chore(release): 0.3.2 [skip ci]

## [0.3.2](https://github.com/Draculabo/AntigravityManager/compare/v0.3.1...v0.3.2) (2026-01-25)

### 🐛 Bug Fixes

* handle keychain hint and suppress pgrep spam ([bd3d41a](https://github.com/Draculabo/AntigravityManager/commit/bd3d41aed17bafe9d684c5c421bad8b90afa19a8))

### 📝 Documentation

* add macOS self-signing workaround for Keychain issues ([01e3f8f](https://github.com/Draculabo/AntigravityManager/commit/01e3f8f8fd6dacc5eed214ed4b505d6d85f4bcff))

### 🔧 Continuous Integration

* setup semantic release configuration and github actions workflow ([d2945a6](https://github.com/Draculabo/AntigravityManager/commit/d2945a6e8a14d75f577716183cdff093443d9636))
* trigger publish on release published event ([6a07bc0](https://github.com/Draculabo/AntigravityManager/commit/6a07bc0a10a5ad802777e007cfd7390852119b15))

.github/workflows/publish.yaml

@@ -1,9 +1,8 @@
 name: Publish Release
 
 on:
-  push:
-    tags:
-      - 'v*'
+  release:
+    types: [published]
   workflow_dispatch:
 
 jobs:
@@ -11,7 +10,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, macos-latest, ubuntu-latest]
+        os: [windows-latest, macos-latest, macos-14, ubuntu-latest]
 
     runs-on: ${{ matrix.os }}
 

.github/workflows/release.yml

@@ -0,0 +1,37 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+      - master
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  release:
+    name: Semantic Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required for semantic-release to analyze commits
+          persist-credentials: false # We use a token in the next steps
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} # Use GH_TOKEN to trigger other workflows
+        run: npx semantic-release

.vscode/settings.json

@@ -0,0 +1,7 @@
+{
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit"
+  },
+  "eslint.validate": ["javascript", "javascriptreact", "typescript", "typescriptreact"]
+}

CHANGELOG.md

@@ -1,3 +1,36 @@
+<a name="readme-top"></a>
+
+# Changelog
+
+## [0.3.2](https://github.com/Draculabo/AntigravityManager/compare/v0.3.1...v0.3.2) (2026-01-25)
+
+### 🐛 Bug Fixes
+
+* handle keychain hint and suppress pgrep spam ([bd3d41a](https://github.com/Draculabo/AntigravityManager/commit/bd3d41aed17bafe9d684c5c421bad8b90afa19a8))
+
+### 📝 Documentation
+
+* add macOS self-signing workaround for Keychain issues ([01e3f8f](https://github.com/Draculabo/AntigravityManager/commit/01e3f8f8fd6dacc5eed214ed4b505d6d85f4bcff))
+
+### 🔧 Continuous Integration
+
+* setup semantic release configuration and github actions workflow ([d2945a6](https://github.com/Draculabo/AntigravityManager/commit/d2945a6e8a14d75f577716183cdff093443d9636))
+* trigger publish on release published event ([6a07bc0](https://github.com/Draculabo/AntigravityManager/commit/6a07bc0a10a5ad802777e007cfd7390852119b15))
+
+## [0.3.2](https://github.com/Draculabo/AntigravityManager/compare/v0.3.1...v0.3.2) (2026-01-25)
+
+### 🐛 Bug Fixes
+
+* handle keychain hint and suppress pgrep spam ([bd3d41a](https://github.com/Draculabo/AntigravityManager/commit/bd3d41aed17bafe9d684c5c421bad8b90afa19a8))
+
+### 📝 Documentation
+
+* add macOS self-signing workaround for Keychain issues ([01e3f8f](https://github.com/Draculabo/AntigravityManager/commit/01e3f8f8fd6dacc5eed214ed4b505d6d85f4bcff))
+
+### 🔧 Continuous Integration
+
+* setup semantic release configuration and github actions workflow ([d2945a6](https://github.com/Draculabo/AntigravityManager/commit/d2945a6e8a14d75f577716183cdff093443d9636))
+
 # Changelog
 
 All notable changes to this project will be documented in this file.
@@ -5,6 +38,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.1] - 2026-01-25
+
+### Bug Fixes
+
+- Fixed startup race condition causing cloud accounts verify failure ([f0718db]
+- Enabled WAL mode and force initialization on startup to resolve process resource contention ([1bce5d3])
+
+## [0.3.0] - 2026-01-23
+
+### New Features
+
+- Verify Google OAuth code automatically after receipt
+- Add button to open logs folder
+- Add expiration warning for Google OAuth authentication
+
+### Bug Fixes
+
+- Fixed `state.vscdb` path on Linux to include `User/globalStorage` subdirectory (Fixed [#26](https://github.com/Draculabo/AntigravityManager/issues/26))
+- Improved process detection on macOS/Linux using `find-process` to reliably identify the main application and exclude helper processes (Fixed [#27](https://github.com/Draculabo/AntigravityManager/issues/27))
+- Fixed keychain access error on macOS Apple Silicon (M1/M2/M3) by adding arm64 build to CI
+
+### Maintenance
+
+- Add VS Code settings for auto-formatting and ESLint
+
 ## [0.2.2] - 2026-01-19
 
 ### Bug Fixes

README.md

@@ -280,6 +280,24 @@ Please check:
 
 </details>
 
+<details>
+<summary><b>Q: macOS shows Keychain/Credential error and OAuth cannot be saved?</b></summary>
+
+This is a common macOS security behavior, usually when the app is unsigned or run directly from Downloads.
+This is a **temporary workaround** for personal use:
+
+1. Move the app to `/Applications`
+2. Run the following commands in Terminal (repeat after every update)
+
+```plaintext
+sudo xattr -dr com.apple.quarantine "/Applications/Antigravity Manager 2.app"
+codesign --force --deep --sign - "/Applications/Antigravity Manager 2.app"
+```
+
+Reopen the app and allow Keychain access if prompted.
+
+</details>
+
 <details>
 <summary><b>Q: How to report issues or suggestions?</b></summary>
 

