diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5f354b4..527815f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
           done
 
   web:
-    name: Frontend · tsc
+    name: Frontend · tsc + vitest
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -46,11 +46,44 @@ jobs:
           node-version: "20"
           cache: npm
           cache-dependency-path: ${{ matrix.dir }}/package-lock.json
-      - name: install + typecheck
+      - name: install + typecheck + test（三个前端都有 vitest，此前只跑 tsc，测试从没进过关卡）
         working-directory: ${{ matrix.dir }}
         run: |
           npm ci
           npx tsc --noEmit
+          npm test
+
+  # desktop 的 Go 模块不在 go.work 里，上面的 go job 从来没测过它（app.go 的
+  # download/另存为等桥方法有单测但 CI 一次没跑过）。用 macos runner：一来免装
+  # gtk/webkit（linux 编 wails 要一堆 CGO 头），二来 darwin 才是实际发行目标。
+  # go:embed frontend/dist 要求先出前端产物，故先 npm build。
+  desktop:
+    name: Desktop · go build + test (macOS)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache-dependency-path: sundynix-desktop/go.sum
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: sundynix-desktop/frontend/package-lock.json
+      - name: 前端构建（供 go:embed）
+        working-directory: sundynix-desktop/frontend
+        run: |
+          npm ci
+          npm run build
+      - name: go build + vet + test
+        working-directory: sundynix-desktop
+        env:
+          GOWORK: "off" # 必须加引号：YAML 裸 off 会被解析成布尔 false
+        run: |
+          go build ./...
+          go vet ./...
+          go test ./...
 
   py:
     name: mcp-py · sandbox guard