diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..64076fe
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,42 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+- `src/core/llm/`: unified LLM client (`LLMClient`) and JSON extractor (`extractJson`, `parseJsonSafe`, `parseJsonStrict`) shared by every AI feature.
+- `src/core/schema.ts`: `SCHEMA_VERSION` constant (starts at `1`) and `todayIso()` helper. All plugin-managed frontmatter now includes `schema_version: 1`.
+- Bilingual documentation: `README.md`, `README.zh-CN.md`, `PRIVACY.md`, `PRIVACY.zh-CN.md`.
+- `CONTRIBUTING.md`, `SECURITY.md`, `CHANGELOG.md`, GitHub issue and pull request templates.
+- `.github/workflows/ci.yml`: type-check and build on push/PR.
+- `.github/dependabot.yml`: weekly npm and monthly GitHub Actions updates.
+- Conflict-safe file creation in `VaultWriter` and the AI assistant's concept-page flow (auto-suffixes `-2`, `-3`, ... when paths collide).
+- **Concept page completion** actions wired into the command panel:
+  - "补全当前概念页" — opens depth select → AI completion → preview → write.
+  - "扫描并补全空概念页" — batch scan → select → sequential completion.
+- **Knowledge Q&A with question graph** action:
+  - "知识提问" — ask → auto-classify (new/refinement/expansion) → user confirm → generate Q&A → attach classification frontmatter → update question index → append recommended follow-ups → rebuild Mermaid evolution graph.
+- **Vault-aware Q&A** action ("知识库问答"):
+  - Searches the in-memory vault index for related notes, builds a context window from up to 8 relevant entries, sends to the LLM with instructions to cite `[[sources]]`, and renders the answer with a "依据来源" section.
+- `src/core/knowledge/KnowledgeIndexService.ts` — in-memory vault index built from metadataCache. Rebuilt on load, incrementally updated on file change/delete/rename. Three-layer scoring: exact match → structural (links/backlinks/domain) → keyword substring. No embedding, no external DB.
+- `src/core/execution/` — ExecutionPlan infrastructure:
+  - `types.ts`: `VaultOperation` union (create-file, modify-file, append-section, replace-selection, move-file, create-link, update-frontmatter), `ExecutionPlan`, `ExecutionRecord`.
+  - `PlanBuilder.ts`: fluent builder with automatic risk assessment and preview markdown generation.
+  - `PlanExecutor.ts`: applies plans to the vault and persists execution logs under `Knowledge/_Executions/`.
+
+### Changed
+- All nine LLM call sites (`AIAssistant`, `DeepSeekClient`, `QuestionClassifier`, `ConceptCompleter`, `ContextQAClient`, `ReadingPlanner`, `SectionAppender`, `DiagramGenerator`, `SmartCompleter`) now go through `LLMClient` and `extractJson`.
+- `tsconfig.json`: enabled full strict mode (`strict: true`) and scoped `include` to `src/**/*.ts`.
+- `package.json`: pinned `obsidian` to `^1.7.2` (was `latest`), added `homepage`, `repository`, `bugs`, `keywords`, and `author` fields, added `typecheck`, `test`, and `ci` scripts.
+- Release workflow uses `npm ci` instead of `npm install` for reproducible builds.
+- Action definitions now use appropriate groups (`concept`, `reading`, `sync`, `document`) instead of all being `general`.
+
+### Removed
+- Stale committed `main.js` build artifact at the repository root. The runtime bundle is now produced into `dist/` only and shipped exclusively via GitHub Releases.
+
+## Older versions
+
+Historical entries prior to this changelog were not maintained. See [the versions.json](./versions.json) for the version-to-minimum-Obsidian map and the [GitHub Releases page](https://github.com/yan-istart/IStart-Note-AI-Plugin/releases) for prior release notes.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..59ddfd0
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,107 @@
+# Contributing to IStart-Note-AI
+
+Thanks for your interest in improving IStart-Note-AI. This document covers how to set up the project, the conventions we follow, and how to send a change.
+
+## Setup
+
+```bash
+git clone https://github.com/yan-istart/IStart-Note-AI-Plugin.git
+cd IStart-Note-AI-Plugin
+npm ci
+```
+
+Always use `npm ci` rather than `npm install` so the lockfile is respected and builds are reproducible.
+
+## Common commands
+
+| Command | What it does |
+| --- | --- |
+| `npm run dev` | Watch mode build to `dist/` |
+| `npm run typecheck` | Run `tsc --noEmit` against `tsconfig.json` (strict mode) |
+| `npm run build` | Type-check, then production build to `dist/` |
+| `npm run ci` | Full type-check + build (mirrors GitHub Actions) |
+| `npm run release` | Interactive release (build, tag, GitHub release) — maintainers only |
+| `npm run submit` | Helper for submitting to community plugin store |
+
+To run the plugin locally, symlink or copy `dist/` into your test vault's `.obsidian/plugins/istart-note-ai/` folder, then enable the plugin in Obsidian.
