diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..ba27c3d
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: build & test (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    env:
+      # The unit tests + tsc don't need the Electron/Playwright binaries — skip the heavy downloads.
+      ELECTRON_SKIP_BINARY_DOWNLOAD: '1'
+      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - run: npm test
+      # Verify the macOS launcher's generated AppleScript compiles on a real Mac (no GUI needed).
+      - name: Validate generated AppleScript compiles
+        if: runner.os == 'macOS'
+        run: node scripts/check-applescript.mjs
diff --git a/README.md b/README.md
index 39cfd79..4144640 100644
--- a/README.md
+++ b/README.md
@@ -51,8 +51,11 @@ If you run Claude Code across a dozen side projects, you lose the thread: *Which
 
 | OS | Status |
 |----|--------|
-| Windows | ✅ Supported |
-| macOS / Linux | ⏳ Planned — the terminal launcher is currently Windows-only (`wt.exe` / PowerShell). PRs welcome. |
+| Windows | ✅ Supported — Windows Terminal / PowerShell. Packaged release available. |
+| macOS | ✅ Supported (beta) — opens Terminal.app via `osascript`. Run from source for now. Launcher logic + AppleScript are CI-verified on real macOS runners; the GUI flow hasn't been hardware-tested yet — feedback welcome. |
+| Linux | ✅ Supported (beta) — auto-detects `gnome-terminal` / `konsole` / `alacritty` / `kitty` / `xterm` (and `x-terminal-emulator`). Run from source. |
+
+> Packaged installers are Windows-only so far; on macOS/Linux, run from source (`npm start`). CI (GitHub Actions) builds + tests on Windows, macOS, and Linux on every push.
 
 ## Build from source
 
diff --git a/scripts/check-applescript.mjs b/scripts/check-applescript.mjs
new file mode 100644
index 0000000..0a49d19
--- /dev/null
+++ b/scripts/check-applescript.mjs
@@ -0,0 +1,18 @@
+// macOS-only CI check: validate that the AppleScript DevDeck actually generates
+// COMPILES on a real Mac (via osacompile) — no GUI/window server required. Imports
+// the real builder so the check can never drift from the shipped code.
+import { buildMacLaunch } from '../dist/shared/posixLaunch.js';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const [cmd] = buildMacLaunch([{ name: 'x', dir: '/tmp/x', command: 'claude -c' }]);
+// Re-extract the `-e <script>` pairs (everything before the trailing dir+command argv).
+const eArgs = [];
+for (let i = 0; i < cmd.args.length - 2; i++) {
+  if (cmd.args[i] === '-e') eArgs.push('-e', cmd.args[i + 1]);
+}
+if (eArgs.length === 0) { console.error('no -e script bodies found'); process.exit(1); }
+
+execFileSync('osacompile', [...eArgs, '-o', join(tmpdir(), 'devdeck-check.scpt')], { stdio: 'inherit' });
+console.log('AppleScript compiled OK (' + eArgs.filter((a) => a !== '-e').length + ' lines)');
diff --git a/src/main/ipc.ts b/src/main/ipc.ts
index 0a5ba7e..32d43d9 100644
--- a/src/main/ipc.ts
+++ b/src/main/ipc.ts
@@ -6,7 +6,7 @@ import { scanRepos } from './scanner';
 import { getGitInfo } from './gitInfo';
 import { listSessions, isValidSessionId, lastUserMessageForSession } from './sessions';
 import { buildProjectList } from './projects';
-import { openProjects, resolveShell, resolveWtPath } from './launcher';
+import { openProjects } from './launcher';
 import type { WtTab } from '../shared/wtArgs';
 import { scanUsage } from './usageScan';
 import { DEFAULT_THRESHOLDS } from '../shared/staleness';
@@ -82,7 +82,6 @@ export function registerIpc(cfg: IpcConfig): void {
 
