feat(desktop): add client release updater

apps/desktop-client/electron-builder.yml

@@ -8,37 +8,37 @@ compression: maximum
 removePackageScripts: true
 removePackageKeywords: true
 asar: true
-afterPack: build/afterPack.cjs    # 签名前裁掉非 en/zh_CN 的本地化文件
+afterPack: build/afterPack.cjs # 签名前裁掉非 en/zh_CN 的本地化文件
 asarUnpack:
-  - "**/node_modules/better-sqlite3/build/Release/**"
-  - "**/node_modules/better-sqlite3/lib/**"
-  - "**/node_modules/bindings/**"
-  - "**/node_modules/file-uri-to-path/**"
-  - "**/node_modules/playwright-core/lib/**"
-  - "**/node_modules/playwright-core/bin/**"
+  - '**/node_modules/better-sqlite3/build/Release/**'
+  - '**/node_modules/better-sqlite3/lib/**'
+  - '**/node_modules/bindings/**'
+  - '**/node_modules/file-uri-to-path/**'
+  - '**/node_modules/playwright-core/lib/**'
+  - '**/node_modules/playwright-core/bin/**'
 files:
   - out/**/*
   - package.json
-  - "!**/*.map"
-  - "!**/*.ts"
-  - "!**/*.tsx"
-  - "!**/*.md"
-  - "!**/*.markdown"
-  - "!**/{test,tests,__tests__,__mocks__,example,examples,docs,doc,demo,samples,man}/**"
-  - "!**/{LICENSE,LICENSE.*,license,CHANGELOG,CHANGELOG.*,README,README.*,HISTORY,HISTORY.*,AUTHORS,CONTRIBUTING}*"
-  - "!**/.*"
-  - "!**/node_modules/.bin/**"
-  - "!**/node_modules/*/{Makefile,Gulpfile.js,Gruntfile.js,CMakeLists.txt,*.coffee,*.flow,*.c,*.cc,*.cpp,*.h,*.hpp,*.gyp,*.gypi,*.tgz,binding.gyp}"
-  - "!**/node_modules/**/{*.d.ts,tsconfig*.json,jest.config*,rollup.config*,webpack.config*,vite.config*}"
-  - "!**/node_modules/better-sqlite3/{deps,src,docs,benchmark}/**"
-  - "!**/node_modules/better-sqlite3/{test_extension.c,download.sh,*.gyp,*.gypi}"
-  - "!**/node_modules/playwright-core/{types,ThirdPartyNotices.txt}/**"
-  - "!**/node_modules/**/*.{c,cc,cpp,h,hpp,cmake,m4,am,sh}"
+  - '!**/*.map'
+  - '!**/*.ts'
+  - '!**/*.tsx'
+  - '!**/*.md'
+  - '!**/*.markdown'
+  - '!**/{test,tests,__tests__,__mocks__,example,examples,docs,doc,demo,samples,man}/**'
+  - '!**/{LICENSE,LICENSE.*,license,CHANGELOG,CHANGELOG.*,README,README.*,HISTORY,HISTORY.*,AUTHORS,CONTRIBUTING}*'
+  - '!**/.*'
+  - '!**/node_modules/.bin/**'
+  - '!**/node_modules/*/{Makefile,Gulpfile.js,Gruntfile.js,CMakeLists.txt,*.coffee,*.flow,*.c,*.cc,*.cpp,*.h,*.hpp,*.gyp,*.gypi,*.tgz,binding.gyp}'
+  - '!**/node_modules/**/{*.d.ts,tsconfig*.json,jest.config*,rollup.config*,webpack.config*,vite.config*}'
+  - '!**/node_modules/better-sqlite3/{deps,src,docs,benchmark}/**'
+  - '!**/node_modules/better-sqlite3/{test_extension.c,download.sh,*.gyp,*.gypi}'
+  - '!**/node_modules/playwright-core/{types,ThirdPartyNotices.txt}/**'
+  - '!**/node_modules/**/*.{c,cc,cpp,h,hpp,cmake,m4,am,sh}'
 mac:
   category: public.app-category.productivity
   # identity 不写死：让 electron-builder 自动从 CSC_NAME 环境变量或钥匙串里挑
   # 注意：写 `identity: null` 是"明确不签名"，不要这么写
-  notarize: false             # 我们用 notarytool 自己跑，比 electron-builder 内置更稳
+  notarize: false # 我们用 notarytool 自己跑，比 electron-builder 内置更稳
   hardenedRuntime: true
   gatekeeperAssess: false
   entitlements: build/entitlements.mac.plist
@@ -57,8 +57,8 @@ mac:
   target:
     - target: dmg
       arch: [arm64, universal]
-    # - target: zip
-    #   arch: [arm64, universal]
+    - target: zip
+      arch: [arm64, universal]
 dmg:
   format: ULFO
   contents:
@@ -82,4 +82,6 @@ linux:
   target:
     - target: AppImage
       arch: [x64]
-publish: null
+publish:
+  provider: generic
+  url: https://api.shengxintui.com/api/desktop/releases/updater/stub/universal/stable/0.0.0

apps/desktop-client/scripts/sign-mac.sh

@@ -10,6 +10,14 @@ ok()   { echo "  ${G}✓${N} $1"; }
 fail() { echo "  ${R}✗${N} $1"; }
 step() { echo ""; echo "${B}── $1 ──${N}"; }
 
+LOCK_DIR="${TMPDIR:-/tmp}/geo-rankly-desktop-sign-mac.lock"
+if ! mkdir "$LOCK_DIR" 2>/dev/null; then
+  fail "已有 sign:mac 正在运行，避免多个构建同时写 release/"
+  echo "  如确认没有进程，可删除: $LOCK_DIR"
+  exit 1
+fi
+trap 'rm -rf "$LOCK_DIR"' EXIT
+
 # ── 前置检查（本地/CI 双模式）─────────────────────────────────────
 # 本地模式：读 .env.signing，公证走钥匙串 profile
 # CI 模式：靠环境变量 CSC_NAME / APPLE_ID / APPLE_APP_SPECIFIC_PASSWORD / APPLE_TEAM_ID
@@ -35,6 +43,12 @@ fi
 ok "签名身份: $CSC_NAME"
 ok "Team ID: $APPLE_TEAM_ID"
 
+CODESIGN_IDENTITY="${CODESIGN_IDENTITY:-$CSC_NAME}"
+if [[ ! "$CODESIGN_IDENTITY" =~ ^[0-9A-Fa-f]{40}$ && "$CODESIGN_IDENTITY" != Developer\ ID\ Application:* ]]; then
+  CODESIGN_IDENTITY="Developer ID Application: $CODESIGN_IDENTITY"
+fi
+ok "codesign 身份: $CODESIGN_IDENTITY"
+
 # ── 1. 构建 ──────────────────────────────────────────────────────
 step "[1/5] 构建 Electron 产物"
 pnpm build
@@ -43,68 +57,98 @@ ok "构建完成"
 # ── 2. 打包 + 签名 ───────────────────────────────────────────────
 step "[2/5] 打包 + 签名 (electron-builder)"
 # 清理旧产物，避免 spctl 把上次未公证的 dmg 认成本次产物
+rm -rf release/mac-* 2>/dev/null || true
 rm -f release/*.dmg release/*-mac.zip release/*.blockmap 2>/dev/null || true
 pnpm exec electron-builder --mac --arm64
 ok "打包完成"
 
-DMG=$(ls -t release/*.dmg 2>/dev/null | head -n1 || true)
-ZIP=$(ls -t release/*-mac.zip 2>/dev/null | head -n1 || true)
-APP=$(ls -td release/mac*/*.app 2>/dev/null | head -n1 || true)
+shopt -s nullglob
+DMGS=(release/*.dmg)
+ZIPS=(release/*-mac.zip)
+APPS=(release/mac*/*.app)
+shopt -u nullglob
 
-[ -z "$DMG" ] && { fail "未找到 .dmg 产物"; exit 1; }
-ok "DMG: $DMG"
-[ -n "$ZIP" ] && ok "ZIP: $ZIP"
-[ -n "$APP" ] && ok "APP: $APP"
+[ "${#DMGS[@]}" -eq 0 ] && { fail "未找到 .dmg 产物"; exit 1; }
+[ "${#APPS[@]}" -eq 0 ] && { fail "未找到 .app 产物"; exit 1; }
+for DMG in "${DMGS[@]}"; do ok "DMG: $DMG"; done
+for ZIP in "${ZIPS[@]}"; do ok "ZIP: $ZIP"; done
+for APP in "${APPS[@]}"; do ok "APP: $APP"; done
 
 # 验证签名是否真的盖上了
-if [ -n "$APP" ]; then
+for APP in "${APPS[@]}"; do
   if ! codesign --verify --deep --strict --verbose=2 "$APP" >/dev/null 2>&1; then
-    fail ".app 签名验证失败，停止公证"
+    fail ".app 签名验证失败，停止公证: $APP"
     codesign --verify --deep --strict --verbose=2 "$APP" || true
     exit 1
   fi
-  ok ".app 签名校验通过"
-fi
+  ok ".app 签名校验通过: $APP"
+done
+
+# electron-builder 会签 .app，但 DMG 本体在部分配置/版本下不会自动签。
+# Gatekeeper 对安装包执行 `spctl -t install` 时要求外层 DMG 也有可用签名。
+for DMG in "${DMGS[@]}"; do
+  echo "  正在签名 DMG: $DMG"
+  codesign --force --timestamp --sign "$CODESIGN_IDENTITY" "$DMG"
+  if ! codesign --verify --verbose=2 "$DMG" >/dev/null 2>&1; then
+    fail "DMG 签名验证失败，停止公证: $DMG"
+    codesign --verify --verbose=2 "$DMG" || true
+    exit 1
+  fi
+  ok "DMG 签名校验通过: $DMG"
+done
 
 # ── 3. 公证 ──────────────────────────────────────────────────────
 step "[3/5] 提交公证 (notarytool, 通常 1-5 分钟)"
-echo "  正在提交 DMG..."
-xcrun notarytool submit "$DMG" \
-  "${NOTARY_ARGS[@]}" \
-  --wait
-ok "DMG 公证通过"
-
-if [ -n "$ZIP" ]; then
-  echo "  正在提交 ZIP（用于自动更新）..."
-  xcrun notarytool submit "$ZIP" \
-    --keychain-profile "$NOTARY_KEYCHAIN_PROFILE" \
+for DMG in "${DMGS[@]}"; do
+  echo "  正在提交 DMG: $DMG"
+  xcrun notarytool submit "$DMG" \
+    "${NOTARY_ARGS[@]}" \
     --wait
-  ok "ZIP 公证通过"
-fi
+  ok "DMG 公证通过: $DMG"
+done
+
+for ZIP in "${ZIPS[@]}"; do
+  echo "  正在提交 ZIP（用于自动更新）: $ZIP"
+  xcrun notarytool submit "$ZIP" \
+    "${NOTARY_ARGS[@]}" \
+    --wait
+  ok "ZIP 公证通过: $ZIP"
+done
 
 # ── 4. 装订 ticket ───────────────────────────────────────────────
 step "[4/5] 装订 ticket (stapler)"
-xcrun stapler staple "$DMG"
-ok "DMG ticket 已装订（断网也能验证）"
+for DMG in "${DMGS[@]}"; do
+  xcrun stapler staple "$DMG"
+  ok "DMG ticket 已装订（断网也能验证）: $DMG"
+done
 # zip 不能 staple，但用户解压后里面的 .app 已经被 staple 过
 
 # ── 5. 验证 ──────────────────────────────────────────────────────
 step "[5/5] 最终验证 (Gatekeeper)"
-if spctl -a -vv -t install "$DMG" 2>&1 | tee /tmp/spctl.log | grep -q "accepted"; then
-  ok "Gatekeeper 验证通过"
-  grep -E "source=|origin=" /tmp/spctl.log | sed 's/^/    /'
-else
-  fail "Gatekeeper 拒绝了产物"
-  cat /tmp/spctl.log
-  exit 1
-fi
+for DMG in "${DMGS[@]}"; do
+  LOG_FILE=$(mktemp "${TMPDIR:-/tmp}/spctl.XXXXXX")
+  if spctl -a -vv -t install "$DMG" 2>&1 | tee "$LOG_FILE" | grep -q "accepted"; then
+    ok "Gatekeeper 验证通过: $DMG"
+    grep -E "source=|origin=" "$LOG_FILE" | sed 's/^/    /'
+  else
+    fail "Gatekeeper 拒绝了产物: $DMG"
+    cat "$LOG_FILE"
+    rm -f "$LOG_FILE"
+    exit 1
+  fi
+  rm -f "$LOG_FILE"
+done
 
