fix(query-editor): prevent AI inline completion from trapping cursor

延续上一轮 AI 补全卡顿修复：AI 元数据预热把整库列灌入共享缓存后，仍有三处热点会
阻塞主线程——buildQueryEditorAiContext 每次请求全量重建合并 Map、普通补全
findPreloadedColumns/relevantColumns 对全量列逐条正则扫描、ghost 可见期间
scroll/layout 每帧全量重渲染 overlay。改为：AI 上下文按依赖引用相等缓存（并保持
数组身份稳定使下游索引跨请求复用）、共享列按表名/标识符建 WeakMap 索引、
重定位用 rAF 合并。

.containerignore

@@ -0,0 +1,18 @@
+.git
+.github
+.idea
+.ace-tool
+.playwright-mcp
+.superpowers
+.worktrees
+bin
+build
+dist
+frontend/dist
+node_modules
+frontend/node_modules
+tools/__pycache__
+GoNavi-Wails
+GoNavi-Wails.exe
+optional-driver-agent
+optional-driver-agent.exe

.dockerignore

@@ -0,0 +1,18 @@
+.git
+.github
+.idea
+.ace-tool
+.playwright-mcp
+.superpowers
+.worktrees
+bin
+build
+dist
+frontend/dist
+node_modules
+frontend/node_modules
+tools/__pycache__
+GoNavi-Wails
+GoNavi-Wails.exe
+optional-driver-agent
+optional-driver-agent.exe

.github/workflows/docker-images.yml

@@ -0,0 +1,204 @@
+name: Docker Images
+
+on:
+  push:
+    branches:
+      - dev
+    tags:
+      - 'v*'
+
+concurrency:
+  group: docker-images-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    name: Build ${{ matrix.image_name }} (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        image_name:
+          - gonavi-mcp-server
+          - gonavi-build-env
+        platform:
+          - linux/amd64
+          - linux/arm64
+        include:
+          - image_name: gonavi-mcp-server
+            dockerfile: Dockerfile.mcp-server
+            description: GoNavi MCP Server container image
+          - image_name: gonavi-build-env
+            dockerfile: Dockerfile.build-env
+            description: GoNavi Linux build environment image
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Prepare build variables
+        id: prep
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "owner_lc=$(printf '%s' "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
+          echo "platform_pair=$(printf '%s' "${{ matrix.platform }}" | tr '/' '-')" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ steps.prep.outputs.owner_lc }}/${{ matrix.image_name }}
+          labels: |
+            org.opencontainers.image.title=${{ matrix.image_name }}
+            org.opencontainers.image.description=${{ matrix.description }}
+
+      - name: Build smoke image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          platforms: ${{ matrix.platform }}
+          load: true
+          tags: codex-smoke/${{ matrix.image_name }}:local
+          cache-from: type=gha,scope=${{ matrix.image_name }}-${{ steps.prep.outputs.platform_pair }}
+
+      - name: Smoke test MCP Server image
+        if: matrix.image_name == 'gonavi-mcp-server'
+        shell: bash
+        run: |
+          set -euo pipefail
+          cid="$(docker run -d -p 8765:8765 -e GONAVI_MCP_HTTP_TOKEN=smoke-token codex-smoke/${{ matrix.image_name }}:local http)"
+          trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
+          for _ in 1 2 3 4 5 6 7 8 9 10; do
+            if curl --fail --silent http://127.0.0.1:8765/healthz >/dev/null; then
+              exit 0
+            fi
+            sleep 1
+          done
+          docker logs "$cid"
+          echo "MCP Server image smoke test failed" >&2
+          exit 1
+
+      - name: Smoke test build environment image
+        if: matrix.image_name == 'gonavi-build-env'
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm codex-smoke/${{ matrix.image_name }}:local \
+            bash -lc 'go version && node -v && npm -v && wails version'
+
+      - name: Push by digest
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
+          tags: ghcr.io/${{ steps.prep.outputs.owner_lc }}/${{ matrix.image_name }}
+          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=${{ matrix.image_name }}-${{ steps.prep.outputs.platform_pair }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.image_name }}-${{ steps.prep.outputs.platform_pair }}
+
+      - name: Export digest
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "${{ runner.temp }}/digests"
+          digest="${{ steps.push.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ matrix.image_name }}-${{ steps.prep.outputs.platform_pair }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    name: Publish ${{ matrix.image_name }}
+    runs-on: ubuntu-latest
+    needs: build
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image_name: gonavi-mcp-server
+            description: GoNavi MCP Server container image
+          - image_name: gonavi-build-env
+            description: GoNavi Linux build environment image
+    steps:
+      - name: Normalize image namespace
+        id: vars
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "owner_lc=$(printf '%s' "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
+
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-${{ matrix.image_name }}-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ steps.vars.outputs.owner_lc }}/${{ matrix.image_name }}
+          flavor: |
+            latest=false
+          tags: |
+            type=raw,value=dev-latest,enable=${{ github.ref == 'refs/heads/dev' }}
+            type=sha,format=short,prefix=dev-,enable=${{ github.ref == 'refs/heads/dev' }}
+            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+          labels: |
+            org.opencontainers.image.title=${{ matrix.image_name }}
+            org.opencontainers.image.description=${{ matrix.description }}
+
+      - name: Create manifest list and push
+        working-directory: ${{ runner.temp }}/digests
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf 'ghcr.io/${{ steps.vars.outputs.owner_lc }}/${{ matrix.image_name }}@sha256:%s ' *)
+
+      - name: Inspect image
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker buildx imagetools inspect "ghcr.io/${{ steps.vars.outputs.owner_lc }}/${{ matrix.image_name }}:${{ steps.meta.outputs.version }}"

.github/workflows/release-winget.yml

@@ -1,25 +0,0 @@
-name: Publish to WinGet
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-    inputs:
-      release_tag:
-        required: true
-        description: 'Tag of release you want to publish'
-        type: string
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
-jobs:
-  publish:
-    runs-on: windows-latest
-    steps:
-      - uses: vedantmgoyal9/winget-releaser@v2
-        with:
-          identifier: Syngnat.GoNavi
-          installers-regex: 'GoNavi-windows-(amd64|arm64)\.exe$'
-          release-tag: ${{ inputs.release_tag || github.ref_name }}
-          token: ${{ secrets.WINGET_TOKEN }}

.github/workflows/release.yml

@@ -8,13 +8,211 @@ on:
 permissions:
   contents: write
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
 jobs:
+  frontend:
+    name: Build frontend
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Cache frontend node_modules
+        uses: actions/cache@v5
+        with:
+          path: frontend/node_modules
+          key: ${{ runner.os }}-node20-frontend-${{ hashFiles('frontend/package-lock.json') }}
+
+      - name: Install Wails
+        run: go install -v github.com/wailsapp/wails/v2/cmd/wails@v2.11.0
+
+      - name: Build frontend dist
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p frontend/dist
+          printf '<!doctype html><title>GoNavi</title>\n' > frontend/dist/index.html
+          wails generate module
+          node frontend/scripts/wails-frontend-install.mjs
+          npm --prefix frontend run build
+
+      - name: Pack frontend dist
+        shell: bash
+        run: tar -cf frontend-dist.tar -C frontend/dist .
+
+      - name: Upload frontend dist
+        uses: actions/upload-artifact@v6
+        with:
+          name: frontend-dist
+          path: frontend-dist.tar
+          if-no-files-found: error
+          retention-days: 1
+
+  driver_agents:
+    name: Detect changed driver agents
+    runs-on: ubuntu-latest
+    outputs:
+      drivers: ${{ steps.detect.outputs.drivers }}
+      has_changes: ${{ steps.detect.outputs.has_changes }}
+      release_source: ${{ steps.detect.outputs.release_source }}
+      compare_base: ${{ steps.detect.outputs.compare_base }}
+      force_global_driver_builds: ${{ steps.detect.outputs.force_global_driver_builds }}
+      published_source_commit: ${{ steps.published_source.outputs.source_commit }}
+      has_manifest: ${{ steps.published_source.outputs.has_manifest }}
+      manifest_valid: ${{ steps.published_source.outputs.manifest_valid }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Resolve published driver release source
+        id: published_source
+        env:
+          DRIVER_RELEASE_TOKEN: ${{ secrets.DRIVER_RELEASE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          PREV_TAG="$(git describe --tags --match 'v*' --abbrev=0 "${GITHUB_SHA}^" 2>/dev/null || true)"
+          manifest_path="$RUNNER_TEMP/published-driver-manifest.json"
+          if [[ -z "$PREV_TAG" ]]; then
+            echo "source_commit=" >> "$GITHUB_OUTPUT"
+            echo "has_manifest=false" >> "$GITHUB_OUTPUT"
+            echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+            echo "🧭 No previous stable tag found; full rebuild will be used"
+            exit 0
+          fi
+          SOURCE_COMMIT="$(python3 tools/resolve-driver-release-source.py --repo Syngnat/GoNavi-DriverAgents --tag "$PREV_TAG" --manifest-output "$manifest_path")"
+          echo "source_commit=${SOURCE_COMMIT}" >> "$GITHUB_OUTPUT"
+          if [[ -s "$manifest_path" ]]; then
+            echo "has_manifest=true" >> "$GITHUB_OUTPUT"
+            echo "🧭 Published driver release exposes revision manifest"
+          else
+            echo "has_manifest=false" >> "$GITHUB_OUTPUT"
+            echo "🧭 Published driver release has no revision manifest"
+          fi
+          if [[ -n "$SOURCE_COMMIT" && -s "$manifest_path" ]]; then
+            if bash ./tools/validate-driver-release-manifest.sh --commit "$SOURCE_COMMIT" --manifest "$manifest_path"; then
+              if python3 tools/validate-driver-release-assets.py --repo Syngnat/GoNavi-DriverAgents --tag "$PREV_TAG"; then
+                echo "manifest_valid=true" >> "$GITHUB_OUTPUT"
+                echo "🧭 Published driver release manifest and actual assets are consistent with its source commit"
+              else
+                echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+                echo "⚠️ Published driver release assets do not match manifest; forcing full rebuild"
+              fi
+            else
+              echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+              echo "⚠️ Published driver release manifest is stale; forcing full rebuild"
+            fi
+          else
+            echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+          fi
+          if [[ -n "$SOURCE_COMMIT" ]]; then
+            echo "🧭 Last published release source commit (${PREV_TAG}): $SOURCE_COMMIT"
+          else
+            echo "🧭 Unable to resolve published release source commit for ${PREV_TAG}; fallback to previous tag diff"
+          fi
+
+      - name: Detect changed driver agents
+        id: detect
+        shell: bash
+        run: |
+          set -euo pipefail
+          merge_csv() {
+            local current="$1"
+            local incoming="$2"
+            local merged="$current"
+            local seen=",${current},"
+            local item
+            IFS=',' read -r -a items <<< "$incoming"
+            for item in "${items[@]}"; do
+              item="$(printf '%s' "$item" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+              if [[ -z "$item" ]]; then
+                continue
+              fi
+              if [[ "$seen" == *",$item,"* ]]; then
+                continue
+              fi
+              if [[ -n "$merged" ]]; then
+                merged="${merged},${item}"
+              else
+                merged="$item"
+              fi
+              seen="${seen}${item},"
+            done
+            printf '%s\n' "$merged"
+          }
+
+          git fetch --force --tags
+          PREV_TAG="$(git describe --tags --match 'v*' --abbrev=0 "${GITHUB_SHA}^" 2>/dev/null || true)"
+          if [ -n "$PREV_TAG" ]; then
+            BASE_REF="$PREV_TAG"
+            RELEASE_SOURCE="$PREV_TAG"
+          else
+            BASE_REF="all"
+            RELEASE_SOURCE="all"
+          fi
+          HAS_MANIFEST="${{ steps.published_source.outputs.has_manifest }}"
+          MANIFEST_VALID="${{ steps.published_source.outputs.manifest_valid }}"
+          if [[ "$RELEASE_SOURCE" != "all" && "$HAS_MANIFEST" != "true" ]]; then
+            echo "⚠️ Published driver release lacks revision manifest; forcing full rebuild to self-heal old assets"
+            BASE_REF="all"
+            RELEASE_SOURCE="all"
+          elif [[ "$RELEASE_SOURCE" != "all" && "$MANIFEST_VALID" != "true" ]]; then
+            echo "⚠️ Published driver release manifest is stale; forcing full rebuild to self-heal old assets"
+            BASE_REF="all"
+            RELEASE_SOURCE="all"
+          fi
+          DRIVERS="$(bash ./tools/detect-changed-driver-agents.sh --base "$BASE_REF" --head "$GITHUB_SHA")"
+          if [[ "$BASE_REF" != "all" ]]; then
+            REVISION_DRIVERS=""
+            for PLATFORM in darwin/amd64 darwin/arm64 windows/amd64 windows/arm64 linux/amd64 linux/arm64; do
+              PLATFORM_DRIVERS="$(bash ./tools/diff-driver-agent-revisions.sh --base "$BASE_REF" --head "$GITHUB_SHA" --platform "$PLATFORM")" || {
+                echo "⚠️ 平台 revision 差异对比失败（${PLATFORM}），保守回退为全量驱动重建"
+                DRIVERS="$(bash ./tools/detect-changed-driver-agents.sh --base all --head "$GITHUB_SHA")"
+                REVISION_DRIVERS=""
+                break
+              }
+              REVISION_DRIVERS="$(merge_csv "$REVISION_DRIVERS" "$PLATFORM_DRIVERS")"
+            done
+            if [[ -n "$REVISION_DRIVERS" ]]; then
+              echo "🧭 Revision diff union drivers: $REVISION_DRIVERS"
+              DRIVERS="$(merge_csv "$DRIVERS" "$REVISION_DRIVERS")"
+            fi
+          fi
+          FORCE_GLOBAL_DRIVER_BUILDS="$(bash ./tools/should-force-global-driver-builds.sh --base "$BASE_REF" --head "$GITHUB_SHA")"
+          echo "drivers=${DRIVERS}" >> "$GITHUB_OUTPUT"
+          echo "release_source=${RELEASE_SOURCE}" >> "$GITHUB_OUTPUT"
+          echo "compare_base=${BASE_REF}" >> "$GITHUB_OUTPUT"
+          echo "force_global_driver_builds=${FORCE_GLOBAL_DRIVER_BUILDS}" >> "$GITHUB_OUTPUT"
+          if [ -n "$DRIVERS" ]; then
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+            echo "🧭 Changed driver agents since ${BASE_REF}: $DRIVERS"
+          else
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            echo "🧭 No driver-agent changes since ${BASE_REF}"
+          fi
+          if [[ "$FORCE_GLOBAL_DRIVER_BUILDS" == "true" ]]; then
+            echo "🧭 Driver build/release plumbing changed; preserve global driver rebuild set on every platform"
+          fi
+
   # Phase 1: Build in parallel and output artifacts
   build:
     name: Build ${{ matrix.platform }}
+    needs:
+      - frontend
+      - driver_agents
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -38,7 +236,7 @@ jobs:
             artifact_suffix: ""
             build_optional_agents: true
             linux_webkit: ""
-          - os: windows-latest
+          - os: windows-2025-vs2026
             platform: windows/amd64
             os_name: Windows
             arch_name: Amd64
@@ -47,7 +245,7 @@ jobs:
             artifact_suffix: ""
             build_optional_agents: true
             linux_webkit: ""
-          - os: windows-latest
+          - os: windows-2025-vs2026
             platform: windows/arm64
             os_name: Windows
             arch_name: Arm64
@@ -65,6 +263,15 @@ jobs:
             artifact_suffix: ""
             build_optional_agents: true
             linux_webkit: "4.0"
+          - os: ubuntu-22.04-arm
+            platform: linux/arm64
+            os_name: Linux
+            arch_name: Arm64
+            build_name: gonavi-build-linux-arm64
+            wails_tags: ""
+            artifact_suffix: ""
+            build_optional_agents: true
+            linux_webkit: "4.0"
           # Debian 13 (trixie) 默认仓库已切到 WebKitGTK 4.1：单独提供 4.1 变体产物
           - os: ubuntu-24.04
             platform: linux/amd64
@@ -78,21 +285,46 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
-          check-latest: true
+          go-version-file: 'go.mod'
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Download frontend dist
+        id: download_frontend_dist
+        continue-on-error: true
+        uses: actions/download-artifact@v7
         with:
-          node-version: '20'
+          name: frontend-dist
+          path: frontend-artifact
+
+      - name: Reset failed frontend dist download
+        if: steps.download_frontend_dist.outcome != 'success'
+        shell: bash
+        run: rm -rf frontend-artifact
+
+      - name: Retry frontend dist download
+        if: steps.download_frontend_dist.outcome != 'success'
+        uses: actions/download-artifact@v7
+        with:
+          name: frontend-dist
+          path: frontend-artifact
+
+      - name: Extract frontend dist
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p frontend/dist
+          test -s frontend-artifact/frontend-dist.tar
+          tar -xf frontend-artifact/frontend-dist.tar -C frontend/dist
+          test -s frontend/dist/index.html
 