+
+## Project layout
+
+```
+src/
+  core/           # cross-feature infrastructure (LLM client, future vault index, ...)
+  ai/             # AI feature modules (assistant, classifier, planner, ...)
+  features/       # UI and per-feature managers
+  vault/          # vault read/write helpers
+  settings/
+  actions/        # unified action registry + command panel
+  main.ts
+```
+
+### Working with the LLM
+
+All AI features must use `src/core/llm/LLMClient.ts` instead of calling `requestUrl` directly:
+
+```typescript
+import { LLMClient, parseJsonSafe } from "../core/llm";
+
+const llm = new LLMClient(settings);
+const raw = await llm.chat({ userPrompt: prompt, temperature: 0.5 });
+const parsed = parseJsonSafe<MyShape>(raw, defaultShape);
+```
+
+This keeps error handling, header construction, and provider-swapping in one place.
+
+### Vault writes
+
+Use `VaultWriter` for the standard QA / context-QA / concept patterns. When you need a unique file path, use `VaultWriter`'s conflict-safe helper rather than calling `app.vault.create` directly.
+
+When introducing new file types, plan for migration: include `schema_version` in the frontmatter and document the schema in the PR.
+
+## Coding conventions
+
+- TypeScript strict mode is on. New code must pass `npm run typecheck` without `any` (use proper types or `unknown` + narrowing).
+- Avoid `console.log` in shipped code. Use `Notice` for user-visible messages.
+- Keep modules small and single-purpose. Cross-feature utilities live in `src/core/`.
+- Mirror existing language usage. UI strings are Chinese; code comments are mixed Chinese/English. Pick whichever fits the surrounding code.
+- Prefer pure functions in `core/` and side-effect-bearing classes (modal, manager, ...) in `features/`.
+
+## Testing
+
+A formal test framework is not wired in yet. The `npm test` script is a placeholder so CI passes. When you add tests, use [vitest](https://vitest.dev) and put them next to the unit under test as `*.test.ts`. We will switch the placeholder script over once the first tests land.
+
+If your change is non-trivial, please describe how you manually verified it in the PR description.
+
+## Pull requests
+
+1. Fork the repo and create a topic branch (`feat/...`, `fix/...`, `docs/...`).
+2. Run `npm run ci` locally — PRs failing CI are not reviewed.
+3. Keep PRs focused. Unrelated cleanups belong in separate PRs.
+4. Update [CHANGELOG.md](./CHANGELOG.md) under the "Unreleased" section.
+5. If your change affects user data — frontmatter, vault paths, sync layout — mention migration impact in the PR description.
+
+## Releasing (maintainers)
+
+Releases are tag-driven. Pushing a tag triggers `.github/workflows/release.yml`, which builds `dist/` and creates a draft release.
+
+Recommended flow:
+
+```bash
+npm run release        # interactive: bump version, build, tag, push, draft release
+```
+
+The release workflow uses `npm ci`, so any change that requires a new lockfile must be committed first.
+
+## Reporting bugs
+
+Open an issue with:
+
+- Obsidian version, plugin version, OS.
+- Reproduction steps. A short snippet of the affected note (with secrets removed) helps a lot.
+- Anything visible in the developer console (`Ctrl/Cmd+Shift+I` → Console).
+
+For security issues, follow [SECURITY.md](./SECURITY.md) instead.
+
+## Code of conduct
+
+Be respectful. Stay on topic. Disagreements about technical direction are fine; personal attacks aren't.
diff --git a/PRIVACY.md b/PRIVACY.md
new file mode 100644
index 0000000..052e5f4
--- /dev/null
+++ b/PRIVACY.md
@@ -0,0 +1,87 @@
+# Privacy Policy
+
+_Last updated: 2026-05-20. [简体中文版本 →](./PRIVACY.zh-CN.md)_
+
+This document describes what data IStart-Note-AI handles, where it goes, and how to control it. The plugin runs entirely inside your Obsidian client — there are no plugin-operated servers, no analytics, and no telemetry.
+
+## Summary
+
+- The plugin sends prompts to **the AI provider you configure** (default: DeepSeek). Nothing else.
+- The plugin uploads files to **your own Baidu Pan storage** when you enable Baidu sync. Nothing else.
+- API keys, Baidu OAuth tokens, and other secrets are stored locally in your vault's plugin data file (`<your-vault>/.obsidian/plugins/istart-note-ai/data.json`).