 # ── 完成 ────────────────────────────────────────────────────────
-SIZE=$(du -h "$DMG" | awk '{print $1}')
 echo ""
 echo "${G}${B}━━━━━━━━━━ 全部完成 ━━━━━━━━━━${N}"
-echo "  📦 $DMG  (${SIZE})"
-[ -n "$ZIP" ] && echo "  📦 $ZIP"
+for DMG in "${DMGS[@]}"; do
+  SIZE=$(du -h "$DMG" | awk '{print $1}')
+  echo "  📦 $DMG  (${SIZE})"
+done
+for ZIP in "${ZIPS[@]}"; do
+  echo "  📦 $ZIP"
+done
 echo ""
 echo "  这份 DMG 可以直接发给任何 macOS 用户，"
 echo "  双击安装，首次打开${B}不会${N}弹\"无法验证开发者\"或被 Gatekeeper 拦截。"

apps/desktop-client/src/main/account-health.test.ts

@@ -0,0 +1,108 @@
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import type { AuthProbeResult } from './auth-types'
+
+const probeAIAccountSession = vi.fn()
+const probePublishAccountSession = vi.fn()
+const silentRefreshAIAccountSession = vi.fn()
+const silentRefreshPublishAccountSession = vi.fn()
+const getSessionHandle = vi.fn()
+const getPersistedPartition = vi.fn()
+const emitRuntimeInvalidated = vi.fn()
+
+vi.mock('electron/main', () => ({
+  app: {
+    getPath: () => join(tmpdir(), 'geo-rankly-account-health-test'),
+  },
+}))
+
+vi.mock('./account-binder', () => ({
+  probeAIAccountSession,
+  probePublishAccountSession,
+  silentRefreshAIAccountSession,
+  silentRefreshPublishAccountSession,
+}))
+
+vi.mock('./session-registry', () => ({
+  getSessionHandle,
+  getPersistedPartition,
+}))
+
+vi.mock('./runtime-events', () => ({
+  emitRuntimeInvalidated,
+}))
+
+const account = {
+  id: 'account-1',
+  platform: 'doubao',
+  platformUid: 'doubao-session:demo',
+  displayName: '豆包账号',
+}
+
+function challenge(reason: AuthProbeResult['reason'] = 'captcha_gate'): AuthProbeResult {
+  return {
+    verdict: 'challenge_required',
+    reason,
+    profile: null,
+    sessionFingerprint: null,
+  }
+}
+
+function active(): AuthProbeResult {
+  return {
+    verdict: 'active',
+    reason: 'probe_success',
+    profile: {
+      displayName: '豆包账号',
+      avatarUrl: null,
+      subjectUid: 'doubao-session:demo',
+    },
+    sessionFingerprint: 'fingerprint-live',
+  }
+}
+
+describe('account health challenge recheck', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.clearAllMocks()
+    getSessionHandle.mockReturnValue({ partition: 'persist:test' })
+    getPersistedPartition.mockReturnValue('persist:test')
+    silentRefreshAIAccountSession.mockResolvedValue(true)
+    silentRefreshPublishAccountSession.mockResolvedValue(true)
+  })
+
+  it('hides a first challenge result when the automatic recheck succeeds', async () => {
+    probeAIAccountSession.mockResolvedValueOnce(challenge()).mockResolvedValueOnce(active())
+    const { probeTrackedAccount } = await import('./account-health')
+
+    const snapshot = await probeTrackedAccount(account, {
+      trigger: 'manual',
+      allowSilentRefresh: true,
+      force: true,
+    })
+
+    expect(probeAIAccountSession).toHaveBeenCalledTimes(2)
+    expect(snapshot.authState).toBe('active')
+    expect(snapshot.authReason).toBe('probe_success')
+  })
+
+  it('shows manual verification only after the automatic recheck still needs it', async () => {
+    probeAIAccountSession
+      .mockResolvedValueOnce(challenge('risk_control'))
+      .mockResolvedValueOnce(challenge('risk_control'))
+    const { probeTrackedAccount } = await import('./account-health')
+
+    const snapshot = await probeTrackedAccount(account, {
+      trigger: 'manual',
+      allowSilentRefresh: true,
+      force: true,
+    })
+
+    expect(probeAIAccountSession).toHaveBeenCalledTimes(2)
+    expect(snapshot.authState).toBe('challenge_required')
+    expect(snapshot.authReason).toBe('risk_control')
+  })
+})

apps/desktop-client/src/main/account-health.ts

@@ -13,7 +13,11 @@ import type {
   AccountProbeState,
   AuthProbeResult,
 } from './auth-types'
-import { getPlatformAdapter, type PlatformFailureInput } from './platform-auth-adapters'
+import {
+  getPlatformAdapter,
+  type PlatformAdapter,
+  type PlatformFailureInput,
+} from './platform-auth-adapters'
 import { emitRuntimeInvalidated } from './runtime-events'
 import { getPersistedPartition, getSessionHandle } from './session-registry'
 
@@ -30,6 +34,7 @@ const MAX_CONCURRENT_ACCOUNT_PROBES = 2
 const MANUAL_PROBE_CACHE_TTL_MS = 5 * 60_000
 const MANUAL_PROBE_MIN_INTERVAL_MS = 15_000
 const ACCOUNT_PROBE_RETRY_BACKOFF_MS = [1_000, 3_000, 10_000] as const
+const CHALLENGE_RECHECK_ATTEMPTS = 1
 
 type ProbeTrigger = 'scheduled' | 'manual' | 'preflight' | 'confirm'
 
@@ -366,6 +371,62 @@ function applyNetworkResult(
   return commitRecord(record, previousSignature)
 }
 
+function networkProbeResult(): AuthProbeResult {
+  return {
+    verdict: 'network_error',
+    reason: 'network_error',
+    profile: null,
+    sessionFingerprint: null,
+  }
+}
+
+async function probeAdapter(
+  adapter: PlatformAdapter,
+  account: PublishAccountIdentity,
+  partition: string,
+): Promise<AuthProbeResult> {
+  return await adapter.probe(account, partition).catch<AuthProbeResult>(() => networkProbeResult())
+}
+
+async function recheckChallengeResult(
+  adapter: PlatformAdapter,
+  account: PublishAccountIdentity,
+  partition: string,
+  result: AuthProbeResult,
+): Promise<AuthProbeResult> {
+  if (result.verdict !== 'challenge_required') {
+    return result
+  }
+
+  let confirmed = result
+  for (let attempt = 0; attempt < CHALLENGE_RECHECK_ATTEMPTS; attempt += 1) {
+    confirmed = await probeAdapter(adapter, account, partition)
+    if (confirmed.verdict !== 'challenge_required') {
+      return confirmed
+    }
+  }
+
+  return confirmed
+}
+
+function applyProbeResult(
+  record: AccountHealthRecord,
+  result: AuthProbeResult,
+  now: number,
+  trigger: ProbeTrigger,
+): AccountHealthSnapshot {
+  switch (result.verdict) {
+    case 'active':
+      return applyActiveResult(record, result, now)
+    case 'expired':
+      return applyExpiredResult(record, result, now)
+    case 'challenge_required':
+      return applyChallengeResult(record, result, now)
+    default:
+      return applyNetworkResult(record, result, now, trigger)
+  }
+}
+
 async function performProbeLocked(
   account: PublishAccountIdentity,
   options: {
@@ -407,28 +468,18 @@ async function performProbeLocked(
     }
   }
 
-  const result = await adapter.probe(account, partition).catch<AuthProbeResult>(() => ({
-    verdict: 'network_error',
-    reason: 'network_error',
-    profile: null,
-    sessionFingerprint: null,
-  }))
+  const result = await probeAdapter(adapter, account, partition)
 
   if (record.authRevision !== probeAuthRevision) {
     return toPublicSnapshot(record)
   }
 
-  const now = Date.now()
-  switch (result.verdict) {
-    case 'active':
-      return applyActiveResult(record, result, now)
-    case 'expired':
-      return applyExpiredResult(record, result, now)
-    case 'challenge_required':
-      return applyChallengeResult(record, result, now)
-    default:
-      return applyNetworkResult(record, result, now, options.trigger)
+  const confirmedResult = await recheckChallengeResult(adapter, account, partition, result)
+  if (record.authRevision !== probeAuthRevision) {
+    return toPublicSnapshot(record)
   }
+
+  return applyProbeResult(record, confirmedResult, Date.now(), options.trigger)
 }
 
 function canUseCachedProbe(
@@ -922,15 +973,25 @@ export async function reportAccountFailure(
     const now = Date.now()
 
     if (classification === 'challenge' || classification === 'risk_control') {
-      record.authState = 'challenge_required'
-      record.probeState = 'idle'
-      record.authReason = classification === 'risk_control' ? 'risk_control' : 'captcha_gate'
-      record.lastAuthFailureAt = now
-      record.lastProbeAt = now
-      record.nextProbeAt = nextRegularProbeAt(now)
-      record.suspectedExpiredAt = null
-      record.confirmFailureCount = 0
-      return commitRecord(record, previousSignature)
+      record.probeState = 'probing'
+      commitRecord(record, previousSignature)
+
+      const partition = resolveKnownPartition(account.id)
+      const result = partition
+        ? await recheckChallengeResult(adapter, account, partition, {
+            verdict: 'challenge_required',
+            reason: classification === 'risk_control' ? 'risk_control' : 'captcha_gate',
+            profile: null,
+            sessionFingerprint: null,
+          })
+        : {
+            verdict: 'expired' as const,
+            reason: 'missing_partition' as const,
+            profile: null,
+            sessionFingerprint: null,
+          }
+
+      return applyProbeResult(record, result, Date.now(), 'confirm')
     }
 
     if (classification === 'network') {

apps/desktop-client/src/main/app-version.ts

@@ -0,0 +1,9 @@
+import { app } from 'electron/main'
+
+export function getDesktopAppVersion(): string {
+  return app.getVersion()
+}
+
+export function getDesktopReleaseChannel(): string {
+  return process.env.DESKTOP_RELEASE_CHANNEL ?? (app.isPackaged ? 'stable' : 'dev')
+}

apps/desktop-client/src/main/bootstrap.ts

@@ -3,6 +3,7 @@ import { join } from 'node:path'
 
 import type {
   DesktopAccountInfo,
+  DesktopClientReleaseCheckResponse,
   DesktopClientRotateResponse,
   DesktopRuntimeSessionSyncRequest,
 } from '@geo/shared-types'
@@ -31,23 +32,29 @@ import {
   setDesktopAppSetting,
   type DesktopAppSettingKey,
 } from './app-settings'
-import { resolveDesktopClientID, resolveDesktopDeviceInfo } from './device-id'
+import { getDesktopAppVersion, getDesktopReleaseChannel } from './app-version'
 import {
-  installObservedGlobalFetch,
-  registerObservedRequestRendererTarget,
-} from './network-observer'
-import { getPlaywrightCDPPort, startHiddenPlaywrightReaper } from './playwright-cdp'
+  defaultDesktopUpdateChannel,
+  startDesktopClientUpdate,
+  type DesktopClientUpdateProgressEvent,
+} from './client-updater'
+import { resolveDesktopClientID, resolveDesktopDeviceInfo } from './device-id'
 import {
   clearSavedLoginCredentials,
   getSavedLoginCredentials,
   saveLoginCredentials,
 } from './login-credentials'
+import {
+  installObservedGlobalFetch,
+  registerObservedRequestRendererTarget,
+} from './network-observer'
+import { getPlaywrightCDPPort, startHiddenPlaywrightReaper } from './playwright-cdp'
 import { initProcessMetricsSampler } from './process-metrics'
 import { registerRendererDevtoolsProxyTarget } from './renderer-devtools-proxy'
 import {
+  getRuntimeControllerSnapshot,
   noteRuntimeAccountBound,
   refreshRuntimeAccounts,
-  getRuntimeControllerSnapshot,
   releaseRuntimeSession,
   requestRuntimeAccountProbe,
   syncRuntimeSession,
@@ -59,8 +66,10 @@ import { initScheduler } from './scheduler'
 import { initSessionRegistry } from './session-registry'
 import { initSingleInstance } from './single-instance'
 import {
+  checkDesktopClientRelease,
   initTransport,
   listDesktopPublishTasks,
+  resolveDesktopClientReleaseDownloadURL,
   retryDesktopPublishTask,
   rotateDesktopClient,
 } from './transport/api-client'
@@ -772,15 +781,73 @@ function isSafeExternalUrl(url: string): boolean {
   }
 }
 
+function desktopReleasePlatform(): string {
+  switch (process.platform) {
+    case 'darwin':
+      return 'darwin'
+    case 'win32':
+      return 'win32'
+    case 'linux':
+      return 'linux'
+    default:
+      return process.platform
+  }
+}
+
+function desktopReleaseArch(): string {
+  switch (process.arch) {
+    case 'x64':
+    case 'arm64':
+    case 'ia32':
+      return process.arch
+    default:
+      return 'universal'
+  }
+}
+
+async function checkCurrentDesktopClientRelease(): Promise<DesktopClientReleaseCheckResponse> {
+  const snapshot = getRuntimeControllerSnapshot()
+  if (!snapshot.session?.client_token) {
+    throw new Error('desktop_client_not_registered')
+  }
+
+  return checkDesktopClientRelease({
+    platform: desktopReleasePlatform(),
+    arch: desktopReleaseArch(),
+    version: getDesktopAppVersion(),
+    channel: snapshot.session.desktop_client?.channel || getDesktopReleaseChannel(),
+  })
+}
+
+async function resolveCurrentDesktopClientReleaseDownloadURL(): Promise<{ download_url: string }> {
+  const snapshot = getRuntimeControllerSnapshot()
+  if (!snapshot.session?.client_token) {
+    throw new Error('desktop_client_not_registered')
+  }
+
+  return resolveDesktopClientReleaseDownloadURL({
+    platform: desktopReleasePlatform(),
+    arch: desktopReleaseArch(),
+    version: getDesktopAppVersion(),
+    channel: snapshot.session.desktop_client?.channel || getDesktopReleaseChannel(),
+  })
+}
+
+function emitClientUpdateProgress(event: DesktopClientUpdateProgressEvent): void {
+  for (const window of BrowserWindow.getAllWindows()) {
+    if (!window.isDestroyed()) {
+      window.webContents.send('desktop:client-update-progress', event)
+    }
+  }
+}
+
 function registerDesktopProtocolClient(): void {
   if (app.isDefaultProtocolClient(desktopDeepLinkScheme)) {
     return
   }
 
   if (process.defaultApp && process.execPath) {
-    app.setAsDefaultProtocolClient(desktopDeepLinkScheme, process.execPath, [
-      process.argv[1] ?? '',
-    ])
+    app.setAsDefaultProtocolClient(desktopDeepLinkScheme, process.execPath, [process.argv[1] ?? ''])
     return
   }
 
