chore(release): 0.4.0 [skip ci]

## [0.4.0](https://github.com/Draculabo/AntigravityManager/compare/v0.3.5...v0.4.0) (2026-01-28)

### ✨ Features

* add system autostart and single-instance support ([ea51253](https://github.com/Draculabo/AntigravityManager/commit/ea51253d589abd537682344d3bdb684b8fc9a511))
* implement smart foreground quota refresh with debounce ([dd9e84a](https://github.com/Draculabo/AntigravityManager/commit/dd9e84a0dbefad6066193b6bd468689a755a02e3))

### 🐛 Bug Fixes

* stub nestjs optional modules for packaging ([f0eb7c6](https://github.com/Draculabo/AntigravityManager/commit/f0eb7c6b619a3ea9ea203d66f5dbce731d731e3c))

.github/workflows/publish.yaml

@@ -1,9 +1,8 @@
 name: Publish Release
 
 on:
-  push:
+  release:
-    tags:
+    types: [published]
-      - 'v*'
   workflow_dispatch:
 
 jobs:

.github/workflows/release.yml

@@ -0,0 +1,37 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+      - beta
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  release:
+    name: Semantic Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required for semantic-release to analyze commits
+          persist-credentials: false # We use a token in the next steps
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} # Use GH_TOKEN to trigger other workflows
+        run: npx semantic-release

CHANGELOG.md

@@ -1,34 +1,94 @@
+<a name="readme-top"></a>
+
 # Changelog
 
-All notable changes to this project will be documented in this file.
+## [0.4.0](https://github.com/Draculabo/AntigravityManager/compare/v0.3.5...v0.4.0) (2026-01-28)
 
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+### ✨ Features
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.3.0-rc.3] - 2026-01-21
+* add system autostart and single-instance support ([ea51253](https://github.com/Draculabo/AntigravityManager/commit/ea51253d589abd537682344d3bdb684b8fc9a511))
+* implement smart foreground quota refresh with debounce ([dd9e84a](https://github.com/Draculabo/AntigravityManager/commit/dd9e84a0dbefad6066193b6bd468689a755a02e3))
+
+### 🐛 Bug Fixes
+
+* stub nestjs optional modules for packaging ([f0eb7c6](https://github.com/Draculabo/AntigravityManager/commit/f0eb7c6b619a3ea9ea203d66f5dbce731d731e3c))
+
+## [0.3.5](https://github.com/Draculabo/AntigravityManager/compare/v0.3.4...v0.3.5) (2026-01-26)
+
+### 🐛 Bug Fixes
+
+* "Check Quota Now" button not refreshing UI after polling ([#42](https://github.com/Draculabo/AntigravityManager/issues/42)) ([e959ee3](https://github.com/Draculabo/AntigravityManager/commit/e959ee346e7c26a8a4c5b7deefa5bd2452153f9d))
+
+### 📝 Documentation
+
+* remove beta download links from README ([5a21680](https://github.com/Draculabo/AntigravityManager/commit/5a2168030eac4ddeffa1c3b002b2de48b6a11a8f))
+
+## [0.3.4](https://github.com/Draculabo/AntigravityManager/compare/v0.3.3...v0.3.4) (2026-01-26)
+
+### 🐛 Bug Fixes
+
+* **security:** add safeStorage fallback for production builds ([#38](https://github.com/Draculabo/AntigravityManager/issues/38)) ([#43](https://github.com/Draculabo/AntigravityManager/issues/43)) ([0208058](https://github.com/Draculabo/AntigravityManager/commit/02080588b764ed88a5831152a3a1249f1d077d29))
+
+### 📝 Documentation
+
+* update beta release link ([d5ee08d](https://github.com/Draculabo/AntigravityManager/commit/d5ee08d5a06a915a8b82f680b38e2f532105498c))
+
+## [0.3.4-beta.1](https://github.com/Draculabo/AntigravityManager/compare/v0.3.3...v0.3.4-beta.1) (2026-01-25)
+
+### 🐛 Bug Fixes
+
+* **security:** add safeStorage fallback for production builds ([#38](https://github.com/Draculabo/AntigravityManager/issues/38)) ([92dc2f6](https://github.com/Draculabo/AntigravityManager/commit/92dc2f6f2169eb1a32950694387f2333ea2de682))
+
+## [0.3.3](https://github.com/Draculabo/AntigravityManager/compare/v0.3.2...v0.3.3) (2026-01-25)
+
+### 🐛 Bug Fixes
+
+* accept lowercase antigravity in process detection ([0d4e2ab](https://github.com/Draculabo/AntigravityManager/commit/0d4e2ab21f37704e09ef1a67c181c48b42df1180))
+
+### 📝 Documentation
+
+* add beta download link to readme ([f15bb48](https://github.com/Draculabo/AntigravityManager/commit/f15bb48fdda10fda3c2382941ee0ce51204f750a))
+* clean up changelog duplicate ([22265e1](https://github.com/Draculabo/AntigravityManager/commit/22265e153c9d394229aa48afdc5948044b74e842))
+
+## [0.3.2](https://github.com/Draculabo/AntigravityManager/compare/v0.3.1...v0.3.2) (2026-01-25)
+
+### 🐛 Bug Fixes
+
+* handle keychain hint and suppress pgrep spam ([bd3d41a](https://github.com/Draculabo/AntigravityManager/commit/bd3d41aed17bafe9d684c5c421bad8b90afa19a8))
+
+### 📝 Documentation
+
+* add macOS self-signing workaround for Keychain issues ([01e3f8f](https://github.com/Draculabo/AntigravityManager/commit/01e3f8f8fd6dacc5eed214ed4b505d6d85f4bcff))
+
+### 🔧 Continuous Integration
+
+* setup semantic release configuration and github actions workflow ([d2945a6](https://github.com/Draculabo/AntigravityManager/commit/d2945a6e8a14d75f577716183cdff093443d9636))
+* trigger publish on release published event ([6a07bc0](https://github.com/Draculabo/AntigravityManager/commit/6a07bc0a10a5ad802777e007cfd7390852119b15))
+
+## [0.3.1] - 2026-01-25
+
+### Bug Fixes
+
+- Fixed startup race condition causing cloud accounts verify failure ([f0718db])
+- Enabled WAL mode and force initialization on startup to resolve process resource contention ([1bce5d3])
+
+## [0.3.0] - 2026-01-23
+
+### New Features
+
+- Verify Google OAuth code automatically after receipt
+- Add button to open logs folder
+- Add expiration warning for Google OAuth authentication
 
 ### Bug Fixes
 
 - Fixed `state.vscdb` path on Linux to include `User/globalStorage` subdirectory (Fixed [#26](https://github.com/Draculabo/AntigravityManager/issues/26))
 - Improved process detection on macOS/Linux using `find-process` to reliably identify the main application and exclude helper processes (Fixed [#27](https://github.com/Draculabo/AntigravityManager/issues/27))
-
-## [0.3.0-rc.2] - 2026-01-21
-
-### Bug Fixes
-
 - Fixed keychain access error on macOS Apple Silicon (M1/M2/M3) by adding arm64 build to CI
 
-## [0.3.0-rc.1] - 2026-01-21
-
-### New Features
-
-- Verify Google OAuth code automatically after receipt ([e927ac9]
-- Add button to open logs folder ([a438070]
-- Add expiration warning for Google OAuth authentication ([f224fea]
-
 ### Maintenance
 
-- Add VS Code settings for auto-formatting and ESLint ([013f329])
+- Add VS Code settings for auto-formatting and ESLint
 
 ## [0.2.2] - 2026-01-19
 

README.md

@@ -280,6 +280,24 @@ Please check:
 
 </details>
 
+<details>
+<summary><b>Q: macOS shows Keychain/Credential error and OAuth cannot be saved?</b></summary>
+
+This is a common macOS security behavior, usually when the app is unsigned or run directly from Downloads.
+This is a **temporary workaround** for personal use:
+
+1. Move the app to `/Applications`
+2. Run the following commands in Terminal (repeat after every update)
+
+```plaintext
+sudo xattr -dr com.apple.quarantine "/Applications/Antigravity Manager 2.app"
+codesign --force --deep --sign - "/Applications/Antigravity Manager 2.app"
+```
+
+Reopen the app and allow Keychain access if prompted.
+
+</details>
+
 <details>
 <summary><b>Q: How to report issues or suggestions?</b></summary>
 

README.zh-CN.md

@@ -280,6 +280,24 @@ AntigravityManager/
 
 </details>
 
+<details>
+<summary><b>Q: macOS 上提示 Keychain/凭据管理不可用，OAuth 无法保存？</b></summary>
+
+这是 macOS 安全机制导致的常见问题，通常出现在未签名的应用或从 Downloads 直接运行的场景。
+这是**临时方案**，仅适合个人设备：
+
+1. 将应用移动到 `/Applications`
+2. 打开终端执行以下命令（每次更新后都需要重新执行）
+
+```plaintext
+sudo xattr -dr com.apple.quarantine "/Applications/Antigravity Manager 2.app"
+codesign --force --deep --sign - "/Applications/Antigravity Manager 2.app"
+```
+
+重新打开应用后，Keychain 应会提示授权（可选“始终允许”）。
+
+</details>
+
 <details>
 <summary><b>Q: 如何反馈问题或建议？</b></summary>
 

forge.config.ts

@@ -78,7 +78,7 @@ const config: ForgeConfig = {
           name: 'AntigravityManager',
         },
         draft: true,
-        prerelease: true,
+        prerelease: false,
       },
     },
   ],

package.json

@@ -1,7 +1,7 @@
 {
   "name": "antigravity-manager",
   "productName": "Antigravity Manager",
-  "version": "0.3.0-rc.3",
+  "version": "0.4.0",
   "description": "Antigravity Manager - Electron App",
   "main": ".vite/build/main.js",
   "private": true,
@@ -38,6 +38,9 @@
     "@eslint/compat": "^1.4.1",
     "@eslint/js": "^9.39.0",
     "@playwright/test": "^1.56.1",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.2",
     "@swc/core": "^1.15.8",
     "@tanstack/router-plugin": "^1.135.0",
     "@testing-library/jest-dom": "^6.9.1",
@@ -53,6 +56,7 @@
     "@vitejs/plugin-react": "^4.7.0",
     "babel-plugin-react-compiler": "1.0.0",
     "code-inspector-plugin": "^1.3.3",
+    "conventional-changelog-conventionalcommits": "^9.1.0",
     "electron": "^37.3.1",
     "electron-devtools-installer": "^4.0.0",
     "electron-playwright-helpers": "^1.8.2",
@@ -67,6 +71,8 @@
     "node-addon-api": "^8.3.1",
     "prettier": "^3.6.2",
     "prettier-plugin-tailwindcss": "^0.7.1",
+    "semantic-release": "^25.0.2",
+    "semantic-release-config-gitmoji": "^1.5.3",
     "sharp": "^0.34.5",
     "tailwindcss": "^4.1.16",
     "ts-node": "^10.9.2",
@@ -85,7 +91,6 @@
     "@nestjs/microservices": "^11.1.11",
     "@nestjs/platform-express": "^11.1.11",
     "@nestjs/platform-fastify": "^11.1.10",
-    "@nestjs/websockets": "^11.1.11",
     "@orpc/client": "^1.10.4",
     "@orpc/server": "^1.11.3",
     "@radix-ui/react-avatar": "^1.1.11",

