      } else {
+        setInitialLoading(false);
+      }
+    }
+  };
+
+  useEffect(() => {
+    if (!open) {
+      return;
+    }
+    refreshProfiles();
+  }, [open, account?.id]);
+
+  const runAction = async (key: string, action: () => Promise<void>) => {
+    if (actionLockRef.current) {
+      return;
+    }
+    actionLockRef.current = true;
+    setActionKey(key);
+    try {
+      await action();
+      await refreshProfiles({ silent: true });
+    } catch (error) {
+      toast({
+        title: t('cloud.toast.actionFailed', { defaultValue: 'Action failed' }),
+        description: formatError(error),
+        variant: 'destructive',
+      });
+    } finally {
+      actionLockRef.current = false;
+      setActionKey(null);
+    }
+  };
+
+  if (!account) {
+    return null;
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="flex max-h-[90vh] max-w-6xl flex-col overflow-hidden p-0">
+        <DialogHeader className="from-primary/10 via-background to-background border-b bg-gradient-to-r p-6">
+          <div className="flex items-start justify-between gap-4">
+            <div className="flex min-w-0 items-center gap-3">
+              <div className="bg-primary/15 text-primary rounded-xl border p-2.5">
+                <Fingerprint className="h-5 w-5" />
+              </div>
+              <div className="min-w-0">
+                <DialogTitle className="truncate">{t('cloud.identity.title')}</DialogTitle>
+                <DialogDescription className="truncate">{account.email}</DialogDescription>
+              </div>
+            </div>
+            <Badge variant="secondary" className="shrink-0">
+              <History className="mr-1.5 h-3.5 w-3.5" />
+              {history.length}
+            </Badge>
+          </div>
+        </DialogHeader>
+
+        <div className="flex-1 space-y-6 overflow-y-auto p-6" aria-busy={refreshing}>
+          <div className="grid gap-3 sm:grid-cols-2 xl:grid-cols-4">
+            <Button
+              variant="outline"
+              disabled={actionKey === 'preview-generate'}
+              className="h-auto cursor-pointer justify-start rounded-xl px-4 py-3"
+              onClick={() => {
+                runAction('preview-generate', async () => {
+                  const profile = await previewGenerateCloudIdentityProfile();
+                  setPreviewProfile(profile);
+                });
+              }}
+            >
+              <Wand2 className="mr-2 h-4 w-4" />
+              {t('cloud.identity.generateAndBind')}
+            </Button>
+
+            <Button
+              variant="outline"
+              disabled={actionKey === 'capture-bind'}
+              className="h-auto cursor-pointer justify-start rounded-xl px-4 py-3"
+              onClick={() => {
+                runAction('capture-bind', async () => {
+                  await bindCloudIdentityProfile({ accountId: account.id, mode: 'capture' });
+                  setPreviewProfile(null);
+                  toast({ title: t('cloud.identity.captureSuccess') });
+                });
+              }}
+            >
+              <Fingerprint className="mr-2 h-4 w-4" />
+              {t('cloud.identity.captureAndBind')}
+            </Button>
+
+            <Button
+              variant="outline"
+              disabled={actionKey === 'restore-original'}
+              className="h-auto cursor-pointer justify-start rounded-xl px-4 py-3"
+              onClick={() => {
+                runAction('restore-original', async () => {
+                  await restoreCloudBaselineProfile({ accountId: account.id });
+                  toast({ title: t('cloud.identity.restoreOriginalSuccess') });
+                });
+              }}
+            >
+              <RotateCcw className="mr-2 h-4 w-4" />
+              {t('cloud.identity.restoreOriginal')}
+            </Button>
+
+            <Button
+              variant="outline"
+              disabled={actionKey === 'open-folder'}
+              className="h-auto cursor-pointer justify-start rounded-xl px-4 py-3"
+              onClick={() => {
+                runAction('open-folder', async () => {
+                  await openCloudIdentityStorageFolder();
+                  toast({ title: t('cloud.identity.openFolderSuccess') });
+                });
+              }}
+            >
+              <FolderOpen className="mr-2 h-4 w-4" />
+              {t('cloud.identity.openFolder')}
+            </Button>
+          </div>
+
+          {previewProfile ? (
+            <Card className="border-primary/20 shadow-sm">
+              <CardHeader className="pb-3">
+                <CardTitle className="text-sm">{t('cloud.identity.previewTitle')}</CardTitle>
+              </CardHeader>
+              <CardContent className="space-y-4">
+                {renderProfile(previewProfile)}
+                <div className="flex flex-wrap gap-2">
+                  <Button
+                    size="sm"
+                    disabled={actionKey === 'confirm-generate'}
+                    className="cursor-pointer"
+                    onClick={() => {
+                      runAction('confirm-generate', async () => {
+                        await bindCloudIdentityProfileWithPayload({
+                          accountId: account.id,
+                          profile: previewProfile,
+                        });
+                        setPreviewProfile(null);
+                        toast({ title: t('cloud.identity.generateSuccess') });
+                      });
+                    }}
+                  >
+                    {t('cloud.identity.confirm')}
+                  </Button>
+                  <Button
+                    size="sm"
+                    variant="ghost"
+                    className="cursor-pointer"
+                    onClick={() => setPreviewProfile(null)}
+                  >
+                    {t('cloud.identity.cancel')}
+                  </Button>
+                </div>
+              </CardContent>
+            </Card>
+          ) : null}
+
+          <div className="grid gap-6 xl:grid-cols-[minmax(0,1.2fr)_minmax(0,1fr)]">
+            <div className="space-y-4">
+              <div className="grid gap-4 md:grid-cols-2">
+                <Card className="shadow-sm">
+                  <CardHeader className="pb-3">
+                    <CardTitle className="flex items-center gap-2 text-sm">
+                      <Cpu className="text-muted-foreground h-4 w-4" />
+                      {t('cloud.identity.currentStorage')}
+                    </CardTitle>
+                  </CardHeader>
+                  <CardContent>
+                    {showLoadingPlaceholder ? (
+                      <div className="text-muted-foreground text-xs">
+                        {t('cloud.identity.loading')}
+                      </div>
+                    ) : (
+                      renderProfile(snapshot?.currentStorage)
+                    )}
+                  </CardContent>
+                </Card>
+
+                <Card className="shadow-sm">
+                  <CardHeader className="pb-3">
+                    <CardTitle className="flex items-center gap-2 text-sm">
+                      <ShieldCheck className="text-muted-foreground h-4 w-4" />
+                      {t('cloud.identity.accountBinding')}
+                    </CardTitle>
+                  </CardHeader>
+                  <CardContent>
+                    {showLoadingPlaceholder ? (
+                      <div className="text-muted-foreground text-xs">
+                        {t('cloud.identity.loading')}
+                      </div>
+                    ) : (
+                      renderProfile(snapshot?.boundProfile)
+                    )}
+                  </CardContent>
+                </Card>
+              </div>
+
+              <Card className="shadow-sm">
+                <CardHeader className="pb-3">
+                  <CardTitle className="text-sm">{t('cloud.identity.history')}</CardTitle>
+                </CardHeader>
+                <CardContent className="max-h-[38vh] space-y-3 overflow-y-auto pr-1">
+                  {showLoadingPlaceholder ? (
+                    <div className="text-muted-foreground text-xs">
+                      {t('cloud.identity.loading')}
+                    </div>
+                  ) : null}
+
+                  {!showLoadingPlaceholder && history.length === 0 ? (
+                    <div className="text-muted-foreground text-xs">
+                      {t('cloud.identity.noHistory')}
+                    </div>
+                  ) : null}
+
+                  {!showLoadingPlaceholder
+                    ? history.map((version) => (
+                        <div key={version.id} className="bg-muted/20 rounded-xl border p-3">
+                          <div className="mb-2 flex items-center justify-between gap-3">
+                            <div className="min-w-0">
+                              <div className="truncate text-sm font-medium">{version.label}</div>
+                              <div className="text-muted-foreground text-xs">
+                                {new Date(version.createdAt * 1000).toLocaleString()}
+                              </div>
+                            </div>
+                            {version.isCurrent ? (
+                              <Badge variant="secondary" className="shrink-0">
+                                {t('cloud.identity.current')}
+                              </Badge>
+                            ) : null}
+                          </div>
+
+                          {renderProfile(version.profile)}
+
+                          <div className="mt-3 flex flex-wrap gap-2">
+                            <Button
+                              size="sm"
+                              variant="outline"
+                              disabled={version.isCurrent || actionKey === `restore-${version.id}`}
+                              className="cursor-pointer"
+                              onClick={() => {
+                                runAction(`restore-${version.id}`, async () => {
+                                  await restoreCloudIdentityProfileRevision({
+                                    accountId: account.id,
+                                    versionId: version.id,
+                                  });
+                                  toast({ title: t('cloud.identity.restoreVersionSuccess') });
+                                });
+                              }}
+                            >
+                              {t('cloud.identity.restore')}
+                            </Button>
+                            {!version.isCurrent ? (
+                              <Button
+                                size="sm"
+                                variant="outline"
+                                disabled={actionKey === `delete-${version.id}`}
+                                className="cursor-pointer"
+                                onClick={() => {
+                                  runAction(`delete-${version.id}`, async () => {
+                                    await deleteCloudIdentityProfileRevision({
+                                      accountId: account.id,
+                                      versionId: version.id,
+                                    });
+                                    toast({ title: t('cloud.identity.deleteVersionSuccess') });
+                                  });
+                                }}
+                              >
+                                <Trash2 className="h-4 w-4" />
+                              </Button>
+                            ) : null}
+                          </div>
+                        </div>
+                      ))
+                    : null}
+                </CardContent>
+              </Card>
+            </div>
+
+            <Card className="shadow-sm">
+              <CardHeader className="pb-3">
+                <CardTitle className="text-sm">
+                  {t('cloud.identity.baseline', { defaultValue: 'Reference Profile' })}
+                </CardTitle>
+              </CardHeader>
+              <CardContent>
+                {showLoadingPlaceholder ? (
+                  <div className="text-muted-foreground text-xs">{t('cloud.identity.loading')}</div>
+                ) : (
+                  renderProfile(snapshot?.baseline)
+                )}
+              </CardContent>
+            </Card>
+          </div>
+        </div>
+
+        <DialogFooter className="border-t px-6 py-4">
+          <Button variant="ghost" className="cursor-pointer" onClick={() => onOpenChange(false)}>
+            {t('cloud.identity.close')}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}

src/components/StatusBar.tsx

@@ -3,10 +3,15 @@ import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import { isProcessRunning, startAntigravity, closeAntigravity } from '@/actions/process';
 import { Button } from '@/components/ui/button';
 import { cn } from '@/lib/utils';
-import { Play, Square, Loader2 } from 'lucide-react';
+import { Play, Square, Loader2, Power } from 'lucide-react';
 import { useTranslation } from 'react-i18next';
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
 
-export const StatusBar: React.FC = () => {
+interface StatusBarProps {
+  isCollapsed?: boolean;
+}
+
+export const StatusBar: React.FC<StatusBarProps> = ({ isCollapsed = false }) => {
   const { t } = useTranslation();
   const queryClient = useQueryClient();
 
@@ -40,26 +45,78 @@ export const StatusBar: React.FC = () => {
 
   const isPending = startMutation.isPending || stopMutation.isPending;
 
+  // Collapsed View
+  if (isCollapsed) {
+    return (
+      <div className="flex justify-center py-2">
+        <TooltipProvider>
+          <Tooltip delayDuration={0}>
+            <TooltipTrigger asChild>
+              <Button
+                variant="ghost"
+                size="icon"
+                onClick={handleToggle}
+                disabled={isLoading || isPending}
+                className={cn(
+                  'h-10 w-10 rounded-lg transition-all duration-300',
+                  isRunning
+                    ? 'bg-green-100/50 text-green-700 hover:bg-green-100 hover:text-green-800 dark:bg-green-900/30 dark:text-green-400 dark:hover:bg-green-900/50'
+                    : 'bg-red-100/50 text-red-700 hover:bg-red-100 hover:text-red-800 dark:bg-red-900/30 dark:text-red-400 dark:hover:bg-red-900/50',
+                )}
+              >
+                {isPending ? (
+                  <Loader2 className="h-5 w-5 animate-spin" />
+                ) : (
+                  <Power className="h-5 w-5" />
+                )}
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent side="right" className="flex items-center gap-2">
+              <div
+                className={cn('h-2 w-2 rounded-full', isRunning ? 'bg-green-500' : 'bg-red-500')}
+              />
+              <p>
+                {isLoading
+                  ? t('status.checking')
+                  : isRunning
+                    ? t('status.running')
+                    : t('status.stopped')}
+              </p>
+            </TooltipContent>
+          </Tooltip>
+        </TooltipProvider>
+      </div>
+    );
+  }
+
+  // Expanded View
   return (
     <div
       className={cn(
-        'flex items-center justify-between px-4 py-2 text-sm font-medium transition-colors',
+        'flex items-center justify-between overflow-hidden rounded-lg px-3 py-2.5 text-sm font-medium ring-1 transition-colors ring-inset',
         isRunning
-          ? 'bg-green-100 text-green-900 dark:bg-green-900/30 dark:text-green-100'
-          : 'bg-red-100 text-red-900 dark:bg-red-900/30 dark:text-red-100',
+          ? 'bg-green-100 text-green-900 ring-green-200 dark:bg-green-900/20 dark:text-green-100 dark:ring-green-900/50'
+          : 'bg-red-100 text-red-900 ring-red-200 dark:bg-red-900/20 dark:text-red-100 dark:ring-red-900/50',
       )}
     >
-      <div className="flex items-center gap-2">
+      <div className="flex flex-1 items-start gap-3">
         {isLoading ? (
-          <Loader2 className="h-4 w-4 animate-spin" />
+          <Loader2 className="mt-0.5 h-3.5 w-3.5 shrink-0 animate-spin" />
         ) : isRunning ? (
-          <div className="h-3 w-3 rounded-full bg-green-500" />
+          <div className="mt-1.5 h-2.5 w-2.5 shrink-0 rounded-full bg-green-500 shadow-[0_0_8px_rgba(34,197,94,0.5)]" />
         ) : (
-          <div className="h-3 w-3 rounded-full bg-red-500" />
+          <div className="mt-1.5 h-2.5 w-2.5 shrink-0 rounded-full bg-red-500 shadow-[0_0_8px_rgba(239,68,68,0.5)]" />
         )}
-        <span>
-          {isLoading ? t('status.checking') : isRunning ? t('status.running') : t('status.stopped')}
-        </span>
+        <div className="flex flex-col gap-1 leading-none">
+          <span className="text-xs font-semibold tracking-wider uppercase opacity-80">Status</span>
+          <span className="text-sm leading-tight font-medium">
+            {isLoading
+              ? t('status.checking')
+              : isRunning
+                ? t('status.running')
+                : t('status.stopped')}
+          </span>
+        </div>
       </div>
       <Button
         variant="ghost"
@@ -67,18 +124,22 @@ export const StatusBar: React.FC = () => {
         onClick={handleToggle}
         disabled={isLoading || isPending}
         className={cn(
-          'h-8 px-3 hover:bg-white/20',
-          isRunning ? 'hover:text-green-900' : 'hover:text-red-900',
+          'ml-2 h-8 shrink-0 rounded-md border px-3 transition-all',
+          isRunning
+            ? 'border-green-200 bg-green-200/50 text-green-900 hover:bg-green-200 dark:border-green-800 dark:bg-green-800/30 dark:text-green-100 dark:hover:bg-green-800/50'
+            : 'border-red-200 bg-red-200/50 text-red-900 hover:bg-red-200 dark:border-red-800 dark:bg-red-800/30 dark:text-red-100 dark:hover:bg-red-800/50',
         )}
       >
         {isPending ? (
-          <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+          <Loader2 className="h-3.5 w-3.5 animate-spin" />
         ) : isRunning ? (
-          <Square className="mr-2 h-4 w-4 fill-current" />
+          <Square className="h-3.5 w-3.5 fill-current" />
         ) : (
-          <Play className="mr-2 h-4 w-4 fill-current" />
+          <Play className="h-3.5 w-3.5 fill-current" />
         )}
-        {isRunning ? t('action.stop') : t('action.start')}
+        <span className="ml-2 font-semibold">
+          {isRunning ? t('action.stop') : t('action.start')}
+        </span>
       </Button>
     </div>
   );

src/components/ui/toaster.tsx

@@ -0,0 +1,31 @@
+import { useToast } from '@/components/ui/use-toast';
+import {
+  Toast,
+  ToastClose,
+  ToastDescription,
+  ToastProvider,
+  ToastTitle,
+  ToastViewport,
+} from '@/components/ui/toast';
+
+export function Toaster() {
+  const { toasts } = useToast();
+
+  return (
+    <ToastProvider>
+      {toasts.map(function ({ id, title, description, action, ...props }) {
+        return (
+          <Toast key={id} {...props}>
+            <div className="grid gap-1">
+              {title ? <ToastTitle>{title}</ToastTitle> : null}
+              {description ? <ToastDescription>{description}</ToastDescription> : null}
+            </div>
+            {action}
+            <ToastClose />
+          </Toast>
+        );
+      })}
+      <ToastViewport />
+    </ToastProvider>
+  );
+}

src/components/ui/tooltip.tsx

@@ -0,0 +1,28 @@
+import * as React from 'react';
+import * as TooltipPrimitive from '@radix-ui/react-tooltip';
+
+import { cn } from '@/lib/utils';
+
+const TooltipProvider = TooltipPrimitive.Provider;
+
+const Tooltip = TooltipPrimitive.Root;
+
+const TooltipTrigger = TooltipPrimitive.Trigger;
+
+const TooltipContent = React.forwardRef<
+  React.ElementRef<typeof TooltipPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof TooltipPrimitive.Content>
+>(({ className, sideOffset = 4, ...props }, ref) => (
+  <TooltipPrimitive.Content
+    ref={ref}
+    sideOffset={sideOffset}
+    className={cn(
+      'bg-popover text-popover-foreground animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 z-50 origin-[--radix-tooltip-content-transform-origin] overflow-hidden rounded-md border px-3 py-1.5 text-sm shadow-md',
+      className,
+    )}
+    {...props}
+  />
+));
+TooltipContent.displayName = TooltipPrimitive.Content.displayName;
+
+export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider };

src/hooks/useAppConfig.ts

@@ -1,7 +1,12 @@
-import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
+import { useCallback, useEffect, useRef } from 'react';
+
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+
+import { toast } from '@/components/ui/use-toast';
 import { ipc } from '@/ipc/manager';
 import { AppConfig } from '@/types/config';
-import { toast } from '@/components/ui/use-toast';
+
+const SAVE_DEBOUNCE_MS = 400;
 
 export function useAppConfig() {
   const queryClient = useQueryClient();
@@ -20,28 +25,105 @@ export function useAppConfig() {
   const updateConfig = useMutation({
     mutationFn: async (newConfig: AppConfig) => {
       await ipc.client.config.save(newConfig);
+      return newConfig;
     },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['appConfig'] });
+  });
+
+  const latestConfigRef = useRef<AppConfig | null>(null);
+  const lastStableConfigRef = useRef<AppConfig | null>(null);
+  const pendingResolversRef = useRef<
+    Array<{ resolve: () => void; reject: (error: Error) => void }>
+  >([]);
+  const debounceTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  useEffect(() => {
+    if (config) {
+      lastStableConfigRef.current = config;
+    }
+  }, [config]);
+
+  const flushPendingSave = useCallback(async () => {
+    const pendingBatch = pendingResolversRef.current.splice(0);
+    const nextConfig = latestConfigRef.current;
+    if (!nextConfig) {
+      for (const item of pendingBatch) {
+        item.resolve();
+      }
+      return;
+    }
+
+    try {
+      const savedConfig = await updateConfig.mutateAsync(nextConfig);
+      queryClient.setQueryData(['appConfig'], savedConfig);
+      lastStableConfigRef.current = savedConfig;
       toast({
         title: 'Settings saved',
         description: 'Your configuration has been updated.',
       });
-    },
-    onError: (err) => {
+      for (const item of pendingBatch) {
+        item.resolve();
+      }
+    } catch (err) {
+      const error = err instanceof Error ? err : new Error('Failed to save settings');
+      const fallback = lastStableConfigRef.current;
+      if (fallback) {
+        queryClient.setQueryData(['appConfig'], fallback);
+      } else {
+        queryClient.invalidateQueries({ queryKey: ['appConfig'] });
+      }
       toast({
         title: 'Error saving settings',
-        description: err.message,
+        description: error.message,
         variant: 'destructive',
       });
+      for (const item of pendingBatch) {
+        item.reject(error);
+      }
+    }
+  }, [queryClient, updateConfig]);
+
+  const saveConfig = useCallback(
+    (newConfig: AppConfig) => {
+      latestConfigRef.current = newConfig;
+      queryClient.setQueryData(['appConfig'], newConfig);
+
+      if (debounceTimerRef.current) {
+        clearTimeout(debounceTimerRef.current);
+      }
+
+      return new Promise<void>((resolve, reject) => {
+        pendingResolversRef.current.push({ resolve, reject });
+        debounceTimerRef.current = setTimeout(() => {
+          debounceTimerRef.current = null;
+          flushPendingSave();
+        }, SAVE_DEBOUNCE_MS);
+      });
     },
-  });
+    [flushPendingSave, queryClient],
+  );
+
+  useEffect(() => {
+    const handleBeforeUnload = () => {
+      if (!debounceTimerRef.current) {
+        return;
+      }
+      clearTimeout(debounceTimerRef.current);
+      debounceTimerRef.current = null;
+      void flushPendingSave();
+    };
+
+    window.addEventListener('beforeunload', handleBeforeUnload);
+    return () => {
+      window.removeEventListener('beforeunload', handleBeforeUnload);
+      handleBeforeUnload();
+    };
+  }, [flushPendingSave]);
 
