Merge pull request #1014 from Jasonzhu1207/fix/Get-SecretKey

fix: Failed to retrieve secret key after WeChat login

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"                
+    schedule:
+      interval: "daily"           
+    target-branch: "dev"          

.github/scripts/release-utils.sh

@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+retry_cmd() {
+  local attempts="$1"
+  local delay_seconds="$2"
+  shift 2
+
+  local i
+  local exit_code
+  for ((i = 1; i <= attempts; i++)); do
+    if "$@"; then
+      return 0
+    fi
+    exit_code=$?
+    if [ "$i" -lt "$attempts" ]; then
+      echo "Command failed (attempt $i/$attempts, exit=$exit_code): $*" >&2
+      echo "Retrying in ${delay_seconds}s..." >&2
+      sleep "$delay_seconds"
+    fi
+  done
+
+  echo "Command failed after $attempts attempts: $*" >&2
+  return "$exit_code"
+}
+
+capture_cmd_with_retry() {
+  local result_var="$1"
+  local attempts="$2"
+  local delay_seconds="$3"
+  shift 3
+
+  local i
+  local output=""
+  local exit_code=1
+  for ((i = 1; i <= attempts; i++)); do
+    if output="$("$@" 2>/dev/null)"; then
+      printf -v "$result_var" "%s" "$output"
+      return 0
+    fi
+    exit_code=$?
+    if [ "$i" -lt "$attempts" ]; then
+      echo "Capture command failed (attempt $i/$attempts, exit=$exit_code): $*" >&2
+      echo "Retrying in ${delay_seconds}s..." >&2
+      sleep "$delay_seconds"
+    fi
+  done
+
+  echo "Capture command failed after $attempts attempts: $*" >&2
+  return "$exit_code"
+}
+
+wait_for_release_id() {
+  local repo="$1"
+  local tag="$2"
+  local attempts="${3:-12}"
+  local delay_seconds="${4:-2}"
+
+  local i
+  local release_id
+  local release_api_url
+  for ((i = 1; i <= attempts; i++)); do
+    release_id="$(gh api "repos/$repo/releases/tags/$tag" --jq '.id' 2>/dev/null || true)"
+    if [[ "$release_id" =~ ^[0-9]+$ ]]; then
+      echo "$release_id"
+      return 0
+    fi
+
+    release_id="$(gh release view "$tag" --repo "$repo" --json databaseId --jq '.databaseId // empty' 2>/dev/null || true)"
+    if [[ "$release_id" =~ ^[0-9]+$ ]]; then
+      echo "$release_id"
+      return 0
+    fi
+
+    release_api_url="$(gh release view "$tag" --repo "$repo" --json apiUrl --jq '.apiUrl // empty' 2>/dev/null || true)"
+    if [[ "$release_api_url" =~ /releases/([0-9]+)$ ]]; then
+      echo "${BASH_REMATCH[1]}"
+      return 0
+    fi
+
+    if [ "$i" -lt "$attempts" ]; then
+      echo "Release id for tag '$tag' is not ready yet (attempt $i/$attempts), retrying in ${delay_seconds}s..." >&2
+      sleep "$delay_seconds"
+    fi
+  done
+
+  echo "Unable to fetch release id for tag '$tag' after $attempts attempts." >&2
+  gh release view "$tag" --repo "$repo" --json databaseId,id,isDraft,isPrerelease,url 2>/dev/null || true
+  gh api "repos/$repo/releases/tags/$tag" --jq '{draft: .draft, prerelease: .prerelease, url: .html_url}' 2>/dev/null || true
+  return 1
+}
+
+settle_release_state() {
+  local repo="$1"
+  local release_id="$2"
+  local tag="$3"
+  local attempts="${4:-12}"
+  local delay_seconds="${5:-2}"
+  local endpoint="repos/$repo/releases/tags/$tag"
+
+  local i
+  local draft_state
+  local prerelease_state
+  for ((i = 1; i <= attempts; i++)); do
+    gh release edit "$tag" --repo "$repo" --draft=false --prerelease >/dev/null 2>&1 || true
+    gh api --method PATCH "repos/$repo/releases/$release_id" -F draft=false -F prerelease=true >/dev/null 2>&1 || true
+    draft_state="$(gh api "$endpoint" --jq '.draft' 2>/dev/null || gh release view "$tag" --repo "$repo" --json isDraft --jq '.isDraft' 2>/dev/null || echo true)"
+    prerelease_state="$(gh api "$endpoint" --jq '.prerelease' 2>/dev/null || gh release view "$tag" --repo "$repo" --json isPrerelease --jq '.isPrerelease' 2>/dev/null || echo false)"
+    if [ "$draft_state" = "false" ] && [ "$prerelease_state" = "true" ]; then
+      return 0
+    fi
+    if [ "$i" -lt "$attempts" ]; then
+      echo "Release '$tag' state not settled yet (attempt $i/$attempts), retrying in ${delay_seconds}s..." >&2
+      sleep "$delay_seconds"
+    fi
+  done
+
+  echo "Failed to settle release state for tag '$tag'." >&2
+  gh release view "$tag" --repo "$repo" --json isDraft,isPrerelease,url 2>/dev/null || true
+  gh api "$endpoint" --jq '{draft: .draft, prerelease: .prerelease, url: .html_url}' 2>/dev/null || true
+  return 1
+}
+
+print_release_state() {
+  local repo="$1"
+  local tag="$2"
+
+  gh api "repos/$repo/releases/tags/$tag" --jq '{isDraft: .draft, isPrerelease: .prerelease, url: .html_url}' 2>/dev/null \
+    || gh release view "$tag" --repo "$repo" --json isDraft,isPrerelease,url --jq '{isDraft: .isDraft, isPrerelease: .isPrerelease, url: .url}'
+}
+
+wait_for_release_absent() {
+  local repo="$1"
+  local tag="$2"
+  local attempts="${3:-12}"
+  local delay_seconds="${4:-2}"
+
+  local i
+  for ((i = 1; i <= attempts; i++)); do
+    if gh release view "$tag" --repo "$repo" >/dev/null 2>&1; then
+      if [ "$i" -lt "$attempts" ]; then
+        echo "Release '$tag' still exists (attempt $i/$attempts), waiting ${delay_seconds}s..." >&2
+        sleep "$delay_seconds"
+      fi
+      continue
+    fi
+    return 0
+  done
+
+  echo "Release '$tag' still exists after waiting." >&2
+  gh release view "$tag" --repo "$repo" --json url,isDraft,isPrerelease 2>/dev/null || true
+  return 1
+}
+
+wait_for_git_tag_absent() {
+  local repo="$1"
+  local tag="$2"
+  local attempts="${3:-12}"
+  local delay_seconds="${4:-2}"
+
+  local i
+  for ((i = 1; i <= attempts; i++)); do
+    if gh api "repos/$repo/git/ref/tags/$tag" >/dev/null 2>&1; then
+      if [ "$i" -lt "$attempts" ]; then
+        echo "Git tag '$tag' still exists (attempt $i/$attempts), waiting ${delay_seconds}s..." >&2
+        sleep "$delay_seconds"
+      fi
+      continue
+    fi
+    return 0
+  done
+
+  echo "Git tag '$tag' still exists after waiting." >&2
+  gh api "repos/$repo/git/ref/tags/$tag" --jq '{ref: .ref, object: .object.sha}' 2>/dev/null || true
+  return 1
+}
+
+recreate_fixed_prerelease() {
+  local repo="$1"
+  local tag="$2"
+  local target_branch="$3"
+  local release_title="$4"
+  local release_notes="$5"
+
+  if gh release view "$tag" --repo "$repo" >/dev/null 2>&1; then
+    retry_cmd 5 3 gh release delete "$tag" --repo "$repo" --yes --cleanup-tag
+  fi
+
+  wait_for_release_absent "$repo" "$tag" 12 2
+
+  if gh api "repos/$repo/git/ref/tags/$tag" >/dev/null 2>&1; then
+    retry_cmd 5 2 gh api --method DELETE "repos/$repo/git/refs/tags/$tag"
+  fi
+
+  wait_for_git_tag_absent "$repo" "$tag" 12 2
+
+  local created="false"
+  local i
+  for ((i = 1; i <= 6; i++)); do
+    if gh release create "$tag" --repo "$repo" --title "$release_title" --notes "$release_notes" --prerelease --target "$target_branch"; then
+      created="true"
+      break
+    fi
+    if gh release view "$tag" --repo "$repo" >/dev/null 2>&1; then
+      echo "Release '$tag' appears to exist after create failure; continue to settle state." >&2
+      created="true"
+      break
+    fi
+    if [ "$i" -lt 6 ]; then
+      echo "Create release '$tag' failed (attempt $i/6), retrying in 3s..." >&2
+      sleep 3
+    fi
+  done
+
+  if [ "$created" != "true" ]; then
+    echo "Failed to create release '$tag'." >&2
+    return 1
+  fi
+
+  local release_id
+  release_id="$(wait_for_release_id "$repo" "$tag" 12 2)"
+  settle_release_state "$repo" "$release_id" "$tag" 12 2
+}
+
+upload_release_assets_with_retry() {
+  local repo="$1"
+  local tag="$2"
+  shift 2
+
+  if [ "$#" -eq 0 ]; then
+    echo "No release assets provided for upload." >&2
+    return 1
+  fi
+
+  wait_for_release_id "$repo" "$tag" 12 2 >/dev/null
+  retry_cmd 5 3 gh release upload "$tag" "$@" --repo "$repo" --clobber
+}

.github/workflows/anti-spam.yml

@@ -0,0 +1,134 @@
+name: Anti-Spam
+
+on:
+  issues:
+    types: [opened, edited]
+
+permissions:
+  issues: write
+
+jobs:
+  check-spam:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for spam
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const issue = context.payload.issue;
+            const title = (issue.title || '').toLowerCase();
+            const body = (issue.body || '').toLowerCase();
+            const text = title + ' ' + body;
+
+            // 博彩/赌球类
+            const gamblingPatterns = [
+              /世界杯.*买球/, /买球.*世界杯/,
+              /世界杯.*下注/, /世界杯.*竞猜/,
+              /世界杯.*投注/, /世界杯.*押注/,
+              /世界杯.*彩票/, /世界杯.*平台/,
+              /世界杯.*app/, /世界杯.*软件/,
+              /世界杯.*网站/, /世界杯.*网址/,
+              /足球.*买球/, /买球.*足球/,
+              /足球.*投注/, /足球.*押注/,
+              /足球.*竞猜/, /足球.*平台/,
+              /篮球.*买球/, /篮球.*投注/,
+              /体育.*投注/, /体育.*竞猜/,
+              /体育.*买球/, /体育.*押注/,
+              /赌球/, /赌博.*网站/, /赌博.*平台/,
+              /博彩/, /博彩.*网站/, /博彩.*平台/,
+              /正规.*买球/, /官方.*买球/,
+              /买球.*网站/, /买球.*app/,
+              /买球.*软件/, /买球.*网址/,
+              /买球.*平台/, /买球.*技巧/,
+              /投注.*网站/, /投注.*平台/,
+              /押注.*网站/, /押注.*平台/,
+              /竞猜.*网站/, /竞猜.*平台/,
+              /彩票.*网站/, /彩票.*平台/,
+              /欧洲杯.*买球/, /欧冠.*买球/,
+              /nba.*买球/, /nba.*投注/,
+            ];
+
+            // 色情/交友类
+            const adultPatterns = [
+              /约炮/, /一夜情/, /外围/,
+              /包养/, /援交/, /陪聊/,
+              /成人.*网站/, /成人.*视频/,
+              /av.*网站/, /黄色.*网站/,
+            ];
+
+            // 贷款/金融诈骗类
+            const financePatterns = [
+              /秒到账.*贷款/, /无抵押.*贷款/,
+              /征信.*贷款/, /黑户.*贷款/,
+              /快速.*放款/, /私人.*放贷/,
+              /刷单/, /兼职.*日入/, /兼职.*月入/,
+              /网赚/, /躺赚/, /被动收入.*平台/,
+              /虚拟货币.*投资/, /usdt.*投资/,
+              /炒币.*平台/, /数字货币.*平台/,
+            ];
+
+            // 垃圾推广类
+            const spamPromoPatterns = [
+              /代刷/, /粉丝.*购买/, /涨粉/,
+              /seo.*优化/, /快速排名/,
+              /微商/, /代理.*招募/,
+            ];
+
+            // 账号特征检测（新账号 + 无 contribution）
+            const allPatterns = [
+              ...gamblingPatterns,
+              ...adultPatterns,
+              ...financePatterns,
+              ...spamPromoPatterns,
+            ];
+
+            const isSpam = allPatterns.some(pattern => pattern.test(text));
+
+            // 额外检测：标题超短且含可疑关键词（常见于批量刷单）
+            const suspiciousShort = title.length < 10 && /(买球|投注|博彩|赌博|下注|押注)/.test(title);
+
+            if (isSpam || suspiciousShort) {
+              // 确保 spam label 存在
+              try {
+                await github.rest.issues.createLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: 'spam',
+                  color: 'e4e669',
+                  description: 'Spam issue'
+                });
+              } catch (e) {
+                // label 已存在，忽略
+              }
+
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                body: '此 issue 已被自动识别为垃圾内容并关闭。\n\nThis issue has been automatically identified as spam and closed.'
+              });
+
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                labels: ['spam']
+              });
+
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                state: 'closed',
+                state_reason: 'not_planned'
+              });
+
+              await github.rest.issues.lock({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                lock_reason: 'spam'
+              });
+
+              console.log(`Closed spam issue #${issue.number}: ${issue.title}`);
+            }

.github/workflows/dev-daily-fixed.yml

@@ -0,0 +1,389 @@
+name: Dev Daily
+
+on:
+  schedule:
+    # GitHub Actions schedule uses UTC. 16:00 UTC = 北京时间次日 00:00
+    - cron: "0 16 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: dev-nightly-fixed-release
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  FIXED_DEV_TAG: nightly-dev
+  TARGET_BRANCH: dev
+  ELECTRON_BUILDER_BINARIES_MIRROR: https://github.com/electron-userland/electron-builder-binaries/releases/download/
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      dev_version: ${{ steps.meta.outputs.dev_version }}
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - name: Generate daily dev version
+        id: meta
+        shell: bash
+        run: |
+          set -euo pipefail
+          YEAR_2="$(TZ=Asia/Shanghai date +%y)"
+          MONTH="$(TZ=Asia/Shanghai date +%-m)"
+          DAY="$(TZ=Asia/Shanghai date +%-d)"
+          DEV_VERSION="${YEAR_2}.${MONTH}.${DAY}"
+          echo "dev_version=$DEV_VERSION" >> "$GITHUB_OUTPUT"
+          echo "Dev version: $DEV_VERSION"
+
+      - name: Recreate fixed prerelease
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          recreate_fixed_prerelease "$GITHUB_REPOSITORY" "$FIXED_DEV_TAG" "$TARGET_BRANCH" "Daily Dev Build" "开发版发布页"
+
+  dev-mac-arm64:
+    needs: prepare
+    runs-on: macos-14
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: "npm"
+      - name: Install Dependencies
+        run: npm install
+
+      - name: Ensure mac key helpers are executable
+        shell: bash
+        run: |
+          set -euo pipefail
+          for file in \
+            resources/key/macos/universal/xkey_helper \
+            resources/key/macos/universal/image_scan_helper \
+            resources/key/macos/universal/xkey_helper_macos \
+            resources/key/macos/universal/libwx_key.dylib
+          do
+            if [ -f "$file" ]; then
+              chmod +x "$file"
+              ls -l "$file"
+            fi
+          done
+
+      - name: Set dev version
+        shell: bash
+        run: npm version "${{ needs.prepare.outputs.dev_version }}" --no-git-tag-version --allow-same-version
+
+      - name: Build Frontend & Type Check
+        shell: bash
+        run: |
+          npx tsc
+          npx vite build
+
+      - name: Package macOS arm64 dev artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          export ELECTRON_BUILDER_BINARIES_MIRROR="https://github.com/electron-userland/electron-builder-binaries/releases/download/"
+          echo "Using ELECTRON_BUILDER_BINARIES_MIRROR=$ELECTRON_BUILDER_BINARIES_MIRROR"
+          if ! npx electron-builder --mac dmg zip --arm64 --publish never '--config.publish.channel=dev' '--config.artifactName=${productName}-dev-arm64.${ext}'; then
+            echo "::warning::DMG packaging failed (hdiutil instability on runner). Retrying with ZIP only."
+            npx electron-builder --mac zip --arm64 --publish never '--config.publish.channel=dev' '--config.artifactName=${productName}-dev-arm64.${ext}'
+          fi
+
+      - name: Upload macOS arm64 assets to fixed release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          assets=()
+          while IFS= read -r file; do
+            assets+=("$file")
+          done < <(find release -maxdepth 1 -type f | sort)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release files found in ./release"
+            exit 1
+          fi
+          upload_release_assets_with_retry "$GITHUB_REPOSITORY" "$FIXED_DEV_TAG" "${assets[@]}"
+
+  dev-linux:
+    needs: prepare
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: "npm"
+      - name: Install Dependencies
+        run: npm install
+
+      - name: Set dev version
+        shell: bash
+        run: npm version "${{ needs.prepare.outputs.dev_version }}" --no-git-tag-version --allow-same-version
+
+      - name: Build Frontend & Type Check
+        shell: bash
+        run: |
+          npx tsc
+          npx vite build
+
+      - name: Package Linux dev artifacts
+        run: |
+          npx electron-builder --linux --publish never '--config.publish.channel=dev' '--config.artifactName=${productName}-dev-linux.${ext}'
+
+      - name: Upload Linux assets to fixed release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          assets=()
+          while IFS= read -r file; do
+            assets+=("$file")
+          done < <(find release -maxdepth 1 -type f | sort)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release files found in ./release"
+            exit 1
+          fi
+          upload_release_assets_with_retry "$GITHUB_REPOSITORY" "$FIXED_DEV_TAG" "${assets[@]}"
+
+  dev-win-x64:
+    needs: prepare
+    runs-on: windows-latest
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: "npm"
+      - name: Install Dependencies
+        run: npm install
+
+      - name: Set dev version
+        shell: bash
+        run: npm version "${{ needs.prepare.outputs.dev_version }}" --no-git-tag-version --allow-same-version
+
+      - name: Build Frontend & Type Check
+        shell: bash
+        run: |
+          npx tsc
+          npx vite build
+
+      - name: Package Windows x64 dev artifacts
+        run: |
+          npx electron-builder --win nsis --x64 --publish never '--config.publish.channel=dev' '--config.artifactName=${productName}-dev-x64-Setup.${ext}'
+
+      - name: Upload Windows x64 assets to fixed release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          assets=()
+          while IFS= read -r file; do
+            assets+=("$file")
+          done < <(find release -maxdepth 1 -type f | sort)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release files found in ./release"
+            exit 1
+          fi
+          upload_release_assets_with_retry "$GITHUB_REPOSITORY" "$FIXED_DEV_TAG" "${assets[@]}"
+
+  dev-win-arm64:
+    needs: prepare
+    runs-on: windows-latest
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: "npm"
+      - name: Install Dependencies
+        run: npm install
+
+      - name: Set dev version
+        shell: bash
+        run: npm version "${{ needs.prepare.outputs.dev_version }}" --no-git-tag-version --allow-same-version
+
+      - name: Build Frontend & Type Check
+        shell: bash
+        run: |
+          npx tsc
+          npx vite build
+
+      - name: Package Windows arm64 dev artifacts
+        run: |
+          npx electron-builder --win nsis --arm64 --publish never '--config.publish.channel=dev-arm64' '--config.artifactName=${productName}-dev-arm64-Setup.${ext}'
+
+      - name: Upload Windows arm64 assets to fixed release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          assets=()
+          while IFS= read -r file; do
+            assets+=("$file")
+          done < <(find release -maxdepth 1 -type f | sort)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release files found in ./release"
+            exit 1
+          fi
+          upload_release_assets_with_retry "$GITHUB_REPOSITORY" "$FIXED_DEV_TAG" "${assets[@]}"
+
+  update-dev-release-notes:
+    needs:
+      - prepare
+      - dev-mac-arm64
+      - dev-linux
+      - dev-win-x64
+      - dev-win-arm64
+    if: always() && needs.prepare.result == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 1
+
+      - name: Update fixed dev release notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          TAG="${FIXED_DEV_TAG:-}"
+          if [ -z "$TAG" ]; then
+            echo "FIXED_DEV_TAG is empty, abort."
+            exit 1
+          fi
+          REPO="$GITHUB_REPOSITORY"
+          RELEASE_PAGE="https://github.com/$REPO/releases/tag/$TAG"
+          echo "Using release tag: $TAG"
+
+          if ! gh api "repos/$REPO/releases/tags/$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG not found, skip notes update."
+            exit 0
+          fi
+
+          ASSETS_JSON="$(gh api "repos/$REPO/releases/tags/$TAG")"
+
+          pick_asset() {
+            local pattern="$1"
+            echo "$ASSETS_JSON" | jq -r --arg p "$pattern" '[.assets[].name | select(test($p))][0] // ""'
+          }
+
+          WINDOWS_ASSET="$(pick_asset "dev-x64-Setup[.]exe$")"
+          WINDOWS_ARM64_ASSET="$(pick_asset "dev-arm64-Setup[.]exe$")"
+          MAC_ASSET="$(pick_asset "dev-arm64[.]dmg$")"
+          if [ -z "$MAC_ASSET" ]; then
+            MAC_ASSET="$(pick_asset "dev-arm64[.]zip$")"
+          fi
+          LINUX_TAR_ASSET="$(pick_asset "dev-linux[.]tar[.]gz$")"
+          LINUX_APPIMAGE_ASSET="$(pick_asset "dev-linux[.]AppImage$")"
+
+          build_link() {
+            local name="$1"
+            if [ -n "$name" ]; then
+              echo "https://github.com/$REPO/releases/download/$TAG/$name"
+            fi
+          }
+
+          WINDOWS_URL="$(build_link "$WINDOWS_ASSET")"
+          WINDOWS_ARM64_URL="$(build_link "$WINDOWS_ARM64_ASSET")"
+          MAC_URL="$(build_link "$MAC_ASSET")"
+          LINUX_TAR_URL="$(build_link "$LINUX_TAR_ASSET")"
+          LINUX_APPIMAGE_URL="$(build_link "$LINUX_APPIMAGE_ASSET")"
+
+          cat > dev_release_notes.md <<EOF
+          ## Daily Dev Build
+          - 该发布页为 **开发版**。
+          - 当前构建版本：\`${{ needs.prepare.outputs.dev_version }}\`
+          - 此版本为每日构建的开发版，包含最新的功能和修复，但可能不够稳定，仅推荐用于测试和验证。
+
+          ## 下载
+          - Windows x64: [点击下载](${WINDOWS_URL:-$RELEASE_PAGE})
+          - Windows arm64: [点击下载](${WINDOWS_ARM64_URL:-$RELEASE_PAGE})
+          - macOS（Apple Silicon）: [点击下载](${MAC_URL:-$RELEASE_PAGE})
+          - Linux (.tar.gz): [点击下载](${LINUX_TAR_URL:-$RELEASE_PAGE})
+          - Linux (.AppImage): [点击下载](${LINUX_APPIMAGE_URL:-$RELEASE_PAGE})
+
+          ## macOS 安装提示
+          - 如果被系统提示已损坏，你需要在终端执行以下命令去除隔离标记：
+          - \`xattr -dr com.apple.quarantine "/Applications/WeFlow.app"\`
+          - 执行后重新打开 WeFlow。
+
+          ## 说明
+          - 该发布页的同名资源会被后续构建覆盖，请勿将其视作长期归档版本。
+          - 如某个平台资源暂未生成，请进入[发布页]($RELEASE_PAGE)查看最新状态
+          EOF
+
+          update_release_notes() {
+            local attempts=5
+            local delay_seconds=2
+            local i
+            for ((i=1; i<=attempts; i++)); do
+              if gh release edit "$TAG" --repo "$REPO" --title "Daily Dev Build" --notes-file dev_release_notes.md --prerelease >/dev/null 2>&1; then
+                return 0
+              fi
+              if [ "$i" -lt "$attempts" ]; then
+                echo "Release update failed (attempt $i/$attempts), retry in ${delay_seconds}s..."
+                sleep "$delay_seconds"
+              fi
+            done
+            return 1
+          }
+
+          update_release_notes
+          source .github/scripts/release-utils.sh
+          RELEASE_REST_ID="$(wait_for_release_id "$REPO" "$TAG" 12 2)"
+          settle_release_state "$REPO" "$RELEASE_REST_ID" "$TAG" 12 2
+          print_release_state "$REPO" "$TAG"

.github/workflows/preview-nightly-main.yml

@@ -0,0 +1,432 @@
+name: Preview Nightly
+
+on:
+  schedule:
+    # GitHub Actions schedule uses UTC. 16:00 UTC = 北京时间次日 00:00
+    - cron: "0 16 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: preview-nightly-fixed-release
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  FIXED_PREVIEW_TAG: nightly-preview
+  TARGET_BRANCH: main
+  ELECTRON_BUILDER_BINARIES_MIRROR: https://github.com/electron-userland/electron-builder-binaries/releases/download/
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      should_build: ${{ steps.meta.outputs.should_build }}
+      preview_version: ${{ steps.meta.outputs.preview_version }}
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - name: Decide whether to build and generate preview version
+        id: meta
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          git fetch origin main --depth=1
+          COMMITS_24H="$(git rev-list --count --since='24 hours ago' origin/main)"
+
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            SHOULD_BUILD=true
+          elif [ "$COMMITS_24H" -gt 0 ]; then
+            SHOULD_BUILD=true
+          else
+            SHOULD_BUILD=false
+          fi
+
+          YEAR_2="$(TZ=Asia/Shanghai date +%y)"
+          YEARLY_RUN_COUNT=1
+          LAST_VERSION="$(gh release view "$FIXED_PREVIEW_TAG" --repo "$GITHUB_REPOSITORY" --json body --jq '.body' 2>/dev/null | grep -Eo '0\.[0-9]{2}\.[0-9]+' | head -n 1 || true)"
+          if [[ "$LAST_VERSION" =~ ^0\.([0-9]{2})\.([0-9]+)$ ]]; then
+            LAST_YEAR="${BASH_REMATCH[1]}"
+            LAST_COUNT="${BASH_REMATCH[2]}"
+            if [ "$LAST_YEAR" = "$YEAR_2" ]; then
+              YEARLY_RUN_COUNT=$((LAST_COUNT + 1))
+            fi
+          fi
+
+          PREVIEW_VERSION="0.${YEAR_2}.${YEARLY_RUN_COUNT}"
+
+          echo "should_build=$SHOULD_BUILD" >> "$GITHUB_OUTPUT"
+          echo "preview_version=$PREVIEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "Preview version: $PREVIEW_VERSION (commits in last 24h on main: $COMMITS_24H, yearly count: $YEARLY_RUN_COUNT)"
+
+      - name: Recreate fixed preview prerelease
+        if: steps.meta.outputs.should_build == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          recreate_fixed_prerelease "$GITHUB_REPOSITORY" "$FIXED_PREVIEW_TAG" "$TARGET_BRANCH" "Preview Nightly Build" "预览版发布页"
+
+  preview-mac-arm64:
+    needs: prepare
+    if: needs.prepare.outputs.should_build == 'true'
+    runs-on: macos-14
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: "npm"
+      - name: Install Dependencies
+        run: npm install
+
+      - name: Ensure mac key helpers are executable
+        shell: bash
+        run: |
+          set -euo pipefail
+          for file in \
+            resources/key/macos/universal/xkey_helper \
+            resources/key/macos/universal/image_scan_helper \
+            resources/key/macos/universal/xkey_helper_macos \
+            resources/key/macos/universal/libwx_key.dylib
+          do
+            if [ -f "$file" ]; then
+              chmod +x "$file"
+              ls -l "$file"
+            fi
+          done
+
+      - name: Set preview version
+        shell: bash
+        run: npm version "${{ needs.prepare.outputs.preview_version }}" --no-git-tag-version --allow-same-version
+
+      - name: Build Frontend & Type Check
+        shell: bash
+        run: |
+          npx tsc
+          npx vite build
+
+      - name: Package macOS arm64 preview artifacts
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: "false"
+        shell: bash
+        run: |
+          set -euo pipefail
+          export ELECTRON_BUILDER_BINARIES_MIRROR="https://github.com/electron-userland/electron-builder-binaries/releases/download/"
+          echo "Using ELECTRON_BUILDER_BINARIES_MIRROR=$ELECTRON_BUILDER_BINARIES_MIRROR"
+          if ! npx electron-builder --mac dmg zip --arm64 --publish never '--config.publish.channel=preview' '--config.artifactName=${productName}-preview-arm64.${ext}'; then
+            echo "::warning::DMG packaging failed (hdiutil instability on runner). Retrying with ZIP only."
+            npx electron-builder --mac zip --arm64 --publish never '--config.publish.channel=preview' '--config.artifactName=${productName}-preview-arm64.${ext}'
+          fi
+
+      - name: Upload macOS arm64 assets to fixed preview release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          assets=()
+          while IFS= read -r file; do
+            assets+=("$file")
+          done < <(find release -maxdepth 1 -type f | sort)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release files found in ./release"
+            exit 1
+          fi
+          upload_release_assets_with_retry "$GITHUB_REPOSITORY" "$FIXED_PREVIEW_TAG" "${assets[@]}"
+
+  preview-linux:
+    needs: prepare
+    if: needs.prepare.outputs.should_build == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: "npm"
+      - name: Install Dependencies
+        run: npm install
+
+      - name: Set preview version
+        shell: bash
+        run: npm version "${{ needs.prepare.outputs.preview_version }}" --no-git-tag-version --allow-same-version
+
+      - name: Build Frontend & Type Check
+        shell: bash
+        run: |
+          npx tsc
+          npx vite build
+
+      - name: Package Linux preview artifacts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          npx electron-builder --linux --publish never '--config.publish.channel=preview' '--config.artifactName=${productName}-preview-linux.${ext}'
+
+      - name: Upload Linux assets to fixed preview release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          assets=()
+          while IFS= read -r file; do
+            assets+=("$file")
+          done < <(find release -maxdepth 1 -type f | sort)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release files found in ./release"
+            exit 1
+          fi
+          upload_release_assets_with_retry "$GITHUB_REPOSITORY" "$FIXED_PREVIEW_TAG" "${assets[@]}"
+
+  preview-win-x64:
+    needs: prepare
+    if: needs.prepare.outputs.should_build == 'true'
+    runs-on: windows-latest
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: "npm"
+      - name: Install Dependencies
+        run: npm install
+
+      - name: Set preview version
+        shell: bash
+        run: npm version "${{ needs.prepare.outputs.preview_version }}" --no-git-tag-version --allow-same-version
+
+      - name: Build Frontend & Type Check
+        shell: bash
+        run: |
+          npx tsc
+          npx vite build
+
+      - name: Package Windows x64 preview artifacts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          npx electron-builder --win nsis --x64 --publish never '--config.publish.channel=preview' '--config.artifactName=${productName}-preview-x64-Setup.${ext}'
+
+      - name: Upload Windows x64 assets to fixed preview release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          assets=()
+          while IFS= read -r file; do
+            assets+=("$file")
+          done < <(find release -maxdepth 1 -type f | sort)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release files found in ./release"
+            exit 1
+          fi
+          upload_release_assets_with_retry "$GITHUB_REPOSITORY" "$FIXED_PREVIEW_TAG" "${assets[@]}"
+
+  preview-win-arm64:
+    needs: prepare
+    if: needs.prepare.outputs.should_build == 'true'
+    runs-on: windows-latest
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: "npm"
+      - name: Install Dependencies
+        run: npm install
+
+      - name: Set preview version
+        shell: bash
+        run: npm version "${{ needs.prepare.outputs.preview_version }}" --no-git-tag-version --allow-same-version
+
+      - name: Build Frontend & Type Check
+        shell: bash
+        run: |
+          npx tsc
+          npx vite build
+
+      - name: Package Windows arm64 preview artifacts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          npx electron-builder --win nsis --arm64 --publish never '--config.publish.channel=preview-arm64' '--config.artifactName=${productName}-preview-arm64-Setup.${ext}'
+
+      - name: Upload Windows arm64 assets to fixed preview release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          assets=()
+          while IFS= read -r file; do
+            assets+=("$file")
+          done < <(find release -maxdepth 1 -type f | sort)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release files found in ./release"
+            exit 1
+          fi
+          upload_release_assets_with_retry "$GITHUB_REPOSITORY" "$FIXED_PREVIEW_TAG" "${assets[@]}"
+
+  update-preview-release-notes:
+    needs:
+      - prepare
+      - preview-mac-arm64
+      - preview-linux
+      - preview-win-x64
+      - preview-win-arm64
+    if: needs.prepare.outputs.should_build == 'true' && always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ env.TARGET_BRANCH }}
+          fetch-depth: 1
+
+      - name: Update preview release notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          TAG="${FIXED_PREVIEW_TAG:-}"
+          if [ -z "$TAG" ]; then
+            echo "FIXED_PREVIEW_TAG is empty, abort."
+            exit 1
+          fi
+          CURRENT_PREVIEW_VERSION="${{ needs.prepare.outputs.preview_version }}"
+          REPO="$GITHUB_REPOSITORY"
+          RELEASE_PAGE="https://github.com/$REPO/releases/tag/$TAG"
+          echo "Using release tag: $TAG"
+
+          if ! gh api "repos/$REPO/releases/tags/$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG not found (possibly all publish jobs failed), skip notes update."
+            exit 0
+          fi
+
+          ASSETS_JSON="$(gh api "repos/$REPO/releases/tags/$TAG")"
+
+          pick_asset() {
+            local pattern="$1"
+            echo "$ASSETS_JSON" | jq -r --arg p "$pattern" '[.assets[].name | select(test($p))][0] // ""'
+          }
+
+          WINDOWS_ASSET="$(pick_asset "x64.*[.]exe$")"
+          if [ -z "$WINDOWS_ASSET" ]; then
+            WINDOWS_ASSET="$(echo "$ASSETS_JSON" | jq -r '[.assets[].name | select(test("[.]exe$")) | select(test("arm64") | not)][0] // ""')"
+          fi
+          WINDOWS_ARM64_ASSET="$(pick_asset "arm64.*[.]exe$")"
+          MAC_ASSET="$(pick_asset "[.]dmg$")"
+          if [ -z "$MAC_ASSET" ]; then
+            MAC_ASSET="$(pick_asset "[.]zip$")"
+          fi
+          LINUX_TAR_ASSET="$(pick_asset "[.]tar[.]gz$")"
+          LINUX_APPIMAGE_ASSET="$(pick_asset "[.]AppImage$")"
+
+          build_link() {
+            local name="$1"
+            if [ -n "$name" ]; then
+              echo "https://github.com/$REPO/releases/download/$TAG/$name"
+            fi
+          }
+
+          WINDOWS_URL="$(build_link "$WINDOWS_ASSET")"
+          WINDOWS_ARM64_URL="$(build_link "$WINDOWS_ARM64_ASSET")"
+          MAC_URL="$(build_link "$MAC_ASSET")"
+          LINUX_TAR_URL="$(build_link "$LINUX_TAR_ASSET")"
+          LINUX_APPIMAGE_URL="$(build_link "$LINUX_APPIMAGE_ASSET")"
+
+          cat > preview_release_notes.md <<EOF
+          ## Preview Nightly 说明
+          - 该版本为 **预览版**，用于提前体验即将发布的功能与修复。
+          - 可能包含尚未完全稳定的改动，不建议长期使用
+          - 当前版本号：\`$CURRENT_PREVIEW_VERSION\`
+
+          ## 下载
+          - Windows x64: [点击下载](${WINDOWS_URL:-$RELEASE_PAGE})
+          - Windows arm64: [点击下载](${WINDOWS_ARM64_URL:-$RELEASE_PAGE})
+          - macOS（Apple Silicon）: [点击下载](${MAC_URL:-$RELEASE_PAGE})
+          - Linux (.tar.gz): [点击下载](${LINUX_TAR_URL:-$RELEASE_PAGE})
+          - Linux (.AppImage): [点击下载](${LINUX_APPIMAGE_URL:-$RELEASE_PAGE})
+
+          ## macOS 安装提示
+          - 如果被系统提示已损坏，你需要在终端执行以下命令去除隔离标记：
+          - \`xattr -dr com.apple.quarantine "/Applications/WeFlow.app"\`
+          - 执行后重新打开 WeFlow。
+
+          > 如某个平台链接暂未生成，请前往[发布页]($RELEASE_PAGE)查看最新资源
+          EOF
+
+          update_release_notes() {
+            local attempts=5
+            local delay_seconds=2
+            local i
+            for ((i=1; i<=attempts; i++)); do
+              if gh release edit "$TAG" --repo "$REPO" --title "Preview Nightly Build" --notes-file preview_release_notes.md --prerelease >/dev/null 2>&1; then
+                return 0
+              fi
+              if [ "$i" -lt "$attempts" ]; then
+                echo "Release update failed (attempt $i/$attempts), retry in ${delay_seconds}s..."
+                sleep "$delay_seconds"
+              fi
+            done
+            return 1
+          }
+
+          update_release_notes
+          source .github/scripts/release-utils.sh
+          RELEASE_REST_ID="$(wait_for_release_id "$REPO" "$TAG" 12 2)"
+          settle_release_state "$REPO" "$RELEASE_REST_ID" "$TAG" 12 2
+          print_release_state "$REPO" "$TAG"

.github/workflows/release.yml

@@ -10,6 +10,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  ELECTRON_BUILDER_BINARIES_MIRROR: https://github.com/electron-userland/electron-builder-binaries/releases/download/
 
 jobs:
   release-mac-arm64:
@@ -26,28 +27,73 @@ jobs:
         with:
           node-version: 24
           cache: "npm"
-
       - name: Install Dependencies
-        run: npm install
+        run: npm install --ignore-scripts
+
+      - name: Ensure mac key helpers are executable
+        shell: bash
+        run: |
+          set -euo pipefail
+          for file in \
+            resources/key/macos/universal/xkey_helper \
+            resources/key/macos/universal/image_scan_helper \
+            resources/key/macos/universal/xkey_helper_macos \
+            resources/key/macos/universal/libwx_key.dylib
+          do
+            if [ -f "$file" ]; then
+              chmod +x "$file"
+              ls -l "$file"
+            fi
+          done
 
       - name: Sync version with tag
         shell: bash
         run: |
           VERSION=${GITHUB_REF_NAME#v}
           echo "Syncing package.json version to $VERSION"
-          npm version $VERSION --no-git-tag-version --allow-same-version
+          node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.version='$VERSION';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n')"
 
       - name: Build Frontend & Type Check
+        shell: bash
         run: |
           npx tsc
           npx vite build
 
-      - name: Package and Publish macOS arm64 (unsigned DMG)
+      - name: Package and Publish macOS arm64 (unsigned DMG + ZIP)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
+        shell: bash
         run: |
-          npx electron-builder --mac dmg --arm64 --publish always
+          set -euo pipefail
+          export ELECTRON_BUILDER_BINARIES_MIRROR="https://github.com/electron-userland/electron-builder-binaries/releases/download/"
+          echo "Using ELECTRON_BUILDER_BINARIES_MIRROR=$ELECTRON_BUILDER_BINARIES_MIRROR"
+          if ! npx electron-builder --mac dmg zip --arm64 --publish always '--config.npmRebuild=false' '--config.publish.owner=${{ github.repository_owner }}' '--config.publish.repo=${{ github.event.repository.name }}'; then
+            echo "::warning::DMG packaging failed (hdiutil instability on runner). Retrying with ZIP only."
+            npx electron-builder --mac zip --arm64 --publish always '--config.npmRebuild=false' '--config.publish.owner=${{ github.repository_owner }}' '--config.publish.repo=${{ github.event.repository.name }}'
+          fi
+
+      - name: Inject minimumVersion into latest yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          TAG=${GITHUB_REF_NAME}
+          REPO=${{ github.repository }}
+          MINIMUM_VERSION="4.1.7"
+          wait_for_release_id "$REPO" "$TAG" 12 2 >/dev/null
+          for YML_FILE in latest-mac.yml latest-arm64-mac.yml; do
+            if ! retry_cmd 5 3 gh release download "$TAG" --repo "$REPO" --pattern "$YML_FILE" --output "/tmp/$YML_FILE"; then
+              echo "Skip $YML_FILE because download failed after retries."
+              continue
+            fi
+            if ! grep -q 'minimumVersion' "/tmp/$YML_FILE"; then
+              echo "minimumVersion: $MINIMUM_VERSION" >> "/tmp/$YML_FILE"
+            fi
+            retry_cmd 5 3 gh release upload "$TAG" --repo "$REPO" "/tmp/$YML_FILE" --clobber
+          done
 
   release-linux:
     runs-on: ubuntu-latest
@@ -63,18 +109,23 @@ jobs:
         with:
           node-version: 24
           cache: "npm"
-
       - name: Install Dependencies
         run: npm install
 
+      - name: Ensure linux key helper is executable
+        shell: bash
+        run: |
+          [ -f "resources/key/linux/x64/xkey_helper" ] && chmod +x "resources/key/linux/x64/xkey_helper" || echo "File not found"
+
       - name: Sync version with tag
         shell: bash
         run: |
           VERSION=${GITHUB_REF_NAME#v}
           echo "Syncing package.json version to $VERSION"
-          npm version $VERSION --no-git-tag-version --allow-same-version
+          node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.version='$VERSION';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n')"
 
       - name: Build Frontend & Type Check
+        shell: bash
         run: |
           npx tsc
           npx vite build
@@ -83,7 +134,24 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          npx electron-builder --linux --publish always
+          npx electron-builder --linux --publish always '--config.publish.owner=${{ github.repository_owner }}' '--config.publish.repo=${{ github.event.repository.name }}'
+
+      - name: Inject minimumVersion into latest yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          TAG=${GITHUB_REF_NAME}
+          REPO=${{ github.repository }}
+          MINIMUM_VERSION="4.1.7"
+          wait_for_release_id "$REPO" "$TAG" 12 2 >/dev/null
+          retry_cmd 5 3 gh release download "$TAG" --repo "$REPO" --pattern "latest-linux.yml" --output "/tmp/latest-linux.yml" || true
+          if [ -f /tmp/latest-linux.yml ] && ! grep -q 'minimumVersion' /tmp/latest-linux.yml; then
+            echo "minimumVersion: $MINIMUM_VERSION" >> /tmp/latest-linux.yml
+            retry_cmd 5 3 gh release upload "$TAG" --repo "$REPO" /tmp/latest-linux.yml --clobber
+          fi
 
   release:
     runs-on: windows-latest
@@ -99,7 +167,6 @@ jobs:
         with:
           node-version: 24
           cache: 'npm'
-
       - name: Install Dependencies
         run: npm install
 
@@ -108,9 +175,10 @@ jobs:
         run: |
           VERSION=${GITHUB_REF_NAME#v}
           echo "Syncing package.json version to $VERSION"
-          npm version $VERSION --no-git-tag-version --allow-same-version
+          node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.version='$VERSION';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n')"
 
       - name: Build Frontend & Type Check
+        shell: bash
         run: |
           npx tsc
           npx vite build
@@ -119,7 +187,24 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          npx electron-builder --win nsis --x64 --publish always '--config.artifactName=${productName}-${version}-x64-Setup.${ext}'
+          npx electron-builder --win nsis --x64 --publish always '--config.publish.owner=${{ github.repository_owner }}' '--config.publish.repo=${{ github.event.repository.name }}' '--config.artifactName=${productName}-${version}-x64-Setup.${ext}'
+
+      - name: Inject minimumVersion into latest yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          TAG=${GITHUB_REF_NAME}
+          REPO=${{ github.repository }}
+          MINIMUM_VERSION="4.1.7"
+          wait_for_release_id "$REPO" "$TAG" 12 2 >/dev/null
+          retry_cmd 5 3 gh release download "$TAG" --repo "$REPO" --pattern "latest.yml" --output "/tmp/latest.yml" || true
+          if [ -f /tmp/latest.yml ] && ! grep -q 'minimumVersion' /tmp/latest.yml; then
+            echo "minimumVersion: $MINIMUM_VERSION" >> /tmp/latest.yml
+            retry_cmd 5 3 gh release upload "$TAG" --repo "$REPO" /tmp/latest.yml --clobber
+          fi
 
   release-windows-arm64:
     runs-on: windows-latest
@@ -135,7 +220,6 @@ jobs:
         with:
           node-version: 24
           cache: 'npm'
-
       - name: Install Dependencies
         run: npm install
 
@@ -144,9 +228,10 @@ jobs:
         run: |
           VERSION=${GITHUB_REF_NAME#v}
           echo "Syncing package.json version to $VERSION"
-          npm version $VERSION --no-git-tag-version --allow-same-version
+          node -e "const fs=require('fs');const p=JSON.parse(fs.readFileSync('package.json','utf8'));p.version='$VERSION';fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n')"
 
       - name: Build Frontend & Type Check
+        shell: bash
         run: |
           npx tsc
           npx vite build
@@ -155,7 +240,24 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          npx electron-builder --win nsis --arm64 --publish always '--config.publish.channel=latest-arm64' '--config.artifactName=${productName}-${version}-arm64-Setup.${ext}'
+          npx electron-builder --win nsis --arm64 --publish always '--config.publish.owner=${{ github.repository_owner }}' '--config.publish.repo=${{ github.event.repository.name }}' '--config.publish.channel=latest-arm64' '--config.artifactName=${productName}-${version}-arm64-Setup.${ext}'
+
+      - name: Inject minimumVersion into latest yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .github/scripts/release-utils.sh
+          TAG=${GITHUB_REF_NAME}
+          REPO=${{ github.repository }}
+          MINIMUM_VERSION="4.1.7"
+          wait_for_release_id "$REPO" "$TAG" 12 2 >/dev/null
+          retry_cmd 5 3 gh release download "$TAG" --repo "$REPO" --pattern "latest-arm64.yml" --output "/tmp/latest-arm64.yml" || true
+          if [ -f /tmp/latest-arm64.yml ] && ! grep -q 'minimumVersion' /tmp/latest-arm64.yml; then
+            echo "minimumVersion: $MINIMUM_VERSION" >> /tmp/latest-arm64.yml
+            retry_cmd 5 3 gh release upload "$TAG" --repo "$REPO" /tmp/latest-arm64.yml --clobber
+          fi
 
   update-release-notes:
     runs-on: ubuntu-latest
@@ -166,18 +268,25 @@ jobs:
       - release-windows-arm64
 
     steps:
+      - name: Check out git repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+
       - name: Generate release notes with platform download links
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: bash
         run: |
           set -euo pipefail
+          source .github/scripts/release-utils.sh
 
           TAG="$GITHUB_REF_NAME"
           REPO="$GITHUB_REPOSITORY"
           RELEASE_PAGE="https://github.com/$REPO/releases/tag/$TAG"
+          wait_for_release_id "$REPO" "$TAG" 12 2 >/dev/null
 
-          ASSETS_JSON="$(gh release view "$TAG" --repo "$REPO" --json assets)"
+          capture_cmd_with_retry ASSETS_JSON 8 3 gh release view "$TAG" --repo "$REPO" --json assets
 
           pick_asset() {
             local pattern="$1"
@@ -190,6 +299,9 @@ jobs:
           fi
           WINDOWS_ARM64_ASSET="$(echo "$ASSETS_JSON" | jq -r '[.assets[].name | select(test("arm64.*\\.exe$"))][0] // ""')"
           MAC_ASSET="$(pick_asset "\\.dmg$")"
+          if [ -z "$MAC_ASSET" ]; then
+            MAC_ASSET="$(pick_asset "arm64\\.zip$")"
+          fi
           LINUX_TAR_ASSET="$(pick_asset "\\.tar\\.gz$")"
           LINUX_APPIMAGE_ASSET="$(pick_asset "\\.AppImage$")"
 
@@ -214,19 +326,66 @@ jobs:
           [点击加入 Telegram 频道](https://t.me/weflow_cc)
 
           ## 下载
-          - Windows x64（Win10+）: ${WINDOWS_URL:-$RELEASE_PAGE}
-          - Windows arm64: ${WINDOWS_ARM64_URL:-$RELEASE_PAGE}
-          - macOS（M系列芯片）: ${MAC_URL:-$RELEASE_PAGE}
-          - Linux (.tar.gz): ${LINUX_TAR_URL:-$RELEASE_PAGE}
-          - linux (.AppImage): ${LINUX_APPIMAGE_URL:-$RELEASE_PAGE}
+          - Windows x64（Win10+）: [点击下载](${WINDOWS_URL:-$RELEASE_PAGE})
+          - Windows arm64: [点击下载](${WINDOWS_ARM64_URL:-$RELEASE_PAGE})
+          - macOS（M系列芯片）: [点击下载](${MAC_URL:-$RELEASE_PAGE})
+          - Linux (.tar.gz): [点击下载](${LINUX_TAR_URL:-$RELEASE_PAGE})
+          - Linux (.AppImage): [点击下载](${LINUX_APPIMAGE_URL:-$RELEASE_PAGE})
 
-          ## macOS 安装提示（未知来源）
-          - 若打开时提示“来自未知开发者”或“无法验证开发者”，请到「系统设置 -> 隐私与安全性」中允许打开该应用。
-          - 如果仍被系统拦截，请在终端执行以下命令去除隔离标记：
-          - `xattr -dr com.apple.quarantine "/Applications/WeFlow.app"`
+          ## macOS 安装提示
+          - 如果被系统提示已损坏，你需要在终端执行以下命令去除隔离标记：
+          - \`xattr -dr com.apple.quarantine "/Applications/WeFlow.app"\`
           - 执行后重新打开 WeFlow。
 
-          > 如果某个平台链接暂时未生成，可进入完整发布页查看全部资源：$RELEASE_PAGE
+          > 如果某个平台链接暂时未生成，可进入[完整发布页]($RELEASE_PAGE)查看全部资源
           EOF
 
-          gh release edit "$TAG" --repo "$REPO" --notes-file release_notes.md
+          retry_cmd 5 3 gh release edit "$TAG" --repo "$REPO" --notes-file release_notes.md
+
+  deploy-aur:
+    runs-on: ubuntu-latest
+    needs: [release-linux]
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - name: Check AUR credentials
+        id: aur-credentials
+        shell: bash
+        env:
+          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+        run: |
+          if [ -z "${AUR_SSH_PRIVATE_KEY}" ]; then
+            echo "::notice::AUR_SSH_PRIVATE_KEY is not configured; skipping AUR publish."
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout code
+        if: steps.aur-credentials.outputs.enabled == 'true'
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Update PKGBUILD version
+        if: steps.aur-credentials.outputs.enabled == 'true'
+        run: |
+          NEW_VER=$(echo "${{ github.ref_name }}" | sed 's/^v//')
+          sed -i "s/^pkgver=.*/pkgver=${NEW_VER}/" resources/installer/linux/PKGBUILD
+          sed -i "s/^pkgrel=.*/pkgrel=1/" resources/installer/linux/PKGBUILD
+
+      - name: Publish AUR package
+        if: steps.aur-credentials.outputs.enabled == 'true'
+        uses: KSXGitHub/github-actions-deploy-aur@master
+        with:
+          pkgname: weflow
+          pkgbuild: resources/installer/linux/PKGBUILD
+          updpkgsums: true
+          assets: |
+            resources/installer/linux/weflow.desktop
+            resources/installer/linux/icon.png
+            resources/installer/linux/.gitignore
+
+          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          commit_username: H3CoF6
+          commit_email: h3cof6@gmail.com
+          ssh_keyscan_types: ed25519

.gitignore

@@ -56,6 +56,8 @@ Thumbs.db
 *.aps
 
 wcdb/
+!resources/wcdb/
+!resources/wcdb/**
 xkey/
 server/
 *info
@@ -70,4 +72,9 @@ resources/wx_send
 概述.md
 pnpm-lock.yaml
 /pnpm-workspace.yaml
-wechat-research-site
+wechat-research-site
+.codex
+weflow-web-offical
+/Wedecrypt
+/scripts/syncwcdb.py
+/scripts/syncWedecrypt.py

.gitleaks.toml

@@ -0,0 +1,23 @@
+title = "Gitleaks Config"
+
+[extend]
+# 继承默认规则
+useDefault = true
+
+# 排除误报路径
+[[rules]]
+id = "curl-auth-header"
+[rules.allowlist]
+paths = [
+  '''docs/HTTP-API\.md'''
+]
+regexes = [
+  '''YOUR_TOKEN'''
+]
+
+[[rules]]
+id = "generic-api-key"
+[rules.allowlist]
+paths = [
+  '''src/pages/ChatPage\.tsx'''
+]

.npmrc

@@ -1,3 +1 @@
-registry=https://registry.npmmirror.com
-electron-mirror=https://npmmirror.com/mirrors/electron/
-electron-builder-binaries-mirror=https://npmmirror.com/mirrors/electron-builder-binaries/
+registry=https://registry.npmjs.org

README.md

@@ -1,37 +1,34 @@
 # WeFlow
 
-WeFlow 是一个**完全本地**的微信**实时**聊天记录查看、分析与导出工具。它可以实时获取你的微信聊天记录并将其导出，还可以根据你的聊天记录为你生成独一无二的分析报告
+WeFlow 是一个**完全本地**的微信**实时**聊天记录查看、分析与导出工具。它可以实时获取你的微信聊天记录并将其导出，还可以根据你的聊天记录为你生成独一无二的分析报告。
 
 ---
 
-<p align="center">
-  <img src="app.png" alt="WeFlow" width="90%">
-</p>
-
----
+**WeFlow** is a fully local tool for viewing, analyzing, and exporting WeChat chat history in real time. It generates unique analysis reports based on your chat history.
 