   ipcMain.handle('projects:open', (_e, items: { path: string; sessionId: string | null }[]) => {
     const base = effBaseDir();
-    const shellExe = resolveShell();
     const now = new Date().toISOString();
     const tabs: WtTab[] = [];
     for (const it of items) {
@@ -102,14 +101,14 @@ export function registerIpc(cfg: IpcConfig): void {
         command = 'claude';
       }
       tabs.push({
-        name: it.path.split('\\').pop() ?? it.path,
+        name: it.path.split(/[\\/]/).pop() ?? it.path,
         dir: it.path,
         command,
       });
       // Record lastOpened only for accepted (validated) projects.
       cfg.store.setLastOpened(it.path, now);
     }
-    openProjects(tabs, { wtPath: resolveWtPath(), shell: shellExe, onError: cfg.sendError });
+    openProjects(tabs, { onError: cfg.sendError });
   });
 
   // Open the project folder in the OS file manager.
diff --git a/src/main/launcher.test.ts b/src/main/launcher.test.ts
index 069c489..45c0b5e 100644
--- a/src/main/launcher.test.ts
+++ b/src/main/launcher.test.ts
@@ -1,19 +1,22 @@
 import { describe, it, expect } from 'vitest';
-import { openProjects, resolveShell, resolveWtPath } from './launcher';
+import { openProjects, resolveShell, resolveWtPath, detectLinuxTerminal } from './launcher';
+import type { WtTab } from '../shared/wtArgs';
 
-describe('openProjects', () => {
-  it('spawns wt once with a tab per project', () => {
-    const calls: { file: string; args: string[] }[] = [];
-    const fakeSpawn = (file: string, args: string[]) => { calls.push({ file, args }); };
+type Call = { file: string; args: string[] };
+const sink = () => { const calls: Call[] = []; return { calls, fn: (file: string, args: string[]) => { calls.push({ file, args }); } }; };
+
+const tabs: WtTab[] = [
+  { name: 'a', dir: '/g/a', command: 'claude -r a0b1c2d3' },
+  { name: 'b', dir: '/g/b', command: 'claude -c' },
+];
 
+describe('openProjects (Windows)', () => {
+  it('spawns wt once with a tab per project', () => {
+    const { calls, fn } = sink();
     openProjects(
-      [
-        { name: 'a', dir: 'C:\\g\\a', command: 'claude -r 1' },
-        { name: 'b', dir: 'C:\\g\\b', command: 'claude -r 2' },
-      ],
-      { wtPath: 'wt.exe', shell: 'pwsh', spawnFn: fakeSpawn },
+      [{ name: 'a', dir: 'C:\\g\\a', command: 'claude -r 1' }, { name: 'b', dir: 'C:\\g\\b', command: 'claude -r 2' }],
+      { platform: 'win32', wtPath: 'wt.exe', shell: 'pwsh', spawnFn: fn },
     );
-
     expect(calls).toHaveLength(1);
     expect(calls[0].file).toBe('wt.exe');
     expect(calls[0].args.slice(0, 2)).toEqual(['-w', '0']);
@@ -22,30 +25,56 @@ describe('openProjects', () => {
 
   it('does nothing for an empty selection', () => {
     let called = false;
-    openProjects([], { wtPath: 'wt.exe', shell: 'pwsh', spawnFn: () => { called = true; } });
+    openProjects([], { platform: 'win32', spawnFn: () => { called = true; } });
     expect(called).toBe(false);
   });
 });
 
-describe('resolveShell', () => {
-  it('returns pwsh when pwsh is present', () => {
-    expect(resolveShell(() => true)).toBe('pwsh');
+describe('openProjects (macOS)', () => {
+  it('spawns osascript once per project with dir+command as trailing argv', () => {
+    const { calls, fn } = sink();
+    openProjects(tabs, { platform: 'darwin', spawnFn: fn });
+    expect(calls).toHaveLength(2);
+    expect(calls.every((c) => c.file === 'osascript')).toBe(true);
+    expect(calls[0].args.slice(-2)).toEqual(['/g/a', 'claude -r a0b1c2d3']);
   });
-  it('falls back to powershell when pwsh is absent', () => {
-    expect(resolveShell(() => false)).toBe('powershell');
+});
+
+describe('openProjects (Linux)', () => {
+  it('spawns the chosen terminal once per project', () => {
+    const { calls, fn } = sink();
+    openProjects(tabs, { platform: 'linux', linuxTerm: 'gnome-terminal', spawnFn: fn });
+    expect(calls).toHaveLength(2);
+    expect(calls.every((c) => c.file === 'gnome-terminal')).toBe(true);
+  });
+
+  it('reports an error and spawns nothing when no terminal is found', () => {
+    let spawned = 0; let err = '';
+    openProjects(tabs, { platform: 'linux', linuxTerm: null, spawnFn: () => { spawned++; }, onError: (m) => { err = m; } });
+    expect(spawned).toBe(0);
+    expect(err).toContain('No supported terminal');
   });
 });
 