@@ -847,6 +914,34 @@ function handleDesktopDeepLink(rawUrl: string): void {
 
 function registerBridgeHandlers(): void {
   ipcMain.handle('desktop:ping', () => 'pong')
+  ipcMain.handle('desktop:version-info', () => ({
+    version: getDesktopAppVersion(),
+    channel: getDesktopReleaseChannel(),
+  }))
+  safeHandle('desktop:check-client-release', () => checkCurrentDesktopClientRelease())
+  safeHandle('desktop:client-release-download-url', () =>
+    resolveCurrentDesktopClientReleaseDownloadURL(),
+  )
+  safeHandle('desktop:quit-app', async () => {
+    app.quit()
+    return null
+  })
+  safeHandle('desktop:start-client-update', async () => {
+    const snapshot = getRuntimeControllerSnapshot()
+    if (!snapshot.session?.client_token) {
+      throw new Error('desktop_client_not_registered')
+    }
+
+    return startDesktopClientUpdate({
+      platform: desktopReleasePlatform(),
+      arch: desktopReleaseArch(),
+      channel: defaultDesktopUpdateChannel(snapshot.session.desktop_client?.channel),
+      notify: emitClientUpdateProgress,
+      beforeInstall: () => {
+        quitReleaseInFlight = true
+      },
+    })
+  })
   ipcMain.handle('desktop:device-info', () => resolveDesktopDeviceInfo())
   safeHandle(
     'desktop:client-id',

apps/desktop-client/src/main/client-updater.ts

@@ -0,0 +1,240 @@
+import { autoUpdater, type ProgressInfo, type UpdateDownloadedEvent } from 'electron-updater'
+import { app } from 'electron/main'
+
+import { getDesktopAppVersion, getDesktopReleaseChannel } from './app-version'
+import { resolveDesktopApiURL } from './transport/api-client'
+
+export type DesktopClientUpdateStage =
+  | 'idle'
+  | 'checking'
+  | 'downloading'
+  | 'downloaded'
+  | 'installing'
+  | 'not-available'
+  | 'error'
+
+export interface DesktopClientUpdateProgressEvent {
+  stage: DesktopClientUpdateStage
+  percent: number | null
+  transferred: number | null
+  total: number | null
+  bytesPerSecond: number | null
+  version: string | null
+  message?: string
+}
+
+export interface DesktopClientUpdateResult {
+  update_available: boolean
+  version: string | null
+  stage: DesktopClientUpdateStage
+}
+
+interface StartDesktopClientUpdateOptions {
+  platform: string
+  arch: string
+  channel: string
+  notify: (event: DesktopClientUpdateProgressEvent) => void
+  beforeInstall?: () => void
+}
+
+let updateInFlight: Promise<DesktopClientUpdateResult> | null = null
+let updaterConfigured = false
+let downloadedVersion: string | null = null
+let progressNotifier: StartDesktopClientUpdateOptions['notify'] | null = null
+
+function encodeFeedPathSegment(value: string): string {
+  return encodeURIComponent(value.trim())
+}
+
+function updaterFeedURL(options: StartDesktopClientUpdateOptions): string {
+  return resolveDesktopApiURL(
+    [
+      '/api/desktop/releases/updater',
+      encodeFeedPathSegment(options.platform),
+      encodeFeedPathSegment(options.arch),
+      encodeFeedPathSegment(options.channel),
+      encodeFeedPathSegment(getDesktopAppVersion()),
+      '',
+    ].join('/'),
+  )
+}
+
+function emitProgress(
+  notify: StartDesktopClientUpdateOptions['notify'] | null,
+  event: DesktopClientUpdateProgressEvent,
+): void {
+  notify?.(event)
+}
+
+function updaterErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
+function isCodeSignatureValidationError(message: string): boolean {
+  return (
+    message.includes('Code signature') ||
+    message.includes('did not pass validation') ||
+    message.includes('代码未能满足指定的代码要求') ||
+    message.includes('code requirements')
+  )
+}
+
+function normalizeUpdaterError(error: unknown): string {
+  const message = updaterErrorMessage(error)
+  if (isCodeSignatureValidationError(message)) {
+    return 'desktop_client_update_signature_validation_failed'
+  }
+  return message || 'desktop_client_update_failed'
+}
+
+function configureUpdater(options: StartDesktopClientUpdateOptions): void {
+  progressNotifier = options.notify
+  autoUpdater.autoDownload = false
+  autoUpdater.autoInstallOnAppQuit = false
+  autoUpdater.disableDifferentialDownload = true
+  autoUpdater.allowDowngrade = false
+  autoUpdater.allowPrerelease = options.channel !== 'stable'
+  autoUpdater.channel = null
+  autoUpdater.logger = console
+  autoUpdater.setFeedURL({
+    provider: 'generic',
+    url: updaterFeedURL(options),
+    channel: 'latest',
+  })
+
+  if (updaterConfigured) {
+    return
+  }
+  updaterConfigured = true
+
+  autoUpdater.on('download-progress', (info: ProgressInfo) => {
+    emitProgress(progressNotifier, {
+      stage: 'downloading',
+      percent: Number.isFinite(info.percent) ? info.percent : null,
+      transferred: Number.isFinite(info.transferred) ? info.transferred : null,
+      total: Number.isFinite(info.total) ? info.total : null,
+      bytesPerSecond: Number.isFinite(info.bytesPerSecond) ? info.bytesPerSecond : null,
+      version: downloadedVersion,
+    })
+  })
+
+  autoUpdater.on('update-downloaded', (event: UpdateDownloadedEvent) => {
+    downloadedVersion = event.version
+    emitProgress(progressNotifier, {
+      stage: 'downloaded',
+      percent: 100,
+      transferred: null,
+      total: null,
+      bytesPerSecond: null,
+      version: event.version,
+      message: 'update_downloaded',
+    })
+  })
+
+  autoUpdater.on('error', (error) => {
+    console.warn('[desktop-updater] update failed', error)
+    emitProgress(progressNotifier, {
+      stage: 'error',
+      percent: null,
+      transferred: null,
+      total: null,
+      bytesPerSecond: null,
+      version: downloadedVersion,
+      message: normalizeUpdaterError(error),
+    })
+  })
+}
+
+export function startDesktopClientUpdate(
+  options: StartDesktopClientUpdateOptions,
+): Promise<DesktopClientUpdateResult> {
+  if (updateInFlight) {
+    return updateInFlight
+  }
+
+  updateInFlight = runDesktopClientUpdate(options).finally(() => {
+    updateInFlight = null
+  })
+  return updateInFlight
+}
+
+async function runDesktopClientUpdate(
+  options: StartDesktopClientUpdateOptions,
+): Promise<DesktopClientUpdateResult> {
+  if (!app.isPackaged && process.env.DESKTOP_ALLOW_DEV_UPDATER !== '1') {
+    throw new Error('desktop_update_requires_packaged_app')
+  }
+
+  downloadedVersion = null
+  configureUpdater(options)
+
+  emitProgress(options.notify, {
+    stage: 'checking',
+    percent: null,
+    transferred: null,
+    total: null,
+    bytesPerSecond: null,
+    version: null,
+  })
+
+  let checkResult
+  try {
+    checkResult = await autoUpdater.checkForUpdates()
+  } catch (error) {
+    throw new Error(normalizeUpdaterError(error))
+  }
+  if (!checkResult?.isUpdateAvailable) {
+    emitProgress(options.notify, {
+      stage: 'not-available',
+      percent: null,
+      transferred: null,
+      total: null,
+      bytesPerSecond: null,
+      version: checkResult?.updateInfo.version ?? null,
+    })
+    return {
+      update_available: false,
+      version: checkResult?.updateInfo.version ?? null,
+      stage: 'not-available',
+    }
+  }
+
+  downloadedVersion = checkResult.updateInfo.version
+  emitProgress(options.notify, {
+    stage: 'downloading',
+    percent: 0,
+    transferred: 0,
+    total: null,
+    bytesPerSecond: null,
+    version: checkResult.updateInfo.version,
+  })
+
+  try {
+    await autoUpdater.downloadUpdate(checkResult.cancellationToken)
+  } catch (error) {
+    throw new Error(normalizeUpdaterError(error))
+  }
+  emitProgress(options.notify, {
+    stage: 'installing',
+    percent: 100,
+    transferred: null,
+    total: null,
+    bytesPerSecond: null,
+    version: checkResult.updateInfo.version,
+  })
+
+  setTimeout(() => {
+    options.beforeInstall?.()
+    autoUpdater.quitAndInstall(process.platform === 'win32', true)
+  }, 250)
+
+  return {
+    update_available: true,
+    version: checkResult.updateInfo.version,
+    stage: 'installing',
+  }
+}
+
+export function defaultDesktopUpdateChannel(clientChannel: string | null | undefined): string {
+  return clientChannel?.trim() || getDesktopReleaseChannel()
+}

apps/desktop-client/src/main/runtime-controller.ts

@@ -54,6 +54,7 @@ import {
   type MonitorAdapter,
   type PublishAdapter,
 } from './adapters'
+import { getDesktopAppVersion, getDesktopReleaseChannel } from './app-version'
 import {
   getLeaseManagerSnapshot,
   noteLeaseExtended,
@@ -1096,8 +1097,8 @@ async function sendHeartbeat(source: 'startup' | 'timer'): Promise<void> {
       device_name: hostname() || state.client?.device_name || `Desktop ${process.platform}`,
       os: process.platform,
       cpu_arch: process.arch,
-      client_version: state.client?.client_version ?? '0.1.0-dev',
-      channel: state.client?.channel ?? 'dev',
+      client_version: getDesktopAppVersion(),
+      channel: state.client?.channel ?? getDesktopReleaseChannel(),
       startup: source === 'startup',
       account_ids: state.accounts
         .filter((account) => shouldReportAccountPresence(account))

apps/desktop-client/src/main/transport/api-client.ts

@@ -13,6 +13,7 @@ import type {
   DesktopArticleContent,
   DesktopClientHeartbeatRequest,
   DesktopClientHeartbeatResponse,
+  DesktopClientReleaseCheckResponse,
   DesktopClientRotateResponse,
   DesktopPublishTaskListResponse,
   DesktopRuntimeSessionSyncRequest,
@@ -35,13 +36,13 @@ import type {
 } from '@geo/shared-types'
 import { app } from 'electron/main'
 
+import { normalizeDesktopApiBaseURL } from '../../shared/api-base-url'
 import {
   failObservedRequest,
   resolveObservedRequest,
   startObservedRequest,
 } from '../network-observer'
 import { canUseRendererDevtoolsProxy, rendererDevtoolsFetch } from '../renderer-devtools-proxy'
-import { normalizeDesktopApiBaseURL } from '../../shared/api-base-url'
 
 type TransportAuthState = 'pending' | 'registered' | 'expired'
 type TransportDispatchState = 'idle' | 'connecting' | 'streaming'
@@ -225,10 +226,7 @@ function normalizeErrorForDiagnostics(error: unknown): Record<string, unknown> {
   }
 }
 
-function appendAccountUpsertDiagnostic(
-  payload: UpsertDesktopAccountRequest,
-  error: unknown,
-): void {
+function appendAccountUpsertDiagnostic(payload: UpsertDesktopAccountRequest, error: unknown): void {
   const target = join(app.getPath('userData'), ACCOUNT_UPSERT_DIAGNOSTIC_FILE)
   const event = {
     at: new Date().toISOString(),
@@ -514,6 +512,44 @@ export async function rotateDesktopClient(): Promise<DesktopClientRotateResponse
   )
 }
 
+export async function checkDesktopClientRelease(params: {
+  platform: string
+  arch: string
+  version: string
+  channel?: string
+}): Promise<DesktopClientReleaseCheckResponse> {
+  const search = new URLSearchParams({
+    platform: params.platform,
+    arch: params.arch,
+    version: params.version,
+  })
+  if (params.channel?.trim()) {
+    search.set('channel', params.channel.trim())
+  }
+  return desktopGet<DesktopClientReleaseCheckResponse>(
+    `/api/desktop/clients/releases/latest?${search.toString()}`,
+  )
+}
+
+export async function resolveDesktopClientReleaseDownloadURL(params: {
+  platform: string
+  arch: string
+  version: string
+  channel?: string
+}): Promise<{ download_url: string; expires_in?: number | null }> {
+  const search = new URLSearchParams({
+    platform: params.platform,
+    arch: params.arch,
+    version: params.version,
+  })
+  if (params.channel?.trim()) {
+    search.set('channel', params.channel.trim())
+  }
+  return desktopGet<{ download_url: string; expires_in?: number | null }>(
+    `/api/desktop/clients/releases/download-url?${search.toString()}`,
+  )
+}
+
 export async function offlineDesktopClient(): Promise<void> {
   await desktopPost<{ server_time: string }, Record<string, never>>(
     '/api/desktop/clients/offline',

apps/desktop-client/src/preload/bridge.ts

@@ -1,7 +1,10 @@
 import type {
   CreatePublishJobResponse,
   DesktopAccountInfo,
+  DesktopClientReleaseCheckResponse,
   DesktopClientRotateResponse,
+  DesktopClientUpdateProgressEvent,
+  DesktopClientUpdateResult,
   DesktopPublishTaskListResponse,
   DesktopRuntimeSessionSyncRequest,
   ListDesktopPublishTasksParams,
@@ -17,6 +20,11 @@ interface DesktopDeviceInfo {
   cpu_arch: string
 }
 
+interface DesktopAppVersionInfo {
+  version: string
+  channel: string
+}
+
 interface DesktopClientIDScope {
   tenant_id: number
   workspace_id: number
@@ -115,6 +123,18 @@ if (import.meta.env.DEV) {
 const desktopBridge = {
   app: {
     ping: () => ipcRenderer.invoke('desktop:ping') as Promise<string>,
+    versionInfo: () => ipcRenderer.invoke('desktop:version-info') as Promise<DesktopAppVersionInfo>,
+    checkClientRelease: () =>
+      ipcRenderer.invoke(
+        'desktop:check-client-release',
+      ) as Promise<DesktopClientReleaseCheckResponse>,
+    clientReleaseDownloadURL: () =>
+      ipcRenderer.invoke('desktop:client-release-download-url') as Promise<{
+        download_url: string
+      }>,
+    quitApp: () => ipcRenderer.invoke('desktop:quit-app') as Promise<null>,
+    startClientUpdate: () =>
+      ipcRenderer.invoke('desktop:start-client-update') as Promise<DesktopClientUpdateResult>,
     deviceInfo: () => ipcRenderer.invoke('desktop:device-info') as Promise<DesktopDeviceInfo>,
     clientId: (scope: DesktopClientIDScope) =>
       ipcRenderer.invoke('desktop:client-id', scope) as Promise<string>,
@@ -153,11 +173,14 @@ const desktopBridge = {
     getAppSettings: () =>
       ipcRenderer.invoke('desktop:get-app-settings') as Promise<DesktopAppSettings>,
     getLoginCredentials: () =>
-      ipcRenderer.invoke('desktop:get-login-credentials') as Promise<DesktopLoginCredentials | null>,
+      ipcRenderer.invoke(
+        'desktop:get-login-credentials',
+      ) as Promise<DesktopLoginCredentials | null>,
     saveLoginCredentials: (credentials: DesktopLoginCredentials) =>
-      ipcRenderer.invoke('desktop:save-login-credentials', credentials) as Promise<
-        DesktopLoginCredentials
-      >,
+      ipcRenderer.invoke(
+        'desktop:save-login-credentials',
+        credentials,
+      ) as Promise<DesktopLoginCredentials>,
     clearLoginCredentials: () =>
       ipcRenderer.invoke('desktop:clear-login-credentials') as Promise<null>,
     setAppSetting: (key: keyof DesktopAppSettings, value: boolean) =>
@@ -205,6 +228,15 @@ const desktopBridge = {
         ipcRenderer.off('desktop:network-observed', wrapped)
       }
     },
+    onClientUpdateProgress: (listener: (event: DesktopClientUpdateProgressEvent) => void) => {
+      const wrapped = (_event: IpcRendererEvent, payload: DesktopClientUpdateProgressEvent) => {
+        listener(payload)
+      }
+      ipcRenderer.on('desktop:client-update-progress', wrapped)
+      return () => {
+        ipcRenderer.off('desktop:client-update-progress', wrapped)
+      }
+    },
   },
   workbenchNavigation: {
     getState: () =>
@@ -212,8 +244,7 @@ const desktopBridge = {
         'desktop:workbench-navigation:get-state',
       ) as Promise<WorkbenchNavigationState>,
     goBack: () => ipcRenderer.invoke('desktop:workbench-navigation:go-back') as Promise<null>,
-    goForward: () =>
-      ipcRenderer.invoke('desktop:workbench-navigation:go-forward') as Promise<null>,
+    goForward: () => ipcRenderer.invoke('desktop:workbench-navigation:go-forward') as Promise<null>,
     reload: () => ipcRenderer.invoke('desktop:workbench-navigation:reload') as Promise<null>,
     onStateChanged: (listener: (state: WorkbenchNavigationState) => void) => {
       const wrapped = (_event: IpcRendererEvent, payload: WorkbenchNavigationState) => {

apps/desktop-client/src/renderer/components/DesktopShell.vue

@@ -1,15 +1,17 @@
 <script setup lang="ts">
 import {
   AppstoreOutlined,
+  DownloadOutlined,
   LinkOutlined,
   LogoutOutlined,
   RobotOutlined,
   SendOutlined,
   SettingOutlined,
 } from '@ant-design/icons-vue'
-import { computed } from 'vue'
+import { computed, onMounted, ref, watch } from 'vue'
 import { RouterLink, RouterView, useRoute } from 'vue-router'
 