   return {
     config,
     isLoading,
     error,
-    saveConfig: updateConfig.mutateAsync,
+    saveConfig,
     isSaving: updateConfig.isPending,
   };
 }

src/hooks/useCloudAccounts.ts

@@ -47,12 +47,12 @@ export function useRefreshQuota() {
   return useMutation({
     mutationFn: refreshAccountQuota,
     onSuccess: (updatedAccount: CloudAccount) => {
-      // Optimistically update the list or just invalidate?
-      // Invalidating is safer as sorting might change (last_used)
+      // Optimistically update
       queryClient.setQueryData(QUERY_KEYS.cloudAccounts, (oldData: CloudAccount[] | undefined) => {
         if (!oldData) return [updatedAccount];
         return oldData.map((acc) => (acc.id === updatedAccount.id ? updatedAccount : acc));
       });
+      queryClient.invalidateQueries({ queryKey: QUERY_KEYS.cloudAccounts });
     },
   });
 }
@@ -97,8 +97,12 @@ export function useSetAutoSwitchEnabled() {
 }
 
 export function useForcePollCloudMonitor() {
+  const queryClient = useQueryClient();
   return useMutation({
     mutationFn: forcePollCloudMonitor,
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: QUERY_KEYS.cloudAccounts });
+    },
   });
 }
 

src/instrument.ts

@@ -0,0 +1,60 @@
+import { app } from 'electron';
+import * as Sentry from '@sentry/electron/main';
+import path from 'path';
+import fs from 'fs';
+import { getAppDataDir } from './utils/paths';
+import { logger } from './utils/logger';
+
+function getQuickConfig() {
+  try {
+    const configPath = path.join(getAppDataDir(), 'gui_config.json');
+    if (fs.existsSync(configPath)) {
+      const content = fs.readFileSync(configPath, 'utf-8');
+      const config = JSON.parse(content);
+      // Default to false (privacy by default)
+      return config.error_reporting_enabled;
+    }
+  } catch (e) {
+    logger.error('Failed to read config for Sentry init:', e);
+  }
+  return false;
+}
+
+if (getQuickConfig()) {
+  Sentry.init({
+    dsn: process.env.SENTRY_DSN,
+    release: `antigravity-manager@${app.getVersion()}`,
+    beforeSend(event) {
+      if (event.exception?.values?.[0]?.value) {
+        event.exception.values[0].value = event.exception.values[0].value.replace(
+          /Users\\\\[^\\\\]+/g,
+          'Users\\\\***',
+        );
+      }
+      return event;
+    },
+  });
+  logger.setErrorReportingEnabled(true);
+  logger.setSentryReporter((payload) => {
+    Sentry.withScope((scope) => {
+      scope.setTag('log_level', payload.level);
+      scope.setContext('recent_logs', {
+        entries: payload.logs.map((entry) => ({
+          timestamp: new Date(entry.timestamp).toISOString(),
+          level: entry.level,
+          message: entry.message,
+          formatted: entry.formatted,
+        })),
+      });
+      scope.setExtra('log_message', payload.message);
+      if (payload.error) {
+        Sentry.captureException(payload.error);
+        return;
+      }
+      Sentry.captureMessage(payload.message, 'error');
+    });
+  });
+} else {
+  logger.setErrorReportingEnabled(false);
+  logger.setSentryReporter(null);
+}

src/ipc/account/handler.ts

@@ -3,15 +3,66 @@ import path from 'path';
 import { v4 as uuidv4 } from 'uuid';
 import { getAccountsFilePath, getBackupsDir } from '../../utils/paths';
 import { logger } from '../../utils/logger';
-import { Account, AccountBackupData } from '../../types/account';
+import {
+  Account,
+  AccountBackupData,
+  DeviceProfile,
+  DeviceProfilesSnapshot,
+  DeviceProfileVersion,
+} from '../../types/account';
 import {
   backupAccount as dbBackup,
   restoreAccount as dbRestore,
   getCurrentAccountInfo,
 } from '../database/handler';
-import { closeAntigravity, startAntigravity } from '../process/handler';
+import {
+  applyDeviceProfile,
+  ensureGlobalOriginalFromCurrentStorage,
+  generateDeviceProfile,
+  isIdentityProfileApplyEnabled,
+  loadGlobalOriginalProfile,
+  readCurrentDeviceProfile,
+  saveGlobalOriginalProfile,
+  getStorageDirectoryPath,
+} from '../device/handler';
+import { runWithSwitchGuard } from '../switchGuard';
+import { executeSwitchFlow } from '../switchFlow';
+import { shell } from 'electron';
 
 type AccountIndex = Record<string, Account>;
+const SWITCH_EXIT_TIMEOUT_MS = 10000;
+
+function getDeviceHistory(account: Account): DeviceProfileVersion[] {
+  if (!account.deviceHistory) {
+    account.deviceHistory = [];
+  }
+  return account.deviceHistory;
+}
+
+function bindDeviceProfileToAccount(
+  account: Account,
+  profile: DeviceProfile,
+  label: string,
+  addHistory: boolean,
+): void {
+  account.deviceProfile = profile;
+  if (!addHistory) {
+    return;
+  }
+
+  const history = getDeviceHistory(account);
+  for (const version of history) {
+    version.isCurrent = false;
+  }
+
+  history.push({
+    id: uuidv4(),
+    createdAt: Math.floor(Date.now() / 1000),
+    label,
+    profile,
+    isCurrent: true,
+  });
+}
 
 /**
  * Loads the accounts index from the file system.
@@ -141,6 +192,7 @@ export async function addAccountSnapshot(): Promise<Account> {
       name: accountName,
       email: info.email,
       backup_file: backupPath,
+      deviceHistory: [],
       created_at: now,
       last_used: now,
     };
@@ -171,7 +223,184 @@ export async function addAccountSnapshot(): Promise<Account> {
  * @throws {Error} If the account cannot be found or the backup file cannot be found.
  */
 export async function switchAccount(accountId: string): Promise<void> {
-  logger.info(`Switching to account: ${accountId}`);
+  await runWithSwitchGuard('local-account-switch', async () => {
+    logger.info(`Switching to account: ${accountId}`);
+
+    const accounts = loadAccountsIndex();
+    const account = accounts[accountId];
+    if (!account) {
+      throw new Error(`Account not found: ${accountId}`);
+    }
+
+    // NOTE Get backup file path from account data
+    const backupPath = account.backup_file || path.join(getBackupsDir(), `${accountId}.json`);
+
+    if (!fs.existsSync(backupPath)) {
+      throw new Error(`Backup file not found: ${backupPath}`);
+    }
+
+    ensureGlobalOriginalFromCurrentStorage();
+    if (!account.deviceProfile) {
+      const generated = generateDeviceProfile();
+      saveGlobalOriginalProfile(generated);
+      bindDeviceProfileToAccount(account, generated, 'auto_generated', true);
+    }
+
+    await executeSwitchFlow({
+      scope: 'local',
+      targetProfile: account.deviceProfile || null,
+      applyFingerprint: isIdentityProfileApplyEnabled(),
+      processExitTimeoutMs: SWITCH_EXIT_TIMEOUT_MS,
+      performSwitch: async () => {
+        // NOTE Load backup file
+        const backupContent = fs.readFileSync(backupPath, 'utf-8');
+        const backupData: AccountBackupData = JSON.parse(backupContent);
+
+        // NOTE Restore data to DB
+        dbRestore(backupData);
+
+        // NOTE Update last used
+        account.last_used = new Date().toISOString();
+        saveAccountsIndex(accounts);
+      },
+    });
+  });
+}
+
+export async function previewGenerateIdentityProfile(): Promise<DeviceProfile> {
+  return generateDeviceProfile();
+}
+
+export async function getIdentityProfiles(accountId: string): Promise<DeviceProfilesSnapshot> {
+  const accounts = loadAccountsIndex();
+  const account = accounts[accountId];
+  if (!account) {
+    throw new Error(`Account not found: ${accountId}`);
+  }
+
+  let currentStorage: DeviceProfile | undefined;
+  try {
+    currentStorage = readCurrentDeviceProfile();
+  } catch (error) {
+    logger.warn('Failed to read current storage device profile', error);
+  }
+
+  return {
+    currentStorage,
+    boundProfile: account.deviceProfile,
+    history: account.deviceHistory || [],
+    baseline: loadGlobalOriginalProfile() || undefined,
+  };
+}
+
+export async function bindIdentityProfile(
+  accountId: string,
+  mode: 'capture' | 'generate',
+): Promise<DeviceProfile> {
+  const accounts = loadAccountsIndex();
+  const account = accounts[accountId];
+  if (!account) {
+    throw new Error(`Account not found: ${accountId}`);
+  }
+
+  let profile: DeviceProfile;
+  if (mode === 'capture') {
+    profile = readCurrentDeviceProfile();
+  } else {
+    profile = generateDeviceProfile();
+  }
+
+  ensureGlobalOriginalFromCurrentStorage();
+  saveGlobalOriginalProfile(profile);
+  applyDeviceProfile(profile);
+  bindDeviceProfileToAccount(account, profile, mode, true);
+  saveAccountsIndex(accounts);
+  return profile;
+}
+
+export async function bindIdentityProfileWithPayload(
+  accountId: string,
+  profile: DeviceProfile,
+): Promise<DeviceProfile> {
+  const accounts = loadAccountsIndex();
+  const account = accounts[accountId];
+  if (!account) {
+    throw new Error(`Account not found: ${accountId}`);
+  }
+
+  ensureGlobalOriginalFromCurrentStorage();
+  saveGlobalOriginalProfile(profile);
+  applyDeviceProfile(profile);
+  bindDeviceProfileToAccount(account, profile, 'generated', true);
+  saveAccountsIndex(accounts);
+  return profile;
+}
+
+export async function applyBoundIdentityProfile(accountId: string): Promise<DeviceProfile> {
+  const accounts = loadAccountsIndex();
+  const account = accounts[accountId];
+  if (!account) {
+    throw new Error(`Account not found: ${accountId}`);
+  }
+  if (!account.deviceProfile) {
+    throw new Error('Account has no bound device profile');
+  }
+
+  applyDeviceProfile(account.deviceProfile);
+  account.last_used = new Date().toISOString();
+  saveAccountsIndex(accounts);
+  return account.deviceProfile;
+}
+
+export async function restoreIdentityProfileRevision(
+  accountId: string,
+  versionId: string,
+): Promise<DeviceProfile> {
+  const accounts = loadAccountsIndex();
+  const account = accounts[accountId];
+  if (!account) {
+    throw new Error(`Account not found: ${accountId}`);
+  }
+
+  let targetProfile: DeviceProfile | null = null;
+  if (versionId === 'baseline') {
+    targetProfile = loadGlobalOriginalProfile();
+    if (!targetProfile) {
+      throw new Error('Global original profile not found');
+    }
+    for (const version of getDeviceHistory(account)) {
+      version.isCurrent = false;
+    }
+  } else if (versionId === 'current') {
+    targetProfile = account.deviceProfile || null;
+    if (!targetProfile) {
+      throw new Error('No currently bound profile');
+    }
+  } else {
+    const history = getDeviceHistory(account);
+    const targetVersion = history.find((version) => version.id === versionId);
+    if (!targetVersion) {
+      throw new Error('Device profile version not found');
+    }
+    targetProfile = targetVersion.profile;
+    for (const version of history) {
+      version.isCurrent = version.id === versionId;
+    }
+  }
+
+  applyDeviceProfile(targetProfile);
+  account.deviceProfile = targetProfile;
+  saveAccountsIndex(accounts);
+  return targetProfile;
+}
+
+export async function deleteIdentityProfileRevision(
+  accountId: string,
+  versionId: string,
+): Promise<void> {
+  if (versionId === 'baseline') {
+    throw new Error('Original profile cannot be deleted');
+  }
 
   const accounts = loadAccountsIndex();
   const account = accounts[accountId];
@@ -179,34 +408,47 @@ export async function switchAccount(accountId: string): Promise<void> {
     throw new Error(`Account not found: ${accountId}`);
   }
 
-  // NOTE Get backup file path from account data
-  const backupPath = account.backup_file || path.join(getBackupsDir(), `${accountId}.json`);
-
-  if (!fs.existsSync(backupPath)) {
-    throw new Error(`Backup file not found: ${backupPath}`);
+  const history = getDeviceHistory(account);
+  if (history.some((version) => version.id === versionId && version.isCurrent)) {
+    throw new Error('Currently bound profile cannot be deleted');
   }
 
-  // NOTE Close Antigravity (with error handling)
-  try {
-    await closeAntigravity();
-  } catch (error) {
-    // NOTE Continue even if close fails
-    logger.warn('Unable to close Antigravity, attempting forced restore...', error);
+  const before = history.length;
+  account.deviceHistory = history.filter((version) => version.id !== versionId);
+  if (account.deviceHistory.length === before) {
+    throw new Error('Historical device profile not found');
   }
 
-  // NOTE Load backup file
-  const backupContent = fs.readFileSync(backupPath, 'utf-8');
-  const backupData: AccountBackupData = JSON.parse(backupContent);
+  saveAccountsIndex(accounts);
+}
 
-  // NOTE Restore data to DB
-  dbRestore(backupData);
+export async function restoreBaselineProfile(accountId: string): Promise<DeviceProfile> {
+  const accounts = loadAccountsIndex();
+  const account = accounts[accountId];
+  if (!account) {
+    throw new Error(`Account not found: ${accountId}`);
+  }
 
-  // NOTE Update last used
-  account.last_used = new Date().toISOString();
+  const baseline = loadGlobalOriginalProfile();
+  if (!baseline) {
+    throw new Error('Global original profile not found');
+  }
+
+  account.deviceProfile = baseline;
+  for (const version of getDeviceHistory(account)) {
+    version.isCurrent = false;
+  }
   saveAccountsIndex(accounts);
 
-  // NOTE Start Antigravity
-  await startAntigravity();
+  return baseline;
+}
+
+export async function openIdentityStorageFolder(): Promise<void> {
+  const directory = getStorageDirectoryPath();
+  const result = await shell.openPath(directory);
+  if (result) {
+    throw new Error(`Failed to open device folder: ${result}`);
+  }
 }
 
 /**

src/ipc/account/router.ts

@@ -1,7 +1,25 @@
 import { z } from 'zod';
 import { os } from '@orpc/server';
-import { listAccountsData, addAccountSnapshot, switchAccount, deleteAccount } from './handler';
-import { AccountSchema } from '../../types/account';
+import {
+  applyBoundIdentityProfile,
+  addAccountSnapshot,
+  bindIdentityProfile,
+  bindIdentityProfileWithPayload,
+  deleteAccount,
+  deleteIdentityProfileRevision,
+  getIdentityProfiles,
+  listAccountsData,
+  previewGenerateIdentityProfile,
+  restoreBaselineProfile,
+  restoreIdentityProfileRevision,
+  switchAccount,
+  openIdentityStorageFolder,
+} from './handler';
+import {
+  AccountSchema,
+  DeviceProfileSchema,
+  DeviceProfilesSnapshotSchema,
+} from '../../types/account';
 
 export const accountRouter = os.router({
   listAccounts: os.output(z.array(AccountSchema)).handler(async () => {
@@ -25,4 +43,61 @@ export const accountRouter = os.router({
     .handler(async ({ input }) => {
       await deleteAccount(input.accountId);
     }),
+
+  previewGenerateIdentityProfile: os.output(DeviceProfileSchema).handler(async () => {
+    return previewGenerateIdentityProfile();
+  }),
+
+  getIdentityProfiles: os
+    .input(z.object({ accountId: z.string() }))
+    .output(DeviceProfilesSnapshotSchema)
+    .handler(async ({ input }) => {
+      return getIdentityProfiles(input.accountId);
+    }),
+
+  bindIdentityProfile: os
+    .input(z.object({ accountId: z.string(), mode: z.enum(['capture', 'generate']) }))
+    .output(DeviceProfileSchema)
+    .handler(async ({ input }) => {
+      return bindIdentityProfile(input.accountId, input.mode);
+    }),
+
+  bindIdentityProfileWithPayload: os
+    .input(z.object({ accountId: z.string(), profile: DeviceProfileSchema }))
+    .output(DeviceProfileSchema)
+    .handler(async ({ input }) => {
+      return bindIdentityProfileWithPayload(input.accountId, input.profile);
+    }),
+
+  applyBoundIdentityProfile: os
+    .input(z.object({ accountId: z.string() }))
+    .output(DeviceProfileSchema)
+    .handler(async ({ input }) => {
+      return applyBoundIdentityProfile(input.accountId);
+    }),
+
+  restoreIdentityProfileRevision: os
+    .input(z.object({ accountId: z.string(), versionId: z.string() }))
+    .output(DeviceProfileSchema)
+    .handler(async ({ input }) => {
+      return restoreIdentityProfileRevision(input.accountId, input.versionId);
+    }),
+
+  deleteIdentityProfileRevision: os
+    .input(z.object({ accountId: z.string(), versionId: z.string() }))
+    .output(z.void())
+    .handler(async ({ input }) => {
+      await deleteIdentityProfileRevision(input.accountId, input.versionId);
+    }),
+
+  restoreBaselineProfile: os
+    .input(z.object({ accountId: z.string() }))
+    .output(DeviceProfileSchema)
+    .handler(async ({ input }) => {
+      return restoreBaselineProfile(input.accountId);
+    }),
+
+  openIdentityStorageFolder: os.output(z.void()).handler(async () => {
+    await openIdentityStorageFolder();
+  }),
 });

src/ipc/cloud/authServer.ts

@@ -20,11 +20,13 @@ export class AuthServer {
         const error = url.searchParams.get('error');
 
         if (code) {
-          logger.info('AuthServer: Received authorization code');
+          logger.info(`AuthServer: Received authorization code: ${code.substring(0, 10)}...`);
 
           // Send code to renderer
           if (ipcContext.mainWindow) {
+            logger.info('AuthServer: Sending code to renderer via IPC');
             ipcContext.mainWindow.webContents.send('GOOGLE_AUTH_CODE', code);
+            logger.info('AuthServer: Code sent successfully');
           } else {
             logger.error('AuthServer: Main window not found, cannot send code');
           }

src/ipc/cloud/handler.ts

@@ -6,9 +6,20 @@ import { logger } from '../../utils/logger';
 
 import { shell } from 'electron';
 import fs from 'fs';
-import { closeAntigravity, startAntigravity, _waitForProcessExit } from '../../ipc/process/handler';
 import { updateTrayMenu } from '../../ipc/tray/handler';
+import {
+  ensureGlobalOriginalFromCurrentStorage,
+  generateDeviceProfile,
+  getStorageDirectoryPath,
+  isIdentityProfileApplyEnabled,
+  loadGlobalOriginalProfile,
+  readCurrentDeviceProfile,
+  saveGlobalOriginalProfile,
+} from '../../ipc/device/handler';
 import { getAntigravityDbPaths } from '../../utils/paths';
+import { runWithSwitchGuard } from '../../ipc/switchGuard';
+import { executeSwitchFlow } from '../../ipc/switchFlow';
+import type { DeviceProfile, DeviceProfilesSnapshot } from '../../types/account';
 
