fix(ci): 显式透传 GITHUB_TOKEN 给 tauri-action 上传用

- tauri-action 报 'GITHUB_TOKEN is required' 实际是模板替换失败
- 在 step env 显式给 ${{ secrets.GITHUB_TOKEN }} 解决

.github/workflows/release.yml

@@ -0,0 +1,91 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  version-check:
+    name: Version consistency
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Verify tag matches package.json / Cargo.toml / tauri.conf.json
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          chmod +x scripts/check-version.sh
+          ./scripts/check-version.sh "$TAG"
+
+  build:
+    name: Build (${{ matrix.platform }})
+    needs: version-check
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: ubuntu-latest
+            args: --bundles deb,appimage,rpm
+          - platform: macos-latest
+            args: --bundles app,dmg
+          - platform: windows-latest
+            args: --bundles msi
+
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          cache: true
+
+      - name: Install Linux build dependencies
+        if: matrix.platform == 'ubuntu-latest'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            librsvg2-dev \
+            patchelf \
+            build-essential \
+            curl \
+            wget \
+            file \
+            libssl-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev
+
+      - name: Build and upload release
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tagName: ${{ github.ref_name }}
+          releaseName: ${{ github.ref_name }}
+          releaseBody: |
+            ## ${{ github.ref_name }}
+
+            ### Downloads by platform
+
+            - **Windows**: `.msi` installer
+            - **macOS**: `.dmg` (unsigned — first launch needs right-click → Open) + `.app`
+            - **Linux**: `.deb` / `.AppImage` / `.rpm`
+
+            Full changelog: see commit history.
+          releaseDraft: true
+          prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }}
+          args: ${{ matrix.args }}

.gitignore

@@ -13,3 +13,4 @@ Snipaste_*.png
 
 # 内部设计规范与实施计划，仅供本地查阅，不入版本库
 docs/superpowers/
+.release*

Dockerfile

@@ -0,0 +1,38 @@
+# Build Kimi Switch Linux packages (deb / AppImage / rpm) inside a clean
+# Ubuntu 22.04 container. Used both locally (`docker compose run`) and as a
+# reference for GH Actions' ubuntu-latest job.
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV CARGO_TERM_COLOR=always
+ENV RUSTUP_HOME=/usr/local/rustup
+ENV CARGO_HOME=/usr/local/cargo
+ENV PATH=/usr/local/cargo/bin:$PATH
+
+RUN apt-get update && apt-get install -y \
+    curl \
+    wget \
+    git \
+    build-essential \
+    pkg-config \
+    libssl-dev \
+    libgtk-3-dev \
+    libayatana-appindicator3-dev \
+    librsvg2-dev \
+    libwebkit2gtk-4.1-dev \
+    libsoup-3.0-dev \
+    libjavascriptcoregtk-4.1-dev \
+    patchelf \
+    file \
+    nodejs \
+    npm \
+    python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
+
+RUN cargo install tauri-cli --version "^2.0" --locked
+
+WORKDIR /workspace
+
+CMD ["/bin/bash"]

README.md

@@ -8,8 +8,9 @@
 [![React](https://img.shields.io/badge/React-18-61dafb?logo=react)](https://react.dev)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.5-3178c6?logo=typescript)](https://www.typescriptlang.org)
 [![Rust](https://img.shields.io/badge/Rust-2021-ed764d?logo=rust)](https://www.rust-lang.org)
-[![Version](https://img.shields.io/badge/release-v0.5.2-brightgreen)](https://git.codingplan.site/admin/KimiCodeSwitch/releases)
+[![Version](https://img.shields.io/badge/release-v0.6.0-brightgreen)](https://github.com/billowliu2/KimiSwitch/releases/tag/v0.6.0)
 [![License](https://img.shields.io/badge/license-MIT-green)](./LICENSE)
+[![Release](https://github.com/billowliu2/KimiSwitch/actions/workflows/release.yml/badge.svg)](https://github.com/billowliu2/KimiSwitch/releases/latest)
 
 ---
 
@@ -51,6 +52,16 @@
 - **主题/语言切换**：设置面板中切换深色/浅色/跟随系统，简体中文/English
 - **Windows 友好**：单实例；最小化保留任务栏按钮；关闭按钮隐藏到托盘
 
+## 下载
+
+- **Windows**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.msi`
+- **macOS**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.dmg`（**未签名** —— 首次启动请右键 → 打开绕过 Gatekeeper）
+- **Linux**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.deb` / `.AppImage` / `.rpm`
+
+历史版本（v0.5.x 及之前）请前往 [git.codingplan.site 仓库](https://git.codingplan.site/admin/KimiCodeSwitch/releases)。
+
+构建说明请见 [`docs/BUILD.md`](./docs/BUILD.md)。
+
 ## 核心特性
 
 | 分类 | 功能 |
@@ -498,38 +509,21 @@ Windows 安装包（MSI），含 WebView2 bootstrapper 自动下载。`nsis` 已
 
 ## 发布历史
 
-### v0.5.1（最新）
+### v0.6.0（最新）
 
-- 窗口/托盘：最小化保留任务栏；关闭 X 隐藏到托盘；托盘左键始终显示并聚焦
+- **15 条主流供应商预设**：Kimi Coding / Moonshot / Anthropic / DeepSeek / 智谱 GLM / z.ai / 阿里百炼 / MiniMax / StepFun / SiliconFlow / Novita / OpenRouter / OpenAI / Google AI Studio / 火山方舟，通过 `PresetPickerModal` 一键填表
-- 模型用量表：模型列宽度自适应，长模型名完整显示不再截断
+- **供应商余额 / 套餐查询**（卡片底部 `UsageFooter`）：余额类（DeepSeek / SiliconFlow / OpenRouter / StepFun / Novita）+ 套餐类（Kimi For Coding / 智谱 GLM / MiniMax），5min stale TTL + `force_refresh` + 并发 ≤3
-- 模型能力编辑：只保留"思考"，其余能力仍由 models.dev 自动推导
+- **Rust 端 `services/` 模块**（`balance` / `coding_plan` / `usage_types`），参考 cc-switch（MIT，© Jason Young）实现
-- 模型映射表格：行分隔线改为主题感知，修复浅色模式突兀问题
+- `query_provider_usage` 命令：Rust 端从 config 加载 key，不经 IPC 序列化 API key
+- `usageKinds` 持久化到 SQLite settings（JSON 数组），load 时合并回 config，导出 `config.toml` 时不写
+- `detect_provider` 启发式：旧用户升级后自动获得账单支持
+- save-time 校验：未完成供应商（缺 api_key / base_url / 模型）保存时弹 confirm 列出原因；新增未提交 back 时静默 drop
+- 修复：`handleDuplicateProvider` 的 `alias.slice` 漏洞；`handleSelectPreset` 不再 auto-save；`handleSwitchProvider` 校验取消时自动 refresh 回滚
+- 新增文档：[`docs/PROPOSAL-presets-and-usage.md`](./docs/PROPOSAL-presets-and-usage.md)（v0.4-draft 实施档）、[`docs/VERIFICATION-CHECKLIST.md`](./docs/VERIFICATION-CHECKLIST.md)（70+ 项手动验证清单）
 
-### v0.5.0
+### 历史版本
 
-- 供应商操作图标化（lucide-react）：启用 / 编辑 / 复制 / 测试连通 / 删除
+v0.5.x 及之前版本（含 v0.5.1 / v0.5.0 / v0.4.1 / v0.4.0 / v0.3.0）请前往 [git.codingplan.site 仓库](https://git.codingplan.site/admin/KimiCodeSwitch/releases) 查看。GitHub 仓库仅作为 v0.6.0 及以后版本的发布渠道。
-- 重复供应商（深拷贝供应商 + 全部模型）
-- 连通性测试（绿/橙/红气泡 + 6 秒自动消失）
-- 每日趋势柱状图锚定到面板底部
-
-### v0.4.1
-
-- 模型发现分页（OpenAI / Anthropic / Google），减少大列表命中限制
-
-### v0.4.0
-
-- 完善的图标系统（移植自 cc-switch 图标库）
-- 设置面板（主题、语言）
-- 启动版本检查
-
-### v0.3.0
-
-[移植自 kimicode-dashboard](https://github.com/JochenYang/kimicode-dashboard)：
-
-- 用量仪表盘：8 KPI、每日趋势、全年热力图、最近请求翻页
-- 会话管理：按工作区浏览、预览、归档、批量删除
-- 时区修复：`today` / 热力图 / `day_key` 改用本地日历日
-- Pi 选项隐藏
 