README.zh-CN.md

@@ -280,6 +280,24 @@ AntigravityManager/
 
 </details>
 
+<details>
+<summary><b>Q: macOS 上提示 Keychain/凭据管理不可用，OAuth 无法保存？</b></summary>
+
+这是 macOS 安全机制导致的常见问题，通常出现在未签名的应用或从 Downloads 直接运行的场景。
+这是**临时方案**，仅适合个人设备：
+
+1. 将应用移动到 `/Applications`
+2. 打开终端执行以下命令（每次更新后都需要重新执行）
+
+```plaintext
+sudo xattr -dr com.apple.quarantine "/Applications/Antigravity Manager 2.app"
+codesign --force --deep --sign - "/Applications/Antigravity Manager 2.app"
+```
+
+重新打开应用后，Keychain 应会提示授权（可选“始终允许”）。
+
+</details>
+
 <details>
 <summary><b>Q: 如何反馈问题或建议？</b></summary>
 

openspec/project.md

@@ -93,7 +93,7 @@ src/
 **数据库位置：**
 * macOS: `~/Library/Application Support/Antigravity/User/globalStorage/state.vscdb`
 * Windows: `%APPDATA%/Antigravity/User/globalStorage/state.vscdb`
-* Linux: `~/.config/Antigravity/state.vscdb`
+* Linux: `~/.config/Antigravity/User/globalStorage/state.vscdb`
 
 **关键数据库键：**
 * `antigravityAuthStatus`: 认证状态和用户信息。

package.json

@@ -1,7 +1,7 @@
 {
   "name": "antigravity-manager",
   "productName": "Antigravity Manager",
-  "version": "0.2.2",
+  "version": "0.3.2",
   "description": "Antigravity Manager - Electron App",
   "main": ".vite/build/main.js",
   "private": true,
@@ -38,6 +38,9 @@
     "@eslint/compat": "^1.4.1",
     "@eslint/js": "^9.39.0",
     "@playwright/test": "^1.56.1",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.2",
     "@swc/core": "^1.15.8",
     "@tanstack/router-plugin": "^1.135.0",
     "@testing-library/jest-dom": "^6.9.1",
@@ -53,6 +56,7 @@
     "@vitejs/plugin-react": "^4.7.0",
     "babel-plugin-react-compiler": "1.0.0",
     "code-inspector-plugin": "^1.3.3",
+    "conventional-changelog-conventionalcommits": "^9.1.0",
     "electron": "^37.3.1",
     "electron-devtools-installer": "^4.0.0",
     "electron-playwright-helpers": "^1.8.2",
@@ -67,6 +71,8 @@
     "node-addon-api": "^8.3.1",
     "prettier": "^3.6.2",
     "prettier-plugin-tailwindcss": "^0.7.1",
+    "semantic-release": "^25.0.2",
+    "semantic-release-config-gitmoji": "^1.5.3",
     "sharp": "^0.34.5",
     "tailwindcss": "^4.1.16",
     "ts-node": "^10.9.2",
@@ -116,6 +122,7 @@
     "date-fns": "^4.1.0",
     "electron-squirrel-startup": "^1.0.1",
     "fastify": "^5.6.2",
+    "find-process": "^2.0.0",
     "happy-dom": "^20.0.10",
     "i18next": "^25.6.3",
     "i18next-browser-languagedetector": "^8.2.0",

release.config.cjs

@@ -0,0 +1,127 @@
+/**
+ * Semantic Release Configuration
+ *
+ * This configuration uses the specific release rules requested by the user,
+ * but adapts the plugin configuration to work with standard Conventional Commits
+ * instead of Gitmoji (since the project history doesn't use emojis).
+ */
+
+const releaseRules = [
+  {
+    release: 'minor',
+    type: 'feat',
+  },
+  {
+    release: 'patch',
+    type: 'fix',
+  },
+  {
+    release: 'patch',
+    type: 'perf',
+  },
+  {
+    release: 'patch',
+    type: 'style',
+  },
+  {
+    release: 'patch',
+    type: 'refactor',
+  },
+  {
+    release: 'patch',
+    type: 'build',
+  },
+  { release: 'patch', scope: 'README', type: 'docs' },
+  { release: 'patch', scope: 'README.md', type: 'docs' },
+  { release: false, type: 'docs' },
+  {
+    release: false,
+    type: 'test',
+  },
+  {
+    release: false,
+    type: 'ci',
+  },
+  {
+    release: false,
+    type: 'chore',
+  },
+  {
+    release: false,
+    type: 'wip',
+  },
+  {
+    release: 'major',
+    type: 'BREAKING CHANGE',
+  },
+  {
+    release: 'major',
+    scope: 'BREAKING CHANGE',
+  },
+  {
+    release: 'major',
+    subject: '*BREAKING CHANGE*',
+  },
+  { release: 'patch', subject: '*force release*' },
+  { release: 'patch', subject: '*force patch*' },
+  { release: 'minor', subject: '*force minor*' },
+  { release: 'major', subject: '*force major*' },
+  { release: false, subject: '*skip release*' },
+];
+
+module.exports = {
+  branches: ['main', 'master'],
+  plugins: [
+    [
+      '@semantic-release/commit-analyzer',
+      {
+        preset: 'conventionalcommits',
+        releaseRules: releaseRules,
+      },
+    ],
+    [
+      '@semantic-release/release-notes-generator',
+      {
+        preset: 'conventionalcommits',
+        presetConfig: {
+          types: [
+            { type: 'feat', section: '✨ Features' },
+            { type: 'fix', section: '🐛 Bug Fixes' },
+            { type: 'perf', section: '⚡ Performance Improvements' },
+            { type: 'revert', section: '⏪ Reverts' },
+            { type: 'docs', section: '📝 Documentation' },
+            { type: 'style', section: '💄 Styles' },
+            { type: 'refactor', section: '♻️ Code Refactoring' },
+            { type: 'test', section: '✅ Tests' },
+            { type: 'build', section: '👷 Build System' },
+            { type: 'ci', section: '🔧 Continuous Integration' },
+          ],
+        },
+      },
+    ],
+    [
+      '@semantic-release/changelog',
+      {
+        changelogFile: 'CHANGELOG.md',
+        changelogTitle: '<a name="readme-top"></a>\n\n# Changelog',
+      },
+    ],
+    '@semantic-release/npm', // Updates package.json and npm-shrinkwrap.json
+    [
+      '@semantic-release/github',
+      {
+        successComment: false,
+        failComment: false,
+        labels: false,
+        releaseName: 'v${nextRelease.version}',
+      },
+    ],
+    [
+      '@semantic-release/git',
+      {
+        assets: ['CHANGELOG.md', 'package.json', 'package-lock.json', 'npm-shrinkwrap.json'],
+        message: 'chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}',
+      },
+    ],
+  ],
+};

src/actions/system.ts

@@ -0,0 +1,5 @@
+import { ipc } from '@/ipc/manager';
+
+export function openLogDirectory() {
+  return ipc.client.system.openLogDirectory();
+}

src/components/CloudAccountList.tsx

@@ -41,6 +41,7 @@ import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
 import { useState, useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
+import { getLocalizedErrorMessage } from '@/utils/errorMessages';
 