 <p align="center">
-<a href="https://github.com/hicccc77/WeFlow/stargazers">
-<img src="https://img.shields.io/github/stars/hicccc77/WeFlow?style=flat-square" alt="Stargazers">
-</a>
-<a href="https://github.com/hicccc77/WeFlow/network/members">
-<img src="https://img.shields.io/github/forks/hicccc77/WeFlow?style=flat-square" alt="Forks">
-</a>
-<a href="https://github.com/hicccc77/WeFlow/issues">
-<img src="https://img.shields.io/github/issues/hicccc77/WeFlow?style=flat-square" alt="Issues">
-<img src="https://gh-down-badges.linkof.link/hicccc77/WeFlow/" alt="Downloads" />
-</a>
-<a href="https://t.me/weflow_cc">
-<img src="https://img.shields.io/badge/Telegram%20频道-0088cc?style=flat-square&logo=telegram&logoColor=0088cc&labelColor=white" alt="Telegram">
-</a>
+  <img src="app.jpg" alt="WeFlow 应用预览" width="90%">
 </p>
 
+<p align="center">
+  <a href="https://github.com/hicccc77/WeFlow/stargazers"><img src="https://img.shields.io/github/stars/hicccc77/WeFlow?style=flat&label=Stars&labelColor=1F2937&color=2563EB" alt="Stargazers"></a>
+  <a href="https://github.com/hicccc77/WeFlow/network/members"><img src="https://img.shields.io/github/forks/hicccc77/WeFlow?style=flat&label=Forks&labelColor=1F2937&color=7C3AED" alt="Forks"></a>
+  <a href="https://github.com/hicccc77/WeFlow/issues"><img src="https://img.shields.io/github/issues/hicccc77/WeFlow?style=flat&label=Issues&labelColor=1F2937&color=D97706" alt="Issues"></a>
+  <a href="https://github.com/hicccc77/WeFlow/releases"><img src="https://img.shields.io/github/downloads/hicccc77/WeFlow/total?style=flat&label=Downloads&labelColor=1F2937&color=059669" alt="Downloads"></a>
+  <br><br>
+  <a href="https://t.me/weflow_cc"><img src="https://img.shields.io/badge/Telegram-频道-1D9BF0?style=flat&logo=telegram&logoColor=white&labelColor=1F2937&color=1D9BF0" alt="Telegram Channel" style="height: 22px; vertical-align: middle;"></a>
+  <a href="https://www.star-history.com/hicccc77/weflow"><img src="https://api.star-history.com/badge?repo=hicccc77/WeFlow&theme=dark" alt="Star History Rank" style="height: 32px; vertical-align: middle;"></a>
+</p>
 
 > [!TIP]
 > 如果导出聊天记录后，想深入分析聊天内容可以试试 [ChatLab](https://chatlab.fun/)
+> 
+> If you want to analyze your exported chat content in depth, try [ChatLab](https://chatlab.fun/)
 
 > [!NOTE]
 > 仅支持微信 **4.0 及以上**版本，确保你的微信版本符合要求
+> 
+> Only supports WeChat **version 4.0 and above**. Please ensure your WeChat version meets the requirements.
 
 ## 主要功能
 
@@ -43,8 +40,19 @@ WeFlow 是一个**完全本地**的微信**实时**聊天记录查看、分析
 - HTTP API 接口（供开发者集成）
 - 查看完整能力清单：[详细功能](#详细功能清单)
 
-## 支持平台与设备
+---
 
+**Key Features**
+
+- View chat history locally in real-time
+- Preview and decrypt Moments photos, videos, and **Live Photos**
+- Statistical analysis and group chat insights
+- Annual reports and visual overviews
+- Export chat history to HTML and other formats
+- HTTP API (for developer integration)
+- View complete feature list: [Detailed Features](#详细功能清单)
+
+## 支持平台与设备
 
 | 平台 | 设备/架构 | 安装包 |
 |------|----------|--------|
@@ -52,6 +60,15 @@ WeFlow 是一个**完全本地**的微信**实时**聊天记录查看、分析
 | macOS | Apple Silicon（M 系列，arm64） | `.dmg` |
 | Linux | x64 设备（amd64） | `.AppImage`、`.tar.gz` |
 
+---
+
+**Supported Platforms & Devices**
+
+| Platform | Device/Architecture | Package |
+|----------|---------------------|---------|
+| Windows | Windows 10+, x64 (amd64) | `.exe` |
+| macOS | Apple Silicon (M series, arm64) | `.dmg` |
+| Linux | x64 devices (amd64) | `.AppImage`, `.tar.gz` |
 
 ## 快速开始
 
@@ -59,6 +76,14 @@ WeFlow 是一个**完全本地**的微信**实时**聊天记录查看、分析
 
 > ArchLinux 用户可以选择 `yay -S weflow` 快速安装
 
+---
+
+**Quick Start**
+
+If you just want to use the pre-compiled application, go to [Releases](https://github.com/hicccc77/WeFlow/releases) to download and install.
+
+> ArchLinux users can quickly install with `yay -S weflow`
+
 ## 详细功能清单
 
 当前版本已支持以下能力：
@@ -66,6 +91,7 @@ WeFlow 是一个**完全本地**的微信**实时**聊天记录查看、分析
 | 功能模块 | 说明 |
 |---------|------|
 | **聊天** | 解密聊天中的图片、视频、实况（仅支持谷歌协议拍摄的实况）；支持**修改**、删除**本地**消息；实时刷新最新消息，无需生成解密中间数据库 |
+| **消息防撤回** | 防止其他人发送的消息被撤回 |
 | **实时弹窗通知** | 新消息到达时提供桌面弹窗提醒，便于及时查看重要会话，提供黑白名单功能 |
 | **私聊分析** | 统计好友间消息数量；分析消息类型与发送比例；查看消息时段分布等 |
 | **群聊分析** | 查看群成员详细信息；分析群内发言排行、活跃时段和媒体内容 |
@@ -76,6 +102,26 @@ WeFlow 是一个**完全本地**的微信**实时**聊天记录查看、分析
 | **联系人** | 导出微信好友、群聊、公众号信息；尝试找回曾经的好友（功能尚不完善） |
 | **HTTP API 映射** | 将本地消息能力映射为 HTTP API，便于对接外部系统、自动化脚本与二次开发 |
 
+---
+
+**Detailed Feature List**
+
+The current version supports the following capabilities:
+
+| Feature Module | Description |
+|----------------|-------------|
+| **Chat** | Decrypt images, videos, and Live Photos in chats (only supports Live Photos captured with Google protocol); supports **modifying** and deleting **local** messages; real-time refresh of latest messages without generating decrypted intermediate databases |
+| **Anti-Recall** | Prevent messages sent by others from being recalled |
+| **Real-time Notifications** | Desktop popup notifications when new messages arrive, convenient for timely viewing of important conversations, with blacklist/whitelist functionality |
+| **Private Chat Analysis** | Statistics on message counts between friends; analysis of message types and sending ratios; view message time distribution, etc. |
+| **Group Chat Analysis** | View detailed group member information; analyze group activity rankings, active periods, and media content |
+| **Annual Report** | Generate annual reports by year, or long-term historical reports across years |
+| **Duo Report** | Select a specific friend and generate an exclusive analysis report based on your mutual chat history |
+| **Message Export** | Export WeChat chat history to multiple formats: JSON, HTML, TXT, Excel, CSV, PGSQL, ChatLab proprietary format, etc. |
+| **Moments** | Decrypt Moments photos, videos, and Live Photos; export Moments content; intercept deletion and hiding operations in Moments; bypass time-based access restrictions |
+| **Contacts** | Export WeChat friends, group chats, and official account information; attempt to recover deleted friends (work in progress) |
+| **HTTP API** | Map local message capabilities to HTTP API for easy integration with external systems, automation scripts, and secondary development |
+
 ## HTTP API
 
 > [!WARNING]
@@ -90,6 +136,19 @@ WeFlow 提供本地 HTTP API 服务，支持通过接口查询消息数据，可
 
 完整接口文档：[点击查看](docs/HTTP-API.md)
 
+---
+
+> [!WARNING]
+> This feature is currently in its early stages, and the interface may change. Stay tuned for future updates.
+
+WeFlow provides a local HTTP API service that supports querying message data through interfaces, which can be used for integration with other tools or secondary development.
+
+- **Enable Method**: Settings → API Service → Start Service
+- **Default Port**: 5031
+- **Access Address**: `http://127.0.0.1:5031`
+- **Supported Formats**: Raw JSON or [ChatLab](https://chatlab.fun/) standard format
+
+Complete API documentation: [Click to view](docs/HTTP-API.md)
 
 ## 面向开发者
 
@@ -105,7 +164,24 @@ npm install
 
 # 3. 运行应用（开发模式）
 npm run dev
+```
 
+---
+
+**For Developers**
+
+If you want to build from source or contribute code to the project, please follow these steps:
+
+```bash
+# 1. Clone the project locally
+git clone https://github.com/hicccc77/WeFlow.git
+cd WeFlow
+
+# 2. Install project dependencies
+npm install
+
+# 3. Run the application (development mode)
+npm run dev
 ```
 
 ## 致谢
@@ -113,22 +189,35 @@ npm run dev
 - [密语 CipherTalk](https://github.com/ILoveBingLu/miyu) 为本项目提供了基础框架
 - [WeChat-Channels-Video-File-Decryption](https://github.com/Evil0ctal/WeChat-Channels-Video-File-Decryption) 提供了视频解密相关的技术参考
 
+---
+
+**Acknowledgments**
+
+- [CipherTalk](https://github.com/ILoveBingLu/miyu) provided the basic framework for this project
+- [WeChat-Channels-Video-File-Decryption](https://github.com/Evil0ctal/WeChat-Channels-Video-File-Decryption) provided technical references for video decryption
+
 ## 支持我们
 
 如果 WeFlow 确实帮到了你，可以考虑请我们喝杯咖啡：
 
+> TRC20 **Address:** `TZCtAw8CaeARWZBfvjidCnTcfnAtf6nvS6`
 
-> TRC20  **Address:** `TZCtAw8CaeARWZBfvjidCnTcfnAtf6nvS6`
+---
 
+**Support Us**
+
+If WeFlow has truly helped you, consider buying us a coffee:
+
+> TRC20 **Address:** `TZCtAw8CaeARWZBfvjidCnTcfnAtf6nvS6`
 
 ## Star History
 
 <a href="https://www.star-history.com/#hicccc77/WeFlow&type=date&legend=top-left">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=hicccc77/WeFlow&type=date&theme=dark&legend=top-left" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=hicccc77/WeFlow&type=date&legend=top-left" />
-   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=hicccc77/WeFlow&type=date&legend=top-left" />
- </picture>
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=hicccc77/WeFlow&type=date&theme=dark&legend=top-left" />
+    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=hicccc77/WeFlow&type=date&legend=top-left" />
+    <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=hicccc77/WeFlow&type=date&legend=top-left" />
+  </picture>
 </a>
 
 <div align="center">
@@ -137,4 +226,6 @@ npm run dev
 
 **请负责任地使用本工具，遵守相关法律法规**
 
+**Please use this tool responsibly and comply with relevant laws and regulations**
+
 </div>

docs/HTTP-API.md

@@ -27,8 +27,8 @@ WeFlow 提供本地 HTTP API（已支持GET 和 POST请求），便于外部脚
 - `GET|POST /api/v1/health`
 - `GET|POST /api/v1/push/messages`
 - `GET|POST /api/v1/messages`
-- `GET|POST /api/v1/messages/new`
 - `GET|POST /api/v1/sessions`
+- `GET /api/v1/sessions/:id/messages` (ChatLab Pull)
 - `GET|POST /api/v1/contacts`
 - `GET|POST /api/v1/group-members`
 - `GET|POST /api/v1/media/*`
@@ -74,18 +74,19 @@ GET /api/v1/push/messages
 - 需要先在设置页开启 `HTTP API 服务`
 - 同时需要开启 `主动推送`
 - 响应类型为 `text/event-stream`
-- 新消息事件名固定为 `message.new`
-- 建议接收端按 `messageKey` 去重
+- 事件名包含 `message.new` 和 `message.revoke`
+- 建议接收端按 `event + rawid` 去重
 
 ### 事件字段
 
 - `event`
 - `sessionId`
-- `messageKey`
+- `rawid`
 - `avatarUrl`
 - `sourceName`
 - `groupName`（仅群聊）
 - `content`
+- `timestamp`（消息时间，秒级 Unix 时间戳）
 
 ### 示例
 
@@ -97,7 +98,14 @@ curl -N "http://127.0.0.1:5031/api/v1/push/messages?access_token=YOUR_TOKEN
 