 ## 常见问题
 

README_EN.md

@@ -8,8 +8,9 @@
 [![React](https://img.shields.io/badge/React-18-61dafb?logo=react)](https://react.dev)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.5-3178c6?logo=typescript)](https://www.typescriptlang.org)
 [![Rust](https://img.shields.io/badge/Rust-2021-ed764d?logo=rust)](https://www.rust-lang.org)
-[![Version](https://img.shields.io/badge/release-v0.5.2-brightgreen)](https://git.codingplan.site/admin/KimiCodeSwitch/releases)
+[![Version](https://img.shields.io/badge/release-v0.6.0-brightgreen)](https://github.com/billowliu2/KimiSwitch/releases/tag/v0.6.0)
 [![License](https://img.shields.io/badge/license-MIT-green)](./LICENSE)
+[![Release](https://github.com/billowliu2/KimiSwitch/actions/workflows/release.yml/badge.svg)](https://github.com/billowliu2/KimiSwitch/releases/latest)
 
 ---
 
@@ -51,6 +52,16 @@
 - **Theme / language** — dark / light / follow-system themes; Simplified Chinese / English
 - **Windows polish** — single instance; minimize keeps the taskbar button; close hides to tray
 
+## Downloads
+
+- **Windows**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.msi`
+- **macOS**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.dmg` (**unsigned** — first launch needs right-click → Open to bypass Gatekeeper)
+- **Linux**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.deb` / `.AppImage` / `.rpm`
+
+Historical versions (v0.5.x and earlier) live on the [git.codingplan.site repository](https://git.codingplan.site/admin/KimiCodeSwitch/releases).
+
+Build instructions: [`docs/BUILD.md`](./docs/BUILD.md).
+
 ## Key Features
 
 | Category | Feature |
@@ -494,38 +505,24 @@ The first run downloads:
 
 ## Release History
 
-### v0.5.1 (latest)
+### v0.6.0 (latest)
 
-- Window / tray: minimize keeps the taskbar button; close X hides to tray; tray left-click always shows + focuses
+- **15 mainstream provider presets**: Kimi Coding / Moonshot / Anthropic / DeepSeek / Zhipu GLM / z.ai / Alibaba Bailian / MiniMax / StepFun / SiliconFlow / Novita / OpenRouter / OpenAI / Google AI Studio / Volcengine Ark — one-click form fill via `PresetPickerModal`
-- Usage table: model column auto-width, long names no longer truncated
+- **Provider balance / plan usage query** (per-card `UsageFooter`):
-- Capability editor: only `thinking` exposed; other capabilities still auto-derived from models.dev
+  - Balance: DeepSeek / SiliconFlow / OpenRouter / StepFun / Novita
-- Model mapping table: theme-aware row divider, no more harsh line in light mode
+  - Plan: Kimi For Coding / Zhipu GLM / MiniMax
+  - 5-min stale TTL + `force_refresh` + concurrency ≤ 3
+- **Rust `services/` module** (`balance` / `coding_plan` / `usage_types`), adapted from cc-switch (MIT, © Jason Young)
+- `query_provider_usage` command: loads API key from config in Rust, never serialized over IPC
+- `usageKinds` persisted in SQLite `settings` (JSON array), merged back into config on load, omitted from `config.toml` export
+- `detect_provider` heuristic: existing users automatically gain balance/plan support after upgrade
+- Save-time validation: incomplete providers (missing `api_key` / `base_url` / models) trigger a confirm dialog listing the reasons; uncommitted `add` is silently dropped on back
+- Fixes: `handleDuplicateProvider` `alias.slice` bug; `handleSelectPreset` no longer auto-saves; `handleSwitchProvider` auto-refresh rollback when validation is cancelled
+- New docs: [`docs/PROPOSAL-presets-and-usage.md`](./docs/PROPOSAL-presets-and-usage.md) (v0.4-draft implementation), [`docs/VERIFICATION-CHECKLIST.md`](./docs/VERIFICATION-CHECKLIST.md) (70+ manual checks)
 
-### v0.5.0
+### Historical versions
 
-- Iconified actions (lucide-react): activate / edit / duplicate / test / delete
+Versions v0.5.x and earlier (v0.5.1 / v0.5.0 / v0.4.1 / v0.4.0 / v0.3.0) live on the [git.codingplan.site repository](https://git.codingplan.site/admin/KimiCodeSwitch/releases). The GitHub repo is the release channel from v0.6.0 onward.
-- Duplicate provider (deep-copy a provider + all its models)
-- Connectivity test (green / orange / red bubble + 6s auto-dismiss)
-- Daily trend bars anchored to the panel bottom
-
-### v0.4.1
-
-- Model discovery pagination (OpenAI / Anthropic / Google), fewer large-list limits hit
-
-### v0.4.0
-
-- Polished icon system (library adapted from cc-switch)
-- Settings modal (theme / language)
-- Launch-time update check
-
-### v0.3.0
-
-Ported from [kimicode-dashboard](https://github.com/JochenYang/kimicode-dashboard):
-
-- Dashboard: 8 KPIs, daily trend, full-year heatmap, paginated recent requests
-- Session manager: per-workspace browsing, preview, archive, bulk delete
-- Timezone fix: `today` / heatmap / `day_key` now use local calendar day
-- Pi option hidden from the UI
 
 ## FAQ
 

docker-compose.yml

@@ -0,0 +1,13 @@
+services:
+  build-linux:
+    build: .
+    container_name: kimiswitch-build-linux
+    volumes:
+      - .:/workspace
+      - cargo-cache:/usr/local/cargo/registry
+      - target-cache:/workspace/src-tauri/target
+    working_dir: /workspace
+
+volumes:
+  cargo-cache:
+  target-cache:

docs/BUILD.md

@@ -0,0 +1,86 @@
+# Build
+
+Docker (Linux), native (any platform), and CI (multi-platform) build instructions.
+
+## Local builds by host
+
+### Windows (current primary dev environment)
+
+Prerequisites: Rust stable, Node 20, Microsoft C++ Build Tools, WebView2.
+
+```bash
+npm ci
+npm run tauri build -- --bundles msi
+```
+
+Output: `src-tauri/target/release/bundle/msi/`.
+
+### macOS
+
+Prerequisites: Xcode command-line tools, Rust stable, Node 20.
+
+```bash
+npm ci
+npm run tauri build -- --bundles app,dmg
+```
+
+Output: `src-tauri/target/release/bundle/{macos,dmg}/`.
+
+Unsigned: first launch requires right-click → Open to bypass Gatekeeper.
+
+### Linux (native)
+
+Prerequisites: see `Dockerfile` for the full apt-get list (webkit2gtk-4.1, librsvg2, etc.).
+
+```bash
+npm ci
+npm run tauri build -- --bundles deb,appimage,rpm
+```
+
+Output: `src-tauri/target/release/bundle/{deb,appimage,rpm}/`.
+
+### Linux via Docker (works on Windows / macOS too)
+
+```bash
+docker compose build build-linux
+docker compose run --rm build-linux bash -c '
+  npm ci &&
+  npm run tauri build -- --bundles deb,appimage,rpm
+'
+```
+
+Output is mounted back to `src-tauri/target/release/bundle/` on the host.
+
+## CI: GitHub Actions
+
+`.github/workflows/release.yml` runs on `git tag v* && git push origin v*`.
+
+1. `version-check` runs `scripts/check-version.sh` to ensure tag matches `package.json`, `Cargo.toml`, `tauri.conf.json`.
+2. Three parallel jobs build for `ubuntu-latest`, `macos-latest`, `windows-latest` using `tauri-action`.
+3. Artifacts are uploaded to the GitHub Release (auto-draft for non-prerelease tags).
+
+To cut a release:
+
+```bash
+# 1. Bump version in three places
+#    package.json:               "version": "0.7.0"
+#    src-tauri/Cargo.toml:       version = "0.7.0"
+#    src-tauri/tauri.conf.json:  "version": "0.7.0"
+# 2. Commit
+git commit -am "chore(release): bump to v0.7.0"
+# 3. Tag and push
+git tag v0.7.0
+git push origin v0.7.0
+```
+
+## Update checker asset selection
+
+`src-tauri/src/commands.rs::pick_asset_for_current_os` picks the right asset by file extension:
+
+| OS      | Extension  |
+|---------|------------|
+| Windows | `.msi`     |
+| macOS   | `.dmg`     |
+| Linux   | `.AppImage` (preferred; deb / rpm downloadable manually from the release page) |
+
+If the preferred extension is missing, the UI falls back to opening the release page.