 // ... (existing code: imports and comments)
 
@@ -62,19 +63,49 @@ export function CloudAccountList() {
   const [isAddDialogOpen, setIsAddDialogOpen] = useState(false);
   const [authCode, setAuthCode] = useState('');
 
+  const handleAddAccount = (codeVal?: string) => {
+    const codeToUse = codeVal || authCode;
+    if (!codeToUse) {
+      return;
+    }
+    addMutation.mutate(
+      { authCode: codeToUse },
+      {
+        onSuccess: () => {
+          setIsAddDialogOpen(false);
+          setAuthCode('');
+          toast({ title: t('cloud.toast.addSuccess') });
+        },
+        onError: (err) => {
+          toast({
+            title: t('cloud.toast.addFailed.title'),
+            description: getLocalizedErrorMessage(err, t),
+            variant: 'destructive',
+          });
+        },
+      },
+    );
+  };
   // Listen for Google Auth Code
   useEffect(() => {
     if (window.electron?.onGoogleAuthCode) {
+      console.log('[OAuth] Setting up auth code listener, dialog open:', isAddDialogOpen);
       const cleanup = window.electron.onGoogleAuthCode((code) => {
+        console.log('[OAuth] Received auth code via IPC:', code?.substring(0, 10) + '...');
         setAuthCode(code);
-        // Auto submit if dialog is open
-        if (isAddDialogOpen) {
-          handleAddAccount(code);
-        }
+        // Note: Auto-submit will be triggered by the authCode change effect below
       });
       return cleanup;
     }
-  }, [isAddDialogOpen]);
+  }, []);
+
+  // Auto-submit when authCode is set and dialog is open
+  useEffect(() => {
+    if (authCode && isAddDialogOpen && !addMutation.isPending) {
+      console.log('[OAuth] Auto-submitting auth code');
+      handleAddAccount(authCode);
+    }
+  }, [authCode, isAddDialogOpen]);
 
   // Batch Operations State
   const [selectedIds, setSelectedIds] = useState<Set<string>>(new Set());
@@ -103,7 +134,7 @@ export function CloudAccountList() {
         onError: (err) =>
           toast({
             title: t('cloud.toast.switchFailed'),
-            description: err.message,
+            description: getLocalizedErrorMessage(err, t),
             variant: 'destructive',
           }),
       },
@@ -169,35 +200,13 @@ export function CloudAccountList() {
       onError: (err) => {
         toast({
           title: t('cloud.toast.syncFailed.title'),
-          description: err.message,
+          description: getLocalizedErrorMessage(err, t),
           variant: 'destructive',
         });
       },
     });
   };
 
-  const handleAddAccount = (codeVal?: string) => {
-    const codeToUse = codeVal || authCode;
-    if (!codeToUse) return;
-    addMutation.mutate(
-      { authCode: codeToUse },
-      {
-        onSuccess: () => {
-          setIsAddDialogOpen(false);
-          setAuthCode('');
-          toast({ title: t('cloud.toast.addSuccess') });
-        },
-        onError: (err) => {
-          toast({
-            title: t('cloud.toast.addFailed.title'),
-            description: err.message,
-            variant: 'destructive',
-          });
-        },
-      },
-    );
-  };
-
   const openAuthUrl = async () => {
     try {
       await startAuthFlow();

src/ipc/cloud/authServer.ts

@@ -20,11 +20,13 @@ export class AuthServer {
         const error = url.searchParams.get('error');
 
         if (code) {
-          logger.info('AuthServer: Received authorization code');
+          logger.info(`AuthServer: Received authorization code: ${code.substring(0, 10)}...`);
 
           // Send code to renderer
           if (ipcContext.mainWindow) {
+            logger.info('AuthServer: Sending code to renderer via IPC');
             ipcContext.mainWindow.webContents.send('GOOGLE_AUTH_CODE', code);
+            logger.info('AuthServer: Code sent successfully');
           } else {
             logger.error('AuthServer: Main window not found, cannot send code');
           }

src/ipc/database/cloudHandler.ts

@@ -22,6 +22,7 @@ function ensureDatabaseInitialized(dbPath: string): void {
   let db: Database.Database | null = null;
   try {
     db = new Database(dbPath);
+    db.pragma('journal_mode = WAL');
 
     // Create accounts table
     // Storing complex objects (token, quota) as JSON strings for simplicity
@@ -73,7 +74,9 @@ function ensureDatabaseInitialized(dbPath: string): void {
 function getDb(): Database.Database {
   const dbPath = getCloudAccountsDbPath();
   ensureDatabaseInitialized(dbPath);
-  return new Database(dbPath);
+  const db = new Database(dbPath);
+  db.pragma('journal_mode = WAL');
+  return db;
 }
 
 export class CloudAccountRepo {
@@ -307,6 +310,7 @@ export class CloudAccountRepo {
     }
 
     const db = new Database(dbPath);
+    db.pragma('journal_mode = WAL');
     try {
       const row = db
         .prepare('SELECT value FROM ItemTable WHERE key = ?')
@@ -454,6 +458,7 @@ export class CloudAccountRepo {
 
     logger.info(`SyncLocal: Using Antigravity database at: ${dbPath}`);
     const ideDb = new Database(dbPath, { readonly: true });
+    ideDb.pragma('journal_mode = WAL');
     try {
       // 1. Read Raw Token Data
       const row = ideDb

src/ipc/database/handler.ts

@@ -8,6 +8,31 @@ import path from 'path';
 
 const KEYS_TO_BACKUP = ['antigravityAuthStatus', 'jetskiStateSync.agentManagerInitState'];
 