 ```text
 event: message.new
-data: {"event":"message.new","sessionId":"xxx@chatroom","messageKey":"server:123456:1760000123:1760000123000:321:wxid_member:1","avatarUrl":"https://example.com/group.jpg","sourceName":"李四","groupName":"项目群","content":"[图片]"}
+data: {"event":"message.new","sessionId":"xxx@chatroom","sessionType":"group","rawid":"1234567890123456789","avatarUrl":"https://example.com/group.jpg","sourceName":"李四","groupName":"项目群","content":"[图片]","timestamp":1760000123}
+```
+
+撤回事件示例：
+
+```text
+event: message.revoke
+data: {"event":"message.revoke","sessionId":"wxid_xxx","sessionType":"other","rawid":"1234567890123456789","avatarUrl":"https://example.com/avatar.jpg","sourceName":"张三","content":"对方撤回了一条消息（rawid：1234567890123456789） 内容为“你好”","timestamp":1760000180}
 ```
 
 ---
@@ -116,21 +124,21 @@ GET /api/v1/messages
 
 ### 参数
 
-| 参数 | 类型 | 必填 | 说明 |
-| --- | --- | --- | --- |
-| `talker` | string | 是 | 会话 ID。私聊通常是对方 `wxid`，群聊是 `xxx@chatroom` |
-| `limit` | number | 否 | 返回条数，默认 `100`，范围 `1~10000` |
-| `offset` | number | 否 | 分页偏移，默认 `0` |
-| `start` | string | 否 | 开始时间，支持 `YYYYMMDD` 或时间戳 |
-| `end` | string | 否 | 结束时间，支持 `YYYYMMDD` 或时间戳 |
-| `keyword` | string | 否 | 基于消息显示文本过滤 |
-| `chatlab` | string | 否 | `1/true` 时输出 ChatLab 格式 |
-| `format` | string | 否 | `json` 或 `chatlab` |
-| `media` | string | 否 | `1/true` 时导出媒体并返回媒体地址，兼容别名 `meiti` |
-| `image` | string | 否 | 在 `media=1` 时控制图片导出，兼容别名 `tupian` |
-| `voice` | string | 否 | 在 `media=1` 时控制语音导出，兼容别名 `vioce` |
-| `video` | string | 否 | 在 `media=1` 时控制视频导出 |
-| `emoji` | string | 否 | 在 `media=1` 时控制表情导出 |
+| 参数      | 类型   | 必填 | 说明                                                  |
+| --------- | ------ | ---- | ----------------------------------------------------- |
+| `talker`  | string | 是   | 会话 ID。私聊通常是对方 `wxid`，群聊是 `xxx@chatroom` |
+| `limit`   | number | 否   | 返回条数，默认 `100`，范围 `1~10000`                  |
+| `offset`  | number | 否   | 分页偏移，默认 `0`                                    |
+| `start`   | string | 否   | 开始时间，支持 `YYYYMMDD` 或时间戳                    |
+| `end`     | string | 否   | 结束时间，支持 `YYYYMMDD` 或时间戳                    |
+| `keyword` | string | 否   | 基于消息显示文本过滤                                  |
+| `chatlab` | string | 否   | `1/true` 时输出 ChatLab 格式                          |
+| `format`  | string | 否   | `json` 或 `chatlab`                                   |
+| `media`   | string | 否   | `1/true` 时导出媒体并返回媒体地址，兼容别名 `meiti`   |
+| `image`   | string | 否   | 在 `media=1` 时控制图片导出，兼容别名 `tupian`        |
+| `voice`   | string | 否   | 在 `media=1` 时控制语音导出，兼容别名 `vioce`         |
+| `video`   | string | 否   | 在 `media=1` 时控制视频导出                           |
+| `emoji`   | string | 否   | 在 `media=1` 时控制表情导出                           |
 
 ### 示例
 
@@ -165,6 +173,8 @@ curl "http://127.0.0.1:5031/api/v1/messages?talker=xxx@chatroom&media=1&image=1&
 - `content`
 - `rawContent`
 - `parsedContent`
+- `replyToMessageId`（引用回复目标消息的 `serverId`，仅引用消息返回）
+- `quote`（引用消息快照，包含被引用消息的 ID、发送者、内容和类型）
 - `mediaType`
 - `mediaFileName`
 - `mediaUrl`
@@ -176,7 +186,7 @@ curl "http://127.0.0.1:5031/api/v1/messages?talker=xxx@chatroom&media=1&image=1&
 {
   "success": true,
   "talker": "xxx@chatroom",
-  "count": 2,
+  "count": 3,
   "hasMore": true,
   "media": {
     "enabled": true,
@@ -186,7 +196,7 @@ curl "http://127.0.0.1:5031/api/v1/messages?talker=xxx@chatroom&media=1&image=1&
   "messages": [
     {
       "localId": 123,
-      "serverId": "456",
+      "serverId": "6116895530414915131",
       "localType": 1,
       "createTime": 1738713600,
       "isSend": 0,
@@ -195,6 +205,25 @@ curl "http://127.0.0.1:5031/api/v1/messages?talker=xxx@chatroom&media=1&image=1&
       "rawContent": "你好",
       "parsedContent": "你好"
     },
+    {
+      "localId": 125,
+      "serverId": "6116895530414915133",
+      "localType": 244813135921,
+      "createTime": 1738713700,
+      "isSend": 0,
+      "senderUsername": "wxid_member",
+      "content": "收到",
+      "rawContent": "<msg>...</msg>",
+      "parsedContent": "收到",
+      "replyToMessageId": "6116895530414915131",
+      "quote": {
+        "platformMessageId": "6116895530414915131",
+        "sender": "wxid_other",
+        "accountName": "张三",
+        "content": "你好",
+        "type": 0
+      }
+    },
     {
       "localId": 124,
       "localType": 3,
@@ -235,6 +264,7 @@ curl "http://127.0.0.1:5031/api/v1/messages?talker=xxx@chatroom&media=1&image=1&
 - `messages[].type`
 - `messages[].content`
 - `messages[].platformMessageId`
+- `messages[].replyToMessageId`
 - `messages[].mediaPath`
 
 群聊里 `groupNickname` 会优先来自群成员群昵称；若源数据缺失，则回退为空或展示名。
@@ -253,10 +283,10 @@ GET /api/v1/sessions
 
 ### 参数
 
-| 参数 | 类型 | 必填 | 说明 |
-| --- | --- | --- | --- |
-| `keyword` | string | 否 | 匹配 `username` 或 `displayName` |
-| `limit` | number | 否 | 默认 `100` |
+| 参数      | 类型   | 必填 | 说明                             |
+| --------- | ------ | ---- | -------------------------------- |
+| `keyword` | string | 否   | 匹配 `username` 或 `displayName` |
+| `limit`   | number | 否   | 默认 `100`                       |
 
 ### 响应字段
 
@@ -288,6 +318,130 @@ GET /api/v1/sessions
 
 ---
 
+## 4.1 获取会话列表（ChatLab 格式）
+
+当 `format=chatlab` 时，返回 ChatLab Pull 协议兼容格式，可直接作为 ChatLab 远程数据源。
+
+**请求**
+
+```http
+GET /api/v1/sessions?format=chatlab
+```
+
+### 参数
+
+| 参数      | 类型   | 必填 | 说明                             |
+| --------- | ------ | ---- | -------------------------------- |
+| `format`  | string | 是   | 设为 `chatlab`                   |
+| `keyword` | string | 否   | 匹配 `username` 或 `displayName` |
+| `limit`   | number | 否   | 默认 `100`                       |
+
+### 响应
+
+```json
+{
+  "sessions": [
+    {
+      "id": "xxx@chatroom",
+      "name": "项目群",
+      "platform": "wechat",
+      "type": "group",
+      "messageCount": 58000,
+      "lastMessageAt": 1738713600
+    }
+  ]
+}
+```
+
+| 字段            | 说明                                |
+| --------------- | ----------------------------------- |
+| `id`            | 会话 ID（微信 username）            |
+| `name`          | 会话显示名称                        |
+| `platform`      | 固定 `wechat`                       |
+| `type`          | `group`（群聊）或 `private`（私聊） |
+| `messageCount`  | 消息数量（估算值，可能不精确）      |
+| `lastMessageAt` | 最后消息的秒级 Unix 时间戳          |
+
+---
+
+## 4.2 拉取会话消息（ChatLab Pull）
+
+返回 ChatLab 标准格式的聊天数据，支持增量拉取和分页。
+
+**请求**
+
+```http
+GET /api/v1/sessions/:id/messages
+```
+
+### 参数
+
+| 参数     | 类型   | 必填 | 说明                                     |
+| -------- | ------ | ---- | ---------------------------------------- |
+| `:id`    | string | 是   | 会话 ID（Path 参数）                     |
+| `since`  | number | 否   | 秒级 Unix 时间戳，仅返回此时间之后的消息 |
+| `end`    | number | 否   | 秒级 Unix 时间戳，时间上界               |
+| `limit`  | number | 否   | 单次返回上限，默认且最大 `5000`          |
+| `offset` | number | 否   | 分页偏移，默认 `0`                       |
+
+### 响应
+
+返回 ChatLab 标准 JSON 格式，外加 `sync` 分页块：
+
+```json
+{
+  "chatlab": {
+    "version": "0.0.2",
+    "exportedAt": 1738713600,
+    "generator": "WeFlow"
+  },
+  "meta": {
+    "name": "项目群",
+    "platform": "wechat",
+    "type": "group",
+    "groupId": "xxx@chatroom",
+    "ownerId": "wxid_xxx"
+  },
+  "members": [
+    {
+      "platformId": "wxid_a",
+      "accountName": "张三",
+      "groupNickname": "产品",
+      "avatar": "https://example.com/avatar.jpg"
+    }
+  ],
+  "messages": [
+    {
+      "sender": "wxid_a",
+      "accountName": "张三",
+      "timestamp": 1738713600,
+      "type": 0,
+      "content": "你好",
+      "platformMessageId": "123456"
+    }
+  ],
+  "sync": {
+    "hasMore": true,
+    "nextSince": 1738713600,
+    "nextOffset": 5000,
+    "watermark": 1738714000
+  }
+}
+```
+
+### sync 块
+
+| 字段         | 说明                             |
+| ------------ | -------------------------------- |
+| `hasMore`    | 是否还有更多数据                 |
+| `nextSince`  | 下次请求的 `since` 值            |
+| `nextOffset` | 下次请求的 `offset` 值           |
+| `watermark`  | 本次拉取的时间上界（秒级时间戳） |
+
+**ChatLab 对接方式**：在 ChatLab 设置中添加远程数据源，`baseUrl` 填 `http://127.0.0.1:5031/api/v1`，Token 填 WeFlow 中配置的 API Token。
+
+---
+
 ## 5. 获取联系人列表
 
 > 当使用 POST 时，请将参数放在 JSON Body 中（Content-Type: application/json）
@@ -300,10 +454,10 @@ GET /api/v1/contacts
 
 ### 参数
 
-| 参数 | 类型 | 必填 | 说明 |
-| --- | --- | --- | --- |
-| `keyword` | string | 否 | 匹配 `username`、`nickname`、`remark`、`displayName` |
-| `limit` | number | 否 | 默认 `100` |
+| 参数      | 类型   | 必填 | 说明                                                 |
+| --------- | ------ | ---- | ---------------------------------------------------- |
+| `keyword` | string | 否   | 匹配 `username`、`nickname`、`remark`、`displayName` |
+| `limit`   | number | 否   | 默认 `100`                                           |
 
 ### 响应字段
 
@@ -353,12 +507,12 @@ GET /api/v1/group-members
 
 ### 参数
 
-| 参数 | 类型 | 必填 | 说明 |
-| --- | --- | --- | --- |
-| `chatroomId` | string | 是 | 群 ID，兼容使用 `talker` 传入 |
-| `includeMessageCounts` | string | 否 | `1/true` 时附带成员发言数 |
-| `withCounts` | string | 否 | `includeMessageCounts` 的别名 |
-| `forceRefresh` | string | 否 | `1/true` 时跳过内存缓存强制刷新 |
+| 参数                   | 类型   | 必填 | 说明                            |
+| ---------------------- | ------ | ---- | ------------------------------- |
+| `chatroomId`           | string | 是   | 群 ID，兼容使用 `talker` 传入   |
+| `includeMessageCounts` | string | 否   | `1/true` 时附带成员发言数       |
+| `withCounts`           | string | 否   | `includeMessageCounts` 的别名   |
+| `forceRefresh`         | string | 否   | `1/true` 时跳过内存缓存强制刷新 |
 
 ### 响应字段
 
@@ -433,7 +587,123 @@ curl "http://127.0.0.1:5031/api/v1/group-members?chatroomId=xxx@chatroom&include
 
 ---
 
-## 7. 访问导出媒体
+## 7. 朋友圈接口
+
+### 7.1 获取朋友圈时间线
+
+```http
+GET /api/v1/sns/timeline
+```
+
+参数：
+
+| 参数        | 类型   | 必填 | 说明                                                         |
+| ----------- | ------ | ---- | ------------------------------------------------------------ |
+| `limit`     | number | 否   | 返回数量，默认 20，范围 `1~200`                              |
+| `offset`    | number | 否   | 偏移量，默认 0                                               |
+| `usernames` | string | 否   | 发布者过滤，逗号分隔，如 `wxid_a,wxid_b`                     |
+| `keyword`   | string | 否   | 关键词过滤（正文）                                           |
+| `start`     | string | 否   | 开始时间，支持 `YYYYMMDD` 或秒/毫秒时间戳                    |
+| `end`       | string | 否   | 结束时间，支持 `YYYYMMDD` 或秒/毫秒时间戳                    |
+| `media`     | number | 否   | 是否返回可直接访问的媒体地址，默认 `1`                       |
+| `replace`   | number | 否   | `media=1` 时，是否用解析地址覆盖 `media.url/thumb`，默认 `1` |
+| `inline`    | number | 否   | `media=1` 时，是否内联返回 `data:` URL，默认 `0`             |
+
+示例：
+
+```bash
+curl "http://127.0.0.1:5031/api/v1/sns/timeline?limit=5"
+curl "http://127.0.0.1:5031/api/v1/sns/timeline?usernames=wxid_a,wxid_b&keyword=旅行"
+curl "http://127.0.0.1:5031/api/v1/sns/timeline?limit=3&media=1&replace=1"
+curl "http://127.0.0.1:5031/api/v1/sns/timeline?limit=3&media=1&inline=1"
+```
+
+媒体字段说明（`media=1`）：
+
+- `media[].url/thumb`：你应该优先直接使用的字段。
+- `replace=1`（默认）时，`media[].url/thumb` 会直接被替换成可访问地址，等价于 `resolvedUrl/resolvedThumbUrl`。
+- `replace=0` 时，`media[].url/thumb` 仍保留微信原始地址；这时再结合下面的 `raw/proxy/resolved` 字段自己决定用哪一个。
+- `media[].rawUrl/rawThumb`：原始朋友圈地址
+- `media[].proxyUrl/proxyThumbUrl`：可直接访问的代理地址
+- `media[].resolvedUrl/resolvedThumbUrl`：最终可用地址（`inline=1` 时可能是 `data:` URL）
+- `media[].token/key/encIdx`：微信源数据里的访问/解密参数。通常不需要你自己处理；如果你手动调用 `/api/v1/sns/media/proxy`，把当前条目的 `url` 和 `key` 原样传回即可。
+- `media[].livePhoto`：实况图的视频部分。外层 `media[].url/thumb` 仍是封面图，`livePhoto` 内部会再提供一组自己的 `url/thumb/raw*/proxy*/resolved*` 字段。
+- `media=0` 时，不会补充 `raw*/proxy*/resolved*`，接口只返回原始 `url/thumb` 以及源字段（如 `key/token/encIdx`）。
+
+### 7.2 获取朋友圈发布者
+
+```http
+GET /api/v1/sns/usernames
+```
+
+### 7.3 获取朋友圈导出统计
+
+```http
+GET /api/v1/sns/export/stats
+```
+
+参数：
+
+| 参数   | 类型   | 必填 | 说明                         |
+| ------ | ------ | ---- | ---------------------------- |
+| `fast` | number | 否   | `1` 使用快速统计（优先缓存） |
+
+### 7.4 朋友圈媒体代理
+
+```http
+GET /api/v1/sns/media/proxy
+```
+
+参数：
+
+| 参数  | 类型          | 必填 | 说明                     |
+| ----- | ------------- | ---- | ------------------------ |
+| `url` | string        | 是   | 媒体原始 URL             |
+| `key` | string/number | 否   | 解密 key（部分资源需要） |
+
+### 7.5 导出朋友圈
+
+```http
+POST /api/v1/sns/export
+Content-Type: application/json
+```
+
+Body 示例：
+
+```json
+{
+  "outputDir": "C:\\Users\\Alice\\Desktop\\sns-export",
+  "format": "json",
+  "usernames": "wxid_a,wxid_b",
+  "keyword": "旅行",
+  "exportMedia": true,
+  "exportImages": true,
+  "exportLivePhotos": true,
+  "exportVideos": true,
+  "start": "20250101",
+  "end": "20251231"
+}
+```
+
+`format` 支持：`json`、`html`、`arkmejson`（兼容写法：`arkme-json`）。
+
+### 7.6 朋友圈防删开关
+
+```http
+GET  /api/v1/sns/block-delete/status
+POST /api/v1/sns/block-delete/install
+POST /api/v1/sns/block-delete/uninstall
+```
+
+### 7.7 删除单条朋友圈
+
+```http
+DELETE /api/v1/sns/post/{postId}
+```
+
+---
+
+## 8. 访问导出媒体
 
 > 当使用 POST 时，请将参数放在 JSON Body 中（Content-Type: application/json）
 
@@ -456,15 +726,15 @@ curl "http://127.0.0.1:5031/api/v1/media/xxx@chatroom/emojis/emoji_300.gif"
 
 ### 支持的 Content-Type
 
-| 扩展名 | Content-Type |
-| --- | --- |
-| `.png` | `image/png` |
+| 扩展名           | Content-Type |
+| ---------------- | ------------ |
+| `.png`           | `image/png`  |
 | `.jpg` / `.jpeg` | `image/jpeg` |
-| `.gif` | `image/gif` |
-| `.webp` | `image/webp` |
-| `.wav` | `audio/wav` |
-| `.mp3` | `audio/mpeg` |
-| `.mp4` | `video/mp4` |
+| `.gif`           | `image/gif`  |
+| `.webp`          | `image/webp` |
+| `.wav`           | `audio/wav`  |
+| `.mp3`           | `audio/mpeg` |
+| `.mp4`           | `video/mp4`  |
 
 常见错误响应：
 
@@ -476,7 +746,7 @@ curl "http://127.0.0.1:5031/api/v1/media/xxx@chatroom/emojis/emoji_300.gif"
 
 ---
 
-## 8. 使用示例
+## 9. 使用示例
 
 ### PowerShell
 
@@ -510,8 +780,8 @@ headers = {"Authorization": "Bearer YOUR_TOKEN", "Content-Type": "application/js
 
 # POST 方式获取消息
 messages = requests.post(
-    f"{BASE_URL}/api/v1/messages", 
-    json={"talker": "xxx@chatroom", "limit": 50}, 
+    f"{BASE_URL}/api/v1/messages",
+    json={"talker": "xxx@chatroom", "limit": 50},
     headers=headers
 ).json()
 
@@ -525,7 +795,7 @@ members = requests.get(
 
 ---
 
-## 9. 注意事项
+## 10. 注意事项
 
 1. API 仅监听本机 `127.0.0.1`，不对外网开放。
 2. 使用前需要先在 WeFlow 中完成数据库连接。

docs/MAC-KEY-FAQ.md

@@ -0,0 +1,54 @@
+# macOS 微信密钥自动获取失败排障指南
+
+如果你在 macOS 系统下，遇到了 WeFlow 自动获取微信数据库密钥失败的问题，这篇指南或许可以帮到你。
+
+### 请立刻停止连续重试
+
+当你看到下面这些报错时，请务必暂停操作，不要再去反复点击获取：
+
+- SCAN_FAILED，通常伴随 No suitable module found 或 Sink pattern not found
+- HOOK_FAILED 或 Native Hook Failed
+- patch_breakpoint_failed
+- thread_get_state_failed
+
+现在的 macOS 系统和微信防护机制非常敏锐。连续的重试动作不仅无法解决问题，反而容易被判定为异常行为，进而触发微信的安全模式或系统级的内存保护。
+
+### 可能的尝试流程
+
+根据大量社区用户的反馈，如果你已经遇到了获取失败的情况，按照下面的步骤顺序操作，通常都能顺利解决问题：
+
+1. **降级微信版本**。找一个经过大家验证、兼容性更好的老版本，目前最推荐先退回到 4.1.7.57 或者 4.1.8.100。
+2. **彻底退出微信**。请使用快捷键 Command + Q 或在活动监视器中结束进程，而不仅仅是关闭窗口。
+3. **重启你的 Mac**。这一步极其关键，必须是真正的重新启动。注销或睡眠唤醒无法清除系统底层的拦截状态。
+4. **重新打开微信**。随便点击几下保持它在最前台，并且确保它是未登录的状态。
+5. **回到 WeFlow**。仅仅尝试一次“自动获取密钥”。
+6. **输入密码并登录**。先在弹窗中输入你的系统密码后，确认页面弹出允许登录了再登录微信
+7. **恢复日常使用**。只要成功拿到了密钥，你就可以放心地把微信更新回你平时爱用的最新版本。
+
+### 常见报错与应对方法
+
+为了方便排查，这里列出了几类最常见的报错及其背后的原因和对策：
+
+**SCAN_FAILED: No suitable module found**
+这意味着微信的内存布局并不标准，或者目标模块没有被命中。你可以先确保微信完整启动并保持在前台。如果还是不行，请直接执行上面提到的“降级、重启电脑、获取、再升级”的完整流程。
+
+**SCAN_FAILED: Sink pattern not found**
+这说明 WeFlow 还没有适配你当前正在使用的微信版本特征。最快的解决办法是直接降级到微信 4.1.7 或 4.1.8.100 版本再试。
+
+**patch_breakpoint_failed 或 thread_get_state_failed**
+这类错误大多是因为调试断点注入或线程状态读取被 macOS 系统的安全机制拦截了。此时继续尝试毫无意义，彻底退出微信并重启电脑再试。
+
+**task_for_pid:5**
+这是进程附加权限被系统拒绝的提示。请确保你使用的是打包好的 WeFlow.app，同时检查系统的签名与调试权限是否已经正确配置。
+
+### 关于推荐版本的补充说明
+
+截至 2026 年 4 月，综合社区的反馈来看，微信 4.1.7 和 4.1.8.100 版本在密钥获取流程中的表现最为稳定，成功率最高。
+
+这并不意味着其他新版本绝对无法获取，只是作为当前的排障参考。未来 WeFlow 也会在后续的更新中逐步适配新版微信的特征，建议大家多留意项目的 Release 动态。
+
+### 最后的几点建议
+
+首次失败后，首要任务是排查原因，切忌盲目地连续点击自动获取。如果你在看到这篇文档前已经失败了好几次，最好的做法是直接清零重来：彻底退出微信，重启电脑，然后再进行下一次尝试。
+
+最后，如果尝试了上述所有方法依然无法解决，请记得保存完整的报错文本，特别是 SCAN_FAILED 或 HOOK_FAILED 后面跟着的英文细节。把这些信息提交到[issue](https://github.com/hicccc77/WeFlow/issues/745)，会大大加快定位和修复兼容性问题的速度。

electron/exportWorker.ts

@@ -1,16 +1,133 @@
 import { parentPort, workerData } from 'worker_threads'
-import type { ExportOptions } from './services/exportService'
 
 interface ExportWorkerConfig {
-  sessionIds: string[]
-  outputDir: string
-  options: ExportOptions
+  mode?: 'sessions' | 'single' | 'contacts'
+  sessionIds?: string[]
+  sessionId?: string
+  outputDir?: string
+  outputPath?: string
+  options?: any
+  taskId?: string
+  dbPath?: string
+  decryptKey?: string
+  myWxid?: string
+  imageXorKey?: unknown
+  imageAesKey?: string
   resourcesPath?: string
   userDataPath?: string
   logEnabled?: boolean
+  isPackaged?: boolean
 }
 
 const config = workerData as ExportWorkerConfig
+const controlState = {
+  pauseRequested: false,
+  stopRequested: false
+}
+
+const CREATED_PATH_FLUSH_INTERVAL_MS = 200
+const CREATED_PATH_BATCH_LIMIT = 256
+const PROGRESS_POST_INTERVAL_MS = 180
+let queuedCreatedFiles: string[] = []
+let queuedCreatedDirs: string[] = []
+let createdPathFlushTimer: ReturnType<typeof setTimeout> | null = null
+let pendingProgress: any = null
+let progressPostTimer: ReturnType<typeof setTimeout> | null = null
+let lastProgressPostedAt = 0
+
+function flushCreatedPaths() {
+  if (createdPathFlushTimer) {
+    clearTimeout(createdPathFlushTimer)
+    createdPathFlushTimer = null
+  }
+  const filePaths = queuedCreatedFiles
+  const dirPaths = queuedCreatedDirs
+  queuedCreatedFiles = []
+  queuedCreatedDirs = []
+  if (!parentPort) return
+  if (filePaths.length > 0) {
+    parentPort.postMessage({ type: 'export:createdFiles', filePaths })
+  }
+  if (dirPaths.length > 0) {
+    parentPort.postMessage({ type: 'export:createdDirs', dirPaths })
+  }
+}
+
+function scheduleCreatedPathFlush() {
+  if (createdPathFlushTimer) return
+  createdPathFlushTimer = setTimeout(flushCreatedPaths, CREATED_PATH_FLUSH_INTERVAL_MS)
+}
+
+function queueCreatedFile(filePath: string) {
+  const normalized = String(filePath || '').trim()
+  if (!normalized) return
+  queuedCreatedFiles.push(normalized)
+  if (queuedCreatedFiles.length + queuedCreatedDirs.length >= CREATED_PATH_BATCH_LIMIT) {
+    flushCreatedPaths()
+  } else {
+    scheduleCreatedPathFlush()
+  }
+}
+
+function queueCreatedDir(dirPath: string) {
+  const normalized = String(dirPath || '').trim()
+  if (!normalized) return
+  queuedCreatedDirs.push(normalized)
+  if (queuedCreatedFiles.length + queuedCreatedDirs.length >= CREATED_PATH_BATCH_LIMIT) {
+    flushCreatedPaths()
+  } else {
+    scheduleCreatedPathFlush()
+  }
+}
+
+function flushProgress() {
+  if (!pendingProgress) return
+  if (progressPostTimer) {
+    clearTimeout(progressPostTimer)
+    progressPostTimer = null
+  }
+  parentPort?.postMessage({
+    type: 'export:progress',
+    data: pendingProgress
+  })
+  pendingProgress = null
+  lastProgressPostedAt = Date.now()
+}
+
+function queueProgress(progress: any) {
+  pendingProgress = progress
+  if (progress?.phase === 'complete') {
+    flushProgress()
+    return
+  }
+
+  const now = Date.now()
+  const elapsed = now - lastProgressPostedAt
+  if (elapsed >= PROGRESS_POST_INTERVAL_MS) {
+    flushProgress()
+    return
+  }
+
+  if (progressPostTimer) return
+  progressPostTimer = setTimeout(flushProgress, PROGRESS_POST_INTERVAL_MS - elapsed)
+}
+
+parentPort?.on('message', (message: any) => {
+  if (!message || typeof message.type !== 'string') return
+  if (message.type === 'export:pause') {
+    controlState.pauseRequested = true
+    return
+  }
+  if (message.type === 'export:resume') {
+    controlState.pauseRequested = false
+    return
+  }
+  if (message.type === 'export:cancel') {
+    controlState.stopRequested = true
+    controlState.pauseRequested = false
+  }
+})
+
 process.env.WEFLOW_WORKER = '1'
 if (config.resourcesPath) {
   process.env.WCDB_RESOURCES_PATH = config.resourcesPath
@@ -29,18 +146,66 @@ async function run() {
 
   wcdbService.setPaths(config.resourcesPath || '', config.userDataPath || '')
   wcdbService.setLogEnabled(config.logEnabled === true)
+  exportService.setRuntimeConfig({
+    dbPath: config.dbPath,
+    decryptKey: config.decryptKey,
+    myWxid: config.myWxid,
+    imageXorKey: config.imageXorKey,
+    imageAesKey: config.imageAesKey,
+    resourcesPath: config.resourcesPath,
+    appPath: config.resourcesPath ? require('path').dirname(config.resourcesPath) : __dirname,
+    isPackaged: config.isPackaged
+  })
 
-  const result = await exportService.exportSessions(
-    Array.isArray(config.sessionIds) ? config.sessionIds : [],
-    String(config.outputDir || ''),
-    config.options || { format: 'json' },
-    (progress) => {
-      parentPort?.postMessage({
-        type: 'export:progress',
-        data: progress
-      })
-    }
-  )
+  const onProgress = (progress: any) => queueProgress(progress)
+
+  const taskControl = config.taskId
+    ? {
+        shouldPause: () => controlState.pauseRequested,
+        shouldStop: () => controlState.stopRequested,
+        recordCreatedFile: queueCreatedFile,
+        recordCreatedDir: queueCreatedDir
+      }
+    : undefined
+
+  let result: any
+  if (config.mode === 'contacts') {
+    const [{ contactExportService }, { chatService }] = await Promise.all([
+      import('./services/contactExportService'),
+      import('./services/chatService')
+    ])
+    chatService.setRuntimeConfig({
+      dbPath: config.dbPath,
+      decryptKey: config.decryptKey,
+      myWxid: config.myWxid,
+      resourcesPath: config.resourcesPath,
+      appPath: config.resourcesPath ? require('path').dirname(config.resourcesPath) : __dirname,
+      isPackaged: config.isPackaged
+    })
+    result = await contactExportService.exportContacts(
+      String(config.outputDir || ''),
+      config.options || {}
+    )
+  } else if (config.mode === 'single') {
+    result = await exportService.exportSessionToChatLab(
+      String(config.sessionId || '').trim(),
+      String(config.outputPath || '').trim(),
+      config.options || { format: 'chatlab' },
+      onProgress,
+      taskControl
+    )
+  } else {
+    result = await exportService.exportSessions(
+      Array.isArray(config.sessionIds) ? config.sessionIds : [],
+      String(config.outputDir || ''),
+      config.options || { format: 'json' },
+      onProgress,
+      taskControl
+    )
+  }
+
+  flushProgress()
+  flushCreatedPaths()
 
   parentPort?.postMessage({
     type: 'export:result',
@@ -49,6 +214,8 @@ async function run() {
 }
 
 run().catch((error) => {
+  flushProgress()
+  flushCreatedPaths()
   parentPort?.postMessage({
     type: 'export:error',
     error: String(error)

electron/imageSearchWorker.ts

@@ -20,7 +20,7 @@ function looksLikeMd5(value: string): boolean {
 
 function stripDatVariantSuffix(base: string): string {
   const lower = base.toLowerCase()
-  const suffixes = ['_thumb', '.thumb', '_hd', '.hd', '_h', '.h', '_t', '.t', '_c', '.c']
+  const suffixes = ['_thumb', '.thumb', '_hd', '.hd', '_h', '.h', '_b', '.b', '_w', '.w', '_t', '.t', '_c', '.c']
   for (const suffix of suffixes) {
     if (lower.endsWith(suffix)) {
       return lower.slice(0, -suffix.length)
@@ -71,8 +71,10 @@ function scoreDatName(fileName: string): number {
   const lower = fileName.toLowerCase()
   const baseLower = lower.endsWith('.dat') ? lower.slice(0, -4) : lower
   if (baseLower.endsWith('_h') || baseLower.endsWith('.h')) return 600
+  if (baseLower.endsWith('_hd') || baseLower.endsWith('.hd')) return 550
+  if (baseLower.endsWith('_b') || baseLower.endsWith('.b')) return 520
+  if (baseLower.endsWith('_w') || baseLower.endsWith('.w')) return 510
   if (!hasXVariant(baseLower)) return 500
-  if (baseLower.endsWith('_hd') || baseLower.endsWith('.hd')) return 450
   if (baseLower.endsWith('_c') || baseLower.endsWith('.c')) return 400
   if (isThumbnailDat(lower)) return 100
   return 350

electron/preload-env.ts

@@ -2,7 +2,7 @@ import { join, dirname } from 'path'
 
 /**
  * 强制将本地资源目录添加到 PATH 最前端，确保优先加载本地 DLL
- * 解决系统中存在冲突版本的 DLL 导致的应用崩溃问题
+ * 解决系统中存在冲突版本的数据服务导致的应用崩溃问题
  */
 function enforceLocalDllPriority() {
     const isDev = !!process.env.VITE_DEV_SERVER_URL
@@ -35,5 +35,5 @@ function enforceLocalDllPriority() {
 try {
     enforceLocalDllPriority()
 } catch (e) {
-    console.error('[WeFlow] Failed to enforce local DLL priority:', e)
+    console.error('[WeFlow] Failed to enforce local service priority:', e)
 }

electron/preload.ts

@@ -1,4 +1,4 @@
-import { contextBridge, ipcRenderer } from 'electron'
+import { contextBridge, ipcRenderer } from 'electron'
 
 // 暴露给渲染进程的 API
 contextBridge.exposeInMainWorld('electronAPI', {
@@ -13,12 +13,22 @@ contextBridge.exposeInMainWorld('electronAPI', {
   notification: {
     show: (data: any) => ipcRenderer.invoke('notification:show', data),
     close: () => ipcRenderer.invoke('notification:close'),
-    click: (sessionId: string) => ipcRenderer.send('notification-clicked', sessionId),
+    click: (payload: any) => ipcRenderer.send('notification-clicked', payload),
     ready: () => ipcRenderer.send('notification:ready'),
     resize: (width: number, height: number) => ipcRenderer.send('notification:resize', { width, height }),
     onShow: (callback: (event: any, data: any) => void) => {
       ipcRenderer.on('notification:show', callback)
       return () => ipcRenderer.removeAllListeners('notification:show')
+    }, // 监听原本发送出来的navigate-to-session事件，跳转到具体的会话
+    onNavigateToSession: (callback: (sessionId: string) => void) => {
+      const listener = (_: any, sessionId: string) => callback(sessionId)
+      ipcRenderer.on('navigate-to-session', listener)
+      return () => ipcRenderer.removeListener('navigate-to-session', listener)
+    },
+    onNavigateToRoute: (callback: (route: string) => void) => {
+      const listener = (_: any, route: string) => callback(route)
+      ipcRenderer.on('navigate-to-route', listener)
+      return () => ipcRenderer.removeListener('navigate-to-route', listener)
     }
   },
 
@@ -53,6 +63,8 @@ contextBridge.exposeInMainWorld('electronAPI', {
   app: {
     getDownloadsPath: () => ipcRenderer.invoke('app:getDownloadsPath'),
     getVersion: () => ipcRenderer.invoke('app:getVersion'),
+    getLaunchAtStartupStatus: () => ipcRenderer.invoke('app:getLaunchAtStartupStatus'),
+    setLaunchAtStartup: (enabled: boolean) => ipcRenderer.invoke('app:setLaunchAtStartup', enabled),
     checkForUpdates: () => ipcRenderer.invoke('app:checkForUpdates'),
     downloadAndInstall: () => ipcRenderer.invoke('app:downloadAndInstall'),
     ignoreUpdate: (version: string) => ipcRenderer.invoke('app:ignoreUpdate', version),
@@ -64,7 +76,6 @@ contextBridge.exposeInMainWorld('electronAPI', {
       ipcRenderer.on('app:updateAvailable', (_, info) => callback(info))
       return () => ipcRenderer.removeAllListeners('app:updateAvailable')
     },
-    checkWayland: () => ipcRenderer.invoke('app:checkWayland'),
   },
 
   // 日志
@@ -104,7 +115,7 @@ contextBridge.exposeInMainWorld('electronAPI', {
       ipcRenderer.invoke('window:respondCloseConfirm', action),
     openAgreementWindow: () => ipcRenderer.invoke('window:openAgreementWindow'),
     completeOnboarding: () => ipcRenderer.invoke('window:completeOnboarding'),
-    openOnboardingWindow: () => ipcRenderer.invoke('window:openOnboardingWindow'),
+    openOnboardingWindow: (options?: { mode?: 'add-account' }) => ipcRenderer.invoke('window:openOnboardingWindow', options),
     setTitleBarOverlay: (options: { symbolColor: string }) => ipcRenderer.send('window:setTitleBarOverlay', options),
     openVideoPlayerWindow: (videoPath: string, videoWidth?: number, videoHeight?: number) =>
       ipcRenderer.invoke('window:openVideoPlayerWindow', videoPath, videoWidth, videoHeight),
@@ -148,6 +159,17 @@ contextBridge.exposeInMainWorld('electronAPI', {
 
   },
 
+  backup: {
+    create: (payload: { outputPath: string; options?: { includeImages?: boolean; includeVideos?: boolean; includeFiles?: boolean } }) => ipcRenderer.invoke('backup:create', payload),
+    inspect: (payload: { archivePath: string }) => ipcRenderer.invoke('backup:inspect', payload),
+    restore: (payload: { archivePath: string }) => ipcRenderer.invoke('backup:restore', payload),
+    onProgress: (callback: (progress: any) => void) => {
+      const listener = (_: unknown, progress: any) => callback(progress)
+      ipcRenderer.on('backup:progress', listener)
+      return () => ipcRenderer.removeListener('backup:progress', listener)
+    }
+  },
+
   // 密钥获取
   key: {
     autoGetDbKey: () => ipcRenderer.invoke('key:autoGetDbKey'),
@@ -168,10 +190,12 @@ contextBridge.exposeInMainWorld('electronAPI', {
   chat: {
     connect: () => ipcRenderer.invoke('chat:connect'),
     getSessions: () => ipcRenderer.invoke('chat:getSessions'),
+    markAllSessionsRead: () => ipcRenderer.invoke('chat:markAllSessionsRead'),
+    getAntiRevokeSessions: () => ipcRenderer.invoke('chat:getAntiRevokeSessions'),
     getSessionStatuses: (usernames: string[]) => ipcRenderer.invoke('chat:getSessionStatuses', usernames),
     getExportTabCounts: () => ipcRenderer.invoke('chat:getExportTabCounts'),
     getContactTypeCounts: () => ipcRenderer.invoke('chat:getContactTypeCounts'),
-    getSessionMessageCounts: (sessionIds: string[]) => ipcRenderer.invoke('chat:getSessionMessageCounts', sessionIds),
+    getSessionMessageCounts: (sessionIds: string[], options?: { preferHintCache?: boolean; bypassSessionCache?: boolean }) => ipcRenderer.invoke('chat:getSessionMessageCounts', sessionIds, options),
     enrichSessionsContactInfo: (
       usernames: string[],
       options?: { skipDisplayName?: boolean; onlyMissingAvatar?: boolean }
@@ -188,6 +212,12 @@ contextBridge.exposeInMainWorld('electronAPI', {
       ipcRenderer.invoke('chat:updateMessage', sessionId, localId, createTime, newContent),
     deleteMessage: (sessionId: string, localId: number, createTime: number, dbPathHint?: string) =>
       ipcRenderer.invoke('chat:deleteMessage', sessionId, localId, createTime, dbPathHint),
+    checkAntiRevokeTriggers: (sessionIds: string[]) =>
+      ipcRenderer.invoke('chat:checkAntiRevokeTriggers', sessionIds),
+    installAntiRevokeTriggers: (sessionIds: string[]) =>
+      ipcRenderer.invoke('chat:installAntiRevokeTriggers', sessionIds),
+    uninstallAntiRevokeTriggers: (sessionIds: string[]) =>
+      ipcRenderer.invoke('chat:uninstallAntiRevokeTriggers', sessionIds),
     resolveTransferDisplayNames: (chatroomId: string, payerUsername: string, receiverUsername: string) =>
       ipcRenderer.invoke('chat:resolveTransferDisplayNames', chatroomId, payerUsername, receiverUsername),
     getMyAvatarUrl: () => ipcRenderer.invoke('chat:getMyAvatarUrl'),
@@ -207,6 +237,8 @@ contextBridge.exposeInMainWorld('electronAPI', {
         allowStaleCache?: boolean
         preferAccurateSpecialTypes?: boolean
         cacheOnly?: boolean
+        beginTimestamp?: number
+        endTimestamp?: number
       }
     ) => ipcRenderer.invoke('chat:getExportSessionStats', sessionIds, options),
     getGroupMyMessageCountHint: (chatroomId: string) =>
@@ -218,6 +250,22 @@ contextBridge.exposeInMainWorld('electronAPI', {
     getAllImageMessages: (sessionId: string) => ipcRenderer.invoke('chat:getAllImageMessages', sessionId),
     getMessageDates: (sessionId: string) => ipcRenderer.invoke('chat:getMessageDates', sessionId),
     getMessageDateCounts: (sessionId: string) => ipcRenderer.invoke('chat:getMessageDateCounts', sessionId),
+    getResourceMessages: (options?: {
+      sessionId?: string
+      types?: Array<'image' | 'video' | 'voice' | 'file'>
+      beginTimestamp?: number
+      endTimestamp?: number
+      limit?: number
+      offset?: number
+    }) => ipcRenderer.invoke('chat:getResourceMessages', options),
+    getMediaStream: (options?: {
+      sessionId?: string
+      mediaType?: 'image' | 'video' | 'all'
+      beginTimestamp?: number
+      endTimestamp?: number
+      limit?: number
+      offset?: number
+    }) => ipcRenderer.invoke('chat:getMediaStream', options),
     resolveVoiceCache: (sessionId: string, msgId: string) => ipcRenderer.invoke('chat:resolveVoiceCache', sessionId, msgId),
     getVoiceTranscript: (sessionId: string, msgId: string, createTime?: number) => ipcRenderer.invoke('chat:getVoiceTranscript', sessionId, msgId, createTime),
     onVoiceTranscriptPartial: (callback: (payload: { sessionId?: string; msgId: string; createTime?: number; text: string }) => void) => {
@@ -230,6 +278,24 @@ contextBridge.exposeInMainWorld('electronAPI', {
       ipcRenderer.invoke('chat:getMessage', sessionId, localId),
     searchMessages: (keyword: string, sessionId?: string, limit?: number, offset?: number, beginTimestamp?: number, endTimestamp?: number) =>
       ipcRenderer.invoke('chat:searchMessages', keyword, sessionId, limit, offset, beginTimestamp, endTimestamp),
+    getMyFootprintStats: (
+      beginTimestamp: number,
+      endTimestamp: number,
+      options?: {
+        myWxid?: string
+        privateSessionIds?: string[]
+        groupSessionIds?: string[]
+        mentionLimit?: number
+        privateLimit?: number
+        mentionMode?: 'text_at_me' | string
+      }
+    ) => ipcRenderer.invoke('chat:getMyFootprintStats', beginTimestamp, endTimestamp, options),
+    exportMyFootprint: (
+      beginTimestamp: number,
+      endTimestamp: number,
+      format: 'csv' | 'json',
+      filePath: string
+    ) => ipcRenderer.invoke('chat:exportMyFootprint', beginTimestamp, endTimestamp, format, filePath),
     onWcdbChange: (callback: (event: any, data: { type: string; json: string }) => void) => {
       ipcRenderer.on('wcdb-change', callback)
       return () => ipcRenderer.removeListener('wcdb-change', callback)
@@ -240,12 +306,41 @@ contextBridge.exposeInMainWorld('electronAPI', {
 
   // 图片解密
   image: {
-    decrypt: (payload: { sessionId?: string; imageMd5?: string; imageDatName?: string; force?: boolean }) =>
+    decrypt: (payload: {
+      sessionId?: string
+      imageMd5?: string
+      imageDatName?: string
+      createTime?: number
+      force?: boolean
+      preferFilePath?: boolean
+      hardlinkOnly?: boolean
+      disableUpdateCheck?: boolean
+      allowCacheIndex?: boolean
+      suppressEvents?: boolean
+    }) =>
       ipcRenderer.invoke('image:decrypt', payload),
-    resolveCache: (payload: { sessionId?: string; imageMd5?: string; imageDatName?: string }) =>
+    resolveCache: (payload: {
+      sessionId?: string
+      imageMd5?: string
+      imageDatName?: string
+      createTime?: number
+      preferFilePath?: boolean
+      hardlinkOnly?: boolean
+      disableUpdateCheck?: boolean
+      allowCacheIndex?: boolean
+      suppressEvents?: boolean
+    }) =>
       ipcRenderer.invoke('image:resolveCache', payload),
-    preload: (payloads: Array<{ sessionId?: string; imageMd5?: string; imageDatName?: string }>) =>
-      ipcRenderer.invoke('image:preload', payloads),
+    resolveCacheBatch: (
+      payloads: Array<{ sessionId?: string; imageMd5?: string; imageDatName?: string; createTime?: number; preferFilePath?: boolean; hardlinkOnly?: boolean }>,
+      options?: { disableUpdateCheck?: boolean; allowCacheIndex?: boolean; preferFilePath?: boolean; hardlinkOnly?: boolean; suppressEvents?: boolean }
+    ) => ipcRenderer.invoke('image:resolveCacheBatch', payloads, options),
+    preload: (
+      payloads: Array<{ sessionId?: string; imageMd5?: string; imageDatName?: string; createTime?: number }>,
+      options?: { allowDecrypt?: boolean; allowCacheIndex?: boolean }
+    ) => ipcRenderer.invoke('image:preload', payloads, options),
+    preloadHardlinkMd5s: (md5List: string[]) =>
+      ipcRenderer.invoke('image:preloadHardlinkMd5s', md5List),
     onUpdateAvailable: (callback: (payload: { cacheKey: string; imageMd5?: string; imageDatName?: string }) => void) => {
       const listener = (_: unknown, payload: { cacheKey: string; imageMd5?: string; imageDatName?: string }) => callback(payload)
       ipcRenderer.on('image:updateAvailable', listener)
@@ -255,15 +350,44 @@ contextBridge.exposeInMainWorld('electronAPI', {
       const listener = (_: unknown, payload: { cacheKey: string; imageMd5?: string; imageDatName?: string; localPath: string }) => callback(payload)
       ipcRenderer.on('image:cacheResolved', listener)
       return () => ipcRenderer.removeListener('image:cacheResolved', listener)
-    }
+    },
+    onDecryptProgress: (callback: (payload: {
+      cacheKey: string
+      imageMd5?: string
+      imageDatName?: string
+      stage: 'queued' | 'locating' | 'decrypting' | 'writing' | 'done' | 'failed'
+      progress: number
+      status: 'running' | 'done' | 'error'
+      message?: string
+    }) => void) => {
+      const listener = (_: unknown, payload: {
+        cacheKey: string
+        imageMd5?: string
+        imageDatName?: string
+        stage: 'queued' | 'locating' | 'decrypting' | 'writing' | 'done' | 'failed'
+        progress: number
+        status: 'running' | 'done' | 'error'
+        message?: string
+      }) => callback(payload)
+      ipcRenderer.on('image:decryptProgress', listener)
+      return () => ipcRenderer.removeListener('image:decryptProgress', listener)
+    },
+    startAutoDownload: (whitelist: string[] | string) => ipcRenderer.invoke('image:startAutoDownload', whitelist),
+    stopAutoDownload: () => ipcRenderer.invoke('image:stopAutoDownload'),
+    getAutoDownloadStatus: () => ipcRenderer.invoke('image:getAutoDownloadStatus')
   },
 
   // 视频
   video: {
-    getVideoInfo: (videoMd5: string) => ipcRenderer.invoke('video:getVideoInfo', videoMd5),
+    getVideoInfo: (videoMd5: string, options?: { includePoster?: boolean; posterFormat?: 'dataUrl' | 'fileUrl' }) => ipcRenderer.invoke('video:getVideoInfo', videoMd5, options),
     parseVideoMd5: (content: string) => ipcRenderer.invoke('video:parseVideoMd5', content)
   },
 
+  process: {
+    platform: process.platform,
+    arch: process.arch
+  },
+
   // 数据分析
   analytics: {
     getOverallStatistics: (force?: boolean) => ipcRenderer.invoke('analytics:getOverallStatistics', force),
@@ -316,6 +440,7 @@ contextBridge.exposeInMainWorld('electronAPI', {
     generateReport: (year: number) => ipcRenderer.invoke('annualReport:generateReport', year),
     exportImages: (payload: { baseDir: string; folderName: string; images: Array<{ name: string; dataUrl: string }> }) =>
       ipcRenderer.invoke('annualReport:exportImages', payload),
+    captureCurrentWindow: () => ipcRenderer.invoke('annualReport:captureCurrentWindow'),
     onAvailableYearsProgress: (callback: (payload: {
       taskId: string
       years?: number[]
@@ -352,8 +477,14 @@ contextBridge.exposeInMainWorld('electronAPI', {
   export: {
     getExportStats: (sessionIds: string[], options: any) =>
       ipcRenderer.invoke('export:getExportStats', sessionIds, options),
-    exportSessions: (sessionIds: string[], outputDir: string, options: any) =>
-      ipcRenderer.invoke('export:exportSessions', sessionIds, outputDir, options),
+    exportSessions: (sessionIds: string[], outputDir: string, options: any, controlOptions?: { taskId?: string }) =>
+      ipcRenderer.invoke('export:exportSessions', sessionIds, outputDir, options, controlOptions),
+    pauseTask: (taskId: string) =>
+      ipcRenderer.invoke('export:pauseTask', taskId),
+    resumeTask: (taskId: string) =>
+      ipcRenderer.invoke('export:resumeTask', taskId),
+    cancelTask: (taskId: string) =>
+      ipcRenderer.invoke('export:cancelTask', taskId),
     exportSession: (sessionId: string, outputPath: string, options: any) =>
       ipcRenderer.invoke('export:exportSession', sessionId, outputPath, options),
     exportContacts: (outputDir: string, options: any) =>
@@ -410,7 +541,22 @@ contextBridge.exposeInMainWorld('electronAPI', {
     uninstallBlockDeleteTrigger: () => ipcRenderer.invoke('sns:uninstallBlockDeleteTrigger'),
     checkBlockDeleteTrigger: () => ipcRenderer.invoke('sns:checkBlockDeleteTrigger'),
     deleteSnsPost: (postId: string) => ipcRenderer.invoke('sns:deleteSnsPost', postId),
-    downloadEmoji: (params: { url: string; encryptUrl?: string; aesKey?: string }) => ipcRenderer.invoke('sns:downloadEmoji', params)
+    downloadEmoji: (params: { url: string; encryptUrl?: string; aesKey?: string }) => ipcRenderer.invoke('sns:downloadEmoji', params),
+    getCacheMigrationStatus: () => ipcRenderer.invoke('sns:getCacheMigrationStatus'),
+    startCacheMigration: () => ipcRenderer.invoke('sns:startCacheMigration'),
+    onCacheMigrationProgress: (callback: (payload: any) => void) => {
+      const listener = (_event: unknown, payload: any) => callback(payload)
+      ipcRenderer.on('sns:cacheMigrationProgress', listener)
+      return () => ipcRenderer.removeListener('sns:cacheMigrationProgress', listener)
+    }
+  },
+
+  biz: {
+    listAccounts: (account?: string) => ipcRenderer.invoke('biz:listAccounts', account),
+    listMessages: (username: string, account?: string, limit?: number, offset?: number) =>
+        ipcRenderer.invoke('biz:listMessages', username, account, limit, offset),
+    listPayRecords: (account?: string, limit?: number, offset?: number) =>
+        ipcRenderer.invoke('biz:listPayRecords', account, limit, offset)
   },
 
 
@@ -426,5 +572,69 @@ contextBridge.exposeInMainWorld('electronAPI', {
     start: (port?: number, host?: string) => ipcRenderer.invoke('http:start', port, host),
     stop: () => ipcRenderer.invoke('http:stop'),
     status: () => ipcRenderer.invoke('http:status')
+  },
+
+  // AI 见解
+  insight: {
+    testConnection: () => ipcRenderer.invoke('insight:testConnection'),
+    getTodayStats: () => ipcRenderer.invoke('insight:getTodayStats'),
+    listRecords: (filters?: any) => ipcRenderer.invoke('insight:listRecords', filters),
+    getRecord: (id: string) => ipcRenderer.invoke('insight:getRecord', id),
+    markRecordRead: (id: string) => ipcRenderer.invoke('insight:markRecordRead', id),
+    clearRecords: (filters?: any) => ipcRenderer.invoke('insight:clearRecords', filters),
+    triggerTest: () => ipcRenderer.invoke('insight:triggerTest'),
+    triggerSessionInsight: (payload: {
+      sessionId: string
+      displayName?: string
+      avatarUrl?: string
+    }) => ipcRenderer.invoke('insight:triggerSessionInsight', payload),
+    generateFootprintInsight: (payload: {
+      rangeLabel: string
+      summary: {
+        private_inbound_people?: number
+        private_replied_people?: number
+        private_outbound_people?: number
+        private_reply_rate?: number
+        mention_count?: number
+        mention_group_count?: number
+      }
+      privateSegments?: Array<{ displayName?: string; session_id?: string; incoming_count?: number; outgoing_count?: number; message_count?: number; replied?: boolean }>
+      mentionGroups?: Array<{ displayName?: string; session_id?: string; count?: number }>
+    }) => ipcRenderer.invoke('insight:generateFootprintInsight', payload),
+    generateMessageInsight: (payload: {
+      sessionId: string
+      displayName?: string
+      avatarUrl?: string
+      targetLocalId?: number
+      targetCreateTime?: number
+      targetMessageKey?: string
+      targetText: string
+      targetSenderName?: string
+      contextCount?: number
+      forceRefresh?: boolean
+    }) => ipcRenderer.invoke('insight:generateMessageInsight', payload)
+  },
+
+  groupSummary: {
+    listRecords: (filters?: any) => ipcRenderer.invoke('groupSummary:listRecords', filters),
+    getRecord: (id: string) => ipcRenderer.invoke('groupSummary:getRecord', id),
+    triggerManual: (payload: {
+      sessionId: string
+      displayName?: string
+      avatarUrl?: string
+      startTime: number
+      endTime: number
+    }) => ipcRenderer.invoke('groupSummary:triggerManual', payload),
+    triggerDay: (payload: {
+      sessionId: string
+      displayName?: string
+      avatarUrl?: string
+      date: string
+    }) => ipcRenderer.invoke('groupSummary:triggerDay', payload)
+  },
+
+  social: {
+    saveWeiboCookie: (rawInput: string) => ipcRenderer.invoke('social:saveWeiboCookie', rawInput),
+    validateWeiboUid: (uid: string) => ipcRenderer.invoke('social:validateWeiboUid', uid)
   }
 })

electron/services/accountDirResolver.ts

@@ -0,0 +1,73 @@
+import { existsSync, readdirSync, statSync } from 'fs'
+import { join } from 'path'
+
+const accountDirCache = new Map<string, string>()
+
+const cleanAccountDirName = (dirName: string): string => {
+  const trimmed = dirName.trim()
+  if (!trimmed) return trimmed
+
+  if (trimmed.toLowerCase().startsWith('wxid_')) {
+    const match = trimmed.match(/^(wxid_[^_]+)/i)
+    if (match) return match[1]
+    return trimmed
+  }
+
+  const suffixMatch = trimmed.match(/^(.+)_([a-zA-Z0-9]{4})$/)
+  if (suffixMatch) return suffixMatch[1]
+
+  return trimmed
+}
+
+const isDirectory = (path: string): boolean => {
+  try {
+    return statSync(path).isDirectory()
+  } catch {
+    return false
+  }
+}
+
+export const resolveAccountDir = (dbPath?: string, wxid?: string): string | null => {
+  if (!dbPath || !wxid) return null
+
+  const cleanedWxid = cleanAccountDirName(wxid)
+  const normalized = dbPath.replace(/[\\/]+$/, '')
+  const cacheKey = `${normalized}|${cleanedWxid.toLowerCase()}`
+
+  const cached = accountDirCache.get(cacheKey)
+  if (cached && existsSync(cached)) return cached
+  if (cached && !existsSync(cached)) {
+    accountDirCache.delete(cacheKey)
+  }
+
+  const lowerWxid = cleanedWxid.toLowerCase()
+  if (!lowerWxid.startsWith('wxid_')) {
+    const direct = join(normalized, cleanedWxid)
+    if (existsSync(direct) && isDirectory(direct)) {
+      accountDirCache.set(cacheKey, direct)
+      return direct
+    }
+  }
+
+  try {
+    const entries = readdirSync(normalized)
+    for (const entry of entries) {
+      const entryPath = join(normalized, entry)
+      if (!isDirectory(entryPath)) continue
+
+      const lowerEntry = entry.toLowerCase()
+      const isExactMatch = lowerEntry === lowerWxid
+      const isSuffixMatch = lowerEntry.startsWith(`${lowerWxid}_`)
+      const shouldMatch = lowerWxid.startsWith('wxid_')
+        ? isSuffixMatch
+        : (isExactMatch || isSuffixMatch)
+
+      if (shouldMatch) {
+        accountDirCache.set(cacheKey, entryPath)
+        return entryPath
+      }
+    }
+  } catch { }
+
+  return null
+}

electron/services/analyticsService.ts

@@ -103,8 +103,10 @@ class AnalyticsService {
     if (username === 'filehelper') return false
     if (username.startsWith('gh_')) return false
 
+    if (username.toLowerCase() === 'weixin') return false
+
     const excludeList = [
-      'weixin', 'qqmail', 'fmessage', 'medianote', 'floatbottle',
+      'qqmail', 'fmessage', 'medianote', 'floatbottle',
       'newsapp', 'brandsessionholder', 'brandservicesessionholder',
       'notifymessage', 'opencustomerservicemsg', 'notification_messages',
       'userexperience_alarm', 'helper_folders', 'placeholder_foldgroup',
@@ -125,13 +127,19 @@ class AnalyticsService {
     const wxid = this.configService.get('myWxid')
     const dbPath = this.configService.get('dbPath')
     const decryptKey = this.configService.get('decryptKey')
+
     if (!wxid) return { success: false, error: '未配置微信ID' }
     if (!dbPath) return { success: false, error: '未配置数据库路径' }
     if (!decryptKey) return { success: false, error: '未配置解密密钥' }
 
-    const cleanedWxid = this.cleanAccountDirName(wxid)
-    const ok = await wcdbService.open(dbPath, decryptKey, cleanedWxid)
+    const accountDir = this.configService.getAccountDir(dbPath, wxid)
+    if (!accountDir) return { success: false, error: '未找到账号目录' }
+
+    const ok = await wcdbService.open(accountDir, decryptKey)
     if (!ok) return { success: false, error: 'WCDB 打开失败' }
+
+    const cleanedWxid = this.cleanAccountDirName(wxid)
+
     return { success: true, cleanedWxid }
   }
 
@@ -231,8 +239,7 @@ class AnalyticsService {
   }
 
   private async computeAggregateByCursor(sessionIds: string[], beginTimestamp = 0, endTimestamp = 0): Promise<any> {
-    const wxid = this.configService.get('myWxid')
-    const cleanedWxid = wxid ? this.cleanAccountDirName(wxid) : ''
+    const cleanedWxid = this.configService.getMyWxidCleaned() || ''
 
     const aggregate = {
       total: 0,
@@ -269,8 +276,7 @@ class AnalyticsService {
             const myWxidLower = cleanedWxid.toLowerCase()
             isSend = (
               senderLower === myWxidLower ||
-              // 兼容非 wxid 开头的账号（如果文件夹名带后缀，如 custom_backup，而 sender 是 custom）
-              (myWxidLower.startsWith(senderLower + '_'))
+              senderLower.startsWith(myWxidLower + '_')
             )
           }
         }

electron/services/annualReportService.ts

@@ -1,5 +1,6 @@
 import { parentPort } from 'worker_threads'
 import { wcdbService } from './wcdbService'
+import { resolveAccountDir } from './accountDirResolver'
 
 export interface TopContact {
   username: string
@@ -59,6 +60,8 @@ export interface AnnualReportData {
     initiatedChats: number
     receivedChats: number
     initiativeRate: number
+    topInitiatedFriend?: string
+    topInitiatedCount?: number
   } | null
   responseSpeed: {
     avgResponseTime: number
@@ -156,9 +159,13 @@ class AnnualReportService {
     if (!dbPath) return { success: false, error: '未配置数据库路径' }
     if (!decryptKey) return { success: false, error: '未配置解密密钥' }
 
-    const cleanedWxid = this.cleanAccountDirName(wxid)
-    const ok = await wcdbService.open(dbPath, decryptKey, cleanedWxid)
+    const accountDir = resolveAccountDir(dbPath, wxid)
+    if (!accountDir) return { success: false, error: '未找到账号目录' }
+
+    const ok = await wcdbService.open(accountDir, decryptKey)
     if (!ok) return { success: false, error: 'WCDB 打开失败' }
+
+    const cleanedWxid = this.cleanAccountDirName(wxid)
     return { success: true, cleanedWxid, rawWxid: wxid }
   }
 
@@ -168,7 +175,7 @@ class AnnualReportService {
     const rows = sessionResult.sessions as Record<string, any>[]
 
     const excludeList = [
-      'weixin', 'qqmail', 'fmessage', 'medianote', 'floatbottle',
+      'qqmail', 'fmessage', 'medianote', 'floatbottle',
       'newsapp', 'brandsessionholder', 'brandservicesessionholder',
       'notifymessage', 'opencustomerservicemsg', 'notification_messages',
       'userexperience_alarm', 'helper_folders', 'placeholder_foldgroup',
@@ -183,6 +190,7 @@ class AnnualReportService {
         if (username === 'filehelper') return false
         if (username.startsWith('gh_')) return false
         if (username.toLowerCase() === cleanedWxid.toLowerCase()) return false
+        if (username.toLowerCase() === 'weixin') return false
 
         for (const prefix of excludeList) {
           if (username.startsWith(prefix) || username === prefix) return false
@@ -1135,7 +1143,7 @@ class AnnualReportService {
 
               const now = Date.now()
               if (now - lastProgressAt > 200) {
-                let progress = 30
+                let progress: number
                 if (totalMessagesForProgress > 0) {
                   const ratio = Math.min(1, processedMessages / totalMessagesForProgress)
                   progress = 30 + Math.floor(ratio * 50)
@@ -1190,7 +1198,9 @@ class AnnualReportService {
         topLiked: { username: string; displayName: string; avatarUrl?: string; count: number }[]
       } | undefined
 
-      const snsStats = await wcdbService.getSnsAnnualStats(actualStartTime, actualEndTime)
+      const snsBeginTime = isAllTime ? 0 : actualStartTime
+      const snsEndTime = isAllTime ? Math.floor(Date.now() / 1000) : actualEndTime
+      const snsStats = await wcdbService.getSnsAnnualStats(snsBeginTime, snsEndTime)
 
       if (snsStats.success && snsStats.data) {
         const d = snsStats.data
@@ -1217,6 +1227,20 @@ class AnnualReportService {
         }
       }
 
+      // ALL YEARS 兼容：部分底层实现 begin/end 为 0 时会返回 0，兜底使用导出统计总数。
+      if (isAllTime && (!snsStatsResult || Number(snsStatsResult.totalPosts || 0) <= 0)) {
+        const snsExportStats = await wcdbService.getSnsExportStats(cleanedWxid || rawWxid)
+        if (snsExportStats.success && snsExportStats.data) {
+          const fallbackTotalPosts = Math.max(0, Number(snsExportStats.data.totalPosts || 0))
+          snsStatsResult = {
+            totalPosts: fallbackTotalPosts,
+            typeCounts: snsStatsResult?.typeCounts,
+            topLikers: snsStatsResult?.topLikers || [],
+            topLiked: snsStatsResult?.topLiked || []
+          }
+        }
+      }
+
       this.reportProgress('整理联系人信息...', 85, onProgress)
 
       const contactIds = Array.from(contactStats.keys())
@@ -1346,16 +1370,27 @@ class AnnualReportService {
       let socialInitiative: AnnualReportData['socialInitiative'] = null
       let totalInitiated = 0
       let totalReceived = 0
-      for (const stats of conversationStarts.values()) {
+      let topInitiatedSessionId = ''
+      let topInitiatedCount = 0
+      for (const [sessionId, stats] of conversationStarts.entries()) {
         totalInitiated += stats.initiated
         totalReceived += stats.received
+        if (stats.initiated > topInitiatedCount) {
+          topInitiatedCount = stats.initiated
+          topInitiatedSessionId = sessionId
+        }
       }
       const totalConversations = totalInitiated + totalReceived
       if (totalConversations > 0) {
+        const topInitiatedInfo = topInitiatedSessionId ? contactInfoMap.get(topInitiatedSessionId) : null
         socialInitiative = {
           initiatedChats: totalInitiated,
           receivedChats: totalReceived,
-          initiativeRate: Math.round((totalInitiated / totalConversations) * 1000) / 10
+          initiativeRate: Math.round((totalInitiated / totalConversations) * 1000) / 10,
+          topInitiatedFriend: topInitiatedCount > 0
+            ? (topInitiatedInfo?.displayName || topInitiatedSessionId)
+            : undefined,
+          topInitiatedCount: topInitiatedCount > 0 ? topInitiatedCount : undefined
         }
       }
 

electron/services/avatarFileCacheService.ts

@@ -0,0 +1,219 @@
+import https from "https";
+import http, { IncomingMessage } from "http";
+import { promises as fs } from "fs";
+import { join } from "path";
+import { ConfigService } from "./config";
+
+// 头像文件缓存服务 - 复用项目已有的缓存目录结构
+export class AvatarFileCacheService {
+  private static instance: AvatarFileCacheService | null = null;
+
+  // 头像文件缓存目录
+  private readonly cacheDir: string;
+  // 头像URL -> 本地文件路径的内存缓存（仅追踪正在下载的）
+  private readonly pendingDownloads: Map<string, Promise<string | null>> =
+    new Map();
+  // LRU 追踪：文件路径->最后访问时间
+  private readonly lruOrder: string[] = [];
+  private readonly maxCacheFiles = 100;
+
+  private constructor() {
+    const basePath = ConfigService.getInstance().getCacheBasePath();
+    this.cacheDir = join(basePath, "avatar-files");
+    this.ensureCacheDir();
+    this.loadLruOrder();
+  }
+
+  public static getInstance(): AvatarFileCacheService {
+    if (!AvatarFileCacheService.instance) {
+      AvatarFileCacheService.instance = new AvatarFileCacheService();
+    }
+    return AvatarFileCacheService.instance;
+  }
+
+  private ensureCacheDir(): void {
+    // 同步确保目录存在（构造函数调用）
+    try {
+      fs.mkdir(this.cacheDir, { recursive: true }).catch(() => {});
+    } catch {}
+  }
+
+  private async ensureCacheDirAsync(): Promise<void> {
+    try {
+      await fs.mkdir(this.cacheDir, { recursive: true });
+    } catch {}
+  }
+
+  private getFilePath(url: string): string {
+    // 使用URL的hash作为文件名，避免特殊字符问题
+    const hash = this.hashString(url);
+    return join(this.cacheDir, `avatar_${hash}.png`);
+  }
+
+  private hashString(str: string): string {
+    let hash = 0;
+    for (let i = 0; i < str.length; i++) {
+      const char = str.charCodeAt(i);
+      hash = (hash << 5) - hash + char;
+      hash = hash & hash; // 转换为32位整数
+    }
+    return Math.abs(hash).toString(16);
+  }
+
+  private async loadLruOrder(): Promise<void> {
+    try {
+      const entries = await fs.readdir(this.cacheDir);
+      // 按修改时间排序（旧的在前）
+      const filesWithTime: { file: string; mtime: number }[] = [];
+      for (const entry of entries) {