+- The plugin does not phone home, send analytics, or contact any third party other than the providers above.
+
+## What is sent to the AI provider
+
+When you trigger an AI feature, the plugin makes an HTTPS request to the chat completions endpoint configured under **Settings → IStart-Note-AI → Base URL** (default: `https://api.deepseek.com/v1/chat/completions`).
+
+The request body may include:
+
+| Source | Data | When |
+| --- | --- | --- |
+| Selection | The currently selected text | Whenever you trigger the AI assistant with a non-empty selection |
+| Active file | The active document content (truncated, typically up to ~2,000 characters) | When the assistant needs context (most actions) |
+| Active file metadata | File name, frontmatter `type` field | Most actions |
+| Cursor context | Up to ~500 characters before the cursor | Continue / fill-empty-section actions |
+| Concept name list | The list of file basenames under your Concepts folder | All actions, used to drive auto-linking |
+| Question history | Up to the last 20 question titles in your Q&A folder | Question classification |
+| Reading notes | The notes for a specific chapter (truncated to ~3,000 characters) | Reading project: chapter summary, Feynman test |
+| Your instruction | The natural-language prompt you type into the assistant | Always |
+
+The plugin never reads files outside the configured paths unless you explicitly point it at them. The plugin never sends your API key to anything other than the provider's endpoint.
+
+You are subject to the privacy policy of whichever provider you configure. Review:
+
+- DeepSeek: <https://platform.deepseek.com>
+- For other providers, consult their own documentation.
+
+## What is sent to Baidu Cloud
+
+Baidu Cloud sync is **disabled by default**. When you enable it under **Settings → IStart-Note-AI → Baidu Cloud Sync**, you supply:
+
+- An **App ID** and **App Secret** from the [Baidu Pan Open Platform](https://pan.baidu.com/union).
+- An OAuth authorization code that the plugin exchanges for an `accessToken` and `refreshToken`.
+
+After enabling sync, the plugin can upload to your own Baidu Pan account at the path you configure (default: `/apps/istart-note-ai`). The data uploaded depends on your settings:
+
+- **Notes**: the markdown files in the folders you choose to sync.
+- **Plugin config (optional)**: a small JSON file containing non-secret plugin settings.
+- **Plugin itself (optional)**: the compiled plugin files in `.obsidian/plugins/istart-note-ai/`.
+- **Obsidian config (optional)**: a curated set of files from `.obsidian/` (toolbar, hotkeys, appearance, community-plugins).
+
+Files are uploaded over HTTPS using the Baidu Pan REST API. The plugin **does not encrypt files end-to-end**; treat your Baidu Pan account security as the boundary.
+
+You can disable sync at any time. Removing the local plugin data file (or running Settings → Community plugins → Reset) clears stored Baidu tokens.
+
+## Where credentials are stored
+
+All settings, including the DeepSeek API key, the Baidu App Secret, and the Baidu access/refresh tokens, are stored in:
+
+```
+<your-vault>/.obsidian/plugins/istart-note-ai/data.json
+```
+
+Anything inside your vault — including this file — is local to your machine unless you sync it elsewhere yourself. The plugin never transmits this file.
+
+If you sync your vault via iCloud, Obsidian Sync, Git, or another mechanism, **you are responsible for whether `data.json` is included in that sync**. The Obsidian default is to include it. To exclude it, configure an exclusion rule in your sync tool.
+
+## What is **not** collected
+
+- No telemetry, usage analytics, or crash reporting.
+- No outbound requests to addresses other than the configured AI provider and Baidu Pan.
+- No background uploads when sync is disabled.
+- No personal information beyond what your prompts and notes already contain.
+
+## Mobile
+
+The plugin runs on Obsidian Mobile and follows the same rules. AI requests go to the same endpoint over the device's network. Baidu sync on mobile uses the same OAuth credentials.
+
+## Data retention and deletion
+
+- **Local data**: delete `<your-vault>/.obsidian/plugins/istart-note-ai/data.json` to remove all locally stored settings and tokens.
+- **Baidu Pan**: open the Baidu Pan web UI or app and delete the folder you configured (default: `/apps/istart-note-ai`) to remove uploaded notes.
+- **AI provider**: refer to the provider's data retention policy. The plugin does not retain anything itself.