+function getDbWithWal(dbPath: string, options: Database.Options = {}): Database.Database {
+  const db = new Database(dbPath, options);
+  db.pragma('journal_mode = WAL');
+  return db;
+}
+
+/**
+ * Initializes the database and ensures WAL mode is enabled.
+ * Should be called on application startup.
+ */
+export function initDatabase(): void {
+  try {
+    const dbPaths = getAntigravityDbPaths();
+    if (dbPaths.length === 0) {
+      return;
+    }
+
+    const db = getDatabaseConnection();
+    db.close();
+    logger.info('Database initialized and verified (WAL mode)');
+  } catch (error) {
+    logger.error('Failed to initialize database on startup', error);
+  }
+}
+
 /**
  * Ensures that the database file exists.
  * @param dbPath {string} The path to the database file.
@@ -59,7 +84,7 @@ export function getDatabaseConnection(dbPath?: string): Database.Database {
   ensureDatabaseExists(targetPath);
 
   try {
-    return new Database(targetPath, { readonly: false, fileMustExist: false });
+    return getDbWithWal(targetPath, { readonly: false, fileMustExist: false });
   } catch (error: unknown) {
     const err = error as { code?: string };
     if (err.code === 'SQLITE_BUSY' || err.code === 'SQLITE_LOCKED') {
@@ -69,6 +94,12 @@ export function getDatabaseConnection(dbPath?: string): Database.Database {
   }
 }
 
+/**
+ * Gets a database connection and enables WAL mode.
+ * @param dbPath {string} The path to the database file.
+ * @returns {Database.Database} The database connection.
+ */
+
 /**
  * Gets the current account info.
  * @returns {AccountInfo} The current account info.

src/ipc/process/handler.ts

@@ -1,63 +1,151 @@
 import { exec, execSync } from 'child_process';
 import { promisify } from 'util';
+import findProcess, { ProcessInfo } from 'find-process';
 import { getAntigravityExecutablePath, isWsl } from '../../utils/paths';
 import { logger } from '../../utils/logger';
 
 const execAsync = promisify(exec);
 
+/**
+ * Helper process name patterns to exclude (Electron helper processes)
+ */
+const HELPER_PATTERNS = [
+  'helper',
+  'plugin',
+  'renderer',
+  'gpu',
+  'crashpad',
+  'utility',
+  'audio',
+  'sandbox',
+  'language_server',
+];
+
+/**
+ * Check if a process is a helper/auxiliary process that should be excluded.
+ * @param name Process name (lowercase)
+ * @param cmd Process command line (lowercase)
+ * @returns True if the process is a helper process
+ */
+function isHelperProcess(name: string, cmd: string): boolean {
+  const nameLower = name.toLowerCase();
+  const cmdLower = cmd.toLowerCase();
+
+  // Check for --type= argument (Electron helper process indicator)
+  if (cmdLower.includes('--type=')) {
+    return true;
+  }
+
+  // Check for helper patterns in process name
+  for (const pattern of HELPER_PATTERNS) {
+    if (nameLower.includes(pattern)) {
+      return true;
+    }
+  }
+
+  // Check for crashpad in path
+  if (cmdLower.includes('crashpad')) {
+    return true;
+  }
+
+  return false;
+}
+
+function isPgrepNoMatchError(error: unknown): boolean {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+
+  const message = error.message;
+  const hasPgrep = message.includes('pgrep -xi Antigravity');
+  const code = (error as { code?: number }).code;
+  return hasPgrep && code === 1;
+}
+
 /**
  * Checks if the Antigravity process is running.
+ * Uses find-process package for robust cross-platform process detection.
  * @returns {boolean} True if the Antigravity process is running, false otherwise.
  */
 export async function isProcessRunning(): Promise<boolean> {
   try {
     const platform = process.platform;
-    let command = '';
+    const currentPid = process.pid;
 
-    if (platform === 'win32' || isWsl()) {
-      // Use absolute path for tasklist to be safe on Windows too
-      const cmd = isWsl()
-        ? '/mnt/c/Windows/System32/tasklist.exe'
-        : process.env.SystemRoot // Usually C:\Windows
-          ? `${process.env.SystemRoot}\\System32\\tasklist.exe`
-          : 'tasklist';
-
-      command = `${cmd} /FI "IMAGENAME eq Antigravity.exe" /NH`;
-    } else {
-      // macOS and Linux (native)
-      command = 'pgrep -xi Antigravity';
+    // Use find-process to search for Antigravity processes
+    // 'name' search type matches process name
+    let processes: ProcessInfo[] = [];
+    try {
+      processes = await findProcess('name', 'Antigravity', true);
+    } catch (error) {
+      if (isPgrepNoMatchError(error)) {
+        logger.debug('No Antigravity process found (pgrep returned 1)');
+        return false;
+      }
+      throw error;
     }
 
-    logger.debug(`Checking process with command: ${command}`);
-    // Increased timeout to 4000ms to avoid flakiness with tasklist/wmic
-    try {
-      const { stdout } = await execAsync(command, { timeout: 4000 });
-      logger.debug(`Process check stdout: ${stdout.trim()}`);
+    logger.debug(`Found ${processes.length} processes matching 'Antigravity'`);
 
-      if (platform === 'win32' || isWsl()) {
-        return stdout.includes('Antigravity.exe');
-      } else {
-        // pgrep returns PIDs if found, empty if not
-        return stdout.trim().length > 0;
+    for (const proc of processes) {
+      // Skip self
+      if (proc.pid === currentPid) {
+        continue;
       }
-    } catch (cmdError) {
-      if (platform === 'win32' && !isWsl()) {
-        logger.warn('tasklist failed, trying wmic fallback...', cmdError);
-        // Fallback to wmic (filtered)
-        try {
-          const wmicCmd = 'wmic process where "name=\'Antigravity.exe\'" get ProcessId';
-          const { stdout } = await execAsync(wmicCmd, { timeout: 4000 });
-          return stdout.includes('ProcessId');
-        } catch (wmicError) {
-          logger.error('wmic fallback also failed', wmicError);
-          return false;
+
+      const name = proc.name?.toLowerCase() || '';
+      const cmd = proc.cmd?.toLowerCase() || '';
+
+      // Skip manager process
+      if (
+        name.includes('manager') ||
+        cmd.includes('manager') ||
+        cmd.includes('antigravity-manager')
+      ) {
+        continue;
+      }
+
+      // Skip helper processes
+      if (isHelperProcess(name, cmd)) {
+        continue;
+      }
+
+      if (platform === 'darwin') {
+        // macOS: Check for Antigravity.app in path
+        if (cmd.includes('antigravity.app')) {
+          logger.debug(
+            `Found Antigravity process: PID=${proc.pid}, name=${name}, cmd=${cmd.substring(0, 100)}`,
+          );
+          return true;
+        }
+        // Also check if the process name is exactly 'Antigravity' (main process)
+        if (name === 'antigravity' && !isHelperProcess(name, cmd)) {
+          logger.debug(`Found Antigravity process: PID=${proc.pid}, name=${name}`);
+          return true;
+        }
+      } else if (platform === 'win32') {
+        // Windows: Check for Antigravity.exe
+        if (name === 'antigravity.exe' || name === 'antigravity') {
+          logger.debug(`Found Antigravity process: PID=${proc.pid}, name=${name}`);
+          return true;
+        }
+      } else {
+        // Linux: Check for antigravity in name or path (but not tools)
+        if (
+          (name.includes('antigravity') || cmd.includes('/antigravity')) &&
+          !name.includes('tools')
+        ) {
+          logger.debug(
+            `Found Antigravity process: PID=${proc.pid}, name=${name}, cmd=${cmd.substring(0, 100)}`,
+          );
+          return true;
         }
       }
-      throw cmdError;
     }
+
+    return false;
   } catch (error) {
-    logger.error('Error checking process status:', error);
-    // pgrep returns exit code 1 if no process found
+    logger.error('Error checking process status with find-process:', error);
     return false;
   }
 }