+        if (!entry.startsWith("avatar_") || !entry.endsWith(".png")) continue;
+        try {
+          const stat = await fs.stat(join(this.cacheDir, entry));
+          filesWithTime.push({ file: entry, mtime: stat.mtimeMs });
+        } catch {}
+      }
+      filesWithTime.sort((a, b) => a.mtime - b.mtime);
+      this.lruOrder.length = 0;
+      this.lruOrder.push(...filesWithTime.map((f) => f.file));
+    } catch {}
+  }
+
+  private updateLru(fileName: string): void {
+    const index = this.lruOrder.indexOf(fileName);
+    if (index > -1) {
+      this.lruOrder.splice(index, 1);
+    }
+    this.lruOrder.push(fileName);
+  }
+
+  private async evictIfNeeded(): Promise<void> {
+    while (this.lruOrder.length >= this.maxCacheFiles) {
+      const oldest = this.lruOrder.shift();
+      if (oldest) {
+        try {
+          await fs.rm(join(this.cacheDir, oldest));
+          console.log(`[AvatarFileCache] Evicted: ${oldest}`);
+        } catch {}
+      }
+    }
+  }
+
+  private async downloadAvatar(url: string): Promise<string | null> {
+    const localPath = this.getFilePath(url);
+
+    // 检查文件是否已存在
+    try {
+      await fs.access(localPath);
+      const fileName = localPath.split("/").pop()!;
+      this.updateLru(fileName);
+      return localPath;
+    } catch {}
+
+    await this.ensureCacheDirAsync();
+    await this.evictIfNeeded();
+
+    return new Promise<string | null>((resolve) => {
+      const options = {
+        headers: {
+          "User-Agent":
+            "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 MicroMessenger/7.0.20.1781(0x6700143B) WindowsWechat(0x63090719) XWEB/8351",
+          Referer: "https://servicewechat.com/",
+          Accept:
+            "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
+          "Accept-Encoding": "gzip, deflate, br",
+          "Accept-Language": "zh-CN,zh;q=0.9",
+          Connection: "keep-alive",
+        },
+      };
+
+      const callback = (res: IncomingMessage) => {
+        if (res.statusCode !== 200) {
+          resolve(null);
+          return;
+        }
+        const chunks: Buffer[] = [];
+        res.on("data", (chunk: Buffer) => chunks.push(chunk));
+        res.on("end", async () => {
+          try {
+            const buffer = Buffer.concat(chunks);
+            await fs.writeFile(localPath, buffer);
+            const fileName = localPath.split("/").pop()!;
+            this.updateLru(fileName);
+            console.log(
+              `[AvatarFileCache] Downloaded: ${url.substring(0, 50)}... -> ${localPath}`,
+            );
+            resolve(localPath);
+          } catch {
+            resolve(null);
+          }
+        });
+        res.on("error", () => resolve(null));
+      };
+
+      const req = url.startsWith("https")
+        ? https.get(url, options, callback)
+        : http.get(url, options, callback);
+
+      req.on("error", () => resolve(null));
+      req.setTimeout(10000, () => {
+        req.destroy();
+        resolve(null);
+      });
+    });
+  }
+
+  /**
+   * 获取头像本地文件路径，如果需要会下载
+   * 同一URL并发调用会复用同一个下载任务
+   */
+  async getAvatarPath(url: string): Promise<string | null> {
+    if (!url) return null;
+
+    // 检查是否有正在进行的下载
+    const pending = this.pendingDownloads.get(url);
+    if (pending) {
+      return pending;
+    }
+
+    // 发起新下载
+    const downloadPromise = this.downloadAvatar(url);
+    this.pendingDownloads.set(url, downloadPromise);
+
+    try {
+      const result = await downloadPromise;
+      return result;
+    } finally {
+      this.pendingDownloads.delete(url);
+    }
+  }
+
+  // 清理所有缓存文件（App退出时调用）
+  async clearCache(): Promise<void> {
+    try {
+      const entries = await fs.readdir(this.cacheDir);
+      for (const entry of entries) {
+        if (entry.startsWith("avatar_") && entry.endsWith(".png")) {
+          try {
+            await fs.rm(join(this.cacheDir, entry));
+          } catch {}
+        }
+      }
+      this.lruOrder.length = 0;
+      console.log("[AvatarFileCache] Cache cleared");
+    } catch {}
+  }
+
+  // 获取当前缓存的文件数量
+  async getCacheCount(): Promise<number> {
+    try {
+      const entries = await fs.readdir(this.cacheDir);
+      return entries.filter(
+        (e) => e.startsWith("avatar_") && e.endsWith(".png"),
+      ).length;
+    } catch {
+      return 0;
+    }
+  }
+}
+
+export const avatarFileCache = AvatarFileCacheService.getInstance();

electron/services/bizService.ts

@@ -0,0 +1,250 @@
+import { join } from 'path'
+import { readdirSync, existsSync } from 'fs'
+import { wcdbService } from './wcdbService'
+import { ConfigService } from './config'
+import { chatService, Message } from './chatService'
+import { ipcMain } from 'electron'
+import { createHash } from 'crypto'
+
+export interface BizAccount {
+  username: string
+  name: string
+  avatar: string
+  type: number
+  last_time: number
+  formatted_last_time: string
+  unread_count?: number
+}
+
+export interface BizMessage {
+  local_id: number
+  create_time: number
+  title: string
+  des: string
+  url: string
+  cover: string
+  content_list: any[]
+}
+
+export interface BizPayRecord {
+  local_id: number
+  create_time: number
+  title: string
+  description: string
+  merchant_name: string
+  merchant_icon: string
+  timestamp: number
+  formatted_time: string
+}
+
+export class BizService {
+  private configService: ConfigService
+
+  constructor() {
+    this.configService = new ConfigService()
+  }
+
+  private extractXmlValue(xml: string, tagName: string): string {
+    const regex = new RegExp(`<${tagName}>([\\s\\S]*?)</${tagName}>`, 'i')
+    const match = regex.exec(xml)
+    if (match) {
+      return match[1].replace(/<!\[CDATA\[/g, '').replace(/\]\]>/g, '').trim()
+    }
+    return ''
+  }
+
+  private parseBizContentList(xmlStr: string): any[] {
+    if (!xmlStr) return []
+    const contentList: any[] = []
+    try {
+      const itemRegex = /<item>([\s\S]*?)<\/item>/gi
+      let match: RegExpExecArray | null
+      while ((match = itemRegex.exec(xmlStr)) !== null) {
+        const itemXml = match[1]
+        const itemStruct = {
+          title: this.extractXmlValue(itemXml, 'title'),
+          url: this.extractXmlValue(itemXml, 'url'),
+          cover: this.extractXmlValue(itemXml, 'cover') || this.extractXmlValue(itemXml, 'thumburl'),
+          summary: this.extractXmlValue(itemXml, 'summary') || this.extractXmlValue(itemXml, 'digest')
+        }
+        if (itemStruct.title) contentList.push(itemStruct)
+      }
+    } catch (e) { }
+    return contentList
+  }
+
+  private parsePayXml(xmlStr: string): any {
+    if (!xmlStr) return null
+    try {
+      const title = this.extractXmlValue(xmlStr, 'title')
+      const description = this.extractXmlValue(xmlStr, 'des')
+      const merchantName = this.extractXmlValue(xmlStr, 'display_name') || '微信支付'
+      const merchantIcon = this.extractXmlValue(xmlStr, 'icon_url')
+      const pubTime = parseInt(this.extractXmlValue(xmlStr, 'pub_time') || '0')
+      if (!title && !description) return null
+      return { title, description, merchant_name: merchantName, merchant_icon: merchantIcon, timestamp: pubTime }
+    } catch (e) { return null }
+  }
+
+  async listAccounts(account?: string): Promise<BizAccount[]> {
+    try {
+      // 1. 获取公众号联系人列表
+      const contactsResult = await chatService.getContacts({ lite: true })
+      if (!contactsResult.success || !contactsResult.contacts) return []
+
+      const officialContacts = contactsResult.contacts.filter(c => c.type === 'official')
+      const usernames = officialContacts.map(c => c.username)
+
+      // 获取头像和昵称等补充信息
+      const enrichment = await chatService.enrichSessionsContactInfo(usernames)
+      const contactInfoMap = enrichment.success && enrichment.contacts ? enrichment.contacts : {}
+
+      const root = this.configService.get('dbPath')
+      const myWxid = this.configService.getMyWxidCleaned()
+      const accountWxid = account || myWxid
+      if (!root || !accountWxid) return []
+
+      const bizLatestTime: Record<string, number> = {}
+      const bizUnreadCount: Record<string, number> = {}
+
+      try {
+        const sessionsRes = await chatService.getSessions()
+        if (sessionsRes.success && sessionsRes.sessions) {
+          for (const session of sessionsRes.sessions) {
+            const uname = session.username || session.strUsrName || session.userName || session.id
+            // 适配日志中发现的字段，注意转为整型数字
+            const timeStr = session.lastTimestamp || session.sortTimestamp || session.last_timestamp || session.sort_timestamp || session.nTime || session.timestamp || '0'
+            const time = parseInt(timeStr.toString(), 10)
+
+            if (usernames.includes(uname) && time > 0) {
+              bizLatestTime[uname] = time
+            }
+            if (usernames.includes(uname)) {
+              const unread = Number(session.unreadCount ?? session.unread_count ?? 0)
+              bizUnreadCount[uname] = Number.isFinite(unread) ? Math.max(0, Math.floor(unread)) : 0
+            }
+          }
+        }
+      } catch (e) {
+        console.error('获取 Sessions 失败:', e)
+      }
+
+      // 3. 格式化时间显示
+      const formatBizTime = (ts: number) => {
+        if (!ts) return ''
+        const date = new Date(ts * 1000)
+        const now = new Date()
+        const isToday = date.toDateString() === now.toDateString()
+        if (isToday) return date.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit', hour12: false })
+
+        const yesterday = new Date(now)
+        yesterday.setDate(now.getDate() - 1)
+        if (date.toDateString() === yesterday.toDateString()) return '昨天'
+
+        const isThisYear = date.getFullYear() === now.getFullYear()
+        if (isThisYear) return `${date.getMonth() + 1}/${date.getDate()}`
+
+        return `${date.getFullYear().toString().slice(-2)}/${date.getMonth() + 1}/${date.getDate()}`
+      }
+
+      // 4. 组装数据
+      const result: BizAccount[] = officialContacts.map(contact => {
+        const uname = contact.username
+        const info = contactInfoMap[uname]
+        const lastTime = bizLatestTime[uname] || 0
+        return {
+          username: uname,
+          name: info?.displayName || contact.displayName || uname,
+          avatar: info?.avatarUrl || '',
+          type: 0,
+          last_time: lastTime,
+          formatted_last_time: formatBizTime(lastTime),
+          unread_count: bizUnreadCount[uname] || 0
+        }
+      })
+
+      // 5. 补充公众号类型 (订阅号/服务号)
+      const contactDbPath = join(root, accountWxid, 'db_storage', 'contact', 'contact.db')
+      if (existsSync(contactDbPath)) {
+        const bizInfoRes = await wcdbService.execQuery('contact', contactDbPath, 'SELECT username, type FROM biz_info')
+        if (bizInfoRes.success && bizInfoRes.rows) {
+          const typeMap: Record<string, number> = {}
+          for (const r of bizInfoRes.rows) typeMap[r.username] = r.type
+          for (const acc of result) if (typeMap[acc.username] !== undefined) acc.type = typeMap[acc.username]
+        }
+      }
+
+      // 6. 排序输出
+      return result
+          .filter(acc => !acc.name.includes('广告'))
+          .sort((a, b) => {
+            if (a.username === 'gh_3dfda90e39d6') return -1 // 微信支付置顶
+            if (b.username === 'gh_3dfda90e39d6') return 1
+            return b.last_time - a.last_time // 按最新时间降序排列
+          })
+    } catch (e) {
+      console.error('获取账号列表发生错误:', e)
+      return []
+    }
+  }
+
+  async listMessages(username: string, account?: string, limit: number = 20, offset: number = 0): Promise<BizMessage[]> {
+    try {
+      // 仅保留核心路径：利用 chatService 的自动路由能力
+      const res = await chatService.getMessages(username, offset, limit)
+      if (!res.success || !res.messages) return []
+
+      return res.messages.map(msg => {
+        const bizMsg: BizMessage = {
+          local_id: msg.localId,
+          create_time: msg.createTime,
+          title: msg.linkTitle || msg.parsedContent || '',
+          des: msg.appMsgDesc || '',
+          url: msg.linkUrl || '',
+          cover: msg.linkThumb || msg.appMsgThumbUrl || '',
+          content_list: []
+        }
+        if (msg.rawContent) {
+          bizMsg.content_list = this.parseBizContentList(msg.rawContent)
+          if (bizMsg.content_list.length > 0 && !bizMsg.title) {
+            bizMsg.title = bizMsg.content_list[0].title
+            bizMsg.cover = bizMsg.cover || bizMsg.content_list[0].cover
+          }
+        }
+        return bizMsg
+      })
+    } catch (e) { return [] }
+  }
+
+  async listPayRecords(account?: string, limit: number = 20, offset: number = 0): Promise<BizPayRecord[]> {
+    const username = 'gh_3dfda90e39d6'
+    try {
+      const res = await chatService.getMessages(username, offset, limit)
+      if (!res.success || !res.messages) return []
+
+      const records: BizPayRecord[] = []
+      for (const msg of res.messages) {
+        if (!msg.rawContent) continue
+        const parsedData = this.parsePayXml(msg.rawContent)
+        if (parsedData) {
+          records.push({
+            local_id: msg.localId,
+            create_time: msg.createTime,
+            ...parsedData,
+            timestamp: parsedData.timestamp || msg.createTime,
+            formatted_time: new Date((parsedData.timestamp || msg.createTime) * 1000).toLocaleString()
+          })
+        }
+      }
+      return records
+    } catch (e) { return [] }
+  }
+
+  registerHandlers() {
+    ipcMain.handle('biz:listAccounts', (_, account) => this.listAccounts(account))
+    ipcMain.handle('biz:listMessages', (_, username, account, limit, offset) => this.listMessages(username, account, limit, offset))
+    ipcMain.handle('biz:listPayRecords', (_, account, limit, offset) => this.listPayRecords(account, limit, offset))
+  }
+}
+
+export const bizService = new BizService()

electron/services/cloudControlService.ts

@@ -15,15 +15,31 @@ class CloudControlService {
   private timer: NodeJS.Timeout | null = null
   private pages: Set<string> = new Set()
   private platformVersionCache: string | null = null
+  private pendingReports: UsageStats[] = []
+  private flushInProgress = false
+  private retryDelayMs = 5_000
+  private consecutiveFailures = 0
+  private circuitOpenedAt = 0
+  private nextDelayOverrideMs: number | null = null
+  private initialized = false
+
+  private static readonly BASE_FLUSH_MS = 300_000
+  private static readonly JITTER_MS = 30_000
+  private static readonly MAX_BUFFER_REPORTS = 200
+  private static readonly MAX_BATCH_REPORTS = 20
+  private static readonly MAX_RETRY_MS = 120_000
+  private static readonly CIRCUIT_FAIL_THRESHOLD = 5
+  private static readonly CIRCUIT_COOLDOWN_MS = 120_000
 
   async init() {
+    if (this.initialized) return
+    this.initialized = true
     this.deviceId = this.getDeviceId()
     await wcdbService.cloudInit(300)
-    await this.reportOnline()
-
-    this.timer = setInterval(() => {
-      this.reportOnline()
-    }, 300000)
+    this.enqueueCurrentReport()
+    await this.flushQueue(true)
+    this.scheduleNextFlush(this.nextDelayOverrideMs ?? undefined)
+    this.nextDelayOverrideMs = null
   }
 
   private getDeviceId(): string {
@@ -33,8 +49,8 @@ class CloudControlService {
     return crypto.createHash('md5').update(machineId).digest('hex')
   }
 
-  private async reportOnline() {
-    const data: UsageStats = {
+  private buildCurrentReport(): UsageStats {
+    return {
       appVersion: app.getVersion(),
       platform: this.getPlatformVersion(),
       deviceId: this.deviceId,
@@ -42,11 +58,69 @@ class CloudControlService {
       online: true,
       pages: Array.from(this.pages)
     }
+  }
 
-    await wcdbService.cloudReport(JSON.stringify(data))
+  private enqueueCurrentReport() {
+    const report = this.buildCurrentReport()
+    this.pendingReports.push(report)
+    if (this.pendingReports.length > CloudControlService.MAX_BUFFER_REPORTS) {
+      this.pendingReports.splice(0, this.pendingReports.length - CloudControlService.MAX_BUFFER_REPORTS)
+    }
     this.pages.clear()
   }
 
+  private isCircuitOpen(nowMs: number): boolean {
+    if (this.circuitOpenedAt <= 0) return false
+    return nowMs-this.circuitOpenedAt < CloudControlService.CIRCUIT_COOLDOWN_MS
+  }
+
+  private scheduleNextFlush(delayMs?: number) {
+    if (this.timer) {
+      clearTimeout(this.timer)
+      this.timer = null
+    }
+    const jitter = Math.floor(Math.random() * CloudControlService.JITTER_MS)
+    const nextDelay = Math.max(1_000, Number(delayMs) > 0 ? Number(delayMs) : CloudControlService.BASE_FLUSH_MS + jitter)
+    this.timer = setTimeout(() => {
+      this.enqueueCurrentReport()
+      this.flushQueue(false).finally(() => {
+        this.scheduleNextFlush(this.nextDelayOverrideMs ?? undefined)
+        this.nextDelayOverrideMs = null
+      })
+    }, nextDelay)
+  }
+
+  private async flushQueue(force: boolean) {
+    if (this.flushInProgress) return
+    if (this.pendingReports.length === 0) return
+    const now = Date.now()
+    if (!force && this.isCircuitOpen(now)) {
+      return
+    }
+    this.flushInProgress = true
+    try {
+      while (this.pendingReports.length > 0) {
+        const batch = this.pendingReports.slice(0, CloudControlService.MAX_BATCH_REPORTS)
+        const result = await wcdbService.cloudReport(JSON.stringify(batch))
+        if (!result || result.success !== true) {
+          this.consecutiveFailures += 1
+          this.retryDelayMs = Math.min(CloudControlService.MAX_RETRY_MS, this.retryDelayMs * 2)
+          if (this.consecutiveFailures >= CloudControlService.CIRCUIT_FAIL_THRESHOLD) {
+            this.circuitOpenedAt = Date.now()
+          }
+          this.nextDelayOverrideMs = this.retryDelayMs
+          return
+        }
+        this.pendingReports.splice(0, batch.length)
+        this.consecutiveFailures = 0
+        this.retryDelayMs = 5_000
+        this.circuitOpenedAt = 0
+      }
+    } finally {
+      this.flushInProgress = false
+    }
+  }
+
   private getPlatformVersion(): string {
     if (this.platformVersionCache) {
       return this.platformVersionCache
@@ -144,12 +218,25 @@ class CloudControlService {
     this.pages.add(pageName)
   }
 
-  stop() {
+  async stop(): Promise<void> {
     if (this.timer) {
-      clearInterval(this.timer)
+      clearTimeout(this.timer)
       this.timer = null
     }
-    wcdbService.cloudStop()
+    this.pendingReports = []
+    this.flushInProgress = false
+    this.retryDelayMs = 5_000
+    this.consecutiveFailures = 0
+    this.circuitOpenedAt = 0
+    this.nextDelayOverrideMs = null
+    this.initialized = false
+    if (wcdbService.isReady()) {
+      try {
+        await wcdbService.cloudStop()
+      } catch {
+        // 忽略停止失败，避免阻塞主进程退出
+      }
+    }
   }
 
   async getLogs() {
@@ -158,4 +245,3 @@ class CloudControlService {
 }
 
 export const cloudControlService = new CloudControlService()
-

electron/services/config.ts

@@ -1,10 +1,32 @@
-import { join } from 'path'
-import { app, safeStorage } from 'electron'
+import { join } from 'path'
+import { existsSync, readdirSync, statSync } from 'fs'
 import crypto from 'crypto'
 import Store from 'electron-store'
+import { expandHomePath } from '../utils/pathUtils'
+
+// 条件导入 electron（Worker 环境中不可用）
+let app: any = null
+let safeStorage: any = null
+const isWorkerThread = process.env.WEFLOW_WORKER === '1'
+if (!isWorkerThread) {
+  try {
+    const electron = require('electron')
+    app = electron.app
+    safeStorage = electron.safeStorage
+  } catch {
+    // Worker 环境中 electron 不可用
+  }
+}
 
 // 加密前缀标记
 const SAFE_PREFIX = 'safe:'  // safeStorage 加密（普通模式）
+const isSafeStorageAvailable = (): boolean => {
+  try {
+    return typeof safeStorage?.isEncryptionAvailable === 'function' && safeStorage.isEncryptionAvailable()
+  } catch {
+    return false
+  }
+}
 const LOCK_PREFIX = 'lock:'  // 密码派生密钥加密（锁定模式）
 
 interface ConfigSchema {
@@ -27,6 +49,8 @@ interface ConfigSchema {
   themeId: string
   language: string
   logEnabled: boolean
+  launchAtStartup?: boolean
+  silentStartup?: boolean
   llmModelPath: string
   whisperModelName: string
   whisperModelDir: string
@@ -34,7 +58,6 @@ interface ConfigSchema {
   autoTranscribeVoice: boolean
   transcribeLanguages: string[]
   exportDefaultConcurrency: number
-  exportDefaultImageDeepSearchOnMiss: boolean
   analyticsExcludedUsernames: string[]
 
   // 安全相关
@@ -45,13 +68,17 @@ interface ConfigSchema {
 
   // 更新相关
   ignoredUpdateVersion: string
+  updateChannel: 'auto' | 'stable' | 'preview' | 'dev'
 
   // 通知
   notificationEnabled: boolean
+  aiInsightNotificationEnabled: boolean
   notificationPosition: 'top-right' | 'top-left' | 'bottom-right' | 'bottom-left' | 'top-center'
   notificationFilterMode: 'all' | 'whitelist' | 'blacklist'
   notificationFilterList: string[]
   messagePushEnabled: boolean
+  messagePushFilterMode: 'all' | 'whitelist' | 'blacklist'
+  messagePushFilterList: string[]
   httpApiEnabled: boolean
   httpApiPort: number
   httpApiHost: string
@@ -59,10 +86,73 @@ interface ConfigSchema {
   windowCloseBehavior: 'ask' | 'tray' | 'quit'
   quoteLayout: 'quote-top' | 'quote-bottom'
   wordCloudExcludeWords: string[]
+  exportWriteLayout: 'A' | 'B' | 'C'
+  exportAutomationTaskMap: Record<string, unknown>
+
+  // AI 见解
+  aiModelApiBaseUrl: string
+  aiModelApiKey: string
+  aiModelApiModel: string
+  aiModelApiMaxTokens: number
+  aiInsightEnabled: boolean
+  aiInsightApiBaseUrl: string
+  aiInsightApiKey: string
+  aiInsightApiModel: string
+  aiInsightSilenceDays: number
+  aiInsightAllowContext: boolean
+  aiInsightAllowMomentsContext: boolean
+  aiInsightMomentsContextCount: number
+  aiInsightMomentsBindings: Record<string, { enabled: boolean; updatedAt: number }>
+  aiInsightAllowSocialContext: boolean
+  aiInsightSocialContextCount: number
+  aiInsightWeiboCookie: string
+  aiInsightWeiboBindings: Record<string, { uid: string; screenName?: string; updatedAt: number }>
+  aiInsightFilterMode: 'whitelist' | 'blacklist'
+  aiInsightFilterList: string[]
+  aiInsightWhitelistEnabled: boolean
+  aiInsightWhitelist: string[]
+  /** 活跃分析冷却时间（分钟），0 表示无冷却 */
+  aiInsightCooldownMinutes: number
+  /** 沉默联系人扫描间隔（小时） */
+  aiInsightScanIntervalHours: number
+  /** 发送上下文时的最大消息条数 */
+  aiInsightContextCount: number
+  /** 自定义 system prompt，空字符串表示使用内置默认值 */
+  aiInsightSystemPrompt: string
+  /** 是否启用 Telegram 推送 */
+  aiInsightTelegramEnabled: boolean
+  /** Telegram Bot Token */
+  aiInsightTelegramToken: string
+  /** Telegram 接收 Chat ID，逗号分隔，支持多个 */
+  aiInsightTelegramChatIds: string
+
+  // AI 足迹
+  aiFootprintEnabled: boolean
+  aiFootprintSystemPrompt: string
+  aiGroupSummaryEnabled: boolean
+  aiGroupSummaryIntervalHours: number
+  aiGroupSummarySystemPrompt: string
+  aiGroupSummaryFilterMode: 'whitelist' | 'blacklist'
+  aiGroupSummaryFilterList: string[]
+  aiMessageInsightEnabled: boolean
+  aiMessageInsightContextCount: number
+  aiMessageInsightSystemPrompt: string
+  /** 是否将 AI 见解调试日志输出到桌面 */
+  aiInsightDebugLogEnabled: boolean
+  autoDownloadHighRes: boolean
+  autoDownloadWhitelist: string[]
 }
 
 // 需要 safeStorage 加密的字段（普通模式）
-const ENCRYPTED_STRING_KEYS: Set<string> = new Set(['decryptKey', 'imageAesKey', 'authPassword', 'httpApiToken'])
+const ENCRYPTED_STRING_KEYS: Set<string> = new Set([
+  'decryptKey',
+  'imageAesKey',
+  'authPassword',
+  'httpApiToken',
+  'aiModelApiKey',
+  'aiInsightApiKey',
+  'aiInsightWeiboCookie'
+])
 const ENCRYPTED_BOOL_KEYS: Set<string> = new Set(['authEnabled', 'authUseHello'])
 const ENCRYPTED_NUMBER_KEYS: Set<string> = new Set(['imageXorKey'])
 
@@ -78,6 +168,9 @@ export class ConfigService {
   private unlockedKeys: Map<string, any> = new Map()
   private unlockPassword: string | null = null
 
+  // 账号目录缓存
+  private accountDirCache: Map<string, string> = new Map()
+
   static getInstance(): ConfigService {
     if (!ConfigService.instance) {
       ConfigService.instance = new ConfigService()
@@ -105,6 +198,7 @@ export class ConfigService {
       themeId: 'cloud-dancer',
       language: 'zh-CN',
       logEnabled: false,
+      silentStartup: false,
       llmModelPath: '',
       whisperModelName: 'base',
       whisperModelDir: '',
@@ -112,14 +206,15 @@ export class ConfigService {
       autoTranscribeVoice: false,
       transcribeLanguages: ['zh'],
       exportDefaultConcurrency: 4,
-      exportDefaultImageDeepSearchOnMiss: true,
       analyticsExcludedUsernames: [],
       authEnabled: false,
       authPassword: '',
       authUseHello: false,
       authHelloSecret: '',
       ignoredUpdateVersion: '',
+      updateChannel: 'auto',
       notificationEnabled: true,
+      aiInsightNotificationEnabled: true,
       notificationPosition: 'top-right',
       notificationFilterMode: 'all',
       notificationFilterList: [],
@@ -128,9 +223,54 @@ export class ConfigService {
       httpApiPort: 5031,
       httpApiHost: '127.0.0.1',
       messagePushEnabled: false,
+      messagePushFilterMode: 'all',
+      messagePushFilterList: [],
       windowCloseBehavior: 'ask',
       quoteLayout: 'quote-top',
-      wordCloudExcludeWords: []
+      wordCloudExcludeWords: [],
+      exportWriteLayout: 'A',
+      exportAutomationTaskMap: {},
+      aiModelApiBaseUrl: '',
+      aiModelApiKey: '',
+      aiModelApiModel: 'gpt-4o-mini',
+      aiModelApiMaxTokens: 1024,
+      aiInsightEnabled: false,
+      aiInsightApiBaseUrl: '',
+      aiInsightApiKey: '',
+      aiInsightApiModel: 'gpt-4o-mini',
+      aiInsightSilenceDays: 3,
+      aiInsightAllowContext: false,
+      aiInsightAllowMomentsContext: false,
+      aiInsightMomentsContextCount: 5,
+      aiInsightMomentsBindings: {},
+      aiInsightAllowSocialContext: false,
+      aiInsightFilterMode: 'whitelist',
+      aiInsightFilterList: [],
+      aiInsightWhitelistEnabled: false,
+      aiInsightWhitelist: [],
+      aiInsightCooldownMinutes: 120,
+      aiInsightScanIntervalHours: 4,
+      aiInsightContextCount: 40,
+      aiInsightSocialContextCount: 3,
+      aiInsightSystemPrompt: '',
+      aiInsightTelegramEnabled: false,
+      aiInsightTelegramToken: '',
+      aiInsightTelegramChatIds: '',
+      aiInsightWeiboCookie: '',
+      aiInsightWeiboBindings: {},
+      aiFootprintEnabled: false,
+      aiFootprintSystemPrompt: '',
+      aiGroupSummaryEnabled: false,
+      aiGroupSummaryIntervalHours: 4,
+      aiGroupSummarySystemPrompt: '',
+      aiGroupSummaryFilterMode: 'whitelist',
+      aiGroupSummaryFilterList: [],
+      aiMessageInsightEnabled: false,
+      aiMessageInsightContextCount: 50,
+      aiMessageInsightSystemPrompt: '',
+      aiInsightDebugLogEnabled: false,
+      autoDownloadHighRes: false,
+      autoDownloadWhitelist: []
     }
 
     const storeOptions: any = {
@@ -162,6 +302,7 @@ export class ConfigService {
       }
     }
     this.migrateAuthFields()
+    this.migrateAiConfig()
   }
 
   // === 状态查询 ===
@@ -211,6 +352,10 @@ export class ConfigService {
       return this.decryptWxidConfigs(raw as any) as ConfigSchema[K]
     }
 
+    if (key === 'dbPath' && typeof raw === 'string') {
+      return expandHomePath(raw) as ConfigSchema[K]
+    }
+
     return raw
   }
 
@@ -218,8 +363,14 @@ export class ConfigService {
     let toStore = value
     const inLockMode = this.isLockMode() && this.unlockPassword
 
+    if (key === 'dbPath' && typeof value === 'string') {
+      toStore = expandHomePath(value) as ConfigSchema[K]
+    }
+
     if (ENCRYPTED_BOOL_KEYS.has(key)) {
-      toStore = this.safeEncrypt(String(value)) as ConfigSchema[K]
+      const boolValue = value === true || value === 'true'
+      // `false` 不需要写入 keychain，避免无意义触发 macOS 钥匙串弹窗
+      toStore = (boolValue ? this.safeEncrypt('true') : false) as ConfigSchema[K]
     } else if (ENCRYPTED_NUMBER_KEYS.has(key)) {
       if (inLockMode && LOCKABLE_NUMBER_KEYS.has(key)) {
         toStore = this.lockEncrypt(String(value), this.unlockPassword!) as ConfigSchema[K]
@@ -252,7 +403,7 @@ export class ConfigService {
   private safeEncrypt(plaintext: string): string {
     if (!plaintext) return ''
     if (plaintext.startsWith(SAFE_PREFIX)) return plaintext
-    if (!safeStorage.isEncryptionAvailable()) return plaintext
+    if (!isSafeStorageAvailable()) return plaintext
     const encrypted = safeStorage.encryptString(plaintext)
     return SAFE_PREFIX + encrypted.toString('base64')
   }
@@ -260,7 +411,7 @@ export class ConfigService {
   private safeDecrypt(stored: string): string {
     if (!stored) return ''
     if (!stored.startsWith(SAFE_PREFIX)) return stored
-    if (!safeStorage.isEncryptionAvailable()) return ''
+    if (!isSafeStorageAvailable()) return ''
     try {
       const buf = Buffer.from(stored.slice(SAFE_PREFIX.length), 'base64')
       return safeStorage.decryptString(buf)
@@ -598,7 +749,7 @@ export class ConfigService {
 
   clearHelloSecret(): void {
     this.store.set('authHelloSecret', '' as any)
-    this.store.set('authUseHello', this.safeEncrypt('false') as any)
+    this.store.set('authUseHello', false as any)
   }
 
   // === 迁移 ===
@@ -607,13 +758,18 @@ export class ConfigService {
     // 将旧版明文 auth 字段迁移为 safeStorage 加密格式
     // 如果已经是 safe: 或 lock: 前缀则跳过
     const rawEnabled: any = this.store.get('authEnabled')
-    if (typeof rawEnabled === 'boolean') {
-      this.store.set('authEnabled', this.safeEncrypt(String(rawEnabled)) as any)
+    if (rawEnabled === true || rawEnabled === 'true') {
+      this.store.set('authEnabled', this.safeEncrypt('true') as any)
+    } else if (rawEnabled === false || rawEnabled === 'false') {
+      // 保持 false 为明文布尔，避免冷启动访问 keychain
+      this.store.set('authEnabled', false as any)
     }
 
     const rawUseHello: any = this.store.get('authUseHello')
-    if (typeof rawUseHello === 'boolean') {
-      this.store.set('authUseHello', this.safeEncrypt(String(rawUseHello)) as any)
+    if (rawUseHello === true || rawUseHello === 'true') {
+      this.store.set('authUseHello', this.safeEncrypt('true') as any)
+    } else if (rawUseHello === false || rawUseHello === 'false') {
+      this.store.set('authUseHello', false as any)
     }
 
     const rawPassword: any = this.store.get('authPassword')
@@ -659,6 +815,32 @@ export class ConfigService {
     }
   }
 
+  private migrateAiConfig(): void {
+    const sharedBaseUrl = String(this.get('aiModelApiBaseUrl') || '').trim()
+    const sharedApiKey = String(this.get('aiModelApiKey') || '').trim()
+    const sharedModel = String(this.get('aiModelApiModel') || '').trim()
+
+    const legacyBaseUrl = String(this.get('aiInsightApiBaseUrl') || '').trim()
+    const legacyApiKey = String(this.get('aiInsightApiKey') || '').trim()
+    const legacyModel = String(this.get('aiInsightApiModel') || '').trim()
+
+    if (!sharedBaseUrl && legacyBaseUrl) {
+      this.set('aiModelApiBaseUrl', legacyBaseUrl)
+    }
+    if (!sharedApiKey && legacyApiKey) {
+      this.set('aiModelApiKey', legacyApiKey)
+    }
+    if (!sharedModel && legacyModel) {
+      this.set('aiModelApiModel', legacyModel)
+    }
+
+    const groupSummaryFilterMode = String(this.store.get('aiGroupSummaryFilterMode' as any) || '').trim()
+    if (groupSummaryFilterMode === 'blacklist') {
+      this.store.set('aiGroupSummaryFilterList' as any, [] as any)
+      this.store.set('aiGroupSummaryFilterMode' as any, 'whitelist' as any)
+    }
+  }
+
   // === 验证 ===
 
   verifyAuthEnabled(): boolean {
@@ -677,6 +859,14 @@ export class ConfigService {
 
   // === 工具方法 ===
 
+  /**
+   * 获取当前用户 wxid（清洗后，不带后缀）
+   */
+  getMyWxidCleaned(): string {
+    const wxid = this.get('myWxid')
+    return wxid ? this.cleanAccountDirName(wxid) : ''
+  }
+
   /**
    * 获取当前 wxid 对应的图片密钥，优先从 wxidConfigs 中取，找不到则回退到全局配置
    */
@@ -698,6 +888,99 @@ export class ConfigService {
     }
   }
 
+  /**
+   * 清理账号目录名称（移除后缀）
+   */
+  private cleanAccountDirName(dirName: string): string {
+    const trimmed = dirName.trim()
+    if (!trimmed) return trimmed
+
+    // wxid_ 开头的特殊处理
+    if (trimmed.toLowerCase().startsWith('wxid_')) {
+      const match = trimmed.match(/^(wxid_[^_]+)/i)
+      if (match) return match[1]
+      return trimmed
+    }
+
+    // 移除4位后缀
+    const suffixMatch = trimmed.match(/^(.+)_([a-zA-Z0-9]{4})$/)
+    if (suffixMatch) return suffixMatch[1]
+
+    return trimmed
+  }
+
+  /**
+   * 检查是否是目录
+   */
+  private isDirectory(path: string): boolean {
+    try {
+      return statSync(path).isDirectory()
+    } catch {
+      return false
+    }
+  }
+
+  /**
+   * 获取账号目录路径
+   * 统一的账号目录解析方法，所有服务应该使用此方法而不是自己实现
+   *
+   * @param dbPath 数据库根目录（可选，默认从配置读取）
+   * @param wxid 微信ID（可选，默认从配置读取）
+   * @returns 账号目录的完整路径，如果找不到返回 null
+   */
+  getAccountDir(dbPath?: string, wxid?: string): string | null {
+    const actualDbPath = dbPath || this.get('dbPath')
+    const actualWxid = wxid || this.get('myWxid')
+
+    if (!actualDbPath || !actualWxid) return null
+
+    const cleanedWxid = this.cleanAccountDirName(actualWxid)
+    const normalized = actualDbPath.replace(/[\\/]+$/, '')
+    const cacheKey = `${normalized}|${cleanedWxid.toLowerCase()}`
+
+    // 检查缓存
+    const cached = this.accountDirCache.get(cacheKey)
+    if (cached && existsSync(cached)) return cached
+    if (cached && !existsSync(cached)) {
+      this.accountDirCache.delete(cacheKey)
+    }
+
+    // 尝试直接路径（非 wxid_ 开头的账号）
+    const lowerWxid = cleanedWxid.toLowerCase()
+    if (!lowerWxid.startsWith('wxid_')) {
+      const direct = join(normalized, cleanedWxid)
+      if (existsSync(direct) && this.isDirectory(direct)) {
+        this.accountDirCache.set(cacheKey, direct)
+        return direct
+      }
+    }
+
+    // 扫描目录查找匹配的账号目录
+    try {
+      const entries = readdirSync(normalized)
+      for (const entry of entries) {
+        const entryPath = join(normalized, entry)
+        if (!this.isDirectory(entryPath)) continue
+
+        const lowerEntry = entry.toLowerCase()
+        const isExactMatch = lowerEntry === lowerWxid
+        const isSuffixMatch = lowerEntry.startsWith(`${lowerWxid}_`)
+
+        // wxid_ 开头只接受带后缀的目录；其他账号精确匹配或带后缀都可以
+        const shouldMatch = lowerWxid.startsWith('wxid_')
+          ? isSuffixMatch
+          : (isExactMatch || isSuffixMatch)
+
+        if (shouldMatch) {
+          this.accountDirCache.set(cacheKey, entryPath)
+          return entryPath
+        }
+      }
+    } catch { }
+
+    return null
+  }
+
   private getUserDataPath(): string {
     const workerUserDataPath = String(process.env.WEFLOW_USER_DATA_PATH || process.env.WEFLOW_CONFIG_CWD || '').trim()
     if (workerUserDataPath) {
@@ -720,3 +1003,4 @@ export class ConfigService {
     this.unlockPassword = null
   }
 }
+

electron/services/dbPathService.ts

@@ -2,6 +2,7 @@ import { join, basename } from 'path'
 import { existsSync, readdirSync, statSync, readFileSync } from 'fs'
 import { homedir } from 'os'
 import { createDecipheriv } from 'crypto'
+import { expandHomePath } from '../utils/pathUtils'
 
 export interface WxidInfo {
   wxid: string
@@ -93,27 +94,39 @@ export class DbPathService {
       const possiblePaths: string[] = []
       const home = homedir()
 
-      // macOS 微信路径（固定）
       if (process.platform === 'darwin') {
+        // macOS 微信 4.0.5+ 新路径（优先检测）
+        const appSupportBase = join(home, 'Library', 'Containers', 'com.tencent.xinWeChat', 'Data', 'Library', 'Application Support', 'com.tencent.xinWeChat')
+        if (existsSync(appSupportBase)) {
+          try {
+            const entries = readdirSync(appSupportBase)
+            for (const entry of entries) {
+              // 匹配形如 2.0b4.0.9 的版本目录
+              if (/^\d+\.\d+b\d+\.\d+/.test(entry) || /^\d+\.\d+\.\d+/.test(entry)) {
+                possiblePaths.push(join(appSupportBase, entry))
+              }
+            }
+          } catch { }
+        }
+        // macOS 旧路径兜底
         possiblePaths.push(join(home, 'Library', 'Containers', 'com.tencent.xinWeChat', 'Data', 'Documents', 'xwechat_files'))
       } else {
         // Windows 微信4.x 数据目录
         possiblePaths.push(join(home, 'Documents', 'xwechat_files'))
       }
 
-
       for (const path of possiblePaths) {
-        if (existsSync(path)) {
-          const rootName = path.split(/[/\\]/).pop()?.toLowerCase()
-          if (rootName !== 'xwechat_files' && rootName !== 'wechat files') {
-            continue
-          }
+        if (!existsSync(path)) continue
 
-          // 检查是否有有效的账号目录
-          const accounts = this.findAccountDirs(path)
-          if (accounts.length > 0) {
-            return { success: true, path }
-          }
+        // 检查是否有有效的账号目录，或本身就是账号目录
+        const accounts = this.findAccountDirs(path)
+        if (accounts.length > 0) {
+          return { success: true, path }
+        }
+
+        // 如果该目录本身就是账号目录（直接包含 db_storage 等）
+        if (this.isAccountDir(path)) {
+          return { success: true, path }
         }
       }
 
@@ -127,13 +140,14 @@ export class DbPathService {
    * 查找账号目录（包含 db_storage 或图片目录）
    */
   findAccountDirs(rootPath: string): string[] {
+    const resolvedRootPath = expandHomePath(rootPath)
     const accounts: string[] = []
 
     try {
-      const entries = readdirSync(rootPath)
+      const entries = readdirSync(resolvedRootPath)
 
       for (const entry of entries) {
-        const entryPath = join(rootPath, entry)
+        const entryPath = join(resolvedRootPath, entry)
         let stat: ReturnType<typeof statSync>
         try {
           stat = statSync(entryPath)
@@ -146,6 +160,16 @@ export class DbPathService {
 
           // 检查是否有有效账号目录结构
           if (this.isAccountDir(entryPath)) {
+            // 过滤掉不带后缀的 wxid_ 目录
+            const lowerEntry = entry.toLowerCase()
+            if (lowerEntry.startsWith('wxid_')) {
+              // wxid_ 开头的目录必须带后缀（wxid_xxx_yyyy 格式）
+              const parts = entry.split('_')
+              if (parts.length <= 2) {
+                // wxid_xxx 格式，跳过
+                continue
+              }
+            }
             accounts.push(entry)
           }
         }
@@ -204,28 +228,39 @@ export class DbPathService {
    * 扫描目录名候选（仅包含下划线的文件夹，排除 all_users）
    */
   scanWxidCandidates(rootPath: string): WxidInfo[] {
+    const resolvedRootPath = expandHomePath(rootPath)
     const wxids: WxidInfo[] = []
 
     try {
-      if (existsSync(rootPath)) {
-        const entries = readdirSync(rootPath)
+      if (existsSync(resolvedRootPath)) {
+        const entries = readdirSync(resolvedRootPath)
         for (const entry of entries) {
-          const entryPath = join(rootPath, entry)
+          const entryPath = join(resolvedRootPath, entry)
           let stat: ReturnType<typeof statSync>
           try { stat = statSync(entryPath) } catch { continue }
           if (!stat.isDirectory()) continue
           const lower = entry.toLowerCase()
           if (lower === 'all_users') continue
           if (!entry.includes('_')) continue
+
+          // 过滤掉不带后缀的 wxid_ 目录
+          if (lower.startsWith('wxid_')) {
+            const parts = entry.split('_')
+            if (parts.length <= 2) {
+              // wxid_xxx 格式，跳过
+              continue
+            }
+          }
+
           wxids.push({ wxid: entry, modifiedTime: stat.mtimeMs })
         }
       }
 
 
       if (wxids.length === 0) {
-        const rootName = basename(rootPath)
+        const rootName = basename(resolvedRootPath)
         if (rootName.includes('_') && rootName.toLowerCase() !== 'all_users') {
-          const rootStat = statSync(rootPath)
+          const rootStat = statSync(resolvedRootPath)
           wxids.push({ wxid: rootName, modifiedTime: rootStat.mtimeMs })
         }
       }
@@ -236,7 +271,7 @@ export class DbPathService {
       return a.wxid.localeCompare(b.wxid)
     });
 
-    const globalInfo = this.parseGlobalConfig(rootPath);
+    const globalInfo = this.parseGlobalConfig(resolvedRootPath);
     if (globalInfo) {
       for (const w of sorted) {
         if (w.wxid.startsWith(globalInfo.wxid) || sorted.length === 1) {
@@ -254,19 +289,20 @@ export class DbPathService {
    * 扫描 wxid 列表
    */
   scanWxids(rootPath: string): WxidInfo[] {
+    const resolvedRootPath = expandHomePath(rootPath)
     const wxids: WxidInfo[] = []
 
     try {
-      if (this.isAccountDir(rootPath)) {
-        const wxid = basename(rootPath)
-        const modifiedTime = this.getAccountModifiedTime(rootPath)
+      if (this.isAccountDir(resolvedRootPath)) {
+        const wxid = basename(resolvedRootPath)
+        const modifiedTime = this.getAccountModifiedTime(resolvedRootPath)
         return [{ wxid, modifiedTime }]
       }
 
-      const accounts = this.findAccountDirs(rootPath)
+      const accounts = this.findAccountDirs(resolvedRootPath)
 
       for (const account of accounts) {
-        const fullPath = join(rootPath, account)
+        const fullPath = join(resolvedRootPath, account)
         const modifiedTime = this.getAccountModifiedTime(fullPath)
         wxids.push({ wxid: account, modifiedTime })
       }
@@ -277,7 +313,7 @@ export class DbPathService {
       return a.wxid.localeCompare(b.wxid)
     });
 
-    const globalInfo = this.parseGlobalConfig(rootPath);
+    const globalInfo = this.parseGlobalConfig(resolvedRootPath);
     if (globalInfo) {
       for (const w of sorted) {
         if (w.wxid.startsWith(globalInfo.wxid) || sorted.length === 1) {
@@ -295,6 +331,20 @@ export class DbPathService {
   getDefaultPath(): string {
     const home = homedir()
     if (process.platform === 'darwin') {
+      // 优先返回 4.0.5+ 新路径
+      const appSupportBase = join(home, 'Library', 'Containers', 'com.tencent.xinWeChat', 'Data', 'Library', 'Application Support', 'com.tencent.xinWeChat')
+      if (existsSync(appSupportBase)) {
+        try {
+          const entries = readdirSync(appSupportBase)
+          for (const entry of entries) {
+            if (/^\d+\.\d+b\d+\.\d+/.test(entry) || /^\d+\.\d+\.\d+/.test(entry)) {
+              const candidate = join(appSupportBase, entry)
+              if (existsSync(candidate)) return candidate
+            }
+          }
+        } catch { }
+      }
+      // 旧版本路径兜底
       return join(home, 'Library', 'Containers', 'com.tencent.xinWeChat', 'Data', 'Documents', 'xwechat_files')
     }
     return join(home, 'Documents', 'xwechat_files')

electron/services/dualReportService.ts

@@ -1,5 +1,6 @@
 import { parentPort } from 'worker_threads'
 import { wcdbService } from './wcdbService'
+import { resolveAccountDir } from './accountDirResolver'
 
 
 export interface DualReportMessage {
@@ -109,9 +110,11 @@ class DualReportService {
     if (!dbPath) return { success: false, error: '未配置数据库路径' }
     if (!decryptKey) return { success: false, error: '未配置解密密钥' }
 
-    const cleanedWxid = this.cleanAccountDirName(wxid)
-    const ok = await wcdbService.open(dbPath, decryptKey, cleanedWxid)
+    const accountDir = resolveAccountDir(dbPath, wxid)
+    if (!accountDir) return { success: false, error: '无法找到账号目录' }
+    const ok = await wcdbService.open(accountDir, decryptKey)
     if (!ok) return { success: false, error: 'WCDB 打开失败' }
+    const cleanedWxid = this.cleanAccountDirName(wxid)
     return { success: true, cleanedWxid, rawWxid: wxid }
   }
 

electron/services/exportRecordService.ts

@@ -19,7 +19,8 @@ class ExportRecordService {
 
   private resolveFilePath(): string {
     if (this.filePath) return this.filePath
-    const userDataPath = app.getPath('userData')
+    const workerUserDataPath = String(process.env.WEFLOW_USER_DATA_PATH || process.env.WEFLOW_CONFIG_CWD || '').trim()
+    const userDataPath = workerUserDataPath || app?.getPath?.('userData') || process.cwd()
     fs.mkdirSync(userDataPath, { recursive: true })
     this.filePath = path.join(userDataPath, 'weflow-export-records.json')
     return this.filePath

electron/services/exportTaskControlService.ts

@@ -0,0 +1,210 @@
+import * as path from 'path'
+import { rm, rmdir } from 'fs/promises'
+
+export type ExportTaskControlState = 'running' | 'pause_requested' | 'cancel_requested'
+
+export interface ExportTaskControlHooks {
+  shouldPause: () => boolean
+  shouldStop: () => boolean
+  recordCreatedFile: (filePath: string) => void
+  recordCreatedDir: (dirPath: string) => void
+}
+
+interface ExportTaskManifest {
+  outputDir: string
+  files: Set<string>
+  dirs: Set<string>
+}
+
+interface ExportTaskControlRecord {
+  state: ExportTaskControlState
+  manifest: ExportTaskManifest
+  createdAt: number
+  updatedAt: number
+}
+
+export interface ExportTaskCleanupResult {
+  success: boolean
+  filesDeleted: number
+  dirsDeleted: number
+  error?: string
+}
+
+class ExportTaskControlService {
+  private tasks = new Map<string, ExportTaskControlRecord>()
+
+  createControl(taskId: string, outputDir: string): ExportTaskControlHooks {
+    this.registerTask(taskId, outputDir)
+    return {
+      shouldPause: () => this.getState(taskId) === 'pause_requested',
+      shouldStop: () => this.getState(taskId) === 'cancel_requested',
+      recordCreatedFile: (filePath: string) => this.recordCreatedFile(taskId, filePath),
+      recordCreatedDir: (dirPath: string) => this.recordCreatedDir(taskId, dirPath)
+    }
+  }
+
+  registerTask(taskId: string, outputDir: string): void {
+    const normalizedTaskId = this.normalizeTaskId(taskId)
+    if (!normalizedTaskId) return
+
+    const normalizedOutputDir = path.resolve(String(outputDir || '').trim() || '.')
+    const existing = this.tasks.get(normalizedTaskId)
+    if (existing) {
+      existing.state = 'running'
+      existing.updatedAt = Date.now()
+      if (!existing.manifest.outputDir) {
+        existing.manifest.outputDir = normalizedOutputDir
+      }
+      return
+    }
+
+    this.tasks.set(normalizedTaskId, {
+      state: 'running',
+      manifest: {
+        outputDir: normalizedOutputDir,
+        files: new Set<string>(),
+        dirs: new Set<string>()
+      },
+      createdAt: Date.now(),
+      updatedAt: Date.now()
+    })
+  }
+
+  pauseTask(taskId: string): boolean {
+    return this.setState(taskId, 'pause_requested')
+  }
+
+  resumeTask(taskId: string): boolean {
+    return this.setState(taskId, 'running')
+  }
+
+  cancelTask(taskId: string): boolean {
+    return this.setState(taskId, 'cancel_requested')
+  }
+
+  getState(taskId: string): ExportTaskControlState | null {
+    const normalizedTaskId = this.normalizeTaskId(taskId)
+    if (!normalizedTaskId) return null
+    return this.tasks.get(normalizedTaskId)?.state || null
+  }
+
+  releaseTask(taskId: string): void {
+    const normalizedTaskId = this.normalizeTaskId(taskId)
+    if (!normalizedTaskId) return
+    this.tasks.delete(normalizedTaskId)
+  }
+
+  recordCreatedFile(taskId: string, filePath: string): void {
+    const task = this.getTaskForManifestWrite(taskId, filePath)
+    if (!task) return
+    task.manifest.files.add(path.resolve(filePath))
+    task.updatedAt = Date.now()
+  }
+
+  recordCreatedDir(taskId: string, dirPath: string): void {
+    const task = this.getTaskForManifestWrite(taskId, dirPath)
+    if (!task) return
+    task.manifest.dirs.add(path.resolve(dirPath))
+    task.updatedAt = Date.now()
+  }
+
+  async cleanupTask(taskId: string): Promise<ExportTaskCleanupResult> {
+    const normalizedTaskId = this.normalizeTaskId(taskId)
+    const task = normalizedTaskId ? this.tasks.get(normalizedTaskId) : undefined
+    if (!task) {
+      return { success: true, filesDeleted: 0, dirsDeleted: 0 }
+    }
+
+    const outputDir = task.manifest.outputDir
+    let filesDeleted = 0
+    let dirsDeleted = 0
+    const errors: string[] = []
+
+    const files = Array.from(task.manifest.files)
+      .filter(filePath => this.isInsideOutputDir(filePath, outputDir))
+      .sort((a, b) => b.length - a.length)
+
+    for (const filePath of files) {
+      try {
+        await rm(filePath, { force: true, recursive: false })
+        filesDeleted++
+      } catch (error) {
+        const code = (error as NodeJS.ErrnoException | undefined)?.code
+        if (code !== 'ENOENT') {
+          errors.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`)
+        }
+      }
+    }
+
+    const dirs = Array.from(task.manifest.dirs)
+      .filter(dirPath => this.isInsideOutputDir(dirPath, outputDir) || this.isSamePath(dirPath, outputDir))
+      .sort((a, b) => b.length - a.length)
+
+    for (const dirPath of dirs) {
+      try {
+        await rmdir(dirPath)
+        dirsDeleted++
+      } catch (error) {
+        const code = (error as NodeJS.ErrnoException | undefined)?.code
+        if (code !== 'ENOENT' && code !== 'ENOTEMPTY' && code !== 'EEXIST') {
+          errors.push(`${dirPath}: ${error instanceof Error ? error.message : String(error)}`)
+        }
+      }
+    }
+
+    if (errors.length === 0) {
+      this.releaseTask(normalizedTaskId)
+      return { success: true, filesDeleted, dirsDeleted }
+    }
+
+    return {
+      success: false,
+      filesDeleted,
+      dirsDeleted,
+      error: errors.slice(0, 3).join('; ')
+    }
+  }
+
+  private setState(taskId: string, state: ExportTaskControlState): boolean {
+    const normalizedTaskId = this.normalizeTaskId(taskId)
+    if (!normalizedTaskId) return false
+    const task = this.tasks.get(normalizedTaskId)
+    if (!task) return false
+    task.state = state
+    task.updatedAt = Date.now()
+    return true
+  }
+
+  private getTaskForManifestWrite(taskId: string, targetPath: string): ExportTaskControlRecord | null {
+    const normalizedTaskId = this.normalizeTaskId(taskId)
+    if (!normalizedTaskId) return null
+    const task = this.tasks.get(normalizedTaskId)
+    if (!task) return null
+    if (!this.isInsideOutputDir(targetPath, task.manifest.outputDir) && !this.isSamePath(targetPath, task.manifest.outputDir)) {
+      return null
+    }
+    return task
+  }
+
+  private isInsideOutputDir(targetPath: string, outputDir: string): boolean {
+    const resolvedTarget = path.resolve(targetPath)
+    const resolvedOutputDir = path.resolve(outputDir)
+    const relativePath = path.relative(resolvedOutputDir, resolvedTarget)
+    return Boolean(relativePath) && !relativePath.startsWith('..') && !path.isAbsolute(relativePath)
+  }
+
+  private isSamePath(left: string, right: string): boolean {
+    const resolvedLeft = path.resolve(left)
+    const resolvedRight = path.resolve(right)
+    if (process.platform === 'win32') {
+      return resolvedLeft.toLowerCase() === resolvedRight.toLowerCase()
+    }
+    return resolvedLeft === resolvedRight
+  }
+
+  private normalizeTaskId(taskId: string): string {
+    return String(taskId || '').trim()
+  }
+}
+
+export const exportTaskControlService = new ExportTaskControlService()

electron/services/groupAnalyticsService.ts

@@ -251,7 +251,7 @@ class GroupAnalyticsService {
   }
 
   private async ensureConnected(): Promise<{ success: boolean; error?: string }> {
-    const wxid = this.configService.get('myWxid')
+    const wxid = this.configService.getMyWxidCleaned()
     const dbPath = this.configService.get('dbPath')
     const decryptKey = this.configService.get('decryptKey')
     if (!wxid) return { success: false, error: '未配置微信ID' }
@@ -259,7 +259,9 @@ class GroupAnalyticsService {
     if (!decryptKey) return { success: false, error: '未配置解密密钥' }
 
     const cleanedWxid = this.cleanAccountDirName(wxid)
-    const ok = await wcdbService.open(dbPath, decryptKey, cleanedWxid)
+    const accountDir = this.configService.getAccountDir(dbPath, wxid)
+    if (!accountDir) return { success: false, error: '无法找到账号目录' }
+    const ok = await wcdbService.open(accountDir, decryptKey)
     if (!ok) return { success: false, error: 'WCDB 打开失败' }
     return { success: true }
   }
@@ -275,7 +277,7 @@ class GroupAnalyticsService {
       }
       return this.buildTrustedGroupNicknameMap(Object.entries(dllResult.nicknames), candidates)
     } catch (e) {
-      console.error('getGroupNicknamesForRoom dll error:', e)
+      console.error('getGroupNicknamesForRoom service error:', e)
       return new Map<string, string>()
     }
   }
@@ -1555,7 +1557,7 @@ class GroupAnalyticsService {
       const phraseCounts = new Map<string, number>()
       const emojiCounts = new Map<string, number>()
 
-      const myWxid = String(this.configService.get('myWxid') || '').trim()
+      const myWxid = String(this.configService.getMyWxidCleaned() || '').trim()
 
       try {
         while (true) {

electron/services/groupSummaryRecordService.ts

@@ -0,0 +1,384 @@
+import { app } from 'electron'
+import fs from 'fs'
+import path from 'path'
+import { createHash, randomUUID } from 'crypto'
+import { ConfigService } from './config'
+
+export type GroupSummaryTriggerType = 'auto' | 'manual'
+
+export interface GroupSummaryTopic {
+  title: string
+  participants: string[]
+  keyPoints: string[]
+  conclusion: string
+}
+
+export interface GroupSummaryLog {
+  endpoint: string
+  model: string
+  temperature: number
+  triggerType: GroupSummaryTriggerType
+  periodStart: number
+  periodEnd: number
+  messageCount: number
+  readableMessageCount: number
+  systemPrompt: string
+  userPrompt: string
+  rawOutput: string
+  finalSummary: string
+  durationMs: number
+  createdAt: number
+  responseFormatJson?: boolean
+  responseFormatFallback?: boolean
+  responseFormatFallbackReason?: string
+  parsedTopics?: GroupSummaryTopic[]
+}
+
+export interface GroupSummaryRecord {
+  id: string
+  accountScope: string
+  createdAt: number
+  sessionId: string
+  displayName: string
+  avatarUrl?: string
+  triggerType: GroupSummaryTriggerType
+  periodStart: number
+  periodEnd: number
+  messageCount: number
+  readableMessageCount: number
+  topics: GroupSummaryTopic[]
+  summaryText: string
+  rawOutput: string
+  log: GroupSummaryLog
+}
+
+export interface GroupSummaryRecordSummary {
+  id: string
+  createdAt: number
+  sessionId: string
+  displayName: string
+  avatarUrl?: string
+  triggerType: GroupSummaryTriggerType
+  periodStart: number
+  periodEnd: number
+  messageCount: number
+  readableMessageCount: number
+  topics: GroupSummaryTopic[]
+  summaryText: string
+}
+
+export interface GroupSummaryRecordFilters {
+  sessionId?: string
+  startTime?: number
+  endTime?: number
+  limit?: number
+  offset?: number
+}
+
+export interface GroupSummaryRecordListResult {
+  success: boolean
+  records: GroupSummaryRecordSummary[]
+  total: number
+  error?: string
+}
+
+interface GroupSummaryIndexRecord extends GroupSummaryRecordSummary {
+  accountScope: string
+  logFile?: string
+}
+
+interface LegacyGroupSummaryRecord extends GroupSummaryIndexRecord {
+  rawOutput?: string
+  log?: GroupSummaryLog
+}
+
+class GroupSummaryRecordService {
+  private readonly maxRecordsPerScope = 2000
+  private filePath: string | null = null
+  private logDir: string | null = null
+  private loaded = false
+  private records: GroupSummaryIndexRecord[] = []
+
+  private resolveUserDataPath(): string {
+    const workerUserDataPath = String(process.env.WEFLOW_USER_DATA_PATH || process.env.WEFLOW_CONFIG_CWD || '').trim()
+    const userDataPath = workerUserDataPath || app?.getPath?.('userData') || process.cwd()
+    fs.mkdirSync(userDataPath, { recursive: true })
+    return userDataPath
+  }
+
+  private resolveFilePath(): string {
+    if (this.filePath) return this.filePath
+    this.filePath = path.join(this.resolveUserDataPath(), 'weflow-group-summary-records.json')
+    return this.filePath
+  }
+
+  private resolveLogDir(): string {
+    if (this.logDir) return this.logDir
+    this.logDir = path.join(this.resolveUserDataPath(), 'weflow-group-summary-logs')
+    fs.mkdirSync(this.logDir, { recursive: true })
+    return this.logDir
+  }
+
+  private normalizeTimestampSeconds(value: unknown): number {
+    const numeric = Number(value || 0)
+    if (!Number.isFinite(numeric) || numeric <= 0) return 0
+    let normalized = Math.floor(numeric)
+    while (normalized > 10000000000) {
+      normalized = Math.floor(normalized / 1000)
+    }
+    return normalized
+  }
+
+  private safeLogFileName(id: string): string {
+    const normalized = String(id || '').replace(/[^a-zA-Z0-9_-]/g, '')
+    return `${normalized || randomUUID()}.json`
+  }
+
+  private writeLogFile(recordId: string, log: GroupSummaryLog, rawOutput: string): string | undefined {
+    try {