release.config.cjs

@@ -0,0 +1,259 @@
+/**
+ * Semantic Release Configuration
+ *
+ * This configuration uses the specific release rules requested by the user,
+ * but adapts the plugin configuration to work with standard Conventional Commits
+ * instead of Gitmoji (since the project history doesn't use emojis).
+ */
+
+const REPO_URL = 'https://github.com/Draculabo/AntigravityManager';
+const GITHUB_BASE_URL = 'https://github.com';
+const FULL_CHANGELOG_URL = `${REPO_URL}/blob/main/CHANGELOG.md`;
+
+const releaseRules = [
+  {
+    release: 'minor',
+    type: 'feat',
+  },
+  {
+    release: 'patch',
+    type: 'fix',
+  },
+  {
+    release: 'patch',
+    type: 'perf',
+  },
+  {
+    release: 'patch',
+    type: 'style',
+  },
+  {
+    release: 'patch',
+    type: 'refactor',
+  },
+  {
+    release: 'patch',
+    type: 'build',
+  },
+  { release: 'patch', scope: 'README', type: 'docs' },
+  { release: 'patch', scope: 'README.md', type: 'docs' },
+  { release: false, type: 'docs' },
+  {
+    release: false,
+    type: 'test',
+  },
+  {
+    release: false,
+    type: 'ci',
+  },
+  {
+    release: false,
+    type: 'chore',
+  },
+  {
+    release: false,
+    type: 'wip',
+  },
+  {
+    release: 'major',
+    type: 'BREAKING CHANGE',
+  },
+  {
+    release: 'major',
+    scope: 'BREAKING CHANGE',
+  },
+  {
+    release: 'major',
+    subject: '*BREAKING CHANGE*',
+  },
+  { release: 'patch', subject: '*force release*' },
+  { release: 'patch', subject: '*force patch*' },
+  { release: 'minor', subject: '*force minor*' },
+  { release: 'major', subject: '*force major*' },
+  { release: false, subject: '*skip release*' },
+];
+
+const getGithubUsernameFromEmail = (email) => {
+  if (!email) {
+    return undefined;
+  }
+
+  const match = email.match(/^(?:\d+\+)?(?<username>[a-z0-9-]+)@users\.noreply\.github\.com$/i);
+
+  return match?.groups?.username;
+};
+
+const isBotIdentity = (value) => {
+  return typeof value === 'string' && /bot/i.test(value);
+};
+
+const buildReleaseFooter = (commits) => {
+  const mergedPullRequests = new Map();
+  const contributors = new Map();
+
+  (commits || []).forEach((commit) => {
+    const message = [commit?.message, commit?.subject, commit?.header].filter(Boolean).join('\n');
+    if (message) {
+      const mergeMatches = message.match(/pull request #(?<number>\d+)/gi);
+      if (mergeMatches) {
+        mergeMatches.forEach((match) => {
+          const number = match.replace(/\D/g, '');
+          if (number) {
+            mergedPullRequests.set(number, {
+              number,
+              url: `${REPO_URL}/pull/${number}`,
+            });
+          }
+        });
+      }
+
+      const squashMatches = message.match(/\(#(?<number>\d+)\)/g);
+      if (squashMatches) {
+        squashMatches.forEach((match) => {
+          const number = match.replace(/\D/g, '');
+          if (number) {
+            mergedPullRequests.set(number, {
+              number,
+              url: `${REPO_URL}/pull/${number}`,
+            });
+          }
+        });
+      }
+    }
+
+    const author = commit?.author || commit?.committer;
+    const username = getGithubUsernameFromEmail(author?.email);
+    const displayName = username ? `@${username}` : author?.name;
+
+    if (!displayName || isBotIdentity(displayName)) {
+      return;
+    }
+
+    if (username && isBotIdentity(username)) {
+      return;
+    }
+
+    contributors.set(username || displayName, {
+      name: displayName,
+      url: username ? `${GITHUB_BASE_URL}/${username}` : undefined,
+    });
+  });
+
+  const footerLines = [];
+  const sortedPullRequests = Array.from(mergedPullRequests.values()).sort(
+    (left, right) => Number(left.number) - Number(right.number),
+  );
+  if (sortedPullRequests.length > 0) {
+    footerLines.push('### 🔀 Merged Pull Requests');
+    sortedPullRequests.forEach((pullRequest) => {
+      footerLines.push(`- [#${pullRequest.number}](${pullRequest.url})`);
+    });
+    footerLines.push('');
+  }
+
+  const sortedContributors = Array.from(contributors.values()).sort((left, right) =>
+    left.name.localeCompare(right.name),
+  );
+  if (sortedContributors.length > 0) {
+    footerLines.push('### 🙌 Contributors');
+    sortedContributors.forEach((contributor) => {
+      if (contributor.url) {
+        footerLines.push(`- [${contributor.name}](${contributor.url})`);
+        return;
+      }
+
+      footerLines.push(`- ${contributor.name}`);
+    });
+    footerLines.push('');
+  }
+
+  footerLines.push(`Full Changelog: ${FULL_CHANGELOG_URL}`);
+
+  return footerLines.join('\n');
+};
+
+const appendReleaseNotes = (notes, commits) => {
+  const trimmedNotes = (notes || '').trimEnd();
+  const footer = buildReleaseFooter(commits);
+
+  if (!footer) {
+    return trimmedNotes;
+  }
+
+  return `${trimmedNotes}\n\n${footer}`;
+};
+
+const appendReleaseNotesPlugin = {
+  publish: async (pluginConfig, context) => {
+    if (!context?.nextRelease?.notes) {
+      return;
+    }
+
+    context.nextRelease.notes = appendReleaseNotes(context.nextRelease.notes, context.commits);
+  },
+};
+
+const releaseConfig = {
+  branches: ['main', { name: 'beta', prerelease: true }],
+  plugins: [
+    [
+      '@semantic-release/commit-analyzer',
+      {
+        preset: 'conventionalcommits',
+        releaseRules: releaseRules,
+      },
+    ],
+    [
+      '@semantic-release/release-notes-generator',
+      {
+        preset: 'conventionalcommits',
+        presetConfig: {
+          types: [
+            { type: 'feat', section: '✨ Features' },
+            { type: 'fix', section: '🐛 Bug Fixes' },
+            { type: 'perf', section: '⚡ Performance Improvements' },
+            { type: 'revert', section: '⏪ Reverts' },
+            { type: 'docs', section: '📝 Documentation' },
+            { type: 'style', section: '💄 Styles' },
+            { type: 'refactor', section: '♻️ Code Refactoring' },
+            { type: 'test', section: '✅ Tests' },
+            { type: 'build', section: '👷 Build System' },
+            { type: 'ci', section: '🔧 Continuous Integration' },
+          ],
+        },
+      },
+    ],
+    [
+      '@semantic-release/changelog',
+      {
+        changelogFile: 'CHANGELOG.md',
+        changelogTitle: '<a name="readme-top"></a>\n\n# Changelog',
+      },
+    ],
+    '@semantic-release/npm', // Updates package.json and npm-shrinkwrap.json
+    appendReleaseNotesPlugin,
+    [
+      '@semantic-release/github',
+      {
+        successComment: false,
+        failComment: false,
+        labels: false,
+        releaseName: 'v${nextRelease.version}',
+      },
+    ],
+    [
+      '@semantic-release/git',
+      {
+        assets: ['CHANGELOG.md', 'package.json', 'package-lock.json', 'npm-shrinkwrap.json'],
+        message: 'chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}',
+      },
+    ],
+  ],
+};
+
+releaseConfig.__internal = {
+  appendReleaseNotes,
+  buildReleaseFooter,
+};
+
+module.exports = releaseConfig;

src/components/CloudAccountList.tsx

@@ -41,12 +41,13 @@ import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
 import { useState, useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
+import { getLocalizedErrorMessage } from '@/utils/errorMessages';
 
 // ... (existing code: imports and comments)
 
 export function CloudAccountList() {
   const { t } = useTranslation();
-  const { data: accounts, isLoading, isError } = useCloudAccounts();
+  const { data: accounts, isLoading, isError, error } = useCloudAccounts();
   const refreshMutation = useRefreshQuota();
   const deleteMutation = useDeleteCloudAccount();
   const addMutation = useAddGoogleAccount();
@@ -78,7 +79,7 @@ export function CloudAccountList() {
         onError: (err) => {
           toast({
             title: t('cloud.toast.addFailed.title'),
-            description: err.message,
+            description: getLocalizedErrorMessage(err, t),
             variant: 'destructive',
           });
         },
@@ -133,7 +134,7 @@ export function CloudAccountList() {
         onError: (err) =>
           toast({
             title: t('cloud.toast.switchFailed'),
-            description: err.message,
+            description: getLocalizedErrorMessage(err, t),
             variant: 'destructive',
           }),
       },
@@ -175,8 +176,15 @@ export function CloudAccountList() {
   };
 
   const handleForcePoll = () => {
+    if (forcePollMutation.isPending) return;
     forcePollMutation.mutate(undefined, {
       onSuccess: () => toast({ title: t('cloud.polling') }),
+      onError: (err) =>
+        toast({
+          title: t('cloud.toast.pollFailed'),
+          description: getLocalizedErrorMessage(err, t),
+          variant: 'destructive',
+        }),
     });
   };
 
@@ -199,7 +207,7 @@ export function CloudAccountList() {
       onError: (err) => {
         toast({
           title: t('cloud.toast.syncFailed.title'),
-          description: err.message,
+          description: getLocalizedErrorMessage(err, t),
           variant: 'destructive',
         });
       },
@@ -272,7 +280,13 @@ export function CloudAccountList() {
   }
 
   if (isError) {
-    return <div className="p-4 text-red-500">Failed to load cloud accounts.</div>;
+    const errorMessage = getLocalizedErrorMessage(error, t);
+    return (
+      <div className="p-4 text-red-500">
+        <div>{t('cloud.error.loadFailed')}</div>
+        <div className="mt-1 text-sm text-red-400">{errorMessage}</div>
+      </div>
+    );
   }
 
   return (

src/hooks/useCloudAccounts.ts

@@ -47,12 +47,12 @@ export function useRefreshQuota() {
   return useMutation({
     mutationFn: refreshAccountQuota,
     onSuccess: (updatedAccount: CloudAccount) => {
-      // Optimistically update the list or just invalidate?
+      // Optimistically update
-      // Invalidating is safer as sorting might change (last_used)
       queryClient.setQueryData(QUERY_KEYS.cloudAccounts, (oldData: CloudAccount[] | undefined) => {
         if (!oldData) return [updatedAccount];
         return oldData.map((acc) => (acc.id === updatedAccount.id ? updatedAccount : acc));
       });
+      queryClient.invalidateQueries({ queryKey: QUERY_KEYS.cloudAccounts });
     },
   });
 }
@@ -97,8 +97,12 @@ export function useSetAutoSwitchEnabled() {
 }
 
 export function useForcePollCloudMonitor() {
+  const queryClient = useQueryClient();
   return useMutation({
     mutationFn: forcePollCloudMonitor,
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: QUERY_KEYS.cloudAccounts });
+    },
   });
 }
 

src/ipc/cloud/handler.ts

@@ -123,6 +123,8 @@ export async function refreshAccountQuota(accountId: string): Promise<CloudAccou
     const quota = await GoogleAPIService.fetchQuota(account.token.access_token);
     account.quota = quota;
     await CloudAccountRepo.updateQuota(account.id, quota);
+    await CloudAccountRepo.updateLastUsed(account.id);
+    account.last_used = Math.floor(Date.now() / 1000); // Sync memory object
     notifyTrayUpdate(account);
     return account;
   } catch (error: any) {
@@ -143,6 +145,8 @@ export async function refreshAccountQuota(accountId: string): Promise<CloudAccou
         const quota = await GoogleAPIService.fetchQuota(account.token.access_token);
         account.quota = quota;
         await CloudAccountRepo.updateQuota(account.id, quota);
+        await CloudAccountRepo.updateLastUsed(account.id);
+        account.last_used = Math.floor(Date.now() / 1000); // Sync memory object
         return account;
       } catch (refreshError) {
         logger.error(

src/ipc/config/handlers.ts

@@ -1,5 +1,6 @@
 import { AppConfig } from '../../types/config';
 import { ConfigManager } from './manager';
+import { syncAutoStart } from '../../utils/autoStart';
 
 export function loadConfig(): AppConfig {
   return ConfigManager.loadConfig();
@@ -10,4 +11,5 @@ export function saveConfig(config: AppConfig): void {
   // Logic to update Tray if language changes
   // For now just save
   ConfigManager.saveConfig(config);
+  syncAutoStart(config);
 }

src/ipc/database/cloudHandler.ts

@@ -5,7 +5,7 @@ import { v4 as uuidv4 } from 'uuid';
 import { getCloudAccountsDbPath, getAntigravityDbPaths } from '../../utils/paths';
 import { logger } from '../../utils/logger';
 import { CloudAccount } from '../../types/cloudAccount';
-import { encrypt, decrypt } from '../../utils/security';
+import { decryptWithMigration, encrypt, type KeySource } from '../../utils/security';
 import { ProtobufUtils } from '../../utils/protobuf';
 import { GoogleAPIService } from '../../services/GoogleAPIService';
 