src/ipc/system/handler.ts

@@ -1,6 +1,8 @@
 import { os } from '@orpc/server';
 import { z } from 'zod';
 import { networkInterfaces } from 'os';
+import { shell } from 'electron';
+import { getAgentDir } from '../../utils/paths';
 
 // Schema for IP info
 const IpInfoSchema = z.object({
@@ -61,4 +63,10 @@ export const systemHandler = os.router({
 
     return results;
   }),
+
+  // Open log directory in file explorer
+  openLogDirectory: os.output(z.void()).handler(async () => {
+    const logDir = getAgentDir();
+    await shell.openPath(logDir);
+  }),
 });

src/localization/i18n.ts

@@ -30,9 +30,18 @@ i18n
             deleteBackup: 'Delete Backup',
             backupCurrent: 'Backup Current',
             retry: 'Retry',
+            openLogs: 'Open Log Directory',
           },
           error: {
             generic: 'An unexpected error occurred.',
+            keychainUnavailable: 'Keychain is unavailable.',
+            keychainHint: {
+              translocation:
+                'Detected macOS App Translocation. Move the app to /Applications and reopen.',
+              keychainDenied:
+                'Keychain access denied. The app may be unsigned; see README for the self-signing workaround.',
+              signNotarize: 'Please use a signed and notarized build when available.',
+            },
           },
           nav: {
             accounts: 'Accounts',
@@ -77,6 +86,7 @@ i18n
             version: 'Version',
             platform: 'Platform',
             license: 'License',
+            openLogDir: 'Open',
             account: {
               title: 'Account Settings',
               description: 'Configure automatic account refresh and sync.',
@@ -304,9 +314,16 @@ i18n
             deleteBackup: '删除备份',
             backupCurrent: '备份当前账号',
             retry: '重试',
+            openLogs: '打开日志目录',
           },
           error: {
             generic: '发生未知错误。',
+            keychainUnavailable: 'Keychain 不可用。',
+            keychainHint: {
+              translocation: '检测到 macOS App Translocation。请将应用移动到 /Applications 后重试。',
+              keychainDenied: 'Keychain 访问被拒绝。应用可能未签名，可参考 README 的“macOS 自签”说明。',
+              signNotarize: '请在可用时使用已签名并公证的版本。',
+            },
           },
           nav: {
             accounts: '账号',
@@ -351,6 +368,7 @@ i18n
             version: '版本',
             platform: '平台',
             license: '许可证',
+            openLogDir: '打开',
             account: {
               title: '账号设置',
               description: '配置自动刷新和同步账号。',

src/main.ts

@@ -1,4 +1,4 @@
-import { app, BrowserWindow, Tray, Menu, nativeImage } from 'electron';
+import { app, BrowserWindow } from 'electron';
 import path from 'path';
 import fs from 'fs';
 
@@ -9,6 +9,7 @@ import { IPC_CHANNELS } from './constants';
 import { updateElectronApp, UpdateSourceType } from 'update-electron-app';
 import { logger } from './utils/logger';
 import { CloudAccountRepo } from './ipc/database/cloudHandler';
+import { initDatabase } from './ipc/database/handler';
 import { CloudMonitorService } from './services/CloudMonitorService';
 
 // Static Imports to fix Bundle Resolution Errors
@@ -223,6 +224,19 @@ process.on('unhandledRejection', (reason) => {
 
 app
   .whenReady()
+  .then(async () => {
+    logger.info('Step: Initialize CloudAccountRepo');
+    try {
+      await CloudAccountRepo.init();
+    } catch (e) {
+      logger.error('Startup: Failed to initialize CloudAccountRepo', e);
+      // We might want to exit here or show a dialog, but for now we proceed
+      // though functionality will be broken.
+    }
+
+    logger.info('Step: Initialize Antigravity DB (WAL Mode)');
+    initDatabase();
+  })
   .then(() => {
     logger.info('Step: setupORPC');
     return setupORPC();
@@ -242,9 +256,6 @@ app
   .then(async () => {
     // Initialize Cloud Monitor if enabled
     try {
-      // Initialize DB & Migrate to Encrypted Storage
-      await CloudAccountRepo.init();
-
       // Start OAuth Server
       AuthServer.start();
 

src/routes/settings.tsx

@@ -17,9 +17,10 @@ import { getAppVersion, getPlatform } from '@/actions/app';
 import { useTranslation } from 'react-i18next';
 import { setAppLanguage } from '@/actions/language';
 import { useAppConfig } from '@/hooks/useAppConfig';
-import { Loader2 } from 'lucide-react';
+import { Loader2, FolderOpen } from 'lucide-react';
 import { useState, useEffect } from 'react';
 import { ProxyConfig } from '@/types/config';
+import { openLogDirectory } from '@/actions/system';
 
 function SettingsPage() {
   const { theme, setTheme } = useTheme();
@@ -193,6 +194,15 @@ function SettingsPage() {
 
                 <div className="text-muted-foreground">{t('settings.license')}</div>
                 <div className="font-medium">CC BY-NC-SA 4.0</div>
+
+                <div className="text-muted-foreground">{t('action.openLogs')}</div>
+                <button
+                  onClick={() => openLogDirectory()}
+                  className="flex items-center gap-2 font-medium text-blue-600 hover:text-blue-700 dark:text-blue-400 dark:hover:text-blue-300"
+                >
+                  <FolderOpen className="h-4 w-4" />
+                  <span>{t('settings.openLogDir', 'Open')}</span>
+                </button>
               </div>
             </CardContent>
           </Card>

src/services/GoogleAPIService.ts

@@ -6,8 +6,6 @@ import { ProxyAgent } from 'undici';
 const CLIENT_ID = '1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com';
 const CLIENT_SECRET = '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';
 