+
+## Reporting concerns
+
+For security or privacy issues, follow [SECURITY.md](./SECURITY.md). For other concerns, open an issue on GitHub.
diff --git a/PRIVACY.zh-CN.md b/PRIVACY.zh-CN.md
new file mode 100644
index 0000000..7a62716
--- /dev/null
+++ b/PRIVACY.zh-CN.md
@@ -0,0 +1,87 @@
+# 隐私政策
+
+_最近更新：2026-05-20。[English →](./PRIVACY.md)_
+
+本文档描述 IStart-Note-AI 处理哪些数据、数据流向哪里、以及如何控制。插件完全运行在你的 Obsidian 客户端内：没有插件方服务器，不收集分析数据，也不上报遥测。
+
+## 概览
+
+- 插件只会把请求发到**你配置的 AI 服务**（默认 DeepSeek）。
+- 启用百度云同步时，插件只会把文件上传到**你自己的百度网盘**。
+- API Key、百度 OAuth Token 等凭证保存在 Vault 的插件数据文件里：`<你的 Vault>/.obsidian/plugins/istart-note-ai/data.json`。
+- 不向其他第三方发送任何数据。
+
+## 发送到 AI 服务的数据
+
+触发 AI 功能时，插件会向**设置 → IStart-Note-AI → Base URL**（默认 `https://api.deepseek.com/v1/chat/completions`）发起 HTTPS 请求。
+
+请求体可能包含：
+
+| 来源 | 数据 | 触发时机 |
+| --- | --- | --- |
+| 选中文字 | 当前选中的文本 | 选中后调用 AI 助手 |
+| 当前文件 | 当前文档内容（通常截断到约 2,000 字符） | 大多数动作 |
+| 文件元数据 | 文件名、frontmatter `type` 字段 | 大多数动作 |
+| 光标上下文 | 光标前最多约 500 字符 | 续写 / 空章节补全 |
+| 概念名列表 | 概念目录下的所有文件名（用于自动双链） | 所有动作 |
+| 问题历史 | 问答目录下最近 20 条问题标题 | 问题分类 |
+| 阅读笔记 | 单个章节的笔记（截断到约 3,000 字符） | 章节总结、费曼测试 |
+| 你的指令 | 你在助手中输入的自然语言指令 | 始终发送 |
+
+插件不会读取你显式配置之外的目录，也不会把 API Key 发往配置的 endpoint 之外的任何地方。
+
+具体数据由所配置服务的隐私政策约束。请自行查阅：
+
+- DeepSeek：<https://platform.deepseek.com>
+- 其他兼容服务请查阅对应官方文档。
+
+## 上传到百度网盘的数据
+
+百度云同步**默认关闭**。在**设置 → IStart-Note-AI → 百度云同步**中启用时，你需要提供：
+
+- 在 [百度网盘开放平台](https://pan.baidu.com/union) 注册的 **App ID** 与 **App Secret**。
+- 一次性 OAuth 授权码，插件会换取 `accessToken` 与 `refreshToken`。
+
+启用后，插件会把以下内容上传到你自己百度网盘的指定路径（默认 `/apps/istart-note-ai`）：
+
+- **笔记**：你选择同步的目录下的 markdown 文件。
+- **插件配置（可选）**：不含凭证的小型 JSON 文件。
+- **插件本身（可选）**：`.obsidian/plugins/istart-note-ai/` 下的编译产物。
+- **Obsidian 配置（可选）**：`.obsidian/` 下的部分文件（工具栏、快捷键、外观、社区插件）。
+
+文件通过百度网盘 REST API 走 HTTPS 上传。**插件不做端到端加密**，安全边界等同你百度网盘账号的安全。
+
+你可以随时关闭同步。删除插件 data.json 或在「设置 → 第三方插件 → 重置」可清除本地存储的百度凭证。
+
+## 凭证存放位置
+
+所有设置（含 DeepSeek API Key、百度 App Secret、百度 access/refresh token）都存在：
+
+```
+<你的 Vault>/.obsidian/plugins/istart-note-ai/data.json
+```
+
+Vault 内的内容默认是本地的，除非你主动同步到别处。插件本身不会传输这个文件。
+
+如果你通过 iCloud、Obsidian Sync、Git 等方式同步 Vault，**是否包含 `data.json` 由你的同步工具决定**。Obsidian 默认是包含的。如需排除，请在同步工具中添加忽略规则。
+
+## 不会收集的内容
+
+- 不收集遥测 / 使用分析 / 崩溃日志。
+- 除配置的 AI 服务和百度网盘外，不向任何外部地址发请求。
+- 同步关闭时不会有后台上传。
+- 不收集 prompts 与笔记之外的个人信息。
+
+## 移动端
+
+插件支持 Obsidian Mobile，规则与桌面端一致。AI 请求走同一 endpoint，百度同步使用同一套 OAuth 凭证。
+
+## 数据保留与删除
+
+- **本地数据**：删除 `<你的 Vault>/.obsidian/plugins/istart-note-ai/data.json`。
+- **百度网盘**：在百度网盘网页 / 客户端上删除同步目录（默认 `/apps/istart-note-ai`）。
+- **AI 服务**：请参阅对应服务的数据保留策略；插件本身不留任何记录。
+
+## 反馈渠道
+
+安全或隐私问题请按 [SECURITY.md](./SECURITY.md) 流程提交。其他问题请在 GitHub 上提 issue。
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..1058e26
--- /dev/null
+++ b/README.md
@@ -0,0 +1,182 @@
+# IStart-Note-AI
+
+> [!warning] Beta software
+> IStart-Note-AI is under active development. Features marked **experimental** below may change or be removed without notice. The data model and frontmatter schema are not yet stable; back up your vault before trying new features.