+describe('detectLinuxTerminal', () => {
+  it('returns the first installed terminal in preference order', () => {
+    expect(detectLinuxTerminal((c) => c === 'konsole')).toBe('konsole');
+  });
+  it('returns null when none are installed', () => {
+    expect(detectLinuxTerminal(() => false)).toBeNull();
+  });
+});
+
+describe('resolveShell', () => {
+  it('returns pwsh when present', () => { expect(resolveShell(() => true)).toBe('pwsh'); });
+  it('falls back to powershell when absent', () => { expect(resolveShell(() => false)).toBe('powershell'); });
+});
+
 describe('resolveWtPath', () => {
-  // Regression: spawning the bare alias name `wt.exe` fails with ENOENT (Node's
-  // PATH search stat-rejects the reparse-point alias). We must return the FULL
-  // WindowsApps path so CreateProcess can resolve the alias.
-  it('returns the full WindowsApps alias path, not the bare name', () => {
-    expect(resolveWtPath('C:\\Users\\x\\AppData\\Local')).toBe(
-      'C:\\Users\\x\\AppData\\Local\\Microsoft\\WindowsApps\\wt.exe',
-    );
+  it('returns the full WindowsApps alias path', () => {
+    expect(resolveWtPath('C:\\Users\\x\\AppData\\Local')).toBe('C:\\Users\\x\\AppData\\Local\\Microsoft\\WindowsApps\\wt.exe');
   });
-  it('falls back to the bare name when LOCALAPPDATA is empty/unset', () => {
+  it('falls back to the bare name when LOCALAPPDATA is empty', () => {
     expect(resolveWtPath('')).toBe('wt.exe');
   });
 });
diff --git a/src/main/launcher.ts b/src/main/launcher.ts
index 646156c..266a662 100644
--- a/src/main/launcher.ts
+++ b/src/main/launcher.ts
@@ -1,14 +1,10 @@
 import { spawn, execFileSync } from 'node:child_process';
-import { join } from 'node:path';
+import { win32 as pathWin32 } from 'node:path';
 import { buildWtArgs, type WtTab } from '../shared/wtArgs';
+import { buildMacLaunch, buildLinuxLaunch, type LaunchCmd } from '../shared/posixLaunch';
 
 export type SpawnFn = (file: string, args: string[]) => void;
-
-export interface OpenOptions {
-  wtPath: string;
-  shell: string;
-  spawnFn?: SpawnFn;
-}
+export type ExistsProbe = (cmd: string) => boolean;
 
 /**
  * Path to Windows Terminal's WindowsApps execution alias.
@@ -16,43 +12,95 @@ export interface OpenOptions {
  * `wt.exe` is a reparse-point alias, not a normal file: `fs.existsSync` reports it
  * as missing and Node's PATH search for a bare `wt.exe` stat-rejects it, so
  * `spawn('wt.exe')` fails with ENOENT even when WindowsApps is on PATH. Spawning
- * the FULL alias path directly works — CreateProcess resolves the reparse point —
- * so we always return the full path (never gate it on existsSync) and fall back to
- * the bare name only when LOCALAPPDATA is unavailable.
+ * the FULL alias path directly works — CreateProcess resolves the reparse point.
  */
 export function resolveWtPath(localAppData = process.env.LOCALAPPDATA): string {
+  // Always a Windows path (wt.exe is Windows-only), so use win32.join — plain
+  // join() would emit POSIX separators when this runs/tests on macOS or Linux.
   return localAppData
-    ? join(localAppData, 'Microsoft', 'WindowsApps', 'wt.exe')
+    ? pathWin32.join(localAppData, 'Microsoft', 'WindowsApps', 'wt.exe')
     : 'wt.exe';
 }
 