+      const fileName = this.safeLogFileName(recordId)
+      const logPath = path.join(this.resolveLogDir(), fileName)
+      fs.writeFileSync(logPath, JSON.stringify({ version: 1, rawOutput, log }, null, 2), 'utf-8')
+      return fileName
+    } catch {
+      return undefined
+    }
+  }
+
+  private readLogFile(fileName?: string): { rawOutput: string; log: GroupSummaryLog } | null {
+    if (!fileName) return null
+    try {
+      const logPath = path.join(this.resolveLogDir(), this.safeLogFileName(fileName.replace(/\.json$/i, '')))
+      if (!fs.existsSync(logPath)) return null
+      const parsed = JSON.parse(fs.readFileSync(logPath, 'utf-8'))
+      const log = parsed?.log
+      if (!log || typeof log !== 'object') return null
+      return {
+        rawOutput: typeof parsed?.rawOutput === 'string' ? parsed.rawOutput : String(log.rawOutput || ''),
+        log: log as GroupSummaryLog
+      }
+    } catch {
+      return null
+    }
+  }
+
+  private ensureLoaded(): void {
+    if (this.loaded) return
+    this.loaded = true
+    const filePath = this.resolveFilePath()
+    try {
+      if (!fs.existsSync(filePath)) return
+      const raw = fs.readFileSync(filePath, 'utf-8')
+      const parsed = JSON.parse(raw)
+      const records = Array.isArray(parsed) ? parsed : parsed?.records
+      if (!Array.isArray(records)) return
+
+      const legacyRecords = records.filter((item) => item && typeof item === 'object') as LegacyGroupSummaryRecord[]
+      const needsMigration = legacyRecords.some((record) => Boolean(record.log || record.rawOutput))
+      if (needsMigration) {
+        this.backupLegacyFile(filePath)
+      }
+
+      this.records = legacyRecords.map((record) => {
+        const id = String(record.id || randomUUID())
+        const logFile = record.log
+          ? this.writeLogFile(id, record.log, String(record.rawOutput || record.log.rawOutput || ''))
+          : record.logFile
+        return {
+          id,
+          accountScope: String(record.accountScope || 'default'),
+          createdAt: Number(record.createdAt || Date.now()),
+          sessionId: String(record.sessionId || ''),
+          displayName: String(record.displayName || record.sessionId || ''),
+          avatarUrl: record.avatarUrl,
+          triggerType: record.triggerType === 'auto' ? 'auto' : 'manual',
+          periodStart: this.normalizeTimestampSeconds(record.periodStart),
+          periodEnd: this.normalizeTimestampSeconds(record.periodEnd),
+          messageCount: Math.max(0, Math.floor(Number(record.messageCount || 0))),
+          readableMessageCount: Math.max(0, Math.floor(Number(record.readableMessageCount || 0))),
+          topics: Array.isArray(record.topics) ? record.topics : [],
+          summaryText: String(record.summaryText || ''),
+          logFile
+        }
+      }).filter((record) => record.sessionId && record.periodStart > 0 && record.periodEnd > record.periodStart)
+
+      if (needsMigration) {
+        this.persist()
+      }
+    } catch {
+      this.records = []
+    }
+  }
+
+  private backupLegacyFile(filePath: string): void {
+    try {
+      const backupPath = `${filePath}.legacy-${Date.now()}.bak`
+      if (!fs.existsSync(backupPath)) {
+        fs.copyFileSync(filePath, backupPath)
+      }
+    } catch {
+      // Backup failure should not block reading existing records.
+    }
+  }
+
+  private persist(): void {
+    try {
+      const filePath = this.resolveFilePath()
+      fs.writeFileSync(filePath, JSON.stringify({ version: 2, records: this.records }, null, 2), 'utf-8')
+    } catch {
+      // Summary generation should not fail because local record persistence failed.
+    }
+  }
+
+  private getCurrentAccountScope(): string {
+    const config = ConfigService.getInstance()
+    const myWxid = String(config.getMyWxidCleaned() || '').trim()
+    if (myWxid) return `wxid:${myWxid}`
+
+    const dbPath = String(config.get('dbPath') || '').trim()
+    if (dbPath) {
+      const hash = createHash('sha1').update(dbPath).digest('hex').slice(0, 16)
+      return `db:${hash}`
+    }
+    return 'default'
+  }
+
+  private toSummary(record: GroupSummaryIndexRecord): GroupSummaryRecordSummary {
+    return {
+      id: record.id,
+      createdAt: record.createdAt,
+      sessionId: record.sessionId,
+      displayName: record.displayName,
+      avatarUrl: record.avatarUrl,
+      triggerType: record.triggerType,
+      periodStart: record.periodStart,
+      periodEnd: record.periodEnd,
+      messageCount: record.messageCount,
+      readableMessageCount: record.readableMessageCount,
+      topics: Array.isArray(record.topics) ? record.topics : [],
+      summaryText: record.summaryText || ''
+    }
+  }
+
+  private getScopedRecords(): GroupSummaryIndexRecord[] {
+    this.ensureLoaded()
+    const scope = this.getCurrentAccountScope()
+    return this.records.filter((record) => record.accountScope === scope)
+  }
+
+  addRecord(input: {
+    sessionId: string
+    displayName: string
+    avatarUrl?: string
+    triggerType: GroupSummaryTriggerType
+    periodStart: number
+    periodEnd: number
+    messageCount: number
+    readableMessageCount: number
+    topics: GroupSummaryTopic[]
+    summaryText: string
+    rawOutput: string
+    log: GroupSummaryLog
+  }): GroupSummaryRecordSummary {
+    this.ensureLoaded()
+    const scope = this.getCurrentAccountScope()
+    const id = randomUUID()
+    const logFile = this.writeLogFile(id, input.log, input.rawOutput)
+    const record: GroupSummaryIndexRecord = {
+      id,
+      accountScope: scope,
+      createdAt: Date.now(),
+      sessionId: input.sessionId,
+      displayName: input.displayName,
+      avatarUrl: input.avatarUrl,
+      triggerType: input.triggerType,
+      periodStart: input.periodStart,
+      periodEnd: input.periodEnd,
+      messageCount: input.messageCount,
+      readableMessageCount: input.readableMessageCount,
+      topics: input.topics,
+      summaryText: input.summaryText,
+      logFile
+    }
+
+    this.records.push(record)
+    const scopedRecords = this.records
+      .filter((item) => item.accountScope === scope)
+      .sort((a, b) => b.createdAt - a.createdAt)
+    const keepIds = new Set(scopedRecords.slice(0, this.maxRecordsPerScope).map((item) => item.id))
+    this.records = this.records.filter((item) => item.accountScope !== scope || keepIds.has(item.id))
+    this.persist()
+    return this.toSummary(record)
+  }
+
+  hasAutoRecord(sessionId: string, periodStart: number, periodEnd: number): boolean {
+    const normalizedSessionId = String(sessionId || '').trim()
+    if (!normalizedSessionId) return false
+    return this.getScopedRecords().some((record) =>
+      record.triggerType === 'auto' &&
+      record.sessionId === normalizedSessionId &&
+      Number(record.periodStart || 0) === periodStart &&
+      Number(record.periodEnd || 0) === periodEnd
+    )
+  }
+
+  listRecords(filters: GroupSummaryRecordFilters = {}): GroupSummaryRecordListResult {
+    try {
+      const sessionId = String(filters.sessionId || '').trim()
+      const startTime = this.normalizeTimestampSeconds(filters.startTime)
+      const endTime = this.normalizeTimestampSeconds(filters.endTime)
+      const offset = Math.max(0, Math.floor(Number(filters.offset || 0)))
+      const limit = Math.min(200, Math.max(1, Math.floor(Number(filters.limit || 100))))
+
+      const filtered = this.getScopedRecords()
+        .filter((record) => {
+          if (sessionId && record.sessionId !== sessionId) return false
+          const periodStart = Number(record.periodStart || 0)
+          const periodEnd = Number(record.periodEnd || 0)
+          if (startTime > 0 && periodEnd < startTime) return false
+          if (endTime > 0 && periodStart > endTime) return false
+          return true
+        })
+        .sort((a, b) => Number(b.periodStart || b.createdAt) - Number(a.periodStart || a.createdAt))
+
+      return {
+        success: true,
+        records: filtered.slice(offset, offset + limit).map((record) => this.toSummary(record)),
+        total: filtered.length
+      }
+    } catch (error) {
+      return { success: false, records: [], total: 0, error: (error as Error).message || String(error) }
+    }
+  }
+
+  getRecord(id: string): { success: boolean; record?: GroupSummaryRecord; error?: string } {
+    this.ensureLoaded()
+    const normalizedId = String(id || '').trim()
+    if (!normalizedId) return { success: false, error: '记录 ID 为空' }
+    const scope = this.getCurrentAccountScope()
+    const record = this.records.find((item) => item.id === normalizedId && item.accountScope === scope)
+    if (!record) return { success: false, error: '未找到该群聊总结记录' }
+
+    const logData = this.readLogFile(record.logFile)
+    if (!logData) return { success: false, error: '未找到该群聊总结日志' }
+
+    return {
+      success: true,
+      record: {
+        ...this.toSummary(record),
+        accountScope: record.accountScope,
+        rawOutput: logData.rawOutput,
+        log: logData.log
+      }
+    }
+  }
+
+  clearRuntimeCache(): void {
+    this.loaded = false
+    this.records = []
+    this.filePath = null
+    this.logDir = null
+  }
+}
+
+export const groupSummaryRecordService = new GroupSummaryRecordService()

electron/services/groupSummaryService.ts

@@ -0,0 +1,801 @@
+import https from 'https'
+import http from 'http'
+import { URL } from 'url'
+import groupSummaryPrompt from '../../shared/groupSummaryPrompt.json'
+import { ConfigService } from './config'
+import { chatService, type Message } from './chatService'
+import { wcdbService } from './wcdbService'
+import {
+  groupSummaryRecordService,
+  type GroupSummaryLog,
+  type GroupSummaryRecord,
+  type GroupSummaryRecordFilters,
+  type GroupSummaryRecordListResult,
+  type GroupSummaryRecordSummary,
+  type GroupSummaryTopic,
+  type GroupSummaryTriggerType
+} from './groupSummaryRecordService'
+
+const API_TIMEOUT_MS = 90_000
+const API_TEMPERATURE = 0.4
+const MIN_SUMMARY_MESSAGES = 5
+const MAX_MANUAL_RANGE_SECONDS = 48 * 60 * 60
+const MAX_MESSAGES_PER_SUMMARY = 3000
+const SUMMARY_CURSOR_BATCH_SIZE = 360
+const DEFAULT_GROUP_SUMMARY_SYSTEM_PROMPT = String(groupSummaryPrompt.defaultSystemPrompt || '').trim()
+const SUMMARY_CONFIG_KEYS = new Set([
+  'aiGroupSummaryEnabled',
+  'aiGroupSummaryIntervalHours',
+  'aiGroupSummarySystemPrompt',
+  'aiGroupSummaryFilterMode',
+  'aiGroupSummaryFilterList',
+  'aiModelApiBaseUrl',
+  'aiModelApiKey',
+  'aiModelApiModel',
+  'aiInsightApiBaseUrl',
+  'aiInsightApiKey',
+  'aiInsightApiModel',
+  'dbPath',
+  'decryptKey',
+  'myWxid'
+])
+
+interface SharedAiModelConfig {
+  apiBaseUrl: string
+  apiKey: string
+  model: string
+}
+
+interface GroupSummaryTriggerResult {
+  success: boolean
+  message: string
+  recordId?: string
+  record?: GroupSummaryRecordSummary
+  skipped?: boolean
+  skippedReason?: string
+}
+
+interface GroupSummaryDayTriggerResult {
+  success: boolean
+  message: string
+  generated: number
+  skipped: number
+  records: GroupSummaryRecordSummary[]
+}
+
+class ApiRequestError extends Error {
+  statusCode?: number
+  responseBody?: string
+
+  constructor(message: string, statusCode?: number, responseBody?: string) {
+    super(message)
+    this.name = 'ApiRequestError'
+    this.statusCode = statusCode
+    this.responseBody = responseBody
+  }
+}
+
+function buildApiUrl(baseUrl: string, path: string): string {
+  const base = baseUrl.replace(/\/+$/, '')
+  const suffix = path.startsWith('/') ? path : `/${path}`
+  return `${base}${suffix}`
+}
+
+function normalizeSessionIdList(value: unknown): string[] {
+  if (!Array.isArray(value)) return []
+  return Array.from(new Set(value.map((item) => String(item || '').trim()).filter(Boolean)))
+}
+
+function normalizeIntervalHours(value: unknown): number {
+  const allowed = new Set([1, 2, 4, 8, 12, 24])
+  const numeric = Math.floor(Number(value) || 4)
+  return allowed.has(numeric) ? numeric : 4
+}
+
+function getStartOfDaySeconds(date: Date = new Date()): number {
+  const next = new Date(date)
+  next.setHours(0, 0, 0, 0)
+  return Math.floor(next.getTime() / 1000)
+}
+
+function clampText(value: unknown, maxLength: number): string {
+  const text = String(value || '').replace(/\s+/g, ' ').trim()
+  if (text.length <= maxLength) return text
+  return `${text.slice(0, Math.max(0, maxLength - 1))}…`
+}
+
+function stripJsonFence(value: string): string {
+  const text = String(value || '').trim()
+  const fenced = text.match(/^```(?:json)?\s*([\s\S]*?)\s*```$/i)
+  if (fenced) return fenced[1].trim()
+  const firstBrace = text.indexOf('{')
+  const lastBrace = text.lastIndexOf('}')
+  if (firstBrace >= 0 && lastBrace > firstBrace) {
+    return text.slice(firstBrace, lastBrace + 1).trim()
+  }
+  return text
+}
+
+function shouldFallbackJsonMode(error: unknown): boolean {
+  const statusCode = (error as ApiRequestError)?.statusCode
+  if (statusCode === 400 || statusCode === 404 || statusCode === 422) return true
+  const text = `${(error as Error)?.message || ''}\n${(error as ApiRequestError)?.responseBody || ''}`.toLowerCase()
+  return text.includes('response_format') || text.includes('json_object') || text.includes('json mode')
+}
+
+function formatTimestamp(createTime: number): string {
+  const ms = createTime > 1_000_000_000_000 ? createTime : createTime * 1000
+  const date = new Date(ms)
+  const year = date.getFullYear()
+  const month = String(date.getMonth() + 1).padStart(2, '0')
+  const day = String(date.getDate()).padStart(2, '0')
+  const hours = String(date.getHours()).padStart(2, '0')
+  const minutes = String(date.getMinutes()).padStart(2, '0')
+  const seconds = String(date.getSeconds()).padStart(2, '0')
+  return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`
+}
+
+function callChatCompletions(
+  apiBaseUrl: string,
+  apiKey: string,
+  model: string,
+  messages: Array<{ role: string; content: string }>,
+  options?: { responseFormatJson?: boolean }
+): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const endpoint = buildApiUrl(apiBaseUrl, '/chat/completions')
+    let urlObj: URL
+    try {
+      urlObj = new URL(endpoint)
+    } catch {
+      reject(new Error(`无效的 API URL: ${endpoint}`))
+      return
+    }
+
+    const payload: Record<string, unknown> = {
+      model,
+      messages,
+      temperature: API_TEMPERATURE,
+      stream: false
+    }
+    if (options?.responseFormatJson) {
+      payload.response_format = { type: 'json_object' }
+    }
+
+    const body = JSON.stringify(payload)
+    const requestOptions = {
+      hostname: urlObj.hostname,
+      port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80),
+      path: urlObj.pathname + urlObj.search,
+      method: 'POST' as const,
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body).toString(),
+        Authorization: `Bearer ${apiKey}`
+      }
+    }
+
+    const requestFn = urlObj.protocol === 'https:' ? https.request : http.request
+    const req = requestFn(requestOptions, (res) => {
+      let data = ''
+      res.on('data', (chunk) => { data += chunk })
+      res.on('end', () => {
+        try {
+          if (res.statusCode && res.statusCode >= 400) {
+            reject(new ApiRequestError(`API 请求失败 (${res.statusCode}): ${data.slice(0, 200)}`, res.statusCode, data))
+            return
+          }
+          const parsed = JSON.parse(data)
+          const content = parsed?.choices?.[0]?.message?.content
+          if (typeof content === 'string' && content.trim()) {
+            resolve(content.trim())
+          } else {
+            reject(new Error(`API 返回格式异常: ${data.slice(0, 200)}`))
+          }
+        } catch {
+          reject(new Error(`JSON 解析失败: ${data.slice(0, 200)}`))
+        }
+      })
+    })
+
+    req.setTimeout(API_TIMEOUT_MS, () => {
+      req.destroy()
+      reject(new Error('API 请求超时'))
+    })
+    req.on('error', reject)
+    req.write(body)
+    req.end()
+  })
+}
+
+function parseTopics(rawOutput: string): GroupSummaryTopic[] {
+  const parsed = JSON.parse(stripJsonFence(rawOutput)) as unknown
+  if (!parsed || typeof parsed !== 'object') {
+    throw new Error('模型输出格式异常：JSON 根节点不是对象')
+  }
+  const source = parsed as Record<string, unknown>
+  const rawTopics = Array.isArray(source.topics) ? source.topics : []
+  const topics = rawTopics.map((item, index) => {
+    const topic = item && typeof item === 'object' ? item as Record<string, unknown> : {}
+    const participantsRaw = Array.isArray(topic.participants) ? topic.participants : []
+    const keyPointsRaw = Array.isArray(topic.key_points)
+      ? topic.key_points
+      : (Array.isArray(topic.keyPoints) ? topic.keyPoints : [])
+    return {
+      title: clampText(topic.title || `话题 ${index + 1}`, 48) || `话题 ${index + 1}`,
+      participants: participantsRaw.map((value) => clampText(value, 24)).filter(Boolean).slice(0, 12),
+      keyPoints: keyPointsRaw.map((value) => clampText(value, 120)).filter(Boolean).slice(0, 8),
+      conclusion: clampText(topic.conclusion, 180) || '无明确结论'
+    }
+  }).filter((topic) => topic.title || topic.keyPoints.length > 0 || topic.conclusion)
+
+  if (topics.length === 0) {
+    throw new Error('模型输出格式异常：topics 为空')
+  }
+  return topics
+}
+
+function buildSummaryText(topics: GroupSummaryTopic[]): string {
+  return topics.map((topic) => {
+    const participants = topic.participants.length > 0 ? topic.participants.join('、') : '未明确'
+    const keyPoints = topic.keyPoints.length > 0 ? topic.keyPoints.join('；') : '无'
+    return `【${topic.title}】参与者：${participants}。关键/矛盾点：${keyPoints}。结论：${topic.conclusion}`
+  }).join('\n')
+}
+
+function fallbackTopicFromRaw(rawOutput: string): GroupSummaryTopic {
+  return {
+    title: '未归类总结',
+    participants: [],
+    keyPoints: [clampText(rawOutput, 500)],
+    conclusion: '模型未按固定 JSON 格式返回，请查看完整日志。'
+  }
+}
+
+class GroupSummaryService {
+  private config: ConfigService
+  private started = false
+  private scanTimer: NodeJS.Timeout | null = null
+  private processing = false
+  private pendingAutoRun = false
+  private dbConnected = false
+
+  constructor() {
+    this.config = ConfigService.getInstance()
+  }
+
+  start(): void {
+    if (this.started) return
+    this.started = true
+    void this.refreshConfiguration('startup')
+  }
+
+  stop(): void {
+    this.started = false
+    this.clearTimers()
+    this.processing = false
+    this.pendingAutoRun = false
+    this.dbConnected = false
+  }
+
+  async handleConfigChanged(key: string): Promise<void> {
+    const normalizedKey = String(key || '').trim()
+    if (!SUMMARY_CONFIG_KEYS.has(normalizedKey)) return
+    if (normalizedKey === 'aiGroupSummarySystemPrompt') return
+    if (normalizedKey === 'dbPath' || normalizedKey === 'decryptKey' || normalizedKey === 'myWxid') {
+      this.dbConnected = false
+      groupSummaryRecordService.clearRuntimeCache()
+    }
+    await this.refreshConfiguration(`config:${normalizedKey}`)
+  }
+
+  handleConfigCleared(): void {
+    this.clearTimers()
+    this.processing = false
+    this.pendingAutoRun = false
+    this.dbConnected = false
+    groupSummaryRecordService.clearRuntimeCache()
+  }
+
+  listRecords(filters?: GroupSummaryRecordFilters): GroupSummaryRecordListResult {
+    return groupSummaryRecordService.listRecords(filters || {})
+  }
+
+  getRecord(id: string): { success: boolean; record?: GroupSummaryRecord; error?: string } {
+    return groupSummaryRecordService.getRecord(id)
+  }
+
+  async triggerManual(params: {
+    sessionId: string
+    displayName?: string
+    avatarUrl?: string
+    startTime: number
+    endTime: number
+  }): Promise<GroupSummaryTriggerResult> {
+    if (!this.isEnabled()) {
+      return { success: false, message: '请先在设置中开启「AI 群聊总结」' }
+    }
+    const sessionId = String(params?.sessionId || '').trim()
+    if (!sessionId.endsWith('@chatroom')) {
+      return { success: false, message: 'AI 群聊总结仅支持群聊' }
+    }
+    const startTime = this.normalizeTimestampSeconds(params?.startTime)
+    const endTime = this.normalizeTimestampSeconds(params?.endTime)
+    if (startTime <= 0 || endTime <= startTime) {
+      return { success: false, message: '请选择有效的总结时段' }
+    }
+    if (endTime - startTime > MAX_MANUAL_RANGE_SECONDS) {
+      return { success: false, message: '手动总结时段不能超过 48 小时' }
+    }
+
+    const displayName = String(params?.displayName || sessionId).trim() || sessionId
+    const avatarUrl = String(params?.avatarUrl || '').trim() || undefined
+    return this.generateSummaryForPeriod({
+      sessionId,
+      displayName,
+      avatarUrl,
+      periodStart: startTime,
+      periodEnd: endTime,
+      triggerType: 'manual'
+    })
+  }
+
+  async triggerDay(params: {
+    sessionId: string
+    displayName?: string
+    avatarUrl?: string
+    date: string
+  }): Promise<GroupSummaryDayTriggerResult> {
+    if (!this.isEnabled()) {
+      return { success: false, message: '请先在设置中开启「AI 群聊总结」', generated: 0, skipped: 0, records: [] }
+    }
+    const sessionId = String(params?.sessionId || '').trim()
+    if (!sessionId.endsWith('@chatroom')) {
+      return { success: false, message: 'AI 群聊总结仅支持群聊', generated: 0, skipped: 0, records: [] }
+    }
+    const dayRange = this.parseLocalDateDayRange(params?.date)
+    if (!dayRange) {
+      return { success: false, message: '请选择有效日期', generated: 0, skipped: 0, records: [] }
+    }
+    const todayStart = getStartOfDaySeconds(new Date())
+    if (dayRange.start > todayStart) {
+      return { success: false, message: '不能总结未来日期', generated: 0, skipped: 0, records: [] }
+    }
+
+    const now = Math.floor(Date.now() / 1000)
+    const effectiveEnd = dayRange.start === todayStart ? Math.min(dayRange.end, now) : dayRange.end
+    const periods = this.getIntervalPeriods(dayRange.start, effectiveEnd, false)
+    if (periods.length === 0) {
+      return { success: true, message: '当前日期暂无已完成的总结时段', generated: 0, skipped: 0, records: [] }
+    }
+
+    const displayName = String(params?.displayName || sessionId).trim() || sessionId
+    const avatarUrl = String(params?.avatarUrl || '').trim() || undefined
+    return this.generateSummariesForPeriods({
+      sessionId,
+      displayName,
+      avatarUrl,
+      periods,
+      triggerType: 'manual'
+    })
+  }
+
+  private async refreshConfiguration(_reason: string): Promise<void> {
+    if (!this.started) return
+    this.clearTimers()
+    if (!this.isEnabled()) return
+    await this.queueDueAutoSummaries()
+    this.scheduleNextAutoRun()
+  }
+
+  private isEnabled(): boolean {
+    return this.config.get('aiGroupSummaryEnabled') === true
+  }
+
+  private clearTimers(): void {
+    if (this.scanTimer !== null) {
+      clearTimeout(this.scanTimer)
+      this.scanTimer = null
+    }
+  }
+
+  private scheduleNextAutoRun(): void {
+    if (!this.started || !this.isEnabled()) return
+    const intervalHours = normalizeIntervalHours(this.config.get('aiGroupSummaryIntervalHours'))
+    const now = Math.floor(Date.now() / 1000)
+    const dayStart = getStartOfDaySeconds(new Date())
+    const intervalSeconds = intervalHours * 60 * 60
+    const elapsed = Math.max(0, now - dayStart)
+    const nextBoundary = dayStart + (Math.floor(elapsed / intervalSeconds) + 1) * intervalSeconds
+    const delayMs = Math.max(1_000, (nextBoundary - now) * 1000 + 1_000)
+
+    this.scanTimer = setTimeout(async () => {
+      this.scanTimer = null
+      await this.queueDueAutoSummaries()
+      this.scheduleNextAutoRun()
+    }, delayMs)
+  }
+
+  private async ensureConnected(): Promise<boolean> {
+    if (this.dbConnected) return true
+    const result = await chatService.connect()
+    this.dbConnected = result.success === true
+    return this.dbConnected
+  }
+
+  private getSharedAiModelConfig(): SharedAiModelConfig {
+    const apiBaseUrl = String(
+      this.config.get('aiModelApiBaseUrl')
+      || this.config.get('aiInsightApiBaseUrl')
+      || ''
+    ).trim()
+    const apiKey = String(
+      this.config.get('aiModelApiKey')
+      || this.config.get('aiInsightApiKey')
+      || ''
+    ).trim()
+    const model = String(
+      this.config.get('aiModelApiModel')
+      || this.config.get('aiInsightApiModel')
+      || 'gpt-4o-mini'
+    ).trim() || 'gpt-4o-mini'
+    return { apiBaseUrl, apiKey, model }
+  }
+
+  private getAutoScopeSessionIds(): string[] {
+    return normalizeSessionIdList(this.config.get('aiGroupSummaryFilterList'))
+      .filter((sessionId) => sessionId.endsWith('@chatroom'))
+  }
+
+  private normalizeTimestampSeconds(value: unknown): number {
+    const numeric = Number(value || 0)
+    if (!Number.isFinite(numeric) || numeric <= 0) return 0
+    let normalized = Math.floor(numeric)
+    while (normalized > 10000000000) {
+      normalized = Math.floor(normalized / 1000)
+    }
+    return normalized
+  }
+
+  private parseLocalDateDayRange(value: unknown): { start: number; end: number } | null {
+    const text = String(value || '').trim()
+    const match = text.match(/^(\d{4})-(\d{2})-(\d{2})$/)
+    if (!match) return null
+    const year = Number(match[1])
+    const month = Number(match[2])
+    const day = Number(match[3])
+    const start = new Date(year, month - 1, day, 0, 0, 0, 0)
+    if (
+      !Number.isFinite(start.getTime()) ||
+      start.getFullYear() !== year ||
+      start.getMonth() !== month - 1 ||
+      start.getDate() !== day
+    ) {
+      return null
+    }
+    const end = new Date(start)
+    end.setDate(end.getDate() + 1)
+    return {
+      start: Math.floor(start.getTime() / 1000),
+      end: Math.floor(end.getTime() / 1000)
+    }
+  }
+
+  private getIntervalPeriods(startTime: number, endTime: number, includePartial: boolean): Array<{ start: number; end: number }> {
+    const intervalHours = normalizeIntervalHours(this.config.get('aiGroupSummaryIntervalHours'))
+    const intervalSeconds = intervalHours * 60 * 60
+    const periods: Array<{ start: number; end: number }> = []
+    for (let start = startTime; start < endTime; start += intervalSeconds) {
+      const end = Math.min(start + intervalSeconds, endTime)
+      if (!includePartial && end - start < intervalSeconds) continue
+      if (end > start) periods.push({ start, end })
+    }
+    return periods
+  }
+
+  private getCompletedPeriodsToday(): Array<{ start: number; end: number }> {
+    const dayStart = getStartOfDaySeconds(new Date())
+    const now = Math.floor(Date.now() / 1000)
+    return this.getIntervalPeriods(dayStart, now, false)
+  }
+
+  private async queueDueAutoSummaries(): Promise<void> {
+    if (!this.started || !this.isEnabled()) return
+    if (this.processing) {
+      this.pendingAutoRun = true
+      return
+    }
+    this.processing = true
+    try {
+      do {
+        this.pendingAutoRun = false
+        await this.runDueAutoSummariesOnce()
+      } while (this.pendingAutoRun && this.started && this.isEnabled())
+    } finally {
+      this.processing = false
+    }
+  }
+
+  private async runDueAutoSummariesOnce(): Promise<void> {
+    if (!this.started || !this.isEnabled()) return
+    try {
+      const { apiBaseUrl, apiKey } = this.getSharedAiModelConfig()
+      if (!apiBaseUrl || !apiKey) return
+      const scopeSessionIds = this.getAutoScopeSessionIds()
+      if (scopeSessionIds.length === 0) return
+      if (!await this.ensureConnected()) return
+
+      const contacts = (await chatService.enrichSessionsContactInfo(scopeSessionIds).catch(() => null))?.contacts || {}
+
+      const periods = this.getCompletedPeriodsToday()
+      for (const period of periods) {
+        for (const sessionId of scopeSessionIds) {
+          if (!this.started || !this.isEnabled()) return
+          if (!sessionId) continue
+          if (groupSummaryRecordService.hasAutoRecord(sessionId, period.start, period.end)) continue
+          await this.generateSummaryForPeriod({
+            sessionId,
+            displayName: contacts[sessionId]?.displayName || sessionId,
+            avatarUrl: contacts[sessionId]?.avatarUrl,
+            periodStart: period.start,
+            periodEnd: period.end,
+            triggerType: 'auto'
+          })
+        }
+      }
+    } catch (error) {
+      console.warn('[GroupSummaryService] 自动总结失败:', error)
+    }
+  }
+
+  private async readMessagesInPeriod(sessionId: string, startTime: number, endTime: number): Promise<Message[]> {
+    if (!await this.ensureConnected()) {
+      throw new Error('数据库连接失败，请先在“数据库连接”页完成配置')
+    }
+    const cursorResult = await wcdbService.openMessageCursorLite(
+      sessionId,
+      SUMMARY_CURSOR_BATCH_SIZE,
+      true,
+      startTime,
+      endTime
+    )
+    if (!cursorResult.success || !cursorResult.cursor) {
+      throw new Error(cursorResult.error || '打开消息游标失败')
+    }
+
+    const cursor = cursorResult.cursor
+    const messages: Message[] = []
+    try {
+      let hasMore = true
+      while (hasMore && messages.length < MAX_MESSAGES_PER_SUMMARY) {
+        const batch = await wcdbService.fetchMessageBatch(cursor)
+        if (!batch.success) {
+          throw new Error(batch.error || '读取消息失败')
+        }
+        hasMore = batch.hasMore === true
+        const rows = Array.isArray(batch.rows) ? batch.rows as Record<string, any>[] : []
+        if (rows.length === 0) {
+          if (!hasMore) break
+          continue
+        }
+        const mapped = chatService.mapRowsToMessagesForApi(rows, sessionId)
+        for (const message of mapped) {
+          const createTime = Number(message.createTime || 0)
+          if (createTime < startTime || createTime > endTime) continue
+          messages.push(message)
+          if (messages.length >= MAX_MESSAGES_PER_SUMMARY) break
+        }
+      }
+    } finally {
+      await wcdbService.closeMessageCursor(cursor).catch(() => {})
+    }
+
+    return messages.sort((a, b) => {
+      if (a.createTime !== b.createTime) return a.createTime - b.createTime
+      if (a.sortSeq !== b.sortSeq) return a.sortSeq - b.sortSeq
+      return a.localId - b.localId
+    })
+  }
+
+  private normalizeMessageText(message: Message): string {
+    const parsedContent = String(message.parsedContent || '').replace(/\s+/g, ' ').trim()
+    const quotedContent = String(message.quotedContent || '').replace(/\s+/g, ' ').trim()
+    const quotedSender = String(message.quotedSender || '').replace(/\s+/g, ' ').trim()
+    let text = parsedContent
+    if (quotedContent) {
+      const quote = quotedSender ? `${quotedSender}：${quotedContent}` : quotedContent
+      text = text && text !== '[引用消息]' ? `${text} [引用 ${quote}]` : `[引用 ${quote}]`
+    }
+    if (!text) {
+      text = String(message.linkTitle || message.fileName || message.appMsgDesc || '').replace(/\s+/g, ' ').trim()
+    }
+    if (!text) return ''
+    if (/^<\?xml|^<msg\b|^<appmsg\b|^<img\b|^<emoji\b/i.test(text)) return ''
+    return text
+  }
+
+  private async buildTranscript(sessionId: string, messages: Message[]): Promise<{ transcript: string; readableMessages: Message[] }> {
+    const readableMessages = messages.filter((message) => this.normalizeMessageText(message))
+    const senderIds = Array.from(new Set(
+      readableMessages
+        .map((message) => String(message.senderUsername || '').trim())
+        .filter(Boolean)
+    ))
+    const contacts = senderIds.length > 0
+      ? (await chatService.enrichSessionsContactInfo(senderIds).catch(() => null))?.contacts || {}
+      : {}
+    const myWxid = String(this.config.getMyWxidCleaned() || '').trim()
+
+    const lines = readableMessages.map((message) => {
+      const senderUsername = String(message.senderUsername || '').trim()
+      const senderName = message.isSend === 1 || (senderUsername && myWxid && senderUsername === myWxid)
+        ? '我'
+        : (contacts[senderUsername]?.displayName || senderUsername || '未知成员')
+      return `${formatTimestamp(message.createTime)} ${senderName}：${this.normalizeMessageText(message)}`
+    })
+
+    return {
+      transcript: lines.join('\n'),
+      readableMessages
+    }
+  }
+
+  private async generateSummaryForPeriod(params: {
+    sessionId: string
+    displayName: string
+    avatarUrl?: string
+    periodStart: number
+    periodEnd: number
+    triggerType: GroupSummaryTriggerType
+  }): Promise<GroupSummaryTriggerResult> {
+    const { apiBaseUrl, apiKey, model } = this.getSharedAiModelConfig()
+    if (!apiBaseUrl || !apiKey) {
+      return { success: false, message: '请先填写通用 AI 模型配置（API 地址和 Key）' }
+    }
+
+    try {
+      const messages = await this.readMessagesInPeriod(params.sessionId, params.periodStart, params.periodEnd)
+      const { transcript, readableMessages } = await this.buildTranscript(params.sessionId, messages)
+      if (readableMessages.length < MIN_SUMMARY_MESSAGES) {
+        return {
+          success: true,
+          skipped: true,
+          skippedReason: 'message_count_too_low',
+          message: `该时段可总结消息少于 ${MIN_SUMMARY_MESSAGES} 条，已跳过`
+        }
+      }
+
+      const customPrompt = String(this.config.get('aiGroupSummarySystemPrompt') || '').trim()
+      const systemPrompt = customPrompt || DEFAULT_GROUP_SUMMARY_SYSTEM_PROMPT
+      const userPrompt = `群聊：${params.displayName}
+总结时段：${formatTimestamp(params.periodStart)} 至 ${formatTimestamp(params.periodEnd)}
+消息数量：${readableMessages.length}
+
+群聊记录：
+${transcript}
+
+请只输出指定 JSON。`
+      const endpoint = buildApiUrl(apiBaseUrl, '/chat/completions')
+      const requestMessages = [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt }
+      ]
+
+      let rawOutput = ''
+      let responseFormatJson = true
+      let responseFormatFallback = false
+      let responseFormatFallbackReason = ''
+      const startedAt = Date.now()
+      try {
+        rawOutput = await callChatCompletions(apiBaseUrl, apiKey, model, requestMessages, { responseFormatJson: true })
+      } catch (error) {
+        if (!shouldFallbackJsonMode(error)) throw error
+        responseFormatJson = false
+        responseFormatFallback = true
+        responseFormatFallbackReason = (error as Error).message || 'response_format 不受支持'
+        rawOutput = await callChatCompletions(apiBaseUrl, apiKey, model, requestMessages)
+      }
+
+      let topics: GroupSummaryTopic[]
+      let finalSummary: string
+      try {
+        topics = parseTopics(rawOutput)
+        finalSummary = buildSummaryText(topics)
+      } catch {
+        topics = [fallbackTopicFromRaw(rawOutput)]
+        finalSummary = buildSummaryText(topics)
+      }
+
+      const log: GroupSummaryLog = {
+        endpoint,
+        model,
+        temperature: API_TEMPERATURE,
+        triggerType: params.triggerType,
+        periodStart: params.periodStart,
+        periodEnd: params.periodEnd,
+        messageCount: messages.length,
+        readableMessageCount: readableMessages.length,
+        systemPrompt,
+        userPrompt,
+        rawOutput,
+        finalSummary,
+        durationMs: Date.now() - startedAt,
+        createdAt: Date.now(),
+        responseFormatJson,
+        responseFormatFallback,
+        responseFormatFallbackReason,
+        parsedTopics: topics
+      }
+
+      const record = groupSummaryRecordService.addRecord({
+        sessionId: params.sessionId,
+        displayName: params.displayName,
+        avatarUrl: params.avatarUrl,
+        triggerType: params.triggerType,
+        periodStart: params.periodStart,
+        periodEnd: params.periodEnd,
+        messageCount: messages.length,
+        readableMessageCount: readableMessages.length,
+        topics,
+        summaryText: finalSummary,
+        rawOutput,
+        log
+      })
+
+      return { success: true, message: '群聊总结已生成', recordId: record.id, record }
+    } catch (error) {
+      return { success: false, message: `生成失败：${(error as Error).message || String(error)}` }
+    }
+  }
+
+  private async generateSummariesForPeriods(params: {
+    sessionId: string
+    displayName: string
+    avatarUrl?: string
+    periods: Array<{ start: number; end: number }>
+    triggerType: GroupSummaryTriggerType
+  }): Promise<GroupSummaryDayTriggerResult> {
+    const records: GroupSummaryRecordSummary[] = []
+    let skipped = 0
+    let failed = 0
+    let firstError = ''
+
+    for (const period of params.periods) {
+      const result = await this.generateSummaryForPeriod({
+        sessionId: params.sessionId,
+        displayName: params.displayName,
+        avatarUrl: params.avatarUrl,
+        periodStart: period.start,
+        periodEnd: period.end,
+        triggerType: params.triggerType
+      })
+      if (result.success && result.record) {
+        records.push(result.record)
+        continue
+      }
+      if (result.success && result.skipped) {
+        skipped += 1
+        continue
+      }
+      failed += 1
+      if (!firstError) firstError = result.message
+    }
+
+    const generated = records.length
+    const parts = [`生成 ${generated} 段`, `跳过 ${skipped} 段`]
+    if (failed > 0) parts.push(`失败 ${failed} 段`)
+    const message = failed > 0 && generated === 0 && skipped === 0
+      ? (firstError || '群聊总结生成失败')
+      : `群聊总结完成：${parts.join('，')}`
+
+    return {
+      success: generated > 0 || skipped > 0 || failed === 0,
+      message,
+      generated,
+      skipped,
+      records
+    }
+  }
+}
+
+export const groupSummaryService = new GroupSummaryService()

electron/services/imageDownloadService.ts

@@ -0,0 +1,203 @@
+import { app } from 'electron'
+import { join } from 'path'
+import { existsSync } from 'fs'
+import { execFile } from 'child_process'
+import { promisify } from 'util'
+// import { ConfigService } from './config'
+
+const execFileAsync = promisify(execFile)
+
+export class ImageDownloadService {
+  private static instance: ImageDownloadService
+  private koffi: any = null
+  private lib: any = null
+  private initialized = false
+
+  private initImgHelper: any = null
+  private uninstallImgHelper: any = null
+  private getImgHelperError: any = null
+
+  private currentPid: number | null = null
+  private pollTimer: NodeJS.Timeout | null = null
+  private isHooked = false
+
+  private lastWhitelist: string[] = []
+
+  static getInstance(): ImageDownloadService {
+    if (!ImageDownloadService.instance) {
+      ImageDownloadService.instance = new ImageDownloadService()
+    }
+    return ImageDownloadService.instance
+  }
+
+  private constructor() {
+  }
+
+  private async ensureInitialized(): Promise<boolean> {
+    if (this.initialized) return true
+    if (process.platform !== 'win32' || process.arch !== 'x64') return false
+
+    try {
+      this.koffi = require('koffi')
+      const dllPath = this.getDllPath()
+      if (!existsSync(dllPath)) return false
+
+      this.lib = this.koffi.load(dllPath)
+
+      this.initImgHelper = this.lib.func('bool InitImgHelper(uint32, const char*)')
+      this.uninstallImgHelper = this.lib.func('void UninstallImgHelper()')
+      this.getImgHelperError = this.lib.func('const char* GetImgHelperError()')
+
+      this.initialized = true
+      return true
+    } catch (error) {
+      console.error('[ImageDownloadService] failed to initialize:', error)
+      return false
+    }
+  }
+
+  private getDllPath(): string {
+    const isPackaged = app.isPackaged
+    const candidates: string[] = []
+    
+    if (isPackaged) {
+      candidates.push(join(process.resourcesPath, 'resources', 'image', 'win32', 'x64', 'img_helper.dll'))
+    } else {
+      candidates.push(join(process.cwd(), 'resources', 'image', 'win32', 'x64', 'img_helper.dll'))
+    }
+
+    for (const path of candidates) {
+      if (existsSync(path)) return path
+    }
+    return candidates[0]
+  }
+
+  private async findMainWeChatPid(): Promise<number | null> {
+    try {
+      const script = `
+      Get-CimInstance Win32_Process -Filter "Name = 'Weixin.exe'" | 
+      Select-Object ProcessId, CommandLine | 
+      ConvertTo-Json -Compress
+    `;
+
+      const { stdout } = await execFileAsync('powershell', ['-NoProfile', '-Command', script])
+      if (!stdout || !stdout.trim()) return null
+
+      let processes = JSON.parse(stdout.trim())
+      if (!Array.isArray(processes)) processes = [processes]
+
+      const target = processes
+          .filter((p: any) => p.CommandLine && p.CommandLine.toLowerCase().includes('weixin.exe'))
+          .sort((a: any, b: any) => a.CommandLine.length - b.CommandLine.length)[0]
+
+      return target ? target.ProcessId : null;
+    } catch (e) {
+      return null
+    }
+  }
+
+  async startAutoDownload(whitelist: string[] | string = []): Promise<{ success: boolean; error?: string }> {
+    if (!await this.ensureInitialized()) {
+      return { success: false, error: '核心组件初始化失败' }
+    }
+
+    if (this.isHooked) {
+      await this.unhook()
+    }
+
+    this.lastWhitelist = whitelist
+
+    if (!this.pollTimer) {
+      this.pollTimer = setInterval(() => this.checkAndHook(this.lastWhitelist, false), 30000)
+    }
+
+    return await this.checkAndHook(whitelist, true)
+  }
+
+  async stopAutoDownload() {
+    if (this.pollTimer) {
+      clearInterval(this.pollTimer)
+      this.pollTimer = null
+    }
+    await this.unhook()
+  }
+
+  private async checkAndHook(whitelist: string[] | string = [], isManualStart = false): Promise<{ success: boolean; error?: string }> {
+    const pid = await this.findMainWeChatPid()
+
+    if (!pid) {
+      if (this.isHooked) {
+        console.log('[ImageDownloadService] WeChat exited, unhooking')
+        await this.unhook()
+      }
+      return { success: true, error: '等待微信启动' }
+    }
+
+    if (this.isHooked && this.currentPid === pid) {
+      return { success: true }
+    }
+
+    if (this.isHooked && this.currentPid !== pid) {
+      console.log('[ImageDownloadService] WeChat PID changed, re-hooking')
+      await this.unhook()
+    }
+
+    console.log(`[ImageDownloadService] attempting to hook PID: ${pid}`)
+    try {
+      let whitelistBuffer: Buffer | null = null;
+      if (typeof whitelist === 'string') {
+        if (whitelist.length > 0) {
+          whitelistBuffer = Buffer.from(whitelist, 'utf8');
+        }
+      } else if (Array.isArray(whitelist) && whitelist.length > 0) {
+        whitelistBuffer = Buffer.from(whitelist.join('\0') + '\0\0', 'utf8');
+      }
+
+      const success = this.initImgHelper(pid, whitelistBuffer)
+
+      if (success) {
+        this.isHooked = true
+        this.currentPid = pid
+        console.log('[ImageDownloadService] hook successful')
+        return { success: true }
+      } else {
+        const err = this.getImgHelperError()
+        console.error(`[ImageDownloadService] hook failed: ${err}`)
+        if (isManualStart && this.pollTimer) {
+          clearInterval(this.pollTimer)
+          this.pollTimer = null
+        }
+        return { success: false, error: err || 'Hook 失败' }
+      }
+    } catch (e: any) {
+      console.error('[ImageDownloadService] InitImgHelper call crashed:', e)
+      if (isManualStart && this.pollTimer) {
+        clearInterval(this.pollTimer)
+        this.pollTimer = null
+      }
+      return { success: false, error: `调用异常: ${e.message || String(e)}` }
+    }
+  }
+
+  private async unhook() {
+    if (this.isHooked && this.uninstallImgHelper) {
+      try {
+        this.uninstallImgHelper()
+      } catch (e) {
+        console.error('[ImageDownloadService] uninstall failed:', e)
+      }
+    }
+    this.isHooked = false
+    this.currentPid = null
+  }
+
+  async getStatus() {
+    return {
+      isHooked: this.isHooked,
+      pid: this.currentPid,
+      supported: process.platform === 'win32' && process.arch === 'x64'
+    }
+  }
+}
+
+export const imageDownloadService = ImageDownloadService.getInstance()

electron/services/imagePreloadService.ts

@@ -4,38 +4,63 @@ type PreloadImagePayload = {
   sessionId?: string
   imageMd5?: string
   imageDatName?: string
+  createTime?: number
+}
+
+type PreloadOptions = {
+  allowDecrypt?: boolean
+  allowCacheIndex?: boolean
 }
 
 type PreloadTask = PreloadImagePayload & {
   key: string
+  allowDecrypt: boolean
+  allowCacheIndex: boolean
 }
 
 export class ImagePreloadService {
   private queue: PreloadTask[] = []
   private pending = new Set<string>()
-  private active = 0
-  private readonly maxConcurrent = 2
+  private activeCache = 0
+  private activeDecrypt = 0
+  private readonly maxCacheConcurrent = 8
+  private readonly maxDecryptConcurrent = 2
+  private readonly maxQueueSize = 320
 
-  enqueue(payloads: PreloadImagePayload[]): void {
+  enqueue(payloads: PreloadImagePayload[], options?: PreloadOptions): void {
     if (!Array.isArray(payloads) || payloads.length === 0) return
+    const allowDecrypt = options?.allowDecrypt !== false
+    const allowCacheIndex = options?.allowCacheIndex !== false
     for (const payload of payloads) {
+      if (!allowDecrypt && this.queue.length >= this.maxQueueSize) break
       const cacheKey = payload.imageMd5 || payload.imageDatName
       if (!cacheKey) continue
       const key = `${payload.sessionId || 'unknown'}|${cacheKey}`
       if (this.pending.has(key)) continue
       this.pending.add(key)
-      this.queue.push({ ...payload, key })
+      this.queue.push({ ...payload, key, allowDecrypt, allowCacheIndex })
     }
     this.processQueue()
   }
 
   private processQueue(): void {
-    while (this.active < this.maxConcurrent && this.queue.length > 0) {
-      const task = this.queue.shift()
+    while (this.queue.length > 0) {
+      const taskIndex = this.queue.findIndex((task) => (
+        task.allowDecrypt
+          ? this.activeDecrypt < this.maxDecryptConcurrent
+          : this.activeCache < this.maxCacheConcurrent
+      ))
+      if (taskIndex < 0) return
+
+      const task = this.queue.splice(taskIndex, 1)[0]
       if (!task) return
-      this.active += 1
+
+      if (task.allowDecrypt) this.activeDecrypt += 1
+      else this.activeCache += 1
+
       void this.handleTask(task).finally(() => {
-        this.active -= 1
+        if (task.allowDecrypt) this.activeDecrypt = Math.max(0, this.activeDecrypt - 1)
+        else this.activeCache = Math.max(0, this.activeCache - 1)
         this.pending.delete(task.key)
         this.processQueue()
       })
@@ -49,13 +74,25 @@ export class ImagePreloadService {
       const cached = await imageDecryptService.resolveCachedImage({
         sessionId: task.sessionId,
         imageMd5: task.imageMd5,
-        imageDatName: task.imageDatName
+        imageDatName: task.imageDatName,
+        createTime: task.createTime,
+        preferFilePath: true,
+        hardlinkOnly: true,
+        disableUpdateCheck: !task.allowDecrypt,
+        allowCacheIndex: task.allowCacheIndex,
+        suppressEvents: true
       })
       if (cached.success) return
+      if (!task.allowDecrypt) return
       await imageDecryptService.decryptImage({
         sessionId: task.sessionId,
         imageMd5: task.imageMd5,
-        imageDatName: task.imageDatName
+        imageDatName: task.imageDatName,
+        createTime: task.createTime,
+        preferFilePath: true,
+        hardlinkOnly: true,
+        disableUpdateCheck: true,
+        suppressEvents: true
       })
     } catch {
       // ignore preload failures

electron/services/insightRecordService.ts

@@ -0,0 +1,380 @@
+import { app } from 'electron'
+import fs from 'fs'
+import path from 'path'
+import { createHash, randomUUID } from 'crypto'
+import { ConfigService } from './config'
+
+export type InsightRecordTriggerReason = 'activity' | 'silence' | 'test' | 'manual' | 'message_analysis'
+export type InsightRecordSourceType = 'insight' | 'message_analysis'
+
+export interface MessageInsightAnalysis {
+  explicitText: string
+  emotion: string
+  intent: string
+  topic: string
+}
+
+export interface MessageInsightTarget {
+  targetLocalId: number
+  targetCreateTime: number
+  targetMessageKey: string
+  targetSenderName: string
+  targetTextPreview: string
+  analysis: MessageInsightAnalysis
+}
+
+export interface InsightRecordLog {
+  endpoint: string
+  model: string
+  maxTokens: number
+  temperature: number
+  triggerReason: InsightRecordTriggerReason
+  allowContext: boolean
+  contextCount: number
+  systemPrompt: string
+  userPrompt: string
+  rawOutput: string
+  finalInsight: string
+  durationMs: number
+  createdAt: number
+  responseFormatJson?: boolean
+  responseFormatFallback?: boolean
+  responseFormatFallbackReason?: string
+  targetMessage?: {
+    localId: number
+    createTime: number
+    messageKey: string
+    senderName: string
+    textPreview: string
+  }
+  contextStats?: {
+    requested: number
+    beforeTarget: number
+    afterTarget: number
+    readError?: string
+  }
+  parsedAnalysis?: MessageInsightAnalysis
+}
+
+export interface InsightRecord {
+  id: string
+  accountScope: string
+  sourceType: InsightRecordSourceType
+  createdAt: number
+  sessionId: string
+  displayName: string
+  avatarUrl?: string
+  triggerReason: InsightRecordTriggerReason
+  insight: string
+  read: boolean
+  messageInsight?: MessageInsightTarget
+  log: InsightRecordLog
+}
+
+export interface InsightRecordSummary {
+  id: string
+  sourceType: InsightRecordSourceType
+  createdAt: number
+  sessionId: string
+  displayName: string
+  avatarUrl?: string
+  triggerReason: InsightRecordTriggerReason
+  insight: string
+  read: boolean
+  messageInsight?: MessageInsightTarget
+}
+
+export interface InsightRecordContactFacet {
+  sessionId: string
+  displayName: string
+  avatarUrl?: string
+  count: number
+}
+
+export interface InsightRecordFilters {
+  keyword?: string
+  sessionId?: string
+  startTime?: number
+  endTime?: number
+  sourceType?: InsightRecordSourceType | 'all'
+  limit?: number
+  offset?: number
+}
+
+export interface InsightRecordListResult {
+  success: boolean
+  records: InsightRecordSummary[]
+  total: number
+  todayCount: number
+  unreadCount: number
+  contacts: InsightRecordContactFacet[]
+  error?: string
+}
+
+class InsightRecordService {
+  private readonly maxRecordsPerScope = 1000
+  private filePath: string | null = null
+  private loaded = false
+  private records: InsightRecord[] = []
+
+  private resolveFilePath(): string {
+    if (this.filePath) return this.filePath
+    const workerUserDataPath = String(process.env.WEFLOW_USER_DATA_PATH || process.env.WEFLOW_CONFIG_CWD || '').trim()
+    const userDataPath = workerUserDataPath || app?.getPath?.('userData') || process.cwd()
+    fs.mkdirSync(userDataPath, { recursive: true })
+    this.filePath = path.join(userDataPath, 'weflow-insight-records.json')
+    return this.filePath
+  }
+
+  private ensureLoaded(): void {
+    if (this.loaded) return
+    this.loaded = true
+    const filePath = this.resolveFilePath()
+    try {
+      if (!fs.existsSync(filePath)) return
+      const raw = fs.readFileSync(filePath, 'utf-8')
+      const parsed = JSON.parse(raw)
+      if (Array.isArray(parsed)) {
+        this.records = parsed.filter((item) => item && typeof item === 'object') as InsightRecord[]
+      } else if (Array.isArray(parsed?.records)) {
+        this.records = parsed.records.filter((item: unknown) => item && typeof item === 'object') as InsightRecord[]
+      }
+    } catch {
+      this.records = []
+    }
+  }
+
+  private persist(): void {
+    try {
+      const filePath = this.resolveFilePath()
+      fs.writeFileSync(filePath, JSON.stringify({ version: 1, records: this.records }, null, 2), 'utf-8')
+    } catch {
+      // Keep insight generation non-blocking even if local persistence fails.
+    }
+  }
+
+  private getCurrentAccountScope(): string {
+    const config = ConfigService.getInstance()
+    const myWxid = String(config.getMyWxidCleaned() || '').trim()
+    if (myWxid) return `wxid:${myWxid}`
+
+    const dbPath = String(config.get('dbPath') || '').trim()
+    if (dbPath) {
+      const hash = createHash('sha1').update(dbPath).digest('hex').slice(0, 16)
+      return `db:${hash}`
+    }
+    return 'default'
+  }
+
+  private getStartOfToday(): number {
+    const date = new Date()
+    date.setHours(0, 0, 0, 0)
+    return date.getTime()
+  }
+
+  private toSummary(record: InsightRecord): InsightRecordSummary {
+    return {
+      id: record.id,
+      sourceType: record.sourceType || 'insight',
+      createdAt: record.createdAt,
+      sessionId: record.sessionId,
+      displayName: record.displayName,
+      avatarUrl: record.avatarUrl,
+      triggerReason: record.triggerReason,
+      insight: record.insight,
+      read: record.read,
+      messageInsight: record.messageInsight
+    }
+  }
+
+  private getScopedRecords(): InsightRecord[] {
+    this.ensureLoaded()
+    const scope = this.getCurrentAccountScope()
+    return this.records.filter((record) => record.accountScope === scope)
+  }
+
+  addRecord(input: {
+    sessionId: string
+    displayName: string
+    avatarUrl?: string
+    sourceType?: InsightRecordSourceType
+    triggerReason: InsightRecordTriggerReason
+    insight: string
+    messageInsight?: MessageInsightTarget
+    log: InsightRecordLog
+  }): InsightRecord {
+    this.ensureLoaded()
+    const scope = this.getCurrentAccountScope()
+    const now = Date.now()
+    const record: InsightRecord = {
+      id: randomUUID(),
+      accountScope: scope,
+      sourceType: input.sourceType || 'insight',
+      createdAt: now,
+      sessionId: input.sessionId,
+      displayName: input.displayName,
+      avatarUrl: input.avatarUrl,
+      triggerReason: input.triggerReason,
+      insight: input.insight,
+      read: false,
+      messageInsight: input.messageInsight,
+      log: input.log
+    }
+
+    this.records.push(record)
+    const scopedRecords = this.records
+      .filter((item) => item.accountScope === scope)
+      .sort((a, b) => b.createdAt - a.createdAt)
+    const keepIds = new Set(scopedRecords.slice(0, this.maxRecordsPerScope).map((item) => item.id))
+    this.records = this.records.filter((item) => item.accountScope !== scope || keepIds.has(item.id))
+    this.persist()
+    return record
+  }
+
+  listRecords(filters: InsightRecordFilters = {}): InsightRecordListResult {
+    try {
+      const allScoped = this.getScopedRecords()
+      const todayStart = this.getStartOfToday()
+      const contactsMap = new Map<string, InsightRecordContactFacet>()
+      for (const record of allScoped) {
+        const existing = contactsMap.get(record.sessionId)
+        if (existing) {
+          existing.count += 1
+        } else {
+          contactsMap.set(record.sessionId, {
+            sessionId: record.sessionId,
+            displayName: record.displayName,
+            avatarUrl: record.avatarUrl,
+            count: 1
+          })
+        }
+      }
+
+      const keyword = String(filters.keyword || '').trim().toLowerCase()
+      const sessionId = String(filters.sessionId || '').trim()
+      const sourceType = String(filters.sourceType || 'all').trim()
+      const startTime = Number(filters.startTime || 0)
+      const endTime = Number(filters.endTime || 0)
+      const offset = Math.max(0, Math.floor(Number(filters.offset || 0)))
+      const limit = Math.min(200, Math.max(1, Math.floor(Number(filters.limit || 100))))
+
+      const filtered = allScoped
+        .filter((record) => {
+          if (sessionId && record.sessionId !== sessionId) return false
+          const recordSourceType = record.sourceType || 'insight'
+          if (sourceType !== 'all' && sourceType && recordSourceType !== sourceType) return false
+          if (startTime > 0 && record.createdAt < startTime) return false
+          if (endTime > 0 && record.createdAt > endTime) return false
+          if (keyword) {
+            const haystack = [
+              record.displayName,
+              record.sessionId,
+              record.insight,
+              record.messageInsight?.targetSenderName,
+              record.messageInsight?.targetTextPreview,
+              record.messageInsight?.analysis?.explicitText,
+              record.messageInsight?.analysis?.emotion,
+              record.messageInsight?.analysis?.intent,
+              record.messageInsight?.analysis?.topic
+            ].join('\n').toLowerCase()
+            if (!haystack.includes(keyword)) return false
+          }
+          return true
+        })
+        .sort((a, b) => b.createdAt - a.createdAt)