docs/superpowers/plans/2026-07-29-multi-platform-packaging.md

@@ -0,0 +1,867 @@
+# Kimi Switch Multi-Platform Packaging Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add macOS + Linux packaging support on top of existing Windows MSI; release driven by GitHub Actions tag-push workflow.
+
+**Architecture:** Source-level changes are minimal (Tauri config tweaks + platform-conditional Rust + asset picker). Build infrastructure is the heavy lifting: one GH Actions workflow (version-check + 3-platform matrix using `tauri-action`) and a local Docker setup for Linux dev iteration.
+
+**Tech Stack:** Tauri 2.x, Rust 2021, React 18 + TypeScript 5.5, GitHub Actions (`tauri-apps/tauri-action`), Docker (Ubuntu 22.04 + webkit2gtk-4.1), bash.
+
+## Global Constraints
+
+- macOS assets: `.app` + `.dmg`, **unsigned** (no Apple Developer ID provided)
+- Linux assets: `.deb` + `.AppImage` + `.rpm` (all three)
+- Windows assets: `.msi` (existing)
+- Bundle target string in `tauri.conf.json`: `"all"` (allow per-platform build)
+- macOS minimum system version: `10.15`
+- Update checker picks asset by file extension: `.msi` / `.dmg` / `.AppImage`
+- Temp filename for downloaded installer: `KimiSwitch_update.<ext>` (ext from OS)
+- Version consistency: `git tag` must equal `package.json:version` = `Cargo.toml:version` = `tauri.conf.json:version`
+- Cargo behavior: keep `tauri = "2.0.0"`, `tauri-plugin-opener = "2.0.0"`, `tauri-plugin-single-instance = "2.0.0"`
+- No new lint failures; no new dependencies beyond what's already in `Cargo.toml`
+- Spec location: `docs/superpowers/specs/2026-07-29-multi-platform-packaging-design.md`
+
+---
+
+## Task 1: Tauri config — bundle targets and macOS section
+
+**Files:**
+- Modify: `src-tauri/tauri.conf.json`
+
+**Interfaces:**
+- Consumes: existing Windows-only config
+- Produces: `bundle.targets = "all"`, `bundle.macOS.minimumSystemVersion`, expanded icon list
+
+- [ ] **Step 1: Update `tauri.conf.json`**
+
+Replace the existing `bundle` block with:
+
+```json
+{
+  "bundle": {
+    "active": true,
+    "targets": "all",
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.ico",
+      "icons/icon.icns"
+    ],
+    "windows": {
+      "webviewInstallMode": {
+        "type": "downloadBootstrapper"
+      },
+      "nsis": null
+    },
+    "macOS": {
+      "minimumSystemVersion": "10.15"
+    },
+    "linux": {
+      "deb": {
+        "depends": []
+      },
+      "appimage": {
+        "bundleMediaFramework": false
+      }
+    }
+  }
+}
+```
+
+- [ ] **Step 2: Verify JSON is valid**
+
+Run: `node -e "JSON.parse(require('fs').readFileSync('src-tauri/tauri.conf.json','utf8'))"`
+Expected: no output (silent success)
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src-tauri/tauri.conf.json
+git commit -m "feat(bundle): enable all-platform targets + macOS/Linux config"
+```
+
+---
+
+## Task 2: Platform-conditional `windows_subsystem` in main.rs
+
+**Files:**
+- Modify: `src-tauri/src/main.rs:1`
+
+**Interfaces:**
+- Consumes: existing `#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]`
+- Produces: Windows-only windows_subsystem; macOS/Linux keep console subsystem so logs are visible
+
+- [ ] **Step 1: Replace the directive at line 1**
+
+Replace:
+```rust
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+```
+
+With:
+```rust
+#![cfg_attr(
+    all(not(debug_assertions), target_os = "windows"),
+    windows_subsystem = "windows"
+)]
+```
+
+- [ ] **Step 2: Verify Windows build still compiles**
+
+Run: `cd src-tauri && cargo check --message-format=short 2>&1 | tail -5`
+Expected: `Finished \`dev\` profile [unoptimized + debuginfo] target(s)` with no errors
+
+- [ ] **Step 3: Verify Linux target compiles (cross-check)**
+
+Run: `cd src-tauri && cargo check --target x86_64-unknown-linux-gnu --message-format=short 2>&1 | tail -5`
+Expected: finishes clean (may need `rustup target add x86_64-unknown-linux-gnu` first; if rustup target is missing, run that and retry)
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add src-tauri/src/main.rs
+git commit -m "fix(build): only set windows_subsystem on Windows targets"
+```
+
+---
+
+## Task 3: TDD — platform-aware asset picker
+
+**Files:**
+- Modify: `src-tauri/src/commands.rs` (append at end)
+
+**Interfaces:**
+- Produces (public to module): `fn pick_asset_for_current_os(assets: &[serde_json::Value]) -> Option<String>`
+- Pure function, no side effects; testable in isolation
+
+- [ ] **Step 1: Write failing tests**
+
+Add to the end of `src-tauri/src/commands.rs`:
+
+```rust
+#[cfg(test)]
+mod asset_picker_tests {
+    use super::*;
+    use serde_json::json;
+
+    fn assets(names: &[&str]) -> Vec<serde_json::Value> {
+        names
+            .iter()
+            .map(|n| {
+                json!({
+                    "name": n,
+                    "browser_download_url": format!("https://example.com/{n}"),
+                })
+            })
+            .collect()
+    }
+
+    #[test]
+    fn windows_picks_msi() {
+        let assets = assets(&["KimiSwitch_0.7.0_x64_en-US.msi", "KimiSwitch_0.7.0_aarch64.dmg", "KimiSwitch_0.7.0_amd64.AppImage"]);
+        let url = pick_asset_for_current_os(&assets);
+        assert_eq!(url.as_deref(), Some("https://example.com/KimiSwitch_0.7.0_x64_en-US.msi"));
+    }
+
+    #[test]
+    fn macos_picks_dmg() {
+        let assets = assets(&["KimiSwitch_0.7.0_x64_en-US.msi", "KimiSwitch_0.7.0_aarch64.dmg", "KimiSwitch_0.7.0_amd64.AppImage"]);
+        let url = pick_asset_for_current_os(&assets);
+        assert_eq!(url.as_deref(), Some("https://example.com/KimiSwitch_0.7.0_aarch64.dmg"));
+    }
+
+    #[test]
+    fn linux_picks_appimage() {
+        let assets = assets(&["KimiSwitch_0.7.0_x64_en-US.msi", "KimiSwitch_0.7.0_aarch64.dmg", "KimiSwitch_0.7.0_amd64.AppImage"]);
+        let url = pick_asset_for_current_os(&assets);
+        assert_eq!(url.as_deref(), Some("https://example.com/KimiSwitch_0.7.0_amd64.AppImage"));
+    }
+
+    #[test]
+    fn missing_target_returns_none() {
+        let assets = assets(&["KimiSwitch_0.7.0_x64_en-US.msi"]);
+        let url = pick_asset_for_current_os(&assets);
+        assert_eq!(url, None);
+    }
+
+    #[test]
+    fn empty_assets_returns_none() {
+        let url = pick_asset_for_current_os(&[]);
+        assert_eq!(url, None);
+    }
+}
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `cd src-tauri && cargo test asset_picker_tests --message-format=short 2>&1 | tail -10`
+Expected: compile error `function \`pick_asset_for_current_os\` not found`
+
+- [ ] **Step 3: Implement the function**
+
+Add to `src-tauri/src/commands.rs` (above the test module):
+
+```rust
+/// Pick the GitHub release asset matching the current OS by file extension.
+/// Preference for Linux is AppImage (portable, no install). If the preferred
+/// extension is not present, returns None so the UI can fall back to
+/// "open release page" instead of guessing a less-preferred format.
+fn pick_asset_for_current_os(assets: &[serde_json::Value]) -> Option<String> {
+    let target_ext = match std::env::consts::OS {
+        "macos" => "dmg",
+        "linux" => "AppImage",
+        "windows" => "msi",
+        _ => return None,
+    };
+    assets
+        .iter()
+        .find(|a| {
+            a.get("name")
+                .and_then(|n| n.as_str())
+                .map(|n| n.ends_with(target_ext))
+                .unwrap_or(false)
+        })
+        .and_then(|a| a.get("browser_download_url"))
+        .and_then(|v| v.as_str())
+        .map(|s| s.to_string())
+}
+
+/// Build the platform-specific temp filename for the downloaded installer.
+fn update_temp_filename() -> String {
+    let ext = match std::env::consts::OS {
+        "macos" => "dmg",
+        "linux" => "AppImage",
+        "windows" => "msi",
+        _ => "bin",
+    };
+    format!("KimiSwitch_update.{ext}")
+}
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `cd src-tauri && cargo test asset_picker_tests --message-format=short 2>&1 | tail -10`
+Expected: `test result: ok. 5 passed; 0 failed`