       - name: Install UPX (Windows)
-        if: contains(matrix.platform, 'windows')
+        if: matrix.platform == 'windows/amd64'
         shell: pwsh
         run: |
           $UPX_VERSION = "4.2.4"
@@ -131,6 +363,12 @@ jobs:
           # AppImage 运行/打包可能需要 FUSE2。不同发行版/版本包名不同，做兼容兜底。
           sudo apt-get install -y libfuse2 || sudo apt-get install -y libfuse2t64 || true
 
+          if [ "${{ matrix.arch_name }}" != "Amd64" ]; then
+            echo "⚠️ Linux arm64 暂不生成 AppImage，仅产出 tar.gz"
+            touch /tmp/skip-appimage
+            exit 0
+          fi
+
           # Download linuxdeploy tools for AppImage packaging
           LINUXDEPLOY_URL="https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage"
           PLUGIN_URL="https://github.com/linuxdeploy/linuxdeploy-plugin-gtk/releases/download/continuous/linuxdeploy-plugin-gtk-x86_64.AppImage"
@@ -155,11 +393,11 @@ jobs:
           fi
 
       - name: Install Wails
-        run: go install -v github.com/wailsapp/wails/v2/cmd/wails@latest
+        run: go install -v github.com/wailsapp/wails/v2/cmd/wails@v2.11.0
 
       - name: Setup MSYS2 Toolchain For DuckDB (Windows AMD64)
         id: msys2_duckdb
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
+        if: ${{ matrix.platform == 'windows/amd64' }}
         continue-on-error: true
         uses: msys2/setup-msys2@v2
         with:
@@ -167,9 +405,10 @@ jobs:
           update: true
           install: >-
             mingw-w64-ucrt-x86_64-gcc
+            mingw-w64-ucrt-x86_64-binutils
 
       - name: Configure DuckDB CGO Toolchain (Windows AMD64)
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
+        if: ${{ matrix.platform == 'windows/amd64' }}
         shell: pwsh
         run: |
           function Find-MingwBin([string[]]$candidates) {
@@ -227,7 +466,7 @@ jobs:
           Write-Host "✅ 已配置 DuckDB cgo 编译器: gcc=$gcc g++=$gxx"
 
       - name: Verify DuckDB CGO Toolchain (Windows AMD64)
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
+        if: ${{ matrix.platform == 'windows/amd64' }}
         shell: pwsh
         run: |
           & "$env:CC" --version
@@ -237,57 +476,271 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          echo "🧭 为 ${{ matrix.platform }} 全量生成 driver-agent revision 指纹，避免跨平台沿用旧 revision"
+          ./tools/generate-driver-agent-revisions.sh --platform "${{ matrix.platform }}"
+          REVISION_HASH="$(python3 - <<'PY'
+          import hashlib
+          from pathlib import Path
+
+          print(hashlib.sha256(Path("internal/db/driver_agent_revisions_gen.go").read_bytes()).hexdigest())
+          PY
+          )"
+          export GOCACHE="${RUNNER_TEMP}/go-build-${{ matrix.os_name }}-${{ matrix.arch_name }}-${REVISION_HASH}"
+          mkdir -p "$GOCACHE"
+          echo "🧭 使用隔离 GOCACHE：$GOCACHE"
           if [ -n "${{ matrix.wails_tags }}" ]; then
-            wails build -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -tags "${{ matrix.wails_tags }}" -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${{ github.ref_name }}"
+            wails build -s -skipbindings -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -tags "${{ matrix.wails_tags }}" -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${{ github.ref_name }}"
           else
-            wails build -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${{ github.ref_name }}"
+            wails build -s -skipbindings -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${{ github.ref_name }}"
+          fi
+
+      - name: Resolve Platform Driver Revision Diff
+        id: revision_diff
+        if: ${{ matrix.build_optional_agents && needs.driver_agents.outputs.has_changes == 'true' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          BASE_REF="${{ needs.driver_agents.outputs.compare_base }}"
+          FALLBACK_DRIVERS="${{ needs.driver_agents.outputs.drivers }}"
+          FORCE_GLOBAL_DRIVER_BUILDS="${{ needs.driver_agents.outputs.force_global_driver_builds }}"
+
+          if [[ -z "$BASE_REF" || "$BASE_REF" == "all" || "$FORCE_GLOBAL_DRIVER_BUILDS" == "true" ]]; then
+            if [[ "$FORCE_GLOBAL_DRIVER_BUILDS" == "true" && -n "$BASE_REF" && "$BASE_REF" != "all" ]]; then
+              echo "⚠️ 当前提交涉及 driver 构建/发布链路，保留全局驱动重建结果：${FALLBACK_DRIVERS}"
+            else
+              echo "⚠️ 未拿到可比对的历史 release 基线，回退使用全局检测结果：${FALLBACK_DRIVERS}"
+            fi
+            echo "drivers=${FALLBACK_DRIVERS}" >> "$GITHUB_OUTPUT"
+          else
+            echo "🧭 对比当前平台 revision：base=${BASE_REF} head=${GITHUB_SHA} platform=${{ matrix.platform }}"
+            if DRIVERS="$(bash ./tools/diff-driver-agent-revisions.sh --base "$BASE_REF" --head "$GITHUB_SHA" --platform "${{ matrix.platform }}")"; then
+              echo "🧭 当前平台实际需要重建的 driver agents: ${DRIVERS:-<empty>}"
+              echo "drivers=${DRIVERS}" >> "$GITHUB_OUTPUT"
+            else
+              echo "⚠️ revision 差异对比失败，保守回退为全量重建"
+              ALL_DRIVERS="$(bash ./tools/detect-changed-driver-agents.sh --base all --head "$GITHUB_SHA")"
+              echo "drivers=${ALL_DRIVERS}" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+
+          DRIVERS="$(sed -n 's/^drivers=//p' "$GITHUB_OUTPUT" | tail -n 1)"
+          if [[ -n "$DRIVERS" ]]; then
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Build Optional Driver Agents
-        if: ${{ matrix.build_optional_agents }}
+        if: ${{ matrix.build_optional_agents && steps.revision_diff.outputs.has_changes == 'true' }}
         shell: bash
+        env:
+          CHANGED_DRIVER_AGENTS: ${{ steps.revision_diff.outputs.drivers }}
         run: |
           set -euo pipefail
           TARGET_PLATFORM="${{ matrix.platform }}"
           GOOS="${TARGET_PLATFORM%%/*}"
           GOARCH="${TARGET_PLATFORM##*/}"
-          DRIVERS=(mariadb doris sphinx sqlserver sqlite duckdb dameng kingbase highgo vastbase mongodb tdengine clickhouse)
+          REVISION_HASH="$(python3 - <<'PY'
+          import hashlib
+          from pathlib import Path
+
+          print(hashlib.sha256(Path("internal/db/driver_agent_revisions_gen.go").read_bytes()).hexdigest())
+          PY
+          )"
+          export GOCACHE="${RUNNER_TEMP}/go-build-${{ matrix.os_name }}-${{ matrix.arch_name }}-${REVISION_HASH}"
+          mkdir -p "$GOCACHE"
+          echo "🧭 可选驱动使用隔离 GOCACHE：$GOCACHE"
+          normalize_driver_token() {
+            local value
+            value="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+            case "$value" in
+              "") return 1 ;;
+              doris|diros) echo "doris" ;;
+              open_gauss|open-gauss) echo "opengauss" ;;
+              gaussdb|gauss_db|gauss-db) echo "gaussdb" ;;
+              elastic|elasticsearch) echo "elasticsearch" ;;
+              mariadb|oceanbase|starrocks|sphinx|sqlserver|sqlite|duckdb|dameng|kingbase|highgo|vastbase|opengauss|gaussdb|iris|mongodb|tdengine|iotdb|clickhouse)
+                echo "$value"
+                ;;
+              *)
+                echo "❌ 不支持的 driver-agent：${1:-}" >&2
+                return 1
+                ;;
+            esac
+          }
+
+          build_driver_name() {
+            case "$1" in
+              doris) echo "diros" ;;
+              *) echo "$1" ;;
+            esac
+          }
+
+          declare -a RAW_DRIVERS=()
+          declare -a DRIVERS=()
+          IFS=',' read -r -a RAW_DRIVERS <<< "$CHANGED_DRIVER_AGENTS"
+          for RAW_DRIVER in "${RAW_DRIVERS[@]}"; do
+            DRIVER="$(normalize_driver_token "$RAW_DRIVER")" || continue
+            DRIVERS+=("$DRIVER")
+          done
+          if [ ${#DRIVERS[@]} -eq 0 ]; then
+            echo "🧭 没有需要构建的 driver-agent"
+            exit 0
+          fi
+          NORMALIZED_CHANGED_DRIVER_AGENTS="$(IFS=,; echo "${DRIVERS[*]}")"
+          echo "🧭 归一后的 driver-agent 构建列表：${NORMALIZED_CHANGED_DRIVER_AGENTS}"
           OUTDIR="drivers/${{ matrix.os_name }}"
           mkdir -p "$OUTDIR"
+          DUCKDB_WINDOWS_LIBRARY_VERSION="v1.4.4"
+          DUCKDB_WINDOWS_LIBRARY_URL="https://github.com/duckdb/duckdb/releases/download/${DUCKDB_WINDOWS_LIBRARY_VERSION}/libduckdb-windows-amd64.zip"
+
+          prepare_duckdb_windows_library() {
+            local lib_dir="$RUNNER_TEMP/duckdb-windows-${DUCKDB_WINDOWS_LIBRARY_VERSION}"
+            local extract_dir="$RUNNER_TEMP/duckdb-windows-extract-${DUCKDB_WINDOWS_LIBRARY_VERSION}"
+            local zip_path="$RUNNER_TEMP/libduckdb-windows-amd64.zip"
+            if [ -f "$lib_dir/duckdb.dll" ] && [ -f "$lib_dir/libduckdb.dll.a" ] && [ -f "$lib_dir/libduckdb.a" ]; then
+              echo "$lib_dir"
+              return 0
+            fi
+            mkdir -p "$lib_dir"
+            rm -rf "$extract_dir"
+            rm -f "$zip_path"
+            local attempt dll_path
+            for attempt in 1 2 3; do
+              echo "📥 下载 DuckDB Windows 动态库 (${attempt}/3): ${DUCKDB_WINDOWS_LIBRARY_URL}" >&2
+              if curl --retry 3 --retry-delay 2 --retry-all-errors --connect-timeout 20 --max-time 300 -fsSL "$DUCKDB_WINDOWS_LIBRARY_URL" -o "$zip_path"; then
+                if unzip -tq "$zip_path" >/dev/null 2>&1; then
+                  rm -rf "$lib_dir"
+                  rm -rf "$extract_dir"
+                  mkdir -p "$lib_dir"
+                  mkdir -p "$extract_dir"
+                  unzip -qo "$zip_path" -d "$extract_dir"
+                  dll_path="$(find "$extract_dir" -type f -name duckdb.dll | head -n 1 || true)"
+                  if [ -n "$dll_path" ]; then
+                    cp "$dll_path" "$lib_dir/duckdb.dll"
+                    go run ./cmd/mingw-import-lib \
+                      --dll "$lib_dir/duckdb.dll" \
+                      --output-lib "$lib_dir/libduckdb.dll.a"
+                    cp "$lib_dir/libduckdb.dll.a" "$lib_dir/libduckdb.a"
+                    rm -rf "$extract_dir"
+                    echo "$lib_dir"
+                    return 0
+                  fi
+                  echo "⚠️ DuckDB Windows 动态库压缩包缺少 duckdb.dll，准备重试" >&2
+                else
+                  echo "⚠️ DuckDB Windows 动态库压缩包校验失败，准备重试" >&2
+                fi
+              else
+                echo "⚠️ DuckDB Windows 动态库下载失败，准备重试" >&2
+              fi
+              rm -f "$zip_path"
+              rm -rf "$lib_dir"
+              rm -rf "$extract_dir"
+              mkdir -p "$lib_dir"
+              sleep $((attempt * 2))
+            done
+            echo "❌ 无法准备 DuckDB Windows 动态库：${DUCKDB_WINDOWS_LIBRARY_URL}" >&2
+            return 1
+          }
 