+
+      return {
+        success: true,
+        records: filtered.slice(offset, offset + limit).map((record) => this.toSummary(record)),
+        total: filtered.length,
+        todayCount: allScoped.filter((record) => record.createdAt >= todayStart).length,
+        unreadCount: allScoped.filter((record) => !record.read).length,
+        contacts: Array.from(contactsMap.values()).sort((a, b) => b.count - a.count)
+      }
+    } catch (error) {
+      return {
+        success: false,
+        records: [],
+        total: 0,
+        todayCount: 0,
+        unreadCount: 0,
+        contacts: [],
+        error: (error as Error).message
+      }
+    }
+  }
+
+  getRecord(id: string): { success: boolean; record?: InsightRecord; error?: string } {
+    this.ensureLoaded()
+    const normalizedId = String(id || '').trim()
+    if (!normalizedId) return { success: false, error: '记录 ID 为空' }
+    const scope = this.getCurrentAccountScope()
+    const record = this.records.find((item) => item.id === normalizedId && item.accountScope === scope)
+    if (!record) return { success: false, error: '未找到该见解记录' }
+    return { success: true, record }
+  }
+
+  findLatestMessageAnalysis(input: {
+    sessionId: string
+    targetLocalId?: number
+    targetCreateTime?: number
+    targetMessageKey?: string
+  }): InsightRecord | null {
+    this.ensureLoaded()
+    const scope = this.getCurrentAccountScope()
+    const sessionId = String(input.sessionId || '').trim()
+    if (!sessionId) return null
+    const targetLocalId = Math.floor(Number(input.targetLocalId || 0))
+    const targetCreateTime = Math.floor(Number(input.targetCreateTime || 0))
+    const targetMessageKey = String(input.targetMessageKey || '').trim()
+    const matches = this.records
+      .filter((record) => {
+        if (record.accountScope !== scope) return false
+        if ((record.sourceType || 'insight') !== 'message_analysis') return false
+        if (record.sessionId !== sessionId) return false
+        const target = record.messageInsight
+        if (!target) return false
+        if (targetLocalId > 0 && Number(target.targetLocalId || 0) === targetLocalId) {
+          if (targetCreateTime <= 0 || Number(target.targetCreateTime || 0) === targetCreateTime) return true
+        }
+        if (targetMessageKey && target.targetMessageKey === targetMessageKey) return true
+        return false
+      })
+      .sort((a, b) => b.createdAt - a.createdAt)
+    return matches[0] || null
+  }
+
+  markRecordRead(id: string): { success: boolean; error?: string } {
+    this.ensureLoaded()
+    const normalizedId = String(id || '').trim()
+    const scope = this.getCurrentAccountScope()
+    const record = this.records.find((item) => item.id === normalizedId && item.accountScope === scope)
+    if (!record) return { success: false, error: '未找到该见解记录' }
+    if (!record.read) {
+      record.read = true
+      this.persist()
+    }
+    return { success: true }
+  }
+
+  clearRecords(filters: InsightRecordFilters = {}): { success: boolean; removed: number; error?: string } {
+    this.ensureLoaded()
+    const scope = this.getCurrentAccountScope()
+    const sessionId = String(filters.sessionId || '').trim()
+    const startTime = Number(filters.startTime || 0)
+    const endTime = Number(filters.endTime || 0)
+    let removed = 0
+    this.records = this.records.filter((record) => {
+      if (record.accountScope !== scope) return true
+      if (sessionId && record.sessionId !== sessionId) return true
+      if (startTime > 0 && record.createdAt < startTime) return true
+      if (endTime > 0 && record.createdAt > endTime) return true
+      removed += 1
+      return false
+    })
+    this.persist()
+    return { success: true, removed }
+  }
+}
+
+export const insightRecordService = new InsightRecordService()

electron/services/keyService.ts

@@ -9,7 +9,11 @@ import crypto from 'crypto'
 const execFileAsync = promisify(execFile)
 
 type DbKeyResult = { success: boolean; key?: string; error?: string; logs?: string[] }
-type ImageKeyResult = { success: boolean; xorKey?: number; aesKey?: string; error?: string }
+type ImageKeyResult = { success: boolean; xorKey?: number; aesKey?: string; verified?: boolean; error?: string }
+type DbKeyPollResult =
+  | { status: 'success'; key: string; loginRequiredDetected: boolean }
+  | { status: 'process-ended'; loginRequiredDetected: boolean }
+  | { status: 'timeout'; loginRequiredDetected: boolean }
 
 export class KeyService {
   private readonly isMac = process.platform === 'darwin'
@@ -58,9 +62,11 @@ export class KeyService {
   private readonly HKEY_CURRENT_USER = 0x80000001
   private readonly ERROR_SUCCESS = 0
   private readonly WM_CLOSE = 0x0010
+  private readonly DB_KEY_PROCESS_CHECK_INTERVAL_MS = 1000
 
   private getDllPath(): string {
     const isPackaged = typeof app !== 'undefined' && app ? app.isPackaged : process.env.NODE_ENV === 'production'
+    const archDir = process.arch === 'arm64' ? 'arm64' : 'x64'
     const candidates: string[] = []
 
     if (process.env.WX_KEY_DLL_PATH) {
@@ -68,11 +74,20 @@ export class KeyService {
     }
 
     if (isPackaged) {
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'win32', archDir, 'wx_key.dll'))
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'win32', 'x64', 'wx_key.dll'))
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'win32', 'wx_key.dll'))
       candidates.push(join(process.resourcesPath, 'resources', 'wx_key.dll'))
       candidates.push(join(process.resourcesPath, 'wx_key.dll'))
     } else {
       const cwd = process.cwd()
+      candidates.push(join(cwd, 'resources', 'key', 'win32', archDir, 'wx_key.dll'))
+      candidates.push(join(cwd, 'resources', 'key', 'win32', 'x64', 'wx_key.dll'))
+      candidates.push(join(cwd, 'resources', 'key', 'win32', 'wx_key.dll'))
       candidates.push(join(cwd, 'resources', 'wx_key.dll'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'win32', archDir, 'wx_key.dll'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'win32', 'x64', 'wx_key.dll'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'win32', 'wx_key.dll'))
       candidates.push(join(app.getAppPath(), 'resources', 'wx_key.dll'))
     }
 
@@ -332,30 +347,169 @@ export class KeyService {
     return null
   }
 
-  private async findPidByImageName(imageName: string): Promise<number | null> {
+  private async findPidsByImageName(imageName: string): Promise<number[]> {
     try {
       const { stdout } = await execFileAsync('tasklist', ['/FI', `IMAGENAME eq ${imageName}`, '/FO', 'CSV', '/NH'])
       const lines = stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean)
+      const pids: number[] = []
       for (const line of lines) {
         if (line.startsWith('INFO:')) continue
         const parts = line.split('","').map((p) => p.replace(/^"|"$/g, ''))
         if (parts[0]?.toLowerCase() === imageName.toLowerCase()) {
           const pid = Number(parts[1])
-          if (!Number.isNaN(pid)) return pid
+          if (!Number.isNaN(pid)) pids.push(pid)
         }
       }
-      return null
+      return pids
     } catch (e) {
-      return null
+      return []
     }
   }
 
-  private async findWeChatPid(): Promise<number | null> {
-    const names = ['Weixin.exe', 'WeChat.exe']
-    for (const name of names) {
-      const pid = await this.findPidByImageName(name)
+  private async findWeChatPids(): Promise<number[]> {
+    const pids: number[] = []
+    const pushUnique = (pid: number | null | undefined) => {
+      if (!pid || pids.includes(pid)) return
+      pids.push(pid)
+    }
+
+    for (const name of ['Weixin.exe', 'WeChat.exe']) {
+      const found = await this.findPidsByImageName(name)
+      found.forEach(pushUnique)
+    }
+    return pids
+  }
+
+  private async isWeChatPidActive(pid: number): Promise<boolean> {
+    const pids = await this.findWeChatPids()
+    if (pids.includes(pid)) return true
+
+    const fallbackPid = await this.waitForWeChatWindow(250)
+    return fallbackPid === pid
+  }
+
+  private async waitForWeChatPid(timeoutMs: number): Promise<number | null> {
+    const start = Date.now()
+    while (Date.now() - start < timeoutMs) {
+      const pids = await this.findWeChatPids()
+      if (pids.length > 0) return pids[0]
+
+      const fallbackPid = await this.waitForWeChatWindow(250)
+      if (fallbackPid) return fallbackPid
+
+      await new Promise(r => setTimeout(r, 500))
+    }
+    return null
+  }
+
+  private getRemainingMs(deadline: number): number {
+    return Math.max(0, deadline - Date.now())
+  }
+
+  private async pollDbKeyFromHook(
+      pid: number,
+      deadline: number,
+      logs: string[],
+      onStatus?: (message: string, level: number) => void
+  ): Promise<DbKeyPollResult> {
+    const keyBuffer = Buffer.alloc(128)
+    let loginRequiredDetected = false
+    let nextProcessCheckAt = 0
+
+    while (Date.now() < deadline) {
+      const now = Date.now()
+      if (now >= nextProcessCheckAt) {
+        nextProcessCheckAt = now + this.DB_KEY_PROCESS_CHECK_INTERVAL_MS
+        if (!await this.isWeChatPidActive(pid)) {
+          return { status: 'process-ended', loginRequiredDetected }
+        }
+      }
+
+      if (this.pollKeyData(keyBuffer, keyBuffer.length)) {
+        const key = this.decodeUtf8(keyBuffer)
+        if (key.length === 64) {
+          onStatus?.('密钥获取成功', 1)
+          return { status: 'success', key, loginRequiredDetected }
+        }
+      }
+
+      for (let i = 0; i < 5; i++) {
+        const statusBuffer = Buffer.alloc(256)
+        const levelOut = [0]
+        if (!this.getStatusMessage(statusBuffer, statusBuffer.length, levelOut)) break
+        const msg = this.decodeUtf8(statusBuffer)
+        const level = levelOut[0] ?? 0
+        if (msg) {
+          logs.push(msg)
+          if (this.isLoginRelatedText(msg)) {
+            loginRequiredDetected = true
+          }
+          onStatus?.(msg, level)
+        }
+      }
+      await new Promise((resolve) => setTimeout(resolve, 120))
+    }
+
+    return { status: 'timeout', loginRequiredDetected }
+  }
+
+  private cleanupDbKeyHook(): void {
+    try {
+      this.cleanupHook()
+    } catch { }
+  }
+
+  private buildInitHookError(): string {
+    const error = this.getLastErrorMsg ? this.decodeCString(this.getLastErrorMsg()) : ''
+    if (error) {
+      if (error.includes('0xC0000022') || error.includes('ACCESS_DENIED') || error.includes('打开目标进程失败')) {
+        return '权限不足：无法访问微信进程。\n\n解决方法：\n1. 右键 WeFlow 图标，选择"以管理员身份运行"\n2. 关闭可能拦截的安全软件（如360、火绒等）\n3. 确保微信没有以管理员权限运行'
+      }
+      return error
+    }
+
+    const statusBuffer = Buffer.alloc(256)
+    const levelOut = [0]
+    const status = this.getStatusMessage && this.getStatusMessage(statusBuffer, statusBuffer.length, levelOut)
+        ? this.decodeUtf8(statusBuffer)
+        : ''
+    return status || '初始化失败'
+  }
+
+  private async waitForNextDbKeyPid(deadline: number, onStatus?: (message: string, level: number) => void): Promise<number | null> {
+    while (this.getRemainingMs(deadline) > 0) {
+      onStatus?.('正在查找微信进程...', 0)
+      const pid = await this.waitForWeChatPid(Math.min(this.getRemainingMs(deadline), 30_000))
       if (pid) return pid
     }
+    return null
+  }
+
+  private shouldRetryAfterProcessLost(deadline: number): boolean {
+    return this.getRemainingMs(deadline) > 1000
+  }
+
+  private async delayBeforeRetry(): Promise<void> {
+    await new Promise((resolve) => setTimeout(resolve, 500))
+  }
+
+  private async waitForProcessRestart(deadline: number, onStatus?: (message: string, level: number) => void): Promise<number | null> {
+    if (!this.shouldRetryAfterProcessLost(deadline)) return null
+    onStatus?.('检测到微信已退出，已清理 Hook，等待重新打开微信...', 0)
+    await this.delayBeforeRetry()
+    return this.waitForNextDbKeyPid(deadline, onStatus)
+  }
+
+  private async detectLoginRequiredForLastPid(pid: number | null, loginRequiredDetected: boolean): Promise<boolean> {
+    if (loginRequiredDetected) return true
+    if (!pid) return false
+    if (!await this.isWeChatPidActive(pid)) return false
+    return await this.detectWeChatLoginRequired(pid)
+  }
+
+  private async findWeChatPid(): Promise<number | null> {
+    const pids = await this.findWeChatPids()
+    if (pids.length > 0) return pids[0]
     const fallbackPid = await this.waitForWeChatWindow(5000)
     return fallbackPid ?? null
   }
@@ -363,9 +517,8 @@ export class KeyService {
   private async waitForWeChatExit(timeoutMs = 8000): Promise<boolean> {
     const start = Date.now()
     while (Date.now() - start < timeoutMs) {
-      const weixinPid = await this.findPidByImageName('Weixin.exe')
-      const wechatPid = await this.findPidByImageName('WeChat.exe')
-      if (!weixinPid && !wechatPid) return true
+      const runningPids = await this.findWeChatPids()
+      if (runningPids.length === 0) return true
       await new Promise(r => setTimeout(r, 400))
     }
     return false
@@ -594,7 +747,7 @@ export class KeyService {
     return true
   }
 
-  // --- DB Key Logic (Unchanged core flow) ---
+  // --- DB Key Logic (core hook/poll flow unchanged) ---
 
   async autoGetDbKey(
       timeoutMs = 60_000,
@@ -605,74 +758,56 @@ export class KeyService {
     if (!this.ensureKernel32()) return { success: false, error: 'Kernel32 Init Failed' }
 
     const logs: string[] = []
-
+    const deadline = Date.now() + timeoutMs
     onStatus?.('正在查找微信进程...', 0)
-    const pid = await this.findWeChatPid()
+    let pid = await this.findWeChatPid()
     if (!pid) {
       const err = '未找到微信进程，请先启动微信'
       onStatus?.(err, 2)
       return { success: false, error: err }
     }
+    let lastAttemptLoginRequiredDetected = false
 
-    onStatus?.(`检测到微信窗口 (PID: ${pid})，正在获取...`, 0)
-    onStatus?.('正在检测微信界面组件...', 0)
-    await this.waitForWeChatWindowComponents(pid, 15000)
+    while (pid && this.getRemainingMs(deadline) > 0) {
+      onStatus?.(`检测到微信窗口 (PID: ${pid})，正在获取...`, 0)
+      onStatus?.('正在检测微信界面组件...', 0)
+      await this.waitForWeChatWindowComponents(pid, Math.min(15000, this.getRemainingMs(deadline)))
 
-    const ok = this.initHook(pid)
-    if (!ok) {
-      const error = this.getLastErrorMsg ? this.decodeCString(this.getLastErrorMsg()) : ''
-      if (error) {
-        if (error.includes('0xC0000022') || error.includes('ACCESS_DENIED') || error.includes('打开目标进程失败')) {
-          const friendlyError = '权限不足：无法访问微信进程。\n\n解决方法：\n1. 右键 WeFlow 图标，选择"以管理员身份运行"\n2. 关闭可能拦截的安全软件（如360、火绒等）\n3. 确保微信没有以管理员权限运行'
-          return { success: false, error: friendlyError }
-        }
-        return { success: false, error }
+      if (!await this.isWeChatPidActive(pid)) {
+        pid = await this.waitForProcessRestart(deadline, onStatus)
+        continue
       }
-      const statusBuffer = Buffer.alloc(256)
-      const levelOut = [0]
-      const status = this.getStatusMessage && this.getStatusMessage(statusBuffer, statusBuffer.length, levelOut)
-          ? this.decodeUtf8(statusBuffer)
-          : ''
-      return { success: false, error: status || '初始化失败' }
-    }
 
-    const keyBuffer = Buffer.alloc(128)
-    const start = Date.now()
-    let loginRequiredDetected = false
-
-    try {
-      while (Date.now() - start < timeoutMs) {
-        if (this.pollKeyData(keyBuffer, keyBuffer.length)) {
-          const key = this.decodeUtf8(keyBuffer)
-          if (key.length === 64) {
-            onStatus?.('密钥获取成功', 1)
-            return { success: true, key, logs }
-          }
+      const ok = this.initHook(pid)
+      if (!ok) {
+        if (!await this.isWeChatPidActive(pid)) {
+          this.cleanupDbKeyHook()
+          pid = await this.waitForProcessRestart(deadline, onStatus)
+          continue
         }
-
-        for (let i = 0; i < 5; i++) {
-          const statusBuffer = Buffer.alloc(256)
-          const levelOut = [0]
-          if (!this.getStatusMessage(statusBuffer, statusBuffer.length, levelOut)) break
-          const msg = this.decodeUtf8(statusBuffer)
-          const level = levelOut[0] ?? 0
-          if (msg) {
-            logs.push(msg)
-            if (this.isLoginRelatedText(msg)) {
-              loginRequiredDetected = true
-            }
-            onStatus?.(msg, level)
-          }
-        }
-        await new Promise((resolve) => setTimeout(resolve, 120))
+        return { success: false, error: this.buildInitHookError(), logs }
       }
-    } finally {
+
+      let pollResult: DbKeyPollResult
       try {
-        this.cleanupHook()
-      } catch { }
+        pollResult = await this.pollDbKeyFromHook(pid, deadline, logs, onStatus)
+      } finally {
+        this.cleanupDbKeyHook()
+      }
+
+      lastAttemptLoginRequiredDetected = pollResult.loginRequiredDetected
+      if (pollResult.status === 'success') {
+        return { success: true, key: pollResult.key, logs }
+      }
+      if (pollResult.status === 'process-ended') {
+        lastAttemptLoginRequiredDetected = false
+        pid = await this.waitForProcessRestart(deadline, onStatus)
+        continue
+      }
+      break
     }
 
-    const loginRequired = loginRequiredDetected || await this.detectWeChatLoginRequired(pid)
+    const loginRequired = await this.detectLoginRequiredForLastPid(pid, lastAttemptLoginRequiredDetected)
     if (loginRequired) {
       return {
         success: false,
@@ -684,10 +819,7 @@ export class KeyService {
     return { success: false, error: '获取密钥超时', logs }
   }
 
-  // --- Image Key (通过 DLL 从缓存目录获取 code，用前端 wxid 计算密钥) ---
-
   private cleanWxid(wxid: string): string {
-    // 截断到第二个下划线: wxid_g4pshorcc0r529_da6c → wxid_g4pshorcc0r529
     const first = wxid.indexOf('_')
     if (first === -1) return wxid
     const second = wxid.indexOf('_', first + 1)
@@ -807,7 +939,7 @@ export class KeyService {
           if (!this.verifyDerivedAesKey(aesKey, verifyCiphertext)) continue
           onProgress?.(`密钥获取成功 (wxid: ${candidateWxid}, code: ${code})`)
           console.log('[ImageKey] 校验命中: wxid=', candidateWxid, 'code=', code)
-          return { success: true, xorKey, aesKey }
+          return { success: true, xorKey, aesKey, verified: true }
         }
       }
       return { success: false, error: '缓存 code 与当前账号 wxid 未匹配，请确认账号目录后重试，或使用内存扫描' }
@@ -819,7 +951,7 @@ export class KeyService {
     const { xorKey, aesKey } = this.deriveImageKeys(fallbackCode, fallbackWxid)
     onProgress?.(`密钥获取成功 (wxid: ${fallbackWxid}, code: ${fallbackCode})`)
     console.log('[ImageKey] 回退计算: wxid=', fallbackWxid, 'code=', fallbackCode)
-    return { success: true, xorKey, aesKey }
+    return { success: true, xorKey, aesKey, verified: false }
   }
 
   // --- 内存扫描备选方案（融合 Dart+Python 优点）---

electron/services/keyServiceLinux.ts

@@ -3,35 +3,46 @@ import { join } from 'path'
 import { existsSync, readdirSync, statSync, readFileSync } from 'fs'
 import { execFile, exec, spawn } from 'child_process'
 import { promisify } from 'util'
+import crypto from 'crypto'
 import { createRequire } from 'module';
-const require = createRequire(import.meta.url);
+const require = createRequire(__filename);
 
 const execFileAsync = promisify(execFile)
 const execAsync = promisify(exec)
 
 type DbKeyResult = { success: boolean; key?: string; error?: string; logs?: string[] }
-type ImageKeyResult = { success: boolean; xorKey?: number; aesKey?: string; error?: string }
+type ImageKeyResult = { success: boolean; xorKey?: number; aesKey?: string; verified?: boolean; error?: string }
 
 export class KeyServiceLinux {
   private sudo: any
 
   constructor() {
     try {
-      this.sudo = require('sudo-prompt');
+      this.sudo = require('@vscode/sudo-prompt');
     } catch (e) {
-      console.error('Failed to load sudo-prompt', e);
+      console.error('Failed to load @vscode/sudo-prompt', e);
     }
   }
 
   private getHelperPath(): string {
     const isPackaged = app.isPackaged
+    const archDir = process.arch === 'arm64' ? 'arm64' : 'x64'
     const candidates: string[] = []
     if (process.env.WX_KEY_HELPER_PATH) candidates.push(process.env.WX_KEY_HELPER_PATH)
     if (isPackaged) {
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'linux', archDir, 'xkey_helper_linux'))
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'linux', 'x64', 'xkey_helper_linux'))
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'linux', 'xkey_helper_linux'))
       candidates.push(join(process.resourcesPath, 'resources', 'xkey_helper_linux'))
       candidates.push(join(process.resourcesPath, 'xkey_helper_linux'))
     } else {
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'linux', archDir, 'xkey_helper_linux'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'linux', 'x64', 'xkey_helper_linux'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'linux', 'xkey_helper_linux'))
       candidates.push(join(app.getAppPath(), 'resources', 'xkey_helper_linux'))
+      candidates.push(join(process.cwd(), 'resources', 'key', 'linux', archDir, 'xkey_helper_linux'))
+      candidates.push(join(process.cwd(), 'resources', 'key', 'linux', 'x64', 'xkey_helper_linux'))
+      candidates.push(join(process.cwd(), 'resources', 'key', 'linux', 'xkey_helper_linux'))
       candidates.push(join(app.getAppPath(), '..', 'Xkey', 'build', 'xkey_helper_linux'))
     }
     for (const p of candidates) {
@@ -88,7 +99,12 @@ export class KeyServiceLinux {
         'xwechat',
         '/opt/wechat/wechat',
         '/usr/bin/wechat',
-        '/opt/apps/com.tencent.wechat/files/wechat'
+        '/usr/local/bin/wechat',
+        '/usr/bin/wechat',
+        '/opt/apps/com.tencent.wechat/files/wechat',
+        '/usr/bin/wechat-bin',
+        '/usr/local/bin/wechat-bin',
+        'com.tencent.wechat'
       ]
 
       for (const binName of wechatBins) {
@@ -142,7 +158,7 @@ export class KeyServiceLinux {
       }
 
       if (!pid) {
-        const err = '未能自动启动微信，或获取PID失败，请查看控制台日志或手动启动并登录。'
+        const err = '未能自动启动微信，或获取PID失败，请查看控制台日志或手动启动微信，看到登录窗口后点击确认。'
         onStatus?.(err, 2)
         return { success: false, error: err }
       }
@@ -151,7 +167,7 @@ export class KeyServiceLinux {
 
       await new Promise(r => setTimeout(r, 2000))
 
-      return await this.getDbKey(pid, onStatus)
+      return await this.getDbKey(pid, onStatus, timeoutMs)
     } catch (err: any) {
       console.error('[Debug] 自动获取流程彻底崩溃:', err);
       const errMsg = '自动获取微信 PID 失败: ' + err.message
@@ -160,7 +176,7 @@ export class KeyServiceLinux {
     }
   }
 
-  public async getDbKey(pid: number, onStatus?: (message: string, level: number) => void): Promise<DbKeyResult> {
+  public async getDbKey(pid: number, onStatus?: (message: string, level: number) => void, timeoutMs = 180_000): Promise<DbKeyResult> {
     try {
       const helperPath = this.getHelperPath()
 
@@ -177,29 +193,63 @@ export class KeyServiceLinux {
       const targetAddr = scanRes.target_addr
       onStatus?.('基址扫描成功，正在请求管理员权限进行内存 Hook...', 0)
 
-      return await new Promise((resolve) => {
-        const options = { name: 'WeFlow' }
-        const command = `"${helperPath}" db_hook ${pid} ${targetAddr}`
+      if (!this.sudo || typeof this.sudo.exec !== 'function') {
+        const err = 'Linux 授权组件 @vscode/sudo-prompt 未加载，请确认依赖已安装并重新启动 WeFlow'
+        onStatus?.(err, 2)
+        return { success: false, error: err }
+      }
 
-        this.sudo.exec(command, options, (error, stdout) => {
+      return await new Promise((resolve) => {
+        const options = {
+          name: 'WeFlow',
+          env: {
+            PATH: `${process.env.PATH || ''}:/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin`
+          }
+        }
+        const timeoutSec = Math.ceil((timeoutMs + 15_000) / 1000)
+        const command = `timeout -k 5s ${timeoutSec}s "${helperPath}" db_hook ${pid} ${targetAddr} ${timeoutMs}`
+        let settled = false
+        const finish = (result: DbKeyResult) => {
+          if (settled) return
+          settled = true
+          clearTimeout(watchdog)
+          resolve(result)
+        }
+        const watchdog = setTimeout(() => {
+          execAsync(`kill -CONT ${pid}`).catch(() => {})
+          const err = `Hook 等待超时（${Math.round(timeoutMs / 1000)} 秒）。请确认微信登录确认已完成，或重启微信后重试。`
+          onStatus?.(err, 2)
+          finish({ success: false, error: err })
+        }, timeoutMs + 30_000)
+
+        onStatus?.('授权通过后请在手机上确认登录微信，正在等待密钥回调...', 0)
+
+        this.sudo.exec(command, options, (error, stdout, stderr) => {
           execAsync(`kill -CONT ${pid}`).catch(() => {})
           if (error) {
-            onStatus?.('授权失败或被取消', 2)
-            resolve({ success: false, error: `授权失败或被取消: ${error.message}` })
+            const detail = String(stderr || '').trim()
+            const message = detail ? `${error.message}: ${detail}` : error.message
+            onStatus?.('授权失败或 Hook 执行失败', 2)
+            finish({ success: false, error: `授权失败或 Hook 执行失败: ${message}` })
             return
           }
           try {
-            const hookRes = JSON.parse((stdout as string).trim())
+            const output = String(stdout || '').trim()
+            if (!output) {
+              const detail = String(stderr || '').trim()
+              throw new Error(detail ? `Hook 无输出: ${detail}` : 'Hook 无输出')
+            }
+            const hookRes = JSON.parse(output)
             if (hookRes.success) {
               onStatus?.('密钥获取成功', 1)
-              resolve({ success: true, key: hookRes.key })
+              finish({ success: true, key: hookRes.key })
             } else {
               onStatus?.(hookRes.result, 2)
-              resolve({ success: false, error: hookRes.result })
+              finish({ success: false, error: hookRes.result })
             }
-          } catch (e) {
+          } catch (e: any) {
             onStatus?.('解析 Hook 结果失败', 2)
-            resolve({ success: false, error: '解析 Hook 结果失败' })
+            finish({ success: false, error: e?.message || '解析 Hook 结果失败' })
           }
         })
       })
@@ -228,7 +278,14 @@ export class KeyServiceLinux {
       if (account && account.keys && account.keys.length > 0) {
         onProgress?.(`已找到匹配的图片密钥 (wxid: ${account.wxid})`);
         const keyObj = account.keys[0]
-        return { success: true, xorKey: keyObj.xorKey, aesKey: keyObj.aesKey }
+        const aesKey = String(keyObj.aesKey || '')
+        const verified = await this.verifyImageKeyByTemplate(accountPath, aesKey)
+        if (verified === true) {
+          onProgress?.('缓存密钥校验成功，已确认可用')
+        } else if (verified === false) {
+          onProgress?.('已从缓存计算密钥，但未通过本地模板校验')
+        }
+        return { success: true, xorKey: keyObj.xorKey, aesKey, verified: verified === true }
       }
       return { success: false, error: '未在缓存中找到匹配的图片密钥' }
     } catch (err: any) {
@@ -236,6 +293,35 @@ export class KeyServiceLinux {
     }
   }
 
+  private async verifyImageKeyByTemplate(accountPath: string | undefined, aesKey: string): Promise<boolean | null> {
+    const normalizedPath = String(accountPath || '').trim()
+    if (!normalizedPath || !aesKey || aesKey.length < 16 || !existsSync(normalizedPath)) return null
+    try {
+      const template = await this._findTemplateData(normalizedPath, 32)
+      if (!template.ciphertext) return null
+      return this.verifyDerivedAesKey(aesKey, template.ciphertext)
+    } catch {
+      return null
+    }
+  }
+
+  private verifyDerivedAesKey(aesKey: string, ciphertext: Buffer): boolean {
+    try {
+      if (!aesKey || aesKey.length < 16 || ciphertext.length !== 16) return false
+      const decipher = crypto.createDecipheriv('aes-128-ecb', Buffer.from(aesKey, 'ascii').subarray(0, 16), null)
+      decipher.setAutoPadding(false)
+      const dec = Buffer.concat([decipher.update(ciphertext), decipher.final()])
+      if (dec[0] === 0xFF && dec[1] === 0xD8 && dec[2] === 0xFF) return true
+      if (dec[0] === 0x89 && dec[1] === 0x50 && dec[2] === 0x4E && dec[3] === 0x47) return true
+      if (dec[0] === 0x52 && dec[1] === 0x49 && dec[2] === 0x46 && dec[3] === 0x46) return true
+      if (dec[0] === 0x77 && dec[1] === 0x78 && dec[2] === 0x67 && dec[3] === 0x66) return true
+      if (dec[0] === 0x47 && dec[1] === 0x49 && dec[2] === 0x46) return true
+      return false
+    } catch {
+      return false
+    }
+  }
+
   public async autoGetImageKeyByMemoryScan(
       accountPath: string,
       onProgress?: (msg: string) => void
@@ -361,4 +447,4 @@ export class KeyServiceLinux {
 
     return { ciphertext, xorKey }
   }
-}
+}

electron/services/keyServiceMac.ts

@@ -1,13 +1,13 @@
 import { app, shell } from 'electron'
 import { join, basename, dirname } from 'path'
-import { existsSync, readdirSync, readFileSync, statSync } from 'fs'
+import { existsSync, readdirSync, readFileSync, statSync, chmodSync } from 'fs'
 import { execFile, spawn } from 'child_process'
 import { promisify } from 'util'
 import crypto from 'crypto'
 import { homedir } from 'os'
 
 type DbKeyResult = { success: boolean; key?: string; error?: string; logs?: string[] }
-type ImageKeyResult = { success: boolean; xorKey?: number; aesKey?: string; error?: string }
+type ImageKeyResult = { success: boolean; xorKey?: number; aesKey?: string; verified?: boolean; error?: string }
 const execFileAsync = promisify(execFile)
 
 export class KeyServiceMac {
@@ -24,9 +24,13 @@ export class KeyServiceMac {
   private machVmReadOverwrite: any = null
   private machPortDeallocate: any = null
   private _needsElevation = false
+  private restrictedFailureCount = 0
+  private restrictedFailureAt = 0
+  private readonly restrictedFailureWindowMs = 8 * 60_000
 
   private getHelperPath(): string {
     const isPackaged = app.isPackaged
+    const archDir = process.arch === 'arm64' ? 'arm64' : 'x64'
     const candidates: string[] = []
 
     if (process.env.WX_KEY_HELPER_PATH) {
@@ -34,12 +38,21 @@ export class KeyServiceMac {
     }
 
     if (isPackaged) {
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'macos', archDir, 'xkey_helper'))
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'macos', 'universal', 'xkey_helper'))
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'macos', 'xkey_helper'))
       candidates.push(join(process.resourcesPath, 'resources', 'xkey_helper'))
       candidates.push(join(process.resourcesPath, 'xkey_helper'))
     } else {
       const cwd = process.cwd()
+      candidates.push(join(cwd, 'resources', 'key', 'macos', archDir, 'xkey_helper'))
+      candidates.push(join(cwd, 'resources', 'key', 'macos', 'universal', 'xkey_helper'))
+      candidates.push(join(cwd, 'resources', 'key', 'macos', 'xkey_helper'))
       candidates.push(join(cwd, 'resources', 'xkey_helper'))
       candidates.push(join(cwd, 'Xkey', 'build', 'xkey_helper'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'macos', archDir, 'xkey_helper'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'macos', 'universal', 'xkey_helper'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'macos', 'xkey_helper'))
       candidates.push(join(app.getAppPath(), 'resources', 'xkey_helper'))
     }
 
@@ -52,14 +65,24 @@ export class KeyServiceMac {
 
   private getImageScanHelperPath(): string {
     const isPackaged = app.isPackaged
+    const archDir = process.arch === 'arm64' ? 'arm64' : 'x64'
     const candidates: string[] = []
 
     if (isPackaged) {
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'macos', archDir, 'image_scan_helper'))
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'macos', 'universal', 'image_scan_helper'))
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'macos', 'image_scan_helper'))
       candidates.push(join(process.resourcesPath, 'resources', 'image_scan_helper'))
       candidates.push(join(process.resourcesPath, 'image_scan_helper'))
     } else {
       const cwd = process.cwd()
+      candidates.push(join(cwd, 'resources', 'key', 'macos', archDir, 'image_scan_helper'))
+      candidates.push(join(cwd, 'resources', 'key', 'macos', 'universal', 'image_scan_helper'))
+      candidates.push(join(cwd, 'resources', 'key', 'macos', 'image_scan_helper'))
       candidates.push(join(cwd, 'resources', 'image_scan_helper'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'macos', archDir, 'image_scan_helper'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'macos', 'universal', 'image_scan_helper'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'macos', 'image_scan_helper'))
       candidates.push(join(app.getAppPath(), 'resources', 'image_scan_helper'))
     }
 
@@ -72,6 +95,7 @@ export class KeyServiceMac {
 
   private getDylibPath(): string {
     const isPackaged = app.isPackaged
+    const archDir = process.arch === 'arm64' ? 'arm64' : 'x64'
     const candidates: string[] = []
 
     if (process.env.WX_KEY_DYLIB_PATH) {
@@ -79,11 +103,20 @@ export class KeyServiceMac {
     }
 
     if (isPackaged) {
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'macos', archDir, 'libwx_key.dylib'))
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'macos', 'universal', 'libwx_key.dylib'))
+      candidates.push(join(process.resourcesPath, 'resources', 'key', 'macos', 'libwx_key.dylib'))
       candidates.push(join(process.resourcesPath, 'resources', 'libwx_key.dylib'))
       candidates.push(join(process.resourcesPath, 'libwx_key.dylib'))
     } else {
       const cwd = process.cwd()
+      candidates.push(join(cwd, 'resources', 'key', 'macos', archDir, 'libwx_key.dylib'))
+      candidates.push(join(cwd, 'resources', 'key', 'macos', 'universal', 'libwx_key.dylib'))
+      candidates.push(join(cwd, 'resources', 'key', 'macos', 'libwx_key.dylib'))
       candidates.push(join(cwd, 'resources', 'libwx_key.dylib'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'macos', archDir, 'libwx_key.dylib'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'macos', 'universal', 'libwx_key.dylib'))
+      candidates.push(join(app.getAppPath(), 'resources', 'key', 'macos', 'libwx_key.dylib'))
       candidates.push(join(app.getAppPath(), 'resources', 'libwx_key.dylib'))
     }
 
@@ -156,18 +189,25 @@ export class KeyServiceMac {
       }
 
       if (!parsed.success) {
-        const errorMsg = this.mapDbKeyErrorMessage(parsed.code, parsed.detail)
+        const errorMsg = this.enrichDbKeyErrorMessage(
+          this.mapDbKeyErrorMessage(parsed.code, parsed.detail),
+          parsed.code,
+          parsed.detail
+        )
         onStatus?.(errorMsg, 2)
         return { success: false, error: errorMsg }
       }
 
+      this.resetRestrictedFailureState()
       onStatus?.('密钥获取成功', 1)
       return { success: true, key: parsed.key }
     } catch (e: any) {
       console.error('[KeyServiceMac] Error:', e)
       console.error('[KeyServiceMac] Stack:', e.stack)
-      onStatus?.('获取失败: ' + e.message, 2)
-      return { success: false, error: e.message }
+      const rawError = `${e?.message || e || ''}`.trim()
+      const resolvedError = this.resolveUnexpectedDbKeyErrorMessage(rawError)
+      onStatus?.(resolvedError, 2)
+      return { success: false, error: resolvedError }
     }
   }
 
@@ -193,6 +233,149 @@ export class KeyServiceMac {
     return this.parseDbKeyResult(helperResult)
   }
 
+  private resetRestrictedFailureState(): void {
+    this.restrictedFailureCount = 0
+    this.restrictedFailureAt = 0
+  }
+
+  private markRestrictedFailureAndGetCount(): number {
+    const now = Date.now()
+    if (now - this.restrictedFailureAt > this.restrictedFailureWindowMs) {
+      this.restrictedFailureCount = 0
+    }
+    this.restrictedFailureAt = now
+    this.restrictedFailureCount += 1
+    return this.restrictedFailureCount
+  }
+
+  private isRestrictedEnvironmentFailure(code?: string, detail?: string): boolean {
+    const normalizedCode = String(code || '').toUpperCase()
+    const normalizedDetail = String(detail || '').toLowerCase()
+    if (!normalizedCode && !normalizedDetail) return false
+
+    if (normalizedCode === 'SCAN_FAILED') {
+      return normalizedDetail.includes('sink pattern not found')
+        || normalizedDetail.includes('no suitable module found')
+    }
+
+    if (normalizedCode === 'HOOK_FAILED') {
+      return normalizedDetail.includes('patch_breakpoint_failed')
+        || normalizedDetail.includes('thread_get_state_failed')
+        || normalizedDetail.includes('native hook failed')
+    }
+
+    if (normalizedCode === 'ATTACH_FAILED') {
+      return normalizedDetail.includes('task_for_pid:5')
+        || normalizedDetail.includes('thread_get_state_failed')
+    }
+
+    return normalizedDetail.includes('patch_breakpoint_failed')
+      || normalizedDetail.includes('thread_get_state_failed')
+      || normalizedDetail.includes('sink pattern not found')
+      || normalizedDetail.includes('no suitable module found')
+  }
+
+  private getMacRecoveryHint(isRepeatedFailure: boolean): string {
+    const steps = isRepeatedFailure
+      ? '建议步骤：彻底退出微信 -> 重启电脑（冷启动）-> 降级微信到 4.1.7 -> 仅尝试一次自动获取 -> 成功后再升级微信。'
+      : '建议步骤：降级微信到 4.1.7 -> 重启电脑（冷启动）-> 自动获取密钥 -> 成功后再升级微信。'
+    return `${steps}\n请不要连续重试，以免触发微信安全模式或系统内存保护。`
+  }
+
+  private simplifyDbKeyDetail(detail?: string): string {
+    const raw = String(detail || '')
+      .replace(/^WF_OK::/i, '')
+      .replace(/^WF_ERR::/i, '')
+      .replace(/\r?\n/g, ' ')
+      .replace(/\s+/g, ' ')
+      .trim()
+    if (!raw) return ''
+
+    const keys = [
+      'No suitable module found',
+      'Sink pattern not found',
+      'patch_breakpoint_failed',
+      'thread_get_state_failed',
+      'task_for_pid:5',
+      'attach_wait_timeout',
+      'HOOK_TIMEOUT',
+      'FRIDA_TIMEOUT'
+    ]
+    for (const key of keys) {
+      if (raw.includes(key)) return key
+    }
+
+    const stripped = raw
+      .replace(/\[xkey_helper\]/gi, ' ')
+      .replace(/\[debug\]/gi, ' ')
+      .replace(/\[\*\]/g, ' ')
+      .replace(/\s+/g, ' ')
+      .trim()
+    if (!stripped) return ''
+    return stripped.length > 140 ? `${stripped.slice(0, 140)}...` : stripped
+  }
+
+  private extractDbKeyErrorFromAnyText(text?: string): { code?: string; detail?: string } {
+    const raw = String(text || '')
+    if (!raw) return {}
+
+    const explicit = raw.match(/ERROR:([A-Z_]+):([^\r\n]*)/)
+    if (explicit) {
+      return {
+        code: explicit[1] || 'UNKNOWN',
+        detail: this.simplifyDbKeyDetail(explicit[2] || '')
+      }
+    }
+
+    if (raw.includes('No suitable module found')) {
+      return { code: 'SCAN_FAILED', detail: 'No suitable module found' }
+    }
+    if (raw.includes('Sink pattern not found')) {
+      return { code: 'SCAN_FAILED', detail: 'Sink pattern not found' }
+    }
+    if (raw.includes('patch_breakpoint_failed')) {
+      return { code: 'HOOK_FAILED', detail: 'patch_breakpoint_failed' }
+    }
+    if (raw.includes('thread_get_state_failed')) {
+      return { code: 'HOOK_FAILED', detail: 'thread_get_state_failed' }
+    }
+    if (raw.includes('task_for_pid:5')) {
+      return { code: 'ATTACH_FAILED', detail: 'task_for_pid:5' }
+    }
+
+    return {}
+  }
+
+  private resolveUnexpectedDbKeyErrorMessage(rawError?: string): string {
+    const text = String(rawError || '').trim()
+    const { code, detail } = this.extractDbKeyErrorFromAnyText(text)
+    if (code) {
+      const mapped = this.mapDbKeyErrorMessage(code, detail)
+      return this.enrichDbKeyErrorMessage(mapped, code, detail)
+    }
+
+    if (text.includes('helper timeout')) {
+      return '获取密钥超时：请保持微信前台并进行一次会话操作后重试。'
+    }
+    if (text.includes('helper returned empty output') || text.includes('invalid json')) {
+      return '获取失败：helper 未返回可识别结果，请彻底退出微信后重启电脑再试。'
+    }
+    if (text.includes('xkey_helper not found')) {
+      return '获取失败：未找到 xkey_helper，请重新安装 WeFlow 后重试。'
+    }
+    return '自动获取密钥失败：环境可能受限或版本暂未适配，请稍后重试。'
+  }
+
+  private enrichDbKeyErrorMessage(baseMessage: string, code?: string, detail?: string): string {
+    if (!this.isRestrictedEnvironmentFailure(code, detail)) return baseMessage
+
+    const failureCount = this.markRestrictedFailureAndGetCount()
+    if (failureCount >= 2) {
+      return `${baseMessage}\n检测到连续失败，疑似已进入受限状态。请先彻底退出微信并重启电脑，再按下方步骤处理。\n${this.getMacRecoveryHint(true)}`
+    }
+    return `${baseMessage}\n${this.getMacRecoveryHint(false)}`
+  }
+
   private async getWeChatPid(): Promise<number> {
     try {
       // 优先使用 pgrep -x 精确匹配进程名
@@ -373,31 +556,81 @@ export class KeyServiceMac {
     return `'${String(text).replace(/'/g, `'\\''`)}'`
   }
 
+  private collectMacKeyArtifactPaths(primaryBinaryPath: string): string[] {
+    const baseDir = dirname(primaryBinaryPath)
+    const names = ['xkey_helper', 'image_scan_helper', 'xkey_helper_macos', 'libwx_key.dylib']
+    const unique: string[] = []
+    for (const name of names) {
+      const full = join(baseDir, name)
+      if (!existsSync(full)) continue
+      if (!unique.includes(full)) unique.push(full)
+    }
+    if (existsSync(primaryBinaryPath) && !unique.includes(primaryBinaryPath)) {
+      unique.unshift(primaryBinaryPath)
+    }
+    return unique
+  }
+
+  private ensureExecutableBitsBestEffort(paths: string[]): void {
+    for (const p of paths) {
+      try {
+        const mode = statSync(p).mode
+        if ((mode & 0o111) !== 0) continue
+        chmodSync(p, mode | 0o111)
+      } catch {
+        // ignore: 可能无权限（例如 /Applications 下 root-owned 的 .app）
+      }
+    }
+  }
+
+  private async ensureExecutableBitsWithElevation(paths: string[], timeoutMs: number): Promise<void> {
+    const existing = paths.filter(p => existsSync(p))
+    if (existing.length === 0) return
+
+    const quotedPaths = existing.map(p => this.shellSingleQuote(p)).join(' ')
+    const timeoutSec = Math.max(30, Math.ceil(timeoutMs / 1000))
+    const scriptLines = [
+      `set chmodCmd to "/bin/chmod +x ${quotedPaths}"`,
+      `set timeoutSec to ${timeoutSec}`,
+      'with timeout of timeoutSec seconds',
+      'do shell script chmodCmd with administrator privileges',
+      'end timeout'
+    ]
+
+    await execFileAsync('/usr/bin/osascript', scriptLines.flatMap(line => ['-e', line]), {
+      timeout: timeoutMs + 10_000
+    })
+  }
+
   private async getDbKeyByHelperElevated(
     timeoutMs: number,
     onStatus?: (message: string, level: number) => void
   ): Promise<string> {
     const helperPath = this.getHelperPath()
+    const artifactPaths = this.collectMacKeyArtifactPaths(helperPath)
+    this.ensureExecutableBitsBestEffort(artifactPaths)
     const waitMs = Math.max(timeoutMs, 30_000)
     const timeoutSec = Math.ceil(waitMs / 1000) + 30
     const pid = await this.getWeChatPid()
+    const chmodPart = artifactPaths.length > 0
+      ? `/bin/chmod +x ${artifactPaths.map(p => this.shellSingleQuote(p)).join(' ')}`
+      : ''
+    const runPart = `${this.shellSingleQuote(helperPath)} ${pid} ${waitMs}`
+    const privilegedCmd = chmodPart ? `${chmodPart} && ${runPart}` : runPart
     // 用 AppleScript 的 quoted form 组装命令，避免复杂 shell 拼接导致整条失败
     // 通过 try/on error 回传详细错误，避免只看到 "Command failed"
     const scriptLines = [
-      `set helperPath to ${JSON.stringify(helperPath)}`,
-      `set cmd to quoted form of helperPath & " ${pid} ${waitMs}"`,
+      `set cmd to ${JSON.stringify(privilegedCmd)}`,
       `set timeoutSec to ${timeoutSec}`,
       'try',
       'with timeout of timeoutSec seconds',
-      'set outText to do shell script cmd with administrator privileges',
+      'set outText to do shell script (cmd & " 2>&1") with administrator privileges',
       'end timeout',
       'return "WF_OK::" & outText',
       'on error errMsg number errNum partial result pr',
       'return "WF_ERR::" & errNum & "::" & errMsg & "::" & (pr as text)',
       'end try'
     ]
-    onStatus?.('已准备就绪，现在登录微信或退出登录后重新登录微信', 0)
-
     let stdout = ''
     try {
       const result = await execFileAsync('/usr/bin/osascript', scriptLines.flatMap(line => ['-e', line]), {
@@ -418,7 +651,12 @@ export class KeyServiceMac {
       const errNum = parts[1] || 'unknown'
       const errMsg = parts[2] || 'unknown'
       const partial = parts.slice(3).join('::')
-      throw new Error(`elevated helper failed: errNum=${errNum}, errMsg=${errMsg}, partial=${partial || '(empty)'}`)
+      if (errNum === '-128' || String(errMsg).includes('User canceled')) {
+        throw new Error('User canceled')
+      }
+      const inferred = this.extractDbKeyErrorFromAnyText(`${errMsg}\n${partial}`)
+      if (inferred.code) return `ERROR:${inferred.code}:${inferred.detail || ''}`
+      throw new Error(`elevated helper failed: errNum=${errNum}, errMsg=${this.simplifyDbKeyDetail(errMsg) || 'unknown'}`)
     }
     const normalizedOutput = joined.startsWith('WF_OK::') ? joined.slice('WF_OK::'.length) : joined
 
@@ -440,40 +678,60 @@ export class KeyServiceMac {
     // 其次找 result 字段
     const resultPayload = allJson.find(p => typeof p?.result === 'string')
     if (resultPayload) return resultPayload.result
-    throw new Error('elevated helper returned invalid json: ' + lines[lines.length - 1])
+    const inferred = this.extractDbKeyErrorFromAnyText(normalizedOutput)
+    if (inferred.code) return `ERROR:${inferred.code}:${inferred.detail || ''}`
+    throw new Error('elevated helper returned invalid output')
   }
 
   private mapDbKeyErrorMessage(code?: string, detail?: string): string {
+    const normalizedDetail = this.simplifyDbKeyDetail(detail)
     if (code === 'PROCESS_NOT_FOUND') return '微信进程未运行'
     if (code === 'ATTACH_FAILED') {
       const isDevElectron = process.execPath.includes('/node_modules/electron/')
-      if ((detail || '').includes('task_for_pid:5')) {
+      if (normalizedDetail.includes('task_for_pid:5')) {
         if (isDevElectron) {
           return `无法附加到微信进程（task_for_pid 被拒绝）。当前为开发环境 Electron：${process.execPath}\n建议使用打包后的 WeFlow.app（已携带调试 entitlements）再重试。`
         }
-        return '无法附加到微信进程（task_for_pid 被系统拒绝）。请确认当前运行程序已正确签名并包含调试 entitlements。'
+        return '无法附加到微信进程（task_for_pid 被系统拒绝）。请确认当前运行程序已正确签名并包含调试 entitlements，优先使用打包版 WeFlow.app。'
       }
-      return `无法附加到进程 (${detail || ''})`
+      if (normalizedDetail.includes('thread_get_state_failed')) {
+        return `无法附加到进程：系统拒绝读取线程状态（${normalizedDetail}）。`
+      }
+      return `无法附加到进程 (${normalizedDetail || ''})`
     }
     if (code === 'FRIDA_FAILED') {
-      if ((detail || '').includes('FRIDA_TIMEOUT')) {
+      if (normalizedDetail.includes('FRIDA_TIMEOUT')) {
         return '定位已成功但在等待时间内未捕获到密钥调用。请保持微信前台并进行一次会话/数据库访问后重试。'
       }
-      return `Frida 语义定位失败 (${detail || ''})`
+      return `Frida 语义定位失败 (${normalizedDetail || ''})`
     }
     if (code === 'HOOK_FAILED') {
-      if ((detail || '').includes('HOOK_TIMEOUT')) {
-        return 'Hook 已安装，但在等待时间内未触发目标函数。请保持微信前台并执行一次会话/数据库访问后重试。'
+      if (normalizedDetail.includes('HOOK_TIMEOUT')) {
+        return 'Hook 已安装，但在等待时间内未触发登录流程。请退出微信账号后重新登录，或在未登录状态下直接登录微信，完成一次登录流程后重试。'
       }
-      if ((detail || '').includes('attach_wait_timeout')) {
+      if (normalizedDetail.includes('attach_wait_timeout')) {
         return '附加调试器超时，未能进入 Hook 阶段。请确认微信处于可交互状态并重试。'
       }
-      return `原生 Hook 失败 (${detail || ''})`
+      if (normalizedDetail.includes('patch_breakpoint_failed') || normalizedDetail.includes('thread_get_state_failed')) {
+        return `原生 Hook 失败：检测到系统调试权限或内存保护冲突（${normalizedDetail}）。`
+      }
+      return `原生 Hook 失败 (${normalizedDetail || ''})`
     }
     if (code === 'HOOK_TARGET_ONLY') {
-      return `已定位到目标函数地址（${detail || ''}），但当前原生 C++ 仅完成定位，尚未完成远程 Hook 回调取 key 流程。`
+      return `已定位到目标函数地址（${normalizedDetail || ''}），但当前原生 C++ 仅完成定位，尚未完成远程 Hook 回调取 key 流程。`
+    }
+    if (code === 'SCAN_FAILED') {
+      if (!normalizedDetail) {
+        return '内存扫描失败：未匹配到可用特征。可能是当前微信版本更新导致，请升级 WeFlow 后重试。'
+      }
+      if (normalizedDetail.includes('Sink pattern not found')) {
+        return '内存扫描失败：未匹配到目标函数特征（Sink pattern not found），当前微信版本可能暂未适配。'
+      }
+      if (normalizedDetail.includes('No suitable module found')) {
+        return '内存扫描失败：未找到可扫描的微信主模块。请确认微信已完整启动并保持前台；若仍失败，优先尝试微信 4.1.7。'
+      }
+      return `内存扫描失败：${normalizedDetail}`
     }
-    if (code === 'SCAN_FAILED') return '内存扫描失败'
     return '未知错误'
   }
 
@@ -553,7 +811,7 @@ export class KeyServiceMac {
               const { xorKey, aesKey } = this.deriveImageKeys(code, candidateWxid)
               if (!this.verifyDerivedAesKey(aesKey, template.ciphertext)) continue
               onStatus?.(`密钥获取成功 (wxid: ${candidateWxid}, code: ${code})`)
-              return { success: true, xorKey, aesKey }
+              return { success: true, xorKey, aesKey, verified: true }
             }
           }
         }
@@ -568,7 +826,7 @@ export class KeyServiceMac {
       const fallbackCode = codes[0]
       const { xorKey, aesKey } = this.deriveImageKeys(fallbackCode, fallbackWxid)
       onStatus?.(`密钥获取成功 (wxid: ${fallbackWxid}, code: ${fallbackCode})`)
-      return { success: true, xorKey, aesKey }
+      return { success: true, xorKey, aesKey, verified: false }
     } catch (e: any) {
       return { success: false, error: `自动获取图片密钥失败: ${e.message}` }
     }
@@ -721,10 +979,12 @@ export class KeyServiceMac {
     try {
       const helperPath = this.getImageScanHelperPath()
       const ciphertextHex = ciphertext.toString('hex')
+      const artifactPaths = this.collectMacKeyArtifactPaths(helperPath)
+      this.ensureExecutableBitsBestEffort(artifactPaths)
 
       // 1) 直接运行 helper（有正式签名的 debugger entitlement 时可用）
       if (!this._needsElevation) {
-        const direct = await this._spawnScanHelper(helperPath, pid, ciphertextHex, false)
+        const direct = await this._spawnScanHelper(helperPath, pid, ciphertextHex, false, artifactPaths)
         if (direct.key) return direct.key
         if (direct.permissionError) {
           console.warn('[KeyServiceMac] task_for_pid 权限不足，切换到 osascript 提权模式')
@@ -735,7 +995,12 @@ export class KeyServiceMac {
 
       // 2) 通过 osascript 以管理员权限运行 helper（SIP 下 ad-hoc 签名无法获取 task_for_pid）
       if (this._needsElevation) {
-        const elevated = await this._spawnScanHelper(helperPath, pid, ciphertextHex, true)
+        try {
+          await this.ensureExecutableBitsWithElevation(artifactPaths, 45_000)
+        } catch (e: any) {
+          console.warn('[KeyServiceMac] elevated chmod failed before image scan:', e?.message || e)
+        }
+        const elevated = await this._spawnScanHelper(helperPath, pid, ciphertextHex, true, artifactPaths)
         if (elevated.key) return elevated.key
       }
     } catch (e: any) {
@@ -838,12 +1103,19 @@ export class KeyServiceMac {
   }
 
   private _spawnScanHelper(
-    helperPath: string, pid: number, ciphertextHex: string, elevated: boolean
+    helperPath: string,
+    pid: number,
+    ciphertextHex: string,
+    elevated: boolean,
+    artifactPaths: string[] = []
   ): Promise<{ key: string | null; permissionError: boolean }> {
     return new Promise((resolve, reject) => {
       let child: ReturnType<typeof spawn>
       if (elevated) {
-        const shellCmd = `'${helperPath}' ${pid} ${ciphertextHex}`
+        const chmodPart = artifactPaths.length > 0
+          ? `/bin/chmod +x ${artifactPaths.map(p => this.shellSingleQuote(p)).join(' ')} && `
+          : ''
+        const shellCmd = `${chmodPart}${this.shellSingleQuote(helperPath)} ${pid} ${ciphertextHex}`
         child = spawn('/usr/bin/osascript', ['-e', `do shell script ${JSON.stringify(shellCmd)} with administrator privileges`],
           { stdio: ['ignore', 'pipe', 'pipe'] })
       } else {
@@ -935,10 +1207,17 @@ export class KeyServiceMac {
   private resolveXwechatRootFromPath(accountPath?: string): string | null {
     const normalized = String(accountPath || '').replace(/\\/g, '/').replace(/\/+$/, '')
     if (!normalized) return null
+
+    // 旧路径：xwechat_files
     const marker = '/xwechat_files'
     const markerIdx = normalized.indexOf(marker)
-    if (markerIdx < 0) return null
-    return normalized.slice(0, markerIdx + marker.length)
+    if (markerIdx >= 0) return normalized.slice(0, markerIdx + marker.length)
+
+    // 新路径（微信 4.0.5+）：Application Support/com.tencent.xinWeChat/2.0b4.0.9
+    const newMarkerMatch = normalized.match(/^(.*\/com\.tencent\.xinWeChat\/(?:\d+\.\d+b\d+\.\d+|\d+\.\d+\.\d+))(\/|$)/)
+    if (newMarkerMatch) return newMarkerMatch[1]
+
+    return null
   }
 
   private pushAccountIdCandidates(candidates: string[], value?: string): void {
@@ -1096,6 +1375,16 @@ export class KeyServiceMac {
         candidates.add(`${base}/app_data/net/kvcomm`)
       }
 
+      // 微信 4.0.5+ 新路径推导：版本目录同级的 net/kvcomm
+      const newMarkerMatch = normalized.match(/^(.*\/com\.tencent\.xinWeChat\/(?:\d+\.\d+b\d+\.\d+|\d+\.\d+\.\d+))/)
+      if (newMarkerMatch) {
+        const versionBase = newMarkerMatch[1]
+        candidates.add(`${versionBase}/net/kvcomm`)
+        // 上级目录也尝试
+        const parentBase = versionBase.replace(/\/[^\/]+$/, '')
+        candidates.add(`${parentBase}/net/kvcomm`)
+      }
+
       let cursor = accountPath
       for (let i = 0; i < 6; i++) {
         candidates.add(join(cursor, 'net', 'kvcomm'))

electron/services/linuxNotificationService.ts

@@ -0,0 +1,186 @@
+import { Notification } from "electron";
+import { avatarFileCache, AvatarFileCacheService } from "./avatarFileCacheService";
+
+export interface LinuxNotificationData {
+  sessionId?: string;
+  title: string;
+  content: string;
+  avatarUrl?: string;
+  channel?: string;
+  insightRecordId?: string;
+  targetRoute?: string;
+  expireTimeout?: number;
+}
+
+type NotificationCallback = (payload: unknown) => void;
+
+let notificationCallbacks: NotificationCallback[] = [];
+let notificationCounter = 1;
+const activeNotifications: Map<number, Notification> = new Map();
+const closeTimers: Map<number, NodeJS.Timeout> = new Map();
+
+function nextNotificationId(): number {
+  const id = notificationCounter;
+  notificationCounter += 1;
+  return id;
+}
+
+function clearNotificationState(notificationId: number): void {
+  activeNotifications.delete(notificationId);
+  const timer = closeTimers.get(notificationId);
+  if (timer) {
+    clearTimeout(timer);
+    closeTimers.delete(notificationId);
+  }
+}
+
+function triggerNotificationCallback(payload: unknown): void {
+  for (const callback of notificationCallbacks) {
+    try {
+      callback(payload);
+    } catch (error) {
+      console.error("[LinuxNotification] Callback error:", error);
+    }
+  }
+}
+
+export async function showLinuxNotification(
+  data: LinuxNotificationData,
+): Promise<number | null> {
+  if (process.platform !== "linux") {
+    return null;
+  }
+
+  if (!Notification.isSupported()) {
+    console.warn("[LinuxNotification] Notification API is not supported");
+    return null;
+  }
+
+  try {
+    let iconPath: string | undefined;
+    if (data.avatarUrl) {
+      iconPath = (await avatarFileCache.getAvatarPath(data.avatarUrl)) || undefined;
+    }
+
+    const notification = new Notification({
+      title: data.title,
+      body: data.content,
+      icon: iconPath,
+    });
+
+    const notificationId = nextNotificationId();
+    activeNotifications.set(notificationId, notification);
+
+    notification.on("click", () => {
+      if (data.channel === "ai-insight" && data.insightRecordId) {
+        triggerNotificationCallback({
+          sessionId: data.sessionId,
+          channel: data.channel,
+          insightRecordId: data.insightRecordId,
+          targetRoute: data.targetRoute,
+        });
+        return;
+      }
+      if (data.sessionId) {
+        triggerNotificationCallback(data.sessionId);
+      }
+    });
+
+    notification.on("close", () => {
+      clearNotificationState(notificationId);
+    });
+
+    notification.on("failed", (_, error) => {
+      console.error("[LinuxNotification] Notification failed:", error);
+      clearNotificationState(notificationId);
+    });
+
+    const expireTimeout = data.expireTimeout ?? 5000;
+    if (expireTimeout > 0) {
+      const timer = setTimeout(() => {
+        const currentNotification = activeNotifications.get(notificationId);
+        if (currentNotification) {
+          currentNotification.close();
+        }
+      }, expireTimeout);
+      closeTimers.set(notificationId, timer);
+    }
+
+    notification.show();
+
+    console.log(