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src-tauri/src/commands.rs
+git commit -m "feat(update): TDD platform-aware asset picker + tests"
+```
+
+---
+
+## Task 4: Wire asset picker into `check_for_update` and `download_update`
+
+**Files:**
+- Modify: `src-tauri/src/commands.rs` (the `check_for_update` and `download_update` functions)
+
+**Interfaces:**
+- Consumes: `pick_asset_for_current_os` (Task 3) and `update_temp_filename` (Task 3)
+- Produces: `check_for_update` returns `download_url` for the current OS only; `download_update` writes to a platform-specific filename
+
+- [ ] **Step 1: Replace the asset-selection block in `check_for_update`**
+
+In `check_for_update`, find the existing block:
+
+```rust
+    let download_url = first
+        .get("assets")
+        .and_then(|a| a.as_array())
+        .and_then(|a| a.first())
+        .and_then(|a| a.get("browser_download_url"))
+        .and_then(|v| v.as_str())
+        .map(|s| s.to_string());
+```
+
+Replace with:
+
+```rust
+    let download_url = first
+        .get("assets")
+        .and_then(|a| a.as_array())
+        .and_then(|a| pick_asset_for_current_os(a));
+```
+
+- [ ] **Step 2: Replace the temp filename in `download_update`**
+
+In `download_update`, find the existing line:
+
+```rust
+    let file_path = temp_dir.join("KimiSwitch_update.msi");
+```
+
+Replace with:
+
+```rust
+    let file_path = temp_dir.join(update_temp_filename());
+```
+
+- [ ] **Step 3: Verify on Windows**
+
+Run: `cd src-tauri && cargo check --message-format=short 2>&1 | tail -5`
+Expected: finishes clean
+
+- [ ] **Step 4: Run the unit tests**
+
+Run: `cd src-tauri && cargo test asset_picker_tests --message-format=short 2>&1 | tail -5`
+Expected: `5 passed; 0 failed`
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add src-tauri/src/commands.rs
+git commit -m "feat(update): use platform-aware asset and filename in update flow"
+```
+
+---
+
+## Task 5: Version consistency check script
+
+**Files:**
+- Create: `scripts/check-version.sh`
+
+**Interfaces:**
+- Inputs: `expected_version` from CLI arg; reads `package.json`, `src-tauri/Cargo.toml`, `src-tauri/tauri.conf.json`
+- Output: exit 0 if all match, exit 1 otherwise (with diff to stderr)
+
+- [ ] **Step 1: Write the script**
+
+Create `scripts/check-version.sh`:
+
+```bash
+#!/usr/bin/env bash
+# Verify that the version across the project matches the expected version.
+# Usage: check-version.sh <expected>
+# Reads:
+#   package.json                  : root
+#   src-tauri/Cargo.toml          : version field
+#   src-tauri/tauri.conf.json     : version field
+set -euo pipefail
+
+EXPECTED="${1:-}"
+
+if [ -z "$EXPECTED" ]; then
+  echo "usage: check-version.sh <expected>" >&2
+  exit 2
+fi
+
+# Strip leading 'v' for comparison (we expect semver without v)
+EXPECTED_BARE="${EXPECTED#v}"
+
+PKG_VERSION=$(node -p "require('./package.json').version")
+CARGO_VERSION=$(grep -E '^version\s*=' src-tauri/Cargo.toml | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
+TAURI_VERSION=$(node -p "require('./src-tauri/tauri.conf.json').version")
+
+fail=0
+check() {
+  local label="$1"
+  local actual="$2"
+  if [ "$actual" != "$EXPECTED_BARE" ]; then
+    echo "FAIL: $label = $actual (expected $EXPECTED_BARE)" >&2
+    fail=1
+  fi
+}
+
+check "package.json"               "$PKG_VERSION"
+check "src-tauri/Cargo.toml"       "$CARGO_VERSION"
+check "src-tauri/tauri.conf.json"  "$TAURI_VERSION"
+
+if [ $fail -ne 0 ]; then
+  exit 1
+fi
+
+echo "OK: all versions = $EXPECTED_BARE"
+```
+
+- [ ] **Step 2: Make it executable**
+
+Run: `chmod +x scripts/check-version.sh`
+Expected: no output
+
+- [ ] **Step 3: Test happy path**
+
+Run: `./scripts/check-version.sh v0.6.0`
+Expected: `OK: all versions = 0.6.0`
+
+- [ ] **Step 4: Test mismatch**
+
+Run: `./scripts/check-version.sh v9.9.9`
+Expected: 3 lines starting with `FAIL:` and exit code 1
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/check-version.sh
+git commit -m "ci: add version-consistency check script"
+```
+
+---
+
+## Task 6: GitHub Actions release workflow
+
+**Files:**
+- Create: `.github/workflows/release.yml`
+
+**Interfaces:**
+- Trigger: `push: tags: ['v*']`
+- Two jobs: `version-check` (sequential) and `build` (matrix ubuntu/macos/windows)
+
+- [ ] **Step 1: Create the workflow file**
+
+Create `.github/workflows/release.yml`:
+
+```yaml
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  version-check:
+    name: Version consistency
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Verify tag matches package.json / Cargo.toml / tauri.conf.json
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          chmod +x scripts/check-version.sh
+          ./scripts/check-version.sh "$TAG"
+
+  build:
+    name: Build (${{ matrix.platform }})
+    needs: version-check
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: ubuntu-latest
+            args: --bundles deb,appimage,rpm
+          - platform: macos-latest
+            args: --bundles app,dmg
+          - platform: windows-latest
+            args: --bundles msi
+
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'npm'
+
+      - uses: actions/setup-rust@v1
+        with:
+          cache: true
+
+      - name: Install Linux build dependencies
+        if: matrix.platform == 'ubuntu-latest'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            patchelf \
+            build-essential \
+            curl \
+            wget \
+            file \
+            libssl-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev
+
+      - name: Build and upload release
+        uses: tauri-apps/tauri-action@v0
+        with:
+          tagName: ${{ github.ref_name }}
+          releaseName: ${{ github.ref_name }}
+          releaseBody: |
+            ## ${{ github.ref_name }}
+
+            ### Downloads by platform
+
+            - **Windows**: `.msi` installer
+            - **macOS**: `.dmg` (unsigned — first launch needs right-click → Open) + `.app`
+            - **Linux**: `.deb` / `.AppImage` / `.rpm`
+
+            Full changelog: see commit history.
+          releaseDraft: true
+          prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }}
+          args: ${{ matrix.args }}
+```
+
+- [ ] **Step 2: Sanity-check the file is in place**
+
+Run: `ls -la .github/workflows/release.yml && head -5 .github/workflows/release.yml`
+Expected: file exists and the first line is `name: Release` (GitHub Actions will catch any YAML syntax errors at runtime)
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add .github/workflows/release.yml
+git commit -m "ci: add multi-platform release workflow on tag push"
+```
+
+---
+
+## Task 7: Local Docker for Linux builds
+
+**Files:**
+- Create: `Dockerfile`
+- Create: `docker-compose.yml`
+
+**Interfaces:**
+- Input: source tree at `/workspace`
+- Output: built packages at `/workspace/src-tauri/target/release/bundle/{deb,appimage,rpm}/`
+
+- [ ] **Step 1: Create the Dockerfile**
+
+Create `Dockerfile`:
+
+```dockerfile
+# Build Kimi Switch Linux packages (deb / AppImage / rpm) inside a clean
+# Ubuntu 22.04 container. Used both locally (`docker compose run`) and as a
+# reference for GH Actions' ubuntu-latest job.
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV CARGO_TERM_COLOR=always
+ENV RUSTUP_HOME=/usr/local/rustup
+ENV CARGO_HOME=/usr/local/cargo
+ENV PATH=/usr/local/cargo/bin:$PATH
+
+RUN apt-get update && apt-get install -y \
+    curl \
+    wget \
+    git \
+    build-essential \
+    pkg-config \
+    libssl-dev \
+    libgtk-3-dev \
+    libayatana-appindicator3-dev \
+    librsvg2-dev \
+    libwebkit2gtk-4.1-dev \
+    libsoup-3.0-dev \
+    libjavascriptcoregtk-4.1-dev \
+    patchelf \
+    file \
+    nodejs \
+    npm \
+    python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
+
+RUN cargo install tauri-cli --version "^2.0" --locked
+
+WORKDIR /workspace
+
+CMD ["/bin/bash"]
+```
+
+- [ ] **Step 2: Create docker-compose.yml**
+
+Create `docker-compose.yml`:
+
+```yaml
+services:
+  build-linux:
+    build: .