           for DRIVER in "${DRIVERS[@]}"; do
-            BUILD_DRIVER="$DRIVER"
-            if [ "$DRIVER" = "doris" ]; then
-              BUILD_DRIVER="diros"
-            fi
+            BUILD_DRIVER="$(build_driver_name "$DRIVER")"
             if [ "$DRIVER" = "duckdb" ] && [ "$GOOS" = "windows" ] && [ "$GOARCH" != "amd64" ]; then
               echo "⚠️ 跳过 DuckDB driver（当前平台 ${GOOS}/${GOARCH} 不受支持，仅支持 windows/amd64）"
               continue
             fi
-            TAG="gonavi_${BUILD_DRIVER}_driver"
-            OUTPUT="${DRIVER}-driver-agent-${GOOS}-${GOARCH}"
-            if [ "$GOOS" = "windows" ]; then
-              OUTPUT="${OUTPUT}.exe"
-            fi
-            OUTPUT_PATH="${OUTDIR}/${OUTPUT}"
-            echo "🔧 构建 ${OUTPUT_PATH} (tag=${TAG})"
-            if [ "$DRIVER" = "duckdb" ]; then
-              CGO_ENABLED=1 GOOS="$GOOS" GOARCH="$GOARCH" go build \
-                -tags "${TAG}" \
-                -trimpath \
-                -ldflags "-s -w" \
-                -o "${OUTPUT_PATH}" \
-                ./cmd/optional-driver-agent
-            else
-              CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" go build \
-                -tags "${TAG}" \
-                -trimpath \
-                -ldflags "-s -w" \
-                -o "${OUTPUT_PATH}" \
-                ./cmd/optional-driver-agent
+            DRIVER_VARIANTS=("")
+            if [ "$DRIVER" = "mongodb" ]; then
+              DRIVER_VARIANTS=("v1" "v2" "")
             fi
+            for DRIVER_VARIANT in "${DRIVER_VARIANTS[@]}"; do
+              TAG="gonavi_${BUILD_DRIVER}_driver"
+              BUILD_TAGS="$TAG"
+              OUTPUT_STEM="${DRIVER}-driver-agent"
+              if [ "$DRIVER" = "mongodb" ]; then
+                if [ "$DRIVER_VARIANT" = "v1" ]; then
+                  BUILD_TAGS="gonavi_mongodb_driver_v1"
+                  OUTPUT_STEM="mongodb-driver-agent-v1"
+                elif [ "$DRIVER_VARIANT" = "v2" ]; then
+                  BUILD_TAGS="gonavi_mongodb_driver"
+                  OUTPUT_STEM="mongodb-driver-agent-v2"
+                else
+                  BUILD_TAGS="gonavi_mongodb_driver"
+                fi
+              fi
+              OUTPUT="${OUTPUT_STEM}-${GOOS}-${GOARCH}"
+              if [ "$GOOS" = "windows" ]; then
+                OUTPUT="${OUTPUT}.exe"
+              fi
+              OUTPUT_PATH="${OUTDIR}/${OUTPUT}"
+              DUCKDB_LIB_DIR=""
+              if [ "$DRIVER" = "duckdb" ] && [ "$GOOS" = "windows" ] && [ "$GOARCH" = "amd64" ]; then
+                DUCKDB_LIB_DIR="$(prepare_duckdb_windows_library)"
+                BUILD_TAGS="${BUILD_TAGS} duckdb_use_lib"
+              fi
+              echo "🔧 构建 ${OUTPUT_PATH} (tags=${BUILD_TAGS})"
+              if [ "$DRIVER" = "duckdb" ]; then
+                if [ -n "$DUCKDB_LIB_DIR" ]; then
+                  DUCKDB_LIB_DIR_GCC="$(cygpath -m "$DUCKDB_LIB_DIR")"
+                  DUCKDB_LIB_DIR_PATH="$(cygpath -u "$DUCKDB_LIB_DIR")"
+                  # cgo 会把每个 CGO_LDFLAGS 片段转成 //go:cgo_ldflag，-L 参数不能再额外包引号。
+                  DUCKDB_WINDOWS_CGO_LDFLAGS="-L${DUCKDB_LIB_DIR_GCC} -lduckdb -lstdc++ -lm -lws2_32 -lwsock32 -lrstrtmgr"
+                  CGO_ENABLED=1 GOOS="$GOOS" GOARCH="$GOARCH" CGO_LDFLAGS="${DUCKDB_WINDOWS_CGO_LDFLAGS}" PATH="${DUCKDB_LIB_DIR_PATH}:$PATH" go build \
+                    -tags "${BUILD_TAGS}" \
+                    -trimpath \
+                    -ldflags "-s -w" \
+                    -o "${OUTPUT_PATH}" \
+                    ./cmd/optional-driver-agent
+                  cp "$DUCKDB_LIB_DIR/duckdb.dll" "$OUTDIR/duckdb.dll"
+                  bash ./tools/compress-driver-artifact.sh "$OUTDIR/duckdb.dll" "$TARGET_PLATFORM" "${{ matrix.os_name }}/duckdb.dll"
+                else
+                  CGO_ENABLED=1 GOOS="$GOOS" GOARCH="$GOARCH" go build \
+                    -tags "${BUILD_TAGS}" \
+                    -trimpath \
+                    -ldflags "-s -w" \
+                    -o "${OUTPUT_PATH}" \
+                    ./cmd/optional-driver-agent
+                fi
+              else
+                CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" go build \
+                  -tags "${BUILD_TAGS}" \
+                  -trimpath \
+                  -ldflags "-s -w" \
+                  -o "${OUTPUT_PATH}" \
+                  ./cmd/optional-driver-agent
+              fi
+              bash ./tools/compress-driver-artifact.sh "${OUTPUT_PATH}" "$TARGET_PLATFORM" "${{ matrix.os_name }}/${OUTPUT}"
+              if [ "$DRIVER" = "duckdb" ] && [ -n "$DUCKDB_LIB_DIR" ]; then
+                DUCKDB_ZIP_PATH="${OUTDIR}/duckdb-driver.zip"
+                export DUCKDB_ZIP_PATH
+                export DUCKDB_AGENT_PATH="${OUTPUT_PATH}"
+                export DUCKDB_DLL_PATH="${OUTDIR}/duckdb.dll"
+              python3 - <<'PY'
+          import os
+          import zipfile
+
+          zip_path = os.environ["DUCKDB_ZIP_PATH"]
+          entries = [
+              ("Windows/duckdb-driver-agent-windows-amd64.exe", os.environ["DUCKDB_AGENT_PATH"]),
+              ("Windows/duckdb.dll", os.environ["DUCKDB_DLL_PATH"]),
+          ]
+
+          with zipfile.ZipFile(zip_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
+              for arcname, src in entries:
+                  if not os.path.isfile(src):
+                      raise FileNotFoundError(src)
+                  zf.write(src, arcname)
+          PY
+                echo "📦 已生成 DuckDB Windows 专属驱动包: ${DUCKDB_ZIP_PATH}"
+              fi
+            done
           done
 
+          bash ./tools/verify-driver-agent-revisions.sh \
+            --assets-dir drivers \
+            --platform "$TARGET_PLATFORM" \
+            --drivers "$NORMALIZED_CHANGED_DRIVER_AGENTS"
+
       # macOS Packaging
       - name: Package macOS DMG
         if: contains(matrix.platform, 'darwin')
@@ -314,6 +767,9 @@ jobs:
           echo "🔏 正在进行 Ad-hoc 签名..."
           # 注意：Ad-hoc + hardened runtime（--options runtime）在未配置 entitlements 时，
           # 可能导致部分 macOS 机型上应用双击无响应。这里保持 Ad-hoc 深签名但禁用 runtime hardened。
+          if command -v xattr >/dev/null 2>&1; then
+            xattr -cr "$APP_NAME" || true
+          fi
           codesign --force --deep --sign - "$APP_NAME"
           
           DMG_NAME="${{ matrix.build_name }}.dmg"
@@ -330,6 +786,17 @@ jobs:
             --app-drop-link 600 185 \
             "$DMG_NAME" \
             "$APP_NAME"
+
+          VERIFY_MOUNT_DIR=$(mktemp -d "${TMPDIR:-/tmp}/gonavi-release-verify.XXXXXX")
+          hdiutil attach -nobrowse -readonly -mountpoint "$VERIFY_MOUNT_DIR" "$DMG_NAME" >/dev/null
+          PACKAGED_APP=$(find "$VERIFY_MOUNT_DIR" -maxdepth 1 -name "*.app" | head -n 1)
+          if [ -z "$PACKAGED_APP" ]; then
+            echo "❌ DMG 内未找到 .app 应用包!"
+            hdiutil detach "$VERIFY_MOUNT_DIR" -quiet >/dev/null 2>&1 || true
+            exit 1
+          fi
+          codesign --verify --deep --strict --verbose=4 "$PACKAGED_APP"
+          hdiutil detach "$VERIFY_MOUNT_DIR" -quiet >/dev/null 2>&1 || true
             
           mv "$DMG_NAME" "../../$FINAL_NAME"
 
@@ -484,7 +951,7 @@ jobs:
 
       # Upload to Actions Artifacts (Temporary Storage)
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: build-artifacts-${{ strategy.job-index }} # Unique name per job
           path: |
@@ -498,11 +965,16 @@ jobs:
   # Phase 2: Collect all artifacts and Publish Release (Single Job)
   release:
     name: Publish Release
-    needs: build
+    needs:
+      - build
+      - driver_agents
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
       - name: Download All Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           path: release-assets
           pattern: build-artifacts-*
@@ -511,31 +983,49 @@ jobs:
       - name: List Assets
         run: ls -R release-assets
 
+      - name: Complete Driver Agent Assets
+        if: needs.driver_agents.outputs.has_changes == 'true' && needs.driver_agents.outputs.release_source != 'all'
+        env:
+          DRIVER_RELEASE_TOKEN: ${{ secrets.DRIVER_RELEASE_TOKEN }}
+        run: |
+          python3 tools/complete-driver-release-assets.py \
+            --assets-dir release-assets \
+            --source "${{ needs.driver_agents.outputs.release_source }}" \
+            --require-complete
+
       - name: Verify Optional Driver Assets
+        if: needs.driver_agents.outputs.has_changes == 'true'
         shell: bash
+        env:
+          CHANGED_DRIVER_AGENTS: ${{ needs.driver_agents.outputs.drivers }}
         run: |
           set -euo pipefail
           cd release-assets
 