-export type ExistsProbe = (cmd: string) => boolean;
-
-const defaultPwshExists: ExistsProbe = (cmd) => {
-  try {
-    execFileSync('where', [cmd], { stdio: 'ignore', windowsHide: true });
-    return true;
-  } catch {
-    return false;
-  }
-};
+function whichProbe(probe: string): ExistsProbe {
+  return (cmd) => {
+    try {
+      execFileSync(probe, [cmd], { stdio: 'ignore', windowsHide: true });
+      return true;
+    } catch {
+      return false;
+    }
+  };
+}
+const defaultPwshExists = whichProbe('where');
 
 /** Prefer PowerShell 7 (`pwsh`) if it is on PATH, else fall back to Windows PowerShell. */
 export function resolveShell(exists: ExistsProbe = defaultPwshExists): string {
   return exists('pwsh') ? 'pwsh' : 'powershell';
 }
 
-export function openProjects(
-  tabs: WtTab[],
-  opts: OpenOptions & { onError?: (msg: string) => void },
-): void {
+/** Linux terminal emulators we know how to drive, in preference order. */
+export const LINUX_TERMINALS = ['x-terminal-emulator', 'gnome-terminal', 'konsole', 'alacritty', 'kitty', 'xterm'];
+
+/** First installed terminal from LINUX_TERMINALS, or null if none are found. */
+export function detectLinuxTerminal(exists: ExistsProbe = whichProbe('which')): string | null {
+  for (const t of LINUX_TERMINALS) if (exists(t)) return t;
+  return null;
+}
+
+export interface PlanDeps {
+  wtPath?: string;
+  shell?: string;
+  linuxTerm?: string | null;
+}
+
+/** Build the list of spawnable commands for the given platform (pure given its deps). */
+export function planLaunch(tabs: WtTab[], platform: NodeJS.Platform, deps: PlanDeps = {}): LaunchCmd[] {
+  if (tabs.length === 0) return [];
+  if (platform === 'darwin') return buildMacLaunch(tabs);
+  if (platform === 'linux') {
+    const term = deps.linuxTerm ?? detectLinuxTerminal();
+    return term ? buildLinuxLaunch(tabs, term) : [];
+  }
+  // win32 and anything else: one Windows Terminal window with a tab per project
+  const wtPath = deps.wtPath ?? resolveWtPath();
+  const shell = deps.shell ?? resolveShell();
+  return [{ file: wtPath, args: buildWtArgs(tabs, shell) }];
+}
+
+export interface OpenOptions {
+  platform?: NodeJS.Platform;
+  wtPath?: string;
+  shell?: string;
+  linuxTerm?: string | null;
+  spawnFn?: SpawnFn;
+  onError?: (msg: string) => void;
+}
+
+function defaultSpawn(onError?: (msg: string) => void): SpawnFn {
+  return (file, args) => {
+    const child = spawn(file, args, { detached: true, stdio: 'ignore', windowsHide: false });
+    child.on('error', (err) => {
+      console.error('DevDeck: failed to launch terminal', err);
+      onError?.(`Failed to launch terminal (${file}): ${(err as Error).message}`);
+    });
+    child.unref();
+  };
+}
+
+/** Open each project in a platform-appropriate terminal running its command. */
+export function openProjects(tabs: WtTab[], opts: OpenOptions = {}): void {
   if (tabs.length === 0) return;
-  const args = buildWtArgs(tabs, opts.shell);
-  if (opts.spawnFn) { opts.spawnFn(opts.wtPath, args); return; }
-  const child = spawn(opts.wtPath, args, { detached: true, stdio: 'ignore', windowsHide: false });
-  child.on('error', (err) => {
-    console.error('DevDeck: failed to launch Windows Terminal', err);
-    opts.onError?.(`Failed to launch Windows Terminal: ${(err as Error).message}`);