+import { useClientRelease } from '../composables/useClientRelease'
 import { useDesktopRuntime } from '../composables/useDesktopRuntime'
 import { useDesktopSession } from '../composables/useDesktopSession'
 import { desktopMonitoringMediaCatalog, desktopPublishMediaCatalog } from '../lib/media-catalog'
@@ -17,6 +19,21 @@ import { desktopMonitoringMediaCatalog, desktopPublishMediaCatalog } from '../li
 const route = useRoute()
 const { snapshot, error, refreshAccounts } = useDesktopRuntime()
 const { session, logout } = useDesktopSession()
+const {
+  check: checkClientRelease,
+  startUpdate: startClientUpdate,
+  openManualDownload,
+  updateProgress,
+  updateError,
+  updateManualDownloadRequired,
+  manualDownloadLoading,
+  updating,
+} = useClientRelease()
+let hasCheckedClientRelease = false
+const updateModalOpen = ref(false)
+const updateModalVersion = ref('')
+const updateModalForce = ref(false)
+const updateModalStarted = ref(false)
 
 const accountAwareRoutes = new Set(['/media-platforms', '/ai-platforms'])
 
@@ -66,12 +83,7 @@ const navItems = computed(() => {
 
 const operatorName = computed(() => {
   const user = session.value?.user
-  return (
-    user?.name?.trim() ||
-    user?.phone?.trim() ||
-    user?.email?.trim() ||
-    '未命名操作员'
-  )
+  return user?.name?.trim() || user?.phone?.trim() || user?.email?.trim() || '未命名操作员'
 })
 const operatorEmail = computed(() => {
   const user = session.value?.user
@@ -87,10 +99,131 @@ const clientLabel = computed(
   () =>
     liveClientLabel.value ?? session.value?.desktopClient?.device_name ?? '当前设备尚未注册 client',
 )
+const updateProgressPercent = computed(() => {
+  const percent = updateProgress.value?.percent
+  if (typeof percent !== 'number' || !Number.isFinite(percent)) {
+    return null
+  }
+  return Math.max(0, Math.min(100, Math.round(percent)))
+})
+const updateProgressLabel = computed(() => {
+  if (isUpdateFailed.value) {
+    return '热更新失败，请去官网更新'
+  }
+  switch (updateProgress.value?.stage) {
+    case 'checking':
+      return '正在准备更新'
+    case 'downloading':
+      return updateProgressPercent.value === null
+        ? '正在下载更新'
+        : `正在下载 ${updateProgressPercent.value}%`
+    case 'downloaded':
+      return '下载完成，准备安装'
+    case 'installing':
+      return '正在重启安装'
+    case 'not-available':
+      return '当前已是最新版本'
+    default:
+      return updateModalStarted.value ? '正在准备更新' : ''
+  }
+})
+const isUpdateFailed = computed(() => Boolean(updateError.value))
+const updateProgressBarPercent = computed(() => {
+  if (!updateModalStarted.value) {
+    return 0
+  }
+  if (updateProgress.value?.stage === 'checking') {
+    return 8
+  }
+  if (updateProgress.value?.stage === 'downloaded' || updateProgress.value?.stage === 'installing') {
+    return 100
+  }
+  return updateProgressPercent.value ?? 8
+})
+const updatePrimaryLabel = computed(() => {
+  if (!updateModalStarted.value) {
+    return '立即更新'
+  }
+  if (updating.value) {
+    return '更新中'
+  }
+  return updateError.value ? '重试更新' : '立即更新'
+})
+const updateModalEyebrow = computed(() => {
+  if (isUpdateFailed.value) {
+    return '热更新失败'
+  }
+  return updateModalForce.value ? '必须更新' : '发现新版本'
+})
+const updateModalTitle = computed(() => {
+  if (isUpdateFailed.value) {
+    return '热更新失败，请去官网更新'
+  }
+  return '发现新的客户端版本'
+})
+const updateModalDescription = computed(() => {
+  if (isUpdateFailed.value) {
+    return `最新版本 ${updateModalVersion.value} 已可下载，请前往官网下载安装包后手动更新。`
+  }
+  return `最新版本 ${updateModalVersion.value} 已可下载。自动更新失败时会打开官网下载地址。`
+})
 
 function openSettingsWindow() {
   void window.desktopBridge.app.openSettingsWindow()
 }
+
+async function startClientReleaseUpdate() {
+  updateModalStarted.value = true
+  const updated = await startClientUpdate()
+  if (updated) {
+    return
+  }
+}
+
+function notifyClientUpdate(latestVersion: string, forceUpdate: boolean) {
+  updateModalVersion.value = latestVersion
+  updateModalForce.value = forceUpdate
+  updateModalStarted.value = false
+  updateModalOpen.value = true
+}
+
+function closeUpdateModal() {
+  if (isUpdateFailed.value || updateModalForce.value || updating.value) {
+    return
+  }
+  updateModalOpen.value = false
+}
+
+function openUpdateManualDownload() {
+  void openManualDownload()
+}
+
+function quitApp() {
+  void window.desktopBridge.app.quitApp()
+}
+
+async function checkClientReleaseOnce() {
+  if (hasCheckedClientRelease || !session.value?.clientToken) {
+    return
+  }
+  hasCheckedClientRelease = true
+  const result = await checkClientRelease('silent')
+  if (!result?.update_available) {
+    return
+  }
+  notifyClientUpdate(result.latest_version, result.force_update)
+}
+
+onMounted(() => {
+  void checkClientReleaseOnce()
+})
+
+watch(
+  () => session.value?.clientToken,
+  () => {
+    void checkClientReleaseOnce()
+  },
+)
 </script>
 
 <template>
@@ -172,6 +305,89 @@ function openSettingsWindow() {
       <div class="content-dragbar" aria-hidden="true"></div>
       <RouterView />
     </main>
+
+    <a-modal
+      v-model:open="updateModalOpen"
+      :closable="!isUpdateFailed && !updateModalForce && !updating"
+      :mask-closable="!isUpdateFailed && !updateModalForce && !updating"
+      :keyboard="!isUpdateFailed && !updateModalForce && !updating"
+      :footer="null"
+      width="520px"
+      centered
+      class="client-update-modal"
+      @cancel="closeUpdateModal"
+    >
+      <section class="client-update-dialog">
+        <div class="client-update-dialog__mark">
+          <DownloadOutlined />
+        </div>
+        <div class="client-update-dialog__copy">
+          <span>{{ updateModalEyebrow }}</span>
+          <h2>{{ updateModalTitle }}</h2>
+          <p>{{ updateModalDescription }}</p>
+          <button
+            v-if="isUpdateFailed"
+            type="button"
+            class="client-update-link-button"
+            :disabled="manualDownloadLoading"
+            @click="openUpdateManualDownload"
+          >
+            <DownloadOutlined />
+            {{ manualDownloadLoading ? '正在打开更新包链接' : '打开更新包链接' }}
+          </button>
+        </div>
+
+        <div v-if="updateModalStarted && !isUpdateFailed" class="client-update-progress">
+          <div class="client-update-progress__meta">
+            <strong>{{ updateProgressLabel }}</strong>
+            <span v-if="updateProgressPercent !== null">{{ updateProgressPercent }}%</span>
+          </div>
+          <div class="client-update-progress__bar">
+            <span :style="{ width: `${updateProgressBarPercent}%` }"></span>
+          </div>
+        </div>
+
+        <div class="client-update-dialog__actions">
+          <button
+            v-if="isUpdateFailed"
+            type="button"
+            class="client-update-button client-update-button--primary"
+            @click="quitApp"
+          >
+            退出
+          </button>
+          <button
+            v-else-if="!updateModalForce"
+            type="button"
+            class="client-update-button client-update-button--ghost"
+            :disabled="updating"
+            @click="closeUpdateModal"
+          >
+            稍后
+          </button>
+          <button
+            v-if="!isUpdateFailed && updateManualDownloadRequired"
+            type="button"
+            class="client-update-button client-update-button--ghost"
+            :disabled="manualDownloadLoading"
+            @click="openUpdateManualDownload"
+          >
+            <DownloadOutlined />
+            {{ manualDownloadLoading ? '打开中' : '官网下载' }}
+          </button>
+          <button
+            v-if="!isUpdateFailed"
+            type="button"
+            class="client-update-button client-update-button--primary"
+            :disabled="updating"
+            @click="startClientReleaseUpdate"
+          >
+            <DownloadOutlined />
+            {{ updatePrimaryLabel }}
+          </button>
+        </div>
+      </section>
+    </a-modal>
   </div>
 </template>
 
@@ -548,6 +764,195 @@ h1 {
   z-index: 5;
 }
 
+:global(.client-update-modal .ant-modal-content) {
+  overflow: hidden;
+  border-radius: 12px;
+  padding: 0;
+  box-shadow:
+    0 22px 48px rgba(15, 23, 42, 0.18),
+    0 8px 18px rgba(15, 23, 42, 0.08);
+}
+
+:global(.client-update-modal .ant-modal-close) {
+  top: 18px;
+  right: 18px;
+}
+
+.client-update-dialog {
+  display: flex;
+  flex-direction: column;
+  gap: 22px;
+  padding: 34px 36px 30px;
+  background: #ffffff;
+}
+
+.client-update-dialog__mark {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 42px;
+  height: 42px;
+  border-radius: 8px;
+  background: #e6f4ff;
+  color: #1677ff;
+  font-size: 20px;
+}
+
+.client-update-dialog__copy {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+}
+
+.client-update-dialog__copy span {
+  color: #1677ff;
+  font-size: 13px;
+  font-weight: 800;
+}
+
+.client-update-dialog__copy h2 {
+  margin: 0;
+  color: #111827;
+  font-size: 24px;
+  font-weight: 800;
+  line-height: 1.25;
+}
+
+.client-update-dialog__copy p {
+  margin: 0;
+  color: #374151;
+  font-size: 16px;
+  font-weight: 600;
+  line-height: 1.75;
+}
+
+.client-update-link-button {
+  align-self: flex-start;
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  min-height: 36px;
+  padding: 0 0 2px;
+  border: 0;
+  border-bottom: 2px solid rgba(22, 119, 255, 0.28);
+  background: transparent;
+  color: #1677ff;
+  cursor: pointer;
+  font-size: 15px;
+  font-weight: 800;
+  transition:
+    border-color 0.2s ease,
+    color 0.2s ease,
+    opacity 0.2s ease;
+}
+
+.client-update-link-button:disabled {
+  cursor: not-allowed;
+  opacity: 0.6;
+}
+
+.client-update-link-button:not(:disabled):hover {
+  border-color: #1677ff;
+  color: #0958d9;
+}
+
+.client-update-progress {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+}
+
+.client-update-progress__meta {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  color: #64748b;
+  font-size: 13px;
+}
+
+.client-update-progress__meta strong {
+  min-width: 0;
+  color: #334155;
+  font-size: 13px;
+  font-weight: 800;
+}
+
+.client-update-progress__meta span {
+  color: #1677ff;
+  font-weight: 800;
+}
+
+.client-update-progress__bar {
+  height: 8px;
+  overflow: hidden;
+  border-radius: 999px;
+  background: #eef2f7;
+}
+
+.client-update-progress__bar span {
+  display: block;
+  width: 0;
+  height: 100%;
+  border-radius: inherit;
+  background: #1677ff;
+  transition: width 0.2s ease;
+}
+
+.client-update-dialog__actions {
+  display: flex;
+  justify-content: flex-end;
+  align-items: center;
+  gap: 12px;
+}
+
+.client-update-button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  min-width: 104px;
+  height: 40px;
+  padding: 0 18px;
+  border-radius: 8px;
+  cursor: pointer;
+  font-size: 15px;
+  font-weight: 800;
+  transition:
+    background 0.2s ease,
+    border-color 0.2s ease,
+    color 0.2s ease,
+    opacity 0.2s ease;
+}
+
+.client-update-button:disabled {
+  cursor: not-allowed;
+  opacity: 0.62;
+}
+
+.client-update-button--primary {
+  border: 1px solid #1677ff;
+  background: #1677ff;
+  color: #ffffff;
+}
+
+.client-update-button--primary:not(:disabled):hover {
+  background: #0958d9;
+  border-color: #0958d9;
+}
+
+.client-update-button--ghost {
+  border: 1px solid #dbe3ee;
+  background: #ffffff;
+  color: #475569;
+}
+
+.client-update-button--ghost:not(:disabled):hover {
+  border-color: #b6cff5;
+  color: #1677ff;
+  background: #f8fbff;
+}
+
 @media (max-width: 1080px) {
   .sidebar {
     width: 260px;