-declare const fetch: any;
-
 const URLS = {
   TOKEN: 'https://oauth2.googleapis.com/token',
   USER_INFO: 'https://www.googleapis.com/oauth2/v2/userinfo',
@@ -20,6 +18,18 @@ const URLS = {
 const USER_AGENT = 'antigravity/1.11.3 Darwin/arm64';
 const REDIRECT_URI = 'http://localhost:8888/oauth-callback';
 
+// Request timeout in milliseconds (30 seconds)
+const REQUEST_TIMEOUT_MS = 30000;
+
+/**
+ * Creates an AbortSignal that times out after the specified duration.
+ */
+function createTimeoutSignal(ms: number): AbortSignal {
+  const controller = new AbortController();
+  setTimeout(() => controller.abort(), ms);
+  return controller.signal;
+}
+
 // --- Types ---
 
 export interface TokenResponse {
@@ -65,7 +75,7 @@ interface LoadProjectResponse {
 // --- Service Implementation ---
 
 export class GoogleAPIService {
-  private static getFetchOptions(): any {
+  private static getFetchOptions() {
     try {
       const config = ConfigManager.loadConfig();
       if (config.proxy?.upstream_proxy?.enabled && config.proxy.upstream_proxy.url) {
@@ -121,7 +131,17 @@ export class GoogleAPIService {
       method: 'POST',
       headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
       body: params,
+      signal: createTimeoutSignal(REQUEST_TIMEOUT_MS),
       ...this.getFetchOptions(),
+    }).catch((err: unknown) => {
+      if (err instanceof Error) {
+        if (err.name === 'AbortError') {
+          throw new Error(
+            'Token exchange timed out. Please check your network connection and try again.',
+          );
+        }
+      }
+      throw err;
     });
 
     if (!response.ok) {
@@ -147,7 +167,17 @@ export class GoogleAPIService {
       method: 'POST',
       headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
       body: params,
+      signal: createTimeoutSignal(REQUEST_TIMEOUT_MS),
       ...this.getFetchOptions(),
+    }).catch((err: unknown) => {
+      if (err instanceof Error) {
+        if (err.name === 'AbortError') {
+          throw new Error(
+            'Token refresh timed out. Please check your network connection and try again.',
+          );
+        }
+      }
+      throw err;
     });
 
     if (!response.ok) {
@@ -166,7 +196,17 @@ export class GoogleAPIService {
   static async getUserInfo(accessToken: string): Promise<UserInfo> {
     const response = await fetch(URLS.USER_INFO, {
       headers: { Authorization: `Bearer ${accessToken}` },
+      signal: createTimeoutSignal(REQUEST_TIMEOUT_MS),
       ...this.getFetchOptions(),
+    }).catch((err: unknown) => {
+      if (err instanceof Error) {
+        if (err.name === 'AbortError') {
+          throw new Error(
+            'User info request timed out. Please check your network connection and try again.',
+          );
+        }
+      }
+      throw err;
     });
 
     if (!response.ok) {
@@ -221,7 +261,7 @@ export class GoogleAPIService {
     const projectId = await this.fetchProjectId(accessToken);
 
     // 2. Build Payload
-    const payload: Record<string, any> = {};
+    const payload: Record<string, unknown> = {};
     if (projectId) {
       payload['project'] = projectId;
     }
@@ -285,11 +325,13 @@ export class GoogleAPIService {
         }
 
         return result;
-      } catch (e: any) {
-        console.warn(
-          `[GoogleAPIService] Request failed: ${e.message} (Attempt ${attempt}/${maxRetries})`,
-        );
-        lastError = e;
+      } catch (e: unknown) {
+        if (e instanceof Error) {
+          console.warn(
+            `[GoogleAPIService] Request failed: ${e.message} (Attempt ${attempt}/${maxRetries})`,
+          );
+        }
+        lastError = e instanceof Error ? e : new Error(String(e));
         if (attempt < maxRetries) {
           await new Promise((r) => setTimeout(r, 1000));
         }

src/tests/unit/google-api-timeout.test.ts

@@ -0,0 +1,82 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// Mock module to test timeout behavior
+describe('GoogleAPIService Timeout', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('should abort request after timeout', async () => {
+    const TIMEOUT_MS = 100;
+
+    // Recreate the same logic used in GoogleAPIService
+    const createTimeoutSignal = (ms: number): AbortSignal => {
+      const controller = new AbortController();
+      setTimeout(() => controller.abort(), ms);
+      return controller.signal;
+    };
+
+    const signal = createTimeoutSignal(TIMEOUT_MS);
+
+    // Verify signal is not aborted initially
+    expect(signal.aborted).toBe(false);
+
+    // Fast-forward time
+    vi.advanceTimersByTime(TIMEOUT_MS + 10);
+
+    // Signal should now be aborted
+    expect(signal.aborted).toBe(true);
+  });
+
+  it('should set aborted state when controller.abort() is called', () => {
+    const controller = new AbortController();
+
+    // Initially not aborted
+    expect(controller.signal.aborted).toBe(false);
+
+    // Abort the controller
+    controller.abort();
+
+    // Signal should now be aborted
+    expect(controller.signal.aborted).toBe(true);
+  });
+
+  it('should transform AbortError to user-friendly message', () => {
+    // This tests our error transformation logic from GoogleAPIService
+    const handleAbortError = (err: Error) => {
+      if (err.name === 'AbortError') {
+        throw new Error(
+          'Token exchange timed out. Please check your network connection and try again.',
+        );
+      }
+      throw err;
+    };
+
+    const abortError = new Error('The operation was aborted');
+    abortError.name = 'AbortError';
+
+    expect(() => handleAbortError(abortError)).toThrow(
+      'Token exchange timed out. Please check your network connection and try again.',
+    );
+  });
+
+  it('should not transform non-AbortError', () => {
+    const handleAbortError = (err: Error) => {
+      if (err.name === 'AbortError') {
+        throw new Error(
+          'Token exchange timed out. Please check your network connection and try again.',
+        );
+      }
+      throw err;
+    };
+
+    const networkError = new Error('Network failure');
+    networkError.name = 'NetworkError';
+
+    expect(() => handleAbortError(networkError)).toThrow('Network failure');
+  });
+});

src/tests/unit/process.test.ts

@@ -1,55 +1,182 @@
-import { describe, it, expect, vi } from 'vitest';
-import { isProcessRunning, closeAntigravity, startAntigravity } from '../../ipc/process/handler';
-import { exec } from 'child_process';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
 