-  });
-  child.unref();
+  const platform = opts.platform ?? process.platform;
+
+  let linuxTerm = opts.linuxTerm;
+  if (platform === 'linux' && linuxTerm === undefined) linuxTerm = detectLinuxTerminal();
+  if (platform === 'linux' && !linuxTerm) {
+    opts.onError?.('No supported terminal emulator found (tried ' + LINUX_TERMINALS.join(', ') + '). Install one.');
+    return;
+  }
+
+  const cmds = planLaunch(tabs, platform, { wtPath: opts.wtPath, shell: opts.shell, linuxTerm });
+  const doSpawn = opts.spawnFn ?? defaultSpawn(opts.onError);
+  for (const c of cmds) doSpawn(c.file, c.args);
 }
diff --git a/src/shared/posixLaunch.test.ts b/src/shared/posixLaunch.test.ts
new file mode 100644
index 0000000..38ea0d6
--- /dev/null
+++ b/src/shared/posixLaunch.test.ts
@@ -0,0 +1,70 @@
+import { describe, it, expect } from 'vitest';
+import { buildMacLaunch, buildLinuxLaunch } from './posixLaunch';
+import type { WtTab } from './wtArgs';
+
+const tab = (over: Partial<WtTab> = {}): WtTab => ({ name: 'proj', dir: '/Users/x/proj', command: 'claude -c', ...over });
+
+describe('buildMacLaunch', () => {
+  it('returns one osascript invocation per tab, passing dir+command as trailing argv', () => {
+    const cmds = buildMacLaunch([tab(), tab({ dir: '/Users/x/b', command: 'claude -r a0b1c2d3' })]);
+    expect(cmds).toHaveLength(2);
+    expect(cmds[0].file).toBe('osascript');
+    // dir and command are passed as argv (NOT interpolated into the script) -> no AppleScript injection
+    expect(cmds[0].args.slice(-2)).toEqual(['/Users/x/proj', 'claude -c']);
+    expect(cmds[1].args.slice(-2)).toEqual(['/Users/x/b', 'claude -r a0b1c2d3']);
+  });
+
+  it('declares an argv run handler and quotes the directory via "quoted form of"', () => {
+    const [cmd] = buildMacLaunch([tab()]);
+    expect(cmd.args).toContain('on run argv');
+    const doScript = cmd.args.find((a) => a.includes('do script'));
+    expect(doScript).toBeDefined();
+    expect(doScript!).toContain('quoted form of (item 1 of argv)');
+    expect(doScript!).toContain('item 2 of argv');
+  });
+
+  it('never interpolates dir/command into the -e script bodies (injection-safe)', () => {
+    const evil = tab({ dir: '/p"; do shell script "rm -rf ~', command: 'claude -c' });
+    const [cmd] = buildMacLaunch([evil]);
+    const scriptBodies = cmd.args.filter((a, i) => cmd.args[i - 1] === '-e').join('\n');
+    expect(scriptBodies).not.toContain('rm -rf');
+    expect(cmd.args).toContain('/p"; do shell script "rm -rf ~'); // present only as a trailing argv value
+  });
+});
+
+describe('buildLinuxLaunch', () => {
+  it('gnome-terminal: uses --working-directory and -- bash -lc', () => {
+    const [cmd] = buildLinuxLaunch([tab()], 'gnome-terminal');
+    expect(cmd).toEqual({
+      file: 'gnome-terminal',
+      args: ['--working-directory=/Users/x/proj', '--', 'bash', '-lc', 'claude -c; exec bash'],
+    });
+  });
+
+  it('konsole: uses --workdir and -e bash -lc', () => {
+    const [cmd] = buildLinuxLaunch([tab()], 'konsole');
+    expect(cmd).toEqual({
+      file: 'konsole',
+      args: ['--workdir', '/Users/x/proj', '-e', 'bash', '-lc', 'claude -c; exec bash'],
+    });
+  });
+
+  it('xterm/x-terminal-emulator: cd into a single-quoted dir inside bash -lc', () => {