apps/desktop-client/src/renderer/composables/useClientRelease.ts

@@ -0,0 +1,194 @@
+import type {
+  DesktopClientReleaseCheckResponse,
+  DesktopClientUpdateProgressEvent,
+} from '@geo/shared-types'
+import { computed, readonly, ref } from 'vue'
+
+type CheckMode = 'manual' | 'silent'
+
+const release = ref<DesktopClientReleaseCheckResponse | null>(null)
+const loading = ref(false)
+const error = ref<string | null>(null)
+const lastCheckedAt = ref<number | null>(null)
+const updateProgress = ref<DesktopClientUpdateProgressEvent | null>(null)
+const updateError = ref<string | null>(null)
+const updateManualDownloadRequired = ref(false)
+const manualDownloadLoading = ref(false)
+let inFlight: Promise<DesktopClientReleaseCheckResponse | null> | null = null
+let updateInFlight: Promise<boolean> | null = null
+let progressListenerRegistered = false
+
+const MANUAL_DOWNLOAD_UPDATE_ERROR = '自动更新包校验失败，请前往官网下载最新版客户端'
+
+function normalizeReleaseError(err: unknown): string {
+  const message = err instanceof Error ? err.message : String(err)
+  if (message.includes('desktop_client_not_registered')) {
+    return '当前客户端尚未注册'
+  }
+  if (message.includes('desktop_client_release_not_configured')) {
+    return '暂未配置当前平台版本'
+  }
+  return message || '版本检查失败'
+}
+
+async function check(
+  mode: CheckMode = 'manual',
+): Promise<DesktopClientReleaseCheckResponse | null> {
+  if (inFlight) {
+    return inFlight
+  }
+
+  loading.value = true
+  if (mode === 'manual') {
+    error.value = null
+  }
+
+  inFlight = window.desktopBridge.app
+    .checkClientRelease()
+    .then((result) => {
+      release.value = result
+      error.value = null
+      lastCheckedAt.value = Date.now()
+      return result
+    })
+    .catch((err: unknown) => {
+      const message = normalizeReleaseError(err)
+      if (mode === 'manual') {
+        error.value = message
+      }
+      return null
+    })
+    .finally(() => {
+      loading.value = false
+      inFlight = null
+    })
+
+  return inFlight
+}
+
+function clearReleaseCheck(): void {
+  release.value = null
+  error.value = null
+  lastCheckedAt.value = null
+}
+
+function normalizeUpdateError(err: unknown): string {
+  const message = err instanceof Error ? err.message : String(err)
+  if (requiresManualDownload(message)) {
+    return MANUAL_DOWNLOAD_UPDATE_ERROR
+  }
+  if (message.includes('desktop_update_requires_packaged_app')) {
+    return '自动更新需要在打包后的客户端中执行'
+  }
+  if (message.includes('desktop_client_release_missing_sha256')) {
+    return '自动更新需要先配置安装包 SHA256'
+  }
+  if (message.includes('desktop_client_update_package_not_supported')) {
+    return '当前安装包格式不支持自动更新'
+  }
+  return message || '自动更新失败'
+}
+
+function requiresManualDownload(message: string): boolean {
+  return (
+    message.includes('desktop_client_update_signature_validation_failed') ||
+    message.includes('Code signature') ||
+    message.includes('did not pass validation') ||
+    message.includes('代码未能满足指定的代码要求')
+  )
+}
+
+function ensureProgressListener(): void {
+  if (progressListenerRegistered) {
+    return
+  }
+  progressListenerRegistered = true
+  window.desktopBridge.app.onClientUpdateProgress((event) => {
+    updateProgress.value = event
+    if (event.stage === 'error') {
+      const message = event.message ?? '自动更新失败'
+      updateManualDownloadRequired.value = requiresManualDownload(message)
+      updateError.value = normalizeUpdateError(message)
+    }
+  })
+}
+
+async function startUpdate(): Promise<boolean> {
+  ensureProgressListener()
+  if (updateInFlight) {
+    return updateInFlight
+  }
+  updateError.value = null
+  updateManualDownloadRequired.value = false
+  updateProgress.value = {
+    stage: 'checking',
+    percent: null,
+    transferred: null,
+    total: null,
+    bytesPerSecond: null,
+    version: release.value?.latest_version ?? null,
+  }
+
+  updateInFlight = window.desktopBridge.app
+    .startClientUpdate()
+    .then((result) => result.update_available)
+    .catch((err: unknown) => {
+      const message = err instanceof Error ? err.message : String(err)
+      updateManualDownloadRequired.value = requiresManualDownload(message)
+      updateError.value = normalizeUpdateError(err)
+      return false
+    })
+    .finally(() => {
+      updateInFlight = null
+    })
+
+  return updateInFlight
+}
+
+async function openManualDownload(): Promise<boolean> {
+  if (manualDownloadLoading.value) {
+    return false
+  }
+  manualDownloadLoading.value = true
+  try {
+    const result = await window.desktopBridge.app.clientReleaseDownloadURL()
+    if (!result.download_url) {
+      updateError.value = '暂未配置官网下载地址'
+      return false
+    }
+    await window.desktopBridge.app.openExternalUrl(result.download_url)
+    return true
+  } catch (err: unknown) {
+    updateError.value = normalizeReleaseError(err)
+    return false
+  } finally {
+    manualDownloadLoading.value = false
+  }
+}
+
+export function useClientRelease() {
+  ensureProgressListener()
+  return {
+    release: readonly(release),
+    loading: readonly(loading),
+    error: readonly(error),
+    lastCheckedAt: readonly(lastCheckedAt),
+    updateProgress: readonly(updateProgress),
+    updateError: readonly(updateError),
+    updateManualDownloadRequired: readonly(updateManualDownloadRequired),
+    manualDownloadLoading: readonly(manualDownloadLoading),
+    updateAvailable: computed(() => release.value?.update_available === true),
+    forceUpdate: computed(() => release.value?.force_update === true),
+    updating: computed(
+      () =>
+        updateProgress.value?.stage === 'checking' ||
+        updateProgress.value?.stage === 'downloading' ||
+        updateProgress.value?.stage === 'downloaded' ||
+        updateProgress.value?.stage === 'installing',
+    ),
+    check,
+    startUpdate,
+    openManualDownload,
+    clearReleaseCheck,
+  }
+}

apps/desktop-client/src/renderer/composables/useDesktopSession.ts

@@ -479,12 +479,28 @@ async function registerPayload(
   device?: ResolvedDeviceInfo,
 ): Promise<DesktopClientRegisterRequest> {
   const resolvedDevice = device ?? (await resolveDeviceInfo())
+  const versionInfo = await resolveVersionInfo()
   return {
     client_id: await resolveDesktopClientID(user),
     device_name: resolvedDevice.device_name,
     os: resolvedDevice.os,
     cpu_arch: resolvedDevice.cpu_arch,
-    client_version: '0.1.0-dev',
+    client_version: versionInfo.version,
+    channel: versionInfo.channel,
+  }
+}
+
+async function resolveVersionInfo(): Promise<{ version: string; channel: string }> {
+  try {
+    const info = await window.desktopBridge?.app?.versionInfo?.()
+    if (info?.version && info.channel) {
+      return info
+    }
+  } catch (err) {
+    console.warn('[desktop-session] versionInfo bridge failed', err)
+  }
+  return {
+    version: '0.1.0',
     channel: 'dev',
   }
 }
@@ -519,6 +535,7 @@ function createPreviewUser(): UserInfo {
 async function createPreviewClient(): Promise<DesktopClientInfo> {
   const now = new Date().toISOString()
   const device = await resolveDeviceInfo()
+  const versionInfo = await resolveVersionInfo()
   return {
     id: 'preview-client',
     tenant_id: 0,
@@ -527,8 +544,8 @@ async function createPreviewClient(): Promise<DesktopClientInfo> {
     device_name: `Preview ${device.device_name}`,
     os: device.os,
     cpu_arch: device.cpu_arch,
-    client_version: '0.1.0-preview',
-    channel: 'dev',
+    client_version: versionInfo.version,
+    channel: versionInfo.channel,
     created_at: now,
     last_seen_at: now,
     last_rotated_at: now,

apps/desktop-client/src/renderer/env.d.ts

@@ -1,6 +1,9 @@
 import type {
   CreatePublishJobResponse,
   DesktopAccountInfo,
+  DesktopClientReleaseCheckResponse,
+  DesktopClientUpdateProgressEvent,
+  DesktopClientUpdateResult,
   DesktopClientRotateResponse,
   DesktopPublishTaskListResponse,
   DesktopRuntimeSessionSyncRequest,
@@ -36,6 +39,14 @@ declare global {
     desktopBridge: {
       app: {
         ping(): Promise<string>
+        versionInfo(): Promise<{
+          version: string
+          channel: string
+        }>
+        checkClientRelease(): Promise<DesktopClientReleaseCheckResponse>
+        clientReleaseDownloadURL(): Promise<{ download_url: string }>
+        quitApp(): Promise<null>
+        startClientUpdate(): Promise<DesktopClientUpdateResult>
         deviceInfo(): Promise<{
           device_name: string
           os: string
@@ -70,9 +81,7 @@ declare global {
         openSettingsWindow(): Promise<null>
         getAppSettings(): Promise<DesktopAppSettings>
         getLoginCredentials(): Promise<DesktopLoginCredentials | null>
-        saveLoginCredentials(
-          credentials: DesktopLoginCredentials,
-        ): Promise<DesktopLoginCredentials>
+        saveLoginCredentials(credentials: DesktopLoginCredentials): Promise<DesktopLoginCredentials>
         clearLoginCredentials(): Promise<null>
         setAppSetting(key: keyof DesktopAppSettings, value: boolean): Promise<DesktopAppSettings>
         syncRuntimeSession(session: DesktopRuntimeSessionSyncRequest | null): Promise<null>
@@ -94,6 +103,9 @@ declare global {
           }) => void,
         ): () => void
         onNetworkObserved(listener: (event: DesktopObservedRequest) => void): () => void
+        onClientUpdateProgress(
+          listener: (event: DesktopClientUpdateProgressEvent) => void,
+        ): () => void
       }
       workbenchNavigation: {
         getState(): Promise<WorkbenchNavigationState>

apps/desktop-client/src/renderer/views/SettingsView.vue

@@ -1,17 +1,36 @@
 <script setup lang="ts">
 import {
+  DownloadOutlined,
   InfoCircleOutlined,
   LoginOutlined,
   SlidersOutlined,
+  SyncOutlined,
   ToolOutlined,
 } from '@ant-design/icons-vue'
 import { computed, onMounted, ref, watch } from 'vue'
 
+import { useClientRelease } from '../composables/useClientRelease'
 import { useDesktopRuntime } from '../composables/useDesktopRuntime'
 import { DEFAULT_API_BASE_URL, useDesktopSession } from '../composables/useDesktopSession'
 
 const { snapshot } = useDesktopRuntime()
 const { apiBaseURL, setApiBaseURL } = useDesktopSession()
+const {
+  release: clientRelease,
+  loading: releaseLoading,
+  error: releaseError,
+  lastCheckedAt,
+  updateProgress,
+  updateError,
+  updateManualDownloadRequired,
+  manualDownloadLoading,
+  updateAvailable,
+  forceUpdate,
+  updating,
+  check: checkClientRelease,
+  startUpdate: startClientUpdate,
+  openManualDownload,
+} = useClientRelease()
 
 type SectionKey =
   | 'general'
@@ -54,6 +73,75 @@ const subsystemEntries = computed(() =>
 )
 
 const appVersion = computed(() => snapshot.value?.app.version ?? '0.1.0')
+const releaseCheckedAtLabel = computed(() => {
+  if (!lastCheckedAt.value) {
+    return ''
+  }
+  return new Date(lastCheckedAt.value).toLocaleString('zh-CN', {
+    hour12: false,
+  })
+})
+const releaseStateLabel = computed(() => {
+  if (releaseLoading.value) {
+    return '检查中'
+  }
+  if (releaseError.value) {
+    return '检查失败'
+  }
+  if (!clientRelease.value) {
+    return '未检查'
+  }
+  if (updateAvailable.value) {
+    return forceUpdate.value ? '必须更新' : '发现新版本'
+  }
+  return '已是最新'
+})
+const releaseDetail = computed(() => {
+  if (releaseError.value) {
+    return releaseError.value
+  }
+  if (!clientRelease.value) {
+    return '当前版本会按平台、架构和渠道匹配运营端配置'
+  }
+  if (updateAvailable.value) {
+    return `最新版本 ${clientRelease.value.latest_version}`
+  }
+  return `当前版本 ${clientRelease.value.current_version}`
+})
+const releaseSourceLabel = computed(() => {
+  if (!clientRelease.value) {
+    return ''
+  }
+  return clientRelease.value.download_source === 'oss' ? 'OSS 自动地址' : '自定义地址'
+})
+const updateProgressPercent = computed(() => {
+  const percent = updateProgress.value?.percent
+  if (typeof percent !== 'number' || !Number.isFinite(percent)) {
+    return null
+  }
+  return Math.max(0, Math.min(100, Math.round(percent)))
+})
+const updateProgressLabel = computed(() => {
+  if (updateError.value) {
+    return updateError.value
+  }
+  switch (updateProgress.value?.stage) {
+    case 'checking':
+      return '正在准备更新'
+    case 'downloading':
+      return updateProgressPercent.value === null
+        ? '正在下载更新'
+        : `正在下载 ${updateProgressPercent.value}%`
+    case 'downloaded':
+      return '下载完成，准备安装'
+    case 'installing':
+      return '正在重启安装'
+    case 'not-available':
+      return '当前已是最新版本'
+    default:
+      return ''
+  }
+})
 const hasServerSettingChanged = computed(
   () => normalizeServerURLInput(serverBaseURL.value) !== apiBaseURL.value,
 )
@@ -86,6 +174,21 @@ function openServiceTerms() {
   void window.desktopBridge.app.openExternalUrl('https://shengxintui.com/terms')
 }
 