@@ -22,6 +22,7 @@ function ensureDatabaseInitialized(dbPath: string): void {
   let db: Database.Database | null = null;
   try {
     db = new Database(dbPath);
+    db.pragma('journal_mode = WAL');
 
     // Create accounts table
     // Storing complex objects (token, quota) as JSON strings for simplicity
@@ -73,9 +74,70 @@ function ensureDatabaseInitialized(dbPath: string): void {
 function getDb(): Database.Database {
   const dbPath = getCloudAccountsDbPath();
   ensureDatabaseInitialized(dbPath);
-  return new Database(dbPath);
+  const db = new Database(dbPath);
+  db.pragma('journal_mode = WAL');
+  return db;
 }
 
+interface MigrationStats {
+  totalFields: number;
+  fallbackUsedFields: number;
+  migratedFields: number;
+  migratedBySource: Record<KeySource, number>;
+  failedFields: number;
+}
+
+function createMigrationStats(): MigrationStats {
+  return {
+    totalFields: 0,
+    fallbackUsedFields: 0,
+    migratedFields: 0,
+    migratedBySource: {
+      safeStorage: 0,
+      keytar: 0,
+      file: 0,
+    },
+    failedFields: 0,
+  };
+}
+
+async function decryptAndMigrateField(
+  db: Database.Database,
+  accountId: string,
+  field: 'token_json' | 'quota_json',
+  value: string | null,
+): Promise<{ value: string | null; migrated: boolean; usedFallback?: KeySource }> {
+  if (!value) {
+    return { value: null, migrated: false };
+  }
+
+  const result = await decryptWithMigration(value);
+  if (result.reencrypted) {
+    if (field === 'token_json') {
+      db.prepare('UPDATE accounts SET token_json = ? WHERE id = ?').run(
+        result.reencrypted,
+        accountId,
+      );
+    } else {
+      db.prepare('UPDATE accounts SET quota_json = ? WHERE id = ?').run(
+        result.reencrypted,
+        accountId,
+      );
+    }
+    logger.info(
+      `Migrated ${field} for account ${accountId} from ${result.usedFallback ?? 'unknown'} key`,
+    );
+  }
+
+  return {
+    value: result.value,
+    migrated: Boolean(result.reencrypted),
+    usedFallback: result.usedFallback,
+  };
+}
+
+type DecryptFieldResult = Awaited<ReturnType<typeof decryptAndMigrateField>>;
+
 export class CloudAccountRepo {
   static async init(): Promise<void> {
     const dbPath = getCloudAccountsDbPath();
@@ -168,6 +230,7 @@ export class CloudAccountRepo {
 
   static async getAccounts(): Promise<CloudAccount[]> {
     const db = getDb();
+    const migrationStats = createMigrationStats();
 
     try {
       const stmt = db.prepare('SELECT * FROM accounts ORDER BY last_used DESC');
@@ -180,24 +243,91 @@ export class CloudAccountRepo {
       );
       activeRows.forEach((r) => logger.info(`[DEBUG] Active Account: ${r.email} (${r.id})`));
 
-      const accounts = await Promise.all(
+      const accounts: CloudAccount[] = [];
-        rows.map(async (row) => ({
+      for (const row of rows) {
+        let tokenResult: DecryptFieldResult;
+        try {
+          tokenResult = await decryptAndMigrateField(db, row.id, 'token_json', row.token_json);
+        } catch (error) {
+          migrationStats.failedFields += 1;
+          logger.error(`Failed to decrypt token for account ${row.id}`, error);
+          throw error;
+        }
+
+        let quotaResult: DecryptFieldResult;
+        try {
+          quotaResult = await decryptAndMigrateField(db, row.id, 'quota_json', row.quota_json);
+        } catch (error) {
+          migrationStats.failedFields += 1;
+          logger.error(`Failed to decrypt quota for account ${row.id}`, error);
+          throw error;
+        }
+
+        if (!tokenResult.value) {
+          throw new Error(`Missing token data for account ${row.id}`);
+        }
+
+        if (tokenResult.value) {
+          migrationStats.totalFields += 1;
+        }
+        if (tokenResult.usedFallback) {
+          migrationStats.fallbackUsedFields += 1;
+        }
+        if (tokenResult.migrated) {
+          migrationStats.migratedFields += 1;
+          if (tokenResult.usedFallback) {
+            migrationStats.migratedBySource[tokenResult.usedFallback] += 1;
+          }
+        }
+
+        if (quotaResult.value) {
+          migrationStats.totalFields += 1;
+        }
+        if (quotaResult.usedFallback) {
+          migrationStats.fallbackUsedFields += 1;
+        }
+        if (quotaResult.migrated) {
+          migrationStats.migratedFields += 1;
+          if (quotaResult.usedFallback) {
+            migrationStats.migratedBySource[quotaResult.usedFallback] += 1;
+          }
+        }
+
+        accounts.push({
           id: row.id,
           provider: row.provider,
           email: row.email,
           name: row.name,
           avatar_url: row.avatar_url,
-          token: JSON.parse(await decrypt(row.token_json)),
+          token: JSON.parse(tokenResult.value),
-          quota: row.quota_json ? JSON.parse(await decrypt(row.quota_json)) : undefined,
+          quota: quotaResult.value ? JSON.parse(quotaResult.value) : undefined,
           created_at: row.created_at,
           last_used: row.last_used,
           status: row.status,
           is_active: Boolean(row.is_active),
-        })),
+        });
-      );
+      }
 
       return accounts;
     } finally {
+      if (
+        migrationStats.migratedFields > 0 ||
+        migrationStats.fallbackUsedFields > 0 ||
+        migrationStats.failedFields > 0
+      ) {
+        const summary = {
+          totalFields: migrationStats.totalFields,
+          fallbackUsedFields: migrationStats.fallbackUsedFields,
+          migratedFields: migrationStats.migratedFields,
+          migratedBySource: migrationStats.migratedBySource,
+          failedFields: migrationStats.failedFields,
+        };
+        if (migrationStats.failedFields > 0) {
+          logger.warn('CloudAccountRepo migration summary (with failures)', summary);
+        } else {
+          logger.info('CloudAccountRepo migration summary', summary);
+        }
+      }
       db.close();
     }
   }
@@ -211,14 +341,21 @@ export class CloudAccountRepo {
 
       if (!row) return undefined;
 
+      const tokenResult = await decryptAndMigrateField(db, row.id, 'token_json', row.token_json);
+      const quotaResult = await decryptAndMigrateField(db, row.id, 'quota_json', row.quota_json);
+
+      if (!tokenResult.value) {
+        throw new Error(`Missing token data for account ${row.id}`);
+      }
+
       return {
         id: row.id,
         provider: row.provider,
         email: row.email,
         name: row.name,
         avatar_url: row.avatar_url,
-        token: JSON.parse(await decrypt(row.token_json)),
+        token: JSON.parse(tokenResult.value),
-        quota: row.quota_json ? JSON.parse(await decrypt(row.quota_json)) : undefined,
+        quota: quotaResult.value ? JSON.parse(quotaResult.value) : undefined,
         created_at: row.created_at,
         last_used: row.last_used,
         status: row.status,
@@ -293,20 +430,14 @@ export class CloudAccountRepo {
 
   static injectCloudToken(account: CloudAccount): void {
     const dbPaths = getAntigravityDbPaths();
-    let dbPath: string | null = null;
+    const dbPath = dbPaths.find((p) => fs.existsSync(p)) ?? null;
-
-    for (const p of dbPaths) {
-      if (fs.existsSync(p)) {
-        dbPath = p;
-        break;
-      }
-    }
 
     if (!dbPath) {
       throw new Error(`Antigravity database not found. Checked paths: ${dbPaths.join(', ')}`);
     }
 
     const db = new Database(dbPath);
+    db.pragma('journal_mode = WAL');
     try {
       const row = db
         .prepare('SELECT value FROM ItemTable WHERE key = ?')
@@ -437,14 +568,11 @@ export class CloudAccountRepo {
     const dbPaths = getAntigravityDbPaths();
     logger.info(`SyncLocal: Checking database paths: ${JSON.stringify(dbPaths)}`);
 
-    let dbPath: string | null = null;
+    const dbPath =
-    for (const p of dbPaths) {
+      dbPaths.find((p) => {
         logger.info(`SyncLocal: Checking path: ${p}, exists: ${fs.existsSync(p)}`);
-      if (fs.existsSync(p)) {
+        return fs.existsSync(p);
-        dbPath = p;
+      }) ?? null;
-        break;
-      }
-    }
 
     if (!dbPath) {
       const errorMsg = `Antigravity database not found. Please ensure Antigravity IDE is installed. Checked paths: ${dbPaths.join(', ')}`;
@@ -454,6 +582,7 @@ export class CloudAccountRepo {
 
     logger.info(`SyncLocal: Using Antigravity database at: ${dbPath}`);
     const ideDb = new Database(dbPath, { readonly: true });
+    ideDb.pragma('journal_mode = WAL');
     try {
       // 1. Read Raw Token Data
       const row = ideDb

src/ipc/database/handler.ts

@@ -8,6 +8,31 @@ import path from 'path';
 
 const KEYS_TO_BACKUP = ['antigravityAuthStatus', 'jetskiStateSync.agentManagerInitState'];
 
+function getDbWithWal(dbPath: string, options: Database.Options = {}): Database.Database {
+  const db = new Database(dbPath, options);
+  db.pragma('journal_mode = WAL');
+  return db;
+}
+
+/**
+ * Initializes the database and ensures WAL mode is enabled.
+ * Should be called on application startup.
+ */
+export function initDatabase(): void {
+  try {
+    const dbPaths = getAntigravityDbPaths();
+    if (dbPaths.length === 0) {
+      return;
+    }
+
+    const db = getDatabaseConnection();
+    db.close();
+    logger.info('Database initialized and verified (WAL mode)');
+  } catch (error) {
+    logger.error('Failed to initialize database on startup', error);
+  }
+}
+
 /**
  * Ensures that the database file exists.
  * @param dbPath {string} The path to the database file.
@@ -59,7 +84,7 @@ export function getDatabaseConnection(dbPath?: string): Database.Database {
   ensureDatabaseExists(targetPath);
 
   try {
-    return new Database(targetPath, { readonly: false, fileMustExist: false });
+    return getDbWithWal(targetPath, { readonly: false, fileMustExist: false });
   } catch (error: unknown) {
     const err = error as { code?: string };
     if (err.code === 'SQLITE_BUSY' || err.code === 'SQLITE_LOCKED') {
@@ -69,6 +94,12 @@ export function getDatabaseConnection(dbPath?: string): Database.Database {
   }
 }
 