-          REQUIRED_FILES=(
-            "drivers/Windows/duckdb-driver-agent-windows-amd64.exe"
-            "drivers/MacOS/duckdb-driver-agent-darwin-amd64"
-            "drivers/MacOS/duckdb-driver-agent-darwin-arm64"
-            "drivers/Linux/duckdb-driver-agent-linux-amd64"
-            "drivers/Windows/clickhouse-driver-agent-windows-amd64.exe"
-            "drivers/MacOS/clickhouse-driver-agent-darwin-amd64"
-            "drivers/MacOS/clickhouse-driver-agent-darwin-arm64"
-            "drivers/Linux/clickhouse-driver-agent-linux-amd64"
-          )
-
           missing=0
-          for file in "${REQUIRED_FILES[@]}"; do
-            if [ ! -f "$file" ]; then
-              echo "❌ 缺少驱动资产：$file"
-              missing=1
+          IFS=',' read -r -a DRIVERS <<< "$CHANGED_DRIVER_AGENTS"
+          for driver in "${DRIVERS[@]}"; do
+            REQUIRED_FILES=(
+              "drivers/Windows/${driver}-driver-agent-windows-amd64.exe"
+              "drivers/MacOS/${driver}-driver-agent-darwin-amd64"
+              "drivers/MacOS/${driver}-driver-agent-darwin-arm64"
+              "drivers/Linux/${driver}-driver-agent-linux-amd64"
+            )
+            if [ "$driver" != "duckdb" ]; then
+              REQUIRED_FILES+=("drivers/Windows/${driver}-driver-agent-windows-arm64.exe")
             else
-              echo "✅ 已找到驱动资产：$file"
+              REQUIRED_FILES+=("drivers/Windows/duckdb.dll")
+              REQUIRED_FILES+=("drivers/Windows/duckdb-driver.zip")
             fi
+
+            for file in "${REQUIRED_FILES[@]}"; do
+              if [ ! -f "$file" ]; then
+                echo "❌ 缺少驱动资产：$file"
+                missing=1
+              else
+                echo "✅ 已找到驱动资产：$file"
+              fi
+            done
           done
 
           if [ "$missing" -ne 0 ]; then
@@ -544,57 +1034,35 @@ jobs:
           fi
 
       - name: Package Driver Agents Bundle
+        id: driver_assets
         shell: bash
         run: |
           set -euo pipefail
           cd release-assets
           if [ ! -d drivers ]; then
             echo "⚠️ 未找到 drivers 目录，跳过驱动总包打包"
+            echo "has_driver_assets=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           if [ -z "$(find drivers -type f 2>/dev/null | head -n 1)" ]; then
             echo "⚠️ drivers 目录为空，跳过驱动总包打包"
             rm -rf drivers
+            echo "has_driver_assets=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
           echo "📦 打包驱动总包：GoNavi-DriverAgents.zip"
-          python3 - <<'PY'
-          import json
-          import os
-          import zipfile
-          from pathlib import Path
+          python3 ../tools/package-driver-release-assets.py \
+            drivers \
+            ../driver-release-assets
 
-          out_name = "GoNavi-DriverAgents.zip"
-          index_name = "GoNavi-DriverAgents-Index.json"
-          base = Path("drivers")
-          out_path = Path(out_name)
-          index_path = Path(index_name)
-          if out_path.exists():
-              out_path.unlink()
-          if index_path.exists():
-              index_path.unlink()
+          python3 ../tools/generate-driver-release-manifest.py \
+            --assets-dir drivers \
+            --output ../driver-release-assets/GoNavi-DriverAgents-Manifest.json
 
-          size_index = {}
-          with zipfile.ZipFile(out_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
-              for p in base.rglob("*"):
-                  if not p.is_file():
-                      continue
-                  arcname = p.relative_to(base).as_posix()
-                  zf.write(p, arcname)
-                  size_index[p.name] = p.stat().st_size
-
-          index_path.write_text(
-              json.dumps({"assets": size_index}, ensure_ascii=False, indent=2),
-              encoding="utf-8",
-          )
-
-          print(f"created {out_name} size={out_path.stat().st_size} bytes")
-          print(f"created {index_name} entries={len(size_index)}")
-          PY
-
-          # Release 只发布一个驱动总包，避免大量平铺资产污染 Release 页面
+          # GoNavi 主仓库只保留主程序包；驱动资产发布到独立仓库。
           rm -rf drivers
+          echo "has_driver_assets=true" >> "$GITHUB_OUTPUT"
 
       - name: Generate SHA256SUMS
         shell: bash
@@ -613,13 +1081,122 @@ jobs:
             sha256sum "${FILES[@]}" > SHA256SUMS
           fi
 
+      - name: Generate Driver SHA256SUMS
+        if: steps.driver_assets.outputs.has_driver_assets == 'true'
+        shell: bash
+        run: |
+          cd driver-release-assets
+          FILES=()
+          while IFS= read -r file; do
+            if [ -n "$file" ]; then
+              FILES+=("$file")
+            fi
+          done < <(find . -maxdepth 1 -type f ! -name SHA256SUMS -exec basename {} \; | sort)
+          if [ ${#FILES[@]} -eq 0 ]; then
+            echo "❌ 未找到驱动发布资产"
+            exit 1
+          fi
+          sha256sum "${FILES[@]}" > SHA256SUMS
+
+      - name: Create Driver Agents Release
+        if: startsWith(github.ref, 'refs/tags/') && steps.driver_assets.outputs.has_driver_assets == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.DRIVER_RELEASE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -t DRIVER_RELEASE_ASSETS < <(find driver-release-assets -maxdepth 1 -type f | sort)
+          if [ ${#DRIVER_RELEASE_ASSETS[@]} -eq 0 ]; then
+            echo "未找到 driver release assets"
+            exit 1
+          fi
+
+          NOTES_FILE="$RUNNER_TEMP/driver-release-notes.md"
+          cat > "$NOTES_FILE" <<'EOF'
+            GoNavi driver-agent assets for `${{ github.ref_name }}`.
+          EOF
+
+          gh release create "${{ github.ref_name }}" "${DRIVER_RELEASE_ASSETS[@]}" \
+            --repo Syngnat/GoNavi-DriverAgents \
+            --title "GoNavi Driver Agents ${{ github.ref_name }}" \
+            --notes-file "$NOTES_FILE" \
+            --latest
+
+      - name: Checkout code for changelog
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          path: repo-for-changelog
+
+      - name: Generate Changelog
+        id: changelog
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd repo-for-changelog
+          TAG="${{ github.ref_name }}"
+          # 获取上一个 tag
+          PREV_TAG=$(git tag --sort=-creatordate | grep -E '^v' | sed -n '2p' || true)
+          if [ -z "$PREV_TAG" ]; then
+            echo "⚠️ 未找到上一个 tag，使用全部 commit"
+            RANGE="$TAG"
+          else
+            RANGE="${PREV_TAG}..${TAG}"
+          fi
+
+          echo "📋 生成更新日志：$RANGE"
+
+          # 提取 commit 消息（排除 merge commit）
+          COMMITS=$(git log "$RANGE" --no-merges --pretty=format:'%s' 2>/dev/null || true)
+          if [ -z "$COMMITS" ]; then
+            BODY="暂无提交记录。"
+          else
+            CAT_FEAT=""
+            CAT_FIX=""
+            CAT_PERF=""
+            CAT_REFACTOR=""
+            CAT_I18N=""
+            CAT_OTHER=""
+
+            while IFS= read -r line; do
+              [ -z "$line" ] && continue
+              case "$line" in
+                ✨*|*feat*)     CAT_FEAT="${CAT_FEAT}\n- ${line}" ;;
+                🐛*|*fix*)     CAT_FIX="${CAT_FIX}\n- ${line}" ;;
+                ⚡*|*perf*)    CAT_PERF="${CAT_PERF}\n- ${line}" ;;
+                ♻️*|*refactor*) CAT_REFACTOR="${CAT_REFACTOR}\n- ${line}" ;;
+                🌐*)           CAT_I18N="${CAT_I18N}\n- ${line}" ;;
+                🔧*|🔨*|*chore*) CAT_OTHER="${CAT_OTHER}\n- ${line}" ;;
+                *)             CAT_OTHER="${CAT_OTHER}\n- ${line}" ;;
+              esac
+            done <<< "$COMMITS"
+
+            BODY=""
+            [ -n "$CAT_FEAT" ]     && BODY="${BODY}## ✨ 新功能\n${CAT_FEAT}\n\n"
+            [ -n "$CAT_FIX" ]      && BODY="${BODY}## 🐛 问题修复\n${CAT_FIX}\n\n"
+            [ -n "$CAT_PERF" ]     && BODY="${BODY}## ⚡ 性能优化\n${CAT_PERF}\n\n"
+            [ -n "$CAT_REFACTOR" ] && BODY="${BODY}## ♻️ 重构\n${CAT_REFACTOR}\n\n"
+            [ -n "$CAT_I18N" ]     && BODY="${BODY}## 🌐 国际化\n${CAT_I18N}\n\n"
+            [ -n "$CAT_OTHER" ]    && BODY="${BODY}## 🔧 其他变更\n${CAT_OTHER}\n\n"
+
+            # 附加 compare 链接
+            if [ -n "$PREV_TAG" ]; then
+              REPO_URL="${{ github.server_url }}/${{ github.repository }}"
+              BODY="${BODY}---\n**完整变更**: [${PREV_TAG}...${TAG}](${REPO_URL}/compare/${PREV_TAG}...${TAG})\n"
+            fi
+          fi
+
+          # 写入到文件避免多行环境变量问题
+          printf '%b' "$BODY" > /tmp/changelog.md
+          echo "changelog_file=/tmp/changelog.md" >> "$GITHUB_OUTPUT"
+
       - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         if: startsWith(github.ref, 'refs/tags/')
         with:
           files: release-assets/*
           draft: true
           make_latest: true
-          generate_release_notes: true
+          body_path: ${{ steps.changelog.outputs.changelog_file }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test-build-all-platforms.yml