+function checkReleaseManually() {
+  void checkClientRelease('manual')
+}
+
+async function openReleaseDownload() {
+  if (!clientRelease.value?.update_available) {
+    return
+  }
+  await startClientUpdate()
+}
+
+async function openOfficialDownload() {
+  await openManualDownload()
+}
+
 function normalizeServerURLInput(value: string): string {
   return value.trim() || DEFAULT_API_BASE_URL
 }
@@ -155,6 +258,7 @@ async function toggleAppSetting(key: keyof DesktopAppSettings) {
 
 onMounted(() => {
   void loadAppSettings()
+  void checkClientRelease('silent')
 })
 
 watch(apiBaseURL, (next) => {
@@ -192,7 +296,61 @@ watch(apiBaseURL, (next) => {
               <span class="brand-ring"></span>
               <span class="brand-core"></span>
             </div>
-            <strong>版本: {{ appVersion }}</strong>
+            <div class="about-version-copy">
+              <span>当前版本</span>
+              <strong>{{ appVersion }}</strong>
+            </div>
+          </div>
+
+          <div class="release-check-card">
+            <div class="release-check-copy">
+              <span class="release-state" :class="{ 'is-update': updateAvailable }">
+                {{ releaseStateLabel }}
+              </span>
+              <strong>{{ releaseDetail }}</strong>
+              <p v-if="clientRelease">
+                {{ releaseSourceLabel }}
+                <span v-if="releaseCheckedAtLabel">· {{ releaseCheckedAtLabel }}</span>
+              </p>
+              <p v-else>检查服务端配置的最新客户端版本和下载地址</p>
+            </div>
+            <div class="release-check-actions">
+              <button
+                type="button"
+                class="server-button"
+                :disabled="releaseLoading"
+                @click="checkReleaseManually"
+              >
+                <SyncOutlined />
+                {{ releaseLoading ? '检查中' : '检查更新' }}
+              </button>
+              <button
+                v-if="clientRelease && updateAvailable"
+                type="button"
+                class="server-button server-button--primary"
+                :disabled="updating"
+                @click="openReleaseDownload"
+              >
+                <DownloadOutlined />
+                {{ updating ? '更新中' : '立即更新' }}
+              </button>
+              <button
+                v-if="clientRelease && updateAvailable && updateManualDownloadRequired"
+                type="button"
+                class="server-button"
+                :disabled="manualDownloadLoading"
+                @click="openOfficialDownload"
+              >
+                <DownloadOutlined />
+                {{ manualDownloadLoading ? '打开中' : '官网下载' }}
+              </button>
+            </div>
+            <div v-if="updateProgressLabel" class="release-update-progress">
+              <div class="release-update-progress__bar">
+                <span :style="{ width: `${updateProgressPercent ?? 12}%` }"></span>
+              </div>
+              <p>{{ updateProgressLabel }}</p>
+            </div>
           </div>
 
           <footer class="about-footer">
@@ -398,7 +556,7 @@ watch(apiBaseURL, (next) => {
 .settings-heading h1 {
   margin: 0;
   color: #000000;
-  font-size:22px;
+  font-size: 22px;
   font-weight: 900;
   line-height: 1;
 }
@@ -412,6 +570,9 @@ watch(apiBaseURL, (next) => {
 
 .about-page {
   position: relative;
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
   min-height: 100%;
   padding: 28px 44px 108px;
 }
@@ -432,6 +593,19 @@ watch(apiBaseURL, (next) => {
   font-weight: 800;
 }
 
+.about-version-copy {
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+  gap: 5px;
+}
+
+.about-version-copy span {
+  color: #777777;
+  font-size: 13px;
+  font-weight: 700;
+}
+
 .about-logo {
   position: relative;
   display: grid;
@@ -460,6 +634,83 @@ watch(apiBaseURL, (next) => {
   box-shadow: 0 3px 8px rgba(22, 119, 255, 0.35);
 }
 
+.release-check-card {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto;
+  gap: 20px;
+  align-items: center;
+  padding: 22px 30px;
+  border-radius: 8px;
+  background: #ffffff;
+}
+
+.release-update-progress {
+  grid-column: 1 / -1;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+
+.release-update-progress__bar {
+  height: 6px;
+  overflow: hidden;
+  border-radius: 999px;
+  background: #eeeeef;
+}
+
+.release-update-progress__bar span {
+  display: block;
+  width: 0;
+  height: 100%;
+  border-radius: inherit;
+  background: #1677ff;
+  transition: width 0.2s ease;
+}
+
+.release-update-progress p {
+  margin: 0;
+  color: #777777;
+  font-size: 12px;
+  font-weight: 700;
+}
+
+.release-check-copy {
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+  gap: 7px;
+}
+
+.release-state {
+  color: #777777;
+  font-size: 13px;
+  font-weight: 800;
+}
+
+.release-state.is-update {
+  color: #d93025;
+}
+
+.release-check-copy strong {
+  color: #070707;
+  font-size: 16px;
+  font-weight: 850;
+}
+
+.release-check-copy p {
+  margin: 0;
+  color: #777777;
+  font-size: 13px;
+  font-weight: 600;
+}
+
+.release-check-actions {
+  display: inline-flex;
+  flex-wrap: wrap;
+  justify-content: flex-end;
+  gap: 8px;
+}
+
 .about-footer {
   position: absolute;
   left: 0;
@@ -580,6 +831,10 @@ watch(apiBaseURL, (next) => {
 }
 
 .server-button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
   height: 32px;
   padding: 0 14px;
   border: 0;
@@ -763,5 +1018,13 @@ watch(apiBaseURL, (next) => {
     grid-template-columns: 1fr;
     gap: 14px;
   }
+
+  .release-check-card {
+    grid-template-columns: 1fr;
+  }
+
+  .release-check-actions {
+    justify-content: flex-start;
+  }
 }
 </style>

apps/ops-web/src/layouts/AppShell.vue

@@ -50,12 +50,13 @@ import {
   AuditOutlined,
   BookOutlined,
   ClockCircleOutlined,
+  CloudDownloadOutlined,
   ControlOutlined,
   CrownOutlined,
   FileSearchOutlined,
   GlobalOutlined,
-  PartitionOutlined,
   LineChartOutlined,
+  PartitionOutlined,
   SafetyCertificateOutlined,
   SettingOutlined,
   TeamOutlined,
@@ -83,6 +84,7 @@ const menuLeaves: MenuLeaf[] = [
   { key: '/admin-users', label: '用户管理', path: '/admin-users' },
   { key: '/kol-subscriptions', label: '订阅包审批', path: '/kol-subscriptions' },
   { key: '/site-domain-mappings', label: '站点映射', path: '/site-domain-mappings' },
+  { key: '/desktop-client/releases', label: '客户端版本', path: '/desktop-client/releases' },
   { key: '/compliance/policy', label: '全局策略', path: '/compliance/policy' },
   { key: '/compliance/dictionaries', label: '合规词库', path: '/compliance/dictionaries' },
   { key: '/compliance/manual-reviews', label: '人工审阅', path: '/compliance/manual-reviews' },
@@ -110,6 +112,11 @@ const menuItems = computed<ItemType[]>(() => [
     label: '站点映射',
     icon: () => h(GlobalOutlined),
   },
+  {
+    key: '/desktop-client/releases',
+    label: '客户端版本',
+    icon: () => h(CloudDownloadOutlined),
+  },
   {
     key: 'compliance',
     label: '内容安全',

apps/ops-web/src/lib/desktop-client-releases.ts

@@ -0,0 +1,156 @@
+import { http } from '@/lib/http'
+
+export type DesktopReleasePlatform = 'darwin' | 'win32' | 'linux'
+export type DesktopReleaseArch = 'universal' | 'x64' | 'arm64' | 'ia32'
+export type DesktopReleaseSource = 'oss' | 'custom'
+
+export interface DesktopClientRelease {
+  id: number
+  platform: DesktopReleasePlatform
+  arch: DesktopReleaseArch
+  channel: string
+  version: string
+  min_supported_version?: string | null
+  download_source: DesktopReleaseSource
+  oss_object_key?: string | null
+  custom_download_url?: string | null
+  download_url?: string | null
+  file_name?: string | null
+  file_size_bytes?: number | null
+  sha256?: string | null
+  updater_download_source?: DesktopReleaseSource | null
+  updater_oss_object_key?: string | null
+  updater_custom_download_url?: string | null
+  updater_download_url?: string | null
+  updater_file_name?: string | null
+  updater_file_size_bytes?: number | null
+  updater_sha256?: string | null
+  release_notes?: string | null
+  force_update: boolean
+  enabled: boolean
+  published_at?: string | null
+  created_at: string
+  updated_at: string
+}
+
+export interface DesktopClientReleasePayload {
+  platform: DesktopReleasePlatform
+  arch: DesktopReleaseArch
+  channel: string
+  version: string
+  min_supported_version?: string | null
+  download_source: DesktopReleaseSource
+  oss_object_key?: string | null
+  custom_download_url?: string | null
+  file_name?: string | null
+  file_size_bytes?: number | null
+  sha256?: string | null
+  updater_download_source?: DesktopReleaseSource | null
+  updater_oss_object_key?: string | null
+  updater_custom_download_url?: string | null
+  updater_file_name?: string | null
+  updater_file_size_bytes?: number | null
+  updater_sha256?: string | null
+  release_notes?: string | null
+  force_update: boolean
+  enabled: boolean
+}
+
+export interface DesktopClientReleaseList {
+  items: DesktopClientRelease[]
+  total: number
+  page: number
+  size: number
+}
+
+export interface DesktopClientReleaseUploadResult {
+  oss_object_key: string
+  file_name: string
+  file_size_bytes: number
+  sha256: string
+}
+
+export interface DesktopClientReleaseDownloadURLResult {
+  download_url: string
+  expires_in?: number | null
+}
+
+export const platformOptions = [
+  { label: 'macOS', value: 'darwin' },
+  { label: 'Windows', value: 'win32' },
+  { label: 'Linux', value: 'linux' },
+]
+
+export const archOptions = [
+  { label: 'Universal', value: 'universal' },
+  { label: 'x64', value: 'x64' },
+  { label: 'arm64', value: 'arm64' },
+  { label: 'ia32', value: 'ia32' },
+]
+
+export const desktopClientReleaseApi = {
+  list(params: {
+    keyword?: string
+    platform?: string
+    channel?: string
+    enabled?: string
+    page?: number
+    size?: number
+  }) {
+    return http.get<DesktopClientReleaseList>('/desktop-client/releases', params)
+  },
+  create(payload: DesktopClientReleasePayload) {
+    return http.post<DesktopClientRelease, DesktopClientReleasePayload>(
+      '/desktop-client/releases',
+      payload,
+    )
+  },
+  update(id: number, payload: DesktopClientReleasePayload) {
+    return http.patch<DesktopClientRelease, DesktopClientReleasePayload>(
+      `/desktop-client/releases/${id}`,
+      payload,
+    )
+  },
+  setEnabled(id: number, enabled: boolean) {
+    return http.post<DesktopClientRelease, { enabled: boolean }>(
+      `/desktop-client/releases/${id}/enabled`,
+      { enabled },
+    )
+  },
+  async uploadOSS(
+    file: File,
+    target: {
+      platform: string
+      arch: string
+      channel: string
+      version: string
+      kind?: 'installer' | 'updater'
+    },
+  ) {
+    const form = new FormData()
+    form.append('file', file, file.name)
+    form.append('platform', target.platform)
+    form.append('arch', target.arch)
+    form.append('channel', target.channel)
+    form.append('version', target.version)
+    form.append('kind', target.kind ?? 'installer')
+    const response = await http.raw.post<{
+      code: number
+      message: string
+      data: DesktopClientReleaseUploadResult
+    }>('/desktop-client/releases/upload', form)
+    return response.data.data
+  },
+  resolveDownloadURL(id: number) {
+    return http.get<DesktopClientReleaseDownloadURLResult>(
+      `/desktop-client/releases/${id}/download-url`,
+    )
+  },
+  delete(id: number) {
+    return http.delete<{ id: number }>(`/desktop-client/releases/${id}`)
+  },
+}
+
+export function platformLabel(value: string): string {
+  return platformOptions.find((item) => item.value === value)?.label ?? value
+}

apps/ops-web/src/lib/http.ts

@@ -57,7 +57,8 @@ const client: AxiosInstance = axios.create({
 
 function isLoginRequest(url: string | undefined, method: string | undefined): boolean {
   return (
-    method?.toLowerCase() === 'post' && (url === '/auth/login' || Boolean(url?.endsWith('/auth/login')))
+    method?.toLowerCase() === 'post' &&
+    (url === '/auth/login' || Boolean(url?.endsWith('/auth/login')))
   )
 }
 
@@ -117,4 +118,5 @@ export const http = {
   put: <T, B = unknown>(url: string, body?: B) => unwrap<T>(client.put(url, body)),
   patch: <T, B = unknown>(url: string, body?: B) => unwrap<T>(client.patch(url, body)),
   delete: <T>(url: string) => unwrap<T>(client.delete(url)),
+  raw: client,
 }

apps/ops-web/src/main.ts

@@ -23,6 +23,7 @@ import {
   Popconfirm,
   Radio,
   Result,
+  Segmented,
   Select,
   Space,
   Spin,
@@ -32,6 +33,7 @@ import {
   Tabs,
   Tag,
   Tooltip,
+  Upload,
   message,
 } from 'ant-design-vue'
 import { createApp } from 'vue'
@@ -95,6 +97,7 @@ bindUnauthorizedHandler(() => {
   Radio,
   Result,
   Select,
+  Segmented,
   Space,
   Spin,
   Statistic,
@@ -103,6 +106,7 @@ bindUnauthorizedHandler(() => {
   Tabs,
   Tag,
   Tooltip,
+  Upload,
 ].forEach((component) => {
   app.use(component)
 })

apps/ops-web/src/router/index.ts

@@ -61,6 +61,12 @@ export const router = createRouter({
           component: () => import('@/views/SiteDomainMappingsView.vue'),
           meta: { title: '站点映射' },
         },
+        {
+          path: 'desktop-client/releases',
+          name: 'desktop-client-releases',
+          component: () => import('@/views/DesktopClientReleasesView.vue'),
+          meta: { title: '客户端版本' },
+        },
         {
           path: 'compliance/policy',
           name: 'compliance-policy',