 // Fallback constants if service constants are not available or for direct usage
 const CLIENT_ID = '1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com';
@@ -123,6 +134,8 @@ export async function refreshAccountQuota(accountId: string): Promise<CloudAccou
     const quota = await GoogleAPIService.fetchQuota(account.token.access_token);
     account.quota = quota;
     await CloudAccountRepo.updateQuota(account.id, quota);
+    await CloudAccountRepo.updateLastUsed(account.id);
+    account.last_used = Math.floor(Date.now() / 1000); // Sync memory object
     notifyTrayUpdate(account);
     return account;
   } catch (error: any) {
@@ -143,6 +156,8 @@ export async function refreshAccountQuota(accountId: string): Promise<CloudAccou
         const quota = await GoogleAPIService.fetchQuota(account.token.access_token);
         account.quota = quota;
         await CloudAccountRepo.updateQuota(account.id, quota);
+        await CloudAccountRepo.updateLastUsed(account.id);
+        account.last_used = Math.floor(Date.now() / 1000); // Sync memory object
         return account;
       } catch (refreshError) {
         logger.error(
@@ -165,74 +180,176 @@ export async function refreshAccountQuota(accountId: string): Promise<CloudAccou
 }
 
 export async function switchCloudAccount(accountId: string): Promise<void> {
-  try {
-    const account = await CloudAccountRepo.getAccount(accountId);
-    if (!account) {
-      throw new Error(`Account not found: ${accountId}`);
-    }
-
-    logger.info(`Switching to cloud account: ${account.email} (${account.id})`);
-
-    // 1. Ensure token is fresh before injecting
-    const now = Math.floor(Date.now() / 1000);
-    if (account.token.expiry_timestamp < now + 300) {
-      logger.info(`Token for ${account.email} near expiry, refreshing before switch...`);
-      try {
-        const newTokenData = await GoogleAPIService.refreshAccessToken(account.token.refresh_token);
-        account.token.access_token = newTokenData.access_token;
-        account.token.expires_in = newTokenData.expires_in;
-        account.token.expiry_timestamp = now + newTokenData.expires_in;
-        await CloudAccountRepo.updateToken(account.id, account.token);
-      } catch (e) {
-        logger.warn('Failed to refresh token before switch, trying with existing token', e);
-      }
-    }
-
-    // 2. Stop Antigravity Process
-    await closeAntigravity();
+  await runWithSwitchGuard('cloud-account-switch', async () => {
     try {
-      await _waitForProcessExit(10000); // Wait up to 10s for it to truly vanish
-    } catch (e) {
-      logger.warn('Process did not exit cleanly within timeout, but proceeding...', e);
-    }
-
-    // 3. Backup Database (New Logic)
-    const dbPaths = getAntigravityDbPaths();
-    // Find the valid DB path
-    let dbPath: string | null = null;
-    for (const p of dbPaths) {
-      if (fs.existsSync(p)) {
-        dbPath = p;
-        break;
+      const account = await CloudAccountRepo.getAccount(accountId);
+      if (!account) {
+        throw new Error(`Account not found: ${accountId}`);
       }
-    }
 
-    if (dbPath) {
-      try {
-        const backupPath = `${dbPath}.backup`;
-        fs.copyFileSync(dbPath, backupPath);
-        logger.info(`Backed up database to ${backupPath}`);
-      } catch (e) {
-        logger.error('Failed to backup database', e);
+      logger.info(`Switching to cloud account: ${account.email} (${account.id})`);
+
+      ensureGlobalOriginalFromCurrentStorage();
+      if (!account.device_profile) {
+        const generated = generateDeviceProfile();
+        CloudAccountRepo.setDeviceBinding(account.id, generated, 'auto_generated');
+        saveGlobalOriginalProfile(generated);
+        account.device_profile = generated;
       }
+
+      // 1. Ensure token is fresh before injecting
+      const now = Math.floor(Date.now() / 1000);
+      if (account.token.expiry_timestamp < now + 300) {
+        logger.info(`Token for ${account.email} near expiry, refreshing before switch...`);
+        try {
+          const newTokenData = await GoogleAPIService.refreshAccessToken(account.token.refresh_token);
+          account.token.access_token = newTokenData.access_token;
+          account.token.expires_in = newTokenData.expires_in;
+          account.token.expiry_timestamp = now + newTokenData.expires_in;
+          await CloudAccountRepo.updateToken(account.id, account.token);
+        } catch (e) {
+          logger.warn('Failed to refresh token before switch, trying with existing token', e);
+        }
+      }
+
+      await executeSwitchFlow({
+        scope: 'cloud',
+        targetProfile: account.device_profile || null,
+        applyFingerprint: isIdentityProfileApplyEnabled(),
+        processExitTimeoutMs: 10000,
+        performSwitch: async () => {
+          // 3. Backup Database (New Logic)
+          const dbPaths = getAntigravityDbPaths();
+          // Find the valid DB path
+          let dbPath: string | null = null;
+          for (const p of dbPaths) {
+            if (fs.existsSync(p)) {
+              dbPath = p;
+              break;
+            }
+          }
+
+          if (dbPath) {
+            try {
+              const backupPath = `${dbPath}.backup`;
+              fs.copyFileSync(dbPath, backupPath);
+              logger.info(`Backed up database to ${backupPath}`);
+            } catch (e) {
+              logger.error('Failed to backup database', e);
+            }
+          }
+
+          // 4. Inject Token
+          // injectedCloudToken uses direct DB/FS access which is sync better-sqlite3.
+          CloudAccountRepo.injectCloudToken(account);
+
+          // 5. Update usage and active status
+          CloudAccountRepo.updateLastUsed(account.id);
+          CloudAccountRepo.setActive(account.id);
+
+          logger.info(`Successfully switched to cloud account: ${account.email}`);
+          notifyTrayUpdate(account);
+        },
+      });
+    } catch (err: any) {
+      logger.error('Failed to switch cloud account', err);
+      throw new Error(`Switch failed: ${err.message || 'Unknown error'}`);
     }
+  });
+}
 
-    // 3. Inject Token
-    // injectedCloudToken uses direct DB/FS access which is sync better-sqlite3.
-    CloudAccountRepo.injectCloudToken(account);
+export async function getCloudIdentityProfiles(accountId: string): Promise<DeviceProfilesSnapshot> {
+  const account = await CloudAccountRepo.getAccount(accountId);
+  if (!account) {
+    throw new Error(`Account not found: ${accountId}`);
+  }
 
-    // 4. Update usage and active status
-    CloudAccountRepo.updateLastUsed(account.id);
-    CloudAccountRepo.setActive(account.id);
+  let currentStorage: DeviceProfile | undefined;
+  try {
+    currentStorage = readCurrentDeviceProfile();
+  } catch (error) {
+    logger.warn('Failed to read current storage device profile', error);
+  }
 
-    // 5. Restart Process
-    await startAntigravity();
+  return {
+    currentStorage,
+    boundProfile: account.device_profile,
+    history: account.device_history || [],
+    baseline: loadGlobalOriginalProfile() || undefined,
+  };
+}
 
-    logger.info(`Successfully switched to cloud account: ${account.email}`);
-    notifyTrayUpdate(account);
-  } catch (err: any) {
-    logger.error('Failed to switch cloud account', err);
-    throw new Error(`Switch failed: ${err.message || 'Unknown error'}`);
+export async function previewGenerateCloudIdentityProfile(): Promise<DeviceProfile> {
+  return generateDeviceProfile();
+}
+
+export async function bindCloudIdentityProfile(
+  accountId: string,
+  mode: 'capture' | 'generate',
+): Promise<DeviceProfile> {
+  const account = await CloudAccountRepo.getAccount(accountId);
+  if (!account) {
+    throw new Error(`Account not found: ${accountId}`);
+  }
+
+  let profile: DeviceProfile;
+  if (mode === 'capture') {
+    profile = readCurrentDeviceProfile();
+  } else {
+    profile = generateDeviceProfile();
+  }
+
+  ensureGlobalOriginalFromCurrentStorage();
+  saveGlobalOriginalProfile(profile);
+  CloudAccountRepo.setDeviceBinding(account.id, profile, mode);
+
+  return profile;
+}
+
+export async function bindCloudIdentityProfileWithPayload(
+  accountId: string,
+  profile: DeviceProfile,
+): Promise<DeviceProfile> {
+  const account = await CloudAccountRepo.getAccount(accountId);
+  if (!account) {
+    throw new Error(`Account not found: ${accountId}`);
+  }
+
+  ensureGlobalOriginalFromCurrentStorage();
+  saveGlobalOriginalProfile(profile);
+  CloudAccountRepo.setDeviceBinding(account.id, profile, 'generated');
+
+  return profile;
+}
+
+export async function restoreCloudIdentityProfileRevision(
+  accountId: string,
+  versionId: string,
+): Promise<DeviceProfile> {
+  const baseline = loadGlobalOriginalProfile();
+  return CloudAccountRepo.restoreDeviceVersion(accountId, versionId, baseline);
+}
+
+export async function restoreCloudBaselineProfile(accountId: string): Promise<DeviceProfile> {
+  const baseline = loadGlobalOriginalProfile();
+  if (!baseline) {
+    throw new Error('Global original profile not found');
+  }
+  return CloudAccountRepo.restoreDeviceVersion(accountId, 'baseline', baseline);
+}
+
+export async function deleteCloudIdentityProfileRevision(
+  accountId: string,
+  versionId: string,
+): Promise<void> {
+  CloudAccountRepo.deleteDeviceVersion(accountId, versionId);
+}
+
+export async function openCloudIdentityStorageFolder(): Promise<void> {
+  const directory = getStorageDirectoryPath();
+  const result = await shell.openPath(directory);
+  if (result) {
+    throw new Error(`Failed to open identity storage: ${result}`);
   }
 }
 

src/ipc/cloud/router.ts

@@ -2,9 +2,17 @@ import { z } from 'zod';
 import { os } from '@orpc/server';
 import {
   addGoogleAccount,
+  bindCloudIdentityProfile,
+  bindCloudIdentityProfileWithPayload,
+  deleteCloudIdentityProfileRevision,
   listCloudAccounts,
   deleteCloudAccount,
+  getCloudIdentityProfiles,
+  openCloudIdentityStorageFolder,
+  previewGenerateCloudIdentityProfile,
   refreshAccountQuota,
+  restoreCloudIdentityProfileRevision,
+  restoreCloudBaselineProfile,
   switchCloudAccount,
   getAutoSwitchEnabled,
   setAutoSwitchEnabled,
@@ -12,7 +20,53 @@ import {
   startAuthFlow,
 } from './handler';
 import { CloudAccountSchema } from '../../types/cloudAccount';
+import {
+  DeviceProfileSchema,
+  DeviceProfilesSnapshotSchema,
+} from '../../types/account';
 import { CloudAccountRepo } from '../database/cloudHandler';
+import { logger } from '../../utils/logger';
+import { getSwitchMetricsSnapshot } from '../switchMetrics';
+import { getSwitchGuardSnapshot } from '../switchGuard';
+import { getDeviceHardeningSnapshot } from '../device/handler';
+
+const switchOwnerSchema = z.enum(['local-account-switch', 'cloud-account-switch']);
+const switchMetricBucketSchema = z.object({
+  switchSuccess: z.number(),
+  switchFailure: z.number(),
+  rollbackAttempt: z.number(),
+  rollbackSuccess: z.number(),
+  rollbackFailure: z.number(),
+  failureReasons: z.record(z.string(), z.number()),
+  lastFailure: z
+    .object({
+      reason: z.string(),
+      message: z.string(),
+      occurredAt: z.number(),
+    })
+    .nullable(),
+});
+const switchMetricsSnapshotSchema = z.object({
+  local: switchMetricBucketSchema,
+  cloud: switchMetricBucketSchema,
+});
+const switchGuardSnapshotSchema = z.object({
+  activeOwner: switchOwnerSchema.nullable(),
+  pendingOwners: z.array(switchOwnerSchema),
+  pendingCount: z.number(),
+});
+const switchStatusSnapshotSchema = z.object({
+  metrics: switchMetricsSnapshotSchema,
+  guard: switchGuardSnapshotSchema,
+  hardening: z.object({
+    consecutiveApplyFailures: z.number(),
+    safeModeActive: z.boolean(),
+    safeModeUntil: z.number().nullable(),
+    lastFailureReason: z.string().nullable(),
+    lastFailureStage: z.string().nullable(),
+    lastFailureAt: z.number().nullable(),
+  }),
+});
 
 export const cloudRouter = os.router({
   addGoogleAccount: os
@@ -72,8 +126,66 @@ export const cloudRouter = os.router({
 
       return result;
     } catch (error: any) {
-      console.error('[ORPC] syncLocalAccount error:', error.message, error.stack);
+      logger.error('[ORPC] syncLocalAccount error:', error.message, error.stack);
       throw error;
     }
   }),
+
+  getSwitchStatus: os.output(switchStatusSnapshotSchema).handler(async () => {
+    return {
+      metrics: getSwitchMetricsSnapshot(),
+      guard: getSwitchGuardSnapshot(),
+      hardening: getDeviceHardeningSnapshot(),
+    };
+  }),
+
+  getIdentityProfiles: os
+    .input(z.object({ accountId: z.string() }))
+    .output(DeviceProfilesSnapshotSchema)
+    .handler(async ({ input }) => {
+      return getCloudIdentityProfiles(input.accountId);
+    }),
+
+  previewIdentityProfile: os.output(DeviceProfileSchema).handler(async () => {
+    return previewGenerateCloudIdentityProfile();
+  }),
+
+  bindIdentityProfile: os
+    .input(z.object({ accountId: z.string(), mode: z.enum(['capture', 'generate']) }))
+    .output(DeviceProfileSchema)
+    .handler(async ({ input }) => {
+      return bindCloudIdentityProfile(input.accountId, input.mode);
+    }),
+
+  bindIdentityProfileWithPayload: os
+    .input(z.object({ accountId: z.string(), profile: DeviceProfileSchema }))
+    .output(DeviceProfileSchema)
+    .handler(async ({ input }) => {
+      return bindCloudIdentityProfileWithPayload(input.accountId, input.profile);
+    }),
+
+  restoreIdentityProfileRevision: os
+    .input(z.object({ accountId: z.string(), versionId: z.string() }))
+    .output(DeviceProfileSchema)
+    .handler(async ({ input }) => {
+      return restoreCloudIdentityProfileRevision(input.accountId, input.versionId);
+    }),
+
+  restoreBaselineProfile: os
+    .input(z.object({ accountId: z.string() }))
+    .output(DeviceProfileSchema)
+    .handler(async ({ input }) => {
+      return restoreCloudBaselineProfile(input.accountId);
+    }),
+
+  deleteIdentityProfileRevision: os
+    .input(z.object({ accountId: z.string(), versionId: z.string() }))
+    .output(z.void())
+    .handler(async ({ input }) => {
+      await deleteCloudIdentityProfileRevision(input.accountId, input.versionId);
+    }),
+
+  openIdentityStorageFolder: os.output(z.void()).handler(async () => {
+    await openCloudIdentityStorageFolder();
+  }),
 });

src/ipc/config/handlers.ts

@@ -1,13 +1,20 @@
 import { AppConfig } from '../../types/config';
 import { ConfigManager } from './manager';
+import { syncAutoStart } from '../../utils/autoStart';
+import { logger } from '../../utils/logger';
 
 export function loadConfig(): AppConfig {
   return ConfigManager.loadConfig();
 }
 
-export function saveConfig(config: AppConfig): void {
+export async function saveConfig(config: AppConfig): Promise<void> {
   // Logic to notify proxy server if configuration changes (hot update)
   // Logic to update Tray if language changes
   // For now just save
-  ConfigManager.saveConfig(config);
+  const previous = ConfigManager.getCachedConfig() ?? ConfigManager.loadConfig();
+  await ConfigManager.saveConfig(config);
+  logger.setErrorReportingEnabled(config.error_reporting_enabled);
+  if (previous.auto_startup !== config.auto_startup) {
+    syncAutoStart(config);
+  }
 }

src/ipc/config/manager.ts

@@ -7,6 +7,9 @@ import { logger } from '../../utils/logger';
 const CONFIG_FILENAME = 'gui_config.json';
 
 export class ConfigManager {
+  private static cachedConfig: AppConfig | null = null;
+  private static saveQueue: Promise<void> = Promise.resolve();
+
   private static getConfigPath(): string {
     const appDataDir = getAppDataDir();
     if (!fs.existsSync(appDataDir)) {
@@ -20,6 +23,7 @@ export class ConfigManager {
       const configPath = this.getConfigPath();
       if (!fs.existsSync(configPath)) {
         logger.info(`Config: File not found at ${configPath}, returning default`);
+        this.cachedConfig = DEFAULT_APP_CONFIG;
         return DEFAULT_APP_CONFIG;
       }
 
@@ -28,7 +32,7 @@ export class ConfigManager {
 
       // Merge with default to ensure new fields are present
       // Zod parse helps validate
-      const merged = {
+      const merged: AppConfig = {
         ...DEFAULT_APP_CONFIG,
         ...raw,
         proxy: { ...DEFAULT_APP_CONFIG.proxy, ...(raw.proxy || {}) },
@@ -45,22 +49,35 @@ export class ConfigManager {
       // Handle Anthropic Mapping Map vs Object
       // In JSON it's object
 
-      return merged as AppConfig;
+      this.cachedConfig = merged;
+      return merged;
     } catch (e) {
       logger.error('Config: Failed to load config', e);
+      this.cachedConfig = DEFAULT_APP_CONFIG;
       return DEFAULT_APP_CONFIG;
     }
   }
 
-  static saveConfig(config: AppConfig): void {
-    try {
-      const configPath = this.getConfigPath();
-      const content = JSON.stringify(config, null, 2);
-      fs.writeFileSync(configPath, content, 'utf-8');
-      logger.info(`Config: Saved to ${configPath}`);
-    } catch (e) {
-      logger.error('Config: Failed to save config', e);
-      throw e;
-    }
+  static getCachedConfig(): AppConfig | null {
+    return this.cachedConfig;
+  }
+
+  static async saveConfig(config: AppConfig): Promise<void> {
+    const configPath = this.getConfigPath();
+    const content = JSON.stringify(config, null, 2);
+
+    this.saveQueue = this.saveQueue
+      .catch(() => undefined)
+      .then(async () => {
+        await fs.promises.writeFile(configPath, content, 'utf-8');
+        this.cachedConfig = config;
+        logger.info(`Config: Saved to ${configPath}`);
+      })
+      .catch((e) => {
+        logger.error('Config: Failed to save config', e);
+        throw e;
+      });
+
+    return this.saveQueue;
   }
 }

src/ipc/config/router.ts

@@ -12,6 +12,6 @@ export const configRouter = os.router({
     .input(AppConfigSchema)
     .output(z.void())
     .handler(async ({ input }) => {
-      saveConfig(input);
+      await saveConfig(input);
     }),
 });

src/ipc/database/dbConnection.ts

@@ -0,0 +1,34 @@
+import Database from 'better-sqlite3';
+import { drizzle, type BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
+import * as schema from './schema';
+
+export interface DbConfigOptions {
+  readOnly?: boolean;
+  busyTimeoutMs?: number;
+  enableWal?: boolean;
+}
+
+export interface DrizzleConnection {
+  raw: Database.Database;
+  orm: BetterSQLite3Database<typeof schema>;
+}
+
+export function configureDatabase(db: Database.Database, options: DbConfigOptions = {}): void {
+  const busyTimeoutMs = options.busyTimeoutMs ?? 3000;
+  const enableWal = options.enableWal ?? !options.readOnly;
+  if (enableWal) {
+    db.pragma('journal_mode = WAL');
+  }
+  db.pragma(`busy_timeout = ${busyTimeoutMs}`);
+}
+
+export function openDrizzleConnection(
+  dbPath: string,
+  options: Database.Options = {},
+  config: DbConfigOptions = {},
+): DrizzleConnection {
+  const raw = new Database(dbPath, options);
+  configureDatabase(raw, config);
+  const orm = drizzle(raw, { schema });
+  return { raw, orm };
+}

src/ipc/database/handler.ts

@@ -1,12 +1,47 @@
 import Database from 'better-sqlite3';
 import fs from 'fs';
-import { getAntigravityDbPaths } from '../../utils/paths';
-import { logger } from '../../utils/logger';
-import { AccountBackupData, AccountInfo } from '../../types/account';
-
 import path from 'path';
+import { eq } from 'drizzle-orm';
+import { AccountBackupData, AccountInfo } from '../../types/account';
+import { ItemTableValueRowSchema, type ItemTableKey } from '../../types/db';
+import { logger } from '../../utils/logger';
+import { getAntigravityDbPaths } from '../../utils/paths';
+import { parseRow } from '../../utils/sqlite';
+import { openDrizzleConnection } from './dbConnection';
+import { itemTable } from './schema';
 
-const KEYS_TO_BACKUP = ['antigravityAuthStatus', 'jetskiStateSync.agentManagerInitState'];
+const KEYS_TO_BACKUP: ItemTableKey[] = [
+  'antigravityAuthStatus',
+  'jetskiStateSync.agentManagerInitState',
+  'antigravityUnifiedStateSync.oauthToken',
+];
+
+function openIdeDb(dbPath: string, readOnly = false): ReturnType<typeof openDrizzleConnection> {
+  return openDrizzleConnection(
+    dbPath,
+    { readonly: readOnly, fileMustExist: false },
+    { readOnly, busyTimeoutMs: 3000 },
+  );
+}
+
+/**
+ * Initializes the database and ensures WAL mode is enabled.
+ * Should be called on application startup.
+ */
+export function initDatabase(): void {
+  try {
+    const dbPaths = getAntigravityDbPaths();
+    if (dbPaths.length === 0) {
+      return;
+    }
+
+    const { raw } = getDatabaseConnection();
+    raw.close();
+    logger.info('Database initialized and verified (WAL mode)');
+  } catch (error) {
+    logger.error('Failed to initialize database on startup', error);
+  }
+}
 
 /**
  * Ensures that the database file exists.
@@ -47,9 +82,9 @@ function ensureDatabaseExists(dbPath: string): void {
 /**
  * Gets a database connection.
  * @param dbPath {string} The path to the database file.
- * @returns {Database.Database} The database connection.
+ * @returns {ReturnType<typeof openDrizzleConnection>} The database connection.
  */
-export function getDatabaseConnection(dbPath?: string): Database.Database {
+export function getDatabaseConnection(dbPath?: string): ReturnType<typeof openDrizzleConnection> {
   const targetPath = dbPath || getAntigravityDbPaths()[0];
 
   if (!targetPath) {
@@ -59,7 +94,7 @@ export function getDatabaseConnection(dbPath?: string): Database.Database {
   ensureDatabaseExists(targetPath);
 
   try {
-    return new Database(targetPath, { readonly: false, fileMustExist: false });
+    return openIdeDb(targetPath);
   } catch (error: unknown) {
     const err = error as { code?: string };
     if (err.code === 'SQLITE_BUSY' || err.code === 'SQLITE_LOCKED') {
@@ -69,67 +104,86 @@ export function getDatabaseConnection(dbPath?: string): Database.Database {
   }
 }
 