+    container_name: kimiswitch-build-linux
+    volumes:
+      - .:/workspace
+      - cargo-cache:/usr/local/cargo/registry
+      - target-cache:/workspace/src-tauri/target
+    working_dir: /workspace
+
+volumes:
+  cargo-cache:
+  target-cache:
+```
+
+- [ ] **Step 3: Build the Docker image**
+
+Run: `docker compose build build-linux 2>&1 | tail -10`
+Expected: ends with `naming to docker.io/library/...build-linux  done` (or similar successful build output)
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add Dockerfile docker-compose.yml
+git commit -m "ci: add Linux Docker build environment"
+```
+
+---
+
+## Task 8: Build documentation
+
+**Files:**
+- Create: `docs/BUILD.md`
+
+**Interfaces:**
+- Audience: contributors who want to build the project locally
+- Output: instructions for Windows / macOS / Linux local builds + Docker Linux build
+
+- [ ] **Step 1: Write the doc**
+
+Create `docs/BUILD.md`:
+
+````markdown
+# Build
+
+Docker (Linux), native (any platform), and CI (multi-platform) build instructions.
+
+## Local builds by host
+
+### Windows (current primary dev environment)
+
+Prerequisites: Rust stable, Node 20, Microsoft C++ Build Tools, WebView2.
+
+```bash
+npm ci
+npm run tauri build -- --bundles msi
+```
+
+Output: `src-tauri/target/release/bundle/msi/`.
+
+### macOS
+
+Prerequisites: Xcode command-line tools, Rust stable, Node 20.
+
+```bash
+npm ci
+npm run tauri build -- --bundles app,dmg
+```
+
+Output: `src-tauri/target/release/bundle/{macos,dmg}/`.
+
+Unsigned: first launch requires right-click → Open to bypass Gatekeeper.
+
+### Linux (native)
+
+Prerequisites: see `Dockerfile` for the full apt-get list (webkit2gtk-4.1, librsvg2, etc.).
+
+```bash
+npm ci
+npm run tauri build -- --bundles deb,appimage,rpm
+```
+
+Output: `src-tauri/target/release/bundle/{deb,appimage,rpm}/`.
+
+### Linux via Docker (works on Windows / macOS too)
+
+```bash
+docker compose build build-linux
+docker compose run --rm build-linux bash -c '
+  npm ci &&
+  npm run tauri build -- --bundles deb,appimage,rpm
+'
+```
+
+Output is mounted back to `src-tauri/target/release/bundle/` on the host.
+
+## CI: GitHub Actions
+
+`.github/workflows/release.yml` runs on `git tag v* && git push origin v*`.
+
+1. `version-check` runs `scripts/check-version.sh` to ensure tag matches `package.json`, `Cargo.toml`, `tauri.conf.json`.
+2. Three parallel jobs build for `ubuntu-latest`, `macos-latest`, `windows-latest` using `tauri-action`.
+3. Artifacts are uploaded to the GitHub Release (auto-draft for non-prerelease tags).
+
+To cut a release:
+
+```bash
+# 1. Bump version in three places
+#    package.json:               "version": "0.7.0"
+#    src-tauri/Cargo.toml:       version = "0.7.0"
+#    src-tauri/tauri.conf.json:  "version": "0.7.0"
+# 2. Commit
+git commit -am "chore(release): bump to v0.7.0"
+# 3. Tag and push
+git tag v0.7.0
+git push origin v0.7.0
+```
+
+## Update checker asset selection
+
+`src-tauri/src/commands.rs::pick_asset_for_current_os` picks the right asset by file extension:
+
+| OS      | Extension  |
+|---------|------------|
+| Windows | `.msi`     |
+| macOS   | `.dmg`     |
+| Linux   | `.AppImage` (preferred; deb / rpm downloadable manually from the release page) |
+
+If the preferred extension is missing, the UI falls back to opening the release page.
+````
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add docs/BUILD.md
+git commit -m "docs: build instructions for all platforms + Docker + CI"
+```
+
+---
+
+## Task 9: README — multi-platform download links + workflow badge
+
+**Files:**
+- Modify: `README.md`
+- Modify: `README_EN.md`
+
+**Interfaces:**
+- Adds a "下载" / "Downloads" section with three platform bullets
+- Adds a build-from-source link to `docs/BUILD.md`
+- Adds a GitHub Actions badge
+
+- [ ] **Step 1: Add the badges (after the existing license badge)**
+
+In `README.md`, locate the line:
+
+```markdown
+[![License](https://img.shields.io/badge/license-MIT-green)](./LICENSE)
+```
+
+Add two new badges below it:
+
+```markdown
+[![Release](https://github.com/billowliu2/KimiSwitch/actions/workflows/release.yml/badge.svg)](https://github.com/billowliu2/KimiSwitch/releases/latest)
+```
+
+(Do the same in `README_EN.md`.)
+
+- [ ] **Step 2: Add a "下载" section right after "这是什么"**
+
+In `README.md`, after the paragraph immediately above `## 核心特性`, insert:
+
+```markdown
+## 下载
+
+- **Windows**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.msi`
+- **macOS**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.dmg`（**未签名** —— 首次启动请右键 → 打开绕过 Gatekeeper）
+- **Linux**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.deb` / `.AppImage` / `.rpm`
+
+历史版本（v0.5.x 及之前）请前往 [git.codingplan.site 仓库](https://git.codingplan.site/admin/KimiCodeSwitch/releases)。
+
+构建说明请见 [`docs/BUILD.md`](./docs/BUILD.md)。
+```
+
+In `README_EN.md`, insert the English equivalent:
+
+```markdown
+## Downloads
+
+- **Windows**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.msi`
+- **macOS**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.dmg` (**unsigned** — first launch needs right-click → Open to bypass Gatekeeper)
+- **Linux**: [GitHub Releases](https://github.com/billowliu2/KimiSwitch/releases/latest) → `.deb` / `.AppImage` / `.rpm`
+
+Historical versions (v0.5.x and earlier) live on the [git.codingplan.site repository](https://git.codingplan.site/admin/KimiCodeSwitch/releases).
+
+Build instructions: [`docs/BUILD.md`](./docs/BUILD.md).
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add README.md README_EN.md
+git commit -m "docs(readme): multi-platform downloads + workflow badge"
+```
+
+---
+
+## Task 10: End-to-end test with a pre-release tag
+
+**Files:**
+- (No file changes — pure verification)
+
+**Goal:** Confirm the GH Actions workflow actually produces all 6 assets. Use a pre-release tag so it doesn't pollute the main `v0.6.0` release.
+
+- [ ] **Step 1: Confirm current version is in sync**
+
+Run: `./scripts/check-version.sh v0.6.0`
+Expected: `OK: all versions = 0.6.0`
+
+- [ ] **Step 2: Push all un-pushed commits**
+
+```bash
+git push origin main
+git push origin --tags
+```
+
+- [ ] **Step 3: Tag a pre-release on the current commit**
+
+```bash
+git tag v0.6.0-rc1
+git push origin v0.6.0-rc1
+```
+
+- [ ] **Step 4: Watch the workflow run**
+
+Open: https://github.com/billowliu2/KimiSwitch/actions
+
+Expected: `version-check` job passes, then 3 `build` jobs run in parallel. Total time roughly 10-15 minutes per platform.
+
+- [ ] **Step 5: Verify the pre-release**
+
+Open: https://github.com/billowliu2/KimiSwitch/releases/tag/v0.6.0-rc1
+
+Expected: 6 assets attached (`.msi`, `.dmg`, `.app`, `.deb`, `.AppImage`, `.rpm`); release marked as "Pre-release".
+
+- [ ] **Step 6: Verify version mismatch fails the workflow**
+
+On a clean branch, change only `package.json` version to `0.9.0`, commit, then:
+
+```bash
+git tag v0.6.0-rc2
+git push origin v0.6.0-rc2
+```
+
+Open the new workflow run. Expected: `version-check` job fails with `FAIL: package.json = 0.9.0 (expected 0.6.0)`. Build jobs are skipped.
+
+Then revert the package.json change and delete the rc2 tag:
+
+```bash
+git checkout main -- package.json
+git tag -d v0.6.0-rc2
+git push origin :refs/tags/v0.6.0-rc2
+```
+
+- [ ] **Step 7: Clean up the rc1 tag**
+
+After verifying the rc1 assets are good, delete the pre-release to keep the release list clean:
+
+```bash
+git tag -d v0.6.0-rc1
+git push origin :refs/tags/v0.6.0-rc1
+# Then delete the GitHub Release via the web UI (or leave it as a historical rc)
+```
+
+- [ ] **Step 8: Final commit — none if Tasks 1-9 are clean**
+
+If no edits were needed, no commit. Otherwise, commit any fixups.
+
+---
+
+## Summary
+
+After all 10 tasks, the project ships with:
+- macOS + Linux + Windows builds produced from a single `git tag v0.7.0` push
+- Local Docker for Linux dev iteration
+- Per-platform asset picker in the update checker
+- README + BUILD docs covering all three platforms
+- Version-consistency gate preventing drift between tag and the three version files