apps/ops-web/src/views/DesktopClientReleasesView.vue

@@ -0,0 +1,986 @@
+<template>
+  <div class="release-page">
+    <div class="release-header">
+      <div>
+        <h2 class="ops-page-title release-title">客户端版本</h2>
+        <div class="release-summary">
+          <span>全部 {{ total }}</span>
+          <span>本页启用 {{ enabledRows }}</span>
+          <span>强制更新 {{ forceRows }}</span>
+        </div>
+      </div>
+      <a-button type="primary" @click="openCreate">
+        <template #icon><PlusOutlined /></template>
+        新增版本
+      </a-button>
+    </div>
+
+    <div class="ops-card release-card">
+      <div class="ops-toolbar release-toolbar">
+        <a-input
+          v-model:value="filter.keyword"
+          class="release-search"
+          placeholder="搜索版本 / Object Key / 下载地址"
+          allow-clear
+          @press-enter="resetAndReload"
+          @change="onKeywordChange"
+        />
+        <a-select
+          v-model:value="filter.platform"
+          class="release-select"
+          :options="platformOptions"
+          placeholder="平台"
+          allow-clear
+          @change="resetAndReload"
+        />
+        <a-input
+          v-model:value="filter.channel"
+          class="release-channel"
+          placeholder="渠道 stable"
+          allow-clear
+          @press-enter="resetAndReload"
+        />
+        <a-select
+          v-model:value="filter.enabled"
+          class="release-enabled"
+          :options="enabledOptions"
+          placeholder="状态"
+          allow-clear
+          @change="resetAndReload"
+        />
+        <a-button @click="reload">
+          <template #icon><ReloadOutlined /></template>
+          刷新
+        </a-button>
+      </div>
+
+      <a-table
+        :columns="columns"
+        :data-source="rows"
+        :loading="loading"
+        :pagination="pagination"
+        row-key="id"
+        :scroll="{ x: 1280 }"
+        @change="onTableChange"
+      >
+        <template #bodyCell="{ column, record }">
+          <template v-if="column.key === 'target'">
+            <div class="target-cell">
+              <strong>{{ platformLabel(record.platform) }}</strong>
+              <span>{{ record.arch }} · {{ record.channel }}</span>
+            </div>
+          </template>
+          <template v-else-if="column.key === 'version'">
+            <div class="version-cell">
+              <strong>{{ record.version }}</strong>
+              <span v-if="record.min_supported_version">
+                最低 {{ record.min_supported_version }}
+              </span>
+            </div>
+          </template>
+          <template v-else-if="column.key === 'source'">
+            <div class="source-stack">
+              <div class="source-asset">
+                <a-tag :color="record.download_source === 'oss' ? 'blue' : 'gold'">
+                  官网 {{ record.download_source === 'oss' ? 'OSS' : '自定义' }}
+                </a-tag>
+                <span>{{ assetTargetText(record, 'installer') }}</span>
+              </div>
+              <div class="source-asset">
+                <a-tag :color="updaterAssetConfigured(record) ? 'purple' : 'default'">
+                  更新 {{ updaterSourceText(record) }}
+                </a-tag>
+                <span>{{ assetTargetText(record, 'updater') }}</span>
+              </div>
+            </div>
+          </template>
+          <template v-else-if="column.key === 'policy'">
+            <a-space size="small">
+              <a-tag :color="record.enabled ? 'green' : 'default'">
+                {{ record.enabled ? '启用' : '停用' }}
+              </a-tag>
+              <a-tag v-if="record.force_update" color="red">强更</a-tag>
+            </a-space>
+          </template>
+          <template v-else-if="column.key === 'updated_at'">
+            {{ formatDate(record.updated_at) }}
+          </template>
+          <template v-else-if="column.key === 'actions'">
+            <div class="table-actions-row" style="justify-content: flex-end">
+              <a-tooltip title="复制最终下载地址">
+                <a-button
+                  type="text"
+                  shape="circle"
+                  size="small"
+                  class="action-btn"
+                  @click="copyDownloadURL(record)"
+                >
+                  <LinkOutlined />
+                </a-button>
+              </a-tooltip>
+              <a-tooltip title="编辑">
+                <a-button
+                  type="text"
+                  shape="circle"
+                  size="small"
+                  class="action-btn action-edit"
+                  @click="openEdit(record)"
+                >
+                  <EditOutlined />
+                </a-button>
+              </a-tooltip>
+              <a-tooltip :title="record.enabled ? '停用' : '启用'">
+                <a-switch
+                  size="small"
+                  :checked="record.enabled"
+                  :loading="statusLoadingId === record.id"
+                  @change="onEnabledSwitchChange(record, $event)"
+                />
+              </a-tooltip>
+              <a-tooltip title="删除">
+                <a-popconfirm title="确认删除该客户端版本配置？" @confirm="deleteRelease(record)">
+                  <a-button
+                    type="text"
+                    shape="circle"
+                    size="small"
+                    class="action-btn action-delete"
+                  >
+                    <DeleteOutlined />
+                  </a-button>
+                </a-popconfirm>
+              </a-tooltip>
+            </div>
+          </template>
+        </template>
+      </a-table>
+    </div>
+
+    <a-drawer
+      v-model:open="drawerOpen"
+      :title="editingRow ? '编辑客户端版本' : '新增客户端版本'"
+      width="620"
+      :destroy-on-close="true"
+      @close="closeDrawer"
+    >
+      <a-form layout="vertical" :model="form">
+        <div class="form-grid">
+          <a-form-item label="平台" required>
+            <a-select v-model:value="form.platform" :options="platformOptions" />
+          </a-form-item>
+          <a-form-item label="架构" required>
+            <a-select v-model:value="form.arch" :options="archOptions" />
+          </a-form-item>
+        </div>
+        <div class="form-grid">
+          <a-form-item label="渠道" required>
+            <a-input v-model:value="form.channel" placeholder="stable" />
+          </a-form-item>
+          <a-form-item label="最新版本" required>
+            <a-input v-model:value="form.version" placeholder="0.1.0" />
+          </a-form-item>
+        </div>
+        <a-form-item label="最低支持版本">
+          <a-input v-model:value="form.min_supported_version" placeholder="低于该版本将强制更新" />
+        </a-form-item>
+
+        <section class="asset-section">
+          <div class="asset-section-head">
+            <div>
+              <h3>官网安装包</h3>
+              <p>installer</p>
+            </div>
+          </div>
+          <a-form-item label="下载来源" required>
+            <a-segmented v-model:value="form.download_source" :options="sourceOptions" />
+          </a-form-item>
+          <template v-if="form.download_source === 'oss'">
+            <a-form-item label="上传安装包" required>
+              <a-upload
+                :before-upload="beforeUploadInstallerPackage"
+                :show-upload-list="false"
+                accept=".dmg,.pkg,.exe,.msi,.zip,.AppImage,.appimage,.deb,.rpm,.tar.gz,.tgz"
+              >
+                <a-button :loading="uploading">
+                  <template #icon><UploadOutlined /></template>
+                  {{ form.oss_object_key ? '重新上传' : '选择文件并上传' }}
+                </a-button>
+              </a-upload>
+              <div v-if="form.file_name" class="upload-result">
+                <strong>{{ form.file_name }}</strong>
+                <span>{{ formatBytes(form.file_size_bytes) }}</span>
+                <a v-if="canCopyFormDownloadURL" href="#" @click.prevent="copyFormDownloadURL">
+                  复制下载地址
+                </a>
+              </div>
+            </a-form-item>
+            <a-form-item label="OSS Object Key">
+              <a-input
+                v-model:value="form.oss_object_key"
+                placeholder="上传后自动生成，可手动填已有对象作为兜底"
+              />
+            </a-form-item>
+          </template>
+          <a-form-item v-else label="自定义下载地址" required>
+            <a-input
+              v-model:value="form.custom_download_url"
+              placeholder="https://download.example.com/desktop/app.exe"
+            />
+          </a-form-item>
+
+          <div class="form-grid">
+            <a-form-item label="文件名">
+              <a-input v-model:value="form.file_name" placeholder="可选" />
+            </a-form-item>
+            <a-form-item label="文件大小 Bytes">
+              <a-input-number
+                v-model:value="form.file_size_bytes"
+                :min="0"
+                style="width: 100%"
+                placeholder="可选"
+              />
+            </a-form-item>
+          </div>
+          <a-form-item label="SHA256">
+            <a-input v-model:value="form.sha256" placeholder="64 位十六进制，可选" />
+          </a-form-item>
+        </section>
+
+        <section class="asset-section">
+          <div class="asset-section-head">
+            <div>
+              <h3>自动更新包</h3>
+              <p>updater</p>
+            </div>
+            <a-button size="small" @click="reuseInstallerForUpdater">复用官网包</a-button>
+          </div>
+          <a-form-item label="更新来源">
+            <a-segmented
+              v-model:value="form.updater_download_source"
+              :options="updaterSourceOptions"
+            />
+          </a-form-item>
+          <template v-if="form.updater_download_source === 'oss'">
+            <a-form-item label="上传更新包">
+              <a-upload
+                :before-upload="beforeUploadUpdaterPackage"
+                :show-upload-list="false"
+                accept=".zip,.exe,.AppImage,.appimage"
+              >
+                <a-button :loading="updaterUploading">
+                  <template #icon><UploadOutlined /></template>
+                  {{ form.updater_oss_object_key ? '重新上传' : '选择文件并上传' }}
+                </a-button>
+              </a-upload>
+              <div v-if="form.updater_file_name" class="upload-result">
+                <strong>{{ form.updater_file_name }}</strong>
+                <span>{{ formatBytes(form.updater_file_size_bytes) }}</span>
+              </div>
+            </a-form-item>
+            <a-form-item label="更新包 OSS Object Key">
+              <a-input
+                v-model:value="form.updater_oss_object_key"
+                placeholder="可复用官网包 Object Key，也可上传后自动生成"
+              />
+            </a-form-item>
+          </template>
+          <a-form-item v-else-if="form.updater_download_source === 'custom'" label="更新包自定义地址">
+            <a-input
+              v-model:value="form.updater_custom_download_url"
+              placeholder="https://download.example.com/desktop/app.zip"
+            />
+          </a-form-item>
+          <a-alert
+            v-else
+            type="info"
+            show-icon
+            message="复用官网安装包"
+          />
+
+          <div v-if="form.updater_download_source !== ''" class="form-grid">
+            <a-form-item label="更新包文件名">
+              <a-input v-model:value="form.updater_file_name" placeholder="可选" />
+            </a-form-item>
+            <a-form-item label="更新包大小 Bytes">
+              <a-input-number
+                v-model:value="form.updater_file_size_bytes"
+                :min="0"
+                style="width: 100%"
+                placeholder="可选"
+              />
+            </a-form-item>
+          </div>
+          <a-form-item v-if="form.updater_download_source !== ''" label="更新包 SHA256" required>
+            <a-input v-model:value="form.updater_sha256" placeholder="64 位十六进制" />
+          </a-form-item>
+        </section>
+
+        <a-form-item label="发布说明">
+          <a-textarea v-model:value="form.release_notes" :rows="4" placeholder="可选" />
+        </a-form-item>
+        <div class="switch-row">
+          <a-checkbox v-model:checked="form.force_update">强制更新</a-checkbox>
+          <a-checkbox v-model:checked="form.enabled">启用该版本</a-checkbox>
+        </div>
+      </a-form>
+
+      <template #footer>
+        <div class="drawer-footer">
+          <a-button @click="closeDrawer">取消</a-button>
+          <a-button type="primary" :loading="saving" @click="submitForm">保存</a-button>
+        </div>
+      </template>
+    </a-drawer>
+  </div>
+</template>
+
+<script setup lang="ts">
+import {
+  DeleteOutlined,
+  EditOutlined,
+  LinkOutlined,
+  PlusOutlined,
+  ReloadOutlined,
+  UploadOutlined,
+} from '@ant-design/icons-vue'
+import type { TablePaginationConfig } from 'ant-design-vue'
+import { message } from 'ant-design-vue'
+import dayjs from 'dayjs'
+import { computed, onMounted, reactive, ref, watch } from 'vue'
+
+import {
+  archOptions,
+  desktopClientReleaseApi,
+  platformLabel,
+  platformOptions,
+  type DesktopClientRelease,
+  type DesktopReleaseArch,
+  type DesktopReleasePlatform,
+  type DesktopReleaseSource,
+} from '@/lib/desktop-client-releases'
+import { showOpsError } from '@/lib/errors'
+
+const enabledOptions = [
+  { label: '启用', value: 'true' },
+  { label: '停用', value: 'false' },
+]
+
+const sourceOptions = [
+  { label: 'OSS 自动地址', value: 'oss' },
+  { label: '自定义地址', value: 'custom' },
+]
+
+const updaterSourceOptions = [
+  { label: '复用/不单独配置', value: '' },
+  { label: 'OSS 自动地址', value: 'oss' },
+  { label: '自定义地址', value: 'custom' },
+]
+
+const columns = [
+  { title: '目标', key: 'target', width: 190 },
+  { title: '版本', key: 'version', width: 170 },
+  { title: '下载来源', key: 'source', width: 420 },
+  { title: '策略', key: 'policy', width: 150 },
+  { title: '更新时间', key: 'updated_at', width: 180 },
+  { title: '操作', key: 'actions', width: 190, align: 'right' as const },
+]
+
+const filter = reactive({
+  keyword: '',
+  platform: undefined as string | undefined,
+  channel: '',
+  enabled: undefined as string | undefined,
+})
+
+const rows = ref<DesktopClientRelease[]>([])
+const loading = ref(false)
+const page = ref(1)
+const size = ref(20)
+const total = ref(0)
+const statusLoadingId = ref<number | null>(null)
+const uploading = ref(false)
+const updaterUploading = ref(false)
+
+const enabledRows = computed(() => rows.value.filter((row) => row.enabled).length)
+const forceRows = computed(() => rows.value.filter((row) => row.force_update).length)
+const pagination = computed<TablePaginationConfig>(() => ({