+function readItemValue(
+  orm: ReturnType<typeof openDrizzleConnection>['orm'],
+  key: string,
+  context: string,
+): string | null {
+  const rows = orm
+    .select({ value: itemTable.value })
+    .from(itemTable)
+    .where(eq(itemTable.key, key))
+    .all();
+  const row = parseRow(ItemTableValueRowSchema, rows[0], context);
+  return row?.value ?? null;
+}
+
 /**
  * Gets the current account info.
  * @returns {AccountInfo} The current account info.
  */
 export function getCurrentAccountInfo(): AccountInfo {
   // NOTE Database existence is now handled by getDatabaseConnection
-  let db: Database.Database | null = null;
+  let connection: ReturnType<typeof openDrizzleConnection> | null = null;
   try {
-    db = getDatabaseConnection();
+    connection = getDatabaseConnection();
+    const { orm } = connection;
 
     // Query for auth status
-    const authRow = db
-      .prepare("SELECT value FROM ItemTable WHERE key = 'antigravityAuthStatus'")
-      .get() as { value: string } | undefined;
-
+    const authValue = readItemValue(
+      orm,
+      'antigravityAuthStatus',
+      'ide.itemTable.antigravityAuthStatus',
+    );
     let authStatus = null;
-    if (authRow) {
+    if (authValue) {
       try {
-        authStatus = JSON.parse(authRow.value);
+        authStatus = JSON.parse(authValue);
       } catch {
         // NOTE Ignore JSON parse errors
       }
     }
 
     // NOTE Query for user info (usually in jetskiStateSync.agentManagerInitState or similar)
-    const initRow = db
-      .prepare("SELECT value FROM ItemTable WHERE key = 'jetskiStateSync.agentManagerInitState'")
-      .get() as { value: string } | undefined;
-
+    const initValue = readItemValue(
+      orm,
+      'jetskiStateSync.agentManagerInitState',
+      'ide.itemTable.jetskiStateSync.agentManagerInitState',
+    );
     let initState = null;
-    if (initRow) {
+    if (initValue) {
       try {
-        initState = JSON.parse(initRow.value);
+        initState = JSON.parse(initValue);
       } catch {
         // Ignore JSON parse errors (this key often contains non-JSON data)
       }
     }
 
     // Query for google.antigravity
-    const googleRow = db
-      .prepare("SELECT value FROM ItemTable WHERE key = 'google.antigravity'")
-      .get() as { value: string } | undefined;
-
+    const googleValue = readItemValue(
+      orm,
+      'google.antigravity',
+      'ide.itemTable.google.antigravity',
+    );
     let googleState = null;
-    if (googleRow) {
+    if (googleValue) {
       try {
-        googleState = JSON.parse(googleRow.value);
+        googleState = JSON.parse(googleValue);
       } catch {
         // Ignore JSON parse errors
       }
     }
 
     // Query for antigravityUserSettings.allUserSettings
-    const settingsRow = db
-      .prepare("SELECT value FROM ItemTable WHERE key = 'antigravityUserSettings.allUserSettings'")
-      .get() as { value: string } | undefined;
-
+    const settingsValue = readItemValue(
+      orm,
+      'antigravityUserSettings.allUserSettings',
+      'ide.itemTable.antigravityUserSettings.allUserSettings',
+    );
     let settingsState = null;
-    if (settingsRow) {
+    if (settingsValue) {
       try {
-        settingsState = JSON.parse(settingsRow.value);
+        settingsState = JSON.parse(settingsValue);
       } catch {
         // Ignore JSON parse errors
       }
@@ -164,28 +218,28 @@ export function getCurrentAccountInfo(): AccountInfo {
     logger.error('Failed to get current account info', error);
     throw error;
   } finally {
-    if (db) db.close();
+    if (connection) {
+      connection.raw.close();
+    }
   }
 }
 
 export function backupAccount(account: AccountBackupData['account']): AccountBackupData {
-  let db: Database.Database | null = null;
+  let connection: ReturnType<typeof openDrizzleConnection> | null = null;
   try {
-    db = getDatabaseConnection();
+    connection = getDatabaseConnection();
+    const { orm } = connection;
 
     // NOTE Backup only specific keys
     const data: Record<string, unknown> = {};
 
     for (const key of KEYS_TO_BACKUP) {
-      const row = db.prepare('SELECT value FROM ItemTable WHERE key = ?').get(key) as
-        | { value: string }
-        | undefined;
-
-      if (row) {
+      const value = readItemValue(orm, key, `ide.itemTable.backup.${key}`);
+      if (value) {
         try {
-          data[key] = JSON.parse(row.value);
+          data[key] = JSON.parse(value);
         } catch {
-          data[key] = row.value;
+          data[key] = value;
         }
         logger.debug(`Backed up key: ${key}`);
       } else {
@@ -206,7 +260,9 @@ export function backupAccount(account: AccountBackupData['account']): AccountBac
     logger.error('Failed to backup account', error);
     throw error;
   } finally {
-    if (db) db.close();
+    if (connection) {
+      connection.raw.close();
+    }
   }
 }
 
@@ -257,32 +313,36 @@ function _restoreSingleDb(dbPath: string, backup: AccountBackupData): boolean {
   }
 
   logger.info(`Restoring database: ${dbPath}`);
-  let db: Database.Database | null = null;
+  let connection: ReturnType<typeof openDrizzleConnection> | null = null;
 
   try {
-    db = getDatabaseConnection(dbPath);
-
-    const insert = db.prepare('INSERT OR REPLACE INTO ItemTable (key, value) VALUES (?, ?)');
-
-    const transaction = db.transaction(() => {
+    connection = getDatabaseConnection(dbPath);
+    const { orm } = connection;
+    orm.transaction((tx) => {
       // NOTE Only restore the keys that were backed up
       for (const key of KEYS_TO_BACKUP) {
         if (key in backup.data) {
           const value = backup.data[key];
           const stringValue = typeof value === 'string' ? value : JSON.stringify(value);
-          insert.run(key, stringValue);
+          tx.insert(itemTable)
+            .values({ key, value: stringValue })
+            .onConflictDoUpdate({
+              target: itemTable.key,
+              set: { value: stringValue },
+            })
+            .run();
           logger.debug(`Restored key: ${key}`);
         }
       }
     });
-
-    transaction();
     logger.info(`Database restoration complete: ${dbPath}`);
     return true;
   } catch (error) {
     logger.error(`Failed to restore database: ${dbPath}`, error);
     return false;
   } finally {
-    if (db) db.close();
+    if (connection) {
+      connection.raw.close();
+    }
   }
 }

src/ipc/database/schema.ts

@@ -0,0 +1,27 @@
+import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core';
+
+export const accounts = sqliteTable('accounts', {
+  id: text('id').primaryKey(),
+  provider: text('provider').notNull(),
+  email: text('email').notNull(),
+  name: text('name'),
+  avatarUrl: text('avatar_url'),
+  tokenJson: text('token_json').notNull(),
+  quotaJson: text('quota_json'),
+  deviceProfileJson: text('device_profile_json'),
+  deviceHistoryJson: text('device_history_json'),
+  createdAt: integer('created_at').notNull(),
+  lastUsed: integer('last_used').notNull(),
+  status: text('status'),
+  isActive: integer('is_active').notNull().default(0),
+});
+
+export const settings = sqliteTable('settings', {
+  key: text('key').primaryKey(),
+  value: text('value').notNull(),
+});
+
+export const itemTable = sqliteTable('ItemTable', {
+  key: text('key').primaryKey(),
+  value: text('value'),
+});