+/**
+ * Gets a database connection and enables WAL mode.
+ * @param dbPath {string} The path to the database file.
+ * @returns {Database.Database} The database connection.
+ */
+
 /**
  * Gets the current account info.
  * @returns {AccountInfo} The current account info.

src/ipc/manager.ts

@@ -78,7 +78,7 @@ function createIPCClient(port: MessagePort) {
           pendingRequests.delete(id);
           reject(new Error(`Request /${methodPath} timed out`));
         }
-      }, 10000);
+      }, 60000);
     });
   }
 

src/ipc/process/handler.ts

@@ -1,6 +1,6 @@
 import { exec, execSync } from 'child_process';
 import { promisify } from 'util';
-import findProcess from 'find-process';
+import findProcess, { ProcessInfo } from 'find-process';
 import { getAntigravityExecutablePath, isWsl } from '../../utils/paths';
 import { logger } from '../../utils/logger';
 
@@ -51,6 +51,17 @@ function isHelperProcess(name: string, cmd: string): boolean {
   return false;
 }
 
+function isPgrepNoMatchError(error: unknown): boolean {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+
+  const message = error.message.toLowerCase();
+  const hasPgrep = message.includes('pgrep') && message.includes('antigravity');
+  const code = (error as { code?: number }).code;
+  return hasPgrep && code === 1;
+}
+
 /**
  * Checks if the Antigravity process is running.
  * Uses find-process package for robust cross-platform process detection.
@@ -63,9 +74,35 @@ export async function isProcessRunning(): Promise<boolean> {
 
     // Use find-process to search for Antigravity processes
     // 'name' search type matches process name
-    const processes = await findProcess('name', 'Antigravity', true);
+    const processMap = new Map<number, ProcessInfo>();
+    const searchNames = ['Antigravity', 'antigravity'];
+    let sawNoMatch = false;
 
-    logger.debug(`Found ${processes.length} processes matching 'Antigravity'`);
+    for (const searchName of searchNames) {
+      try {
+        const matches = await findProcess('name', searchName, true);
+        for (const proc of matches) {
+          if (typeof proc.pid === 'number') {
+            processMap.set(proc.pid, proc);
+          }
+        }
+      } catch (error) {
+        if (isPgrepNoMatchError(error)) {
+          sawNoMatch = true;
+          continue;
+        }
+        throw error;
+      }
+    }
+
+    const processes = Array.from(processMap.values());
+    if (processes.length === 0 && sawNoMatch) {
+      logger.debug('No Antigravity process found (pgrep returned 1)');
+    }
+
+    logger.debug(
+      `Found ${processes.length} processes matching 'Antigravity/antigravity'`,
+    );
 
     for (const proc of processes) {
       // Skip self

src/localization/i18n.ts

@@ -34,6 +34,19 @@ i18n
           },
           error: {
             generic: 'An unexpected error occurred.',
+            keychainUnavailable: 'Keychain is unavailable.',
+            keychainHint: {
+              translocation:
+                'Detected macOS App Translocation. Move the app to /Applications and reopen.',
+              keychainDenied:
+                'Keychain access denied. The app may be unsigned; see README for the self-signing workaround.',
+              signNotarize: 'Please use a signed and notarized build when available.',
+            },
+            dataMigrationFailed: 'Unable to decrypt legacy account data.',
+            dataMigrationHint: {
+              relogin: 'Please re-login or re-add your accounts.',
+              clearData: 'If the issue persists, clear local account data and sign in again.',
+            },
           },
           nav: {
             accounts: 'Accounts',
@@ -87,6 +100,14 @@ i18n
               auto_sync: 'Auto Sync Current Account',
               auto_sync_desc: 'Periodically sync active account information',
             },
+            startup: {
+              title: 'Startup',
+              description: 'Control application launch behavior at system startup.',
+              auto_startup: 'Start with system',
+              auto_startup_desc: 'Launch at sign-in and keep the app in the system tray',
+              macos_hint:
+                'macOS requires a signed app for Login Items to work. If auto-start fails, please sign the app or enable it manually in System Settings.',
+            },
             proxy: {
               title: 'Upstream Proxy',
               description: 'Configure a proxy for outgoing requests to Google/Gemini APIs.',
@@ -214,6 +235,9 @@ i18n
             list: {
               noAccounts: 'No cloud accounts added yet.',
             },
+            error: {
+              loadFailed: 'Failed to load cloud accounts.',
+            },
             toast: {
               syncSuccess: {
                 title: 'Sync Successful',
@@ -229,6 +253,7 @@ i18n
               },
               quotaRefreshed: 'Quota refreshed',
               refreshFailed: 'Failed to refresh quota',
+              pollFailed: 'Failed to poll quota for all accounts',
               switched: {
                 title: 'Account switched!',
                 description: 'Restarting Antigravity...',
@@ -310,6 +335,17 @@ i18n
           },
           error: {
             generic: '发生未知错误。',
+            keychainUnavailable: 'Keychain 不可用。',
+            keychainHint: {
+              translocation: '检测到 macOS App Translocation。请将应用移动到 /Applications 后重试。',
+              keychainDenied: 'Keychain 访问被拒绝。应用可能未签名，可参考 README 的“macOS 自签”说明。',
+              signNotarize: '请在可用时使用已签名并公证的版本。',
+            },
+            dataMigrationFailed: '旧版账号数据无法解密。',
+            dataMigrationHint: {
+              relogin: '请重新登录或重新添加账号。',
+              clearData: '如仍失败，请清理本地账号数据后再登录。',
+            },
           },
           nav: {
             accounts: '账号',
@@ -363,6 +399,14 @@ i18n
               auto_sync: '自动获取当前账号',
               auto_sync_desc: '定期自动同步当前活跃账号信息',
             },
+            startup: {
+              title: '启动',
+              description: '控制系统启动时的应用行为。',
+              auto_startup: '随系统启动',
+              auto_startup_desc: '登录时自动启动并保持在托盘里',
+              macos_hint:
+                'macOS 需要应用已签名才可生效。如自启动失败，请自行签名或在系统设置中手动启用。',
+            },
             proxy: {
               title: '上游代理',
               description: '为发往 Google/Gemini API 的请求配置代理。',
@@ -488,6 +532,9 @@ i18n
             list: {
               noAccounts: '暂无云账号。',
             },
+            error: {
+              loadFailed: '加载云账号失败。',
+            },
             toast: {
               syncSuccess: {
                 title: '同步成功',
@@ -503,6 +550,7 @@ i18n
               },
               quotaRefreshed: '配额已刷新',
               refreshFailed: '刷新配额失败',
+              pollFailed: '轮询所有账号配额失败',
               switched: {
                 title: '账号已切换！',
                 description: '正在重启 Antigravity...',

src/main.ts

@@ -1,4 +1,4 @@
-import { app, BrowserWindow, Tray, Menu, nativeImage } from 'electron';
+import { app, BrowserWindow } from 'electron';
 import path from 'path';
 import fs from 'fs';
 
@@ -9,6 +9,7 @@ import { IPC_CHANNELS } from './constants';
 import { updateElectronApp, UpdateSourceType } from 'update-electron-app';
 import { logger } from './utils/logger';
 import { CloudAccountRepo } from './ipc/database/cloudHandler';
+import { initDatabase } from './ipc/database/handler';
 import { CloudMonitorService } from './services/CloudMonitorService';
 
 // Static Imports to fix Bundle Resolution Errors
@@ -17,6 +18,8 @@ import { bootstrapNestServer, stopNestServer } from './server/main';
 import { initTray, setTrayLanguage, destroyTray } from './ipc/tray/handler';
 import { rpcHandler } from './ipc/handler';
 import { ConfigManager } from './ipc/config/manager';
+import { AppConfig } from './types/config';
+import { isAutoStartLaunch, syncAutoStart } from './utils/autoStart';
 
 const packetLogPath = path.join(app.getPath('userData'), 'orpc_packets.log');
 
@@ -62,6 +65,25 @@ const inDevelopment = process.env.NODE_ENV === 'development';
 let globalMainWindow: BrowserWindow | null = null;
 // let tray: Tray | null = null; // Moved to tray/handler.ts
 let isQuitting = false;
+let startupConfig: AppConfig | null = null;
+let shouldStartHidden = false;
+
+const gotSingleInstanceLock = app.requestSingleInstanceLock();
+
+if (!gotSingleInstanceLock) {
+  app.quit();
+} else {
+  app.on('second-instance', () => {
+    logger.info('Second instance detected, focusing existing window');
+    if (app.isReady()) {
+      createWindow({ startHidden: false });
+      return;
+    }
+    app.whenReady().then(() => {
+      createWindow({ startHidden: false });
+    });
+  });
+}
 
 process.on('exit', (code) => {
   logger.info(`Process exit event triggered with code: ${code}`);
@@ -74,7 +96,22 @@ process.on('before-exit', (code) => {
 
 // let tray: Tray | null = null; // Moved to tray/handler.ts
 
-function createWindow() {
+function createWindow({ startHidden }: { startHidden: boolean }) {
+  if (globalMainWindow && !globalMainWindow.isDestroyed()) {
+    if (startHidden) {
+      globalMainWindow.hide();
+      return;
+    }
+    if (globalMainWindow.isMinimized()) {
+      globalMainWindow.restore();
+    }
+    if (!globalMainWindow.isVisible()) {
+      globalMainWindow.show();
+    }
+    globalMainWindow.focus();
+    return;
+  }
+
   logger.info('createWindow: start');
   const preload = path.join(__dirname, 'preload.js');
   logger.info(`createWindow: preload path: ${preload}`);
@@ -83,6 +120,7 @@ function createWindow() {
   const mainWindow = new BrowserWindow({
     width: 1200,
     height: 800,
+    show: !startHidden,
     autoHideMenuBar: true,
     webPreferences: {
       devTools: inDevelopment,
@@ -98,6 +136,10 @@ function createWindow() {
   });
   globalMainWindow = mainWindow;
   logger.info('createWindow: BrowserWindow instance created');
+  if (startHidden) {
+    mainWindow.hide();
+    logger.info('createWindow: startHidden enabled, window hidden');
+  }
 
   logger.info('createWindow: setting main window in ipcContext');
   ipcContext.setMainWindow(mainWindow);
@@ -125,6 +167,7 @@ function createWindow() {
 
   mainWindow.on('closed', () => {
     logger.info('Window closed event triggered');
+    globalMainWindow = null;
   });
 
   mainWindow.webContents.on('render-process-gone', (event, details) => {
@@ -143,6 +186,10 @@ function createWindow() {
     const { level, message, lineNumber, sourceId } = details;
     logger.info(`[Renderer Console][${level}] ${message} (${sourceId}:${lineNumber})`);
   });
+
+  mainWindow.on('focus', () => {
+    CloudMonitorService.handleAppFocus();
+  });
 }
 
 app.on('child-process-gone', (event, details) => {
@@ -223,13 +270,36 @@ process.on('unhandledRejection', (reason) => {
 
 app
   .whenReady()
+  .then(async () => {
+    logger.info('Step: Initialize CloudAccountRepo');
+    try {
+      await CloudAccountRepo.init();
+    } catch (e) {
+      logger.error('Startup: Failed to initialize CloudAccountRepo', e);
+      // We might want to exit here or show a dialog, but for now we proceed
+      // though functionality will be broken.
+    }
+
+    logger.info('Step: Initialize Antigravity DB (WAL Mode)');
+    initDatabase();
+  })
+  .then(() => {
+    logger.info('Step: Load Config');
+    const config = ConfigManager.loadConfig();
+    startupConfig = config;
+    syncAutoStart(config);
+    shouldStartHidden = isAutoStartLaunch() && config.auto_startup;
+    if (shouldStartHidden) {
+      logger.info('Startup: Auto-start detected, window will start hidden');
+    }
+  })
   .then(() => {
     logger.info('Step: setupORPC');
     return setupORPC();
   })
   .then(async () => {
     logger.info('Step: createWindow');
-    await createWindow();
+    await createWindow({ startHidden: shouldStartHidden });
   })
   .then(() => {
     logger.info('Step: installExtensions (SKIPPED)');
@@ -242,14 +312,11 @@ app
   .then(async () => {
     // Initialize Cloud Monitor if enabled
     try {
-      // Initialize DB & Migrate to Encrypted Storage
-      await CloudAccountRepo.init();
-
       // Start OAuth Server
       AuthServer.start();
 