+      `[LinuxNotification] Shown notification ${notificationId}: ${data.title}`,
+    );
+
+    return notificationId;
+  } catch (error) {
+    console.error("[LinuxNotification] Failed to show notification:", error);
+    return null;
+  }
+}
+
+export async function closeLinuxNotification(
+  notificationId: number,
+): Promise<void> {
+  const notification = activeNotifications.get(notificationId);
+  if (!notification) return;
+  notification.close();
+  clearNotificationState(notificationId);
+}
+
+export async function getCapabilities(): Promise<string[]> {
+  if (process.platform !== "linux") {
+    return [];
+  }
+
+  if (!Notification.isSupported()) {
+    return [];
+  }
+
+  return ["native-notification", "click"];
+}
+
+export function onNotificationAction(callback: NotificationCallback): void {
+  notificationCallbacks.push(callback);
+}
+
+export function removeNotificationCallback(
+  callback: NotificationCallback,
+): void {
+  const index = notificationCallbacks.indexOf(callback);
+  if (index > -1) {
+    notificationCallbacks.splice(index, 1);
+  }
+}
+
+export async function initLinuxNotificationService(): Promise<void> {
+  if (process.platform !== "linux") {
+    console.log("[LinuxNotification] Not on Linux, skipping init");
+    return;
+  }
+
+  if (!Notification.isSupported()) {
+    console.warn("[LinuxNotification] Notification API is not supported");
+    return;
+  }
+
+  const caps = await getCapabilities();
+  console.log("[LinuxNotification] Service initialized with native API:", caps);
+}
+
+export async function shutdownLinuxNotificationService(): Promise<void> {
+  // 清理所有活动的通知
+  for (const [id, notification] of activeNotifications) {
+    try {
+      notification.close();
+    } catch {}
+    clearNotificationState(id);
+  }
+
+  // 清理头像文件缓存
+  try {
+    await avatarFileCache.clearCache();
+  } catch {}
+
+  console.log("[LinuxNotification] Service shutdown complete");
+}

electron/services/messageCacheService.ts

@@ -12,6 +12,7 @@ export class MessageCacheService {
   private readonly cacheFilePath: string
   private cache: Record<string, SessionMessageCacheEntry> = {}
   private readonly sessionLimit = 150
+  private readonly maxSessionEntries = 48
 
   constructor(cacheBasePath?: string) {
     const basePath = cacheBasePath && cacheBasePath.trim().length > 0
@@ -36,6 +37,7 @@ export class MessageCacheService {
       const parsed = JSON.parse(raw)
       if (parsed && typeof parsed === 'object') {
         this.cache = parsed
+        this.pruneSessionEntries()
       }
     } catch (error) {
       console.error('MessageCacheService: 载入缓存失败', error)
@@ -43,6 +45,19 @@ export class MessageCacheService {
     }
   }
 
+  private pruneSessionEntries(): void {
+    const entries = Object.entries(this.cache || {})
+    if (entries.length <= this.maxSessionEntries) return
+
+    entries.sort((left, right) => {
+      const leftAt = Number(left[1]?.updatedAt || 0)
+      const rightAt = Number(right[1]?.updatedAt || 0)
+      return rightAt - leftAt
+    })
+
+    this.cache = Object.fromEntries(entries.slice(0, this.maxSessionEntries))
+  }
+
   get(sessionId: string): SessionMessageCacheEntry | undefined {
     return this.cache[sessionId]
   }
@@ -56,6 +71,7 @@ export class MessageCacheService {
       updatedAt: Date.now(),
       messages: trimmed
     }
+    this.pruneSessionEntries()
     this.persist()
   }
 

electron/services/nativeImageDecrypt.ts

@@ -0,0 +1,154 @@
+import { existsSync } from 'fs'
+import { join } from 'path'
+
+type NativeDecryptResult = {
+  data: Buffer
+  ext: string
+  isWxgf?: boolean
+  is_wxgf?: boolean
+  version?: number
+  aesSize?: number
+  aes_size?: number
+  xorSize?: number
+  xor_size?: number
+  rawSize?: number
+  raw_size?: number
+  flag?: number
+}
+
+export type NativeDatMeta = {
+  version?: number
+  aesSize?: number
+  aes_size?: number
+  xorSize?: number
+  xor_size?: number
+  rawSize?: number
+  raw_size?: number
+  flag?: number
+}
+
+type NativeAddon = {
+  decryptDatNative: (inputPath: string, xorKey: number, aesKey?: string) => NativeDecryptResult
+  encryptDatNative?: (inputPath: string, xorKey: number, aesKey?: string, meta?: NativeDatMeta) => Buffer
+}
+
+let cachedAddon: NativeAddon | null | undefined
+
+function shouldEnableNative(): boolean {
+  return process.env.WEFLOW_IMAGE_NATIVE !== '0'
+}
+
+function expandAsarCandidates(filePath: string): string[] {
+  if (!filePath.includes('app.asar') || filePath.includes('app.asar.unpacked')) {
+    return [filePath]
+  }
+  return [filePath.replace('app.asar', 'app.asar.unpacked'), filePath]
+}
+
+function getPlatformDir(): string {
+  if (process.platform === 'win32') return 'win32'
+  if (process.platform === 'darwin') return 'macos'
+  if (process.platform === 'linux') return 'linux'
+  return process.platform
+}
+
+function getArchDir(): string {
+  if (process.arch === 'x64') return 'x64'
+  if (process.arch === 'arm64') return 'arm64'
+  return process.arch
+}
+
+function getAddonCandidates(): string[] {
+  const platformDir = getPlatformDir()
+  const archDir = getArchDir()
+  const cwd = process.cwd()
+  const fileNames = [
+    `weflow-image-native-${platformDir}-${archDir}.node`
+  ]
+  const roots = [
+    join(cwd, 'resources', 'wedecrypt', platformDir, archDir),
+    ...(process.resourcesPath
+      ? [
+          join(process.resourcesPath, 'resources', 'wedecrypt', platformDir, archDir),
+          join(process.resourcesPath, 'wedecrypt', platformDir, archDir)
+        ]
+      : [])
+  ]
+  const candidates = roots.flatMap((root) => fileNames.map((name) => join(root, name)))
+  return Array.from(new Set(candidates.flatMap(expandAsarCandidates)))
+}
+
+function loadAddon(): NativeAddon | null {
+  if (!shouldEnableNative()) return null
+  if (cachedAddon !== undefined) return cachedAddon
+
+  for (const candidate of getAddonCandidates()) {
+    if (!existsSync(candidate)) continue
+    try {
+      // eslint-disable-next-line @typescript-eslint/no-var-requires
+      const addon = require(candidate) as NativeAddon
+      if (addon && typeof addon.decryptDatNative === 'function') {
+        cachedAddon = addon
+        return addon
+      }
+    } catch {
+      // try next candidate
+    }
+  }
+
+  cachedAddon = null
+  return null
+}
+
+export function nativeAddonLocation(): string | null {
+  for (const candidate of getAddonCandidates()) {
+    if (existsSync(candidate)) return candidate
+  }
+  return null
+}
+
+export function decryptDatViaNative(
+  inputPath: string,
+  xorKey: number,
+  aesKey?: string
+): { data: Buffer; ext: string; isWxgf: boolean; meta: NativeDatMeta } | null {
+  const addon = loadAddon()
+  if (!addon) return null
+
+  try {
+    const result = addon.decryptDatNative(inputPath, xorKey, aesKey)
+    const isWxgf = Boolean(result?.isWxgf ?? result?.is_wxgf)
+    if (!result || !Buffer.isBuffer(result.data)) return null
+    const rawExt = typeof result.ext === 'string' && result.ext.trim()
+      ? result.ext.trim().toLowerCase()
+      : ''
+    const ext = rawExt ? (rawExt.startsWith('.') ? rawExt : `.${rawExt}`) : ''
+    const meta: NativeDatMeta = {
+      version: result.version,
+      aes_size: result.aes_size ?? result.aesSize,
+      xor_size: result.xor_size ?? result.xorSize,
+      raw_size: result.raw_size ?? result.rawSize,
+      flag: result.flag
+    }
+    return { data: result.data, ext, isWxgf, meta }
+  } catch {
+    return null
+  }
+}
+
+export function encryptDatViaNative(
+  inputPath: string,
+  xorKey: number,
+  aesKey?: string,
+  meta?: NativeDatMeta
+): Buffer | null {
+  const addon = loadAddon()
+  if (!addon || typeof addon.encryptDatNative !== 'function') return null
+
+  try {
+    const result = addon.encryptDatNative(inputPath, xorKey, aesKey, meta)
+    return Buffer.isBuffer(result) ? result : null
+  } catch {
+    return null
+  }
+}

electron/services/snsService.ts

@@ -1,7 +1,8 @@
 import { wcdbService } from './wcdbService'
 import { ConfigService } from './config'
 import { ContactCacheService } from './contactCacheService'
-import { existsSync, mkdirSync } from 'fs'
+import { app } from 'electron'
+import { existsSync, mkdirSync, unlinkSync } from 'fs'
 import { readFile, writeFile, mkdir } from 'fs/promises'
 import { basename, join } from 'path'
 import crypto from 'crypto'
@@ -13,6 +14,7 @@ export interface SnsLivePhoto {
     thumb: string
     md5?: string
     token?: string
+    thumbToken?: string
     key?: string
     encIdx?: string
 }
@@ -22,6 +24,7 @@ export interface SnsMedia {
     thumb: string
     md5?: string
     token?: string
+    thumbToken?: string
     key?: string
     encIdx?: string
     livePhoto?: SnsLivePhoto
@@ -125,12 +128,22 @@ const fixSnsUrl = (url: string, token?: string, isVideo: boolean = false) => {
 
     let fixedUrl = url.replace('http://', 'https://')
 
-    // 只有非视频（即图片）才需要处理 /150 变 /0
+    // 只有非视频（即图片）才需要处理路径末尾的尺寸标识（/150、/200等）变为 /0
     if (!isVideo) {
-        fixedUrl = fixedUrl.replace(/\/150($|\?)/, '/0$1')
+        const [pathPart, queryPart] = fixedUrl.split('?')
+        const fixedPath = pathPart.replace(/\/(150|200|480)($|\?)/, '/0$2')
+        fixedUrl = queryPart ? `${fixedPath}?${queryPart}` : fixedPath
     }
 
-    if (!token || fixedUrl.includes('token=')) return fixedUrl
+    // 如果没有提供新token，直接返回
+    if (!token) return fixedUrl
+
+    // 移除已有的token和idx参数
+    const [pathPart, queryPart] = fixedUrl.split('?')
+    if (queryPart) {
+        const params = queryPart.split('&').filter(p => !p.startsWith('token=') && !p.startsWith('idx='))
+        fixedUrl = params.length > 0 ? `${pathPart}?${params.join('&')}` : pathPart
+    }
 
     // 根据用户要求，视频链接组合方式为: BASE_URL + "?" + "token=" + token + "&idx=1" + 原有参数
     if (isVideo) {
@@ -173,8 +186,17 @@ const detectImageMime = (buf: Buffer, fallback: string = 'image/jpeg') => {
     // BMP
     if (buf[0] === 0x42 && buf[1] === 0x4d) return 'image/bmp'
 
-    // MP4: 00 00 00 18 / 20 / ... + 'ftyp'
-    if (buf.length > 8 && buf[4] === 0x66 && buf[5] === 0x74 && buf[6] === 0x79 && buf[7] === 0x70) return 'video/mp4'
+    // ISO BMFF 家族：优先识别 AVIF/HEIF，避免误判为 MP4
+    if (buf.length > 12 && buf[4] === 0x66 && buf[5] === 0x74 && buf[6] === 0x79 && buf[7] === 0x70) {
+        const ftypWindow = buf.subarray(8, Math.min(buf.length, 64)).toString('ascii').toLowerCase()
+        if (ftypWindow.includes('avif') || ftypWindow.includes('avis')) return 'image/avif'
+        if (
+            ftypWindow.includes('heic') || ftypWindow.includes('heix') ||
+            ftypWindow.includes('hevc') || ftypWindow.includes('hevx') ||
+            ftypWindow.includes('mif1') || ftypWindow.includes('msf1')
+        ) return 'image/heic'
+        return 'video/mp4'
+    }
 
     // Fallback logic for video
     if (fallback.includes('video') || fallback.includes('mp4')) return 'video/mp4'
@@ -314,6 +336,9 @@ class SnsService {
     private configService: ConfigService
     private contactCache: ContactCacheService
     private imageCache = new Map<string, string>()
+    private imageCacheMeta = new Map<string, number>()
+    private readonly imageCacheTtlMs = 15 * 60 * 1000
+    private readonly imageCacheMaxEntries = 120
     private exportStatsCache: { totalPosts: number; totalFriends: number; myPosts: number | null; updatedAt: number } | null = null
     private userPostCountsCache: { counts: Record<string, number>; updatedAt: number } | null = null
     private readonly exportStatsCacheTtlMs = 5 * 60 * 1000
@@ -326,6 +351,38 @@ class SnsService {
         this.contactCache = new ContactCacheService(this.configService.get('cachePath') as string)
     }
 
+    clearMemoryCache(): void {
+        this.imageCache.clear()
+        this.imageCacheMeta.clear()
+    }
+
+    private pruneImageCache(now: number = Date.now()): void {
+        for (const [key, updatedAt] of this.imageCacheMeta.entries()) {
+            if (now - updatedAt > this.imageCacheTtlMs) {
+                this.imageCacheMeta.delete(key)
+                this.imageCache.delete(key)
+            }
+        }
+
+        while (this.imageCache.size > this.imageCacheMaxEntries) {
+            const oldestKey = this.imageCache.keys().next().value as string | undefined
+            if (!oldestKey) break
+            this.imageCache.delete(oldestKey)
+            this.imageCacheMeta.delete(oldestKey)
+        }
+    }
+
+    private rememberImageCache(cacheKey: string, dataUrl: string): void {
+        if (!cacheKey || !dataUrl) return
+        const now = Date.now()
+        if (this.imageCache.has(cacheKey)) {
+            this.imageCache.delete(cacheKey)
+        }
+        this.imageCache.set(cacheKey, dataUrl)
+        this.imageCacheMeta.set(cacheKey, now)
+        this.pruneImageCache(now)
+    }
+
     private toOptionalString(value: unknown): string | undefined {
         if (typeof value !== 'string') return undefined
         const trimmed = value.trim()
@@ -537,6 +594,32 @@ class SnsService {
         return raw.trim()
     }
 
+    private async collectSnsUsernamesFromTimeline(maxRounds: number = 2000): Promise<string[]> {
+        const pageSize = 500
+        const uniqueUsers = new Set<string>()
+        let offset = 0
+
+        for (let round = 0; round < maxRounds; round++) {
+            const result = await wcdbService.getSnsTimeline(pageSize, offset, undefined, undefined, 0, 0)
+            if (!result.success || !Array.isArray(result.timeline)) {
+                throw new Error(result.error || '获取朋友圈发布者失败')
+            }
+
+            const rows = result.timeline
+            if (rows.length === 0) break
+
+            for (const row of rows) {
+                const username = this.pickTimelineUsername(row)
+                if (username) uniqueUsers.add(username)
+            }
+
+            if (rows.length < pageSize) break
+            offset += rows.length
+        }
+
+        return Array.from(uniqueUsers)
+    }
+
     private async getExportStatsFromTimeline(myWxid?: string): Promise<{ totalPosts: number; totalFriends: number; myPosts: number | null }> {
         const pageSize = 500
         const uniqueUsers = new Set<string>()
@@ -633,6 +716,7 @@ class SnsService {
                     url: urlMatch ? urlMatch[1].trim() : '',
                     thumb: thumbMatch ? thumbMatch[1].trim() : '',
                     token: urlToken || thumbToken,
+                    thumbToken: thumbToken,
                     key: urlKey || thumbKey,
                     md5: urlMd5,
                     encIdx: urlEncIdx || thumbEncIdx
@@ -645,19 +729,24 @@ class SnsService {
                     const lpUrlTag = lx.match(/<url([^>]*)>/i)
                     const lpThumb = lx.match(/<thumb[^>]*>([^<]+)<\/thumb>/i)
                     const lpThumbTag = lx.match(/<thumb([^>]*)>/i)
-                    let lpToken: string | undefined, lpKey: string | undefined, lpEncIdx: string | undefined
+                    let lpUrlToken: string | undefined, lpThumbToken: string | undefined
+                    let lpKey: string | undefined, lpEncIdx: string | undefined
                     if (lpUrlTag?.[1]) {
                         const a = lpUrlTag[1]
-                        lpToken = a.match(/token="([^"]+)"/i)?.[1]
+                        lpUrlToken = a.match(/token="([^"]+)"/i)?.[1]
                         lpKey = a.match(/key="([^"]+)"/i)?.[1]
                         lpEncIdx = a.match(/enc_idx="([^"]+)"/i)?.[1]
                     }
-                    if (!lpToken && lpThumbTag?.[1]) lpToken = lpThumbTag[1].match(/token="([^"]+)"/i)?.[1]
-                    if (!lpKey && lpThumbTag?.[1]) lpKey = lpThumbTag[1].match(/key="([^"]+)"/i)?.[1]
+                    if (lpThumbTag?.[1]) {
+                        const a = lpThumbTag[1]
+                        lpThumbToken = a.match(/token="([^"]+)"/i)?.[1]
+                        if (!lpKey) lpKey = a.match(/key="([^"]+)"/i)?.[1]
+                    }
                     item.livePhoto = {
                         url: lpUrl ? lpUrl[1].trim() : '',
                         thumb: lpThumb ? lpThumb[1].trim() : '',
-                        token: lpToken,
+                        token: lpUrlToken || lpThumbToken,
+                        thumbToken: lpThumbToken,
                         key: lpKey,
                         encIdx: lpEncIdx
                     }
@@ -775,14 +864,25 @@ class SnsService {
     }
 
     private getSnsCacheDir(): string {
-        const cachePath = this.configService.getCacheBasePath()
-        const snsCacheDir = join(cachePath, 'sns_cache')
+        const configuredCachePath = String(this.configService.get('cachePath') || '').trim()
+        const baseDir = configuredCachePath || join(app.getPath('documents'), 'WeFlow')
+        const snsCacheDir = join(baseDir, 'sns_cache')
         if (!existsSync(snsCacheDir)) {
             mkdirSync(snsCacheDir, { recursive: true })
         }
         return snsCacheDir
     }
 
+    private getEmojiCacheDir(): string {
+        const configuredCachePath = String(this.configService.get('cachePath') || '').trim()
+        const baseDir = configuredCachePath || join(app.getPath('documents'), 'WeFlow')
+        const emojiDir = join(baseDir, 'Emojis')
+        if (!existsSync(emojiDir)) {
+            mkdirSync(emojiDir, { recursive: true })
+        }
+        return emojiDir
+    }
+
     private getCacheFilePath(url: string): string {
         const hash = crypto.createHash('md5').update(url).digest('hex')
         const ext = isVideoUrl(url) ? '.mp4' : '.jpg'
@@ -794,7 +894,22 @@ class SnsService {
         if (!result.success) {
             return { success: false, error: result.error || '获取朋友圈联系人失败' }
         }
-        return { success: true, usernames: result.usernames || [] }
+        const directUsernames = Array.isArray(result.usernames) ? result.usernames : []
+        if (directUsernames.length > 0) {
+            return { success: true, usernames: directUsernames }
+        }
+
+        // 回退：通过 timeline 分页拉取收集用户名，兼容底层接口暂时返回空数组的场景。
+        try {
+            const timelineUsers = await this.collectSnsUsernamesFromTimeline()
+            if (timelineUsers.length > 0) {
+                return { success: true, usernames: timelineUsers }
+            }
+        } catch {
+            // 忽略回退错误，保持与原行为一致返回空数组
+        }
+
+        return { success: true, usernames: directUsernames }
     }
 
     private async getExportStatsFromTableCount(myWxid?: string): Promise<{ totalPosts: number; totalFriends: number; myPosts: number | null }> {
@@ -817,7 +932,7 @@ class SnsService {
         const allowTimelineFallback = options?.allowTimelineFallback ?? true
         const preferCache = options?.preferCache ?? false
         const now = Date.now()
-        const myWxid = this.toOptionalString(this.configService.get('myWxid'))
+        const myWxid = this.toOptionalString(this.configService.getMyWxidCleaned())
 
         try {
             if (preferCache && this.exportStatsCache && now - this.exportStatsCache.updatedAt <= this.exportStatsCacheTtlMs) {
@@ -1021,14 +1136,14 @@ class SnsService {
     }
 
     /**
-     * 补全 DLL 返回的评论中缺失的 refNickname
-     * DLL 返回的 refCommentId 是被回复评论的 cmtid
+     * 补全数据服务返回的评论中缺失的 refNickname
+     *数据服务返回的 refCommentId 是被回复评论的 cmtid
      * 评论按 cmtid 从小到大排列，cmtid 从 1 开始递增
      */
     private fixCommentRefs(comments: any[]): any[] {
         if (!comments || comments.length === 0) return []
 
-        // DLL 现在返回完整的评论数据（含 emojis、refNickname）
+        //数据服务现在返回完整的评论数据（含 emojis、refNickname）
         // 此处做最终的格式化和兜底补全
         const idToNickname = new Map<string, string>()
         comments.forEach((c, idx) => {
@@ -1084,29 +1199,31 @@ class SnsService {
 
             const fixedMedia = (post.media || []).map((m: any) => ({
                 url: fixSnsUrl(m.url, m.token, isVideoPost),
-                thumb: fixSnsUrl(m.thumb, m.token, false),
+                thumb: fixSnsUrl(m.thumb, m.thumbToken || m.token, false),
                 md5: m.md5,
                 token: m.token,
+                thumbToken: m.thumbToken,
                 key: isVideoPost ? (videoKey || m.key) : m.key,
                 encIdx: m.encIdx || m.enc_idx,
                 livePhoto: m.livePhoto ? {
                     ...m.livePhoto,
                     url: fixSnsUrl(m.livePhoto.url, m.livePhoto.token, true),
-                    thumb: fixSnsUrl(m.livePhoto.thumb, m.livePhoto.token, false),
+                    thumb: fixSnsUrl(m.livePhoto.thumb, m.livePhoto.thumbToken || m.livePhoto.token, false),
                     token: m.livePhoto.token,
+                    thumbToken: m.livePhoto.thumbToken,
                     key: videoKey || m.livePhoto.key || m.key,
                     encIdx: m.livePhoto.encIdx || m.livePhoto.enc_idx
                 } : undefined
             }))
 
-            // DLL 已返回完整评论数据（含 emojis、refNickname）
-            // 如果 DLL 评论缺少表情包信息，回退到从 rawXml 重新解析
+            //数据服务已返回完整评论数据（含 emojis、refNickname）
+            // 如果数据服务评论缺少表情包信息，回退到从 rawXml 重新解析
             const dllComments: any[] = post.comments || []
             const hasEmojisInDll = dllComments.some((c: any) => c.emojis && c.emojis.length > 0)
 
             let finalComments: any[]
             if (dllComments.length > 0 && (hasEmojisInDll || !rawXml)) {
-                // DLL 数据完整，直接使用
+                //数据服务数据完整，直接使用
                 finalComments = this.fixCommentRefs(dllComments)
             } else if (rawXml) {
                 // 回退：从 rawXml 重新解析（兼容旧版 DLL）
@@ -1177,8 +1294,27 @@ class SnsService {
         if (!url) return { success: false, error: 'url 不能为空' }
         const cacheKey = `${url}|${key ?? ''}`
 
-        if (this.imageCache.has(cacheKey)) {
-            return { success: true, dataUrl: this.imageCache.get(cacheKey) }
+        const cachedDataUrl = this.imageCache.get(cacheKey) || ''
+        if (cachedDataUrl) {
+            const cachedAt = this.imageCacheMeta.get(cacheKey) || 0
+            if (cachedAt > 0 && Date.now() - cachedAt <= this.imageCacheTtlMs) {
+                const base64Part = cachedDataUrl.split(',')[1] || ''
+                if (base64Part) {
+                    try {
+                        const cachedBuf = Buffer.from(base64Part, 'base64')
+                        if (detectImageMime(cachedBuf, '').startsWith('image/')) {
+                            this.imageCache.delete(cacheKey)
+                            this.imageCache.set(cacheKey, cachedDataUrl)
+                            this.imageCacheMeta.set(cacheKey, Date.now())
+                            return { success: true, dataUrl: cachedDataUrl }
+                        }
+                    } catch {
+                        // ignore and fall through to refetch
+                    }
+                }
+            }
+            this.imageCache.delete(cacheKey)
+            this.imageCacheMeta.delete(cacheKey)
         }
 
         const result = await this.fetchAndDecryptImage(url, key)
@@ -1191,15 +1327,18 @@ class SnsService {
             }
 
             if (result.data && result.contentType) {
+                if (!detectImageMime(result.data, '').startsWith('image/')) {
+                    return { success: false, error: '无效图片数据（可能密钥不匹配或缓存损坏）' }
+                }
                 const dataUrl = `data:${result.contentType};base64,${result.data.toString('base64')}`
-                this.imageCache.set(cacheKey, dataUrl)
+                this.rememberImageCache(cacheKey, dataUrl)
                 return { success: true, dataUrl }
             }
         }
         return { success: false, error: result.error }
     }
 
-    async downloadImage(url: string, key?: string | number): Promise<{ success: boolean; data?: Buffer; contentType?: string; error?: string }> {
+    async downloadImage(url: string, key?: string | number): Promise<{ success: boolean; data?: Buffer; contentType?: string; cachePath?: string; error?: string }> {
         return this.fetchAndDecryptImage(url, key)
     }
 
@@ -1221,6 +1360,8 @@ class SnsService {
     }, progressCallback?: (progress: { current: number; total: number; status: string }) => void, control?: {
         shouldPause?: () => boolean
         shouldStop?: () => boolean
+        recordCreatedFile?: (filePath: string) => void
+        recordCreatedDir?: (dirPath: string) => void
     }): Promise<{ success: boolean; filePath?: string; postCount?: number; mediaCount?: number; paused?: boolean; stopped?: boolean; error?: string }> {
         const { outputDir, format, usernames, keyword, startTime, endTime } = options
         const hasExplicitMediaSelection =
@@ -1242,6 +1383,18 @@ class SnsService {
             if (control?.shouldPause?.()) return 'paused'
             return null
         }
+        const ensureExportDir = (dirPath: string) => {
+            const existed = existsSync(dirPath)
+            if (!existed) {
+                mkdirSync(dirPath, { recursive: true })
+                control?.recordCreatedDir?.(dirPath)
+            }
+        }
+        const recordCreatedFileBeforeWrite = (filePath: string) => {
+            if (!existsSync(filePath)) {
+                control?.recordCreatedFile?.(filePath)
+            }
+        }
         const buildInterruptedResult = (state: 'paused' | 'stopped', postCount: number, mediaCount: number) => (
             state === 'stopped'
                 ? { success: true, stopped: true, filePath: '', postCount, mediaCount }
@@ -1250,9 +1403,7 @@ class SnsService {
 
         try {
             // 确保输出目录存在
-            if (!existsSync(outputDir)) {
-                mkdirSync(outputDir, { recursive: true })
-            }
+            ensureExportDir(outputDir)
 
             // 1. 分页加载全部帖子
             const allPosts: SnsPost[] = []
@@ -1295,9 +1446,7 @@ class SnsService {
             const mediaDir = join(outputDir, 'media')
 
             if (shouldExportMedia) {
-                if (!existsSync(mediaDir)) {
-                    mkdirSync(mediaDir, { recursive: true })
-                }
+                ensureExportDir(mediaDir)
 
                 // 收集所有媒体下载任务
                 const mediaTasks: Array<{
@@ -1366,6 +1515,7 @@ class SnsService {
                         } else {
                             const result = await this.fetchAndDecryptImage(task.url, task.key)
                             if (result.success && result.data) {
+                                recordCreatedFileBeforeWrite(filePath)
                                 await writeFile(filePath, result.data)
                                 if (task.kind === 'livephoto') {
                                     if (media.livePhoto) (media.livePhoto as any).localPath = `media/${fileName}`
@@ -1375,6 +1525,7 @@ class SnsService {
                                 mediaCount++
                             } else if (result.success && result.cachePath) {
                                 const cachedData = await readFile(result.cachePath)
+                                recordCreatedFileBeforeWrite(filePath)
                                 await writeFile(filePath, cachedData)
                                 if (task.kind === 'livephoto') {
                                     if (media.livePhoto) (media.livePhoto as any).localPath = `media/${fileName}`
@@ -1412,7 +1563,7 @@ class SnsService {
             // 2.5 下载头像
             const avatarMap = new Map<string, string>()
             if (format === 'html') {
-                if (!existsSync(mediaDir)) mkdirSync(mediaDir, { recursive: true })
+                ensureExportDir(mediaDir)
                 const uniqueUsers = [...new Map(allPosts.filter(p => p.avatarUrl).map(p => [p.username, p])).values()]
                 let avatarDone = 0
                 const avatarQueue = [...uniqueUsers]
@@ -1429,6 +1580,7 @@ class SnsService {
                             } else {
                                 const result = await this.fetchAndDecryptImage(post.avatarUrl!)
                                 if (result.success && result.data) {
+                                    recordCreatedFileBeforeWrite(filePath)
                                     await writeFile(filePath, result.data)
                                     avatarMap.set(post.username, `media/${fileName}`)
                                 }
@@ -1483,6 +1635,7 @@ class SnsService {
                         linkUrl: (p as any).linkUrl
                     }))
                 }
+                recordCreatedFileBeforeWrite(outputFilePath)
                 await writeFile(outputFilePath, JSON.stringify(exportData, null, 2), 'utf-8')
             } else if (format === 'arkmejson') {
                 outputFilePath = join(outputDir, `朋友圈导出_${timestamp}.json`)
@@ -1570,11 +1723,13 @@ class SnsService {
                     },
                     posts
                 }
+                recordCreatedFileBeforeWrite(outputFilePath)
                 await writeFile(outputFilePath, JSON.stringify(exportData, null, 2), 'utf-8')
             } else {
                 // HTML 格式
                 outputFilePath = join(outputDir, `朋友圈导出_${timestamp}.html`)
                 const html = this.generateHtml(allPosts, { usernames, keyword }, avatarMap)
+                recordCreatedFileBeforeWrite(outputFilePath)
                 await writeFile(outputFilePath, html, 'utf-8')
             }
 
@@ -1791,7 +1946,7 @@ window.addEventListener('scroll',function(){document.getElementById('btt').class
         const isVideo = isVideoUrl(url)
         const cachePath = this.getCacheFilePath(url)
 
-        // 1. 尝试从磁盘缓存读取
+        // 1. 优先尝试从当前缓存目录读取
         if (existsSync(cachePath)) {
             try {
                 // 对于视频，不读取整个文件到内存，只确认存在即可
@@ -1800,8 +1955,13 @@ window.addEventListener('scroll',function(){document.getElementById('btt').class
                 }
 
                 const data = await readFile(cachePath)
-                const contentType = detectImageMime(data)
-                return { success: true, data, contentType, cachePath }
+                if (!detectImageMime(data, '').startsWith('image/')) {
+                    // 旧版本可能把未解密内容写入缓存；发现无效图片头时删除并重新拉取。
+                    try { unlinkSync(cachePath) } catch { }
+                } else {
+                    const contentType = detectImageMime(data)
+                    return { success: true, data, contentType, cachePath }
+                }
             } catch (e) {
                 console.warn(`[SnsService] 读取缓存失败: ${cachePath}`, e)
             }
@@ -1920,6 +2080,8 @@ window.addEventListener('scroll',function(){document.getElementById('btt').class
                 const zlib = require('zlib')
                 const urlObj = new URL(url)
 
+                console.log(`[SnsService] 开始下载图片: url=${url.substring(0, 100)}..., key=${key || 'undefined'}`)
+
                 const options = {
                     hostname: urlObj.hostname,
                     path: urlObj.pathname + urlObj.search,
@@ -1934,7 +2096,9 @@ window.addEventListener('scroll',function(){document.getElementById('btt').class
                 }
 
                 const req = https.request(options, (res: any) => {
+                    console.log(`[SnsService] CDN 响应: statusCode=${res.statusCode}, x-enc=${res.headers['x-enc']}, content-type=${res.headers['content-type']}`)
                     if (res.statusCode !== 200 && res.statusCode !== 206) {
+                        console.error(`[SnsService] CDN 请求失败: HTTP ${res.statusCode}`)
                         resolve({ success: false, error: `HTTP ${res.statusCode}` })
                         return
                     }
@@ -1953,9 +2117,12 @@ window.addEventListener('scroll',function(){document.getElementById('btt').class
                         const xEnc = String(res.headers['x-enc'] || '').trim()
 
                         let decoded = raw
+                        const rawMagicMime = detectImageMime(raw, '')
+                        console.log(`[SnsService] 原始数据: size=${raw.length}, mime=${rawMagicMime}, xEnc=${xEnc}`)
 
                         // 图片逻辑
                         const shouldDecrypt = (xEnc === '1' || !!key) && key !== undefined && key !== null && String(key).trim().length > 0
+                        console.log(`[SnsService] 解密判断: shouldDecrypt=${shouldDecrypt}, key=${key || 'undefined'}`)
                         if (shouldDecrypt) {
                             try {
                                 const keyStr = String(key).trim()
@@ -1970,13 +2137,27 @@ window.addEventListener('scroll',function(){document.getElementById('btt').class
                                         decrypted[i] = raw[i] ^ keystream[i]
                                     }
 
-                                    decoded = decrypted
+                                    const decryptedMagicMime = detectImageMime(decrypted, '')
+                                    console.log(`[SnsService] 解密后: mime=${decryptedMagicMime}`)
+                                    if (decryptedMagicMime.startsWith('image/')) {
+                                        decoded = decrypted
+                                    } else if (!rawMagicMime.startsWith('image/')) {
+                                        decoded = decrypted
+                                    }
                                 }
                             } catch (e) {
                                 console.error('[SnsService] TS Decrypt Error:', e)
                             }
                         }
 
+                        const decodedMagicMime = detectImageMime(decoded, '')
+                        console.log(`[SnsService] 最终结果: mime=${decodedMagicMime}, isImage=${decodedMagicMime.startsWith('image/')}`)
+                        if (!decodedMagicMime.startsWith('image/')) {
+                            console.error(`[SnsService] 图片解密失败: 原始mime=${rawMagicMime}, 解密后mime=${decodedMagicMime}, key=${key}`)
+                            resolve({ success: false, error: '图片解密失败：无法识别图片格式' })
+                            return
+                        }
+
                         // 写入磁盘缓存
                         try {
                             await writeFile(cachePath, decoded)
@@ -2010,6 +2191,15 @@ window.addEventListener('scroll',function(){document.getElementById('btt').class
         if (buf[0] === 0xFF && buf[1] === 0xD8 && buf[2] === 0xFF) return true
         if (buf[0] === 0x52 && buf[1] === 0x49 && buf[2] === 0x46 && buf[3] === 0x46
             && buf[8] === 0x57 && buf[9] === 0x45 && buf[10] === 0x42 && buf[11] === 0x50) return true
+        if (buf[4] === 0x66 && buf[5] === 0x74 && buf[6] === 0x79 && buf[7] === 0x70) {
+            const ftypWindow = buf.subarray(8, Math.min(buf.length, 64)).toString('ascii').toLowerCase()
+            if (ftypWindow.includes('avif') || ftypWindow.includes('avis')) return true
+            if (
+                ftypWindow.includes('heic') || ftypWindow.includes('heix') ||
+                ftypWindow.includes('hevc') || ftypWindow.includes('hevx') ||
+                ftypWindow.includes('mif1') || ftypWindow.includes('msf1')
+            ) return true
+        }
         return false
     }
 
@@ -2252,9 +2442,7 @@ window.addEventListener('scroll',function(){document.getElementById('btt').class
 
         const fs = require('fs')
         const cacheKey = crypto.createHash('md5').update(url || encryptUrl!).digest('hex')
-        const cachePath = this.configService.getCacheBasePath()
-        const emojiDir = join(cachePath, 'sns_emoji_cache')
-        if (!existsSync(emojiDir)) mkdirSync(emojiDir, { recursive: true })
+        const emojiDir = this.getEmojiCacheDir()
 
         // 检查本地缓存
         for (const ext of ['.gif', '.png', '.webp', '.jpg', '.jpeg']) {

electron/services/social/weiboService.ts

@@ -0,0 +1,367 @@
+import https from 'https'
+import { createHash } from 'crypto'
+import { URL } from 'url'
+
+const WEIBO_TIMEOUT_MS = 10_000
+const WEIBO_MAX_POSTS = 5
+const WEIBO_CACHE_TTL_MS = 30 * 60 * 1000
+const WEIBO_USER_AGENT =
+  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36'
+const WEIBO_MOBILE_USER_AGENT =
+  'Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1'
+
+interface BrowserCookieEntry {
+  domain?: string
+  name?: string
+  value?: string
+}
+
+interface WeiboUserInfo {
+  id?: number | string
+  screen_name?: string
+}
+
+interface WeiboWaterFallItem {
+  id?: number | string
+  idstr?: string
+  mblogid?: string
+  created_at?: string
+  text_raw?: string
+  isLongText?: boolean
+  user?: WeiboUserInfo
+  retweeted_status?: WeiboWaterFallItem
+}
+
+interface WeiboWaterFallResponse {
+  ok?: number
+  data?: {
+    list?: WeiboWaterFallItem[]
+    next_cursor?: string
+  }
+}
+
+interface WeiboStatusShowResponse {
+  id?: number | string
+  idstr?: string
+  mblogid?: string
+  created_at?: string
+  text_raw?: string
+  user?: WeiboUserInfo
+  retweeted_status?: WeiboWaterFallItem
+}
+
+interface MWeiboCard {
+  mblog?: WeiboWaterFallItem
+  card_group?: MWeiboCard[]
+}
+
+interface MWeiboContainerResponse {
+  ok?: number
+  data?: {
+    cards?: MWeiboCard[]
+  }
+}
+
+export interface WeiboRecentPost {
+  id: string
+  createdAt: string
+  url: string
+  text: string
+  screenName?: string
+}
+
+interface CachedRecentPosts {
+  expiresAt: number
+  posts: WeiboRecentPost[]
+}
+
+function requestJson<T>(url: string, options: { cookie?: string; referer?: string; userAgent?: string }): Promise<T> {
+  return new Promise((resolve, reject) => {
+    let urlObj: URL
+    try {
+      urlObj = new URL(url)
+    } catch {
+      reject(new Error(`无效的微博请求地址：${url}`))
+      return
+    }
+
+    const headers: Record<string, string> = {
+      Accept: 'application/json, text/plain, */*',
+      Referer: options.referer || 'https://weibo.com',
+      'User-Agent': options.userAgent || WEIBO_USER_AGENT,
+      'X-Requested-With': 'XMLHttpRequest'
+    }
+    if (options.cookie) {
+      headers.Cookie = options.cookie
+    }
+
+    const req = https.request(
+      {
+        hostname: urlObj.hostname,
+        port: urlObj.port || 443,
+        path: urlObj.pathname + urlObj.search,
+        method: 'GET',
+        headers
+      },
+      (res) => {
+        let raw = ''
+        res.setEncoding('utf8')
+        res.on('data', (chunk) => {
+          raw += chunk
+        })
+        res.on('end', () => {
+          const statusCode = res.statusCode || 0
+          if (statusCode < 200 || statusCode >= 300) {
+            reject(new Error(`微博接口返回异常状态码 ${statusCode}`))
+            return
+          }
+          try {
+            resolve(JSON.parse(raw) as T)
+          } catch {
+            reject(new Error('微博接口返回了非 JSON 响应'))
+          }
+        })
+      }
+    )
+
+    req.setTimeout(WEIBO_TIMEOUT_MS, () => {
+      req.destroy()
+      reject(new Error('微博请求超时'))
+    })
+
+    req.on('error', reject)
+    req.end()
+  })
+}
+
+function normalizeCookieArray(entries: BrowserCookieEntry[]): string {
+  const picked = new Map<string, string>()
+
+  for (const entry of entries) {
+    const name = String(entry?.name || '').trim()
+    const value = String(entry?.value || '').trim()
+    const domain = String(entry?.domain || '').trim().toLowerCase()
+
+    if (!name || !value) continue
+    if (domain && !domain.includes('weibo.com') && !domain.includes('weibo.cn')) continue
+
+    picked.set(name, value)
+  }
+
+  return Array.from(picked.entries())
+    .map(([name, value]) => `${name}=${value}`)
+    .join('; ')
+}
+
+export function normalizeWeiboCookieInput(rawInput: string): string {
+  const trimmed = String(rawInput || '').trim()
+  if (!trimmed) return ''
+
+  try {
+    const parsed = JSON.parse(trimmed) as unknown
+    if (Array.isArray(parsed)) {
+      const normalized = normalizeCookieArray(parsed as BrowserCookieEntry[])
+      if (normalized) return normalized
+      throw new Error('Cookie JSON 中未找到可用的微博 Cookie 项')
+    }
+  } catch (error) {
+    if (!(error instanceof SyntaxError)) {
+      throw error
+    }
+  }
+
+  return trimmed.replace(/^Cookie:\s*/i, '').trim()
+}
+
+function normalizeWeiboUid(input: string): string {
+  const trimmed = String(input || '').trim()
+  const directMatch = trimmed.match(/^\d{5,}$/)
+  if (directMatch) return directMatch[0]
+
+  const linkMatch = trimmed.match(/(?:weibo\.com|m\.weibo\.cn)\/u\/(\d{5,})/i)
+  if (linkMatch) return linkMatch[1]
+
+  throw new Error('请输入有效的微博 UID（纯数字）')
+}
+
+function sanitizeWeiboText(text: string): string {
+  return String(text || '')
+    .replace(/\u200b|\u200c|\u200d|\ufeff/g, '')
+    .replace(/https?:\/\/t\.cn\/[A-Za-z0-9]+/g, ' ')
+    .replace(/ +/g, ' ')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim()
+}
+
+function mergeRetweetText(item: Pick<WeiboWaterFallItem, 'text_raw' | 'retweeted_status'>): string {
+  const baseText = sanitizeWeiboText(item.text_raw || '')
+  const retweetText = sanitizeWeiboText(item.retweeted_status?.text_raw || '')
+  if (!retweetText) return baseText
+  if (!baseText || baseText === '转发微博') return `转发：${retweetText}`
+  return `${baseText}\n\n转发内容：${retweetText}`
+}
+
+function buildCacheKey(uid: string, count: number, cookie: string): string {
+  const cookieHash = createHash('sha1').update(cookie).digest('hex')
+  return `${uid}:${count}:${cookieHash}`
+}
+
+class WeiboService {
+  private recentPostsCache = new Map<string, CachedRecentPosts>()
+
+  clearCache(): void {
+    this.recentPostsCache.clear()
+  }
+
+  async validateUid(
+    uidInput: string,
+    cookieInput: string
+  ): Promise<{ success: boolean; uid?: string; screenName?: string; error?: string }> {
+    try {
+      const uid = normalizeWeiboUid(uidInput)
+      const cookie = normalizeWeiboCookieInput(cookieInput)
+      if (!cookie) {
+        return { success: true, uid }
+      }
+
+      const timeline = await this.fetchTimeline(uid, cookie)
+      const firstItem = timeline.data?.list?.[0]
+      if (!firstItem) {
+        return { success: false, error: '该微博账号暂无可读取的近期公开内容，或当前 Cookie 已失效' }
+      }
+
+      return {
+        success: true,
+        uid,
+        screenName: firstItem.user?.screen_name
+      }
+    } catch (error) {
+      return {
+        success: false,
+        error: (error as Error).message || '微博 UID 校验失败'
+      }
+    }
+  }
+
+  async fetchRecentPosts(
+    uidInput: string,
+    cookieInput: string,
+    requestedCount: number
+  ): Promise<WeiboRecentPost[]> {
+    const uid = normalizeWeiboUid(uidInput)
+    const cookie = normalizeWeiboCookieInput(cookieInput)
+    const hasCookie = Boolean(cookie)
+
+    const count = Math.max(1, Math.min(WEIBO_MAX_POSTS, Math.floor(Number(requestedCount) || 0)))
+    const cacheKey = buildCacheKey(uid, count, hasCookie ? cookie : '__no_cookie_mobile__')
+    const cached = this.recentPostsCache.get(cacheKey)
+    const now = Date.now()
+
+    if (cached && cached.expiresAt > now) {
+      return cached.posts
+    }
+
+    const rawItems = hasCookie
+      ? (await this.fetchTimeline(uid, cookie)).data?.list || []
+      : await this.fetchMobileTimeline(uid)
+    const posts: WeiboRecentPost[] = []
+
+    for (const item of rawItems) {
+      if (posts.length >= count) break
+
+      const id = String(item.idstr || item.id || '').trim()
+      if (!id) continue
+
+      let text = mergeRetweetText(item)
+      if (item.isLongText && hasCookie) {
+        try {
+          const detail = await this.fetchDetail(id, cookie)
+          text = mergeRetweetText(detail)
+        } catch {
+          // 长文补抓失败时回退到列表摘要
+        }
+      }
+
+      text = sanitizeWeiboText(text)
+      if (!text) continue
+
+      posts.push({
+        id,
+        createdAt: String(item.created_at || ''),
+        url: `https://m.weibo.cn/detail/${id}`,
+        text,
+        screenName: item.user?.screen_name
+      })
+    }
+
+    this.recentPostsCache.set(cacheKey, {
+      expiresAt: now + WEIBO_CACHE_TTL_MS,
+      posts
+    })
+
+    return posts
+  }
+
+  private fetchTimeline(uid: string, cookie: string): Promise<WeiboWaterFallResponse> {
+    return requestJson<WeiboWaterFallResponse>(
+      `https://weibo.com/ajax/profile/getWaterFallContent?uid=${encodeURIComponent(uid)}`,
+      {
+        cookie,
+        referer: `https://weibo.com/u/${encodeURIComponent(uid)}`
+      }
+    ).then((response) => {
+      if (response.ok !== 1 || !Array.isArray(response.data?.list)) {
+        throw new Error('微博时间线获取失败，请检查 Cookie 是否仍然有效')
+      }
+      return response
+    })
+  }
+
+  private fetchMobileTimeline(uid: string): Promise<WeiboWaterFallItem[]> {
+    const containerid = `107603${uid}`
+    return requestJson<MWeiboContainerResponse>(
+      `https://m.weibo.cn/api/container/getIndex?type=uid&value=${encodeURIComponent(uid)}&containerid=${encodeURIComponent(containerid)}`,
+      {
+        referer: `https://m.weibo.cn/u/${encodeURIComponent(uid)}`,
+        userAgent: WEIBO_MOBILE_USER_AGENT
+      }
+    ).then((response) => {
+      if (response.ok !== 1 || !Array.isArray(response.data?.cards)) {
+        throw new Error('微博时间线获取失败，请稍后重试')
+      }
+
+      const rows: WeiboWaterFallItem[] = []
+      for (const card of response.data.cards) {
+        if (card?.mblog) rows.push(card.mblog)
+        if (Array.isArray(card?.card_group)) {
+          for (const subCard of card.card_group) {
+            if (subCard?.mblog) rows.push(subCard.mblog)
+          }
+        }
+      }
+
+      if (rows.length === 0) {
+        throw new Error('该微博账号暂无可读取的近期公开内容')
+      }
+
+      return rows
+    })
+  }
+
+  private fetchDetail(id: string, cookie: string): Promise<WeiboStatusShowResponse> {
+    return requestJson<WeiboStatusShowResponse>(
+      `https://weibo.com/ajax/statuses/show?id=${encodeURIComponent(id)}&isGetLongText=true`,
+      {
+        cookie,
+        referer: `https://weibo.com/detail/${encodeURIComponent(id)}`
+      }
+    ).then((response) => {
+      if (!response || (!response.id && !response.idstr)) {
+        throw new Error('微博详情获取失败')
+      }
+      return response
+    })
+  }
+}
+
+export const weiboService = new WeiboService()

electron/services/videoService.ts

@@ -1,5 +1,6 @@
 import { join } from 'path'
 import { existsSync, readdirSync, statSync, readFileSync, appendFileSync, mkdirSync } from 'fs'
+import { pathToFileURL } from 'url'
 import { app } from 'electron'
 import { ConfigService } from './config'
 import { wcdbService } from './wcdbService'
@@ -22,6 +23,8 @@ interface VideoIndexEntry {
   thumbPath?: string
 }
 
+type PosterFormat = 'dataUrl' | 'fileUrl'
+
 class VideoService {
   private configService: ConfigService
   private hardlinkResolveCache = new Map<string, TimedCacheEntry<string | null>>()
@@ -93,7 +96,7 @@ class VideoService {
    * 获取当前用户的wxid
    */
   private getMyWxid(): string {
-    return this.configService.get('myWxid') || ''
+    return this.configService.getMyWxidCleaned() || ''
   }
 
   /**
@@ -128,6 +131,14 @@ class VideoService {
     if (dbPathContainsWxid) {
       return join(dbPath, 'msg', 'video')
     }
+
+    // 使用 ConfigService 的统一账号目录解析
+    const accountDir = this.configService.getAccountDir(dbPath, wxid)
+    if (accountDir) {
+      return join(accountDir, 'msg', 'video')
+    }
+
+    // 回退到原始逻辑
     return join(dbPath, wxid, 'msg', 'video')
   }
 
@@ -141,6 +152,13 @@ class VideoService {
       return [join(dbPath, 'db_storage', 'hardlink', 'hardlink.db')]
     }
 
+    // 使用 ConfigService 的统一账号目录解析
+    const accountDir = this.configService.getAccountDir(dbPath, wxid)
+    if (accountDir) {
+      return [join(accountDir, 'db_storage', 'hardlink', 'hardlink.db')]
+    }
+
+    // 回退到原始逻辑
     return [
       join(dbPath, wxid, 'db_storage', 'hardlink', 'hardlink.db'),
       join(dbPath, cleanedWxid, 'db_storage', 'hardlink', 'hardlink.db')
@@ -249,19 +267,15 @@ class VideoService {
   }
 
   async preloadVideoHardlinkMd5s(md5List: string[]): Promise<void> {
-    const dbPath = this.getDbPath()
-    const wxid = this.getMyWxid()
-    const cleanedWxid = this.cleanWxid(wxid)
-    if (!dbPath || !wxid) return
-    await this.resolveVideoHardlinks(md5List, dbPath, wxid, cleanedWxid)
+    // 视频链路已改为直接使用 packed_info_data 提取出的文件名索引本地目录。
+    // 该预热接口保留仅为兼容旧调用方，不再查询 hardlink.db。
+    void md5List
   }
 
-  /**
-   * 将文件转换为 data URL
-   */
-  private fileToDataUrl(filePath: string | undefined, mimeType: string): string | undefined {
+  private fileToPosterUrl(filePath: string | undefined, mimeType: string, posterFormat: PosterFormat): string | undefined {
     try {
       if (!filePath || !existsSync(filePath)) return undefined
+      if (posterFormat === 'fileUrl') return pathToFileURL(filePath).toString()
       const buffer = readFileSync(filePath)
       return `data:${mimeType};base64,${buffer.toString('base64')}`
     } catch {
@@ -355,7 +369,12 @@ class VideoService {
     return index
   }
 
-  private getVideoInfoFromIndex(index: Map<string, VideoIndexEntry>, md5: string, includePoster = true): VideoInfo | null {
+  private getVideoInfoFromIndex(
+    index: Map<string, VideoIndexEntry>,
+    md5: string,
+    includePoster = true,
+    posterFormat: PosterFormat = 'dataUrl'
+  ): VideoInfo | null {
     const normalizedMd5 = String(md5 || '').trim().toLowerCase()
     if (!normalizedMd5) return null
 
@@ -379,8 +398,8 @@ class VideoService {
       }
       return {
         videoUrl: entry.videoPath,
-        coverUrl: this.fileToDataUrl(entry.coverPath, 'image/jpeg'),
-        thumbUrl: this.fileToDataUrl(entry.thumbPath, 'image/jpeg'),
+        coverUrl: this.fileToPosterUrl(entry.coverPath, 'image/jpeg', posterFormat),
+        thumbUrl: this.fileToPosterUrl(entry.thumbPath, 'image/jpeg', posterFormat),
         exists: true
       }
     }
@@ -388,7 +407,29 @@ class VideoService {
     return null
   }
 
-  private fallbackScanVideo(videoBaseDir: string, realVideoMd5: string, includePoster = true): VideoInfo | null {
+  private normalizeVideoLookupKey(value: string): string {
+    let text = String(value || '').trim().toLowerCase()
+    if (!text) return ''
+    text = text.replace(/^.*[\\/]/, '')
+    text = text.replace(/\.(?:mp4|mov|m4v|avi|mkv|flv|jpg|jpeg|png|gif|dat)$/i, '')
+    text = text.replace(/_thumb$/, '')
+    const direct = /^([a-f0-9]{16,64})(?:_raw)?$/i.exec(text)
+    if (direct) {
+      const suffix = /_raw$/i.test(text) ? '_raw' : ''
+      return `${direct[1].toLowerCase()}${suffix}`
+    }
+    const preferred32 = /([a-f0-9]{32})(?![a-f0-9])/i.exec(text)
+    if (preferred32?.[1]) return preferred32[1].toLowerCase()
+    const fallback = /([a-f0-9]{16,64})(?![a-f0-9])/i.exec(text)
+    return String(fallback?.[1] || '').toLowerCase()
+  }
+
+  private fallbackScanVideo(
+    videoBaseDir: string,
+    realVideoMd5: string,
+    includePoster = true,
+    posterFormat: PosterFormat = 'dataUrl'
+  ): VideoInfo | null {
     try {
       const yearMonthDirs = readdirSync(videoBaseDir)
         .filter((dir) => {
@@ -416,8 +457,8 @@ class VideoService {
         const thumbPath = join(dirPath, `${baseMd5}_thumb.jpg`)
         return {
           videoUrl: videoPath,
-          coverUrl: this.fileToDataUrl(coverPath, 'image/jpeg'),
-          thumbUrl: this.fileToDataUrl(thumbPath, 'image/jpeg'),
+          coverUrl: this.fileToPosterUrl(coverPath, 'image/jpeg', posterFormat),
+          thumbUrl: this.fileToPosterUrl(thumbPath, 'image/jpeg', posterFormat),
           exists: true
         }
       }
@@ -427,14 +468,21 @@ class VideoService {
     return null
   }
 
+  private async ensurePoster(info: VideoInfo, includePoster: boolean, posterFormat: PosterFormat): Promise<VideoInfo> {
+    void posterFormat
+    if (!includePoster) return info
+    return info
+  }
+
   /**
    * 根据视频MD5获取视频文件信息
    * 视频存放在: {数据库根目录}/{用户wxid}/msg/video/{年月}/
    * 文件命名: {md5}.mp4, {md5}.jpg, {md5}_thumb.jpg
    */
-  async getVideoInfo(videoMd5: string, options?: { includePoster?: boolean }): Promise<VideoInfo> {
+  async getVideoInfo(videoMd5: string, options?: { includePoster?: boolean; posterFormat?: PosterFormat }): Promise<VideoInfo> {
     const normalizedMd5 = String(videoMd5 || '').trim().toLowerCase()
     const includePoster = options?.includePoster !== false
+    const posterFormat: PosterFormat = options?.posterFormat === 'fileUrl' ? 'fileUrl' : 'dataUrl'
     const dbPath = this.getDbPath()
     const wxid = this.getMyWxid()
 
@@ -446,7 +494,7 @@ class VideoService {
     }
 
     const scopeKey = this.getScopeKey(dbPath, wxid)
-    const cacheKey = `${scopeKey}|${normalizedMd5}|poster=${includePoster ? 1 : 0}`
+    const cacheKey = `${scopeKey}|${normalizedMd5}|poster=${includePoster ? 1 : 0}|format=${posterFormat}`
 
     const cachedInfo = this.readTimedCache(this.videoInfoCache, cacheKey)
     if (cachedInfo) return cachedInfo
@@ -455,7 +503,7 @@ class VideoService {
     if (pending) return pending
 
     const task = (async (): Promise<VideoInfo> => {
-      const realVideoMd5 = await this.queryVideoFileName(normalizedMd5) || normalizedMd5
+      const realVideoMd5 = this.normalizeVideoLookupKey(normalizedMd5) || normalizedMd5
       const videoBaseDir = this.resolveVideoBaseDir(dbPath, wxid)
 
       if (!existsSync(videoBaseDir)) {
@@ -465,21 +513,23 @@ class VideoService {
       }
 
       const index = this.getOrBuildVideoIndex(videoBaseDir)
-      const indexed = this.getVideoInfoFromIndex(index, realVideoMd5, includePoster)
+      const indexed = this.getVideoInfoFromIndex(index, realVideoMd5, includePoster, posterFormat)
       if (indexed) {
-        this.writeTimedCache(this.videoInfoCache, cacheKey, indexed, this.videoInfoCacheTtlMs, this.maxCacheEntries)
-        return indexed
+        const withPoster = await this.ensurePoster(indexed, includePoster, posterFormat)
+        this.writeTimedCache(this.videoInfoCache, cacheKey, withPoster, this.videoInfoCacheTtlMs, this.maxCacheEntries)
+        return withPoster
       }
 
-      const fallback = this.fallbackScanVideo(videoBaseDir, realVideoMd5, includePoster)
+      const fallback = this.fallbackScanVideo(videoBaseDir, realVideoMd5, includePoster, posterFormat)
       if (fallback) {
-        this.writeTimedCache(this.videoInfoCache, cacheKey, fallback, this.videoInfoCacheTtlMs, this.maxCacheEntries)
-        return fallback
+        const withPoster = await this.ensurePoster(fallback, includePoster, posterFormat)
+        this.writeTimedCache(this.videoInfoCache, cacheKey, withPoster, this.videoInfoCacheTtlMs, this.maxCacheEntries)
+        return withPoster
       }
 
       const miss = { exists: false }
       this.writeTimedCache(this.videoInfoCache, cacheKey, miss, this.videoInfoCacheTtlMs, this.maxCacheEntries)
-      this.log('getVideoInfo: 未找到视频', { inputMd5: normalizedMd5, resolvedMd5: realVideoMd5 })
+      this.log('getVideoInfo: 未找到视频', { lookupKey: normalizedMd5, normalizedKey: realVideoMd5 })
       return miss
     })()
 

electron/services/voiceTranscribeService.ts

@@ -76,7 +76,7 @@ export class VoiceTranscribeService {
         console.warn(`[VoiceTranscribe] 未找到 ${platformPkg} 目录，可能导致语音引擎加载失败`)
       }
     } else if (process.platform === 'win32') {
-      // Windows: 把 sherpa-onnx DLL 所在目录加到 PATH，否则 native module 找不到依赖
+      // Windows: 把 sherpa-onnx 所在目录加到 PATH，否则 native module 找不到依赖
       const existing = env['PATH'] || ''
       const merged = [...candidates, ...existing.split(';').filter(Boolean)]
       env['PATH'] = Array.from(new Set(merged)).join(';')

electron/services/wcdbService.ts

@@ -25,9 +25,7 @@ export class WcdbService {
   private logEnabled = false
   private monitorListener: ((type: string, json: string) => void) | null = null
 
-  constructor() {
-    this.initWorker()
-  }
+  constructor() {}
 
   /**
    * 初始化 Worker 线程
@@ -80,7 +78,7 @@ export class WcdbService {
         // Worker 退出，需要 reject 所有 pending promises
         if (code !== 0) {
           console.error('WCDB Worker 异常退出，退出码:', code)
-          const errorMsg = `Worker 异常退出 (退出码: ${code})。可能是 DLL 加载失败，请检查是否安装了 Visual C++ Redistributable。`
+          const errorMsg = `Worker 异常退出 (退出码: ${code})。可能是数据服务加载失败，请检查是否安装了 Visual C++ Redistributable。`
           for (const [id, p] of this.pending) {
             p.reject(new Error(errorMsg))
           }
@@ -94,6 +92,9 @@ export class WcdbService {
         this.setPaths(this.resourcesPath, this.userDataPath)