docs/superpowers/specs/2026-07-29-multi-platform-packaging-design.md

@@ -0,0 +1,248 @@
+# Kimi Switch 多平台打包 — 设计
+
+**日期**：2026-07-29
+**状态**：待用户审查
+**关联 issue / 任务**：新增 macOS + Linux 打包支持（gh Actions 为主 + Docker 本地调 Linux）
+
+---
+
+## 1. 背景与目标
+
+Kimi Switch 是 Tauri 2.x 桌面配置管理器，目前仅支持 Windows MSI（`tauri.conf.json` 中 `bundle.targets: ["msi"]`）。本次改动让同一份代码可同时构建 Windows / macOS / Linux 三平台，整理出能在 GitHub Releases 上统一发布的工作流。
+
+成功标准：
+- `git tag v0.7.0 && git push origin v0.7.0` → GitHub Actions 自动产出 6 个资产（`.msi` + `.dmg` + `.app` + `.deb` + `.AppImage` + `.rpm`），全部挂到 v0.7.0 Release
+- 开发者本机 Windows + Docker 可本地调 Linux 三种格式
+- 应用内"检查更新"按 OS 自动选对应 asset 下载
+- 不回归现有 Windows 用户的体验
+
+## 2. 决策（已与用户确认）
+
+| 决策点 | 选定 |
+|--------|------|
+| 构建策略 | GH Actions 为主（tauri-action）+ Docker 本地调 Linux |
+| macOS 签名 | 不签名 / 跳过公证（用户在 README 中被告知右键 → 打开绕过 Gatekeeper） |
+| Linux 格式 | deb + AppImage + rpm（全部覆盖） |
+| Release 触发 | tag 推送触发 + tag / package.json / Cargo.toml / tauri.conf.json 四处版本一致性检查 |
+| Update checker | 按 OS + 扩展名自动选 asset（Windows: .msi，macOS: .dmg，Linux: .AppImage） |
+
+## 3. 架构
+
+### 3.1 发布流
+
+```
+git tag v0.7.0 && git push origin v0.7.0
+        │
+        ▼
+GH Actions: version-check job
+        │  (tag == package.json == Cargo.toml == tauri.conf.json ?)
+        ▼
+3 个并行 jobs 同时 build：
+  ubuntu-latest    → .deb / .AppImage / .rpm
+  macos-latest     → .app + .dmg（无签名）
+  windows-latest   → .msi
+        │
+        ▼
+tauri-action 自动收集 artifacts → 上传到 GitHub Release v0.7.0
+```
+
+### 3.2 本地调试流
+
+```
+Developer on Windows
+        │
+        ▼
+docker compose run --rm build-linux
+        │
+        ▼
+ubuntu 22.04 容器内
+  apt-get install webkit2gtk-4.1 librsvg2-dev
+  cargo install tauri-cli
+  npm ci && npm run build
+  cargo tauri build --bundles deb,appimage,rpm
+        │
+        ▼
+src-tauri/target/release/bundle/
+  ├── deb/KimiSwitch_0.7.0_amd64.deb
+  ├── appimage/KimiSwitch_0.7.0_amd64.AppImage
+  └── rpm/KimiSwitch-0.7.0-1.x86_64.rpm
+```
+
+### 3.3 用户更新流
+
+```
+App 启动 / 每 8h / 手动
+        │
+        ▼
+GET https://api.github.com/repos/billowliu2/KimiSwitch/releases?per_page=1
+        │
+        ▼
+解析 JSON，按 OS 过滤 assets
+        │
+        ▼
+? update_available → footer 弹提示
+        │
+        ▼
+用户点"下载" → 后端流式下载到 temp_dir()/KimiSwitch_update.<ext>
+        │
+        ▼
+open_installer(path) → 系统默认 handler 打开
+  Windows: 启动 MSI 安装
+  macOS:   挂载 .dmg，用户拖入 Applications
+  Linux:   AppImage 直接 chmod +x 跑；deb/rpm 走系统包管理器
+```
+
+## 4. 文件 / 代码变更
+
+### 4.1 新增
+
+| 路径 | 目的 |
+|------|------|
+| `.github/workflows/release.yml` | GH Actions 工作流（version-check + 3 平台矩阵） |
+| `Dockerfile` | Ubuntu 22.04 + webkit2gtk-4.1 + librsvg2 + cargo + node，构建工具链 |
+| `docker-compose.yml` | `docker compose run --rm build-linux` 一行起 |
+| `scripts/check-version.sh` | 校验 tag / package.json / Cargo.toml / tauri.conf.json 四处版本号一致 |
+| `docs/BUILD.md` | 本地 Docker 构建、平台差异、签名状态说明 |
+
+### 4.2 修改
+
+| 路径 | 改动 |
+|------|------|
+| `src-tauri/tauri.conf.json` | `bundle.targets: ["msi"]` → `"all"`；icon 列表追加 macOS 专用 `.icns`；加 `macOS.minimumSystemVersion: "10.15"` |
+| `src-tauri/src/main.rs` | `windows_subsystem = "windows"` 改为仅 Windows 启用（macOS / Linux 仍 console subsystem） |
+| `src-tauri/src/commands.rs` | `download_update` 临时文件名按 OS 走；`check_for_update` 按 OS 过滤 asset |
+| `README.md` | 三平台下载链接；Docker 调试一节；GH Actions 状态徽章 |
+| `README_EN.md` | 同上英文版 |
+
+### 4.3 核心 Rust 实现
+
+```rust
+// src-tauri/src/commands.rs
+
+/// Pick the GitHub release asset matching the current OS by file extension.
+/// Preference for Linux is AppImage (portable, no install). If the preferred
+/// extension is not present, returns None so the UI can fall back to
+/// "open release page" instead of guessing a less-preferred format.
+fn pick_asset_for_current_os(assets: &[serde_json::Value]) -> Option<String> {
+    let target_ext = match std::env::consts::OS {
+        "macos" => "dmg",
+        "linux" => "AppImage",
+        "windows" => "msi",
+        _ => return None,
+    };
+    assets.iter()
+        .find(|a| a.get("name").and_then(|n| n.as_str())
+             .map(|n| n.ends_with(target_ext)).unwrap_or(false))
+        .and_then(|a| a.get("browser_download_url"))
+        .and_then(|v| v.as_str())
+        .map(|s| s.to_string())
+}
+
+/// Build the platform-ext-specific temp filename for downloaded installer.
+fn update_temp_filename() -> String {
+    let ext = match std::env::consts::OS {
+        "macos" => "dmg",
+        "linux" => "AppImage",