       // Gateway Server (NestJS) - auto-start if enabled
-      const config = ConfigManager.loadConfig();
+      const config = startupConfig || ConfigManager.loadConfig();
       if (config.proxy?.auto_start) {
         const port = config.proxy?.port || 8045;
         // Default to a valid ProxyConfig object if null, although loadConfig ensures defaults
@@ -291,7 +358,7 @@ app.on('window-all-closed', () => {
 
 app.on('activate', () => {
   if (BrowserWindow.getAllWindows().length === 0) {
-    createWindow();
+    createWindow({ startHidden: false });
   }
 });
 //osX only ends

src/mocks/nestjs-microservices/index.ts

@@ -0,0 +1 @@
+export {};

src/mocks/nestjs-microservices/microservices-module.ts

@@ -0,0 +1 @@
+export {};

src/mocks/nestjs-websockets/index.ts

@@ -0,0 +1 @@
+export {};

src/mocks/nestjs-websockets/socket-module.ts

@@ -0,0 +1 @@
+export {};

src/routes/settings.tsx

@@ -47,6 +47,10 @@ function SettingsPage() {
     queryFn: getPlatform,
   });
 
+  const isAutoStartSupported =
+    platform === 'win32' || platform === 'darwin' || platform === 'linux';
+  const isMac = platform === 'darwin';
+
   const handleLanguageChange = (value: string) => {
     setAppLanguage(value, i18n);
   };
@@ -179,6 +183,49 @@ function SettingsPage() {
             </CardContent>
           </Card>
 
+          {isAutoStartSupported && (
+            <Card>
+              <CardHeader>
+                <CardTitle>{t('settings.startup.title', 'Startup')}</CardTitle>
+                <CardDescription>
+                  {t(
+                    'settings.startup.description',
+                    'Control application launch behavior at system startup.',
+                  )}
+                </CardDescription>
+              </CardHeader>
+              <CardContent className="space-y-4">
+                <div className="flex items-center justify-between rounded-lg border p-4">
+                  <div className="space-y-1">
+                    <Label>{t('settings.startup.auto_startup', 'Start with system')}</Label>
+                    <p className="text-xs text-gray-500">
+                      {t(
+                        'settings.startup.auto_startup_desc',
+                        'Launch at sign-in and keep the app in the system tray',
+                      )}
+                    </p>
+                  </div>
+                  <Switch
+                    checked={config?.auto_startup || false}
+                    onCheckedChange={async (checked) => {
+                      if (config) {
+                        await saveConfig({ ...config, auto_startup: checked });
+                      }
+                    }}
+                  />
+                </div>
+                {isMac && (
+                  <p className="text-xs text-muted-foreground">
+                    {t(
+                      'settings.startup.macos_hint',
+                      'macOS requires a signed app for Login Items to work. If auto-start fails, please sign the app or enable it manually in System Settings.',
+                    )}
+                  </p>
+                )}
+              </CardContent>
+            </Card>
+          )}
+
           <Card>
             <CardHeader>
               <CardTitle>{t('settings.about.title')}</CardTitle>

src/services/CloudMonitorService.ts

@@ -6,17 +6,28 @@ import { logger } from '../utils/logger';
 export class CloudMonitorService {
   private static intervalId: NodeJS.Timeout | null = null;
   private static POLL_INTERVAL = 1000 * 60 * 5; // 5 minutes
+  private static DEBOUNCE_TIME = 10000; // 10 seconds
+  private static lastFocusTime: number = 0;
+  private static isPolling: boolean = false;
+
+  // Helper for testing
+  static resetStateForTesting() {
+    this.lastFocusTime = 0;
+    this.isPolling = false;
+    this.stop();
+  }
 
   static start() {
     if (this.intervalId) return;
     logger.info('Starting CloudMonitorService...');
 
+    // Set lastFocusTime to now to prevent "double-dip" on startup (focus event immediately after start)
+    this.lastFocusTime = Date.now();
+
     // Initial Poll
     this.poll().catch((e) => logger.error('Initial poll failed', e));
 
-    this.intervalId = setInterval(() => {
+    this.startInterval();
-      this.poll().catch((e) => logger.error('Scheduled poll failed', e));
-    }, this.POLL_INTERVAL);
   }
 
   static stop() {
@@ -27,7 +38,59 @@ export class CloudMonitorService {
     }
   }
 
+  /**
+   * Called when the application window gains focus.
+   * Triggers an immediate poll if not rate-limited by debounce.
+   */
+  static async handleAppFocus() {
+    const now = Date.now();
+
+    // 1. Concurrency Guard: If we are already polling, don't pile up requests
+    if (this.isPolling) {
+      logger.info('Monitor: App focused, but polling is already in progress. Skipping.');
+      return;
+    }
+
+    // 2. Debounce: If we focused recently, don't poll again
+    if (now - this.lastFocusTime < this.DEBOUNCE_TIME) {
+      logger.info('Monitor: App focused, skipping poll (debounce active).');
+      return;
+    }
+
+    logger.info('Monitor: App focused, triggering immediate poll...');
+    this.lastFocusTime = now;
+
+    // 3. Trigger Poll
+    await this.poll().catch((e) => {
+      logger.error('Monitor: Focus poll failed', e);
+    });
+    // 4. Reset the background interval so we don't double-poll shortly after
+    this.resetInterval();
+  }
+
+  private static startInterval() {
+    if (this.intervalId) {
+      clearInterval(this.intervalId);
+    }
+    this.intervalId = setInterval(() => {
+      this.poll().catch((e) => logger.error('Scheduled poll failed', e));
+    }, this.POLL_INTERVAL);
+  }
+
+  private static resetInterval() {
+    if (this.intervalId) {
+      clearInterval(this.intervalId);
+      this.startInterval(); // Restart the 5-minute timer
+    }
+  }
+
   static async poll() {
+    if (this.isPolling) {
+      return; // Extra safety
+    }
+    this.isPolling = true;
+
+    try {
       logger.info('CloudMonitor: Polling quotas...');
       const accounts = await CloudAccountRepo.getAccounts();
       const now = Math.floor(Date.now() / 1000);
@@ -53,6 +116,7 @@ export class CloudMonitorService {
 
           // 3. Update DB
           await CloudAccountRepo.updateQuota(account.id, quota);
+          await CloudAccountRepo.updateLastUsed(account.id);
         } catch (error) {
           logger.error(`Monitor: Failed to update ${account.email}`, error);
           // Could mark status as 'error' or 'rate_limited' if 429
@@ -61,5 +125,8 @@ export class CloudMonitorService {
 
       // 4. Check for Auto-Switch
       await AutoSwitchService.checkAndSwitchIfNeeded();
+    } finally {
+      this.isPolling = false;
+    }
   }
 }

src/tests/unit/cloud-monitor.test.ts

@@ -0,0 +1,194 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { CloudMonitorService } from '../../services/CloudMonitorService';
+import { CloudAccountRepo } from '../../ipc/database/cloudHandler';
+import { GoogleAPIService } from '../../services/GoogleAPIService';
+import { AutoSwitchService } from '../../services/AutoSwitchService';
+import { logger } from '../../utils/logger';
+
+// Mock dependencies
+vi.mock('../../ipc/database/cloudHandler');
+vi.mock('../../services/GoogleAPIService');
+vi.mock('../../services/AutoSwitchService');
+vi.mock('../../utils/logger');
+
+describe('CloudMonitorService', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.clearAllMocks();
+    CloudMonitorService.resetStateForTesting();
+  });
+
+  afterEach(() => {
+    CloudMonitorService.stop();
+    vi.useRealTimers();
+  });
+
+  it('should start polling on start() and set up interval', async () => {
+    const pollSpy = vi.spyOn(CloudMonitorService, 'poll').mockResolvedValue(undefined);
+
+    CloudMonitorService.start();
+
+    // Should call initial poll
+    expect(pollSpy).toHaveBeenCalledTimes(1);
+
+    // Fast forward 5 minutes
+    await vi.advanceTimersByTimeAsync(1000 * 60 * 5);
+    expect(pollSpy).toHaveBeenCalledTimes(2);
+
+    pollSpy.mockRestore();
+  });
+
+  it('should poll accounts correctly', async () => {
+    const mockAccounts = [
+      {
+        id: 'acc1',
+        email: '[email protected]',
+        token: { access_token: 'valid_token', expiry_timestamp: Date.now() / 1000 + 3600 },
+      },
+    ];
+
+    vi.mocked(CloudAccountRepo.getAccounts).mockResolvedValue(mockAccounts as never);
+    vi.mocked(GoogleAPIService.fetchQuota).mockResolvedValue({ models: {} } as never);
+
+    // Start poll but don't await immediately, as it pauses
+    const pollPromise = CloudMonitorService.poll();
+
+    // Advance time to pass the 1s sleep
+    await vi.advanceTimersByTimeAsync(1000);
+
+    // Now await
+    await pollPromise;
+
+    expect(CloudAccountRepo.getAccounts).toHaveBeenCalled();
+    expect(GoogleAPIService.fetchQuota).toHaveBeenCalledWith('valid_token');
+    expect(CloudAccountRepo.updateQuota).toHaveBeenCalledWith('acc1', expect.anything());
+    expect(CloudAccountRepo.updateLastUsed).toHaveBeenCalledWith('acc1');
+    expect(AutoSwitchService.checkAndSwitchIfNeeded).toHaveBeenCalled();
+  });
+
+  it('should refresh token if expired during poll', async () => {
+    const mockAccounts = [
+      {
+        id: 'acc1',
+        email: '[email protected]',
+        token: {
+          access_token: 'old_token',
+          refresh_token: 'ref_token',
+          expiry_timestamp: Math.floor(Date.now() / 1000) - 100, // Expired
+        },
+      },
+    ];
+
+    vi.mocked(CloudAccountRepo.getAccounts).mockResolvedValue(mockAccounts as never);
+    vi.mocked(GoogleAPIService.refreshAccessToken).mockResolvedValue({
+      access_token: 'new_token',
+      expires_in: 3600,
+      token_type: 'Bearer',
+    });
+    vi.mocked(GoogleAPIService.fetchQuota).mockResolvedValue({ models: {} } as never);
+
+    // Same async pattern
+    const pollPromise = CloudMonitorService.poll();
+    await vi.advanceTimersByTimeAsync(1000);
+    await pollPromise;
+
+    expect(GoogleAPIService.refreshAccessToken).toHaveBeenCalledWith('ref_token');
+    expect(CloudAccountRepo.updateToken).toHaveBeenCalled();
+    expect(GoogleAPIService.fetchQuota).toHaveBeenCalledWith('new_token');
+  });
+
+  describe('handleAppFocus (Smart Refresh)', () => {
+    it('should trigger poll when focused after debounce time', async () => {
+      const pollSpy = vi.spyOn(CloudMonitorService, 'poll').mockResolvedValue(undefined);
+
+      CloudMonitorService.start();
+      vi.setSystemTime(Date.now() + 20000);
+
+      await CloudMonitorService.handleAppFocus();
+
+      // Called once by start, once by focus
+      expect(pollSpy).toHaveBeenCalledTimes(2);
+    });
+
+    it('should NOT trigger poll if debounced (focused too soon)', async () => {
+      const pollSpy = vi.spyOn(CloudMonitorService, 'poll').mockResolvedValue(undefined);
+
+      CloudMonitorService.start();
+
+      vi.setSystemTime(Date.now() + 1000);
+
+      await CloudMonitorService.handleAppFocus();
+
+      // Called once by start, 0 by focus
+      expect(pollSpy).toHaveBeenCalledTimes(1);
+      expect(logger.info).toHaveBeenCalledWith(expect.stringContaining('debounce active'));
+    });
+
+    it('should NOT trigger poll if already polling (concurrency guard)', async () => {
+      // Let's spy on poll to silence start's poll
+      const pollSpy = vi.spyOn(CloudMonitorService, 'poll').mockResolvedValue(undefined);
+      CloudMonitorService.start();
+      pollSpy.mockRestore(); // Restore so we can test the real guard logic
+
+      vi.setSystemTime(Date.now() + 20000);
+
+      // 2. Mock getAccounts to delay
+      let resolveGetAccounts: (value: unknown) => void;
+      const getAccountsPromise = new Promise((resolve) => {
+        resolveGetAccounts = resolve;
+      });
+      vi.mocked(CloudAccountRepo.getAccounts).mockImplementation(() => getAccountsPromise as never);
+
+      // 3. Trigger first focus -> starts poll, hangs at getAccounts or sleep
+      // Actually poll() calls getAccounts first thing.
+      const p1 = CloudMonitorService.handleAppFocus();
+
+      // Allow p1 to start execution and enter poll()
+      // We invoke one run loop
+      // But since everything is sync until first await, it should enter poll, set isPolling=true, call getAccounts, and await.
+
+      // 4. Trigger second focus immediately
+      const p2 = CloudMonitorService.handleAppFocus();
+
+      // 5. Release the first poll
+      resolveGetAccounts!([
+        { id: '1', token: { access_token: 'tok', expiry_timestamp: 9999999999 } },
+      ]);
+
+      // Advance timer for the 1s sleep inside poll
+      await vi.advanceTimersByTimeAsync(1000);
+
+      await Promise.all([p1, p2]);
+
+      expect(logger.info).toHaveBeenCalledWith(
+        expect.stringContaining('polling is already in progress'),
+      );
+      // getAccounts should be called once (by the first unblocked poll)
+      // The second one blocked by guard before calling poll
+      expect(CloudAccountRepo.getAccounts).toHaveBeenCalledTimes(1);
+    });
+
+    it('should reset interval after successful focus poll', async () => {
+      const clearIntervalSpy = vi.spyOn(global, 'clearInterval');
+      const setIntervalSpy = vi.spyOn(global, 'setInterval');
+
+      // Spy on poll to consume the start() call
+      const pollSpy = vi.spyOn(CloudMonitorService, 'poll').mockResolvedValue(undefined);
+      CloudMonitorService.start();
+      pollSpy.mockRestore(); // Restore real poll
+
+      vi.setSystemTime(Date.now() + 20000);
+
+      // Needs to handle async poll
+      vi.mocked(CloudAccountRepo.getAccounts).mockResolvedValue([]);
+
+      const focusPromise = CloudMonitorService.handleAppFocus();
+      await vi.advanceTimersByTimeAsync(1000); // For poll sleep
+      await focusPromise;
+
+      expect(clearIntervalSpy).toHaveBeenCalled();
+      // 1 for start (initial), 1 for reset = 2
+      expect(setIntervalSpy).toHaveBeenCalledTimes(2);
+    });
+  });
+});