@@ -1,412 +0,0 @@
-name: Test Build All Platforms (Manual)
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_label:
-        description: "测试包标识（仅用于文件名）"
-        required: false
-        default: "test"
-
-permissions:
-  contents: read
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
-concurrency:
-  group: test-build-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  build:
-    name: Build ${{ matrix.platform }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: macos-latest
-            platform: darwin/amd64
-            os_name: MacOS
-            arch_name: Amd64
-            build_name: gonavi-test-darwin-amd64
-            wails_tags: ""
-            artifact_suffix: ""
-            build_optional_agents: true
-            linux_webkit: ""
-          - os: macos-latest
-            platform: darwin/arm64
-            os_name: MacOS
-            arch_name: Arm64
-            build_name: gonavi-test-darwin-arm64
-            wails_tags: ""
-            artifact_suffix: ""
-            build_optional_agents: true
-            linux_webkit: ""
-          - os: windows-latest
-            platform: windows/amd64
-            os_name: Windows
-            arch_name: Amd64
-            build_name: gonavi-test-windows-amd64
-            wails_tags: ""
-            artifact_suffix: ""
-            build_optional_agents: true
-            linux_webkit: ""
-          - os: windows-latest
-            platform: windows/arm64
-            os_name: Windows
-            arch_name: Arm64
-            build_name: gonavi-test-windows-arm64
-            wails_tags: ""
-            artifact_suffix: ""
-            build_optional_agents: true
-            linux_webkit: ""
-          - os: ubuntu-22.04
-            platform: linux/amd64
-            os_name: Linux
-            arch_name: Amd64
-            build_name: gonavi-test-linux-amd64
-            wails_tags: ""
-            artifact_suffix: ""
-            build_optional_agents: true
-            linux_webkit: "4.0"
-          - os: ubuntu-24.04
-            platform: linux/amd64
-            os_name: Linux
-            arch_name: Amd64
-            build_name: gonavi-test-linux-amd64-webkit41
-            wails_tags: "webkit2_41"
-            artifact_suffix: "-WebKit41"
-            build_optional_agents: false
-            linux_webkit: "4.1"
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.24'
-          check-latest: true
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Install UPX (Windows)
-        if: contains(matrix.platform, 'windows')
-        shell: pwsh
-        run: |
-          $UPX_VERSION = "4.2.4"
-          $url = "https://github.com/upx/upx/releases/download/v${UPX_VERSION}/upx-${UPX_VERSION}-win64.zip"
-          $zipPath = "$env:RUNNER_TEMP\upx.zip"
-          $extractPath = "$env:RUNNER_TEMP\upx"
-          Write-Host "📥 从 GitHub Releases 下载 UPX v${UPX_VERSION} ..."
-          Invoke-WebRequest -Uri $url -OutFile $zipPath -UseBasicParsing
-          Expand-Archive -Path $zipPath -DestinationPath $extractPath -Force
-          $upxDir = Get-ChildItem -Path $extractPath -Directory | Select-Object -First 1
-          "$($upxDir.FullName)" | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
-          $upxCmd = Join-Path $upxDir.FullName "upx.exe"
-          if (!(Test-Path $upxCmd)) {
-            Write-Error "❌ 未检测到 upx，无法保证 Windows 测试产物经过压缩"
-            exit 1
-          }
-          & $upxCmd --version
-
-      - name: Install Linux Dependencies
-        if: contains(matrix.platform, 'linux')
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libgtk-3-dev
-
-          if [ "${{ matrix.linux_webkit }}" = "4.1" ]; then
-            sudo apt-get install -y libwebkit2gtk-4.1-dev libsoup-3.0-dev
-          else
-            sudo apt-get install -y libwebkit2gtk-4.0-dev
-          fi
-
-          sudo apt-get install -y upx-ucl || sudo apt-get install -y upx
-          upx --version
-
-          sudo apt-get install -y libfuse2 || sudo apt-get install -y libfuse2t64 || true
-
-          LINUXDEPLOY_URL="https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage"
-          PLUGIN_URL="https://github.com/linuxdeploy/linuxdeploy-plugin-gtk/releases/download/continuous/linuxdeploy-plugin-gtk-x86_64.AppImage"
-
-          wget --retry-connrefused --waitretry=1 --read-timeout=20 --timeout=15 --tries=3 -O /tmp/linuxdeploy "$LINUXDEPLOY_URL" || {
-            echo "skip-appimage=true" >> "$GITHUB_ENV"
-          }
-          wget --retry-connrefused --waitretry=1 --read-timeout=20 --timeout=15 --tries=3 -O /tmp/linuxdeploy-plugin-gtk "$PLUGIN_URL" || {
-            echo "skip-appimage=true" >> "$GITHUB_ENV"
-          }
-
-          if [ "${skip-appimage:-false}" != "true" ]; then
-            chmod +x /tmp/linuxdeploy /tmp/linuxdeploy-plugin-gtk
-          fi
-
-      - name: Install Wails
-        run: go install github.com/wailsapp/wails/v2/cmd/wails@v2.11.0
-
-      - name: Setup MSYS2 Toolchain For DuckDB (Windows AMD64)
-        id: msys2_duckdb
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
-        continue-on-error: true
-        uses: msys2/setup-msys2@v2
-        with:
-          msystem: UCRT64
-          update: true
-          install: >-
-            mingw-w64-ucrt-x86_64-gcc
-
-      - name: Configure DuckDB CGO Toolchain (Windows AMD64)
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
-        shell: pwsh
-        run: |
-          function Find-MingwBin([string[]]$candidates) {
-            foreach ($bin in $candidates) {
-              if ([string]::IsNullOrWhiteSpace($bin)) {
-                continue
-              }
-              $gcc = Join-Path $bin 'gcc.exe'
-              $gxx = Join-Path $bin 'g++.exe'
-              if ((Test-Path $gcc) -and (Test-Path $gxx)) {
-                return $bin
-              }
-            }
-            return $null
-          }
-
-          $msys2Location = "${{ steps.msys2_duckdb.outputs['msys2-location'] }}"
-          $candidateBins = @()
-          if (-not [string]::IsNullOrWhiteSpace($msys2Location)) {
-            $candidateBins += Join-Path $msys2Location 'ucrt64\bin'
-          }
-          $candidateBins += @(
-            'C:\msys64\ucrt64\bin',
-            'D:\a\_temp\msys64\ucrt64\bin'
-          )
-          $candidateBins = @($candidateBins | Select-Object -Unique)
-
-          $mingwBin = Find-MingwBin $candidateBins
-          if (-not $mingwBin) {
-            Write-Error "❌ 未找到可用的 DuckDB UCRT64 编译器。"
-            exit 1
-          }
-
-          $gcc = Join-Path $mingwBin 'gcc.exe'
-          $gxx = Join-Path $mingwBin 'g++.exe'
-          "$mingwBin" | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
-          "CC=$gcc" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
-          "CXX=$gxx" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
-
-      - name: Build App
-        shell: bash
-        run: |
-          set -euo pipefail
-          BUILD_LABEL="${{ inputs.build_label }}"
-          if [ -z "$BUILD_LABEL" ]; then
-            BUILD_LABEL="test"
-          fi
-          APP_VERSION="${BUILD_LABEL}-${GITHUB_RUN_NUMBER}"
-          if [ -n "${{ matrix.wails_tags }}" ]; then
-            wails build -platform "${{ matrix.platform }}" -clean -o "${{ matrix.build_name }}" -tags "${{ matrix.wails_tags }}" -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${APP_VERSION}"
-          else
-            wails build -platform "${{ matrix.platform }}" -clean -o "${{ matrix.build_name }}" -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${APP_VERSION}"
-          fi
-
-      - name: Build Optional Driver Agents
-        if: ${{ matrix.build_optional_agents }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          TARGET_PLATFORM="${{ matrix.platform }}"
-          GOOS="${TARGET_PLATFORM%%/*}"
-          GOARCH="${TARGET_PLATFORM##*/}"
-          DRIVERS=(mariadb doris sphinx sqlserver sqlite duckdb dameng kingbase highgo vastbase mongodb tdengine clickhouse)
-          OUTDIR="drivers/${{ matrix.os_name }}"
-          mkdir -p "$OUTDIR"
-
-          for DRIVER in "${DRIVERS[@]}"; do
-            BUILD_DRIVER="$DRIVER"
-            if [ "$DRIVER" = "doris" ]; then
-              BUILD_DRIVER="diros"
-            fi
-            if [ "$DRIVER" = "duckdb" ] && [ "$GOOS" = "windows" ] && [ "$GOARCH" != "amd64" ]; then
-              echo "跳过 DuckDB driver: ${GOOS}/${GOARCH}"
-              continue
-            fi
-            TAG="gonavi_${BUILD_DRIVER}_driver"
-            OUTPUT="${DRIVER}-driver-agent-${GOOS}-${GOARCH}"
-            if [ "$GOOS" = "windows" ]; then
-              OUTPUT="${OUTPUT}.exe"
-            fi
-            OUTPUT_PATH="${OUTDIR}/${OUTPUT}"
-            if [ "$DRIVER" = "duckdb" ]; then
-              CGO_ENABLED=1 GOOS="$GOOS" GOARCH="$GOARCH" go build -tags "$TAG" -trimpath -ldflags "-s -w" -o "$OUTPUT_PATH" ./cmd/optional-driver-agent
-            else
-              CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" go build -tags "$TAG" -trimpath -ldflags "-s -w" -o "$OUTPUT_PATH" ./cmd/optional-driver-agent
-            fi
-          done
-
-      - name: Package macOS
-        if: contains(matrix.platform, 'darwin')
-        shell: bash
-        run: |
-          set -euo pipefail
-          brew install create-dmg
-          LABEL="${{ inputs.build_label }}"
-          if [ -z "$LABEL" ]; then
-            LABEL="test"
-          fi
-          cd build/bin
-          APP_PATH=$(find . -maxdepth 1 -name "*.app" | head -n 1)
-          if [ -z "$APP_PATH" ]; then
-            echo "未找到 .app 应用包"
-            exit 1
-          fi
-          APP_NAME=$(basename "$APP_PATH")
-          APP_BIN=$(find "$APP_PATH/Contents/MacOS" -maxdepth 1 -type f | head -n 1)
-          if [ -z "$APP_BIN" ]; then
-            echo "未找到 macOS 应用主程序"
-            exit 1
-          fi
-          echo "ℹ️ macOS 产物不执行 UPX 压缩，保留原始主程序。"
-          codesign --force --deep --sign - "$APP_NAME"
-          ZIP_NAME="GoNavi-${LABEL}-${{ matrix.os_name }}-${{ matrix.arch_name }}-run${GITHUB_RUN_NUMBER}.zip"
-          DMG_NAME="GoNavi-${LABEL}-${{ matrix.os_name }}-${{ matrix.arch_name }}-run${GITHUB_RUN_NUMBER}.dmg"
-          mkdir -p ../../artifacts
-          ditto -c -k --sequesterRsrc --keepParent "$APP_NAME" "../../artifacts/$ZIP_NAME"
-          create-dmg \
-            --volname "GoNavi Test Installer" \
-            --window-pos 200 120 \
-            --window-size 800 400 \
-            --icon-size 100 \
-            --icon "$APP_NAME" 200 190 \
-            --hide-extension "$APP_NAME" \
-            --app-drop-link 600 185 \
-            "$DMG_NAME" \
-            "$APP_NAME"
-          mv "$DMG_NAME" "../../artifacts/$DMG_NAME"
-          shasum -a 256 "../../artifacts/$ZIP_NAME" > "../../artifacts/$ZIP_NAME.sha256"
-          shasum -a 256 "../../artifacts/$DMG_NAME" > "../../artifacts/$DMG_NAME.sha256"
-
-      - name: Package Windows
-        if: contains(matrix.platform, 'windows')
-        shell: pwsh
-        run: |
-          $label = "${{ inputs.build_label }}"
-          if ([string]::IsNullOrWhiteSpace($label)) { $label = 'test' }
-          Set-Location build/bin
-          $target = "${{ matrix.build_name }}"
-          $finalExeName = "GoNavi-$label-${{ matrix.os_name }}-${{ matrix.arch_name }}-run$env:GITHUB_RUN_NUMBER.exe"
-          if (Test-Path "$target.exe") {
-            $finalExe = "$target.exe"
-          } elseif (Test-Path "$target") {
-            Rename-Item -Path "$target" -NewName "$target.exe"
-            $finalExe = "$target.exe"
-          } else {
-            Write-Error "未找到构建产物 '$target'"
-            exit 1
-          }
-          $isArm64Target = "${{ matrix.arch_name }}".ToLowerInvariant() -eq "arm64"
-          if ($isArm64Target) {
-            Write-Warning "⚠️ UPX 当前不支持 win64/arm64，跳过压缩并保留原始 EXE。"
-            $LASTEXITCODE = 0
-          } else {
-            $upxCmd = Get-Command upx -ErrorAction SilentlyContinue
-            if ($null -eq $upxCmd) {
-              Write-Error "❌ 未找到 upx，无法保证 Windows 测试产物经过压缩"
-              exit 1
-            }
-            $beforeBytes = (Get-Item -LiteralPath $finalExe).Length
-            Write-Host "🗜️ 使用 UPX 压缩 $finalExe ..."
-            & upx --best --lzma --force $finalExe | Out-Host
-            if ($LASTEXITCODE -ne 0) {
-              Write-Error "❌ UPX 压缩失败（$LASTEXITCODE）"
-              exit 1
-            }
-            & upx -t $finalExe | Out-Host
-            if ($LASTEXITCODE -ne 0) {
-              Write-Error "❌ UPX 校验失败（$LASTEXITCODE）"
-              exit 1
-            }
-            $afterBytes = (Get-Item -LiteralPath $finalExe).Length
-            if ($afterBytes -lt $beforeBytes) {
-              $savedBytes = $beforeBytes - $afterBytes
-              Write-Host ("✅ UPX 压缩完成：{0:N2}MB -> {1:N2}MB，减少 {2:N2}MB" -f ($beforeBytes / 1MB), ($afterBytes / 1MB), ($savedBytes / 1MB))
-            } else {
-              Write-Host ("ℹ️ UPX 压缩完成：{0:N2}MB -> {1:N2}MB" -f ($beforeBytes / 1MB), ($afterBytes / 1MB))
-            }
-          }
-          New-Item -ItemType Directory -Force -Path ..\..\artifacts | Out-Null
-          Copy-Item -LiteralPath $finalExe -Destination "..\..\artifacts\$finalExeName" -Force
-          Get-FileHash "..\..\artifacts\$finalExeName" -Algorithm SHA256 | ForEach-Object { "{0} *{1}" -f $_.Hash.ToLower(), (Split-Path $_.Path -Leaf) } | Out-File "..\..\artifacts\$finalExeName.sha256" -Encoding ascii
-
-      - name: Package Linux
-        if: contains(matrix.platform, 'linux')
-        shell: bash
-        run: |
-          set -euo pipefail
-          LABEL="${{ inputs.build_label }}"
-          if [ -z "$LABEL" ]; then
-            LABEL="test"
-          fi
-          cd build/bin
-          TARGET="${{ matrix.build_name }}"
-          TAR_NAME="GoNavi-${LABEL}-${{ matrix.os_name }}-${{ matrix.arch_name }}${{ matrix.artifact_suffix }}-run${GITHUB_RUN_NUMBER}.tar.gz"
-          APPIMAGE_NAME="GoNavi-${LABEL}-${{ matrix.os_name }}-${{ matrix.arch_name }}${{ matrix.artifact_suffix }}-run${GITHUB_RUN_NUMBER}.AppImage"
-          mkdir -p ../../artifacts
-
-          if [ ! -f "$TARGET" ]; then
-            echo "未找到构建产物 '$TARGET'"
-            exit 1
-          fi
-          chmod +x "$TARGET"
-          BEFORE_BYTES=$(wc -c <"$TARGET" | tr -d '[:space:]')
-          echo "🗜️ 使用 UPX 压缩 Linux 可执行文件: $TARGET ..."
-          upx --best --lzma --force "$TARGET"
-          upx -t "$TARGET"
-          AFTER_BYTES=$(wc -c <"$TARGET" | tr -d '[:space:]')
-          if [ "$AFTER_BYTES" -lt "$BEFORE_BYTES" ]; then
-            SAVED_BYTES=$((BEFORE_BYTES - AFTER_BYTES))
-            awk -v b="$BEFORE_BYTES" -v a="$AFTER_BYTES" -v s="$SAVED_BYTES" 'BEGIN { printf "✅ Linux UPX 压缩完成：%.2fMB -> %.2fMB，减少 %.2fMB\n", b/1024/1024, a/1024/1024, s/1024/1024 }'
-          else
-            awk -v b="$BEFORE_BYTES" -v a="$AFTER_BYTES" 'BEGIN { printf "ℹ️ Linux UPX 压缩完成：%.2fMB -> %.2fMB\n", b/1024/1024, a/1024/1024 }'
-          fi
-          tar -czvf "../../artifacts/$TAR_NAME" "$TARGET"
-          sha256sum "../../artifacts/$TAR_NAME" > "../../artifacts/$TAR_NAME.sha256"
-
-          if [ "${skip-appimage:-false}" = "true" ]; then
-            echo "跳过 AppImage 打包"
-            exit 0
-          fi
-
-          mkdir -p AppDir/usr/bin AppDir/usr/share/applications AppDir/usr/share/icons/hicolor/256x256/apps
-          cp "$TARGET" AppDir/usr/bin/gonavi
-          printf '%s\n' '[Desktop Entry]' 'Name=GoNavi' 'Exec=gonavi' 'Icon=gonavi' 'Type=Application' 'Categories=Development;Database;' 'Comment=Database Management Tool' > AppDir/usr/share/applications/gonavi.desktop
-          cp AppDir/usr/share/applications/gonavi.desktop AppDir/gonavi.desktop
-          if [ -f "../../build/appicon.png" ]; then
-            cp "../../build/appicon.png" AppDir/usr/share/icons/hicolor/256x256/apps/gonavi.png
-            cp "../../build/appicon.png" AppDir/gonavi.png
-          else
-            touch AppDir/gonavi.png
-            cp AppDir/gonavi.png AppDir/usr/share/icons/hicolor/256x256/apps/gonavi.png
-          fi
-          export DEPLOY_GTK_VERSION=3
-          /tmp/linuxdeploy --appdir AppDir --plugin gtk --output appimage || exit 0
-          mv GoNavi*.AppImage "$APPIMAGE_NAME" 2>/dev/null || exit 0
-          mv "$APPIMAGE_NAME" "../../artifacts/$APPIMAGE_NAME"
-          sha256sum "../../artifacts/$APPIMAGE_NAME" > "../../artifacts/$APPIMAGE_NAME.sha256"
-
-      - name: Upload Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-build-${{ matrix.build_name }}-run${{ github.run_number }}
-          path: |
-            artifacts/*
-            drivers/**
-          if-no-files-found: error
-          retention-days: 7