+        "windows" => "msi",
+        _ => "bin",
+    };
+    format!("KimiSwitch_update.{ext}")
+}
+```
+
+`main.rs` 调整：
+
+```rust
+// 旧
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+// 新
+#![cfg_attr(
+    all(not(debug_assertions), target_os = "windows"),
+    windows_subsystem = "windows"
+)]
+```
+
+## 5. 错误处理
+
+| 场景 | 处理 |
+|------|------|
+| tag 与 Cargo.toml 版本不一致 | workflow 立即 fail，输出 diff；不进入 build |
+| GitHub Release 已有同名 asset | tauri-action 自动覆盖（默认行为） |
+| Linux runner 缺 webkit2gtk 等系统包 | tauri-action 文档明确会自动 `apt-get install`；失败 bubble up |
+| macOS 构建失败 | 失败 job 标红，其他平台不受影响；release 仍上传成功的资产 |
+| 用户端 update check 网络失败 | 静默失败（`useUpdateCheck.ts` 已有 try/catch） |
+| 本地 Docker 构建失败 | 多阶段 Dockerfile，失败 → 容器退出码 + 完整日志 |
+| macOS 未签名 .dmg 被 Gatekeeper 拦 | README 明确"右键 → 打开"绕过；远期可加签名（独立设计） |
+
+质量门：
+- `cargo check --target x86_64-unknown-linux-gnu`（Docker 内）
+- `npm run build`（前端）
+- 不引入新的 lint 失败
+- macOS unsigned 状态在 release body 里显式标注
+
+## 6. 测试验证
+
+### 6.1 本地构建验证
+
+1. **单测 / lint**
+   - `npm run lint`
+   - `cargo check`
+   - `cargo check --target x86_64-unknown-linux-gnu`（Docker 内）
+
+2. **本地 Docker Linux 构建**
+   - `docker compose build build-linux` → 容器构建成功
+   - `docker compose run --rm build-linux` → 产出 3 个 Linux 包
+   - `dpkg --info kimiswitch_0.7.0_amd64.deb` 确认 metadata
+   - `file kimiswitch_0.7.0_amd64.AppImage` 确认 ELF 可执行
+
+3. **Rust 单元测**
+   - `pick_asset_for_current_os`：
+     - `windows` + assets `[msi, dmg, AppImage]` → 选 msi
+     - `macos` + assets `[msi, dmg, AppImage]` → 选 dmg
+     - `linux` + assets `[msi, dmg, AppImage]` → 选 AppImage
+     - 都不匹配 → 返回 None
+
+### 6.2 GH Actions 端到端
+
+- 推 test tag `v0.6.0-rc1`（prerelease，**不污染正式 v0.6.0**）
+- 验证 3 个 jobs 都绿
+- 验证 assets 上传到 GitHub Release
+
+### 6.3 运行时手测（自动化跳过，仅文档化）
+
+- macOS: 挂载 .dmg，拖入 Applications；启动确认（首次会被 Gatekeeper 拦，文档说明）
+- Linux: AppImage `chmod +x && ./KimiSwitch_0.7.0_amd64.AppImage`；deb `sudo dpkg -i`；rpm `sudo rpm -i`
+- Windows: 已有 MSI 流程，不回归
+
+### 6.4 Update checker 联调
+
+- App 内"检查更新" → 后端 fetch GH releases → 按 OS 选对 asset → 下载正确文件
+- Linux 上 AppImage 装完后启动 app，update check 选 AppImage 而非其他格式
+
+### 6.5 验收
+
+- ✅ 三个平台都跑出可安装产物
+- ✅ GH Actions 总耗时 < 30 分钟
+- ✅ 版本不一致时 workflow 立即 fail
+- ✅ Update checker 跨平台行为正确
+- ✅ README 三平台下载链接齐全
+
+## 7. 范围外（本次不做）
+
+- macOS 代码签名 + notarization（用户已确认本期跳过；独立设计未来再加）
+- 自动更新检查替换为 Tauri 官方 `tauri-plugin-updater`（本期仍用自定义 `check_for_update`）
+- iOS / Android（已有 icon 资源，但本期不构建）
+- 自动 changelog 生成（用 commit log + 手动整理）
+- Linux 平台 snap / flatpak
+- Linux 32 位 / ARM 构建（先 x86_64 就够了）
+
+## 8. 风险与回退
+
+| 风险 | 缓解 |
+|------|------|
+| macOS unsigned 限制分发 | README 引导用户绕过；后续可补签名 |
+| GH Actions 30 分钟耗时不够 | 用 `tauri-action` 自带缓存；3 平台并行通常 10-15 分钟 |
+| Docker 镜像构建慢 | 用 prebuilt `tauri-apps/tauri:2-jammy` 风格基础镜像（自维护一份）；接下来 PR 可替换 |
+| 单元测 build 时间拖慢 | `pick_asset_for_current_os` 是纯函数，单测几百 ms；不会显著拖慢 CI |
+| 用户升级后旧版检查更新路径被破坏 | 新逻辑兼容旧 release（只有一个 msi asset 时返回 None，UI 显示"请手动下载"） |

scripts/check-version.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Verify that the version across the project matches the expected version.
+# Usage: check-version.sh <expected>
+# Reads:
+#   package.json                  : root
+#   src-tauri/Cargo.toml          : version field
+#   src-tauri/tauri.conf.json     : version field
+set -euo pipefail
+
+EXPECTED="${1:-}"
+
+if [ -z "$EXPECTED" ]; then
+  echo "usage: check-version.sh <expected>" >&2
+  exit 2
+fi
+
+# Strip leading 'v' for comparison (we expect semver without v)
+EXPECTED_BARE="${EXPECTED#v}"
+# Strip common prerelease suffixes (-rc1, -beta.2, -alpha.3, etc.) so a
+# v0.6.0-rc1 tag can reuse the existing 0.6.0 versions in the project files.
+# If the project does want a separate prerelease version, it must be
+# committed explicitly to the three version files.
+EXPECTED_BARE="${EXPECTED_BARE%%-*}"
+
+PKG_VERSION=$(node -p "require('./package.json').version")
+CARGO_VERSION=$(grep -E '^version\s*=' src-tauri/Cargo.toml | head -1 | sed -E 's/.*"([^"]+)".*/\1/')
+TAURI_VERSION=$(node -p "require('./src-tauri/tauri.conf.json').version")
+
+fail=0
+check() {
+  local label="$1"
+  local actual="$2"
+  if [ "$actual" != "$EXPECTED_BARE" ]; then
+    echo "FAIL: $label = $actual (expected $EXPECTED_BARE)" >&2
+    fail=1
+  fi
+}
+
+check "package.json"               "$PKG_VERSION"
+check "src-tauri/Cargo.toml"       "$CARGO_VERSION"
+check "src-tauri/tauri.conf.json"  "$TAURI_VERSION"
+
+if [ $fail -ne 0 ]; then
+  exit 1
+fi
+
+echo "OK: all versions = $EXPECTED_BARE"