+    const [xt] = buildLinuxLaunch([tab()], 'xterm');
+    expect(xt).toEqual({ file: 'xterm', args: ['-e', 'bash', '-lc', "cd '/Users/x/proj' && claude -c; exec bash"] });
+    const [xte] = buildLinuxLaunch([tab()], 'x-terminal-emulator');
+    expect(xte.file).toBe('x-terminal-emulator');
+    expect(xte.args).toEqual(['-e', 'bash', '-lc', "cd '/Users/x/proj' && claude -c; exec bash"]);
+  });
+
+  it('shell-escapes single quotes in the directory path', () => {
+    const [cmd] = buildLinuxLaunch([tab({ dir: "/p/o'brien" })], 'xterm');
+    expect(cmd.args[3]).toBe("cd '/p/o'\\''brien' && claude -c; exec bash");
+  });
+
+  it('falls back to xterm-style for an unknown terminal', () => {
+    const [cmd] = buildLinuxLaunch([tab()], 'mystery-term');
+    expect(cmd.file).toBe('mystery-term');
+    expect(cmd.args.slice(0, 3)).toEqual(['-e', 'bash', '-lc']);
+  });
+});
diff --git a/src/shared/posixLaunch.ts b/src/shared/posixLaunch.ts
new file mode 100644
index 0000000..b2bc0fa
--- /dev/null
+++ b/src/shared/posixLaunch.ts
@@ -0,0 +1,52 @@
+import type { WtTab } from './wtArgs';
+
+/** A spawnable command: an executable plus its argv. */
+export interface LaunchCmd {
+  file: string;
+  args: string[];
+}
+
+// macOS: open one Terminal window per project. The directory and command are passed
+// as `argv` to osascript (NOT interpolated into the AppleScript source), so a crafted
+// path/command can never inject AppleScript. The directory is shell-quoted by
+// AppleScript's `quoted form of` before the `cd`; the command is our own trusted
+// string (`claude`, `claude -c`, or `claude -r <validated-id>`).
+const MAC_SCRIPT = [
+  '-e', 'on run argv',
+  '-e', 'tell application "Terminal" to do script ("cd " & quoted form of (item 1 of argv) & " && " & (item 2 of argv))',
+  '-e', 'tell application "Terminal" to activate',
+  '-e', 'end run',
+];
+
+export function buildMacLaunch(tabs: WtTab[]): LaunchCmd[] {
+  return tabs.map((t) => ({ file: 'osascript', args: [...MAC_SCRIPT, t.dir, t.command] }));
+}
+
+/** POSIX single-quote a string for safe inclusion in a `bash -lc` command. */
+function shSingleQuote(s: string): string {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+
+/**
+ * Linux: one terminal window per project, keeping the shell open after the command
+ * (`exec bash`). Terminals differ in how they set the working directory and run a
+ * command, so we special-case the common ones and fall back to the `-e` convention
+ * (xterm / x-terminal-emulator / unknowns) with an explicit `cd`.
+ */
+export function buildLinuxLaunch(tabs: WtTab[], term: string): LaunchCmd[] {
+  return tabs.map((t) => {
+    const keepOpen = `${t.command}; exec bash`;
+    switch (term) {
+      case 'gnome-terminal':
+        return { file: term, args: [`--working-directory=${t.dir}`, '--', 'bash', '-lc', keepOpen] };
+      case 'konsole':
+        return { file: term, args: ['--workdir', t.dir, '-e', 'bash', '-lc', keepOpen] };
+      case 'alacritty':
+        return { file: term, args: ['--working-directory', t.dir, '-e', 'bash', '-lc', keepOpen] };
+      case 'kitty':
+        return { file: term, args: ['--directory', t.dir, 'bash', '-lc', keepOpen] };
+      default:
+        return { file: term, args: ['-e', 'bash', '-lc', `cd ${shSingleQuote(t.dir)} && ${keepOpen}`] };
+    }
+  });
+}