.github/workflows/test-macos-build.yml

@@ -1,94 +0,0 @@
-name: Test Build macOS (Manual)
-
-on:
-  workflow_dispatch:
-    inputs:
-      build_label:
-        description: "测试包标识（仅用于文件名）"
-        required: false
-        default: "test"
-  push:
-    branches:
-      - feature/kingbase_opt
-    paths:
-      - ".github/workflows/test-macos-build.yml"
-
-permissions:
-  contents: read
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
-jobs:
-  build-macos:
-    name: Build macOS ${{ matrix.arch }}
-    runs-on: macos-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: darwin/amd64
-            arch: amd64
-          - platform: darwin/arm64
-            arch: arm64
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.24.3"
-          check-latest: true
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-
-      - name: Install Wails
-        run: go install github.com/wailsapp/wails/v2/cmd/wails@v2.11.0
-
-      - name: Build App
-        run: |
-          set -euo pipefail
-          OUTPUT_NAME="gonavi-test-${{ matrix.arch }}"
-          BUILD_LABEL="${{ inputs.build_label }}"
-          if [ -z "$BUILD_LABEL" ]; then
-            BUILD_LABEL="test"
-          fi
-          APP_VERSION="${BUILD_LABEL}-${GITHUB_RUN_NUMBER}"
-          wails build \
-            -platform "${{ matrix.platform }}" \
-            -clean \
-            -o "$OUTPUT_NAME" \
-            -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${APP_VERSION}"
-
-      - name: Package Zip
-        run: |
-          set -euo pipefail
-          APP_PATH="build/bin/gonavi-test-${{ matrix.arch }}.app"
-          if [ ! -d "$APP_PATH" ]; then
-            APP_PATH=$(find build/bin -maxdepth 1 -name "*.app" | head -n 1 || true)
-          fi
-          if [ -z "$APP_PATH" ] || [ ! -d "$APP_PATH" ]; then
-            echo "未找到 .app 产物"
-            ls -la build/bin || true
-            exit 1
-          fi
-          LABEL="${{ inputs.build_label }}"
-          if [ -z "$LABEL" ]; then
-            LABEL="test"
-          fi
-          ZIP_NAME="GoNavi-${LABEL}-macos-${{ matrix.arch }}-run${GITHUB_RUN_NUMBER}.zip"
-          mkdir -p artifacts
-          ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "artifacts/$ZIP_NAME"
-          shasum -a 256 "artifacts/$ZIP_NAME" > "artifacts/$ZIP_NAME.sha256"
-
-      - name: Upload Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: gonavi-macos-${{ matrix.arch }}-run${{ github.run_number }}
-          path: artifacts/*
-          if-no-files-found: error

.gitignore

@@ -1,7 +1,7 @@
 # IDE
 .idea/
 *.iml
-
+.gitignore
 # build / release artifacts
 frontend/release/
 **/release/
@@ -10,17 +10,26 @@ build/bin/
 
 # wails / node artifacts (按需)
 node_modules/
+frontend/wailsjs/tsconfig.json
 
 dist/
 .DS_Store
 .gemini-clipboard
 GoNavi-Wails
 GoNavi-Wails.exe
+optional-driver-agent
+optional-driver-agent.exe
 .ace-tool/
 .superpowers/
 .claude/
 .gemini/
+.playwright-mcp/
 **/tmpclaude-*
+docs/superpowers/
+docs/需求追踪/
 
 CLAUDE.md
 **/CLAUDE.md
+.worktrees
+docs
+.tmp_superpowers_edit

AI_EXTENSIONS_ROADMAP.md

@@ -0,0 +1,106 @@
+# AI 扩展能力路线
+
+当前 GoNavi 的 AI 链路是：
+
+1. 前端 `AIChatPanel` 组装 system messages。
+2. 前端声明本地固定工具 `LOCAL_TOOLS`。
+3. 后端 `aiservice.Service` 只负责 Provider 配置、安全级别与模型转发。
+
+这套结构已经足够承接“用户级提示词”，但要继续承接 MCP 和 Skills，需要先把“提示词 / 工具 / 技能”三层职责拆开。
+
+## 1. 用户级自定义提示词
+
+已落地的方向：
+
+- 配置存储在 `ai_config.json` 的 `userPromptSettings`。
+- 由 `AISettingsModal` 提供编辑入口。
+- 由 `AIChatPanel` 在运行时追加为 system message。
+
+建议长期保持 4 个层级：
+
+- `global`: 所有 AI 会话统一追加。
+- `database`: 数据库 / SQL 场景追加。
+- `jvm`: JVM 资源浏览与分析场景追加。
+- `jvmDiagnostic`: JVM 诊断命令规划场景追加。
+
+这样既能满足“个人习惯”定制，也不会把所有场景揉成一条超长总提示词。
+
+## 2. MCP 能力开放
+
+目标不是把 MCP 做成新的聊天面板，而是把它变成“外部工具源”。
+
+建议后续拆成三层：
+
+1. `tool registry`
+   - 统一收口内置工具、本地扩展工具、MCP 工具。
+   - 对模型只暴露统一的 `tools[]`。
+2. `mcp server config`
+   - 保存 server 名称、transport、启动命令或 URL、超时、启用状态。
+   - 由后端维护生命周期与连通性。
+3. `mcp runtime bridge`
+   - 负责 `list tools / call tool / errors / timeout / auth`。
+
+### MCP 是否需要单独 GitHub 仓库
+
+不需要把“GoNavi 对 MCP 的支持”单独拆仓库。
+
+更合理的边界是：
+
+- `GoNavi 主仓库`
+  - 维护 MCP client、配置、UI、工具注册和运行时桥接。
+- `单独仓库（可选）`
+  - 只在你要发布一个可复用的 MCP Server 时才有价值。
+  - 例如 `gonavi-mcp-sql-tools`、`gonavi-mcp-jvm-agent` 这类独立 server。
+
+结论：
+
+- “客户端支持 MCP” 不需要新仓库。
+- “某个独立 MCP Server” 是否拆仓库，取决于它要不要单独发布、复用或部署。
+
+## 3. Skills 设计
+
+Skills 不建议直接等同于“另一种提示词”。
+
+更合适的定义是：
+
+- `skill manifest`
+  - 名称、说明、适用场景、是否默认启用。
+- `skill prompt`
+  - 该技能追加的 system prompt / few-shot / 输出约束。
+- `skill tool requirements`
+  - 该技能依赖哪些内置工具或 MCP 工具。
+- `skill shortcuts`
+  - 可选地给欢迎卡片、斜杠命令或快速动作提供入口。
+
+一个 Skill 本质上应该是“提示词 + 工具依赖 + 使用入口”的组合，而不是单独一段文案。
+
+### Skills 是否需要单独 GitHub 仓库
+
+第一阶段不需要。
+
+建议顺序：
+
+1. 先在 GoNavi 主仓库内把 Skills manifest/runtime 跑通。
+2. 等格式稳定后，再考虑增加“本地目录导入”或“Git 仓库导入”。
+
+只有当你明确要做下面两件事时，独立仓库才值得：
+
+- 把 Skills 当作社区共享资产分发。
+- 让不同团队独立维护自己的 skill pack。
+
+## 建议的下一步实现顺序
+
+1. 抽出统一 `ToolRegistry`，让 `LOCAL_TOOLS` 不再硬编码在聊天面板内部。
+2. 在 AI 设置中新增 `MCP Servers` 配置页。
+3. 后端先支持最小 transport：
+   - `stdio`
+   - `http/sse`（如果后续确认需要）
+4. 在 AI 设置中新增 `Skills` 配置页。
+5. 让 Skill 以 manifest 形式声明：
+   - `id`
+   - `name`
+   - `description`
+   - `systemPrompt`
+   - `requiredTools`
+   - `scopes`
+6. 再决定是否增加“从 Git 仓库同步 MCP/Skills 包”的分发能力。

CONTRIBUTING.md

@@ -2,14 +2,14 @@
 
 Thank you for contributing to this project.
 
-This repository follows a release-first workflow: `main` is the default public branch, while releases are prepared through `release/*` branches.
+This repository uses `dev` as the default integration branch, while stable releases are published from `main` through `release/*` branches.
 
 ---
 
 ## Branch Model
 
-- `main`: stable release branch and default branch
-- `dev`: day-to-day integration branch for maintainers
+- `dev`: default branch and day-to-day integration branch
+- `main`: stable release branch
 - `release/*`: release preparation branches for maintainers
 - Recommended branch names for external contributors:
   - `fix/*`: bug fixes
@@ -25,21 +25,21 @@ feature/* / fix/* -> dev -> release/* -> main -> tag(vX.Y.Z)
 
 ## How External Contributors Should Open Pull Requests
 
-Whether your branch is `fix/*` or `feature/*`, external contributors should **open pull requests directly against `main`**.
+Whether your branch is `fix/*` or `feature/*`, external contributors should **open pull requests directly against `dev`**.
 
 Reasons:
 
-- `main` is the default branch, so the PR entry point is clearer
-- merged contributions are immediately visible on the default branch
-- maintainers can handle downstream sync and release preparation in one place
+- `dev` is the active integration branch, so changes can be reviewed in the same lane as ongoing work
+- contributors align with the branch that triggers day-to-day validation and dev builds
+- maintainers can cut `release/*` branches from `dev` without re-syncing external changes first
 
 Recommended flow:
 
 1. Fork this repository
-2. Create a branch in your fork (`fix/*` or `feature/*` is recommended)
+2. Sync your fork with `dev` and create a branch from `dev` (`fix/*` or `feature/*` is recommended)
 3. Make your changes and perform basic self-checks
 4. Push the branch to your fork
-5. Open a pull request against the `main` branch of this repository
+5. Open a pull request against the `dev` branch of this repository
 
 ---
 
@@ -63,33 +63,21 @@ Recommended expectations:
 
 ## Merge Strategy for Maintainers
 
-Pull requests merged into `main` should generally use **Squash and merge**.
+Pull requests merged into `dev` should generally use **Squash and merge**.
 
 Reasons:
 
-- keeps `main` history clean and linear
-- maps each PR to a single commit on `main`
-- reduces release, audit, and rollback complexity
+- keeps `dev` history readable and easier to audit during active iteration
+- maps each PR to a single integration commit on `dev`
+- reduces cherry-pick and conflict cost before creating `release/*`
 
 ---
 
 ## Maintainer Sync Rules
 
-Because external pull requests are merged directly into `main`, maintainers must sync `main` back to development and release branches to avoid branch drift.
+Because external pull requests are merged directly into `dev`, maintainers should treat `dev` as the source branch for daily collaboration and release preparation.
 
-### 1. Sync `main` -> `dev` (required)
-
-The automatic GitHub Actions sync workflow has been removed.
-Maintainers should sync `main` back to `dev` manually when needed:
-
-```bash
-git checkout dev
-git pull
-git merge main
-git push
-```
-
-### 2. Create `release/*` from `dev`
+### 1. Create `release/*` from `dev`
 
 Before a release, create a release branch from `dev`, for example:
 
@@ -100,7 +88,7 @@ git checkout -b release/v0.6.0
 git push -u origin release/v0.6.0
 ```
 
-### 3. Release from `release/*` back to `main`
+### 2. Release from `release/*` back to `main`
 
 When release preparation is complete, merge the release branch back into `main` and create a tag:
 
@@ -113,9 +101,9 @@ git tag v0.6.0
 git push origin v0.6.0
 ```
 
-### 4. Sync `main` back to `dev` after release
+### 3. Sync `main` back to `dev` after release
 