src/tests/unit/security-migration.test.ts

@@ -0,0 +1,122 @@
+import crypto from 'crypto';
+import fs from 'fs/promises';
+import keytar from 'keytar';
+import { safeStorage } from 'electron';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { decryptWithMigration } from '../../utils/security';
+
+const primaryHex = '11'.repeat(32);
+const fallbackHex = '22'.repeat(32);
+
+vi.mock('electron', () => ({
+  safeStorage: {
+    isEncryptionAvailable: vi.fn(() => true),
+    decryptString: vi.fn(() => primaryHex),
+    encryptString: vi.fn((value: string) => Buffer.from(value)),
+  },
+  app: {
+    getPath: vi.fn(() => 'C:\\test'),
+  },
+}));
+
+vi.mock('fs/promises', () => ({
+  default: {
+    readFile: vi.fn(),
+    writeFile: vi.fn(),
+    rename: vi.fn(),
+    unlink: vi.fn(),
+  },
+}));
+
+vi.mock('keytar', () => ({
+  default: {
+    findCredentials: vi.fn(async () => []),
+    getPassword: vi.fn(async () => fallbackHex),
+    setPassword: vi.fn(),
+  },
+}));
+
+const fsMock = vi.mocked(fs, { deep: true });
+const keytarMock = vi.mocked(keytar, { deep: true });
+const safeStorageMock = vi.mocked(safeStorage, { deep: true });
+
+function encryptWithKey(key: Buffer, text: string): string {
+  const iv = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+
+  let encrypted = cipher.update(text, 'utf8', 'hex');
+  encrypted += cipher.final('hex');
+
+  const authTag = cipher.getAuthTag();
+
+  return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+
+  safeStorageMock.isEncryptionAvailable.mockReturnValue(true);
+  safeStorageMock.decryptString.mockReturnValue(primaryHex);
+
+  fsMock.readFile.mockImplementation(async (_path, encoding) => {
+    if (encoding === 'utf8') {
+      return 'not-hex';
+    }
+
+    return Buffer.from('encrypted');
+  });
+  fsMock.writeFile.mockResolvedValue(undefined);
+  fsMock.rename.mockResolvedValue(undefined);
+  fsMock.unlink.mockResolvedValue(undefined);
+
+  keytarMock.findCredentials.mockResolvedValue([]);
+  keytarMock.getPassword.mockResolvedValue(fallbackHex);
+});
+
+describe('decryptWithMigration', () => {
+  it('falls back to legacy key and re-encrypts', async () => {
+    const plaintext = '{"token":"legacy"}';
+    const ciphertext = encryptWithKey(Buffer.from(fallbackHex, 'hex'), plaintext);
+
+    const result = await decryptWithMigration(ciphertext);
+
+    expect(result.value).toBe(plaintext);
+    expect(result.usedFallback).toBe('keytar');
+    expect(result.reencrypted).toBeTypeOf('string');
+    expect(result.reencrypted).not.toBe(ciphertext);
+    expect(keytarMock.getPassword).toHaveBeenCalledTimes(1);
+
+    if (result.reencrypted) {
+      const migrated = await decryptWithMigration(result.reencrypted);
+      expect(migrated.value).toBe(plaintext);
+      expect(migrated.usedFallback).toBeUndefined();
+    }
+  });
+
+  it('does not use fallback when primary key works', async () => {
+    const plaintext = '{"token":"primary"}';
+    const ciphertext = encryptWithKey(Buffer.from(primaryHex, 'hex'), plaintext);
+
+    const result = await decryptWithMigration(ciphertext);
+
+    expect(result.value).toBe(plaintext);
+    expect(result.usedFallback).toBeUndefined();
+    expect(result.reencrypted).toBeUndefined();
+  });
+
+  it('throws migration error code when legacy keys are unavailable', async () => {
+    keytarMock.getPassword.mockResolvedValue(null);
+    fsMock.readFile.mockImplementation(async (_path, encoding) => {
+      if (encoding === 'utf8') {
+        return 'not-hex';
+      }
+
+      return Buffer.from('encrypted');
+    });
+
+    const plaintext = '{"token":"legacy"}';
+    const ciphertext = encryptWithKey(Buffer.from('33'.repeat(32), 'hex'), plaintext);
+
+    await expect(decryptWithMigration(ciphertext)).rejects.toThrow('ERR_DATA_MIGRATION_FAILED');
+  });
+});

src/types/config.ts

@@ -22,6 +22,7 @@ export const AppConfigSchema = z.object({
   refresh_interval: z.number(), // minutes
   auto_sync: z.boolean(), // 是否自动同步
   sync_interval: z.number(), // minutes
+  auto_startup: z.boolean(), // 是否随系统启动
   default_export_path: z.string().nullable().optional(), // 导出路径
   proxy: ProxyConfigSchema,
 });
@@ -37,6 +38,7 @@ export const DEFAULT_APP_CONFIG: AppConfig = {
   refresh_interval: 15,
   auto_sync: false,
   sync_interval: 5,
+  auto_startup: false,
   default_export_path: null,
   proxy: {
     enabled: false,

src/utils/autoStart.ts

@@ -0,0 +1,126 @@
+import { app } from 'electron';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { logger } from './logger';
+import { AppConfig } from '../types/config';
+
+export const AUTO_START_ARG = '--autostart';
+const LINUX_AUTOSTART_FILENAME = 'antigravity-manager.desktop';
+
+function getLinuxAutoStartPath() {
+  const dir = path.join(os.homedir(), '.config', 'autostart');
+  return path.join(dir, LINUX_AUTOSTART_FILENAME);
+}
+
+export function isAutoStartLaunch(argv = process.argv) {
+  if (process.platform === 'linux') {
+    return argv.includes(AUTO_START_ARG);
+  }
+
+  if (process.platform === 'win32' || process.platform === 'darwin') {
+    try {
+      const settings = app.getLoginItemSettings();
+      return settings.wasOpenedAtLogin;
+    } catch (error) {
+      logger.error('AutoStart: Failed to read login item settings', error);
+    }
+  }
+
+  return false;
+}
+
+function syncWindowsOrMacAutoStart(enabled: boolean) {
+  try {
+    app.setLoginItemSettings({
+      openAtLogin: enabled,
+      openAsHidden: enabled,
+      path: process.execPath,
+      args: enabled ? [AUTO_START_ARG] : [],
+    });
+    const settings = app.getLoginItemSettings();
+    if (settings.openAtLogin !== enabled) {
+      logger.warn(
+        `AutoStart: Login item mismatch (expected ${enabled}, actual ${settings.openAtLogin})`,
+      );
+    }
+    logger.info(`AutoStart: Login item set to ${enabled}`);
+  } catch (error) {
+    logger.error('AutoStart: Failed to update login item settings', error);
+  }
+}
+
+function cleanupLinuxAutoStartEntries(currentPath: string) {
+  const autoStartDir = path.dirname(currentPath);
+  if (!fs.existsSync(autoStartDir)) {
+    return;
+  }
+
+  const legacyNames = [
+    `${app.getName()}.desktop`,
+    `${app.getName().replace(/\s+/g, '')}.desktop`,
+    'Antigravity Manager.desktop',
+    'AntigravityManager.desktop',
+  ];
+
+  for (const name of legacyNames) {
+    const candidate = path.join(autoStartDir, name);
+    if (candidate === currentPath) {
+      continue;
+    }
+    if (fs.existsSync(candidate)) {
+      try {
+        fs.unlinkSync(candidate);
+        logger.info(`AutoStart: Removed legacy autostart entry ${candidate}`);
+      } catch (error) {
+        logger.warn('AutoStart: Failed to remove legacy autostart entry', error);
+      }
+    }
+  }
+}
+
+function syncLinuxAutoStart(enabled: boolean) {
+  const autoStartPath = getLinuxAutoStartPath();
+
+  if (!enabled) {
+    if (fs.existsSync(autoStartPath)) {
+      fs.unlinkSync(autoStartPath);
+      logger.info('AutoStart: Removed Linux autostart entry');
+    }
+    cleanupLinuxAutoStartEntries(autoStartPath);
+    return;
+  }
+
+  const autoStartDir = path.dirname(autoStartPath);
+  if (!fs.existsSync(autoStartDir)) {
+    fs.mkdirSync(autoStartDir, { recursive: true });
+  }
+
+  const execPath = process.execPath.replace(/"/g, '\\"');
+  const content = [
+    '[Desktop Entry]',
+    'Type=Application',
+    `Name=${app.getName()}`,
+    `Exec="${execPath}" ${AUTO_START_ARG}`,
+    'X-GNOME-Autostart-enabled=true',
+    'Hidden=false',
+    'NoDisplay=false',
+  ].join('\n');
+
+  cleanupLinuxAutoStartEntries(autoStartPath);
+  fs.writeFileSync(autoStartPath, content, 'utf-8');
+  logger.info('AutoStart: Created Linux autostart entry');
+}
+
+export function syncAutoStart(config: AppConfig) {
+  const enabled = Boolean(config.auto_startup);
+
+  if (process.platform === 'win32' || process.platform === 'darwin') {
+    syncWindowsOrMacAutoStart(enabled);
+    return;
+  }
+
+  if (process.platform === 'linux') {
+    syncLinuxAutoStart(enabled);
+  }
+}