src/ipc/device/handler.ts

@@ -0,0 +1,715 @@
+import Database from 'better-sqlite3';
+import fs from 'fs';
+import path from 'path';
+import { createHash, randomBytes } from 'crypto';
+import { type DeviceProfile } from '../../types/account';
+import { logger } from '../../utils/logger';
+import { getAgentDir, getAntigravityDbPaths, getAntigravityStoragePaths } from '../../utils/paths';
+
+const GLOBAL_BASELINE_FILE = 'device_original.json';
+const SQLITE_RETRY_COUNT = 3;
+const LAST_KNOWN_GOOD_DIR = 'device_last_known_good';
+const LAST_KNOWN_GOOD_STORAGE_FILE = 'storage.json';
+const LAST_KNOWN_GOOD_STATE_DB_FILE = 'state.vscdb';
+const LAST_KNOWN_GOOD_MARKER_FILE = 'marker.json';
+const DEVICE_HARDENING_SAFE_MODE_THRESHOLD = 3;
+const DEVICE_HARDENING_SAFE_MODE_DURATION_MS = 5 * 60 * 1000;
+
+export type DeviceApplyFailureReason =
+  | 'backup_failed'
+  | 'storage_write_failed'
+  | 'state_sync_failed'
+  | 'verify_storage_failed'
+  | 'verify_state_failed'
+  | 'snapshot_update_failed'
+  | 'rollback_failed'
+  | 'unknown';
+
+export interface DeviceHardeningSnapshot {
+  consecutiveApplyFailures: number;
+  safeModeActive: boolean;
+  safeModeUntil: number | null;
+  lastFailureReason: DeviceApplyFailureReason | null;
+  lastFailureStage: string | null;
+  lastFailureAt: number | null;
+}
+
+const UUID_V4_REGEX =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const SQM_ID_REGEX =
+  /^\{[0-9A-F]{8}-[0-9A-F]{4}-4[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}\}$/;
+
+interface DeviceProfileTemplate {
+  machineIdPrefix: string;
+  machineIdHexLength: number;
+}
+
+const DEFAULT_PROFILE_TEMPLATE: DeviceProfileTemplate = {
+  machineIdPrefix: 'auth0|user_',
+  machineIdHexLength: 32,
+};
+
+const DEVICE_PROFILE_TEMPLATES: Record<string, DeviceProfileTemplate[]> = {
+  win32: [DEFAULT_PROFILE_TEMPLATE],
+  linux: [DEFAULT_PROFILE_TEMPLATE],
+  darwin: [DEFAULT_PROFILE_TEMPLATE],
+};
+
+interface LastKnownGoodMarker {
+  version: 1;
+  savedAt: number;
+  hasStateDb: boolean;
+}
+
+interface DeviceHardeningState {
+  consecutiveApplyFailures: number;
+  safeModeUntil: number | null;
+  lastFailureReason: DeviceApplyFailureReason | null;
+  lastFailureStage: string | null;
+  lastFailureAt: number | null;
+}
+
+const deviceHardeningState: DeviceHardeningState = {
+  consecutiveApplyFailures: 0,
+  safeModeUntil: null,
+  lastFailureReason: null,
+  lastFailureStage: null,
+  lastFailureAt: null,
+};
+
+function isSqliteBusyError(error: unknown): boolean {
+  if (!error || typeof error !== 'object') {
+    return false;
+  }
+  const candidate = error as { code?: string; message?: string };
+  if (candidate.code === 'SQLITE_BUSY' || candidate.code === 'SQLITE_LOCKED') {
+    return true;
+  }
+  if (typeof candidate.message === 'string') {
+    return candidate.message.includes('SQLITE_BUSY') || candidate.message.includes('SQLITE_LOCKED');
+  }
+  return false;
+}
+
+function resolveExistingPath(paths: string[]): string | null {
+  for (const targetPath of paths) {
+    if (fs.existsSync(targetPath)) {
+      return targetPath;
+    }
+  }
+  return null;
+}
+
+function randomHex(length: number): string {
+  return randomBytes(Math.ceil(length / 2))
+    .toString('hex')
+    .slice(0, length)
+    .toLowerCase();
+}
+
+function getLastKnownGoodSnapshotDir(): string {
+  return path.join(getAgentDir(), LAST_KNOWN_GOOD_DIR);
+}
+
+function getLastKnownGoodStoragePath(): string {
+  return path.join(getLastKnownGoodSnapshotDir(), LAST_KNOWN_GOOD_STORAGE_FILE);
+}
+
+function getLastKnownGoodStateDbPath(): string {
+  return path.join(getLastKnownGoodSnapshotDir(), LAST_KNOWN_GOOD_STATE_DB_FILE);
+}
+
+function getLastKnownGoodMarkerPath(): string {
+  return path.join(getLastKnownGoodSnapshotDir(), LAST_KNOWN_GOOD_MARKER_FILE);
+}
+
+function ensureDirectoryExists(dirPath: string): void {
+  if (!fs.existsSync(dirPath)) {
+    fs.mkdirSync(dirPath, { recursive: true });
+  }
+}
+
+function readLastKnownGoodMarker(): LastKnownGoodMarker | null {
+  const markerPath = getLastKnownGoodMarkerPath();
+  if (!fs.existsSync(markerPath)) {
+    return null;
+  }
+
+  try {
+    const content = fs.readFileSync(markerPath, 'utf-8');
+    const parsed = JSON.parse(content) as Partial<LastKnownGoodMarker>;
+    if (
+      parsed &&
+      parsed.version === 1 &&
+      typeof parsed.savedAt === 'number' &&
+      typeof parsed.hasStateDb === 'boolean'
+    ) {
+      return {
+        version: 1,
+        savedAt: parsed.savedAt,
+        hasStateDb: parsed.hasStateDb,
+      };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+function parseStorageJson(storagePath: string): Record<string, unknown> {
+  const content = fs.readFileSync(storagePath, 'utf-8');
+  const parsed = JSON.parse(content);
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error('storage.json top-level value must be an object');
+  }
+  return parsed as Record<string, unknown>;
+}
+
+function getTelemetryField(storage: Record<string, unknown>, key: string): string | null {
+  const telemetry = storage.telemetry;
+  if (telemetry && typeof telemetry === 'object' && !Array.isArray(telemetry)) {
+    const nestedValue = (telemetry as Record<string, unknown>)[key];
+    if (typeof nestedValue === 'string' && nestedValue.length > 0) {
+      return nestedValue;
+    }
+  }
+
+  const flatValue = storage[`telemetry.${key}`];
+  if (typeof flatValue === 'string' && flatValue.length > 0) {
+    return flatValue;
+  }
+
+  return null;
+}
+
+function ensureTelemetryObject(storage: Record<string, unknown>): Record<string, unknown> {
+  if (!storage.telemetry || typeof storage.telemetry !== 'object' || Array.isArray(storage.telemetry)) {
+    storage.telemetry = {};
+  }
+  return storage.telemetry as Record<string, unknown>;
+}
+
+function getStateDbPathFromStorage(storagePath: string): string {
+  return path.join(path.dirname(storagePath), 'state.vscdb');
+}
+
+function getGlobalBaselinePath(): string {
+  return path.join(getAgentDir(), GLOBAL_BASELINE_FILE);
+}
+
+function writeJsonAtomically(filePath: string, payload: unknown): void {
+  const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+  const content = `${JSON.stringify(payload, null, 2)}\n`;
+  fs.writeFileSync(tempPath, content, 'utf-8');
+  try {
+    fs.renameSync(tempPath, filePath);
+  } catch {
+    fs.copyFileSync(tempPath, filePath);
+    fs.unlinkSync(tempPath);
+  }
+}
+
+function readStateServiceMachineIdValue(dbPath: string): string | null {
+  if (!fs.existsSync(dbPath)) {
+    return null;
+  }
+
+  let db: Database.Database | null = null;
+  try {
+    db = new Database(dbPath, { readonly: true, fileMustExist: true });
+    db.pragma('busy_timeout = 3000');
+    const row = db
+      .prepare("SELECT value FROM ItemTable WHERE key = 'storage.serviceMachineId' LIMIT 1")
+      .get() as { value?: unknown } | undefined;
+    if (!row || typeof row.value !== 'string' || row.value.length === 0) {
+      return null;
+    }
+    return row.value;
+  } catch (error) {
+    logger.warn('Failed to read state.serviceMachineId from state.vscdb', error);
+    return null;
+  } finally {
+    if (db) {
+      db.close();
+    }
+  }
+}
+
+function ensureStorageProfileApplied(profile: DeviceProfile, storagePath: string): void {
+  const applied = readCurrentDeviceProfile(storagePath);
+  const isMatched =
+    applied.machineId === profile.machineId &&
+    applied.macMachineId === profile.macMachineId &&
+    applied.devDeviceId === profile.devDeviceId &&
+    applied.sqmId === profile.sqmId;
+  if (!isMatched) {
+    throw new Error('device_profile_integrity_check_failed_for_storage');
+  }
+}
+
+function ensureStateServiceMachineIdApplied(serviceMachineId: string, dbPath: string): void {
+  const value = readStateServiceMachineIdValue(dbPath);
+  if (value !== serviceMachineId) {
+    throw new Error('device_profile_integrity_check_failed_for_state_db');
+  }
+}
+
+function cleanupPathIfExists(targetPath: string): void {
+  if (fs.existsSync(targetPath)) {
+    fs.rmSync(targetPath, { force: true });
+  }
+}
+
+function cleanupStateDbJournalFiles(dbPath: string): void {
+  cleanupPathIfExists(`${dbPath}-wal`);
+  cleanupPathIfExists(`${dbPath}-shm`);
+}
+
+function pickDeviceProfileTemplate(): DeviceProfileTemplate {
+  const templates = DEVICE_PROFILE_TEMPLATES[process.platform] || [DEFAULT_PROFILE_TEMPLATE];
+  const randomIndex = Number.parseInt(randomHex(2), 16) % templates.length;
+  return templates[randomIndex];
+}
+
+function deterministicUuidFromSeed(seed: string, namespace: string): string {
+  const hash = createHash('sha256')
+    .update(`${namespace}:${seed}`)
+    .digest();
+  const bytes = Buffer.from(hash.subarray(0, 16));
+
+  bytes[6] = (bytes[6] & 0x0f) | 0x40;
+  bytes[8] = (bytes[8] & 0x3f) | 0x80;
+
+  const hex = bytes.toString('hex');
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20, 32),
+  ].join('-');
+}
+
+function ensureGeneratedProfile(profile: DeviceProfile, template: DeviceProfileTemplate): void {
+  const machineIdPrefix = template.machineIdPrefix;
+  const machineIdSuffix = profile.machineId.slice(machineIdPrefix.length);
+
+  if (!profile.machineId.startsWith(machineIdPrefix)) {
+    throw new Error('generated_profile_machine_id_prefix_invalid');
+  }
+  if (machineIdSuffix.length !== template.machineIdHexLength) {
+    throw new Error('generated_profile_machine_id_length_invalid');
+  }
+  if (!/^[0-9a-f]+$/.test(machineIdSuffix)) {
+    throw new Error('generated_profile_machine_id_suffix_invalid');
+  }
+  if (!UUID_V4_REGEX.test(profile.macMachineId)) {
+    throw new Error('generated_profile_mac_machine_id_invalid');
+  }
+  if (!UUID_V4_REGEX.test(profile.devDeviceId)) {
+    throw new Error('generated_profile_dev_device_id_invalid');
+  }
+  if (!SQM_ID_REGEX.test(profile.sqmId)) {
+    throw new Error('generated_profile_sqm_id_invalid');
+  }
+  if (profile.macMachineId === profile.devDeviceId) {
+    throw new Error('generated_profile_uuid_collision');
+  }
+}
+
+function ensureStorageStateConsistency(
+  storagePath: string,
+  stateDbPath: string,
+  expectedStateDb: boolean,
+  requireStateMachineIdMatch: boolean = true,
+): void {
+  const profile = readCurrentDeviceProfile(storagePath);
+  const hasStateDb = fs.existsSync(stateDbPath);
+
+  if (expectedStateDb && !hasStateDb) {
+    throw new Error('state_vscdb_missing_after_restore');
+  }
+  if (!hasStateDb) {
+    return;
+  }
+
+  const stateValue = readStateServiceMachineIdValue(stateDbPath);
+  if (!requireStateMachineIdMatch && !stateValue) {
+    return;
+  }
+  if (stateValue !== profile.devDeviceId) {
+    throw new Error('storage_state_service_machine_id_mismatch');
+  }
+}
+
+function saveLastKnownGoodSnapshot(storagePath: string, stateDbPath: string): void {
+  const snapshotDir = getLastKnownGoodSnapshotDir();
+  ensureDirectoryExists(snapshotDir);
+
+  const storageSnapshotPath = getLastKnownGoodStoragePath();
+  const stateDbSnapshotPath = getLastKnownGoodStateDbPath();
+  const markerPath = getLastKnownGoodMarkerPath();
+  const hasStateDb = fs.existsSync(stateDbPath);
+
+  fs.copyFileSync(storagePath, storageSnapshotPath);
+  if (hasStateDb) {
+    fs.copyFileSync(stateDbPath, stateDbSnapshotPath);
+  } else {
+    cleanupPathIfExists(stateDbSnapshotPath);
+  }
+
+  const marker: LastKnownGoodMarker = {
+    version: 1,
+    savedAt: Date.now(),
+    hasStateDb,
+  };
+  writeJsonAtomically(markerPath, marker);
+}
+
+function restoreLastKnownGoodSnapshot(storagePath: string, stateDbPath: string): boolean {
+  const marker = readLastKnownGoodMarker();
+  if (!marker) {
+    return false;
+  }
+
+  const storageSnapshotPath = getLastKnownGoodStoragePath();
+  const stateDbSnapshotPath = getLastKnownGoodStateDbPath();
+
+  if (!fs.existsSync(storageSnapshotPath)) {
+    return false;
+  }
+
+  try {
+    fs.copyFileSync(storageSnapshotPath, storagePath);
+    if (marker.hasStateDb && fs.existsSync(stateDbSnapshotPath)) {
+      fs.copyFileSync(stateDbSnapshotPath, stateDbPath);
+    } else {
+      cleanupPathIfExists(stateDbPath);
+      cleanupStateDbJournalFiles(stateDbPath);
+    }
+    ensureStorageStateConsistency(storagePath, stateDbPath, marker.hasStateDb);
+    return true;
+  } catch (error) {
+    logger.error('Failed to restore last known good device snapshot', error);
+    return false;
+  }
+}
+
+function classifyApplyFailure(stage: string, error: unknown): DeviceApplyFailureReason {
+  if (stage === 'prepare_backup') {
+    return 'backup_failed';
+  }
+  if (stage === 'prepare_write_storage') {
+    return 'storage_write_failed';
+  }
+  if (stage === 'prepare_sync_state') {
+    return 'state_sync_failed';
+  }
+  if (stage === 'verify_storage') {
+    return 'verify_storage_failed';
+  }
+  if (stage === 'verify_state') {
+    return 'verify_state_failed';
+  }
+  if (stage === 'commit_snapshot') {
+    return 'snapshot_update_failed';
+  }
+  if (stage === 'rollback') {
+    return 'rollback_failed';
+  }
+
+  if (error instanceof Error) {
+    if (error.message.includes('device_profile_integrity_check_failed_for_storage')) {
+      return 'verify_storage_failed';
+    }
+    if (error.message.includes('device_profile_integrity_check_failed_for_state_db')) {
+      return 'verify_state_failed';
+    }
+  }
+  return 'unknown';
+}
+
+function markApplySuccess(): void {
+  deviceHardeningState.consecutiveApplyFailures = 0;
+  deviceHardeningState.safeModeUntil = null;
+}
+
+function markApplyFailure(reason: DeviceApplyFailureReason, stage: string): void {
+  const now = Date.now();
+  deviceHardeningState.consecutiveApplyFailures += 1;
+  deviceHardeningState.lastFailureReason = reason;
+  deviceHardeningState.lastFailureStage = stage;
+  deviceHardeningState.lastFailureAt = now;
+  if (deviceHardeningState.consecutiveApplyFailures >= DEVICE_HARDENING_SAFE_MODE_THRESHOLD) {
+    deviceHardeningState.safeModeUntil = now + DEVICE_HARDENING_SAFE_MODE_DURATION_MS;
+  }
+}
+
+function isSafeModeActiveNow(): boolean {
+  if (!deviceHardeningState.safeModeUntil) {
+    return false;
+  }
+  const active = Date.now() < deviceHardeningState.safeModeUntil;
+  if (!active) {
+    deviceHardeningState.safeModeUntil = null;
+  }
+  return active;
+}
+
+function buildApplyError(
+  reason: DeviceApplyFailureReason,
+  stage: string,
+  original: unknown,
+): Error {
+  const message = original instanceof Error ? original.message : String(original);
+  const wrapped = new Error(`device_apply_failed:${reason}:${stage}:${message}`);
+  (wrapped as Error & { deviceFailureReason?: DeviceApplyFailureReason; deviceFailureStage?: string })
+    .deviceFailureReason = reason;
+  (wrapped as Error & { deviceFailureReason?: DeviceApplyFailureReason; deviceFailureStage?: string })
+    .deviceFailureStage = stage;
+  return wrapped;
+}
+
+export function getDeviceHardeningSnapshot(): DeviceHardeningSnapshot {
+  const safeModeActive = isSafeModeActiveNow();
+  return {
+    consecutiveApplyFailures: deviceHardeningState.consecutiveApplyFailures,
+    safeModeActive,
+    safeModeUntil: safeModeActive ? deviceHardeningState.safeModeUntil : null,
+    lastFailureReason: deviceHardeningState.lastFailureReason,
+    lastFailureStage: deviceHardeningState.lastFailureStage,
+    lastFailureAt: deviceHardeningState.lastFailureAt,
+  };
+}
+
+export function isIdentityProfileApplyEnabled(): boolean {
+  const raw =
+    process.env.CRACK_IDENTITY_PROFILE_APPLY_ENABLED ??
+    process.env.CRACK_DEVICE_FINGERPRINT_ENABLED;
+  if (!raw) {
+    return !isSafeModeActiveNow();
+  }
+  const normalized = raw.trim().toLowerCase();
+  const envEnabled = (
+    normalized !== '0' &&
+    normalized !== 'false' &&
+    normalized !== 'off' &&
+    normalized !== 'no'
+  );
+  if (!envEnabled) {
+    return false;
+  }
+  return !isSafeModeActiveNow();
+}
+
+export function getStoragePath(): string {
+  const storagePath = resolveExistingPath(getAntigravityStoragePaths());
+  if (!storagePath) {
+    throw new Error('storage_json_not_found');
+  }
+  return storagePath;
+}
+
+export function getStorageDirectoryPath(): string {
+  return path.dirname(getStoragePath());
+}
+
+export function loadGlobalOriginalProfile(): DeviceProfile | null {
+  const baselinePath = getGlobalBaselinePath();
+  if (!fs.existsSync(baselinePath)) {
+    return null;
+  }
+
+  try {
+    const raw = fs.readFileSync(baselinePath, 'utf-8');
+    return JSON.parse(raw) as DeviceProfile;
+  } catch (error) {
+    logger.warn('Failed to load global original device profile', error);
+    return null;
+  }
+}
+
+export function saveGlobalOriginalProfile(profile: DeviceProfile): void {
+  const baselinePath = getGlobalBaselinePath();
+  const baselineDir = path.dirname(baselinePath);
+  if (!fs.existsSync(baselineDir)) {
+    fs.mkdirSync(baselineDir, { recursive: true });
+  }
+  if (fs.existsSync(baselinePath)) {
+    return;
+  }
+  fs.writeFileSync(baselinePath, JSON.stringify(profile, null, 2), 'utf-8');
+}
+
+export function readCurrentDeviceProfile(storagePath?: string): DeviceProfile {
+  const targetPath = storagePath || getStoragePath();
+  const storage = parseStorageJson(targetPath);
+
+  const machineId = getTelemetryField(storage, 'machineId');
+  const macMachineId = getTelemetryField(storage, 'macMachineId');
+  const devDeviceId = getTelemetryField(storage, 'devDeviceId');
+  const sqmId = getTelemetryField(storage, 'sqmId');
+
+  if (!machineId || !macMachineId || !devDeviceId || !sqmId) {
+    throw new Error('missing_device_fingerprint_fields');
+  }
+
+  return {
+    machineId,
+    macMachineId,
+    devDeviceId,
+    sqmId,
+  };
+}
+
+export function ensureGlobalOriginalFromCurrentStorage(): void {
+  if (loadGlobalOriginalProfile()) {
+    return;
+  }
+
+  try {
+    const profile = readCurrentDeviceProfile();
+    saveGlobalOriginalProfile(profile);
+  } catch (error) {
+    logger.warn('Failed to capture baseline device profile from storage.json', error);
+  }
+}
+
+export function generateDeviceProfile(): DeviceProfile {
+  const template = pickDeviceProfileTemplate();
+  const seed = randomHex(32);
+  const profile: DeviceProfile = {
+    machineId: `${template.machineIdPrefix}${seed.slice(0, template.machineIdHexLength)}`,
+    macMachineId: deterministicUuidFromSeed(seed, 'mac'),
+    devDeviceId: deterministicUuidFromSeed(seed, 'dev'),
+    sqmId: `{${deterministicUuidFromSeed(seed, 'sqm').toUpperCase()}}`,
+  };
+  ensureGeneratedProfile(profile, template);
+  return profile;
+}
+
+export function syncStateServiceMachineIdValue(serviceMachineId: string, dbPath?: string): void {
+  const targetDbPath = dbPath || resolveExistingPath(getAntigravityDbPaths());
+  if (!targetDbPath) {
+    throw new Error('state_vscdb_not_found');
+  }
+
+  const targetDbDir = path.dirname(targetDbPath);
+  if (!fs.existsSync(targetDbDir)) {
+    fs.mkdirSync(targetDbDir, { recursive: true });
+  }
+
+  for (let attempt = 1; attempt <= SQLITE_RETRY_COUNT; attempt += 1) {
+    let db: Database.Database | null = null;
+    try {
+      db = new Database(targetDbPath);
+      db.pragma('busy_timeout = 3000');
+      db.exec('CREATE TABLE IF NOT EXISTS ItemTable (key TEXT PRIMARY KEY, value TEXT);');
+      db.prepare("INSERT OR REPLACE INTO ItemTable (key, value) VALUES ('storage.serviceMachineId', ?)")
+        .run(serviceMachineId);
+      return;
+    } catch (error) {
+      if (isSqliteBusyError(error) && attempt < SQLITE_RETRY_COUNT) {
+        logger.warn(`state.vscdb busy, retrying (${attempt}/${SQLITE_RETRY_COUNT})`, error);
+        continue;
+      }
+      throw error;
+    } finally {
+      if (db) {
+        db.close();
+      }
+    }
+  }
+
+  throw new Error('sync_state_service_machine_id_failed');
+}
+
+export function applyDeviceProfile(profile: DeviceProfile): string {
+  const storagePath = getStoragePath();
+  const backupPath = `${storagePath}.backup`;
+  const stateDbPath = getStateDbPathFromStorage(storagePath);
+  const stateBackupPath = `${stateDbPath}.backup`;
+  const hadStateDb = fs.existsSync(stateDbPath);
+  let stage = 'prepare_backup';
+
+  try {
+    fs.copyFileSync(storagePath, backupPath);
+    if (hadStateDb) {
+      fs.copyFileSync(stateDbPath, stateBackupPath);
+    }
+
+    stage = 'prepare_write_storage';
+    const storage = parseStorageJson(storagePath);
+    const telemetry = ensureTelemetryObject(storage);
+
+    telemetry.machineId = profile.machineId;
+    telemetry.macMachineId = profile.macMachineId;
+    telemetry.devDeviceId = profile.devDeviceId;
+    telemetry.sqmId = profile.sqmId;
+
+    storage['telemetry.machineId'] = profile.machineId;
+    storage['telemetry.macMachineId'] = profile.macMachineId;
+    storage['telemetry.devDeviceId'] = profile.devDeviceId;
+    storage['telemetry.sqmId'] = profile.sqmId;
+    storage['storage.serviceMachineId'] = profile.devDeviceId;
+
+    writeJsonAtomically(storagePath, storage);
+
+    stage = 'prepare_sync_state';
+    syncStateServiceMachineIdValue(profile.devDeviceId, stateDbPath);
+
+    stage = 'verify_storage';
+    ensureStorageProfileApplied(profile, storagePath);
+
+    stage = 'verify_state';
+    ensureStateServiceMachineIdApplied(profile.devDeviceId, stateDbPath);
+
+    stage = 'commit_snapshot';
+    try {
+      saveLastKnownGoodSnapshot(storagePath, stateDbPath);
+    } catch (snapshotError) {
+      logger.warn('Failed to update last known good device snapshot', snapshotError);
+    }
+
+    cleanupPathIfExists(backupPath);
+    cleanupPathIfExists(stateBackupPath);
+    markApplySuccess();
+    return storagePath;
+  } catch (error) {
+    const classifiedReason = classifyApplyFailure(stage, error);
+    markApplyFailure(classifiedReason, stage);
+
+    let rollbackStage = 'rollback_immediate_backup';
+    let restoredFromImmediateBackup = false;
+    try {
+      if (fs.existsSync(backupPath)) {
+        fs.copyFileSync(backupPath, storagePath);
+      }
+      if (hadStateDb && fs.existsSync(stateBackupPath)) {
+        fs.copyFileSync(stateBackupPath, stateDbPath);
+      }
+      if (!hadStateDb) {
+        cleanupPathIfExists(stateDbPath);
+        cleanupStateDbJournalFiles(stateDbPath);
+      }
+      ensureStorageStateConsistency(storagePath, stateDbPath, hadStateDb, false);
+      restoredFromImmediateBackup = true;
+    } catch (restoreError) {
+      logger.error('Failed to restore device profile from immediate backup', restoreError);
+      rollbackStage = 'rollback_last_known_good';
+    }
+
+    if (!restoredFromImmediateBackup) {
+      const restoredFromLastKnownGood = restoreLastKnownGoodSnapshot(storagePath, stateDbPath);
+      if (!restoredFromLastKnownGood) {
+        logger.error('Failed to restore device profile from last known good snapshot');
+        markApplyFailure('rollback_failed', rollbackStage);
+      }
+    }
+
+    throw buildApplyError(classifiedReason, stage, error);
+  } finally {
+    cleanupPathIfExists(backupPath);
+    cleanupPathIfExists(stateBackupPath);
+  }
+}

src/ipc/gateway/handlers.ts

@@ -5,6 +5,7 @@
 import { bootstrapNestServer, stopNestServer, getNestServerStatus } from '../../server/main';
 import { ConfigManager } from '../config/manager';
 import { v4 as uuidv4 } from 'uuid';
+import { logger } from '../../utils/logger';
 
 /**
  * Start the gateway server (NestJS)
@@ -20,7 +21,7 @@ export const startGateway = async (port: number): Promise<boolean> => {
 
     return await bootstrapNestServer(proxyConfig);
   } catch (e) {
-    console.error('Failed to start gateway:', e);
+    logger.error('Failed to start gateway:', e);
     return false;
   }
 };
@@ -32,7 +33,7 @@ export const stopGateway = async (): Promise<boolean> => {
   try {
     return await stopNestServer();
   } catch (e) {
-    console.error('Failed to stop gateway:', e);
+    logger.error('Failed to stop gateway:', e);
     return false;
   }
 };
@@ -53,7 +54,7 @@ export const generateApiKey = async (): Promise<string> => {
   // Save to config
   const config = ConfigManager.loadConfig();
   config.proxy.api_key = newKey;
-  ConfigManager.saveConfig(config);
+  await ConfigManager.saveConfig(config);
 
   return newKey;
 };

src/ipc/handler.ts

@@ -28,7 +28,7 @@ try {
     logger.info(`Database router check: ${!!db}`);
   }
 } catch (e) {
-  console.error('Error logging router:', e);
+  logger.error('Error logging router:', e);
 }
 
 export const rpcHandler: RPCHandler<Record<never, never>> = new RPCHandler(router);

src/ipc/manager.ts

@@ -78,7 +78,7 @@ function createIPCClient(port: MessagePort) {
           pendingRequests.delete(id);
           reject(new Error(`Request /${methodPath} timed out`));
         }
-      }, 10000);
+      }, 60000);
     });
   }
 

src/ipc/process/handler.ts

@@ -1,63 +1,166 @@
 import { exec, execSync } from 'child_process';
 import { promisify } from 'util';
+import findProcess, { ProcessInfo } from 'find-process';
 import { getAntigravityExecutablePath, isWsl } from '../../utils/paths';
 import { logger } from '../../utils/logger';
 
 const execAsync = promisify(exec);
 
+/**
+ * Helper process name patterns to exclude (Electron helper processes)
+ */
+const HELPER_PATTERNS = [
+  'helper',
+  'plugin',
+  'renderer',
+  'gpu',
+  'crashpad',
+  'utility',
+  'audio',
+  'sandbox',
+  'language_server',
+];
+
+/**
+ * Check if a process is a helper/auxiliary process that should be excluded.
+ * @param name Process name (lowercase)
+ * @param cmd Process command line (lowercase)
+ * @returns True if the process is a helper process
+ */
+function isHelperProcess(name: string, cmd: string): boolean {
+  const nameLower = name.toLowerCase();
+  const cmdLower = cmd.toLowerCase();
+
+  // Check for --type= argument (Electron helper process indicator)
+  if (cmdLower.includes('--type=')) {
+    return true;
+  }
+
+  // Check for helper patterns in process name
+  for (const pattern of HELPER_PATTERNS) {
+    if (nameLower.includes(pattern)) {
+      return true;
+    }
+  }
+
+  // Check for crashpad in path
+  if (cmdLower.includes('crashpad')) {
+    return true;
+  }
+
+  return false;
+}
+
+function isPgrepNoMatchError(error: unknown): boolean {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+
+  const message = error.message.toLowerCase();
+  const hasPgrep = message.includes('pgrep') && message.includes('antigravity');
+  const code = (error as { code?: number }).code;
+  return hasPgrep && code === 1;
+}
+
 /**
  * Checks if the Antigravity process is running.
+ * Uses find-process package for robust cross-platform process detection.
  * @returns {boolean} True if the Antigravity process is running, false otherwise.
  */
 export async function isProcessRunning(): Promise<boolean> {
   try {
     const platform = process.platform;
-    let command = '';
+    const currentPid = process.pid;
 
-    if (platform === 'win32' || isWsl()) {
-      // Use absolute path for tasklist to be safe on Windows too
-      const cmd = isWsl()
-        ? '/mnt/c/Windows/System32/tasklist.exe'
-        : process.env.SystemRoot // Usually C:\Windows
-          ? `${process.env.SystemRoot}\\System32\\tasklist.exe`
-          : 'tasklist';
+    // Use find-process to search for Antigravity processes
+    // 'name' search type matches process name
+    const processMap = new Map<number, ProcessInfo>();
+    const searchNames = ['Antigravity', 'antigravity'];
+    let sawNoMatch = false;
 
-      command = `${cmd} /FI "IMAGENAME eq Antigravity.exe" /NH`;
-    } else {
-      // macOS and Linux (native)
-      command = 'pgrep -xi Antigravity';
+    for (const searchName of searchNames) {
+      try {
+        const matches = await findProcess('name', searchName, true);
+        for (const proc of matches) {
+          if (typeof proc.pid === 'number') {
+            processMap.set(proc.pid, proc);
+          }
+        }
+      } catch (error) {
+        if (isPgrepNoMatchError(error)) {
+          sawNoMatch = true;
+          continue;
+        }
+        throw error;
+      }
     }
 
-    logger.debug(`Checking process with command: ${command}`);
-    // Increased timeout to 4000ms to avoid flakiness with tasklist/wmic
-    try {
-      const { stdout } = await execAsync(command, { timeout: 4000 });
-      logger.debug(`Process check stdout: ${stdout.trim()}`);
+    const processes = Array.from(processMap.values());
+    if (processes.length === 0 && sawNoMatch) {
+      logger.debug('No Antigravity process found (pgrep returned 1)');
+    }
 
-      if (platform === 'win32' || isWsl()) {
-        return stdout.includes('Antigravity.exe');
-      } else {
-        // pgrep returns PIDs if found, empty if not
-        return stdout.trim().length > 0;
+    logger.debug(`Found ${processes.length} processes matching 'Antigravity/antigravity'`);
+
+    for (const proc of processes) {
+      // Skip self
+      if (proc.pid === currentPid) {
+        continue;
       }
-    } catch (cmdError) {
-      if (platform === 'win32' && !isWsl()) {
-        logger.warn('tasklist failed, trying wmic fallback...', cmdError);
-        // Fallback to wmic (filtered)
-        try {
-          const wmicCmd = 'wmic process where "name=\'Antigravity.exe\'" get ProcessId';
-          const { stdout } = await execAsync(wmicCmd, { timeout: 4000 });
-          return stdout.includes('ProcessId');
-        } catch (wmicError) {
-          logger.error('wmic fallback also failed', wmicError);
-          return false;
+
+      const name = proc.name?.toLowerCase() || '';
+      const cmd = proc.cmd?.toLowerCase() || '';
+
+      // Skip manager process
+      if (
+        name.includes('manager') ||
+        cmd.includes('manager') ||
+        cmd.includes('antigravity-manager')
+      ) {
+        continue;
+      }
+
+      // Skip helper processes
+      if (isHelperProcess(name, cmd)) {
+        continue;
+      }
+
+      if (platform === 'darwin') {
+        // macOS: Check for Antigravity.app in path
+        if (cmd.includes('antigravity.app')) {
+          logger.debug(
+            `Found Antigravity process: PID=${proc.pid}, name=${name}, cmd=${cmd.substring(0, 100)}`,
+          );
+          return true;
+        }
+        // Also check if the process name is exactly 'Antigravity' (main process)
+        if (name === 'antigravity' && !isHelperProcess(name, cmd)) {
+          logger.debug(`Found Antigravity process: PID=${proc.pid}, name=${name}`);
+          return true;
+        }
+      } else if (platform === 'win32') {
+        // Windows: Check for Antigravity.exe
+        if (name === 'antigravity.exe' || name === 'antigravity') {
+          logger.debug(`Found Antigravity process: PID=${proc.pid}, name=${name}`);
+          return true;
+        }
+      } else {
+        // Linux: Check for antigravity in name or path (but not tools)
+        if (
+          (name.includes('antigravity') || cmd.includes('/antigravity')) &&
+          !name.includes('tools')
+        ) {
+          logger.debug(
+            `Found Antigravity process: PID=${proc.pid}, name=${name}, cmd=${cmd.substring(0, 100)}`,
+          );
+          return true;
         }
       }
-      throw cmdError;
     }
+
+    return false;
   } catch (error) {
-    logger.error('Error checking process status:', error);
-    // pgrep returns exit code 1 if no process found
+    logger.error('Error checking process status with find-process:', error);
     return false;
   }
 }

src/ipc/router.ts

@@ -11,6 +11,7 @@ import { os } from '@orpc/server';
 import { z } from 'zod';
 import { isProcessRunning, closeAntigravity, startAntigravity } from './process/handler';
 import { systemHandler } from './system/handler';
+import { logger } from '../utils/logger';
 