-After the release, the same automation still applies. If needed, you can run the workflow manually (`workflow_dispatch`) or execute the fallback commands:
+After the release, sync `main` back into `dev` so the next iteration starts from the released code line:
 
 ```bash
 git checkout dev

CONTRIBUTING.zh-CN.md

@@ -2,14 +2,14 @@
 
 感谢你对本项目的贡献。
 
-本项目采用“发布优先（`main` 为默认分支）+ `release/*` 分支发版”的协作模型。为减少分支漂移与 PR 处理成本，请在提交贡献前先阅读本指南。
+本项目当前采用“`dev` 作为默认集成分支，`main` 作为稳定发布分支，`release/*` 负责发版准备”的协作模型。为减少分支漂移与 PR 处理成本，请在提交贡献前先阅读本指南。
 
 ---
 
 ## 分支模型
 
-- `main`：稳定发布分支，也是仓库默认分支
-- `dev`：日常开发集成分支，主要供维护者使用
+- `dev`：默认分支，也是日常开发集成分支
+- `main`：稳定发布分支
 - `release/*`：发布准备分支，主要供维护者使用
 - 外部贡献者建议使用以下分支命名：
   - `fix/*`：问题修复
@@ -25,21 +25,21 @@ feature/* / fix/* -> dev -> release/* -> main -> tag(vX.Y.Z)
 
 ## 外部贡献者如何提 Pull Request
 
-无论是 `fix/*` 还是 `feature/*`，**外部贡献者统一直接向 `main` 发起 Pull Request**。
+无论是 `fix/*` 还是 `feature/*`，**外部贡献者统一直接向 `dev` 发起 Pull Request**。
 
 这样做的原因：
 
-- `main` 是默认分支，PR 入口更直观
-- 合并后贡献会直接体现在默认分支
-- 便于维护者统一做后续同步与发版整理
+- `dev` 是当前日常集成分支，评审与合入路径和维护者开发流程一致
+- 外部贡献会直接进入触发日常校验和 dev 构建的分支
+- 维护者可以直接从 `dev` 切 `release/*`，减少额外同步步骤
 
 建议流程：
 
 1. Fork 本仓库
-2. 从你自己的仓库创建分支（建议命名为 `fix/*` 或 `feature/*`）
+2. 先同步你 fork 中的 `dev`，再从 `dev` 创建分支（建议命名为 `fix/*` 或 `feature/*`）
 3. 完成代码修改，并进行必要自检
 4. 推送到你的远程分支
-5. 向本仓库的 `main` 分支发起 Pull Request
+5. 向本仓库的 `dev` 分支发起 Pull Request
 
 ---
 
@@ -63,33 +63,21 @@ feature/* / fix/* -> dev -> release/* -> main -> tag(vX.Y.Z)
 
 ## PR 合并策略（维护者）
 
-`main` 分支上的 PR 建议使用 **Squash and merge**。
+`dev` 分支上的 PR 建议使用 **Squash and merge**。
 
 原因：
 
-- 保持 `main` 历史干净、线性
-- 每个 PR 在 `main` 上对应一个清晰提交
-- 降低发布排查与回滚成本
+- 保持 `dev` 集成历史清晰、便于审查
+- 每个 PR 在 `dev` 上对应一个明确的集成提交
+- 降低发版前整理与冲突处理成本
 
 ---
 
 ## 维护者同步规则
 
-由于外部 PR 会直接合入 `main`，维护者必须及时将 `main` 的变更同步到开发与发布分支，避免分支漂移。
+由于外部 PR 会直接合入 `dev`，维护者应将 `dev` 作为日常协作与发版准备的主线分支。
 
-### 1. main → dev 同步（必做）
-
-仓库已移除 GitHub Actions 自动回灌 workflow。
-当前统一采用手动方式将 `main` 同步回 `dev`：
-
-```bash
-git checkout dev
-git pull
-git merge main
-git push
-```
-
-### 2. 发版前从 dev 切 release/*
+### 1. 发版前从 dev 切 release/*
 
 发布前由维护者基于 `dev` 创建发布分支，例如：
 
@@ -100,7 +88,7 @@ git checkout -b release/v0.6.0
 git push -u origin release/v0.6.0
 ```
 
-### 3. release/* → main 发版
+### 2. release/* → main 发版
 
 发布准备完成后，将 `release/*` 合并回 `main`，并打标签发布：
 
@@ -113,9 +101,9 @@ git tag v0.6.0
 git push origin v0.6.0
 ```
 
-### 4. main 回流到 dev（发版后必做）
+### 3. main 回流到 dev（发版后必做）
 
-发布完成后，仍沿用同一套自动化流程；如有需要，也可以手动触发 `workflow_dispatch`，或执行以下兜底命令，确保开发线与发布线一致：
+发布完成后，需要将 `main` 回流到 `dev`，确保下一轮开发从已发布代码线继续推进：
 
 ```bash
 git checkout dev

Dockerfile.build-env

@@ -0,0 +1,55 @@
+# syntax=docker/dockerfile:1.7
+
+ARG GO_IMAGE=golang:1.25-bookworm
+ARG NODE_IMAGE=node:20-bookworm
+
+FROM ${NODE_IMAGE} AS node
+
+FROM ${GO_IMAGE}
+
+ARG WEBKIT_API=4.0
+ARG WAILS_VERSION=v2.11.0
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV PATH=/go/bin:/usr/local/go/bin:${PATH}
+
+# Debian's /etc/profile resets PATH in login shells (bash -l), dropping the Go
+# toolchain; restore it via profile.d which is sourced after that reset.
+RUN printf 'export PATH=/go/bin:/usr/local/go/bin:$PATH\n' > /etc/profile.d/10-gonavi-build-env.sh
+
+# Copy only Node.js runtime assets so the Go toolchain from the base image
+# stays intact for smoke tests and interactive build shells.
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+
+# npm/npx/corepack are symlinks in the node image; COPY dereferences them into
+# standalone scripts whose relative requires break, so recreate the symlinks.
+RUN ln -sf ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -sf ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
+    && ln -sf ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        bash \
+        build-essential \
+        ca-certificates \
+        curl \
+        file \
+        git \
+        make \
+        pkg-config \
+        python3 \
+        unzip \
+        zip \
+        libgtk-3-dev \
+    && if [ "${WEBKIT_API}" = "4.1" ]; then \
+        apt-get install -y --no-install-recommends libwebkit2gtk-4.1-dev libsoup-3.0-dev; \
+    else \
+        apt-get install -y --no-install-recommends libwebkit2gtk-4.0-dev; \
+    fi \
+    && go install github.com/wailsapp/wails/v2/cmd/wails@${WAILS_VERSION} \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+CMD ["bash"]

Dockerfile.mcp-server

@@ -0,0 +1,46 @@
+# syntax=docker/dockerfile:1.7
+
+FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS builder
+
+# Declared without defaults so BuildKit injects the real target platform;
+# a default like TARGETARCH=amd64 would win and ship amd64 binaries to arm64.
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+COPY third_party/highgo-pq/go.mod ./third_party/highgo-pq/go.mod
+COPY third_party/go-irisnative/go.mod third_party/go-irisnative/go.sum ./third_party/go-irisnative/
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
+    go build -trimpath -ldflags="-s -w" -o /out/gonavi-mcp-server ./cmd/gonavi-mcp-server
+
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates tzdata \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --system --create-home --home-dir /var/lib/gonavi --uid 10001 gonavi \
+    && mkdir -p /data /var/lib/gonavi/logs \
+    && chown -R gonavi:gonavi /data /var/lib/gonavi
+
+COPY --from=builder /out/gonavi-mcp-server /usr/local/bin/gonavi-mcp-server
+
+ENV HOME=/var/lib/gonavi \
+    GONAVI_DATA_ROOT=/data \
+    GONAVI_LOG_DIR=/var/lib/gonavi/logs \
+    GONAVI_MCP_HTTP_ADDR=0.0.0.0:8765 \
+    GONAVI_MCP_HTTP_PATH=/mcp \
+    GONAVI_MCP_SCHEMA_ONLY=true
+
+VOLUME ["/data"]
+EXPOSE 8765
+
+USER gonavi
+
+ENTRYPOINT ["/usr/local/bin/gonavi-mcp-server"]
+CMD ["http"]

README.md

@@ -5,6 +5,8 @@
 [![React Version](https://img.shields.io/badge/React-v18-blue)](https://reactjs.org/)
 [![License](https://img.shields.io/badge/License-Apache%202.0-green.svg)](LICENSE)
 [![Build Status](https://img.shields.io/github/actions/workflow/status/Syngnat/GoNavi/release.yml?label=Build)](https://github.com/Syngnat/GoNavi/actions)
+[![Stars](https://img.shields.io/github/stars/Syngnat/GoNavi?style=social)](https://github.com/Syngnat/GoNavi/stargazers)
+[![Downloads](https://img.shields.io/github/downloads/Syngnat/GoNavi/total?color=blue&label=downloads)](https://github.com/Syngnat/GoNavi/releases)
 
 **Language**: English | [简体中文](README.zh-CN.md)
 
@@ -32,40 +34,63 @@ GoNavi is designed for developers and DBAs who need a unified desktop experience
 | Category | Data Source | Driver Mode | Typical Capabilities |
 |---|---|---|---|
 | Relational | MySQL | Built-in | Schema browsing, SQL query, data editing, export/backup |
+| Domestic DB | GoldenDB | Built-in | MySQL-compatible query workflow and distributed transaction scenarios |
 | Relational | PostgreSQL | Built-in | Schema browsing, SQL query, data editing, object management |
 | Relational | Oracle | Built-in | Query execution, object browsing, data editing |
 | Cache | Redis | Built-in | Key browsing, command execution, encoding/view switch |
+| Vector Database | Chroma | Built-in | Collection browsing, vector retrieval, metadata filtering |
+| Vector Database | Qdrant | Built-in | Collection browsing, vector search, payload filtering |
+| Message Queue | RocketMQ | Built-in | Topic browsing, consumer-group inspection, message-oriented workflow |
+| Message Queue | MQTT | Built-in | Broker and topic-filter workflow with QoS-aware connection settings |
+| Message Queue | Kafka | Built-in | Topic browsing, broker metadata, consumer-group workflow |
+| Message Queue | RabbitMQ | Built-in | Queue/exchange browsing, virtual host inspection, management API workflow |
 | Relational | MariaDB | Optional driver agent | Querying, object management, data editing |
 | Relational | Doris | Optional driver agent | Querying, object browsing, SQL execution |
+| Columnar Analytics | StarRocks | Optional driver agent | Querying, object browsing, SQL execution |
 | Search | Sphinx | Optional driver agent | SphinxQL querying and object browsing |
 | Relational | SQL Server | Optional driver agent | Schema browsing, SQL query, object management |
 | File-based | SQLite | Optional driver agent | Local DB browsing, editing, export |
 | File-based | DuckDB | Optional driver agent | Large-table query, pagination, file-DB workflow |
+| Domestic DB | OceanBase | Optional driver agent | MySQL / Oracle tenant access, object browsing, query workflow |
 | Domestic DB | Dameng | Optional driver agent | Querying, object browsing, data editing |
 | Domestic DB | Kingbase | Optional driver agent | Querying, object browsing, data editing |
 | Domestic DB | HighGo | Optional driver agent | Querying, object browsing, data editing |
 | Domestic DB | Vastbase | Optional driver agent | Querying, object browsing, data editing |
+| Domestic DB | OpenGauss | Optional driver agent | PostgreSQL-like schema browsing, SQL query, object management |
+| Domestic DB | GaussDB | Optional driver agent | PostgreSQL-like schema browsing, SQL query, object management |
+| Multi-model | InterSystems IRIS | Optional driver agent | Namespace browsing, SQL query, object management |
 | Document | MongoDB | Optional driver agent | Document query, collection browsing, connection management |
 | Time-series | TDengine | Optional driver agent | Time-series schema browsing and querying |
+| Time-series | Apache IoTDB | Optional driver agent | Storage group / device / timeseries browsing and querying |
 | Columnar Analytics | ClickHouse | Optional driver agent | Analytical query, object browsing, SQL execution |
+| Federated Query | Trino | Optional driver agent | Cross-source SQL via multiple catalogs, `catalog.schema` browsing, SQL execution |
+| Search | Elasticsearch | Optional driver agent | Index browsing, mapping inspection, JSON DSL / query_string search |
 | Extensibility | Custom Driver/DSN | Custom | Extend to more data sources via Driver + DSN |
 
 <h2 align="center">📸 Screenshots</h2>
 
 <div align="center">
-    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/341cda98-79a5-4198-90f3-1335131ccde0" />
-    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/224a74e7-65df-4aef-9710-d8e82e3a70c1" />
-    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/ec522145-5ceb-4481-ae46-a9251c89bdfc" />
+    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/0eefe07f-2836-44fa-9ddf-a0d2124b90e2" />
+    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/6765e539-83ea-4cd6-9c9e-f42790fa05b5" />
+    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/60e3d187-171a-4248-94e0-c6b08736e235" />
     <br />
-    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/330ce49b-45f1-4919-ae14-75f7d47e5f73" />
-    <img width="14%" alt="image" src="https://github.com/user-attachments/assets/d15fa9e9-5486-423b-a0e9-53b467e45432" />
-    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/f0c57590-d987-4ecf-89b2-64efad60b6d7" />
+    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/7a478602-0f08-4b30-8f6a-879f4a60ae32" />
+    <img width="14%" alt="image" src="https://github.com/user-attachments/assets/6442ca7d-ce9e-46d9-aecd-405ba88f5a5e" />
+    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/bc17895e-02a4-4cc5-b471-c3803cf25a2b" />
 </div>
 
 ---
 
 ## Key Features
 
+### AI Assistant (New)
+- **Multi-provider Support**: OpenAI, Google Gemini, Anthropic Claude, and custom API support.
+- **Context-Aware Chat**: Attach table schemas to the AI context for accurate SQL generation and assistance.
+- **Slash Commands**: Quick commands for generating SQL, explaining queries, optimizing performance, and reviewing schema designs.
+- **Built-in MCP Workflow**: Manage MCP servers in AI Settings, install GoNavi MCP to Claude Code / Codex, or expose Streamable HTTP for remote Agents.
+- **Remote-Agent Boundary**: Keep saved connections and database passwords on the host running GoNavi while cloud Agents consume schema tools over MCP.
+- **Safety Guardrails**: Remote `schema-only` mode omits `execute_sql`; when SQL execution is enabled, non-read-only statements still require explicit `allowMutating=true`.
+
 ### Performance
 - **Smooth interaction under load**: optimized table interaction (including column resize workflow on large datasets).
 - **Virtualized rendering**: keeps large result sets responsive.
@@ -125,17 +150,26 @@ GoNavi is designed for developers and DBAs who need a unified desktop experience
 - [Go](https://go.dev/dl/) 1.21+
 - [Node.js](https://nodejs.org/) 18+
 - [Wails CLI](https://wails.io/docs/gettingstarted/installation):
-  `go install github.com/wailsapp/wails/v2/cmd/wails@latest`
+  `go install github.com/wailsapp/wails/v2/cmd/wails@v2.11.0`
 