+  current: page.value,
+  pageSize: size.value,
+  total: total.value,
+  showSizeChanger: true,
+  pageSizeOptions: ['10', '20', '50', '100'],
+}))
+
+let keywordTimer: number | null = null
+
+function onKeywordChange() {
+  if (keywordTimer) window.clearTimeout(keywordTimer)
+  keywordTimer = window.setTimeout(() => {
+    resetAndReload()
+  }, 300)
+}
+
+function resetAndReload() {
+  page.value = 1
+  void reload()
+}
+
+async function reload() {
+  loading.value = true
+  try {
+    const result = await desktopClientReleaseApi.list({
+      keyword: filter.keyword || undefined,
+      platform: filter.platform || undefined,
+      channel: filter.channel || undefined,
+      enabled: filter.enabled || undefined,
+      page: page.value,
+      size: size.value,
+    })
+    rows.value = result.items
+    total.value = result.total
+  } catch (error) {
+    showOpsError(error)
+  } finally {
+    loading.value = false
+  }
+}
+
+function onTableChange(pag: TablePaginationConfig) {
+  page.value = pag.current ?? 1
+  size.value = pag.pageSize ?? 20
+  void reload()
+}
+
+const drawerOpen = ref(false)
+const saving = ref(false)
+const editingRow = ref<DesktopClientRelease | null>(null)
+const form = reactive({
+  platform: 'darwin' as DesktopReleasePlatform,
+  arch: 'universal' as DesktopReleaseArch,
+  channel: 'stable',
+  version: '',
+  min_supported_version: '',
+  download_source: 'oss' as DesktopReleaseSource,
+  oss_object_key: '',
+  custom_download_url: '',
+  download_url: '',
+  file_name: '',
+  file_size_bytes: undefined as number | undefined,
+  sha256: '',
+  updater_download_source: '' as '' | DesktopReleaseSource,
+  updater_oss_object_key: '',
+  updater_custom_download_url: '',
+  updater_file_name: '',
+  updater_file_size_bytes: undefined as number | undefined,
+  updater_sha256: '',
+  release_notes: '',
+  force_update: false,
+  enabled: true,
+})
+const canCopyFormDownloadURL = computed(
+  () => Boolean(editingRow.value?.id) || Boolean(form.download_url.trim()),
+)
+
+watch(
+  () => form.download_source,
+  (source) => {
+    if (source === 'oss') {
+      form.custom_download_url = ''
+    } else {
+      form.oss_object_key = ''
+      form.download_url = ''
+    }
+  },
+)
+
+watch(
+  () => form.updater_download_source,
+  (source) => {
+    if (source === 'oss') {
+      form.updater_custom_download_url = ''
+    } else if (source === 'custom') {
+      form.updater_oss_object_key = ''
+    } else {
+      clearUpdaterAsset()
+    }
+  },
+)
+
+function resetForm() {
+  form.platform = 'darwin'
+  form.arch = 'universal'
+  form.channel = 'stable'
+  form.version = ''
+  form.min_supported_version = ''
+  form.download_source = 'oss'
+  form.oss_object_key = ''
+  form.custom_download_url = ''
+  form.download_url = ''
+  form.file_name = ''
+  form.file_size_bytes = undefined
+  form.sha256 = ''
+  clearUpdaterAsset()
+  form.release_notes = ''
+  form.force_update = false
+  form.enabled = true
+  editingRow.value = null
+}
+
+function openCreate() {
+  resetForm()
+  drawerOpen.value = true
+}
+
+function openEdit(row: DesktopClientRelease) {
+  editingRow.value = row
+  form.platform = row.platform
+  form.arch = row.arch
+  form.channel = row.channel
+  form.version = row.version
+  form.min_supported_version = row.min_supported_version ?? ''
+  form.download_source = row.download_source
+  form.oss_object_key = row.oss_object_key ?? ''
+  form.custom_download_url = row.custom_download_url ?? ''
+  form.download_url = row.download_url ?? ''
+  form.file_name = row.file_name ?? ''
+  form.file_size_bytes = row.file_size_bytes ?? undefined
+  form.sha256 = row.sha256 ?? ''
+  form.updater_download_source = row.updater_download_source ?? ''
+  form.updater_oss_object_key = row.updater_oss_object_key ?? ''
+  form.updater_custom_download_url = row.updater_custom_download_url ?? ''
+  form.updater_file_name = row.updater_file_name ?? ''
+  form.updater_file_size_bytes = row.updater_file_size_bytes ?? undefined
+  form.updater_sha256 = row.updater_sha256 ?? ''
+  form.release_notes = row.release_notes ?? ''
+  form.force_update = row.force_update
+  form.enabled = row.enabled
+  drawerOpen.value = true
+}
+
+function closeDrawer() {
+  drawerOpen.value = false
+}
+
+async function beforeUploadReleasePackage(file: File, kind: 'installer' | 'updater') {
+  if (!form.version.trim()) {
+    message.warning('请先填写最新版本')
+    return false
+  }
+  if (kind === 'installer') {
+    uploading.value = true
+  } else {
+    updaterUploading.value = true
+  }
+  try {
+    const result = await desktopClientReleaseApi.uploadOSS(file, {
+      platform: form.platform,
+      arch: form.arch,
+      channel: form.channel.trim() || 'stable',
+      version: form.version.trim(),
+      kind,
+    })
+    if (kind === 'installer') {
+      form.oss_object_key = result.oss_object_key
+      form.download_url = ''
+      form.file_name = result.file_name
+      form.file_size_bytes = result.file_size_bytes
+      form.sha256 = result.sha256
+    } else {
+      form.updater_download_source = 'oss'
+      form.updater_oss_object_key = result.oss_object_key
+      form.updater_custom_download_url = ''
+      form.updater_file_name = result.file_name
+      form.updater_file_size_bytes = result.file_size_bytes
+      form.updater_sha256 = result.sha256
+    }
+    message.success(kind === 'installer' ? '安装包已上传到 OSS' : '自动更新包已上传到 OSS')
+  } catch (error) {
+    showOpsError(error)
+  } finally {
+    uploading.value = false
+    updaterUploading.value = false
+  }
+  return false
+}
+
+function beforeUploadInstallerPackage(file: File) {
+  return beforeUploadReleasePackage(file, 'installer')
+}
+
+function beforeUploadUpdaterPackage(file: File) {
+  return beforeUploadReleasePackage(file, 'updater')
+}
+
+function clearUpdaterAsset() {
+  form.updater_download_source = ''
+  form.updater_oss_object_key = ''
+  form.updater_custom_download_url = ''
+  form.updater_file_name = ''
+  form.updater_file_size_bytes = undefined
+  form.updater_sha256 = ''
+}
+
+function reuseInstallerForUpdater() {
+  form.updater_download_source = form.download_source
+  form.updater_oss_object_key = form.download_source === 'oss' ? form.oss_object_key : ''
+  form.updater_custom_download_url =
+    form.download_source === 'custom' ? form.custom_download_url : ''
+  form.updater_file_name = form.file_name
+  form.updater_file_size_bytes = form.file_size_bytes
+  form.updater_sha256 = form.sha256
+  message.success('已复用官网安装包配置')
+}
+
+async function submitForm() {
+  if (!form.version.trim()) {
+    message.warning('请输入最新版本')
+    return
+  }
+  if (form.download_source === 'oss' && !form.oss_object_key.trim()) {
+    message.warning('请输入 OSS Object Key')
+    return
+  }
+  if (form.download_source === 'custom' && !form.custom_download_url.trim()) {
+    message.warning('请输入自定义下载地址')
+    return
+  }
+  if (form.updater_download_source === 'oss' && !form.updater_oss_object_key.trim()) {
+    message.warning('请输入更新包 OSS Object Key')
+    return
+  }
+  if (form.updater_download_source === 'custom' && !form.updater_custom_download_url.trim()) {
+    message.warning('请输入更新包自定义地址')
+    return
+  }
+  if (form.updater_download_source !== '' && !form.updater_sha256.trim()) {
+    message.warning('请输入更新包 SHA256')
+    return
+  }
+
+  saving.value = true
+  try {
+    const payload = {
+      platform: form.platform,
+      arch: form.arch,
+      channel: form.channel.trim() || 'stable',
+      version: form.version.trim(),
+      min_supported_version: nullableText(form.min_supported_version),
+      download_source: form.download_source,
+      oss_object_key: form.download_source === 'oss' ? nullableText(form.oss_object_key) : null,
+      custom_download_url:
+        form.download_source === 'custom' ? nullableText(form.custom_download_url) : null,
+      file_name: nullableText(form.file_name),
+      file_size_bytes: form.file_size_bytes ?? null,
+      sha256: nullableText(form.sha256),
+      updater_download_source: form.updater_download_source || null,
+      updater_oss_object_key:
+        form.updater_download_source === 'oss' ? nullableText(form.updater_oss_object_key) : null,
+      updater_custom_download_url:
+        form.updater_download_source === 'custom'
+          ? nullableText(form.updater_custom_download_url)
+          : null,
+      updater_file_name:
+        form.updater_download_source !== '' ? nullableText(form.updater_file_name) : null,
+      updater_file_size_bytes:
+        form.updater_download_source !== '' ? (form.updater_file_size_bytes ?? null) : null,
+      updater_sha256:
+        form.updater_download_source !== '' ? nullableText(form.updater_sha256) : null,
+      release_notes: nullableText(form.release_notes),
+      force_update: form.force_update,
+      enabled: form.enabled,
+    }
+    if (editingRow.value) {
+      await desktopClientReleaseApi.update(editingRow.value.id, payload)
+      message.success('已保存客户端版本')
+    } else {
+      await desktopClientReleaseApi.create(payload)
+      message.success('已新增客户端版本')
+    }
+    drawerOpen.value = false
+    resetForm()
+    void reload()
+  } catch (error) {
+    showOpsError(error)
+  } finally {
+    saving.value = false
+  }
+}
+
+function nullableText(value: string): string | null {
+  const trimmed = value.trim()
+  return trimmed ? trimmed : null
+}
+
+function updaterAssetConfigured(row: DesktopClientRelease): boolean {
+  return Boolean(row.updater_download_source)
+}
+
+function updaterSourceText(row: DesktopClientRelease): string {
+  if (!row.updater_download_source) {
+    return '复用官网'
+  }
+  return row.updater_download_source === 'oss' ? 'OSS' : '自定义'
+}
+
+function assetTargetText(
+  row: DesktopClientRelease,
+  kind: 'installer' | 'updater',
+): string {
+  if (kind === 'installer' || !row.updater_download_source) {
+    return row.download_source === 'oss'
+      ? (row.oss_object_key ?? '未配置')
+      : (row.custom_download_url ?? '未配置')
+  }
+  return row.updater_download_source === 'oss'
+    ? (row.updater_oss_object_key ?? '未配置')
+    : (row.updater_custom_download_url ?? '未配置')
+}
+
+async function setEnabled(row: DesktopClientRelease, enabled: boolean) {
+  statusLoadingId.value = row.id
+  try {
+    const next = await desktopClientReleaseApi.setEnabled(row.id, enabled)
+    Object.assign(row, next)
+    message.success(enabled ? '已启用' : '已停用')
+  } catch (error) {
+    showOpsError(error)
+  } finally {
+    statusLoadingId.value = null
+  }
+}
+
+function onEnabledSwitchChange(row: DesktopClientRelease, checked: unknown) {
+  void setEnabled(row, Boolean(checked))
+}
+
+async function deleteRelease(row: DesktopClientRelease) {
+  try {
+    await desktopClientReleaseApi.delete(row.id)
+    message.success('已删除')
+    void reload()
+  } catch (error) {
+    showOpsError(error)
+  }
+}
+
+async function copyDownloadURL(row: DesktopClientRelease) {
+  try {
+    const result = await desktopClientReleaseApi.resolveDownloadURL(row.id)
+    await navigator.clipboard.writeText(result.download_url)
+    message.success('下载地址已复制')
+  } catch (error) {
+    showOpsError(error)
+  }
+}
+
+async function copyFormDownloadURL() {
+  if (form.download_url) {
+    await navigator.clipboard.writeText(form.download_url)
+    message.success('下载地址已复制')
+    return
+  }
+  if (!editingRow.value?.id) return
+  await copyDownloadURL(editingRow.value)
+}
+
+function formatDate(value: string | null | undefined): string {
+  return value ? dayjs(value).format('YYYY-MM-DD HH:mm:ss') : '—'
+}
+
+function formatBytes(value: number | null | undefined): string {
+  if (!value) return '0 B'
+  if (value < 1024) return `${value} B`
+  if (value < 1024 * 1024) return `${(value / 1024).toFixed(1)} KB`
+  if (value < 1024 * 1024 * 1024) return `${(value / 1024 / 1024).toFixed(1)} MB`
+  return `${(value / 1024 / 1024 / 1024).toFixed(1)} GB`
+}
+
+onMounted(() => {
+  void reload()
+})
+</script>
+
+<style scoped>
+.release-page {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+}
+
+.release-header {
+  display: flex;
+  align-items: flex-end;
+  justify-content: space-between;
+  gap: 16px;
+}
+
+.release-title {
+  margin-bottom: 8px;
+}
+
+.release-summary {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  color: #64748b;
+  font-size: 13px;
+}
+
+.release-summary span {
+  border: 1px solid #e2e8f0;
+  border-radius: 6px;
+  background: #fff;
+  padding: 4px 8px;
+}
+
+.release-card {
+  padding-top: 20px;
+}
+
+.release-toolbar {
+  margin-bottom: 18px;
+}
+
+.release-search {
+  width: 320px;
+}
+
+.release-select,
+.release-enabled {
+  width: 140px;
+}
+
+.release-channel {
+  width: 150px;
+}
+
+.target-cell,
+.version-cell {
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+  gap: 4px;
+}
+
+.target-cell strong,
+.version-cell strong {
+  color: #0f172a;
+  font-weight: 750;
+}
+
+.target-cell span,
+.version-cell span {
+  color: #94a3b8;
+  font-size: 12px;
+}
+
+.source-stack {
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+  gap: 8px;
+}
+
+.source-asset {
+  display: grid;
+  min-width: 0;
+  grid-template-columns: auto minmax(0, 1fr);
+  align-items: center;
+  gap: 6px;
+}
+
+.source-asset span {
+  overflow: hidden;
+  max-width: 360px;
+  color: #64748b;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+  font-size: 12px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.asset-section {
+  margin: 16px 0;
+  border: 1px solid #e2e8f0;
+  border-radius: 8px;
+  padding: 14px 14px 4px;
+}
+
+.asset-section-head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 12px;
+  margin-bottom: 12px;
+}
+
+.asset-section-head h3 {
+  margin: 0 0 4px;
+  color: #0f172a;
+  font-size: 15px;
+  font-weight: 750;
+  line-height: 1.3;
+}
+
+.asset-section-head p {
+  margin: 0;
+  color: #64748b;
+  font-size: 12px;
+  line-height: 1.5;
+}
+
+.form-grid {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
+  gap: 14px;
+}
+
+.switch-row {
+  display: flex;
+  gap: 24px;
+  margin-top: 4px;
+}
+
+.upload-result {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-top: 10px;
+  color: #64748b;
+  font-size: 12px;
+}
+
+.upload-result strong {
+  color: #0f172a;
+  font-weight: 750;
+}
+
+.upload-result a {
+  color: #1677ff;
+  font-weight: 700;
+}
+
+.drawer-footer {
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+}
+
+@media (max-width: 768px) {
+  .release-header {
+    align-items: stretch;
+    flex-direction: column;
+  }
+
+  .release-search,
+  .release-select,
+  .release-channel,
+  .release-enabled {
+    width: 100%;
+  }
+
+  .form-grid {
+    grid-template-columns: 1fr;
+  }
+}
+</style>