src-tauri/src/commands.rs

@@ -740,9 +740,21 @@ fn version_lt(current: &str, latest: &str) -> bool {
 #[tauri::command]
 pub async fn check_for_update() -> Result<UpdateInfo, String> {
     let current = env!("CARGO_PKG_VERSION").to_string();
-    let url = "https://git.codingplan.site/api/v1/repos/admin/KimiCodeSwitch/releases?limit=1";
+    // GitHub Releases API for billowliu2/KimiSwitch. Historical versions
+    // (v0.5.x and earlier) live on git.codingplan.site and are not exposed
+    // here — only v0.6.0+ is published via GitHub.
+    let url = "https://api.github.com/repos/billowliu2/KimiSwitch/releases?per_page=1";
 
-    let resp = reqwest::get(url)
+    // GitHub returns 403 without a User-Agent header. Bundle the app version
+    // so the source is identifiable in any rate-limit / abuse reports.
+    let client = reqwest::Client::builder()
+        .user_agent(concat!("KimiSwitch/", env!("CARGO_PKG_VERSION")))
+        .build()
+        .map_err(|e| format!("client build failed: {e}"))?;
+
+    let resp = client
+        .get(url)
+        .send()
         .await
         .map_err(|e| format!("request failed: {e}"))?;
 
@@ -771,10 +783,7 @@ pub async fn check_for_update() -> Result<UpdateInfo, String> {
     let download_url = first
         .get("assets")
         .and_then(|a| a.as_array())
-        .and_then(|a| a.first())
+        .and_then(|a| pick_asset_for_current_os(a));
-        .and_then(|a| a.get("browser_download_url"))
-        .and_then(|v| v.as_str())
-        .map(|s| s.to_string());
 
     let update_available = version_lt(&current, &latest);
 
@@ -807,7 +816,7 @@ pub async fn download_update(
     let total = resp.content_length().unwrap_or(0);
 
     let temp_dir = std::env::temp_dir();
-    let file_path = temp_dir.join("KimiSwitch_update.msi");
+    let file_path = temp_dir.join(update_temp_filename());
 
     let mut file = std::fs::File::create(&file_path)
         .map_err(|e| format!("create temp file failed: {e}"))?;
@@ -856,4 +865,103 @@ pub fn open_installer(app: tauri::AppHandle, path: String) -> Result<(), String>
     app.opener()
         .open_path(&path, None::<&str>)
         .map_err(|e| e.to_string())
+}
+
+/// Pick the GitHub release asset matching the given OS by file extension.
+/// Preference for Linux is AppImage (portable, no install). If the preferred
+/// extension is not present, returns None so the UI can fall back to
+/// "open release page" instead of guessing a less-preferred format.
+fn pick_asset_for_os(assets: &[serde_json::Value], os: &str) -> Option<String> {
+    let target_ext = match os {
+        "macos" => "dmg",
+        "linux" => "AppImage",
+        "windows" => "msi",
+        _ => return None,
+    };
+    assets
+        .iter()
+        .find(|a| {
+            a.get("name")
+                .and_then(|n| n.as_str())
+                .map(|n| n.ends_with(target_ext))
+                .unwrap_or(false)
+        })
+        .and_then(|a| a.get("browser_download_url"))
+        .and_then(|v| v.as_str())
+        .map(|s| s.to_string())
+}
+
+/// Pick the GitHub release asset for the current OS (runtime target).
+fn pick_asset_for_current_os(assets: &[serde_json::Value]) -> Option<String> {
+    pick_asset_for_os(assets, std::env::consts::OS)
+}
+
+/// Build the platform-specific temp filename for the downloaded installer.
+fn update_temp_filename() -> String {
+    let ext = match std::env::consts::OS {
+        "macos" => "dmg",
+        "linux" => "AppImage",
+        "windows" => "msi",
+        _ => "bin",
+    };
+    format!("KimiSwitch_update.{ext}")
+}
+
+#[cfg(test)]
+mod asset_picker_tests {
+    use super::*;
+    use serde_json::json;
+
+    fn assets(names: &[&str]) -> Vec<serde_json::Value> {
+        names
+            .iter()
+            .map(|n| {
+                json!({
+                    "name": n,
+                    "browser_download_url": format!("https://example.com/{n}"),
+                })
+            })
+            .collect()
+    }
+
+    #[test]
+    fn windows_picks_msi() {
+        let assets = assets(&["KimiSwitch_0.7.0_x64_en-US.msi", "KimiSwitch_0.7.0_aarch64.dmg", "KimiSwitch_0.7.0_amd64.AppImage"]);
+        let url = pick_asset_for_os(&assets, "windows");
+        assert_eq!(url.as_deref(), Some("https://example.com/KimiSwitch_0.7.0_x64_en-US.msi"));
+    }
+
+    #[test]
+    fn macos_picks_dmg() {
+        let assets = assets(&["KimiSwitch_0.7.0_x64_en-US.msi", "KimiSwitch_0.7.0_aarch64.dmg", "KimiSwitch_0.7.0_amd64.AppImage"]);
+        let url = pick_asset_for_os(&assets, "macos");
+        assert_eq!(url.as_deref(), Some("https://example.com/KimiSwitch_0.7.0_aarch64.dmg"));
+    }
+
+    #[test]
+    fn linux_picks_appimage() {
+        let assets = assets(&["KimiSwitch_0.7.0_x64_en-US.msi", "KimiSwitch_0.7.0_aarch64.dmg", "KimiSwitch_0.7.0_amd64.AppImage"]);
+        let url = pick_asset_for_os(&assets, "linux");
+        assert_eq!(url.as_deref(), Some("https://example.com/KimiSwitch_0.7.0_amd64.AppImage"));
+    }
+
+    #[test]
+    fn missing_target_returns_none() {
+        let assets = assets(&["KimiSwitch_0.7.0_x64_en-US.msi"]);
+        let url = pick_asset_for_os(&assets, "macos");
+        assert_eq!(url, None);
+    }
+
+    #[test]
+    fn empty_assets_returns_none() {
+        let url = pick_asset_for_os(&[], "linux");
+        assert_eq!(url, None);
+    }
+
+    #[test]
+    fn unknown_os_returns_none() {
+        let assets = assets(&["KimiSwitch_0.7.0_x64_en-US.msi"]);
+        let url = pick_asset_for_os(&assets, "freebsd");
+        assert_eq!(url, None);
+    }
 }

src-tauri/src/main.rs

@@ -1,4 +1,7 @@
-#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+#![cfg_attr(
+    all(not(debug_assertions), target_os = "windows"),
+    windows_subsystem = "windows"
+)]
 
 fn main() {
     kimiswitch_lib::run();

src-tauri/tauri.conf.json

@@ -26,18 +26,30 @@
   },
   "bundle": {
     "active": true,
-    "targets": ["msi"],
+    "targets": "all",
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.ico",
+      "icons/icon.icns"
+    ],
     "windows": {
       "webviewInstallMode": {
         "type": "downloadBootstrapper"
       },
       "nsis": null
     },
-    "icon": [
+    "macOS": {
-      "icons/32x32.png",
+      "minimumSystemVersion": "10.15"
-      "icons/128x128.png",
+    },
-      "icons/128x128@2x.png",
+    "linux": {
-      "icons/icon.ico"
+      "deb": {
-    ]
+        "depends": []
+      },
+      "appimage": {
+        "bundleMediaFramework": false
+      }
+    }
   }
 }