+
+[简体中文 README →](./README.zh-CN.md)
+
+An Obsidian plugin that turns your notes into a structured personal knowledge system. One unified AI assistant helps you draft, expand, and organize notes, with automatic concept pages, bidirectional links, reading projects, and optional Baidu Cloud sync.
+
+The plugin is built around an OpenAI-compatible chat completions API. The default provider is [DeepSeek](https://platform.deepseek.com); other compatible endpoints work by changing the Base URL.
+
+---
+
+## Status overview
+
+| Feature | Status | Notes |
+| --- | --- | --- |
+| AI Assistant (insert / replace / append / show) | stable | Single command panel entry, content classifier + structured prompt + markdown beautifier |
+| Reading projects | stable | Generate skeleton, chapter pre-reading questions, summaries, Feynman tests |
+| Baidu Cloud sync (notes + plugin config) | stable | Manual and auto modes, conflict strategy, plugin/Obsidian config backup |
+| Document beautification | stable | Restructures headings, adds callouts and Mermaid diagrams |
+| Concept pages auto-creation | stable | Empty pages created via `[[concept]]` link scan |
+| Concept page completion (`ConceptCompleter`) | experimental | Internals exist; not exposed in the unified panel yet |
+| Question graph (`QuestionGraphManager`) | experimental | Frontmatter classification + Mermaid evolution graph; not yet wired into the panel |
+| Vault-wide knowledge retrieval | not yet | Planned for v2 |
+| Execution plan / preview / rollback | not yet | Planned for v3 |
+
+---
+
+## Features
+
+### AI Assistant (unified entry)
+
+Select text or place your cursor, then describe what you want in natural language:
+
+- **Expand / rewrite** selected text
+- **Explain** a term
+- **Generate diagrams** (flowchart, sequence, state, class, ER, Gantt) and LaTeX formulas
+- **Fill empty sections** based on document context
+- **Continue writing** from the cursor
+- **Summarize** the current document
+- **Beautify** existing content with callouts, links, and visual breaks
+
+Quick tags work too: `[扩写]` `[解释]` `[画图]` `[补全]` `[续写]` `[总结]` `[公式]` `[时序图]`.
+
+### Structured output
+
+Model output is post-processed for knowledge-base style: short paragraphs, Obsidian callouts (`> [!summary]`, `> [!warning]`, `> [!tip]`), Mermaid diagrams where appropriate, and automatic `[[concept]]` linking against existing pages. The output style is configurable: technical, minimal, academic, product, story, dashboard.
+
+### Reading projects
+
+Turn any book into a structured study plan:
+
+1. Enter book title (and optionally a table of contents).
+2. The plugin generates a reading roadmap, chapter relationships, and pre-reading questions.
+3. Take notes per chapter, then generate chapter summaries and Feynman tests.
+
+### Knowledge organization
+
+- New concepts captured under `Knowledge/Concepts/_未分类/`.
+- After completion, concepts are reorganized into domain subfolders.
+- Domain MOC index pages are generated with Mermaid overview graphs.
+- Question evolution graphs live in the question index.
+
+### Baidu Cloud sync (optional)
+
+- Incremental backup, bidirectional sync, or force overwrite.
+- Optional backup of the plugin itself and Obsidian config (toolbar, hotkeys, appearance).
+- Optional auto-backup after note generation.
+
+> [!info] Privacy
+> AI features send your selection and parts of the active note to the configured chat-completions endpoint. Sync features upload selected notes (and optionally Obsidian config) to your own Baidu Pan storage. See [PRIVACY.md](./PRIVACY.md) for the full data flow.
+
+---
+
+## Requirements
+
+- Obsidian 1.7.2 or later.
+- A DeepSeek API key (or any OpenAI-compatible endpoint).
+- Baidu Cloud sync (optional): a Baidu Pan App ID and App Secret.
+
+---
+
+## Installation
+
+### From community plugins (preferred)
+
+Submission to the community plugin store is in progress. Once available:
+
+1. Settings → Community plugins → Browse.
+2. Search **IStart-Note-AI**.