src/utils/errorMessages.ts

@@ -0,0 +1,78 @@
+import type { TFunction } from 'i18next';
+
+const KEYCHAIN_ERROR_CODE = 'ERR_KEYCHAIN_UNAVAILABLE';
+const KEYCHAIN_HINT_TRANSLOCATION = 'HINT_APP_TRANSLOCATION';
+const KEYCHAIN_HINT_KEYCHAIN_DENIED = 'HINT_KEYCHAIN_DENIED';
+const KEYCHAIN_HINT_SIGN_NOTARIZE = 'HINT_SIGN_NOTARIZE';
+const DATA_MIGRATION_ERROR_CODE = 'ERR_DATA_MIGRATION_FAILED';
+const DATA_MIGRATION_HINT_RELOGIN = 'HINT_RELOGIN';
+const DATA_MIGRATION_HINT_CLEAR_DATA = 'HINT_CLEAR_DATA';
+
+const KEYCHAIN_HINT_I18N_MAP: Record<string, string> = {
+  [KEYCHAIN_HINT_TRANSLOCATION]: 'error.keychainHint.translocation',
+  [KEYCHAIN_HINT_KEYCHAIN_DENIED]: 'error.keychainHint.keychainDenied',
+  [KEYCHAIN_HINT_SIGN_NOTARIZE]: 'error.keychainHint.signNotarize',
+};
+
+const DATA_MIGRATION_HINT_I18N_MAP: Record<string, string> = {
+  [DATA_MIGRATION_HINT_RELOGIN]: 'error.dataMigrationHint.relogin',
+  [DATA_MIGRATION_HINT_CLEAR_DATA]: 'error.dataMigrationHint.clearData',
+};
+
+function resolveKeychainMessage(hintCode: string | undefined, t: TFunction): string {
+  const base = t('error.keychainUnavailable');
+  if (!hintCode) {
+    return base;
+  }
+
+  const hintKey = KEYCHAIN_HINT_I18N_MAP[hintCode];
+  if (!hintKey) {
+    return base;
+  }
+
+  return `${base} ${t(hintKey)}`;
+}
+
+function resolveDataMigrationMessage(hintCode: string | undefined, t: TFunction): string {
+  const base = t('error.dataMigrationFailed');
+  if (!hintCode) {
+    return base;
+  }
+
+  const hintKey = DATA_MIGRATION_HINT_I18N_MAP[hintCode];
+  if (!hintKey) {
+    return base;
+  }
+
+  return `${base} ${t(hintKey)}`;
+}
+
+export function getLocalizedErrorMessage(error: unknown, t: TFunction): string {
+  if (error instanceof Error) {
+    const rawMessage = error.message;
+    const [code, hint] = rawMessage.split('|');
+    if (code === KEYCHAIN_ERROR_CODE) {
+      return resolveKeychainMessage(hint, t);
+    }
+    if (code === DATA_MIGRATION_ERROR_CODE) {
+      return resolveDataMigrationMessage(hint, t);
+    }
+    return rawMessage;
+  }
+
+  if (error && typeof error === 'object' && 'message' in error) {
+    const rawMessage = String((error as { message?: unknown }).message ?? '');
+    const [code, hint] = rawMessage.split('|');
+    if (code === KEYCHAIN_ERROR_CODE) {
+      return resolveKeychainMessage(hint, t);
+    }
+    if (code === DATA_MIGRATION_ERROR_CODE) {
+      return resolveDataMigrationMessage(hint, t);
+    }
+    if (rawMessage) {
+      return rawMessage;
+    }
+  }
+
+  return String(error);
+}

src/utils/security.ts

@@ -1,40 +1,342 @@
-import keytar from 'keytar';
 import crypto from 'crypto';
 import { logger } from './logger';
+import { safeStorage, app } from 'electron';
+import path from 'path';
+import fs from 'fs/promises';
 
 const SERVICE_NAME = 'AntigravityManager';
 const ACCOUNT_NAME = 'MasterKey';
+const KEYCHAIN_ERROR_CODE = 'ERR_KEYCHAIN_UNAVAILABLE';
+const KEYCHAIN_HINT_TRANSLOCATION = 'HINT_APP_TRANSLOCATION';
+const KEYCHAIN_HINT_KEYCHAIN_DENIED = 'HINT_KEYCHAIN_DENIED';
+const KEYCHAIN_HINT_SIGN_NOTARIZE = 'HINT_SIGN_NOTARIZE';
+const DATA_MIGRATION_ERROR_CODE = 'ERR_DATA_MIGRATION_FAILED';
+const DATA_MIGRATION_HINT_RELOGIN = 'HINT_RELOGIN';
+
+export type KeySource = 'safeStorage' | 'keytar' | 'file';
+
+interface MasterKeyState {
+  key: Buffer;
+  source: KeySource;
+}
 
 // Cache the key in memory to avoid frequent system calls
 let cachedMasterKey: Buffer | null = null;
+let cachedMasterKeySource: KeySource | null = null;
 
-async function getOrGenerateMasterKey(): Promise<Buffer> {
+function cacheMasterKey(key: Buffer, source: KeySource) {
-  if (cachedMasterKey) return cachedMasterKey;
+  cachedMasterKey = key;
-
+  cachedMasterKeySource = source;
-  try {
-    let hexKey = await keytar.getPassword(SERVICE_NAME, ACCOUNT_NAME);
-
-    if (!hexKey) {
-      logger.info('Security: Generating new master key...');
-      // Generate 256-bit key (32 bytes)
-      const buffer = crypto.randomBytes(32);
-      hexKey = buffer.toString('hex');
-      await keytar.setPassword(SERVICE_NAME, ACCOUNT_NAME, hexKey);
 }
 