       }
       this.setLogEnabled(this.logEnabled)
+      if (this.monitorListener) {
+        this.callWorker<{ success?: boolean }>('setMonitor').catch(() => { })
+      }
 
     } catch (e) {
       // Failed to create worker
@@ -153,15 +154,17 @@ export class WcdbService {
   /**
    * 测试数据库连接
    */
-  async testConnection(dbPath: string, hexKey: string, wxid: string): Promise<{ success: boolean; error?: string; sessionCount?: number }> {
-    return this.callWorker('testConnection', { dbPath, hexKey, wxid })
+  async testConnection(accountDir: string, hexKey: string): Promise<{ success: boolean; error?: string; sessionCount?: number }> {
+    return this.callWorker('testConnection', { accountDir, hexKey })
   }
 
   /**
    * 打开数据库
+   * @param accountDir 账号目录的完整路径
+   * @param hexKey 解密密钥
    */
-  async open(dbPath: string, hexKey: string, wxid: string): Promise<boolean> {
-    return this.callWorker('open', { dbPath, hexKey, wxid })
+  async open(accountDir: string, hexKey: string): Promise<boolean> {
+    return this.callWorker('open', { accountDir, hexKey })
   }
 
   async getLastInitError(): Promise<string | null> {
@@ -201,6 +204,10 @@ export class WcdbService {
     return this.callWorker('getSessions')
   }
 
+  async markAllSessionsRead(): Promise<{ success: boolean; error?: string }> {
+    return this.callWorker('markAllSessionsRead')
+  }
+
   /**
    * 获取消息列表
    */
@@ -222,6 +229,13 @@ export class WcdbService {
     return this.callWorker('getMessageCount', { sessionId })
   }
 
+  /**
+   * 根据 server_id 查询单条消息
+   */
+  async getMessageByServerId(sessionId: string, svrid: string): Promise<{ success: boolean; row?: any; error?: string }> {
+    return this.callWorker('getMessageByServerId', { sessionId, svrid })
+  }
+
   async getMessageCounts(sessionIds: string[]): Promise<{ success: boolean; counts?: Record<string, number>; error?: string }> {
     return this.callWorker('getMessageCounts', { sessionIds })
   }
@@ -268,6 +282,37 @@ export class WcdbService {
     return this.callWorker('getMessagesByType', { sessionId, localType, ascending, limit, offset })
   }
 
+  async getMediaStream(options?: {
+    sessionId?: string
+    mediaType?: 'image' | 'video' | 'all'
+    beginTimestamp?: number
+    endTimestamp?: number
+    limit?: number
+    offset?: number
+  }): Promise<{
+    success: boolean
+    items?: Array<{
+      sessionId: string
+      sessionDisplayName?: string
+      mediaType: 'image' | 'video'
+      localId: number
+      serverId?: string
+      createTime: number
+      localType: number
+      senderUsername?: string
+      isSend?: number | null
+      imageMd5?: string
+      imageDatName?: string
+      videoMd5?: string
+      content?: string
+    }>
+    hasMore?: boolean
+    nextOffset?: number
+    error?: string
+  }> {
+    return this.callWorker('getMediaStream', { options })
+  }
+
   /**
    * 获取联系人昵称
    */
@@ -337,6 +382,26 @@ export class WcdbService {
     return this.callWorker('getMessageTableColumns', { dbPath, tableName })
   }
 
+  async listTables(kind: string, dbPath: string = ''): Promise<{ success: boolean; tables?: string[]; error?: string }> {
+    return this.callWorker('listTables', { kind, dbPath })
+  }
+
+  async getTableSchema(kind: string, dbPath: string, tableName: string): Promise<{ success: boolean; schema?: string; error?: string }> {
+    return this.callWorker('getTableSchema', { kind, dbPath, tableName })
+  }
+
+  async exportTableSnapshot(kind: string, dbPath: string, tableName: string, outputPath: string): Promise<{ success: boolean; rows?: number; columns?: number; error?: string }> {
+    return this.callWorker('exportTableSnapshot', { kind, dbPath, tableName, outputPath })
+  }
+
+  async importTableSnapshot(kind: string, dbPath: string, tableName: string, inputPath: string): Promise<{ success: boolean; rows?: number; inserted?: number; ignored?: number; malformed?: number; columns?: number; error?: string }> {
+    return this.callWorker('importTableSnapshot', { kind, dbPath, tableName, inputPath })
+  }
+
+  async importTableSnapshotWithSchema(kind: string, dbPath: string, tableName: string, inputPath: string, createTableSql: string): Promise<{ success: boolean; rows?: number; inserted?: number; ignored?: number; malformed?: number; columns?: number; error?: string }> {
+    return this.callWorker('importTableSnapshotWithSchema', { kind, dbPath, tableName, inputPath, createTableSql })
+  }
+
   async getMessageTableTimeRange(dbPath: string, tableName: string): Promise<{ success: boolean; data?: any; error?: string }> {
     return this.callWorker('getMessageTableTimeRange', { dbPath, tableName })
   }
@@ -417,6 +482,19 @@ export class WcdbService {
     return this.callWorker('getGroupStats', { chatroomId, beginTimestamp, endTimestamp })
   }
 
+  async getMyFootprintStats(options: {
+    beginTimestamp?: number
+    endTimestamp?: number
+    myWxid?: string
+    privateSessionIds?: string[]
+    groupSessionIds?: string[]
+    mentionLimit?: number
+    privateLimit?: number
+    mentionMode?: 'text_at_me' | string
+  }): Promise<{ success: boolean; data?: any; error?: string }> {
+    return this.callWorker('getMyFootprintStats', { options })
+  }
+
   /**
    * 打开消息游标
    */
@@ -467,7 +545,7 @@ export class WcdbService {
   }
 
   /**
-   * 获取表情包释义（严格 DLL 接口）
+   * 获取表情包释义（严格数据服务接口）
    */
   async getEmoticonCaptionStrict(md5: string): Promise<{ success: boolean; caption?: string; error?: string }> {
     return this.callWorker('getEmoticonCaptionStrict', { md5 })
@@ -561,6 +639,24 @@ export class WcdbService {
     return this.callWorker('getSnsExportStats', { myWxid })
   }
 
+  async checkMessageAntiRevokeTriggers(
+    sessionIds: string[]
+  ): Promise<{ success: boolean; rows?: Array<{ sessionId: string; success: boolean; installed?: boolean; error?: string }>; error?: string }> {
+    return this.callWorker('checkMessageAntiRevokeTriggers', { sessionIds })
+  }
+
+  async installMessageAntiRevokeTriggers(
+    sessionIds: string[]
+  ): Promise<{ success: boolean; rows?: Array<{ sessionId: string; success: boolean; alreadyInstalled?: boolean; error?: string }>; error?: string }> {
+    return this.callWorker('installMessageAntiRevokeTriggers', { sessionIds })
+  }
+
+  async uninstallMessageAntiRevokeTriggers(
+    sessionIds: string[]
+  ): Promise<{ success: boolean; rows?: Array<{ sessionId: string; success: boolean; error?: string }>; error?: string }> {
+    return this.callWorker('uninstallMessageAntiRevokeTriggers', { sessionIds })
+  }
+
   /**
    * 安装朋友圈删除拦截
    */
@@ -590,7 +686,7 @@ export class WcdbService {
   }
 
   /**
-   * 获取 DLL 内部日志
+   * 获取数据服务内部日志
    */
   async getLogs(): Promise<{ success: boolean; logs?: string[]; error?: string }> {
     return this.callWorker('getLogs')

electron/utils/pathUtils.ts

@@ -0,0 +1,20 @@
+import { homedir } from 'os'
+
+/**
+ * Expand "~" prefix to current user's home directory.
+ * Examples:
+ * - "~" => "/Users/alex"
+ * - "~/Library/..." => "/Users/alex/Library/..."
+ */
+export function expandHomePath(inputPath: string): string {
+  const raw = String(inputPath || '').trim()
+  if (!raw) return raw
+
+  if (raw === '~') return homedir()
+  if (/^~[\\/]/.test(raw)) {
+    return `${homedir()}${raw.slice(1)}`
+  }
+
+  return raw
+}
+

electron/wcdbWorker.ts

@@ -32,10 +32,10 @@ if (parentPort) {
                     break
                     }
                 case 'testConnection':
-                    result = await core.testConnection(payload.dbPath, payload.hexKey, payload.wxid)
+                    result = await core.testConnection(payload.accountDir, payload.hexKey)
                     break
                 case 'open':
-                    result = await core.open(payload.dbPath, payload.hexKey, payload.wxid)
+                    result = await core.open(payload.accountDir, payload.hexKey)
                     break
                 case 'getLastInitError':
                     result = core.getLastInitError()
@@ -50,6 +50,9 @@ if (parentPort) {
                 case 'getSessions':
                     result = await core.getSessions()
                     break
+                case 'markAllSessionsRead':
+                    result = await core.markAllSessionsRead()
+                    break
                 case 'getMessages':
                     result = await core.getMessages(payload.sessionId, payload.limit, payload.offset)
                     break
@@ -59,6 +62,9 @@ if (parentPort) {
                 case 'getMessageCount':
                     result = await core.getMessageCount(payload.sessionId)
                     break
+                case 'getMessageByServerId':
+                    result = await core.getMessageByServerId(payload.sessionId, payload.svrid)
+                    break
                 case 'getMessageCounts':
                     result = await core.getMessageCounts(payload.sessionIds)
                     break
@@ -80,6 +86,9 @@ if (parentPort) {
                 case 'getMessagesByType':
                     result = await core.getMessagesByType(payload.sessionId, payload.localType, payload.ascending, payload.limit, payload.offset)
                     break
+                case 'getMediaStream':
+                    result = await core.getMediaStream(payload.options)
+                    break
                 case 'getDisplayNames':
                     result = await core.getDisplayNames(payload.usernames)
                     break
@@ -113,6 +122,21 @@ if (parentPort) {
                 case 'getMessageTableColumns':
                     result = await core.getMessageTableColumns(payload.dbPath, payload.tableName)
                     break
+                case 'listTables':
+                    result = await core.listTables(payload.kind, payload.dbPath)
+                    break
+                case 'getTableSchema':
+                    result = await core.getTableSchema(payload.kind, payload.dbPath, payload.tableName)
+                    break
+                case 'exportTableSnapshot':
+                    result = await core.exportTableSnapshot(payload.kind, payload.dbPath, payload.tableName, payload.outputPath)
+                    break
+                case 'importTableSnapshot':
+                    result = await core.importTableSnapshot(payload.kind, payload.dbPath, payload.tableName, payload.inputPath)
+                    break
+                case 'importTableSnapshotWithSchema':
+                    result = await core.importTableSnapshotWithSchema(payload.kind, payload.dbPath, payload.tableName, payload.inputPath, payload.createTableSql)
+                    break
                 case 'getMessageTableTimeRange':
                     result = await core.getMessageTableTimeRange(payload.dbPath, payload.tableName)
                     break
@@ -155,6 +179,9 @@ if (parentPort) {
                 case 'getGroupStats':
                     result = await core.getGroupStats(payload.chatroomId, payload.beginTimestamp, payload.endTimestamp)
                     break
+                case 'getMyFootprintStats':
+                    result = await core.getMyFootprintStats(payload.options || {})
+                    break
                 case 'openMessageCursor':
                     result = await core.openMessageCursor(payload.sessionId, payload.batchSize, payload.ascending, payload.beginTimestamp, payload.endTimestamp)
                     break
@@ -230,6 +257,15 @@ if (parentPort) {
                 case 'getSnsExportStats':
                     result = await core.getSnsExportStats(payload.myWxid)
                     break
+                case 'checkMessageAntiRevokeTriggers':
+                    result = await core.checkMessageAntiRevokeTriggers(payload.sessionIds)
+                    break
+                case 'installMessageAntiRevokeTriggers':
+                    result = await core.installMessageAntiRevokeTriggers(payload.sessionIds)
+                    break
+                case 'uninstallMessageAntiRevokeTriggers':
+                    result = await core.uninstallMessageAntiRevokeTriggers(payload.sessionIds)
+                    break
                 case 'installSnsBlockDeleteTrigger':
                     result = await core.installSnsBlockDeleteTrigger()
                     break

electron/windows/notificationWindow.ts

@@ -1,224 +1,354 @@
-import { BrowserWindow, ipcMain, screen } from 'electron'
-import { join } from 'path'
-import { ConfigService } from '../services/config'
+import { BrowserWindow, ipcMain, screen } from "electron";
+import { join } from "path";
+import { ConfigService } from "../services/config";
 
-let notificationWindow: BrowserWindow | null = null
-let closeTimer: NodeJS.Timeout | null = null
+// Linux D-Bus通知服务
+const isLinux = process.platform === "linux";
+let linuxNotificationService:
+  | typeof import("../services/linuxNotificationService")
+  | null = null;
+
+// 用于处理通知点击的回调函数（在Linux上用于导航到会话）
+let onNotificationNavigate: ((payload: unknown) => void) | null = null;
+
+export function setNotificationNavigateHandler(
+  callback: (payload: unknown) => void,
+) {
+  onNotificationNavigate = callback;
+}
+
+let notificationWindow: BrowserWindow | null = null;
+let closeTimer: NodeJS.Timeout | null = null;
 
 export function destroyNotificationWindow() {
-    if (closeTimer) {
-        clearTimeout(closeTimer)
-        closeTimer = null
-    }
-    lastNotificationData = null
+  if (closeTimer) {
+    clearTimeout(closeTimer);
+    closeTimer = null;
+  }
+  lastNotificationData = null;
 
-    if (!notificationWindow || notificationWindow.isDestroyed()) {
-        notificationWindow = null
-        return
-    }
+  // Linux:关闭通知服务并清理缓存（fire-and-forget，不阻塞退出）
+  if (isLinux && linuxNotificationService) {
+    linuxNotificationService.shutdownLinuxNotificationService().catch((error) => {
+      console.warn("[NotificationWindow] Failed to shutdown Linux notification service:", error);
+    });
+    linuxNotificationService = null;
+  }
 
-    const win = notificationWindow
-    notificationWindow = null
+  if (!notificationWindow || notificationWindow.isDestroyed()) {
+    notificationWindow = null;
+    return;
+  }
 
-    try {
-        win.destroy()
-    } catch (error) {
-        console.warn('[NotificationWindow] Failed to destroy window:', error)
-    }
+  const win = notificationWindow;
+  notificationWindow = null;
+
+  try {
+    win.destroy();
+  } catch (error) {
+    console.warn("[NotificationWindow] Failed to destroy window:", error);
+  }
 }
 
 export function createNotificationWindow() {
-    if (notificationWindow && !notificationWindow.isDestroyed()) {
-        return notificationWindow
-    }
+  if (notificationWindow && !notificationWindow.isDestroyed()) {
+    return notificationWindow;
+  }
 
-    const isDev = !!process.env.VITE_DEV_SERVER_URL
-    const iconPath = isDev
-        ? join(__dirname, '../../public/icon.ico')
-        : join(process.resourcesPath, 'icon.ico')
+  const isDev = !!process.env.VITE_DEV_SERVER_URL;
+  const iconPath = isDev
+    ? join(__dirname, "../../public/icon.ico")
+    : join(process.resourcesPath, "icon.ico");
 
-    console.log('[NotificationWindow] Creating window...')
-    const width = 344
-    const height = 114
+  console.log("[NotificationWindow] Creating window...");
+  const width = 344;
+  const height = 114;
 
-    // Update default creation size
-    notificationWindow = new BrowserWindow({
-        width: width,
-        height: height,
-        type: 'toolbar', // 有助于在某些操作系统上保持置顶
-        frame: false,
-        transparent: true,
-        resizable: false,
-        show: false,
-        alwaysOnTop: true,
-        skipTaskbar: true,
-        focusable: false, // 不抢占焦点
-        icon: iconPath,
-        webPreferences: {
-            preload: join(__dirname, 'preload.js'), // FIX: Use correct relative path (same dir in dist)
-            contextIsolation: true,
-            nodeIntegration: false,
-            // devTools: true // Enable DevTools
-        }
-    })
+  // Update default creation size
+  notificationWindow = new BrowserWindow({
+    width: width,
+    height: height,
+    type: "toolbar", // 有助于在某些操作系统上保持置顶
+    frame: false,
+    transparent: true,
+    resizable: false,
+    show: false,
+    alwaysOnTop: true,
+    skipTaskbar: true,
+    focusable: false, // 不抢占焦点
+    icon: iconPath,
+    webPreferences: {
+      preload: join(__dirname, "preload.js"), // FIX: Use correct relative path (same dir in dist)
+      contextIsolation: true,
+      nodeIntegration: false,
+      // devTools: true // Enable DevTools
+    },
+  });
 
-    // notificationWindow.webContents.openDevTools({ mode: 'detach' }) // DEBUG: Force Open DevTools
-    notificationWindow.setIgnoreMouseEvents(true, { forward: true }) // 初始点击穿透
+  // notificationWindow.webContents.openDevTools({ mode: 'detach' }) // DEBUG: Force Open DevTools
+  notificationWindow.setIgnoreMouseEvents(true, { forward: true }); // 初始点击穿透
 
-    // 处理鼠标事件 (如果需要从渲染进程转发，但目前特定区域处理?)
-    // 实际上，我们希望窗口可点击。
-    // 我们将在显示时将忽略鼠标事件设为 false。
+  // 处理鼠标事件 (如果需要从渲染进程转发，但目前特定区域处理?)
+  // 实际上，我们希望窗口可点击。
+  // 我们将在显示时将忽略鼠标事件设为 false。
 
-    const loadUrl = isDev
-        ? `${process.env.VITE_DEV_SERVER_URL}#/notification-window`
-        : `file://${join(__dirname, '../dist/index.html')}#/notification-window`
+  const loadUrl = isDev
+    ? `${process.env.VITE_DEV_SERVER_URL}#/notification-window`
+    : `file://${join(__dirname, "../dist/index.html")}#/notification-window`;
 
-    console.log('[NotificationWindow] Loading URL:', loadUrl)
-    notificationWindow.loadURL(loadUrl)
+  console.log("[NotificationWindow] Loading URL:", loadUrl);
+  notificationWindow.loadURL(loadUrl);
 
-    notificationWindow.on('closed', () => {
-        notificationWindow = null
-    })
+  notificationWindow.on("closed", () => {
+    notificationWindow = null;
+  });
 
-    return notificationWindow
+  return notificationWindow;
 }
 
 export async function showNotification(data: any) {
-    // 先检查配置
-    const config = ConfigService.getInstance()
-    const enabled = await config.get('notificationEnabled')
-    if (enabled === false) return // 默认为 true
+  // 先检查配置
+  const config = ConfigService.getInstance();
+  const sessionId = typeof data.sessionId === "string" ? data.sessionId : "";
+  const channel = typeof data.channel === "string" ? data.channel : "";
+  const isAiInsightNotification = channel === "ai-insight";
+
+  if (isAiInsightNotification) {
+    const enabled = await config.get("aiInsightNotificationEnabled");
+    if (enabled === false) return; // 默认为 true
+  } else {
+    const enabled = await config.get("notificationEnabled");
+    if (enabled === false) return; // 默认为 true
 
     // 检查会话过滤
-    const filterMode = config.get('notificationFilterMode') || 'all'
-    const filterList = config.get('notificationFilterList') || []
-    const sessionId = data.sessionId
+    const filterMode = config.get("notificationFilterMode") || "all";
+    const filterList = config.get("notificationFilterList") || [];
+    // 系统通知（如 "WeFlow 准备就绪"）不是聊天消息，不应受会话白/黑名单影响
+    const isSystemNotification = sessionId.startsWith("weflow-");
 
-    if (sessionId && filterMode !== 'all' && filterList.length > 0) {
-        const isInList = filterList.includes(sessionId)
-        if (filterMode === 'whitelist' && !isInList) {
-            // 白名单模式：不在列表中则不显示
-            return
-        }
-        if (filterMode === 'blacklist' && isInList) {
-            // 黑名单模式：在列表中则不显示
-            return
-        }
+    if (!isSystemNotification && filterMode !== "all") {
+      const isInList = sessionId !== "" && filterList.includes(sessionId);
+      if (filterMode === "whitelist" && !isInList) {
+        // 白名单模式：不在列表中则不显示（空列表视为全部拦截）
+        return;
+      }
+      if (filterMode === "blacklist" && isInList) {
+        // 黑名单模式：在列表中则不显示
+        return;
+      }
     }
+  }
 
-    let win = notificationWindow
-    if (!win || win.isDestroyed()) {
-        win = createNotificationWindow()
-    }
+  // Linux 使用 D-Bus 通知
+  if (isLinux) {
+    await showLinuxNotification(data);
+    return;
+  }
 
-    if (!win) return
+  let win = notificationWindow;
+  if (!win || win.isDestroyed()) {
+    win = createNotificationWindow();
+  }
 
-    // 确保加载完成
-    if (win.webContents.isLoading()) {
-        win.once('ready-to-show', () => {
-            showAndSend(win!, data)
-        })
-    } else {
-        showAndSend(win, data)
-    }
+  if (!win) return;
+
+  // 确保加载完成
+  if (win.webContents.isLoading()) {
+    win.once("ready-to-show", () => {
+      showAndSend(win!, data);
+    });
+  } else {
+    showAndSend(win, data);
+  }
 }
 
-let lastNotificationData: any = null
+// 显示Linux通知
+async function showLinuxNotification(data: any) {
+  if (!linuxNotificationService) {
+    try {
+      linuxNotificationService =
+        await import("../services/linuxNotificationService");
+    } catch (error) {
+      console.error(
+        "[NotificationWindow] Failed to load Linux notification service:",
+        error,
+      );
+      return;
+    }
+  }
+
+  const { showLinuxNotification: showNotification } = linuxNotificationService;
+
+  const notificationData = {
+    title: data.title,
+    content: data.content,
+    avatarUrl: data.avatarUrl,
+    sessionId: data.sessionId,
+    channel: data.channel,
+    insightRecordId: data.insightRecordId,
+    targetRoute: data.targetRoute,
+    expireTimeout: 5000,
+  };
+
+  showNotification(notificationData);
+}
+
+let lastNotificationData: any = null;
 
 async function showAndSend(win: BrowserWindow, data: any) {
-    lastNotificationData = data
-    const config = ConfigService.getInstance()
-    const position = (await config.get('notificationPosition')) || 'top-right'
+  lastNotificationData = data;
+  const config = ConfigService.getInstance();
+  const position = (await config.get("notificationPosition")) || "top-right";
 
-    // 更新位置
-    const { width: screenWidth, height: screenHeight } = screen.getPrimaryDisplay().workAreaSize
-    const winWidth = position === 'top-center' ? 280 : 344
-    const winHeight = 114
-    const padding = 20
+  // 更新位置
+  const { width: screenWidth, height: screenHeight } =
+    screen.getPrimaryDisplay().workAreaSize;
+  const winWidth = position === "top-center" ? 280 : 344;
+  const winHeight = 114;
+  const padding = 20;
 
-    let x = 0
-    let y = 0
+  let x = 0;
+  let y = 0;
 
-    switch (position) {
-        case 'top-center':
-            x = (screenWidth - winWidth) / 2
-            y = padding
-            break
-        case 'top-right':
-            x = screenWidth - winWidth - padding
-            y = padding
-            break
-        case 'bottom-right':
-            x = screenWidth - winWidth - padding
-            y = screenHeight - winHeight - padding
-            break
-        case 'top-left':
-            x = padding
-            y = padding
-            break
-        case 'bottom-left':
-            x = padding
-            y = screenHeight - winHeight - padding
-            break
+  switch (position) {
+    case "top-center":
+      x = (screenWidth - winWidth) / 2;
+      y = padding;
+      break;
+    case "top-right":
+      x = screenWidth - winWidth - padding;
+      y = padding;
+      break;
+    case "bottom-right":
+      x = screenWidth - winWidth - padding;
+      y = screenHeight - winHeight - padding;
+      break;
+    case "top-left":
+      x = padding;
+      y = padding;
+      break;
+    case "bottom-left":
+      x = padding;
+      y = screenHeight - winHeight - padding;
+      break;
+  }
+
+  win.setPosition(Math.floor(x), Math.floor(y));
+  win.setSize(winWidth, winHeight); // 确保尺寸
+
+  // 设为可交互
+  win.setIgnoreMouseEvents(false);
+  win.showInactive(); // 显示但不聚焦
+  win.setAlwaysOnTop(true, "screen-saver"); // 最高层级
+
+  win.webContents.send("notification:show", { ...data, position });
+
+  // 自动关闭计时器通常由渲染进程管理
+  // 渲染进程发送 'notification:close' 来隐藏窗口
+}
+
+// 注册通知处理
+export async function registerNotificationHandlers() {
+  // Linux: 初始化D-Bus服务
+  if (isLinux) {
+    try {
+      const linuxNotificationModule =
+        await import("../services/linuxNotificationService");
+      linuxNotificationService = linuxNotificationModule;
+
+      // 初始化服务
+      await linuxNotificationModule.initLinuxNotificationService();
+
+      // 在Linux上注册通知点击回调
+      linuxNotificationModule.onNotificationAction((payload: unknown) => {
+        console.log(
+          "[NotificationWindow] Linux notification clicked, sessionId:",
+          payload,
+        );
+        // 如果设置了导航处理程序，则使用该处理程序；否则，回退到ipcMain方法。
+        if (onNotificationNavigate) {
+          onNotificationNavigate(payload);
+        } else {
+          // 如果尚未设置处理程序，则通过ipcMain发出事件
+          // 正常流程中不应该发生这种情况，因为我们在初始化之前设置了处理程序。
+          console.warn(
+            "[NotificationWindow] onNotificationNavigate not set yet",
+          );
+        }
+      });
+
+      console.log(
+        "[NotificationWindow] Linux notification service initialized",
+      );
+    } catch (error) {
+      console.error(
+        "[NotificationWindow] Failed to initialize Linux notification service:",
+        error,
+      );
     }
+  }
 
-    win.setPosition(Math.floor(x), Math.floor(y))
-    win.setSize(winWidth, winHeight) // 确保尺寸
+  ipcMain.handle("notification:show", (_, data) => {
+    showNotification(data);
+  });
 
-    // 设为可交互
-    win.setIgnoreMouseEvents(false)
-    win.showInactive() // 显示但不聚焦
-    win.setAlwaysOnTop(true, 'screen-saver') // 最高层级
+  ipcMain.handle("notification:close", () => {
+    if (isLinux && linuxNotificationService) {
+      // 注册通知点击回调函数。Linux通知通过D-Bus自动关闭，但我们可以根据需要进行跟踪
+      return;
+    }
+    if (notificationWindow && !notificationWindow.isDestroyed()) {
+      notificationWindow.hide();
+      notificationWindow.setIgnoreMouseEvents(true, { forward: true });
+    }
+  });
 
-    win.webContents.send('notification:show', { ...data, position })
+  // Handle renderer ready event (fix race condition)
+  ipcMain.on("notification:ready", (event) => {
+    if (isLinux) {
+      // Linux不需要通知窗口，拦截通知窗口渲染
+      return;
+    }
+    console.log("[NotificationWindow] Renderer ready, checking cached data");
+    if (
+      lastNotificationData &&
+      notificationWindow &&
+      !notificationWindow.isDestroyed()
+    ) {
+      console.log("[NotificationWindow] Re-sending cached data");
+      notificationWindow.webContents.send(
+        "notification:show",
+        lastNotificationData,
+      );
+    }
+  });
 
-    // 自动关闭计时器通常由渲染进程管理
-    // 渲染进程发送 'notification:close' 来隐藏窗口
-}
-
-export function registerNotificationHandlers() {
-    ipcMain.handle('notification:show', (_, data) => {
-        showNotification(data)
-    })
-
-    ipcMain.handle('notification:close', () => {
-        if (notificationWindow && !notificationWindow.isDestroyed()) {
-            notificationWindow.hide()
-            notificationWindow.setIgnoreMouseEvents(true, { forward: true })
-        }
-    })
-
-    // Handle renderer ready event (fix race condition)
-    ipcMain.on('notification:ready', (event) => {
-        console.log('[NotificationWindow] Renderer ready, checking cached data')
-        if (lastNotificationData && notificationWindow && !notificationWindow.isDestroyed()) {
-            console.log('[NotificationWindow] Re-sending cached data')
-            notificationWindow.webContents.send('notification:show', lastNotificationData)
-        }
-    })
-
-    // Handle resize request from renderer
-    ipcMain.on('notification:resize', (event, { width, height }) => {
-        if (notificationWindow && !notificationWindow.isDestroyed()) {
-            // Enforce max-height if needed, or trust renderer
-            // Ensure it doesn't go off screen bottom? 
-            // Logic in showAndSend handles position, but we need to keep anchor point (top-right usually).
-            // If we resize, we should re-calculate position to keep it anchored?
-            // Actually, setSize changes size. If it's top-right, x/y stays same -> window grows down. That's fine for top-right.
-            // If bottom-right, growing down pushes it off screen.
-
-            // Simple version: just setSize. For V1 we assume Top-Right.
-            // But wait, the config supports bottom-right.
-            // We can re-call setPosition or just let it be.
-            // If bottom-right, y needs to prevent overflow.
-
-            // Ideally we get current config position
-            const bounds = notificationWindow.getBounds()
-            // Check if we need to adjust Y?
-            // For now, let's just set the size as requested.
-            notificationWindow.setSize(Math.round(width), Math.round(height))
-        }
-    })
-
-    // 'notification-clicked' 在 main.ts 中处理 (导航)
+  // Handle resize request from renderer
+  ipcMain.on("notification:resize", (event, { width, height }) => {
+    if (isLinux) {
+      // Linux 通知通过D-Bus自动调整大小
+      return;
+    }
+    if (notificationWindow && !notificationWindow.isDestroyed()) {
+      // Enforce max-height if needed, or trust renderer
+      // Ensure it doesn't go off screen bottom?
+      // Logic in showAndSend handles position, but we need to keep anchor point (top-right usually).
+      // If we resize, we should re-calculate position to keep it anchored?
+      // Actually, setSize changes size. If it's top-right, x/y stays same -> window grows down. That's fine for top-right.
+      // If bottom-right, growing down pushes it off screen.
+
+      // Simple version: just setSize. For V1 we assume Top-Right.
+      // But wait, the config supports bottom-right.
+      // We can re-call setPosition or just let it be.
+      // If bottom-right, y needs to prevent overflow.
+
+      // Ideally we get current config position
+      const bounds = notificationWindow.getBounds();
+      // Check if we need to adjust Y?
+      // For now, let's just set the size as requested.
+      notificationWindow.setSize(Math.round(width), Math.round(height));
+    }
+  });
+
+  // 'notification-clicked' 在 main.ts 中处理 (导航)
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "weflow",
-  "version": "2.1.0",
+  "version": "4.3.0",
   "description": "WeFlow",
   "main": "dist-electron/main.js",
   "author": {
@@ -13,19 +13,20 @@
   },
   "//": "二改不应改变此处的作者与应用信息",
   "scripts": {
-    "postinstall": "electron-builder install-app-deps",
+    "postinstall": "electron-builder install-app-deps && node scripts/prepare-electron-runtime.cjs",
     "rebuild": "electron-rebuild",
-    "dev": "vite",
+    "dev": "node scripts/prepare-electron-runtime.cjs && vite",
     "typecheck": "tsc --noEmit",
     "build": "tsc && vite build && electron-builder",
     "preview": "vite preview",
-    "electron:dev": "vite --mode electron",
+    "electron:dev": "node scripts/prepare-electron-runtime.cjs && vite --mode electron",
     "electron:build": "npm run build"
   },
   "dependencies": {
-    "echarts": "^5.5.1",
+    "@vscode/sudo-prompt": "^9.3.2",
+    "echarts": "^6.0.0",
     "echarts-for-react": "^3.0.2",
-    "electron-store": "^10.0.0",
+    "electron-store": "^11.0.2",
     "electron-updater": "^6.3.9",
     "exceljs": "^4.4.0",
     "ffmpeg-static": "^5.3.0",
@@ -34,16 +35,15 @@
     "jieba-wasm": "^2.2.0",
     "jszip": "^3.10.1",
     "koffi": "^2.9.0",
-    "lucide-react": "^0.562.0",
+    "lucide-react": "^1.8.0",
     "react": "^19.2.3",
     "react-dom": "^19.2.3",
     "react-markdown": "^10.1.0",
-    "react-router-dom": "^7.1.1",
-    "react-virtuoso": "^4.18.1",
+    "react-router-dom": "^7.14.0",
+    "react-virtuoso": "^4.18.5",
     "remark-gfm": "^4.0.1",
     "sherpa-onnx-node": "^1.10.38",
     "silk-wasm": "^3.7.1",
-    "sudo-prompt": "^9.2.1",
     "wechat-emojis": "^1.0.2",
     "zustand": "^5.0.2"
   },
@@ -51,16 +51,29 @@
     "@electron/rebuild": "^4.0.2",
     "@types/react": "^19.1.0",
     "@types/react-dom": "^19.1.0",
-    "@vitejs/plugin-react": "^4.3.4",
-    "electron": "^39.2.7",
-    "electron-builder": "^25.1.8",
-    "sass": "^1.83.0",
+    "@vitejs/plugin-react": "^6.0.1",
+    "electron": "^41.1.1",
+    "electron-builder": "^26.8.1",
+    "esbuild": "^0.28.0",
+    "sass": "^1.98.0",
     "sharp": "^0.34.5",
-    "typescript": "^5.6.3",
-    "vite": "^6.0.5",
+    "typescript": "^6.0.3",
+    "vite": "^8.0.10",
     "vite-plugin-electron": "^0.28.8",
     "vite-plugin-electron-renderer": "^0.14.6"
   },
+  "pnpm": {
+    "overrides": {
+      "tar": ">=6.2.1",
+      "minimatch": ">=3.1.2",
+      "rollup": ">=4.0.0",
+      "immutable": ">=4.0.0",
+      "lodash": ">=4.17.21",
+      "brace-expansion": ">=1.1.11",
+      "picomatch": ">=2.3.1",
+      "ajv": ">=8.18.0"
+    }
+  },
   "build": {
     "appId": "com.WeFlow.app",
     "publish": {
@@ -84,13 +97,31 @@
       "gatekeeperAssess": false,
       "entitlements": "electron/entitlements.mac.plist",
       "entitlementsInherit": "electron/entitlements.mac.plist",
-      "icon": "resources/icon.icns"
+      "icon": "resources/icons/macos/icon.icns"
     },
     "win": {
       "target": [
         "nsis"
       ],
-      "icon": "public/icon.ico"
+      "icon": "public/icon.ico",
+      "extraFiles": [
+        {
+          "from": "resources/runtime/win32/msvcp140.dll",
+          "to": "."
+        },
+        {
+          "from": "resources/runtime/win32/msvcp140_1.dll",
+          "to": "."
+        },
+        {
+          "from": "resources/runtime/win32/vcruntime140.dll",
+          "to": "."
+        },
+        {
+          "from": "resources/runtime/win32/vcruntime140_1.dll",
+          "to": "."
+        }
+      ]
     },
     "linux": {
       "icon": "public/icon.png",
@@ -103,7 +134,7 @@
       "synopsis": "WeFlow for Linux",
       "extraFiles": [
         {
-          "from": "resources/linux/install.sh",
+          "from": "resources/installer/linux/install.sh",
           "to": "install.sh"
         }
       ]
@@ -156,26 +187,14 @@
       "node_modules/sherpa-onnx-node/**/*",
       "node_modules/sherpa-onnx-*/*",
       "node_modules/sherpa-onnx-*/**/*",
-      "node_modules/ffmpeg-static/**/*"
+      "node_modules/ffmpeg-static/**/*",
+      "resources/wedecrypt/**/*.node"
     ],
-    "extraFiles": [
-      {
-        "from": "resources/msvcp140.dll",
-        "to": "."
-      },
-      {
-        "from": "resources/msvcp140_1.dll",
-        "to": "."
-      },
-      {
-        "from": "resources/vcruntime140.dll",
-        "to": "."
-      },
-      {
-        "from": "resources/vcruntime140_1.dll",
-        "to": "."
-      }
-    ],
-    "icon": "resources/icon.icns"
+    "icon": "resources/icons/macos/icon.icns"
+  },
+  "overrides": {
+    "picomatch": "^4.0.4",
+    "tar": "^7.5.13",
+    "immutable": "^5.1.5"
   }
 }

public/splash.html

@@ -4,246 +4,478 @@
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>WeFlow</title>
-  <style>
-    * { margin: 0; padding: 0; box-sizing: border-box; }
+  <script>
+    (function initSplashMode() {
+      var params = new URLSearchParams(window.location.search || "");
+      var mode = params.get("themeMode") || params.get("mode") || "system";
+      var themeId = params.get("themeId") || "cloud-dancer";
+      var mq = window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)");
+      var resolved = mode === "dark" || (mode === "system" && mq && mq.matches) ? "dark" : "light";
 
-    html, body {
-      width: 100%; height: 100%;
-      background: transparent;
+      document.documentElement.setAttribute("data-theme", themeId);
+      document.documentElement.setAttribute("data-theme-mode", mode);
+      document.documentElement.setAttribute("data-mode", resolved);
+    })();
+  </script>
+  <style>
+    :root {
+      --surface-start: #ffffff;
+      --surface-end: #f8f9fc;
+      --accent: #5b6abf;
+      --accent-rgb: 91, 106, 191;
+      --ambient-glow: rgba(91, 106, 191, 0.08);
+      --text: #1a1b1e;
+      --text-muted: #5f6368;
+      --text-faint: #9aa0a6;
+      --border-subtle: rgba(0, 0, 0, 0.05);
+      --loader-track: rgba(0, 0, 0, 0.06);
+      --shadow-window:
+        0 24px 60px rgba(23, 27, 38, 0.10),
+        0 4px 12px rgba(23, 27, 38, 0.04),
+        inset 0 1px 0 rgba(255, 255, 255, 1);
+      --radius-window: 24px;
+      --ease-ambient: cubic-bezier(0.2, 0.8, 0.2, 1);
+      --font: Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", "Microsoft YaHei", sans-serif;
+    }
+
+    [data-mode="dark"] {
+      --surface-start: #14171d;
+      --surface-end: #0b0d10;
+      --accent: #7c8deb;
+      --accent-rgb: 124, 141, 235;
+      --ambient-glow: rgba(124, 141, 235, 0.08);
+      --text: #f0f0f0;
+      --text-muted: #8b92a5;
+      --text-faint: #4e5569;
+      --border-subtle: rgba(255, 255, 255, 0.06);
+      --loader-track: rgba(255, 255, 255, 0.09);
+      --shadow-window:
+        0 24px 80px rgba(0, 0, 0, 0.60),
+        inset 0 1px 0 rgba(255, 255, 255, 0.05);
+      --radius-window: 20px;
+    }
+
+    * {
+      box-sizing: border-box;
+      margin: 0;
+      padding: 0;
+    }
+
+    html,
+    body {
+      width: 100%;
+      height: 100%;
       overflow: hidden;
-      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Microsoft YaHei', sans-serif;
+      background: transparent;
+      color: var(--text);
+      font-family: var(--font);
+      -webkit-font-smoothing: antialiased;
       user-select: none;
+    }
+
+    body {
+      display: grid;
+      place-items: center;
       -webkit-app-region: drag;
     }
 
-    .splash {
-      width: 100%; height: 100%;
-      border-radius: 20px;
+    .splash-shell {
+      width: 600px;
+      height: 380px;
+      max-width: calc(100vw - 64px);
+      max-height: calc(100vh - 64px);
+      position: relative;
       display: flex;
       flex-direction: column;
+      align-items: center;
+      justify-content: center;
+      overflow: hidden;
+      border-radius: var(--radius-window);
+      border: 1px solid var(--border-subtle);
+      background: linear-gradient(145deg, var(--surface-start), var(--surface-end));
+      box-shadow: var(--shadow-window);
+      isolation: isolate;
+      animation: windowAppear 800ms var(--ease-ambient) both;
     }
 
-    /* 品牌区 */
-    .brand {
-      padding: 48px 52px 0;
+    .splash-shell::before {
+      content: "";
+      position: absolute;
+      width: 200%;
+      height: 200%;
+      left: -50%;
+      top: -50%;
+      background: radial-gradient(circle at 50% 40%, var(--ambient-glow) 0%, transparent 44%);
+      pointer-events: none;
+      z-index: -1;
+    }
+
+    .brand-stage {
+      position: relative;
+      z-index: 2;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      margin-top: -20px;
+      text-align: center;
+      animation: contentIn 560ms var(--ease-ambient) 90ms both;
+    }
+
+    .logo-core {
+      width: 64px;
+      height: 64px;
+      display: grid;
+      place-items: center;
+      margin-bottom: 24px;
+      background: transparent;
+      border: 0;
+    }
+
+    .logo-image {
+      width: 64px;
+      height: 64px;
+      display: block;
+      object-fit: contain;
+      border-radius: 20px;
+      animation: logoBreathe 3200ms ease-in-out infinite alternate;
+    }
+
+    .app-name {
+      font-size: 24px;
+      line-height: 1.18;
+      font-weight: 600;
+      letter-spacing: 0.02em;
+      color: var(--text);
+      margin-bottom: 6px;
+    }
+
+    [data-mode="dark"] .app-name {
+      text-shadow: 0 2px 10px rgba(0, 0, 0, 0.50);
+    }
+
+    .app-desc {
+      font-size: 13px;
+      line-height: 1.5;
+      font-weight: 500;
+      letter-spacing: 0.04em;
+      color: var(--text-muted);
+    }
+
+    [data-mode="dark"] .app-desc {
+      font-weight: 400;
+      letter-spacing: 0.05em;
+    }
+
+    .status-row {
+      position: absolute;
+      left: 32px;
+      right: 32px;
+      bottom: 24px;
+      z-index: 2;
+      display: flex;
+      align-items: flex-end;
+      justify-content: space-between;
+      gap: 18px;
+      color: var(--text-faint);
+      font-size: 11px;
+      line-height: 1.4;
+      font-variant-numeric: tabular-nums;
+      animation: contentIn 560ms var(--ease-ambient) 170ms both;
+    }
+
+    .progress-text-wrap {
+      min-width: 0;
       display: flex;
       align-items: center;
-      gap: 18px;
-      animation: fadeIn 0.4s ease both;
+      gap: 6px;
+      color: var(--text-muted);
+      font-weight: 500;
     }
-    .logo {
-      width: 56px; height: 56px;
-      border-radius: 14px;
+
+    [data-mode="dark"] .progress-text-wrap {
+      color: var(--text-faint);
+      font-weight: 400;
+    }
+
+    .status-dot {
+      width: 4px;
+      height: 4px;
+      flex: 0 0 auto;
+      border-radius: 50%;
+      background: var(--accent);
+      box-shadow: 0 0 6px rgba(var(--accent-rgb), 0.42);
+      animation: dotPulse 1700ms ease-in-out infinite;
+    }
+
+    .progress-text {
+      min-width: 0;
+      overflow: hidden;
+      text-overflow: ellipsis;
+      white-space: nowrap;
+      letter-spacing: 0.02em;
+    }
+
+    .version {
       flex-shrink: 0;
-    }
-    .app-name {
-      font-size: 22px;
-      font-weight: 700;
-      letter-spacing: 0.3px;
-    }
-    .app-desc {
-      font-size: 12px;
-      margin-top: 5px;
-      opacity: 0.6;
+      color: var(--text-faint);
+      font-family: "SFMono-Regular", Consolas, "Liberation Mono", monospace;
+      font-size: 10px;
+      letter-spacing: 0;
+      opacity: 0.62;
     }
 
-    .spacer { flex: 1; }
-
-    /* 底部进度区 */
-    .bottom {
-      padding: 0 48px 40px;
-      animation: fadeIn 0.4s ease 0.1s both;
+    [data-mode="dark"] .version {
+      opacity: 0.50;
     }
 
-    /* 进度条轨道 */
     .progress-track {
-      width: 100%;
-      height: 2px;
-      border-radius: 2px;
-      margin-bottom: 12px;
-      position: relative;
-      overflow: hidden;
-    }
-
-    /* 进度条填充 */
-    .progress-fill {
-      height: 100%;
-      width: 0%;
-      border-radius: 2px;
-      position: relative;
-      transition: width 0.5s cubic-bezier(0.4, 0, 0.2, 1);
-      overflow: hidden;
-    }
-
-    /* 扫光：只在有进度时显示，不循环 */
-    .progress-fill::after {
-      content: '';
       position: absolute;
-      top: 0; left: 0;
-      width: 100%; height: 100%;
-      background: linear-gradient(90deg, transparent 0%, rgba(255,255,255,0.5) 50%, transparent 100%);
-      animation: sweep 1.2s ease-out forwards;
+      left: 0;
+      right: 0;
+      bottom: 0;
+      z-index: 3;
+      height: 3px;
+      background: var(--loader-track);
+      overflow: hidden;
+    }
+
+    [data-mode="dark"] .progress-track {
+      height: 3px;
+    }
+
+    .progress-fill {
+      position: absolute;
+      left: 0;
+      bottom: 0;
+      width: 0%;
+      height: 100%;
+      min-width: 0;
+      border-radius: 0 999px 999px 0;
+      background: var(--accent);
+      box-shadow: 0 0 18px rgba(var(--accent-rgb), 0.34);
+      overflow: hidden;
+      transition: width 440ms var(--ease-ambient);
+    }
+
+    .progress-fill::before {
+      content: "";
+      position: absolute;
+      top: -7px;
+      right: -18px;
+      width: 44px;
+      height: 15px;
+      border-radius: 999px;
+      background: rgba(var(--accent-rgb), 0.34);
+      filter: blur(8px);
       opacity: 0;
     }
 
-    /* 等待阶段：进度条末端呼吸光点 */
-    .progress-fill.waiting::before {
-      content: '';
+    .progress-fill::after {
+      content: "";
       position: absolute;
-      top: -1px; right: -2px;
-      width: 6px; height: 4px;
-      border-radius: 50%;
-      background: inherit;
-      filter: blur(2px);
-      animation: pulse 1.5s ease-in-out infinite;
+      inset: -1px 0;
+      background: linear-gradient(90deg, transparent, rgba(255, 255, 255, 0.54), transparent);
+      opacity: 0;
+      transform: translateX(-100%);
+      animation: spectralGlide 1200ms ease-out;
     }
 
-    .bottom-row {
-      display: flex;
-      justify-content: space-between;
-      align-items: center;
-    }
-    .progress-text {
-      font-size: 11px;
-      opacity: 0.38;
-    }
-    .version {
-      font-size: 11px;
-      opacity: 0.25;
+    .progress-fill.waiting::before {
+      opacity: 0.65;
+      animation: leadingGlow 1300ms ease-in-out infinite;
     }
 
-    @keyframes fadeIn {
-      from { opacity: 0; transform: translateY(4px); }
-      to   { opacity: 1; transform: translateY(0); }
+    @media (prefers-reduced-motion: reduce) {
+      .splash-shell,
+      .brand-stage,
+      .status-row,
+      .logo-image,
+      .status-dot,
+      .progress-fill,
+      .progress-fill::before,
+      .progress-fill::after {
+        animation: none !important;
+        transition: none !important;
+      }
+
+      .progress-fill {
+        left: 0 !important;
+        opacity: 1 !important;
+      }
     }
-    @keyframes sweep {
-      0%   { opacity: 0; transform: translateX(-100%); }
-      20%  { opacity: 1; }
-      80%  { opacity: 1; }
-      100% { opacity: 0; transform: translateX(100%); }
+
+    @keyframes windowAppear {
+      0% {
+        opacity: 0;
+        transform: scale(0.97) translateY(12px);
+      }
+      100% {
+        opacity: 1;
+        transform: scale(1) translateY(0);
+      }
     }
-    @keyframes pulse {
-      0%, 100% { opacity: 0.4; transform: scaleX(1); }
-      50%       { opacity: 1;   transform: scaleX(1.8); }
+
+    @keyframes contentIn {
+      0% {
+        opacity: 0;
+        transform: translateY(8px);
+      }
+      100% {
+        opacity: 1;
+        transform: translateY(0);
+      }
     }
+
+    @keyframes logoBreathe {
+      0% {
+        opacity: 0.94;
+        transform: translateY(0);
+      }
+      100% {
+        opacity: 1;
+        transform: translateY(-3px);
+      }
+    }
+
+    @keyframes dotPulse {
+      0%,
+      100% {
+        opacity: 0.38;
+        transform: scale(0.84);
+      }
+      50% {
+        opacity: 1;
+        transform: scale(1.18);
+      }
+    }
+
+    @keyframes leadingGlow {
+      0%,
+      100% {
+        opacity: 0.38;
+        transform: scaleX(0.78);
+      }
+      50% {
+        opacity: 0.86;
+        transform: scaleX(1.28);
+      }
+    }
+
+    @keyframes spectralGlide {
+      0% {
+        opacity: 0;
+        transform: translateX(-100%);
+      }
+      22%,
+      66% {
+        opacity: 0.58;
+      }
+      100% {
+        opacity: 0;
+        transform: translateX(100%);
+      }
+    }
+
   </style>
 </head>
 <body>
-  <div class="splash" id="splash">
-    <div class="brand">
-      <img class="logo" src="./logo.png" alt="WeFlow" />
-      <div class="brand-text">
-        <div class="app-name" id="appName">WeFlow</div>
-        <div class="app-desc" id="appDesc">微信聊天记录管理工具</div>
+  <main class="splash-shell" id="splash" role="status" aria-live="polite">
+    <section class="brand-stage" aria-label="WeFlow">
+      <div class="logo-core" aria-hidden="true">
+        <img class="logo-image" src="./logo.png" alt="">
       </div>
+
+      <h1 class="app-name">WeFlow</h1>
+      <p class="app-desc">&#24494;&#20449;&#32842;&#22825;&#35760;&#24405;&#31649;&#29702;&#24037;&#20855;</p>
+    </section>
+
+    <div class="status-row">
+      <div class="progress-text-wrap">
+        <div class="status-dot" aria-hidden="true"></div>
+        <div class="progress-text" id="progressText">&#27491;&#22312;&#39044;&#21152;&#36733;&#20250;&#35805;&#36923;&#36753;...</div>
+      </div>
+      <div class="version" id="versionText"></div>
     </div>
 
-    <div class="spacer"></div>
-
-    <div class="bottom">
-      <div class="progress-track" id="progressTrack">
-        <div class="progress-fill" id="progressFill"></div>
-      </div>
-      <div class="bottom-row">
-        <div class="progress-text" id="progressText">正在启动...</div>
-        <div class="version" id="versionText"></div>
-      </div>
+    <div class="progress-track" aria-hidden="true">
+      <div class="progress-fill" id="progressFill"></div>
     </div>
-  </div>
+  </main>
 
   <script>
-    var themes = {
-      'cloud-dancer': {
-        light: { primary: '#8B7355', bg: '#F0EEE9', bgEnd: '#E5E1DA', text: '#3d3d3d', desc: '#8B7355' },
-        dark:  { primary: '#C9A86C', bg: '#1a1816', bgEnd: '#252220', text: '#F0EEE9', desc: '#C9A86C' }
-      },
-      'corundum-blue': {
-        light: { primary: '#4A6670', bg: '#E8EEF0', bgEnd: '#D8E4E8', text: '#3d3d3d', desc: '#4A6670' },
-        dark:  { primary: '#6A9AAA', bg: '#141a1c', bgEnd: '#1e2a2e', text: '#E0EEF2', desc: '#6A9AAA' }
-      },
-      'kiwi-green': {
-        light: { primary: '#7A9A5C', bg: '#E8F0E4', bgEnd: '#D8E8D2', text: '#3d3d3d', desc: '#7A9A5C' },
-        dark:  { primary: '#9ABA7C', bg: '#161a14', bgEnd: '#222a1e', text: '#E8F0E4', desc: '#9ABA7C' }
-      },
-      'spicy-red': {
-        light: { primary: '#8B4049', bg: '#F0E8E8', bgEnd: '#E8D8D8', text: '#3d3d3d', desc: '#8B4049' },
-        dark:  { primary: '#C06068', bg: '#1a1416', bgEnd: '#261e20', text: '#F2E8EA', desc: '#C06068' }
-      },
-      'teal-water': {
-        light: { primary: '#5A8A8A', bg: '#E4F0F0', bgEnd: '#D2E8E8', text: '#3d3d3d', desc: '#5A8A8A' },
-        dark:  { primary: '#7ABAAA', bg: '#121a1a', bgEnd: '#1a2626', text: '#E0F2EE', desc: '#7ABAAA' }
-      },
-      'blossom-dream': {
-        light: { primary: '#D4849A', primaryEnd: '#D4849A', bg: '#FCF9FB', bgMid: '#F8F2F8', bgEnd: '#F2F6FB', text: '#2E2633', desc: '#D4849A' },
-        dark:  { primary: '#C670C3', primaryEnd: '#8A60C0', bg: '#120B16', bgMid: '#1A1020', bgEnd: '#0E0B18', text: '#F2EAF4', desc: '#C670C3' }
-      }
-    };
+    var themeModeQuery = null;
+    var systemModeQuery = null;
 
-    function applyTheme(themeId, mode) {
-      var t = themes[themeId] || themes['cloud-dancer'];
-      var isDark = mode === 'dark';
-      if (mode === 'system') isDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
-      var c = isDark ? t.dark : t.light;
-
-      var el = document.getElementById('splash');
-      var fill = document.getElementById('progressFill');
-
-      if (themeId === 'blossom-dream') {
-        if (isDark) {
-          // 深色
-          el.style.background =
-            'radial-gradient(ellipse 60% 50% at 100% 0%, ' + c.primary + '28 0%, transparent 70%), ' +
-            'linear-gradient(150deg, ' + c.bg + ' 0%, ' + c.bgMid + ' 45%, ' + c.bgEnd + ' 100%)';
-        } else {
-          // 浅色
-          el.style.background = 'linear-gradient(150deg, ' + c.bg + ' 0%, ' + c.bgMid + ' 45%, ' + c.bgEnd + ' 100%)';
-        }
-        // 进度条
-        fill.style.background = 'linear-gradient(90deg, ' + c.primary + ' 0%, ' + c.primaryEnd + ' 100%)';
-      } else {
-        if (isDark) {
-          el.style.background =
-            'radial-gradient(ellipse 60% 50% at 100% 0%, ' + c.primary + '22 0%, transparent 70%), ' +
-            'linear-gradient(145deg, ' + c.bg + ' 0%, ' + c.bgEnd + ' 100%)';
-        } else {
-          el.style.background = 'linear-gradient(150deg, ' + c.bg + ' 0%, ' + c.bgEnd + ' 100%)';
-        }
-        fill.style.background = c.primary;
-      }
-
-      document.getElementById('appName').style.color = c.text;
-      document.getElementById('appDesc').style.color = c.desc;
-      document.getElementById('progressText').style.color = c.text;
-      document.getElementById('versionText').style.color = c.text;
-      document.getElementById('progressTrack').style.background = c.primary + (isDark ? '25' : '18');
+    function resolveMode(mode) {
+      if (mode === "dark" || mode === "light") return mode;
+      return window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light";
+    }
+
+    function syncSystemModeListener(mode) {
+      if (!window.matchMedia) return;
+      var nextQuery = window.matchMedia("(prefers-color-scheme: dark)");
+
+      if (systemModeQuery && systemModeQuery !== nextQuery && systemModeQuery.removeEventListener) {
+        systemModeQuery.removeEventListener("change", handleSystemModeChange);
+      }
+
+      systemModeQuery = nextQuery;
+      themeModeQuery = mode;
+
+      if (mode === "system" && nextQuery.addEventListener) {
+        nextQuery.addEventListener("change", handleSystemModeChange);
+      }
+    }
+
+    function handleSystemModeChange() {
+      if (themeModeQuery === "system") {
+        document.documentElement.setAttribute("data-mode", resolveMode("system"));
+      }
+    }
+
+    function applyTheme(themeId, mode) {
+      var safeThemeId = String(themeId || "cloud-dancer");
+      var safeMode = mode === "light" || mode === "dark" || mode === "system" ? mode : "system";
+      var resolvedMode = resolveMode(safeMode);
+
+      document.documentElement.setAttribute("data-theme", safeThemeId);
+      document.documentElement.setAttribute("data-theme-mode", safeMode);
+      document.documentElement.setAttribute("data-mode", resolvedMode);
+      syncSystemModeListener(safeMode);
     }
 
-    // percent: 实际进度值；waiting: 是否处于等待阶段
     function updateProgress(percent, text, waiting) {
-      var fill = document.getElementById('progressFill');
-      var label = document.getElementById('progressText');
+      var fill = document.getElementById("progressFill");
+      var label = document.getElementById("progressText");
+      var safePercent = Math.max(0, Math.min(100, Number(percent) || 0));
 
       if (fill) {
-        fill.style.width = percent + '%';
+        fill.style.width = safePercent + "%";
         if (waiting) {
-          fill.classList.add('waiting');
+          fill.classList.add("waiting");
         } else {
-          fill.classList.remove('waiting');
-          // 触发扫光：重置动画
-          fill.style.animation = 'none';
+          fill.classList.remove("waiting");
+          fill.style.animation = "none";
           fill.offsetHeight;
-          fill.style.animation = '';
+          fill.style.animation = "";
         }
       }
+
       if (label && text) label.textContent = text;
     }
 
-    function setVersion(ver) {
-      var el = document.getElementById('versionText');
-      if (el) el.textContent = 'v' + ver;
+    function setVersion(version) {
+      var el = document.getElementById("versionText");
+      if (!el) return;
+      var text = String(version || "").trim();
+      el.textContent = text ? "v" + text.replace(/^v/i, "") : "";
     }
 
-    applyTheme('cloud-dancer', 'light');
+    (function bootstrapSplash() {
+      var params = new URLSearchParams(window.location.search || "");
+      applyTheme(params.get("themeId") || "cloud-dancer", params.get("themeMode") || "system");
+      updateProgress(0, "", false);
+    })();
   </script>
 </body>
 </html>

resources/image/README.md

@@ -0,0 +1 @@
+> 目前只适配了x64 win32平台，其它平台同样原理，但是代码还没写（

resources/installer/linux/.gitignore

@@ -0,0 +1,6 @@
+*.tar.gz
+*.tar.xz
+*.zip
+src/
+pkg/
+weflow-*/

resources/installer/linux/PKGBUILD

@@ -0,0 +1,30 @@
+# Maintainer: H3CoF6 <h3cof6@gmail.com>
+pkgname=weflow
+pkgver=4.3.0
+pkgrel=1
+pkgdesc="A local WeChat database decryption and analysis tool"
+arch=('x86_64')
+url="https://github.com/hicccc77/weflow"
+license=('CC-BY-NC-SA-4.0')
+depends=('alsa-lib' 'gtk3' 'nss' 'glibc')
+options=('!strip' '!debug')
+
+source=("WeFlow-${pkgver}-Setup.tar.gz::${url}/releases/download/v${pkgver}/WeFlow-${pkgver}-Setup.tar.gz"
+  "weflow.desktop"
+  "icon.png")
+
+sha256sums=('2859aca2f57c42f4d1516ed229613623c57d3e78b9cb152fcb2b9c1096ab9340'
+            '2cf03766f5c2f1915ad136f060a66f5788ed32b06defe1956e406c73d7e733b7'
+            'b1c412d9c08ae683e231173c16fe73958ad1063f14c9b3852373385e4fcb6f33')
+
+package() {
+  install -dm755 "${pkgdir}/opt/${pkgname}"
+
+  cp -a "${srcdir}/WeFlow-${pkgver}-Setup/"* "${pkgdir}/opt/${pkgname}/"
+
+  install -dm755 "${pkgdir}/usr/bin"
+  ln -s "/opt/${pkgname}/weflow" "${pkgdir}/usr/bin/${pkgname}"
+
+  install -Dm644 "${srcdir}/weflow.desktop" -t "${pkgdir}/usr/share/applications/"
+  install -Dm644 "${srcdir}/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
+}

resources/installer/linux/weflow.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Name=WeFlow
+Comment=一个本地的微信聊天记录导出和年度报告应用
+Exec=/usr/bin/weflow %U
+Terminal=false
+Type=Application
+Icon=weflow
+StartupWMClass=WeFlow
+Categories=Utility;