+3. Install → Enable.
+
+### Manual install (recommended path during beta)
+
+Download the assets from a published [GitHub Release](https://github.com/yan-istart/IStart-Note-AI-Plugin/releases) — `main.js`, `manifest.json`, `styles.css` — and place them under `<your-vault>/.obsidian/plugins/istart-note-ai/`.
+
+> Don't copy the source repository directly: the runtime bundle is built into `dist/` and is not committed to git. Always use the release assets.
+
+### Build from source
+
+```bash
+npm ci
+npm run build
+# dist/main.js, dist/manifest.json, dist/styles.css are the install artifacts
+```
+
+---
+
+## Configuration
+
+Settings → IStart-Note-AI:
+
+| Setting | Description | Default |
+| --- | --- | --- |
+| API Key | DeepSeek API key (or compatible) | — |
+| Base URL | Chat completions endpoint root | `https://api.deepseek.com` |
+| Model | `deepseek-v4-flash` or `deepseek-v4-pro` | `deepseek-v4-flash` |
+| Output style | Knowledge-base, technical, minimal, product, academic, story, dashboard | Knowledge-base |
+| Q&A folder | Where Q&A notes are saved | `Knowledge/Q&A` |
+| Concepts folder | Where concept pages are saved | `Knowledge/Concepts` |
+| Baidu Cloud sync | Enable, App ID/Secret, remote path, auto-backup, ignore pattern | disabled |
+
+---
+
+## Usage
+
+### Desktop
+
+- 🧠 **Ribbon icon** opens the command panel.
+- **Right-click in the editor** → `IStart-Note-AI: AI 助手`.
+- **Right-click a file in the sidebar** → `IStart-Note-AI: AI 助手`.
+
+### Mobile
+
+- 🧠 **Ribbon icon** opens the command panel.
+- Add `AI 助手` to the mobile toolbar for a one-tap entry.
+
+### Workflow
+
+1. Optionally select text.
+2. Click 🧠 or right-click → `AI 助手`.
+3. Type a request (or use a quick tag, or leave blank for auto-detect).
+4. Preview the result, then choose to insert, replace, append, or show only.
+
+---
+
+## Project layout
+
+```
+src/
+  core/           # cross-feature infrastructure
+    llm/          # unified LLM client + JSON extractor
+  ai/             # AI features (assistant, classifier, planner, ...)
+  features/       # UI and per-feature managers
+  vault/          # vault writers
+  settings/
+  actions/        # action registry / command panel
+  main.ts
+```
+
+The `core/llm` module centralizes every chat-completions call. New AI features should depend on it instead of calling `requestUrl` directly.
+
+---
+
+## Roadmap
+
+- v1.9 (in progress): unified LLM client, basic vault retrieval, AI operation preview, full open-source governance.
+- v2.0: vault-wide knowledge retrieval with citations, question graph + concept maturity dashboards.
+- v3.0: execution engine — turn notes into reviewable, rollback-able plans (tasks, decisions, projects).
+
+See [the analysis writeup](https://github.com/yan-istart/IStart-Note-AI-Plugin/issues) for the longer plan.
+
+---
+
+## Contributing
+
+PRs and issues are welcome. Read [CONTRIBUTING.md](./CONTRIBUTING.md) before opening a change. For security reports, see [SECURITY.md](./SECURITY.md).
+
+## License
+
+MIT. See [LICENSE](./LICENSE).