-    cachedMasterKey = Buffer.from(hexKey, 'hex');
+function getCachedMasterKey() {
-    return cachedMasterKey;
+  if (!cachedMasterKey || !cachedMasterKeySource) {
+    return null;
+  }
+
+  return { key: cachedMasterKey, source: cachedMasterKeySource };
+}
+
+function buildKeychainAccessHint(error: unknown): string | null {
+  if (process.platform !== 'darwin') {
+    return null;
+  }
+
+  let appPath = '';
+  try {
+    appPath = app.getAppPath();
+  } catch {
+    appPath = '';
+  }
+
+  const isTranslocated = appPath.includes('/AppTranslocation/');
+  if (isTranslocated) {
+    return KEYCHAIN_HINT_TRANSLOCATION;
+  }
+
+  const errorMessage = error instanceof Error ? error.message : String(error);
+  if (errorMessage.toLowerCase().includes('keychain')) {
+    return KEYCHAIN_HINT_KEYCHAIN_DENIED;
+  }
+
+  return KEYCHAIN_HINT_SIGN_NOTARIZE;
+}
+
+// Lock to prevent concurrent key generation
+let keyGenerationInProgress: Promise<MasterKeyState> | null = null;
+
+// Fallback key file path (used when keytar and safeStorage both fail)
+function getFallbackKeyPath(): string {
+  const userDataPath = app.getPath('userData');
+  return path.join(userDataPath, '.mk');
+}
+
+/**
+ * Try to load keytar dynamically to avoid hard failure if it's not available
+ */
+async function tryKeytar(): Promise<typeof import('keytar') | null> {
+  try {
+    // Native modules may fail to load in production builds
+    const keytar = await import('keytar');
+    // Test if keytar is actually working by calling a method
+    await keytar.default.findCredentials(SERVICE_NAME);
+    return keytar.default;
   } catch (error) {
+    logger.warn('Security: keytar not available, using fallback', error);
+    return null;
+  }
+}
+
+async function readSafeStorageKey(keyPath: string): Promise<Buffer | null> {
+  if (!safeStorage.isEncryptionAvailable()) {
+    return null;
+  }
+
+  try {
+    const encryptedKey = await fs.readFile(keyPath);
+    const hexKey = safeStorage.decryptString(encryptedKey);
+
+    if (!/^[a-f0-9]+$/i.test(hexKey) || hexKey.length !== 64) {
+      return null;
+    }
+
+    return Buffer.from(hexKey, 'hex');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return null;
+    }
+
+    logger.warn('Security: Failed to read safeStorage key file', error);
+    return null;
+  }
+}
+
+async function getOrCreateSafeStorageKey(
+  keyPath: string,
+): Promise<{ key: Buffer; created: boolean }> {
+  const existingKey = await readSafeStorageKey(keyPath);
+  if (existingKey) {
+    return { key: existingKey, created: false };
+  }
+
+  const buffer = crypto.randomBytes(32);
+  const hexKey = buffer.toString('hex');
+  const encrypted = safeStorage.encryptString(hexKey);
+  await atomicWriteFile(keyPath, encrypted, { mode: 0o600 });
+  return { key: buffer, created: true };
+}
+
+async function readKeytarKey(): Promise<Buffer | null> {
+  const keytar = await tryKeytar();
+  if (!keytar) {
+    return null;
+  }
+
+  const existingKey = await keytar.getPassword(SERVICE_NAME, ACCOUNT_NAME);
+  if (!existingKey) {
+    return null;
+  }
+
+  if (!/^[a-f0-9]+$/i.test(existingKey) || existingKey.length !== 64) {
+    logger.warn('Security: keytar key has unexpected format');
+    return null;
+  }
+
+  return Buffer.from(existingKey, 'hex');
+}
+
+async function getOrCreateKeytarKey(): Promise<{ key: Buffer; created: boolean } | null> {
+  const keytar = await tryKeytar();
+  if (!keytar) {
+    return null;
+  }
+
+  const existingKey = await keytar.getPassword(SERVICE_NAME, ACCOUNT_NAME);
+  if (existingKey) {
+    return { key: Buffer.from(existingKey, 'hex'), created: false };
+  }
+
+  const buffer = crypto.randomBytes(32);
+  const hexKey = buffer.toString('hex');
+  await keytar.setPassword(SERVICE_NAME, ACCOUNT_NAME, hexKey);
+  return { key: buffer, created: true };
+}
+
+async function readFileFallbackKey(keyPath: string): Promise<Buffer | null> {
+  try {
+    const content = await fs.readFile(keyPath, 'utf8');
+    if (content.length === 64 && /^[a-f0-9]+$/i.test(content)) {
+      return Buffer.from(content, 'hex');
+    }
+
+    return null;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return null;
+    }
+
+    logger.warn('Security: Error reading fallback key file', error);
+    return null;
+  }
+}
+
+async function getOrCreateFileFallbackKey(
+  keyPath: string,
+): Promise<{ key: Buffer; created: boolean }> {
+  const existingKey = await readFileFallbackKey(keyPath);
+  if (existingKey) {
+    return { key: existingKey, created: false };
+  }
+
+  const buffer = crypto.randomBytes(32);
+  const hexKey = buffer.toString('hex');
+  await atomicWriteFile(keyPath, hexKey, { mode: 0o600 });
+  return { key: buffer, created: true };
+}
+
+async function getFallbackMasterKeys(
+  keyPath: string,
+  primarySource: KeySource,
+): Promise<MasterKeyState[]> {
+  const fallbackKeys: MasterKeyState[] = [];
+
+  if (primarySource !== 'keytar') {
+    const keytarKey = await readKeytarKey();
+    if (keytarKey) {
+      fallbackKeys.push({ key: keytarKey, source: 'keytar' });
+    }
+  }
+
+  if (primarySource !== 'file') {
+    const fileKey = await readFileFallbackKey(keyPath);
+    if (fileKey) {
+      fallbackKeys.push({ key: fileKey, source: 'file' });
+    }
+  }
+
+  if (primarySource !== 'safeStorage') {
+    const safeStorageKey = await readSafeStorageKey(keyPath);
+    if (safeStorageKey) {
+      fallbackKeys.push({ key: safeStorageKey, source: 'safeStorage' });
+    }
+  }
+
+  return fallbackKeys;
+}
+
+/**
+ * Atomic file write to prevent data races
+ * Writes to a temp file first, then renames atomically
+ */
+async function atomicWriteFile(
+  filePath: string,
+  data: Buffer | string,
+  options?: { mode?: number },
+): Promise<void> {
+  const tempPath = `${filePath}.tmp.${process.pid}.${Date.now()}`;
+  try {
+    await fs.writeFile(tempPath, data, { mode: options?.mode ?? 0o600 });
+    await fs.rename(tempPath, filePath);
+  } catch (error) {
+    // Clean up temp file if rename failed
+    try {
+      await fs.unlink(tempPath);
+    } catch {
+      // Ignore cleanup errors
+    }
+    throw error;
+  }
+}
+
+/**
+ * Get or generate master encryption key using multiple fallback strategies:
+ * 1. safeStorage (Electron's built-in secure storage) - preferred
+ * 2. keytar (system keychain) - fallback
+ * 3. File-based with safeStorage encryption - last resort (with security warning)
+ *
+ * Uses a lock to prevent concurrent key generation (data race prevention)
+ */
+async function getPrimaryMasterKey(): Promise<MasterKeyState> {
+  const cached = getCachedMasterKey();
+  if (cached) {
+    return cached;
+  }
+
+  if (keyGenerationInProgress) {
+    return keyGenerationInProgress;
+  }
+
+  keyGenerationInProgress = generatePrimaryMasterKey();
+  try {
+    return await keyGenerationInProgress;
+  } finally {
+    keyGenerationInProgress = null;
+  }
+}
+
+async function generatePrimaryMasterKey(): Promise<MasterKeyState> {
+  const cached = getCachedMasterKey();
+  if (cached) {
+    return cached;
+  }
+
+  const keyPath = getFallbackKeyPath();
+
+  if (safeStorage.isEncryptionAvailable()) {
+    try {
+      const result = await getOrCreateSafeStorageKey(keyPath);
+      cacheMasterKey(result.key, 'safeStorage');
+      if (result.created) {
+        logger.info('Security: Generated new master key via safeStorage');
+      } else {
+        logger.info('Security: Loaded master key via safeStorage');
+      }
+      return { key: result.key, source: 'safeStorage' };
+    } catch (error) {
+      logger.warn('Security: safeStorage failed, trying keytar', error);
+    }
+  }
+
+  try {
+    const result = await getOrCreateKeytarKey();
+    if (result) {
+      cacheMasterKey(result.key, 'keytar');
+      if (result.created) {
+        logger.info('Security: Generated new master key via keytar');
+      } else {
+        logger.info('Security: Loaded master key via keytar');
+      }
+      return { key: result.key, source: 'keytar' };
+    }
+  } catch (error) {
+    logger.warn('Security: keytar failed', error);
+  }
+
+  logger.warn(
+    'Security: WARNING - Using file-based key storage. ' +
+      'This is less secure than system keychain. ' +
+      'Ensure the app data directory has restricted permissions.',
+  );
+
+  try {
+    const result = await getOrCreateFileFallbackKey(keyPath);
+    cacheMasterKey(result.key, 'file');
+    if (result.created) {
+      logger.warn('Security: Generating file-based fallback key (less secure)');
+    } else {
+      logger.warn('Security: Using file-based fallback key (less secure)');
+    }
+    return { key: result.key, source: 'file' };
+  } catch (error) {
+    const hint = buildKeychainAccessHint(error);
     logger.error('Security: Failed to access keychain/credential manager', error);
-    // Fallback? If we can't store the key, we can't persistently encrypt.
+    const message = hint ? `${KEYCHAIN_ERROR_CODE}|${hint}` : KEYCHAIN_ERROR_CODE;
-    // For now, throw to prevent data loss (better not to write than to write something we can't decrypt later or write plain text when promised encrypted)
+    throw new Error(message);
-    throw new Error('Key management system unavailable');
   }
 }
 
 const ALGORITHM = 'aes-256-gcm';
 const IV_LENGTH = 16;
-const AUTH_TAG_LENGTH = 16;
 
 /**
  * Encrypts a string using AES-256-GCM.
@@ -42,7 +344,15 @@ const AUTH_TAG_LENGTH = 16;
  */
 export async function encrypt(text: string): Promise<string> {
   try {
-    const key = await getOrGenerateMasterKey();
+    const { key } = await getPrimaryMasterKey();
+    return encryptWithKey(key, text);
+  } catch (error) {
+    logger.error('Security: Encryption failed', error);
+    throw new Error('Encryption failed');
+  }
+}
+
+function encryptWithKey(key: Buffer, text: string): string {
   const iv = crypto.randomBytes(IV_LENGTH);
 
   const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
@@ -52,36 +362,15 @@ export async function encrypt(text: string): Promise<string> {
 
   const authTag = cipher.getAuthTag();
 
-    // Format: iv:authTag:encrypted
   return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;
-  } catch (error) {
-    logger.error('Security: Encryption failed', error);
-    throw error;
-  }
 }
 
-/**
+function decryptWithKey(
- * Decrypts a string using AES-256-GCM.
+  key: Buffer,
- * Input format: "iv_hex:auth_tag_hex:ciphertext_hex"
+  ivHex: string,
- */
+  authTagHex: string,
-export async function decrypt(text: string): Promise<string> {
+  encryptedHex: string,
-  // Check if it's plain text (JSON) for backward compatibility
+): string {
-  // Very rough check: starts with { or [
-  if (text.startsWith('{') || text.startsWith('[')) {
-    return text;
-  }
-
-  // Also checking if it follows our pattern
-  const parts = text.split(':');
-  if (parts.length !== 3) {
-    // Treat as plain text if it doesn't look like our encrypted format
-    return text;
-  }
-
-  try {
-    const key = await getOrGenerateMasterKey();
-
-    const [ivHex, authTagHex, encryptedHex] = parts;
   const iv = Buffer.from(ivHex, 'hex');
   const authTag = Buffer.from(authTagHex, 'hex');
 
@@ -92,9 +381,93 @@ export async function decrypt(text: string): Promise<string> {
   decrypted += decipher.final('utf8');
 
   return decrypted;
+}
+
+function isAuthTagMismatchError(errorMessage: string): boolean {
+  const normalized = errorMessage.toLowerCase();
+  return (
+    normalized.includes('unable to authenticate data') ||
+    normalized.includes('auth tag') ||
+    normalized.includes('bad decrypt')
+  );
+}
+
+export async function decryptWithMigration(
+  text: string,
+): Promise<{ value: string; reencrypted?: string; usedFallback?: KeySource }> {
+  if (text.startsWith('{') || text.startsWith('[')) {
+    return { value: text };
+  }
+
+  const parts = text.split(':');
+  if (parts.length !== 3) {
+    return { value: text };
+  }
+
+  const [ivHex, authTagHex, encryptedHex] = parts;
+
+  if (
+    !/^[a-f0-9]+$/i.test(ivHex) ||
+    !/^[a-f0-9]+$/i.test(authTagHex) ||
+    !/^[a-f0-9]+$/i.test(encryptedHex)
+  ) {
+    logger.warn('Security: Invalid encrypted format - not valid hex');
+    throw new Error('Invalid encrypted data format');
+  }
+
+  const primary = await getPrimaryMasterKey();
+  try {
+    return { value: decryptWithKey(primary.key, ivHex, authTagHex, encryptedHex) };
   } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+
+    if (errorMessage.includes('Invalid key length') || errorMessage.includes('Invalid IV length')) {
+      logger.error('Security: Decryption failed - corrupted encrypted data');
+      throw new Error('Decryption failed: Corrupted encrypted data');
+    }
+
+    if (!isAuthTagMismatchError(errorMessage)) {
       logger.error('Security: Decryption failed', error);
-    // If decryption fails, it might be corrupted or using a different key.
+      throw new Error('Decryption failed');
-    throw error;
+    }
+
+    const keyPath = getFallbackKeyPath();
+    const fallbackKeys = await getFallbackMasterKeys(keyPath, primary.source);
+    for (const fallback of fallbackKeys) {
+      try {
+        const value = decryptWithKey(fallback.key, ivHex, authTagHex, encryptedHex);
+        let reencrypted: string | undefined;
+        try {
+          reencrypted = encryptWithKey(primary.key, value);
+        } catch (reencryptError) {
+          logger.warn(
+            `Security: Failed to re-encrypt data from ${fallback.source} to ${primary.source}`,
+            reencryptError,
+          );
+        }
+        if (reencrypted) {
+          logger.info(
+            `Security: Re-encrypted data from ${fallback.source} to ${primary.source}`,
+          );
+        }
+        return { value, reencrypted, usedFallback: fallback.source };
+      } catch {
+        continue;
       }
     }
+
+    logger.error(
+      'Security: Decryption failed - authentication tag mismatch (wrong key or corrupted data)',
+    );
+    throw new Error(`${DATA_MIGRATION_ERROR_CODE}|${DATA_MIGRATION_HINT_RELOGIN}`);
+  }
+}
+
+/**
+ * Decrypts a string using AES-256-GCM.
+ * Input format: "iv_hex:auth_tag_hex:ciphertext_hex"
+ */
+export async function decrypt(text: string): Promise<string> {
+  const result = await decryptWithMigration(text);
+  return result.value;
+}

vite.main.config.mts

@@ -14,12 +14,17 @@ export default defineConfig({
       ioredis: path.resolve(process.cwd(), './src/mocks/empty.ts'),
       '@fastify/static': path.resolve(process.cwd(), './src/mocks/empty.ts'),
       '@fastify/view': path.resolve(process.cwd(), './src/mocks/empty.ts'),
+      '@nestjs/microservices': path.resolve(process.cwd(), './src/mocks/nestjs-microservices'),
+      '@nestjs/websockets': path.resolve(process.cwd(), './src/mocks/nestjs-websockets'),
     },
   },
   build: {
     sourcemap: true,
     rollupOptions: {
-      external: ['better-sqlite3', 'keytar'],
+      external: [
+        'better-sqlite3',
+        'keytar',
+      ],
     },
   },
 });