diff --git a/package.json b/package.json
index 06d306e..64c9b5e 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "devflow",
   "private": true,
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/scripts/package-devflow.ps1 b/scripts/package-devflow.ps1
index 7535c3b..12b5e5e 100644
--- a/scripts/package-devflow.ps1
+++ b/scripts/package-devflow.ps1
@@ -36,7 +36,17 @@ if ($Mode -eq "verify") {
 
 Write-Host "== 通道2: 全量发版换装(tauri build -> 静默安装 -> 启动验证) =="
 Write-Host "[1/4] tauri build(可能 10 分钟级)..."
-cmd /c "cargo tauri build 2>&1"
+# 本地换装不需要 updater 签名产物:未设私钥时用 --config 关掉 createUpdaterArtifacts,
+# 否则 tauri build 必因「A public key has been found, but no private key」报错中断(实测多次),
+# 安装段被跳过,只能手工补 swap-install。发版(需签名)走 publish-release.ps1。
+$tauriArgs = "cargo tauri build"
+if (-not $env:TAURI_SIGNING_PRIVATE_KEY) {
+    Write-Host "       [本地换装模式] 未设 TAURI_SIGNING_PRIVATE_KEY -> 关闭 updater 产物(发版走 publish-release.ps1)"
+    $override = "$repo\temp\local-no-updater.json"
+    @{ bundle = @{ createUpdaterArtifacts = $false } } | ConvertTo-Json | Set-Content $override -Encoding utf8
+    $tauriArgs = "cargo tauri build --config `"$override`""
+}
+cmd /c "$tauriArgs 2>&1"
 if ($LASTEXITCODE -ne 0) { Write-Host "[失败] tauri build"; exit 1 }
 
 $bundle = Get-ChildItem "$repo\target\release\bundle\nsis\*.exe" | Sort-Object LastWriteTime -Descending | Select-Object -First 1
diff --git a/scripts/publish-release.ps1 b/scripts/publish-release.ps1
index 9d84957..1d8190b 100644
--- a/scripts/publish-release.ps1
+++ b/scripts/publish-release.ps1
@@ -81,7 +81,12 @@ if (-not $Notes) {
     if (-not $Notes) { $Notes = "DevFlow v$version" }
 }
 $pubDate = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
-$sha256 = (Get-FileHash $artifact.FullName -Algorithm SHA256).Hash.ToLower()
+# SHA256:本机 PowerShell 5.1 实测缺 Get-FileHash(同 swap-install 兜底口径),异常走 certutil
+function Get-Sha256Lower($path) {
+    try { return (Get-FileHash -Path $path -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower() }
+    catch { return (((certutil -hashfile $path SHA256) | Select-Object -Index 1) -replace '\s', '').ToLower() }
+}
+$sha256 = Get-Sha256Lower $artifact.FullName
 $latestJson = [ordered]@{
     version   = $version
     notes     = $Notes
@@ -94,7 +99,10 @@ $latestJson = [ordered]@{
     }
 } | ConvertTo-Json -Depth 5
 $latestPath = "$repo\target\release\bundle\nsis\latest.json"
-$latestJson | Out-File $latestPath -Encoding utf8 -NoNewline
+# ⚠️ 必须写「UTF-8 无 BOM」:Windows PowerShell 5.1 的 `Out-File -Encoding utf8` 会写 BOM
+# (EF BB BF),部分 JSON 解析路径会报 "expected value at line 1 column 1",
+# 表现为 updater 拿到清单即失败(签名/包都没错,只多了头 3 字节)。2026-10-10 实证修正。
+[System.IO.File]::WriteAllText($latestPath, $latestJson, (New-Object System.Text.UTF8Encoding($false)))
 Write-Host "       latest.json: version=$version, sha256=$($sha256.Substring(0,16))..."
 
 # ── 5. 上传到 app.1216.top ──