-vi.mock('child_process', () => {
-  return {
-    exec: vi.fn(),
-    default: { exec: vi.fn() },
-  };
-});
-
-// Mock promisify to return a function that returns a promise
-vi.mock('util', () => ({
-  promisify: (fn: unknown) => fn,
-  default: { promisify: (fn: unknown) => fn },
+// Mock find-process module
+vi.mock('find-process', () => ({
+  default: vi.fn(),
 }));
 
+// Mock logger to avoid console output during tests
+vi.mock('../../utils/logger', () => ({
+  logger: {
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+  },
+}));
+
+// Mock paths module to avoid child_process issues
+vi.mock('../../utils/paths', () => ({
+  getAntigravityExecutablePath: vi.fn(() => '/path/to/antigravity'),
+  isWsl: vi.fn(() => false),
+}));
+
+// Import after mocks are set up
+import { isProcessRunning, closeAntigravity, startAntigravity } from '../../ipc/process/handler';
+import findProcess from 'find-process';
+
 describe('Process Handler', () => {
-  it('should check if process is running', async () => {
-    // Mock exec to return stdout
-    const execMock = exec as unknown as ReturnType<typeof vi.fn>;
-    execMock.mockImplementation((cmd, cb) => {
-      if (cb) cb(null, { stdout: '12345' }, { stderr: '' });
-      return { stdout: '12345' };
+  const mockFindProcess = findProcess as unknown as ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('isProcessRunning', () => {
+    it('should return true when Antigravity main process is found on macOS', async () => {
+      Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+      Object.defineProperty(process, 'pid', { value: 1000, configurable: true });
+
+      mockFindProcess.mockResolvedValue([
+        {
+          pid: 12345,
+          name: 'Antigravity',
+          cmd: '/Applications/Antigravity.app/Contents/MacOS/Antigravity',
+        },
+      ]);
+
+      const result = await isProcessRunning();
+      expect(result).toBe(true);
+      expect(mockFindProcess).toHaveBeenCalledWith('name', 'Antigravity', true);
     });
 
-    // Wait, promisify wraps exec.
-    // If I mock exec, promisify(exec) will use the mock.
-    // But my mock implementation needs to match what promisify expects or I need to mock the promisified function.
-    // Since I mocked 'util', promisify returns the fn itself.
-    // So execAsync IS exec.
-    // But exec signature is (cmd, options, callback) or (cmd, callback).
-    // My implementation calls execAsync(command).
-    // So I should mock exec to return a Promise if I mocked promisify to return fn?
-    // No, if promisify returns fn, then `await execAsync(cmd)` means `await exec(cmd)`.
-    // `exec` returns a ChildProcess, not a Promise.
-    // So my mock of `util` is wrong if I want `await execAsync` to work.
-    // Better to mock the module that exports execAsync if possible, or mock `util` correctly.
-    // Or just mock `child_process` and use `vi.mocked(exec)`.
-    // But `promisify` is the key.
+    it('should return false when only helper processes are found', async () => {
+      Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+      Object.defineProperty(process, 'pid', { value: 1000, configurable: true });
 
-    // Let's rely on vitest mocking capabilities.
-    // If I don't mock util, promisify will wrap the mocked exec.
-    // The mocked exec should behave like real exec (taking a callback).
+      mockFindProcess.mockResolvedValue([
+        {
+          pid: 12346,
+          name: 'Antigravity Helper (Renderer)',
+          cmd: '/Applications/Antigravity.app/Contents/Frameworks/Antigravity Helper (Renderer).app --type=renderer',
+        },
+        {
+          pid: 12347,
+          name: 'Antigravity Helper (GPU)',
+          cmd: '/Applications/Antigravity.app/Contents/Frameworks/Antigravity Helper (GPU).app --type=gpu-process',
+        },
+      ]);
+
+      const result = await isProcessRunning();
+      expect(result).toBe(false);
+    });
+
+    it('should return false when only manager process is found', async () => {
+      Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+      Object.defineProperty(process, 'pid', { value: 1000, configurable: true });
+
+      mockFindProcess.mockResolvedValue([
+        {
+          pid: 12348,
+          name: 'Antigravity Manager',
+          cmd: '/Applications/Antigravity Manager.app/Contents/MacOS/Antigravity Manager',
+        },
+      ]);
+
+      const result = await isProcessRunning();
+      expect(result).toBe(false);
+    });
+
+    it('should return false when no processes are found', async () => {
+      Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+      Object.defineProperty(process, 'pid', { value: 1000, configurable: true });
+
+      mockFindProcess.mockResolvedValue([]);
+
+      const result = await isProcessRunning();
+      expect(result).toBe(false);
+    });
+
+    it('should skip self process', async () => {
+      Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+      Object.defineProperty(process, 'pid', { value: 12345, configurable: true });
+
+      mockFindProcess.mockResolvedValue([
+        {
+          pid: 12345, // Same as current PID
+          name: 'Antigravity',
+          cmd: '/Applications/Antigravity.app/Contents/MacOS/Antigravity',
+        },
+      ]);
+
+      const result = await isProcessRunning();
+      expect(result).toBe(false);
+    });
+
+    it('should return true when Antigravity.exe is found on Windows', async () => {
+      Object.defineProperty(process, 'platform', { value: 'win32', configurable: true });
+      Object.defineProperty(process, 'pid', { value: 1000, configurable: true });
+
+      mockFindProcess.mockResolvedValue([
+        {
+          pid: 12345,
+          name: 'Antigravity.exe',
+          cmd: 'C:\\Program Files\\Antigravity\\Antigravity.exe',
+        },
+      ]);
+
+      const result = await isProcessRunning();
+      expect(result).toBe(true);
+    });
+
+    it('should return true when antigravity is found on Linux', async () => {
+      Object.defineProperty(process, 'platform', { value: 'linux', configurable: true });
+      Object.defineProperty(process, 'pid', { value: 1000, configurable: true });
+
+      mockFindProcess.mockResolvedValue([
+        {
+          pid: 12345,
+          name: 'antigravity',
+          cmd: '/usr/bin/antigravity',
+        },
+      ]);
+
+      const result = await isProcessRunning();
+      expect(result).toBe(true);
+    });
+
+    it('should handle find-process errors gracefully', async () => {
+      Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+      Object.defineProperty(process, 'pid', { value: 1000, configurable: true });
+
+      mockFindProcess.mockRejectedValue(new Error('Process enumeration failed'));
+
+      const result = await isProcessRunning();
+      expect(result).toBe(false);
+    });
+
+    it('should exclude processes with --type= argument', async () => {
+      Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+      Object.defineProperty(process, 'pid', { value: 1000, configurable: true });
+
+      mockFindProcess.mockResolvedValue([
+        {
+          pid: 12345,
+          name: 'Antigravity',
+          cmd: '/Applications/Antigravity.app/Contents/MacOS/Antigravity --type=utility',
+        },
+      ]);
+
+      const result = await isProcessRunning();
+      expect(result).toBe(false);
+    });
   });
 