 // Log middleware setup
 const logMiddleware = os.middleware(async (opts: any) => {
@@ -21,7 +22,7 @@ const logMiddleware = os.middleware(async (opts: any) => {
     const result = await next({});
     return result;
   } catch (err) {
-    console.error(`[ORPC] Error in handler for ${JSON.stringify(requestPath)}:`, err);
+    logger.error(`[ORPC] Error in handler for ${JSON.stringify(requestPath)}:`, err);
     throw err;
   }
 });

src/ipc/switchFlow.ts

@@ -0,0 +1,91 @@
+import { type DeviceProfile } from '../types/account';
+import { logger } from '../utils/logger';
+import { closeAntigravity, startAntigravity, _waitForProcessExit } from './process/handler';
+import { applyDeviceProfile } from './device/handler';
+import { type SwitchFailureReason, recordSwitchFailure, recordSwitchSuccess } from './switchMetrics';
+
+export interface SwitchFlowOptions {
+  scope: 'local' | 'cloud';
+  targetProfile: DeviceProfile | null;
+  applyFingerprint: boolean;
+  processExitTimeoutMs: number;
+  performSwitch: () => Promise<void>;
+}
+
+function getErrorMessage(error: unknown): string {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return String(error);
+}
+
+function toSwitchFailureReason(stage: string, error: unknown): SwitchFailureReason {
+  if (stage === 'close') {
+    return 'process_close_failed';
+  }
+  if (stage === 'missing_profile') {
+    return 'missing_bound_profile';
+  }
+  if (stage === 'apply') {
+    return 'apply_device_profile_failed';
+  }
+  if (stage === 'switch') {
+    return 'perform_switch_failed';
+  }
+  if (stage === 'start') {
+    return 'start_process_failed';
+  }
+
+  // Keep legacy compatibility with reason encoded in thrown errors.
+  if (error instanceof Error && error.message.includes('missing bound device profile')) {
+    return 'missing_bound_profile';
+  }
+  if (error instanceof Error && error.message.includes('device_apply_failed')) {
+    return 'apply_device_profile_failed';
+  }
+  return 'unknown';
+}
+
+export async function executeSwitchFlow(options: SwitchFlowOptions): Promise<void> {
+  const {
+    scope,
+    targetProfile,
+    applyFingerprint,
+    processExitTimeoutMs,
+    performSwitch,
+  } = options;
+
+  let stage = 'close';
+  try {
+    await closeAntigravity();
+    try {
+      await _waitForProcessExit(processExitTimeoutMs);
+    } catch (error) {
+      logger.warn('Process did not exit cleanly within timeout, but proceeding...', error);
+    }
+
+    stage = 'apply';
+    if (applyFingerprint) {
+      if (!targetProfile) {
+        stage = 'missing_profile';
+        throw new Error('Account has no bound identity profile');
+      }
+      applyDeviceProfile(targetProfile);
+    } else {
+      logger.warn(
+        'Identity profile apply is disabled by CRACK_IDENTITY_PROFILE_APPLY_ENABLED / CRACK_DEVICE_FINGERPRINT_ENABLED',
+      );
+    }
+
+    stage = 'switch';
+    await performSwitch();
+    stage = 'start';
+    await startAntigravity();
+    recordSwitchSuccess(scope);
+  } catch (error) {
+    const reason = toSwitchFailureReason(stage, error);
+    const message = getErrorMessage(error);
+    recordSwitchFailure(scope, reason, message);
+    throw error;
+  }
+}

src/ipc/switchGuard.ts

@@ -0,0 +1,80 @@
+import { logger } from '../utils/logger';
+
+type SwitchOwner = 'local-account-switch' | 'cloud-account-switch';
+
+interface SwitchTask {
+  owner: SwitchOwner;
+  action: () => Promise<unknown>;
+  resolve: (value: unknown) => void;
+  reject: (reason?: unknown) => void;
+}
+
+let activeSwitchOwner: SwitchOwner | null = null;
+const pendingQueue: SwitchTask[] = [];
+let processing = false;
+
+function processQueue(): void {
+  if (processing) {
+    return;
+  }
+
+  const nextTask = pendingQueue.shift();
+  if (!nextTask) {
+    return;
+  }
+
+  processing = true;
+  activeSwitchOwner = nextTask.owner;
+  logger.info(`Acquired switch guard: ${nextTask.owner}`);
+
+  Promise.resolve()
+    .then(nextTask.action)
+    .then((result) => {
+      nextTask.resolve(result);
+    })
+    .catch((error) => {
+      nextTask.reject(error);
+    })
+    .finally(() => {
+      logger.info(`Released switch guard: ${nextTask.owner}`);
+      activeSwitchOwner = null;
+      processing = false;
+      processQueue();
+    });
+}
+
+export async function runWithSwitchGuard<T>(
+  owner: SwitchOwner,
+  action: () => Promise<T>,
+): Promise<T> {
+  return await new Promise<T>((resolve, reject) => {
+    pendingQueue.push({
+      owner,
+      action: async () => await action(),
+      resolve: (value) => {
+        resolve(value as T);
+      },
+      reject,
+    });
+    logger.info(
+      `Queued switch request: ${owner} (active=${activeSwitchOwner || 'none'}, pending=${pendingQueue.length})`,
+    );
+    processQueue();
+  });
+}
+
+export function getActiveSwitchOwner(): SwitchOwner | null {
+  return activeSwitchOwner;
+}
+
+export function getSwitchGuardSnapshot(): {
+  activeOwner: SwitchOwner | null;
+  pendingOwners: SwitchOwner[];
+  pendingCount: number;
+} {
+  return {
+    activeOwner: activeSwitchOwner,
+    pendingOwners: pendingQueue.map((item) => item.owner),
+    pendingCount: pendingQueue.length,
+  };
+}

src/ipc/switchMetrics.ts

@@ -0,0 +1,113 @@
+import { logger } from '../utils/logger';
+
+type SwitchScope = 'local' | 'cloud';
+
+export type SwitchFailureReason =
+  | 'unknown'
+  | 'process_close_failed'
+  | 'missing_bound_profile'
+  | 'apply_device_profile_failed'
+  | 'perform_switch_failed'
+  | 'start_process_failed';
+
+interface SwitchFailureMetadata {
+  reason: SwitchFailureReason;
+  message: string;
+  occurredAt: number;
+}
+
+interface SwitchMetricBucket {
+  switchSuccess: number;
+  switchFailure: number;
+  rollbackAttempt: number;
+  rollbackSuccess: number;
+  rollbackFailure: number;
+  failureReasons: Record<SwitchFailureReason, number>;
+  lastFailure: SwitchFailureMetadata | null;
+}
+
+type SwitchMetricMap = Record<SwitchScope, SwitchMetricBucket>;
+
+const metrics: SwitchMetricMap = {
+  local: {
+    switchSuccess: 0,
+    switchFailure: 0,
+    rollbackAttempt: 0,
+    rollbackSuccess: 0,
+    rollbackFailure: 0,
+    failureReasons: {
+      unknown: 0,
+      process_close_failed: 0,
+      missing_bound_profile: 0,
+      apply_device_profile_failed: 0,
+      perform_switch_failed: 0,
+      start_process_failed: 0,
+    },
+    lastFailure: null,
+  },
+  cloud: {
+    switchSuccess: 0,
+    switchFailure: 0,
+    rollbackAttempt: 0,
+    rollbackSuccess: 0,
+    rollbackFailure: 0,
+    failureReasons: {
+      unknown: 0,
+      process_close_failed: 0,
+      missing_bound_profile: 0,
+      apply_device_profile_failed: 0,
+      perform_switch_failed: 0,
+      start_process_failed: 0,
+    },
+    lastFailure: null,
+  },
+};
+
+function logSnapshot(scope: SwitchScope, reason: string): void {
+  logger.info(`[switch-metrics] ${scope} ${reason}`, metrics[scope]);
+}
+
+export function recordSwitchSuccess(scope: SwitchScope): void {
+  metrics[scope].switchSuccess += 1;
+  logSnapshot(scope, 'switch_success');
+}
+
+export function recordSwitchFailure(
+  scope: SwitchScope,
+  reason: SwitchFailureReason = 'unknown',
+  message: string = '',
+): void {
+  metrics[scope].switchFailure += 1;
+  metrics[scope].failureReasons[reason] += 1;
+  metrics[scope].lastFailure = {
+    reason,
+    message,
+    occurredAt: Date.now(),
+  };
+  logSnapshot(scope, 'switch_failure');
+}
+
+export function recordSwitchRollback(scope: SwitchScope, success: boolean): void {
+  metrics[scope].rollbackAttempt += 1;
+  if (success) {
+    metrics[scope].rollbackSuccess += 1;
+  } else {
+    metrics[scope].rollbackFailure += 1;
+  }
+  logSnapshot(scope, success ? 'rollback_success' : 'rollback_failure');
+}
+
+export function getSwitchMetricsSnapshot(): SwitchMetricMap {
+  return {
+    local: {
+      ...metrics.local,
+      failureReasons: { ...metrics.local.failureReasons },
+      lastFailure: metrics.local.lastFailure ? { ...metrics.local.lastFailure } : null,
+    },
+    cloud: {
+      ...metrics.cloud,
+      failureReasons: { ...metrics.cloud.failureReasons },
+      lastFailure: metrics.cloud.lastFailure ? { ...metrics.cloud.lastFailure } : null,
+    },
+  };
+}

src/ipc/system/handler.ts

@@ -1,6 +1,8 @@
 import { os } from '@orpc/server';
 import { z } from 'zod';
 import { networkInterfaces } from 'os';
+import { shell } from 'electron';
+import { getAgentDir } from '../../utils/paths';
 
 // Schema for IP info
 const IpInfoSchema = z.object({
@@ -61,4 +63,10 @@ export const systemHandler = os.router({
 
     return results;
   }),
+
+  // Open log directory in file explorer
+  openLogDirectory: os.output(z.void()).handler(async () => {
+    const logDir = getAgentDir();
+    await shell.openPath(logDir);
+  }),
 });

src/layouts/MainLayout.tsx

@@ -1,14 +1,34 @@
-import React from 'react';
+import React, { useState, useEffect } from 'react';
 import { Link, Outlet, useLocation } from '@tanstack/react-router';
 import { cn } from '@/lib/utils';
 import { StatusBar } from '@/components/StatusBar';
-import { LayoutDashboard, Settings, Network, Rocket } from 'lucide-react';
+import {
+  LayoutDashboard,
+  Settings,
+  Network,
+  Rocket,
+  ChevronLeft,
+  ChevronRight,
+} from 'lucide-react';
 import { useTranslation } from 'react-i18next';
+import { Button } from '@/components/ui/button';
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip';
 
 export const MainLayout: React.FC = () => {
   const location = useLocation();
   const { t } = useTranslation();
 
+  // Initialize state from localStorage if available, default to false (expanded)
+  const [isCollapsed, setIsCollapsed] = useState(() => {
+    const saved = localStorage.getItem('sidebar-collapsed');
+    return saved ? JSON.parse(saved) : false;
+  });
+
+  // Persist state changes
+  useEffect(() => {
+    localStorage.setItem('sidebar-collapsed', JSON.stringify(isCollapsed));
+  }, [isCollapsed]);
+
   const navItems = [
     {
       to: '/',
@@ -31,42 +51,102 @@ export const MainLayout: React.FC = () => {
     <div className="bg-background text-foreground flex h-screen flex-col overflow-hidden">
       <div className="flex flex-1 overflow-hidden">
         {/* Sidebar */}
-        <aside className="bg-muted/10 flex w-64 flex-col border-r">
-          <div className="p-6">
-            <h1 className="flex items-center gap-2 text-xl font-bold tracking-tight">
-              <div className="bg-primary text-primary-foreground flex h-6 w-6 items-center justify-center rounded">
+        <aside
+          className={cn(
+            'bg-muted/10 group relative flex flex-col border-r transition-all duration-300 ease-in-out',
+            isCollapsed ? 'w-[70px]' : 'w-64',
+          )}
+        >
+          <Button
+            variant="ghost"
+            size="icon"
+            className="bg-background hover:bg-accent hover:text-accent-foreground absolute top-6 -right-3 z-10 h-6 w-6 rounded-full border opacity-0 shadow-md transition-opacity group-hover:opacity-100"
+            onClick={() => setIsCollapsed(!isCollapsed)}
+          >
+            {isCollapsed ? (
+              <ChevronRight className="h-3 w-3" />
+            ) : (
+              <ChevronLeft className="h-3 w-3" />
+            )}
+          </Button>
+
+          <div className={cn('flex flex-col', isCollapsed ? 'items-center p-4' : 'p-6')}>
+            <div className="flex items-center gap-2 overflow-hidden whitespace-nowrap">
+              <div className="bg-primary text-primary-foreground flex h-6 w-6 shrink-0 items-center justify-center rounded">
                 <Rocket className="h-4 w-4" />
               </div>
-              Antigravity
-            </h1>
-            <p className="text-muted-foreground mt-1 text-xs">Manager</p>
-          </div>
-
-          <nav className="flex-1 space-y-2 px-4">
-            {navItems.map((item) => (
-              <Link
-                key={item.to}
-                to={item.to}
+              <div
                 className={cn(
-                  'flex items-center gap-3 rounded-md px-3 py-2 text-sm font-medium transition-colors',
-                  location.pathname === item.to
-                    ? 'bg-primary text-primary-foreground'
-                    : 'hover:bg-muted text-muted-foreground hover:text-foreground',
+                  'overflow-hidden transition-all duration-300',
+                  isCollapsed ? 'w-0 opacity-0' : 'w-auto opacity-100',
                 )}
               >
-                <item.icon className="h-4 w-4" />
-                {item.label}
-              </Link>
-            ))}
+                <h1 className="text-xl font-bold tracking-tight">Antigravity</h1>
+              </div>
+            </div>
+            <div
+              className={cn(
+                'text-muted-foreground mt-1 overflow-hidden text-xs whitespace-nowrap transition-all duration-300',
+                isCollapsed ? 'h-0 opacity-0' : 'h-auto opacity-100',
+              )}
+            >
+              Manager
+            </div>
+          </div>
+
+          <nav className="flex-1 space-y-2 px-2">
+            <TooltipProvider>
+              {navItems.map((item) => {
+                const isActive = location.pathname === item.to;
+
+                if (isCollapsed) {
+                  return (
+                    <Tooltip key={item.to} delayDuration={0}>
+                      <TooltipTrigger asChild>
+                        <Link
+                          to={item.to}
+                          className={cn(
+                            'mx-auto flex h-10 w-10 items-center justify-center rounded-md transition-colors',
+                            isActive
+                              ? 'bg-primary text-primary-foreground'
+                              : 'hover:bg-muted text-muted-foreground hover:text-foreground',
+                          )}
+                        >
+                          <item.icon className="h-5 w-5" />
+                          <span className="sr-only">{item.label}</span>
+                        </Link>
+                      </TooltipTrigger>
+                      <TooltipContent side="right">{item.label}</TooltipContent>
+                    </Tooltip>
+                  );
+                }
+
+                return (
+                  <Link
+                    key={item.to}
+                    to={item.to}
+                    className={cn(
+                      'flex items-center gap-3 rounded-md px-3 py-2 text-sm font-medium transition-colors',
+                      isActive
+                        ? 'bg-primary text-primary-foreground'
+                        : 'hover:bg-muted text-muted-foreground hover:text-foreground',
+                    )}
+                  >
+                    <item.icon className="h-4 w-4" />
+                    {item.label}
+                  </Link>
+                );
+              })}
+            </TooltipProvider>
           </nav>
 
-          <div className="border-t p-4">
-            <StatusBar />
+          <div className="border-t p-2">
+            <StatusBar isCollapsed={isCollapsed} />
           </div>
         </aside>
 
         {/* Content Area */}
-        <main className="flex-1 overflow-auto">
+        <main className="flex-1 overflow-auto transition-all duration-300">
           <Outlet />
         </main>
       </div>

src/lib/antigravity/ClaudeRequestMapper.ts

@@ -2,6 +2,7 @@ import { v4 as uuidv4 } from 'uuid';
 import { mapClaudeModelToGemini } from './ModelMapping';
 import { cleanJsonSchema } from './JsonSchemaUtils';
 import { SignatureStore } from './SignatureStore';
+import { logger } from '../../utils/logger';
 import {
   ClaudeRequest,
   Message,
@@ -51,7 +52,7 @@ export function transformClaudeRequestIn(
   const toolIdToName = new Map<string, string>();
 
   // 1. System Instruction
-  let systemInstruction = buildSystemInstruction(claudeReq.system, claudeReq.model);
+  const systemInstruction = buildSystemInstruction(claudeReq.system, claudeReq.model);
 
   // Map model name
   const mappedModel = hasWebSearchTool
@@ -100,7 +101,7 @@ export function transformClaudeRequestIn(
   );
 
   // 3. Tools
-  let tools = buildTools(claudeReq.tools, hasWebSearchTool);
+  const tools = buildTools(claudeReq.tools, hasWebSearchTool);
 
   // 5. Safety Settings
   const safetySettings = [
@@ -152,7 +153,7 @@ export function transformClaudeRequestIn(
     delete innerRequest.systemInstruction;
 
     // 3. Clean generationConfig
-    let genConfig = innerRequest.generationConfig || {};
+    const genConfig = innerRequest.generationConfig || {};
     delete genConfig.thinkingConfig;
     delete genConfig.responseMimeType;
     delete genConfig.responseModalities;
@@ -378,7 +379,7 @@ function injectGoogleSearchTool(body: { tools?: GeminiToolDeclaration[] }) {
 
   const hasFunctions = toolsArr.some((t) => t.functionDeclarations);
   if (hasFunctions) {
-    console.info('Skipping googleSearch injection due to existing functionDeclarations');
+    logger.info('Skipping googleSearch injection due to existing functionDeclarations');
     return;
   }
 

src/lib/antigravity/ClaudeStreamingMapper.ts

@@ -1,6 +1,7 @@
 import { GeminiPart, Usage, UsageMetadata } from './types';
 import { SignatureStore } from './SignatureStore';
 import { decodeSignature } from './signature-utils';
+import { logger } from '../../utils/logger';
 
 type BlockType = 'None' | 'Text' | 'Thinking' | 'Function';
 
@@ -249,7 +250,7 @@ export class StreamingState {
     const chunks: string[] = [];
     this.parseErrorCount++;
 
-    console.warn(
+    logger.warn(
       `[SSE-Parser] Parse error #${this.parseErrorCount}. Raw data length: ${rawData.length}`,
     );
 
@@ -260,7 +261,7 @@ export class StreamingState {
 
     // Emit error event if too many errors
     if (this.parseErrorCount > 3) {
-      console.error(
+      logger.error(
         `[SSE-Parser] High error rate (${this.parseErrorCount} errors). Stream may be corrupted.`,
       );
       chunks.push(

src/lib/antigravity/JsonSchemaUtils.ts

@@ -67,7 +67,7 @@ function flattenRefs(map: any, defs: Record<string, any>) {
 
   // Recursively process all children
   for (const k in map) {
-    if (map.hasOwnProperty(k)) {
+    if (Object.prototype.hasOwnProperty.call(map, k)) {
       const v = map[k];
       if (typeof v === 'object' && v !== null) {
         flattenRefs(v, defs);
@@ -91,7 +91,7 @@ function cleanJsonSchemaRecursive(value: any) {
 