diff --git a/README.zh-CN.md b/README.zh-CN.md
new file mode 100644
index 0000000..5409b7a
--- /dev/null
+++ b/README.zh-CN.md
@@ -0,0 +1,182 @@
+# IStart-Note-AI
+
+> [!warning] 测试版软件
+> IStart-Note-AI 仍在持续开发中。下文标记为**实验中**的功能可能在没有提前通知的情况下变更或移除。Frontmatter schema 尚未稳定，尝试新功能前请先备份你的 Vault。
+
+[English README →](./README.md)
+
+把笔记升级成可被结构化、可被检索、可被执行的个人知识系统的 Obsidian 插件。统一的 AI 助手帮你起草、扩写、组织笔记，并自动维护概念页、双链、阅读项目，可选搭配百度云同步。
+
+底层使用 OpenAI 兼容的 chat completions 接口，默认接入 [DeepSeek](https://platform.deepseek.com)，更换 Base URL 可使用其他兼容服务。
+
+---
+
+## 功能状态总览
+
+| 功能 | 状态 | 说明 |
+| --- | --- | --- |
+| AI 助手（插入 / 替换 / 追加 / 仅展示） | 稳定 | 命令面板单一入口，配套内容分类 + 结构化 Prompt + Markdown 美化 |
+| 阅读项目 | 稳定 | 全书骨架、章节预设问题、章节总结、费曼测试 |
+| 百度云同步（笔记 + 插件配置） | 稳定 | 手动与自动模式、冲突策略、插件本身 / Obsidian 配置备份 |
+| 文档美化 | 稳定 | 重新组织标题，加入 Callout 和 Mermaid |
+| 概念页自动创建 | 稳定 | 从 `[[概念]]` 自动扫描并创建空概念页 |
+| 概念页智能补全（`ConceptCompleter`） | 实验中 | 内部实现已就绪，尚未接入命令面板 |
+| 问题图谱（`QuestionGraphManager`） | 实验中 | 已支持 frontmatter 分类与 Mermaid 演化图，尚未接入命令面板 |
+| Vault 级知识检索 | 未实现 | 列入 v2 |
+| 执行计划 / 预览 / 回滚 | 未实现 | 列入 v3 |
+
+---
+
+## 主要功能
+
+### AI 助手（统一入口）
+
+选中文字或停在光标处，用自然语言描述你想做的事：
+
+- **扩写 / 改写**选中文字
+- **解释**某个术语
+- **生成图表**（流程图、时序图、状态图、类图、ER、甘特图）和 LaTeX 公式
+- **补全**当前空章节
+- **续写**光标后的内容
+- **总结**当前文档
+- **美化**已有内容（加 Callout、双链、视觉分隔）
+
+也支持快捷标签：`[扩写]` `[解释]` `[画图]` `[补全]` `[续写]` `[总结]` `[公式]` `[时序图]`。
+
+### 结构化输出
+
+模型输出会做一层后处理，按知识库风格统一：短段落、Obsidian Callout（`> [!summary]`、`> [!warning]`、`> [!tip]`）、必要时的 Mermaid 图，以及对已有概念页自动加 `[[双链]]`。输出风格可切换：technical / minimal / academic / product / story / dashboard。
+
+### 阅读项目
+
+把一本书变成一份可执行的阅读计划：
+
+1. 输入书名（可选粘贴目录）。
+2. 插件生成阅读路线图、章节关系、读前问题。
+3. 边读边记，再生成章节总结与费曼测试。
+
+### 知识组织
+
+- 新概念先落到 `Knowledge/Concepts/_未分类/`。
+- 补全完成后，按 domain 自动归类到子目录。
+- 自动维护 domain MOC 索引页（含 Mermaid 概览图）。
+- 问题索引下生成问题演化图。
+
+### 百度云同步（可选）
+
+- 增量备份 / 双向同步 / 强制覆盖。
+- 可选连同插件本身及 Obsidian 配置（工具栏、快捷键、外观）一起备份。
+- 可选生成笔记后自动备份。
+
+> [!info] 隐私说明
+> AI 功能会把你选中的内容以及当前笔记的部分上下文发送到所配置的 chat-completions 接口。同步功能会把笔记（可选 Obsidian 配置）上传到你自己的百度网盘。完整数据流见 [PRIVACY.md](./PRIVACY.md)。
+
+---
+
+## 环境要求
+
+- Obsidian 1.7.2 及以上。
+- DeepSeek 或其它 OpenAI 兼容服务的 API Key。
+- 百度云同步（可选）：百度网盘开放平台 App ID 与 App Secret。
+
+---
+
+## 安装
+
+### 从社区插件商店（首选）
+
+正在准备提交。审核通过后：
+
+1. 设置 → 第三方插件 → 浏览。
+2. 搜索 **IStart-Note-AI**。
+3. 安装 → 启用。
+
+### 手动安装（测试版推荐方式）
+
+从 [GitHub Release](https://github.com/yan-istart/IStart-Note-AI-Plugin/releases) 下载 `main.js`、`manifest.json`、`styles.css`，放到 `<你的 Vault>/.obsidian/plugins/istart-note-ai/` 目录下。
+
+> 不要直接克隆源码安装：构建产物在 `dist/`，并不入库。请始终使用 release 资产。
+
+### 从源码构建
+
+```bash
+npm ci
+npm run build
+# dist/main.js、dist/manifest.json、dist/styles.css 即为安装文件
+```
+
+---
+
+## 设置项
+
+设置 → IStart-Note-AI：
+
+| 设置 | 说明 | 默认 |
+| --- | --- | --- |
+| API Key | DeepSeek API Key（或兼容服务） | — |
+| Base URL | chat completions 根地址 | `https://api.deepseek.com` |
+| 模型 | `deepseek-v4-flash` 或 `deepseek-v4-pro` | `deepseek-v4-flash` |
+| 输出风格 | 知识库、技术、极简、产品、学术、故事、仪表盘 | 知识库 |
+| 问答目录 | Q&A 笔记保存路径 | `Knowledge/Q&A` |
+| 概念目录 | 概念页保存路径 | `Knowledge/Concepts` |
+| 百度云同步 | 启用、App ID/Secret、远端路径、自动备份、忽略规则 | 关闭 |
+
+---
+
+## 使用方式
+
+### 桌面端
+
+- 🧠 **侧边栏图标**：打开命令面板。
+- **编辑器右键** → `IStart-Note-AI: AI 助手`。
+- **文件列表右键** → `IStart-Note-AI: AI 助手`。
+
+### 移动端
+