-  // Skip complex mocking tests for now as they are fragile without proper setup.
-  // I'll write a basic test structure.
-
-  it('should be defined', () => {
-    expect(isProcessRunning).toBeDefined();
-    expect(closeAntigravity).toBeDefined();
-    expect(startAntigravity).toBeDefined();
+  describe('Module exports', () => {
+    it('should export all required functions', () => {
+      expect(isProcessRunning).toBeDefined();
+      expect(closeAntigravity).toBeDefined();
+      expect(startAntigravity).toBeDefined();
+    });
   });
 });

src/utils/errorMessages.ts

@@ -0,0 +1,39 @@
+import type { TFunction } from 'i18next';
+
+const KEYCHAIN_ERROR_CODE = 'ERR_KEYCHAIN_UNAVAILABLE';
+const KEYCHAIN_HINT_TRANSLOCATION = 'HINT_APP_TRANSLOCATION';
+const KEYCHAIN_HINT_KEYCHAIN_DENIED = 'HINT_KEYCHAIN_DENIED';
+const KEYCHAIN_HINT_SIGN_NOTARIZE = 'HINT_SIGN_NOTARIZE';
+
+const KEYCHAIN_HINT_I18N_MAP: Record<string, string> = {
+  [KEYCHAIN_HINT_TRANSLOCATION]: 'error.keychainHint.translocation',
+  [KEYCHAIN_HINT_KEYCHAIN_DENIED]: 'error.keychainHint.keychainDenied',
+  [KEYCHAIN_HINT_SIGN_NOTARIZE]: 'error.keychainHint.signNotarize',
+};
+
+function resolveKeychainMessage(hintCode: string | undefined, t: TFunction): string {
+  const base = t('error.keychainUnavailable');
+  if (!hintCode) {
+    return base;
+  }
+
+  const hintKey = KEYCHAIN_HINT_I18N_MAP[hintCode];
+  if (!hintKey) {
+    return base;
+  }
+
+  return `${base} ${t(hintKey)}`;
+}
+
+export function getLocalizedErrorMessage(error: unknown, t: TFunction): string {
+  if (error instanceof Error) {
+    const rawMessage = error.message;
+    const [code, hint] = rawMessage.split('|');
+    if (code === KEYCHAIN_ERROR_CODE) {
+      return resolveKeychainMessage(hint, t);
+    }
+    return rawMessage;
+  }
+
+  return String(error);
+}

src/utils/paths.ts

@@ -124,6 +124,8 @@ export function getAntigravityDbPaths(): string[] {
   }
 
   if (process.platform === 'linux') {
+    paths.push(path.join(appData, 'User', 'globalStorage', 'state.vscdb'));
+    paths.push(path.join(appData, 'User', 'state.vscdb'));
     paths.push(path.join(appData, 'state.vscdb'));
     return paths;
   }

src/utils/security.ts

@@ -1,13 +1,43 @@
 import keytar from 'keytar';
 import crypto from 'crypto';
+import { app } from 'electron';
 import { logger } from './logger';
 
 const SERVICE_NAME = 'AntigravityManager';
 const ACCOUNT_NAME = 'MasterKey';
+const KEYCHAIN_ERROR_CODE = 'ERR_KEYCHAIN_UNAVAILABLE';
+const KEYCHAIN_HINT_TRANSLOCATION = 'HINT_APP_TRANSLOCATION';
+const KEYCHAIN_HINT_KEYCHAIN_DENIED = 'HINT_KEYCHAIN_DENIED';
+const KEYCHAIN_HINT_SIGN_NOTARIZE = 'HINT_SIGN_NOTARIZE';
 
 // Cache the key in memory to avoid frequent system calls
 let cachedMasterKey: Buffer | null = null;
 
+function buildKeychainAccessHint(error: unknown): string | null {
+  if (process.platform !== 'darwin') {
+    return null;
+  }
+
+  let appPath = '';
+  try {
+    appPath = app.getAppPath();
+  } catch {
+    appPath = '';
+  }
+
+  const isTranslocated = appPath.includes('/AppTranslocation/');
+  if (isTranslocated) {
+    return KEYCHAIN_HINT_TRANSLOCATION;
+  }
+
+  const errorMessage = error instanceof Error ? error.message : String(error);
+  if (errorMessage.toLowerCase().includes('keychain')) {
+    return KEYCHAIN_HINT_KEYCHAIN_DENIED;
+  }
+
+  return KEYCHAIN_HINT_SIGN_NOTARIZE;
+}
+
 async function getOrGenerateMasterKey(): Promise<Buffer> {
   if (cachedMasterKey) return cachedMasterKey;
 
@@ -25,16 +55,17 @@ async function getOrGenerateMasterKey(): Promise<Buffer> {
     cachedMasterKey = Buffer.from(hexKey, 'hex');
     return cachedMasterKey;
   } catch (error) {
+    const hint = buildKeychainAccessHint(error);
     logger.error('Security: Failed to access keychain/credential manager', error);
     // Fallback? If we can't store the key, we can't persistently encrypt.
     // For now, throw to prevent data loss (better not to write than to write something we can't decrypt later or write plain text when promised encrypted)
-    throw new Error('Key management system unavailable');
+    const message = hint ? `${KEYCHAIN_ERROR_CODE}|${hint}` : KEYCHAIN_ERROR_CODE;
+    throw new Error(message);
   }
 }
 
 const ALGORITHM = 'aes-256-gcm';
 const IV_LENGTH = 16;
-const AUTH_TAG_LENGTH = 16;
 
 /**
  * Encrypts a string using AES-256-GCM.