     // 1. Recursively process all children first to ensure nested structures are cleaned
     for (const k in map) {
-      if (map.hasOwnProperty(k)) {
+      if (Object.prototype.hasOwnProperty.call(map, k)) {
         cleanJsonSchemaRecursive(map[k]);
       }
     }

src/lib/antigravity/ModelMapping.ts

@@ -1,7 +1,4 @@
-const logger = {
-  log: (msg: string) => console.log(msg),
-  warn: (msg: string) => console.warn(msg),
-};
+import { logger } from '../../utils/logger';
 
 const CLAUDE_TO_GEMINI: Record<string, string> = {
   // Directly supported models
@@ -78,7 +75,7 @@ export function resolveModelRoute(
 ): string {
   // 1. Check custom exact mapping (Highest priority)
   if (customMapping[originalModel]) {
-    logger.log(
+    logger.info(
       `[Router] Using custom exact mapping: ${originalModel} -> ${customMapping[originalModel]}`,
     );
     return customMapping[originalModel];
@@ -98,7 +95,7 @@ export function resolveModelRoute(
     lowerModel === 'gpt-4'
   ) {
     if (openaiMapping['gpt-4-series']) {
-      logger.log(
+      logger.info(
         `[Router] Using GPT-4 series mapping: ${originalModel} -> ${openaiMapping['gpt-4-series']}`,
       );
       return openaiMapping['gpt-4-series'];
@@ -113,7 +110,7 @@ export function resolveModelRoute(
     lowerModel.includes('turbo')
   ) {
     if (openaiMapping['gpt-4o-series']) {
-      logger.log(
+      logger.info(
         `[Router] Using GPT-4o/3.5 series mapping: ${originalModel} -> ${openaiMapping['gpt-4o-series']}`,
       );
       return openaiMapping['gpt-4o-series'];
@@ -124,13 +121,13 @@ export function resolveModelRoute(
   if (lowerModel.startsWith('gpt-5')) {
     // Prefer gpt-5-series mapping, fallback to gpt-4-series if missing
     if (openaiMapping['gpt-5-series']) {
-      logger.log(
+      logger.info(
         `[Router] Using GPT-5 series mapping: ${originalModel} -> ${openaiMapping['gpt-5-series']}`,
       );
       return openaiMapping['gpt-5-series'];
     }
     if (openaiMapping['gpt-4-series']) {
-      logger.log(
+      logger.info(
         `[Router] Using GPT-4 series mapping (GPT-5 fallback): ${originalModel} -> ${openaiMapping['gpt-4-series']}`,
       );
       return openaiMapping['gpt-4-series'];

src/lib/antigravity/QuotaService.ts

@@ -1,5 +1,6 @@
 import axios, { AxiosError, AxiosInstance } from 'axios';
 import { QuotaData, Tier, LoadProjectResponse, QuotaApiResponse } from './types';
+import { logger } from '../../utils/logger';
 
 // Constants
 const QUOTA_API_URL = 'https://cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels';
@@ -48,15 +49,15 @@ export class QuotaService {
         const subscriptionTier = data.paidTier?.id || data.currentTier?.id;
 
         if (subscriptionTier) {
-          console.log(`📊 [${email}] Subscription Identified: ${subscriptionTier}`);
+          logger.info(`📊 [${email}] Subscription Identified: ${subscriptionTier}`);
         }
 
         return [projectId, subscriptionTier];
       } else {
-        console.warn(`⚠️  [${email}] loadCodeAssist failed: Status: ${res.status}`);
+        logger.warn(`⚠️  [${email}] loadCodeAssist failed: Status: ${res.status}`);
       }
     } catch (error: any) {
-      console.error(`❌ [${email}] loadCodeAssist Network Error: ${error.message}`);
+      logger.error(`❌ [${email}] loadCodeAssist Network Error: ${error.message}`);
     }
 
     return [undefined, undefined];
@@ -86,7 +87,7 @@ export class QuotaService {
     const url = QUOTA_API_URL;
     const maxRetries = 3;
 
-    console.log(`Sending quota request to ${url}`);
+    logger.info(`Sending quota request to ${url}`);
 
     for (let attempt = 1; attempt <= maxRetries; attempt++) {
       try {
@@ -104,11 +105,11 @@ export class QuotaService {
           subscriptionTier: subscriptionTier,
         };
 
-        console.log(`Quota API returned ${Object.keys(quotaResponse.models || {}).length} models:`);
+        logger.info(`Quota API returned ${Object.keys(quotaResponse.models || {}).length} models:`);
 
         if (quotaResponse.models) {
           for (const [name, info] of Object.entries(quotaResponse.models)) {
-            console.log(`   - ${name}`);
+            logger.info(`   - ${name}`);
             if (info.quotaInfo) {
               const fraction = info.quotaInfo.remainingFraction ?? 0;
               const percentage = Math.floor(fraction * 100);
@@ -135,7 +136,7 @@ export class QuotaService {
 
           // ✅ Handle 403 Forbidden specifically - return immediately, do not retry
           if (status === 403) {
-            console.warn(`Account no permission (403 Forbidden), marked as forbidden`);
+            logger.warn(`Account no permission (403 Forbidden), marked as forbidden`);
             return {
               quotaData: {
                 models: {},
@@ -146,9 +147,9 @@ export class QuotaService {
             };
           }
 
-          console.warn(`API Error: ${status} - ${text} (Attempt ${attempt}/${maxRetries})`);
+          logger.warn(`API Error: ${status} - ${text} (Attempt ${attempt}/${maxRetries})`);
         } else {
-          console.warn(`Request Failed: ${error.message} (Attempt ${attempt}/${maxRetries})`);
+          logger.warn(`Request Failed: ${error.message} (Attempt ${attempt}/${maxRetries})`);
         }
 
         if (attempt < maxRetries) {

src/lib/antigravity/SignatureStore.ts

@@ -2,6 +2,7 @@
  * Global thought_signature storage shared by all endpoints
  * Used to capture and replay signatures for Gemini 3+ function calls when clients don't pass them back.
  */
+import { logger } from '../../utils/logger';
 
 class SignatureStoreImpl {
   private static instance: SignatureStoreImpl;
@@ -28,12 +29,12 @@ class SignatureStoreImpl {
     const newLen = sig.length;
 
     if (newLen > existingLen) {
-      console.log(
+      logger.info(
         `[ThoughtSig] Storing new signature (length: ${newLen}, replacing old: ${existingLen})`,
       );
       this.signature = sig;
     } else {
-      console.debug(
+      logger.debug(
         `[ThoughtSig] Skipping shorter signature (new length: ${newLen}, existing: ${existingLen})`,
       );
     }

src/lib/antigravity/thinking-utils.ts

@@ -5,6 +5,7 @@
  * Problem: Invalid signatures cause thinking blocks to be dropped, losing content
  * Solution: Validate and convert invalid blocks to text instead of dropping
  */
+import { logger } from '../../utils/logger';
 
 /** Minimum length for a valid thought signature */
 const MIN_SIGNATURE_LENGTH = 10;
@@ -82,7 +83,7 @@ export function gracefulDegradeThinking(block: ContentBlock): ContentBlock | nul
   // Invalid signature - check if we have content to preserve
   if (thinkingBlock.thinking && thinkingBlock.thinking.length > 0) {
     // Convert to text block to preserve content
-    console.info(
+    logger.info(
       `[Thinking-Utils] Converting invalid thinking block to text. Content length: ${thinkingBlock.thinking.length}`,
     );
     return {
@@ -92,7 +93,7 @@ export function gracefulDegradeThinking(block: ContentBlock): ContentBlock | nul
   }
 
   // Empty content + invalid signature = drop
-  console.debug('[Thinking-Utils] Dropping empty thinking block with invalid signature');
+  logger.debug('[Thinking-Utils] Dropping empty thinking block with invalid signature');
   return null;
 }
 

src/localization/i18n.ts

@@ -12,7 +12,7 @@ i18n
       caches: ['localStorage'],
       lookupLocalStorage: 'lang',
     },
-    supportedLngs: ['en', 'zh-CN'],
+    supportedLngs: ['en', 'zh-CN', 'ru'],
     load: 'currentOnly', // Only load the exact language code, not variants
     resources: {
       en: {
@@ -30,9 +30,23 @@ i18n
             deleteBackup: 'Delete Backup',
             backupCurrent: 'Backup Current',
             retry: 'Retry',
+            openLogs: 'Open Log Directory',
           },
           error: {
             generic: 'An unexpected error occurred.',
+            keychainUnavailable: 'Keychain is unavailable.',
+            keychainHint: {
+              translocation:
+                'Detected macOS App Translocation. Move the app to /Applications and reopen.',
+              keychainDenied:
+                'Keychain access denied. The app may be unsigned; see README for the self-signing workaround.',
+              signNotarize: 'Please use a signed and notarized build when available.',
+            },
+            dataMigrationFailed: 'Unable to decrypt legacy account data.',
+            dataMigrationHint: {
+              relogin: 'Please re-login or re-add your accounts.',
+              clearData: 'If the issue persists, clear local account data and sign in again.',
+            },
           },
           nav: {
             accounts: 'Accounts',
@@ -69,6 +83,7 @@ i18n
               description: 'Select your preferred language.',
               english: 'English',
               chinese: 'Chinese (Simplified)',
+              russian: 'Russian',
             },
             about: {
               title: 'About',
@@ -77,6 +92,7 @@ i18n
             version: 'Version',
             platform: 'Platform',
             license: 'License',
+            openLogDir: 'Open',
             account: {
               title: 'Account Settings',
               description: 'Configure automatic account refresh and sync.',
@@ -85,6 +101,23 @@ i18n
               auto_sync: 'Auto Sync Current Account',
               auto_sync_desc: 'Periodically sync active account information',
             },
+            startup: {
+              title: 'Startup',
+              description: 'Control application launch behavior at system startup.',
+              auto_startup: 'Start with system',
+              auto_startup_desc: 'Launch at sign-in and keep the app in the system tray',
+              macos_hint:
+                'macOS requires a signed app for Login Items to work. If auto-start fails, please sign the app or enable it manually in System Settings.',
+            },
+            privacy: {
+              title: 'Privacy',
+              description: 'Control how your data is used to improve the application.',
+              error_reporting: 'Error Reporting',
+              error_reporting_desc:
+                'Send anonymous error reports to help us improve the app. No personal data is collected.',
+              restart_note:
+                'Changes to error reporting will take effect after restarting the application.',
+            },
             proxy: {
               title: 'Upstream Proxy',
               description: 'Configure a proxy for outgoing requests to Google/Gemini APIs.',
@@ -205,13 +238,45 @@ i18n
               unknown: 'Unknown User',
               actions: 'Actions',
               useAccount: 'Use Account',
+              identityProfile: 'Identity Profile',
               refresh: 'Refresh Quota',
               delete: 'Delete Account',
               noQuota: 'No quota data',
+              resetPrefix: 'reset',
+              resetTime: 'Reset time',
+              resetUnknown: 'Unknown',
+            },
+            identity: {
+              title: 'Identity Profile',
+              loading: 'Loading...',
+              generateAndBind: 'Create and Bind',
+              captureAndBind: 'Capture and Bind Current',
+              restoreOriginal: 'Restore Baseline',
+              openFolder: 'Open Identity Storage',
+              previewTitle: 'Generated Identity Preview',
+              confirm: 'Confirm',
+              cancel: 'Cancel',
+              close: 'Close',
+              currentStorage: 'Current Runtime Identity',
+              accountBinding: 'Bound Account Identity',
+              history: 'Identity History',
+              noHistory: 'No identity history',
+              current: 'Active',
+              restore: 'Restore',
+              generateSuccess: 'Identity created and bound',
+              captureSuccess: 'Current identity captured and bound',
+              restoreOriginalSuccess: 'Baseline identity restored',
+              restoreVersionSuccess: 'Historical identity restored',
+              deleteVersionSuccess: 'Historical identity deleted',
+              openFolderSuccess: 'Identity storage opened',
+              baseline: 'Baseline Identity',
             },
             list: {
               noAccounts: 'No cloud accounts added yet.',
             },
+            error: {
+              loadFailed: 'Failed to load cloud accounts.',
+            },
             toast: {
               syncSuccess: {
                 title: 'Sync Successful',
@@ -227,6 +292,7 @@ i18n
               },
               quotaRefreshed: 'Quota refreshed',
               refreshFailed: 'Failed to refresh quota',
+              pollFailed: 'Failed to poll quota for all accounts',
               switched: {
                 title: 'Account switched!',
                 description: 'Restarting Antigravity...',
@@ -275,6 +341,10 @@ i18n
               api_key: 'API Key',
               auto_start: 'Auto Start with App',
               auto_start_desc: 'Start proxy service when application launches',
+              local_access: 'Local network access:',
+              no_token_warning: '⚠️ API key is not set. Access is open to everyone!',
+              show_key: 'Show',
+              hide_key: 'Hide',
             },
             mapping: {
               title: 'Model Mapping',
@@ -304,9 +374,23 @@ i18n
             deleteBackup: '删除备份',
             backupCurrent: '备份当前账号',
             retry: '重试',
+            openLogs: '打开日志目录',
           },
           error: {
             generic: '发生未知错误。',
+            keychainUnavailable: 'Keychain 不可用。',
+            keychainHint: {
+              translocation:
+                '检测到 macOS App Translocation。请将应用移动到 /Applications 后重试。',
+              keychainDenied:
+                'Keychain 访问被拒绝。应用可能未签名，可参考 README 的“macOS 自签”说明。',
+              signNotarize: '请在可用时使用已签名并公证的版本。',
+            },
+            dataMigrationFailed: '旧版账号数据无法解密。',
+            dataMigrationHint: {
+              relogin: '请重新登录或重新添加账号。',
+              clearData: '如仍失败，请清理本地账号数据后再登录。',
+            },
           },
           nav: {
             accounts: '账号',
@@ -343,6 +427,7 @@ i18n
               description: '选择您的首选语言。',
               english: '英语',
               chinese: '中文 (简体)',
+              russian: '俄语',
             },
             about: {
               title: '关于',
@@ -351,6 +436,7 @@ i18n
             version: '版本',
             platform: '平台',
             license: '许可证',
+            openLogDir: '打开',
             account: {
               title: '账号设置',
               description: '配置自动刷新和同步账号。',
@@ -359,6 +445,21 @@ i18n
               auto_sync: '自动获取当前账号',
               auto_sync_desc: '定期自动同步当前活跃账号信息',
             },
+            startup: {
+              title: '启动',
+              description: '控制系统启动时的应用行为。',
+              auto_startup: '随系统启动',
+              auto_startup_desc: '登录时自动启动并保持在托盘里',
+              macos_hint:
+                'macOS 需要应用已签名才可生效。如自启动失败，请自行签名或在系统设置中手动启用。',
+            },
+            privacy: {
+              title: '隐私',
+              description: '控制你的数据如何用于改进应用。',
+              error_reporting: '错误上报',
+              error_reporting_desc: '发送匿名错误报告以帮助我们改进应用。不收集个人数据。',
+              restart_note: '错误上报设置会在重启应用后生效。',
+            },
             proxy: {
               title: '上游代理',
               description: '为发往 Google/Gemini API 的请求配置代理。',
@@ -477,13 +578,45 @@ i18n
               unknown: '未知用户',
               actions: '操作',
               useAccount: '使用账号',
+              identityProfile: '身份配置',
               refresh: '刷新配额',
               delete: '删除账号',
               noQuota: '无配额数据',
+              resetPrefix: '重置',
+              resetTime: '重置时间',
+              resetUnknown: '未知',
+            },
+            identity: {
+              title: '身份配置',
+              loading: '加载中...',
+              generateAndBind: '生成并绑定',
+              captureAndBind: '采集当前并绑定',
+              restoreOriginal: '恢复基线配置',
+              openFolder: '打开身份存储目录',
+              previewTitle: '生成配置预览',
+              confirm: '确认',
+              cancel: '取消',
+              close: '关闭',
+              currentStorage: '当前运行配置',
+              accountBinding: '账号绑定配置',
+              history: '配置历史',
+              noHistory: '暂无配置历史',
+              current: '当前生效',
+              restore: '恢复',
+              generateSuccess: '生成并绑定成功',
+              captureSuccess: '采集当前并绑定成功',
+              restoreOriginalSuccess: '基线配置已恢复',
+              restoreVersionSuccess: '历史配置已恢复',
+              deleteVersionSuccess: '历史配置已删除',
+              openFolderSuccess: '身份存储目录已打开',
+              baseline: '基线配置',
             },
             list: {
               noAccounts: '暂无云账号。',
             },
+            error: {
+              loadFailed: '加载云账号失败。',
+            },
             toast: {
               syncSuccess: {
                 title: '同步成功',
@@ -499,6 +632,7 @@ i18n
               },
               quotaRefreshed: '配额已刷新',
               refreshFailed: '刷新配额失败',
+              pollFailed: '轮询所有账号配额失败',
               switched: {
                 title: '账号已切换！',
                 description: '正在重启 Antigravity...',
@@ -564,5 +698,349 @@ i18n
           },
         },
       },
+      ru: {
+        translation: {
+          appName: 'Antigravity Manager',
+          status: {
+            checking: 'Проверка статуса...',
+            running: 'Antigravity работает в фоне',
+            stopped: 'Служба Antigravity остановлена',
+          },
+          action: {
+            stop: 'Стоп',
+            start: 'Старт',
+            switch: 'Переключить',
+            deleteBackup: 'Удалить резервную копию',
+            backupCurrent: 'Создать бэкап текущего',
+            retry: 'Повторить',
+            openLogs: 'Открыть папку логов',
+          },
+          error: {
+            generic: 'Произошла непредвиденная ошибка.',
+            keychainUnavailable: 'Keychain недоступен.',
+            keychainHint: {
+              translocation:
+                'Обнаружено App Translocation (macOS). Переместите приложение в /Applications и откройте заново.',
+              keychainDenied:
+                'Доступ к Keychain запрещен. Возможно, приложение не подписано. См. README для инструкции.',
+              signNotarize: 'Пожалуйста, используйте подписанную версию приложения.',
+            },
+            dataMigrationFailed: 'Не удалось расшифровать данные старого аккаунта.',
+            dataMigrationHint: {
+              relogin: 'Пожалуйста, перезайдите в аккаунт или добавьте его заново.',
+              clearData: 'Если ошибка сохраняется, очистите локальные данные и войдите снова.',
+            },
+          },
+          nav: {
+            accounts: 'Аккаунты',
+            proxy: 'API Прокси',
+            settings: 'Настройки',
+          },
+          account: {
+            current: 'Текущий',
+            lastUsed: 'Последнее использование {{time}}',
+          },
+          home: {
+            title: 'Аккаунты',
+            description: 'Управление вашими аккаунтами Antigravity Google Gemini.',
+            noBackups: {
+              title: 'Бэкапы не найдены',
+              description:
+                'Создайте резервную копию вашего текущего аккаунта Antigravity, чтобы начать.',
+              action: 'Создать бэкап текущего аккаунта',
+            },
+          },
+          settings: {
+            title: 'Настройки',
+            description: 'Управление настройками приложения.',
+            general: 'Общие',
+            connection: 'Подключение',
+            models: 'Модели',
+            appearance: {
+              title: 'Внешний вид',
+              description: 'Настройте внешний вид Antigravity Manager.',
+            },
+            darkMode: 'Темная тема',
+            darkModeDescription: 'Включить темную тему для комфортной работы ночью.',
+            language: {
+              title: 'Язык',
+              description: 'Выберите язык интерфейса.',
+              english: 'English',
+              chinese: '中文 (简体)',
+              russian: 'Русский',
+            },
+            about: {
+              title: 'О программе',
+              description: 'Информация о приложении.',
+            },
+            version: 'Версия',
+            platform: 'Платформа',
+            license: 'Лицензия',
+            openLogDir: 'Открыть',
+            account: {
+              title: 'Настройки аккаунта',
+              description: 'Настройка автоматического обновления и синхронизации.',
+              auto_refresh: 'Автообновление квот',
+              auto_refresh_desc: 'Периодически обновлять информацию о квотах для всех аккаунтов',
+              auto_sync: 'Автосинхронизация текущего',
+              auto_sync_desc: 'Периодически синхронизировать активный аккаунт',
+            },
+            startup: {
+              title: 'Автозагрузка',
+              description: 'Управление запуском приложения при старте системы.',
+              auto_startup: 'Запускать вместе с системой',
+              auto_startup_desc: 'Запускать при входе и сворачивать в трей',
+              macos_hint:
+                'macOS требует подписанное приложение для работы элементов входа. Если автозапуск не работает, подпишите приложение или включите его вручную в системных настройках.',
+            },
+            privacy: {
+              title: 'Конфиденциальность',
+              description: 'Управление использованием данных для улучшения приложения.',
+              error_reporting: 'Отчеты об ошибках',
+              error_reporting_desc:
+                'Отправляйте анонимные отчеты об ошибках, чтобы помочь нам улучшить приложение. Личные данные не собираются.',
+              restart_note:
+                'Изменения в отчетах об ошибках вступят в силу после перезапуска приложения.',
+            },
+            proxy: {
+              title: 'Верхнеуровневый прокси',
+              description: 'Настроить прокси для исходящих запросов к Google/Gemini API.',
+              enable: 'Включить прокси',
+              url: 'URL прокси',
+              timeout: 'Тайм-аут запроса (сек)',
+            },
+            modelMapping: {
+              title: 'Маппинг моделей',
+              description:
+                'Сопоставьте модели Claude Code с моделями Antigravity. Оптимизируйте затраты и скорость, разумно маршрутизируя запросы.',
+              claudeKeyword: 'Модель Claude (Ключевое слово)',
+              targetGemini: 'Целевая модель Gemini',
+              addPlaceholderKey: 'например, op-3',
+              addPlaceholderValue: 'например, gemini-2.0-flash-exp',
+              noMappings: 'Нет пользовательских сопоставлений.',
+              mapsTo: 'Мапится в',
+              default: 'По умолчанию',
+              restoreDefaults: 'Сбросить по умолчанию',
+            },
+            examples: {
+              title: 'Примеры использования',
+              description: 'Примеры команд для вызова локального API прокси.',
+              curl: 'cURL',
+              python: 'Python',
+              copy: 'Копировать',
+              copied: 'Скопировано!',
+              openai_protocol: 'Протокол OpenAI',
+              anthropic_protocol: 'Протокол Anthropic',
+              openai_tools: 'Cursor, Windsurf, NextChat',
+              anthropic_tools: 'Claude Code CLI',
+              flash: 'Быстрый (Flash)',
+              pro: 'Про (Pro)',
+              flash_preview: 'Превью (Flash Preview)',
+              pro_high: 'Лучший (Pro High)',
+              sonnet: 'Мыслящий (Sonnet)',
+              opus: 'Opus',
+            },
+            gateway: {
+              title: 'Служба API Прокси',
+              description: 'Управление локальным прокси-сервером API.',
+              status_running: 'Запущено',
+              status_stopped: 'Остановлено',
+              action_start: 'Запустить службу',
+              action_stop: 'Остановить службу',
+              accounts_info: '{{count}} аккаунтов доступно',
+              port: 'Порт прослушивания',
+              port_hint: 'По умолчанию 8045, требуется перезапуск для применения',
+              timeout: 'Тайм-аут запроса',
+              timeout_hint: 'По умолчанию 120с, диапазон 30-600с',
+              api_key: 'API Ключ',
+              regenerate_key: 'Перегенерировать',
+              regenerateConfirm: {
+                title: 'Перегенерировать API ключ?',
+                description:
+                  'Это немедленно сделает текущий ключ недействительным. Все приложения, использующие старый ключ, перестанут работать.',
+                cancel: 'Отмена',
+                confirm: 'Перегенерировать',
+              },
+              key_warning: 'Держите ваш API ключ в секрете. Не передавайте его никому.',
+              auto_start: 'Автозапуск с приложением',
+              auto_start_desc: 'Запускать прокси-службу при старте приложения',
+            },
+            proxy_tab: 'Прокси',
+            save: 'Сохранить настройки',
+          },
+          toast: {
+            backupSuccess: {
+              title: 'Успешно',
+              description: 'Бэкап аккаунта создан.',
+            },
+            backupError: {
+              title: 'Ошибка',
+              description: 'Не удалось создать бэкап: {{error}}',
+            },
+            switchSuccess: {
+              title: 'Успешно',
+              description: 'Аккаунт переключен.',
+            },
+            switchError: {
+              title: 'Ошибка',
+              description: 'Не удалось переключить аккаунт: {{error}}',
+            },
+            deleteSuccess: {
+              title: 'Успешно',
+              description: 'Бэкап удален.',
+            },
+            deleteError: {
+              title: 'Ошибка',
+              description: 'Не удалось удалить бэкап: {{error}}',
+            },
+          },
+          cloud: {
+            title: 'Аккаунты',
+            description: 'Управление пулом аккаунтов Google Gemini.',
+            autoSwitch: 'Авто-переключение',
+            addAccount: 'Добавить аккаунт',
+            syncFromIDE: 'Синхр. из IDE',
+            checkQuota: 'Проверить квоту',
+            polling: 'Опрос запущен',
+            authDialog: {
+              title: 'Добавить Google Аккаунт',
+              description: 'Для добавления аккаунта необходимо авторизовать приложение.',
+              openLogin: 'Открыть страницу входа',
+              authCode: 'Код авторизации',
+              placeholder: 'Вставьте код, начинающийся с 4/...',
+              instruction:
+                'Откроется браузер для входа в Google. Скопируйте код со страницы localhost и вставьте сюда.',
+              verify: 'Проверить и добавить',
+            },
+            card: {
+              active: 'Активен',
+              use: 'Использовать',
+              rateLimited: 'Лимит исчерпан',
+              left: 'ост.',
+              used: 'Исп.',
+              unknown: 'Неизвестный',
+              actions: 'Действия',
+              useAccount: 'Использовать этот аккаунт',
+              identityProfile: 'Профиль идентичности',
+              refresh: 'Обновить квоту',
+              delete: 'Удалить аккаунт',
+              noQuota: 'Нет данных',
+              resetPrefix: 'Сброс',
+              resetTime: 'Время сброса',
+              resetUnknown: 'Неизвестно',
+            },
+            identity: {
+              title: 'Профиль идентичности',
+              loading: 'Загрузка...',
+              generateAndBind: 'Создать и привязать',
+              captureAndBind: 'Считать текущий и привязать',
+              restoreOriginal: 'Восстановить базовый профиль',
+              openFolder: 'Открыть хранилище профилей',
+              previewTitle: 'Предпросмотр сгенерированного профиля',
+              confirm: 'Подтвердить',
+              cancel: 'Отмена',
+              close: 'Закрыть',
+              currentStorage: 'Текущий профиль окружения',
+              accountBinding: 'Профиль, привязанный к аккаунту',
+              history: 'История профилей',
+              noHistory: 'История профилей пуста',
+              current: 'Активный',
+              restore: 'Восстановить',
+              generateSuccess: 'Профиль создан и привязан',
+              captureSuccess: 'Текущий профиль считан и привязан',
+              restoreOriginalSuccess: 'Базовый профиль восстановлен',
+              restoreVersionSuccess: 'Исторический профиль восстановлен',
+              deleteVersionSuccess: 'Исторический профиль удален',
+              openFolderSuccess: 'Хранилище профилей открыто',
+              baseline: 'Базовый профиль',
+            },
+            list: {
+              noAccounts: 'Нет добавленных облачных аккаунтов.',
+            },
+            error: {
+              loadFailed: 'Не удалось загрузить аккаунты.',
+            },
+            toast: {
+              syncSuccess: {
+                title: 'Синхронизация успешна',
+                description: 'Импортирован {{email}} из IDE.',
+              },
+              syncFailed: {
+                title: 'Синхронизация не удалась',
+                description: 'В базе данных IDE не найдено активных аккаунтов.',
+              },
+              addSuccess: 'Аккаунт успешно добавлен!',
+              addFailed: {
+                title: 'Не удалось добавить аккаунт',
+              },
+              quotaRefreshed: 'Квота обновлена',
+              refreshFailed: 'Не удалось обновить квоту',
+              pollFailed: 'Не удалось опросить квоты всех аккаунтов',
+              switched: {
+                title: 'Аккаунт переключен!',
+                description: 'Перезапуск Antigravity...',
+              },
+              switchFailed: 'Не удалось переключить аккаунт',
+              deleted: 'Аккаунт удален',
+              deleteFailed: 'Не удалось удалить аккаунт',
+              deleteConfirm: 'Вы уверены, что хотите удалить этот аккаунт?',
+              autoSwitchOn: 'Авто-переключение включено',
+              autoSwitchOff: 'Авто-переключение выключено',
+              updateSettingsFailed: 'Не удалось обновить настройки',
+            },
+            batch: {
+              selected: 'Выбрано {{count}}',
+              delete: 'Удалить выбранные',
+              refresh: 'Обновить выбранные',
+              selectAll: 'Выбрать все',
+              clear: 'Снять выделение',
+              confirmDelete: 'Вы уверены, что хотите удалить {{count}} аккаунтов?',
+            },
+          },
+          proxy: {
+            title: 'API Прокси',
+            description: 'Управление локальным прокси-сервером API.',
+            save: 'Сохранить',
+            copy: 'Копировать',
+            regenerate: 'Перегенерировать',
+            regenerateConfirm: {
+              title: 'Перегенерировать API ключ?',
+              description:
+                'Это немедленно сделает текущий ключ недействительным. Все приложения, использующие старый ключ, перестанут работать.',
+              cancel: 'Отмена',
+              confirm: 'Перегенерировать',
+            },
+            service: {
+              title: 'Статус сервиса',
+              description: 'Управление локальным сервером.',
+              running: 'Работает',
+              stopped: 'Остановлен',
+              start: 'Запустить',
+              stop: 'Остановить',
+            },
+            config: {
+              port: 'Порт',
+              timeout: 'Тайм-аут',
+              api_key: 'API Ключ',
+              auto_start: 'Автозапуск',
+              auto_start_desc: 'Запускать прокси при старте приложения',
+              local_access: 'Доступ из локальной сети:',
+              no_token_warning: '⚠️ API ключ не установлен. Доступ открыт всем!',
+              show_key: 'Показать',
+              hide_key: 'Скрыть',
+            },
+            mapping: {
+              title: 'Маппинг моделей',
+              description: 'Настройка маршрутизации моделей.',
+              maps_to: '->',
+              restore: 'Сброс',
+            },
+            examples: {
+              title: 'Примеры',
+              description: 'Примеры использования локального прокси.',
+            },
+          },
+        },
+      },
     },
   });