+- 🧠 **侧边栏图标**：打开命令面板。
+- 把 `AI 助手` 添加到移动工具栏，可一键唤起。
+
+### 工作流
+
+1. 可选：选中文字。
+2. 点击 🧠 或右键 → AI 助手。
+3. 输入指令（或用快捷标签，或留空让插件自动判断）。
+4. 预览结果，选择插入 / 替换 / 追加 / 仅展示。
+
+---
+
+## 目录结构
+
+```
+src/
+  core/           # 跨功能基础设施
+    llm/          # 统一 LLM 客户端 + JSON 提取
+  ai/             # AI 功能（助手、分类器、Planner ...）
+  features/       # 各功能 UI 与管理器
+  vault/          # Vault 写入层
+  settings/
+  actions/        # action 注册 / 命令面板
+  main.ts
+```
+
+`core/llm` 是所有 chat-completions 调用的唯一入口。新增 AI 功能应该依赖它，而不是直接调用 `requestUrl`。
+
+---
+
+## 路线图
+
+- v1.9（进行中）：统一 LLM 客户端、基础 Vault 检索、AI 操作预览、补齐开源治理。
+- v2.0：带来源引用的 Vault 级检索、问题图谱与概念成熟度看板。
+- v3.0：执行引擎 —— 把笔记转换为可预览、可回滚的计划（任务、决策、项目）。
+
+更长期规划见仓库 issue。
+
+---
+
+## 贡献
+
+欢迎提 Issue / PR。请先阅读 [CONTRIBUTING.md](./CONTRIBUTING.md)。安全相关问题请按 [SECURITY.md](./SECURITY.md) 流程提交。
+
+## 协议
+
+MIT。详见 [LICENSE](./LICENSE)。
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..e33526e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,37 @@
+# Security Policy
+
+## Supported versions
+
+Only the latest released version of IStart-Note-AI receives fixes. Please make sure you are on the latest release before reporting an issue.
+
+| Version | Supported |
+| --- | --- |
+| latest release | yes |
+| anything older | no |
+
+## Reporting a vulnerability
+
+If you believe you have found a security issue, please **do not** open a public GitHub issue. Instead:
+
+1. Use GitHub's [private vulnerability reporting](https://github.com/yan-istart/IStart-Note-AI-Plugin/security/advisories/new) for this repository.
+2. Provide a clear description of the issue, the affected version, and reproduction steps.
+3. Allow up to 14 days for an initial response.
+
+If GitHub private reporting is unavailable, open an issue with the title "Security issue — please contact me" and avoid technical details. A maintainer will reach out for a private channel.
+
+## Scope
+
+In scope:
+
+- Code inside this repository (the plugin itself).
+- Data flow as documented in [PRIVACY.md](./PRIVACY.md).
+
+Out of scope:
+
+- Vulnerabilities in DeepSeek, Baidu Pan, or any other third-party service.
+- Issues caused by user-modified builds or third-party forks.
+- Theoretical attacks against any TLS endpoint that does not affect this plugin specifically.
+
+## Disclosure
+
+Once a fix is shipped, the advisory will be published with credit to the reporter (unless anonymity is requested). Please coordinate before public disclosure to give users time to upgrade.
diff --git a/src/settings/SettingsTab.ts b/src/settings/SettingsTab.ts
index 83bdb27..d98a77d 100644
--- a/src/settings/SettingsTab.ts
+++ b/src/settings/SettingsTab.ts
@@ -47,8 +47,8 @@ export class DeepSeekSettingsTab extends PluginSettingTab {
           .addOption("deepseek-v4-flash", "deepseek-v4-flash（快速，推荐）")
           .addOption("deepseek-v4-pro", "deepseek-v4-pro（深度推理）")
           .setValue(this.plugin.settings.model)
-          .onChange(async (value: "deepseek-v4-flash" | "deepseek-v4-pro") => {
-            this.plugin.settings.model = value;
+          .onChange(async (value: string) => {
+            this.plugin.settings.model = value as "deepseek-v4-flash" | "deepseek-v4-pro";
             await this.plugin.saveSettings();
           })
       );