src/main.ts

@@ -1,14 +1,23 @@
-import { app, BrowserWindow, Tray, Menu, nativeImage } from 'electron';
+import './instrument'; // MUST be the first import to ensure Sentry initializes before app ready
+import { app, BrowserWindow, dialog, shell } from 'electron';
+import type { MessageBoxOptions } from 'electron';
 import path from 'path';
 import fs from 'fs';
+import squirrelStartup from 'electron-squirrel-startup';
 
-// import { installExtension, REACT_DEVELOPER_TOOLS } from 'electron-devtools-installer';
 import { ipcMain } from 'electron/main';
 import { ipcContext } from '@/ipc/context';
 import { IPC_CHANNELS } from './constants';
 import { updateElectronApp, UpdateSourceType } from 'update-electron-app';
 import { logger } from './utils/logger';
+import {
+  getExpectedInstallRoot,
+  getInstallNoticeText,
+  isRunningFromExpectedInstallDir as isRunningFromExpectedInstallDirUtil,
+  resolveInstallNoticeLanguage,
+} from './utils/installNotice';
 import { CloudAccountRepo } from './ipc/database/cloudHandler';
+import { initDatabase } from './ipc/database/handler';
 import { CloudMonitorService } from './services/CloudMonitorService';
 
 // Static Imports to fix Bundle Resolution Errors
@@ -17,6 +26,8 @@ import { bootstrapNestServer, stopNestServer } from './server/main';
 import { initTray, setTrayLanguage, destroyTray } from './ipc/tray/handler';
 import { rpcHandler } from './ipc/handler';
 import { ConfigManager } from './ipc/config/manager';
+import { AppConfig } from './types/config';
+import { isAutoStartLaunch, syncAutoStart } from './utils/autoStart';
 
 const packetLogPath = path.join(app.getPath('userData'), 'orpc_packets.log');
 
@@ -44,7 +55,7 @@ function logPacket(data: any) {
     );
   } catch (e) {
     if (e instanceof Error) {
-      console.error(e.message);
+      logger.error('Failed to append ORPC packet log', e);
     }
   }
 }
@@ -55,6 +66,11 @@ ipcMain.on(IPC_CHANNELS.CHANGE_LANGUAGE, (event, lang) => {
 
 app.disableHardwareAcceleration();
 
+if (squirrelStartup) {
+  app.quit();
+  process.exit(0);
+}
+
 const inDevelopment = process.env.NODE_ENV === 'development';
 
 // Keep a global reference of the window object, if you don't, the window will
@@ -62,6 +78,81 @@ const inDevelopment = process.env.NODE_ENV === 'development';
 let globalMainWindow: BrowserWindow | null = null;
 // let tray: Tray | null = null; // Moved to tray/handler.ts
 let isQuitting = false;
+let startupConfig: AppConfig | null = null;
+let shouldStartHidden = false;
+let hasShownInstallNotice = false;
+
+function isRunningFromExpectedInstallDir() {
+  return isRunningFromExpectedInstallDirUtil({
+    platform: process.platform,
+    isPackaged: app.isPackaged,
+    localAppData: process.env.LOCALAPPDATA,
+    appName: app.getName(),
+    execPath: process.execPath,
+  });
+}
+
+function showWindowsInstallNoticeIfNeeded() {
+  if (hasShownInstallNotice) {
+    return;
+  }
+
+  if (isRunningFromExpectedInstallDir()) {
+    return;
+  }
+
+  const expectedRoot = getExpectedInstallRoot({
+    platform: process.platform,
+    localAppData: process.env.LOCALAPPDATA,
+    appName: app.getName(),
+  });
+  if (!expectedRoot) {
+    return;
+  }
+
+  hasShownInstallNotice = true;
+  const language = resolveInstallNoticeLanguage({
+    configLanguage: startupConfig?.language,
+    locale: app.getLocale(),
+  });
+  const text = getInstallNoticeText(language);
+
+  const options: MessageBoxOptions = {
+    type: 'info',
+    title: text.title,
+    message: text.message,
+    detail: `${text.detailPrefix}${expectedRoot}`,
+    buttons: [...text.buttons],
+    defaultId: 1,
+  };
+
+  const showPromise = globalMainWindow
+    ? dialog.showMessageBox(globalMainWindow, options)
+    : dialog.showMessageBox(options);
+
+  showPromise.then(({ response }) => {
+    if (response === 0) {
+      shell.openPath(expectedRoot);
+    }
+  });
+}
+
+const gotSingleInstanceLock = app.requestSingleInstanceLock();
+
+if (!gotSingleInstanceLock) {
+  app.quit();
+} else {
+  app.on('second-instance', () => {
+    logger.info('Second instance detected, focusing existing window');
+    if (app.isReady()) {
+      createWindow({ startHidden: false });
+      return;
+    }
+    app.whenReady().then(() => {
+      createWindow({ startHidden: false });
+    });
+  });
+}
 
 process.on('exit', (code) => {
   logger.info(`Process exit event triggered with code: ${code}`);
@@ -74,7 +165,22 @@ process.on('before-exit', (code) => {
 
 // let tray: Tray | null = null; // Moved to tray/handler.ts
 
-function createWindow() {
+function createWindow({ startHidden }: { startHidden: boolean }) {
+  if (globalMainWindow && !globalMainWindow.isDestroyed()) {
+    if (startHidden) {
+      globalMainWindow.hide();
+      return;
+    }
+    if (globalMainWindow.isMinimized()) {
+      globalMainWindow.restore();
+    }
+    if (!globalMainWindow.isVisible()) {
+      globalMainWindow.show();
+    }
+    globalMainWindow.focus();
+    return;
+  }
+
   logger.info('createWindow: start');
   const preload = path.join(__dirname, 'preload.js');
   logger.info(`createWindow: preload path: ${preload}`);
@@ -83,6 +189,7 @@ function createWindow() {
   const mainWindow = new BrowserWindow({
     width: 1200,
     height: 800,
+    show: !startHidden,
     autoHideMenuBar: true,
     webPreferences: {
       devTools: inDevelopment,
@@ -98,6 +205,10 @@ function createWindow() {
   });
   globalMainWindow = mainWindow;
   logger.info('createWindow: BrowserWindow instance created');
+  if (startHidden) {
+    mainWindow.hide();
+    logger.info('createWindow: startHidden enabled, window hidden');
+  }
 
   logger.info('createWindow: setting main window in ipcContext');
   ipcContext.setMainWindow(mainWindow);
@@ -112,6 +223,7 @@ function createWindow() {
   }
 
   logger.info('Window created');
+  showWindowsInstallNoticeIfNeeded();
 
   mainWindow.on('close', (event) => {
     if (!isQuitting) {
@@ -125,6 +237,7 @@ function createWindow() {
 
   mainWindow.on('closed', () => {
     logger.info('Window closed event triggered');
+    globalMainWindow = null;
   });
 
   mainWindow.webContents.on('render-process-gone', (event, details) => {
@@ -143,6 +256,10 @@ function createWindow() {
     const { level, message, lineNumber, sourceId } = details;
     logger.info(`[Renderer Console][${level}] ${message} (${sourceId}:${lineNumber})`);
   });
+
+  mainWindow.on('focus', () => {
+    CloudMonitorService.handleAppFocus();
+  });
 }
 
 app.on('child-process-gone', (event, details) => {
@@ -198,7 +315,7 @@ async function setupORPC() {
 
         logPacket(data);
       } catch (e) {
-        console.log('[RAW ORPC MSG] (unparseable)', msgEvent.data);
+        logger.debug('[RAW ORPC MSG] (unparseable)', msgEvent.data);
       }
     });
 
@@ -223,13 +340,36 @@ process.on('unhandledRejection', (reason) => {
 
 app
   .whenReady()
+  .then(async () => {
+    logger.info('Step: Initialize CloudAccountRepo');
+    try {
+      await CloudAccountRepo.init();
+    } catch (e) {
+      logger.error('Startup: Failed to initialize CloudAccountRepo', e);
+      // We might want to exit here or show a dialog, but for now we proceed
+      // though functionality will be broken.
+    }
+
+    logger.info('Step: Initialize Antigravity DB (WAL Mode)');
+    initDatabase();
+  })
+  .then(() => {
+    logger.info('Step: Load Config');
+    const config = ConfigManager.loadConfig();
+    startupConfig = config;
+    syncAutoStart(config);
+    shouldStartHidden = isAutoStartLaunch() && config.auto_startup;
+    if (shouldStartHidden) {
+      logger.info('Startup: Auto-start detected, window will start hidden');
+    }
+  })
   .then(() => {
     logger.info('Step: setupORPC');
     return setupORPC();
   })
   .then(async () => {
     logger.info('Step: createWindow');
-    await createWindow();
+    await createWindow({ startHidden: shouldStartHidden });
   })
   .then(() => {
     logger.info('Step: installExtensions (SKIPPED)');
@@ -242,14 +382,11 @@ app
   .then(async () => {
     // Initialize Cloud Monitor if enabled
     try {
-      // Initialize DB & Migrate to Encrypted Storage
-      await CloudAccountRepo.init();
-
       // Start OAuth Server
       AuthServer.start();
 
       // Gateway Server (NestJS) - auto-start if enabled
-      const config = ConfigManager.loadConfig();
+      const config = startupConfig || ConfigManager.loadConfig();
       if (config.proxy?.auto_start) {
         const port = config.proxy?.port || 8045;
         // Default to a valid ProxyConfig object if null, although loadConfig ensures defaults
@@ -291,7 +428,7 @@ app.on('window-all-closed', () => {
 
 app.on('activate', () => {
   if (BrowserWindow.getAllWindows().length === 0) {
-    createWindow();
+    createWindow({ startHidden: false });
   }
 });
 //osX only ends

src/mocks/nestjs-microservices/index.ts

@@ -0,0 +1 @@
+export {};

src/mocks/nestjs-microservices/microservices-module.ts

@@ -0,0 +1 @@
+export {};

src/mocks/nestjs-websockets/index.ts

@@ -0,0 +1 @@
+export {};

src/mocks/nestjs-websockets/socket-module.ts

@@ -0,0 +1 @@
+export {};

src/preload.ts

@@ -1,6 +1,44 @@
 import { ipcRenderer, contextBridge } from 'electron';
+import * as Sentry from '@sentry/electron/renderer';
 import { IPC_CHANNELS } from './constants';
 
+import path from 'path';
+import fs from 'fs';
+import os from 'os';
+
+// Config check logic (duplicate of instrument.ts logic but adapted for preload)
+let sentryEnabled = false;
+try {
+  const home = os.homedir();
+  let appDataPath = '';
+  if (process.platform === 'win32') {
+    appDataPath = path.join(
+      process.env.APPDATA || path.join(home, 'AppData', 'Roaming'),
+      'Antigravity',
+    );
+  } else if (process.platform === 'darwin') {
+    appDataPath = path.join(home, 'Library', 'Application Support', 'Antigravity');
+  } else {
+    appDataPath = path.join(home, '.config', 'Antigravity');
+  }
+
+  const configPath = path.join(appDataPath, 'gui_config.json');
+  if (fs.existsSync(configPath)) {
+    const content = fs.readFileSync(configPath, 'utf-8');
+    const config = JSON.parse(content);
+    sentryEnabled = config.error_reporting_enabled === true;
+  }
+} catch (e) {
+  // console.error('Preload: Failed to read config', e);
+}
+
+if (sentryEnabled) {
+  // Defer Sentry init to avoid blocking main thread during startup (white screen fix)
+  setTimeout(() => {
+    // console.log('[Preload] Initializing Sentry (Deferred)');
+    Sentry.init({});
+  }, 2000);
+}
 window.addEventListener('message', (event) => {
   if (event.data === IPC_CHANNELS.START_ORPC_SERVER) {
     const [serverPort] = event.ports;
@@ -10,6 +48,7 @@ window.addEventListener('message', (event) => {
 });
 
 contextBridge.exposeInMainWorld('electron', {
+  SENTRY_ENABLED: sentryEnabled,
   onGoogleAuthCode: (callback: (code: string) => void) => {
     const handler = (_event: any, code: string) => callback(code);
     ipcRenderer.on('GOOGLE_AUTH_CODE', handler);

src/renderer.ts

@@ -1 +1,12 @@
+import * as Sentry from '@sentry/electron/renderer';
+
+if (window.electron.SENTRY_ENABLED) {
+  // Defer initialization to prioritize initial render
+  setTimeout(() => {
+    Sentry.init({
+      dsn: process.env.SENTRY_DSN,
+    });
+  }, 2000);
+}
+
 import '@/App';