 ### Development Mode
 
-```bash
+```shell
 # Clone
 git clone https://github.com/Syngnat/GoNavi.git
 cd GoNavi
 
 # Start development with hot reload
 wails dev
+
+# Faster local startup when exported Go method signatures are unchanged
+node tools/wails-fast-dev.mjs
+
+# Refresh Wails JS bindings after changing exported Go method signatures
+node tools/wails-fast-dev.mjs --refresh-bindings
+
+# Windows PowerShell low-memory visual mode: disables transparent WebView/Acrylic backdrop
+$env:GONAVI_LOW_MEMORY_MODE="1"; node tools/wails-fast-dev.mjs
 ```
 
 ### Build
@@ -150,6 +184,82 @@ wails build -clean
 
 Artifacts are generated in `build/bin`.
 
+### Docker / Podman (MCP Server Only)
+
+The desktop GUI is not packaged as a container service. Current container support targets `gonavi-mcp-server` only.
+
+### Browser Access Mode (Experimental)
+
+The main GoNavi application now also exposes a `web-server` mode that reuses the same Go backend and React frontend for browser access:
+
+```powershell
+go build .
+.\GoNavi-Wails.exe web-server --addr 127.0.0.1:34116
+```
+
+The first browser visit is redirected to `/setup` to create the web admin password. Google Authenticator is optional but supported out of the box, together with `web_auth.json`, session cookies, recovery codes, and login rate limiting.
+
+Current scope already includes:
+
+- Browser-side Wails bridge (`window.go.*` / `window.runtime.*` -> HTTP / SSE)
+- First-run setup page, login page, and logout endpoint
+- Session idle timeout / absolute timeout / remember-login window
+- Google Authenticator TOTP plus recovery codes
+
+Still in progress:
+
+- Browser upload/download workbenches for external SQL and connection-package flows
+- More web capability gating for desktop-only features
+- Reverse-proxy / HTTPS / zero-trust deployment guidance
+
+```bash
+cp docker.mcp-server.env.example docker.mcp-server.env
+docker compose --env-file docker.mcp-server.env -f docker-compose.mcp-server.yml up -d
+```
+
+Mount the GoNavi active data root into the container. The mounted directory should contain `connections.json`, `daily_secrets.json`, and optional `drivers/` assets when optional driver agents are required.
+
+The default Compose file pulls the published GHCR image. For local source builds, add the override file:
+
+```bash
+docker compose --env-file docker.mcp-server.env \
+  -f docker-compose.mcp-server.yml \
+  -f docker-compose.mcp-server.local.yml \
+  up -d --build
+```
+
+For Podman, use the same published OCI image with `podman run`, or the native Quadlet example under [deploy/podman/gonavi-mcp-server](deploy/podman/gonavi-mcp-server). That path is intended for Linux servers / NAS hosts where rootless systemd services are preferred.
+
+Deployment matrix:
+
+- Docker Desktop / Linux server / NAS: `docker-compose.mcp-server.yml`
+- Podman / Quadlet: [deploy/podman/gonavi-mcp-server](deploy/podman/gonavi-mcp-server)
+- Kubernetes: [deploy/k8s/gonavi-mcp-server](deploy/k8s/gonavi-mcp-server) (`kustomization.yaml` + overlays)
+- Helm chart: [deploy/helm/gonavi-mcp-server](deploy/helm/gonavi-mcp-server)
+- Build-only Linux environment: `Dockerfile.build-env`
+
+See [cmd/gonavi-mcp-server/README.md](cmd/gonavi-mcp-server/README.md) for deployment details and security boundaries.
+
+### Docker / Podman (Build Environment Only)
+
+If you only need a reproducible Linux build environment for Wails, use `Dockerfile.build-env`:
+
+```bash
+docker build -f Dockerfile.build-env -t gonavi-build-env:local .
+docker run --rm -it -v "$PWD:/workspace" -w /workspace gonavi-build-env:local bash
+```
+
+The same Dockerfile also works with Podman, for example `podman build -f Dockerfile.build-env -t localhost/gonavi-build-env:local .` and `podman run --rm -it -v "$PWD:/workspace" -w /workspace localhost/gonavi-build-env:local bash`.
+
+The default image installs the WebKitGTK 4.0 build toolchain for broader Linux/NAS compatibility. The image bases are multi-arch, so `amd64` and `arm64` follow the target container platform.
+
+Published images are pushed to GHCR:
+
+- `ghcr.io/syngnat/gonavi-mcp-server:latest`
+- `ghcr.io/syngnat/gonavi-build-env:latest`
+
+This image is for building Linux artifacts only. It does not turn the Wails desktop GUI into a browser-accessible web application.
+
 ### Cross-Platform Release (GitHub Actions)
 
 The repository includes a release workflow.
@@ -195,6 +305,16 @@ sudo apt-get install -y libgtk-3-0 libwebkit2gtk-4.0-37 libjavascriptcoregtk-4.0
 
 If you use Linux artifacts with the `-WebKit41` suffix, prefer Debian 13 / Ubuntu 24.04+.
 
+### Linux: Chinese text appears as square boxes
+
+Minimal Ubuntu 24.04 LTS desktop/server environments may not include Chinese CJK fonts. Install Noto / WenQuanYi fonts and restart GoNavi:
+
+```bash
+sudo apt-get update
+sudo apt-get install -y fonts-noto-cjk fonts-wqy-microhei
+fc-cache -fv
+```
+
 ---
 
 ## Contributing
@@ -205,7 +325,21 @@ For the full workflow, branch model, and maintainer sync rules, see:
 
 - [CONTRIBUTING.md](CONTRIBUTING.md)
 
-External contributors should open pull requests directly against `main`.
+External contributors should branch from `dev` and open pull requests against `dev`.
+
+## Star History
+<a href="https://www.star-history.com/?repos=Syngnat%2FGoNavi&type=date&legend=top-left">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/image?repos=Syngnat/GoNavi&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/image?repos=Syngnat/GoNavi&type=date&legend=top-left" />
+   <img alt="Star History Chart" src="https://api.star-history.com/image?repos=Syngnat/GoNavi&type=date&legend=top-left" />
+ </picture>
+</a>
+
+## Links
+
+- [linux.do](https://linux.do/)
+- [AIBook](https://aibook.ren/)
 
 ## License
 

README.zh-CN.md

@@ -5,6 +5,8 @@
 [![React Version](https://img.shields.io/badge/React-v18-blue)](https://reactjs.org/)
 [![License](https://img.shields.io/badge/License-Apache%202.0-green.svg)](LICENSE)
 [![Build Status](https://img.shields.io/github/actions/workflow/status/Syngnat/GoNavi/release.yml?label=Build)](https://github.com/Syngnat/GoNavi/actions)
+[![Stars](https://img.shields.io/github/stars/Syngnat/GoNavi?style=social)](https://github.com/Syngnat/GoNavi/stargazers)
+[![Downloads](https://img.shields.io/github/downloads/Syngnat/GoNavi/total?color=blue&label=downloads)](https://github.com/Syngnat/GoNavi/releases)
 
 **语言**: [English](README.md) | 简体中文
 
@@ -31,40 +33,63 @@ GoNavi 面向开发者与 DBA，核心目标是让数据库操作在桌面端做
 | 类别 | 数据源 | 驱动模式 | 典型能力 |
 |---|---|---|---|
 | 关系型 | MySQL | 内置 | 库表浏览、SQL 查询、数据编辑、导出/备份 |
+| 国产数据库 | GoldenDB | 内置 | MySQL 兼容查询工作流、分布式事务场景 |
 | 关系型 | PostgreSQL | 内置 | 库表浏览、SQL 查询、数据编辑、对象管理 |
 | 关系型 | Oracle | 内置 | 连接查询、对象浏览、数据编辑 |
 | 缓存 | Redis | 内置 | Key 浏览、命令执行、编码/视图切换 |
+| 向量数据库 | Chroma | 内置 | Collection 浏览、向量检索、元数据过滤 |
+| 向量数据库 | Qdrant | 内置 | Collection 浏览、向量搜索、Payload 过滤 |
+| 消息队列 | RocketMQ | 内置 | Topic 浏览、消费组检查、消息型工作流 |
+| 消息队列 | MQTT | 内置 | Broker / Topic Filter 工作流与 QoS 连接配置 |
+| 消息队列 | Kafka | 内置 | Topic 浏览、Broker 元数据、消费组工作流 |
+| 消息队列 | RabbitMQ | 内置 | Queue / Exchange 浏览、Virtual Host 检查、Management API 工作流 |
 | 关系型 | MariaDB | 可选驱动代理 | 连接查询、对象管理、数据编辑 |
 | 关系型 | Doris | 可选驱动代理 | 连接查询、对象浏览、SQL 执行 |
+| 列式分析 | StarRocks | 可选驱动代理 | 连接查询、对象浏览、SQL 执行 |
 | 搜索 | Sphinx | 可选驱动代理 | SphinxQL 查询与对象浏览 |
 | 关系型 | SQL Server | 可选驱动代理 | 库表浏览、SQL 查询、对象管理 |
 | 文件型 | SQLite | 可选驱动代理 | 本地文件库浏览、编辑、导出 |
 | 文件型 | DuckDB | 可选驱动代理 | 大表查询、分页浏览、文件库管理 |
+| 国产数据库 | OceanBase | 可选驱动代理 | MySQL / Oracle 租户接入、对象浏览、查询工作流 |
 | 国产数据库 | Dameng | 可选驱动代理 | 连接查询、对象浏览、数据编辑 |
 | 国产数据库 | Kingbase | 可选驱动代理 | 连接查询、对象浏览、数据编辑 |
 | 国产数据库 | HighGo | 可选驱动代理 | 连接查询、对象浏览、数据编辑 |
 | 国产数据库 | Vastbase | 可选驱动代理 | 连接查询、对象浏览、数据编辑 |
+| 国产数据库 | OpenGauss | 可选驱动代理 | 类 PostgreSQL 的库表浏览、SQL 查询、对象管理 |
+| 国产数据库 | GaussDB | 可选驱动代理 | 类 PostgreSQL 的库表浏览、SQL 查询、对象管理 |
+| 多模型数据库 | InterSystems IRIS | 可选驱动代理 | Namespace 浏览、SQL 查询、对象管理 |
 | 文档型 | MongoDB | 可选驱动代理 | 文档查询、集合浏览、连接管理 |
 | 时序 | TDengine | 可选驱动代理 | 时序库表浏览、查询分析 |
+| 时序 | Apache IoTDB | 可选驱动代理 | Storage Group / Device / Timeseries 浏览与查询 |
 | 列式分析 | ClickHouse | 可选驱动代理 | 分析查询、对象浏览、SQL 执行 |
+| 联邦查询 | Trino | 可选驱动代理 | 跨多数据源联邦 SQL、`catalog.schema` 浏览、SQL 执行 |
+| 搜索 | Elasticsearch | 可选驱动代理 | 索引浏览、Mapping 检查、JSON DSL / query_string 查询 |
 | 扩展接入 | Custom Driver/DSN | 自定义 | 通过 Driver + DSN 接入更多数据源 |
 
 <h2 align="center">📸 项目截图</h2>
 
 <div align="center">
-    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/341cda98-79a5-4198-90f3-1335131ccde0" />
-    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/224a74e7-65df-4aef-9710-d8e82e3a70c1" />
-    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/ec522145-5ceb-4481-ae46-a9251c89bdfc" />
+    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/0eefe07f-2836-44fa-9ddf-a0d2124b90e2" />
+    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/6765e539-83ea-4cd6-9c9e-f42790fa05b5" />
+    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/60e3d187-171a-4248-94e0-c6b08736e235" />
     <br />
-    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/330ce49b-45f1-4919-ae14-75f7d47e5f73" />
-    <img width="14%" alt="image" src="https://github.com/user-attachments/assets/d15fa9e9-5486-423b-a0e9-53b467e45432" />
-    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/f0c57590-d987-4ecf-89b2-64efad60b6d7" />
+    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/7a478602-0f08-4b30-8f6a-879f4a60ae32" />
+    <img width="14%" alt="image" src="https://github.com/user-attachments/assets/6442ca7d-ce9e-46d9-aecd-405ba88f5a5e" />
+    <img width="25%" alt="image" src="https://github.com/user-attachments/assets/bc17895e-02a4-4cc5-b471-c3803cf25a2b" />
 </div>
 
 ---
 
 ## 核心特性
 
+### AI 智能助手 (New)
+- **多模型服务商支持**：内置跨平台接入 OpenAI, Google Gemini, Anthropic Claude，同时支持任意自定义兼容 OpenAI 格式的 API。
+- **关联表结构上下文**：原生支持将当前数据库表结构直接提取作为上下文发送给 AI，让 SQL 生成、分析变得更精准。
+- **快捷指令**：内置多种快捷对话指（如一键生成 SQL、解释执行逻辑、分析性能优化、表字段代码评审等）。
+- **内置 MCP 工作流**：可在 AI 设置里管理 MCP 服务，一键安装 GoNavi MCP 到 Claude Code / Codex，或开启 Streamable HTTP 供远端 Agent 使用。
+- **远端 Agent 边界清晰**：数据库连接与密码继续保留在运行 GoNavi 的主机上，云端 Agent 通过 MCP 读取结构与上下文。
+- **安全控制可追溯**：远端 `schema-only` 模式默认不暴露 `execute_sql`；如开启 SQL 执行，非只读语句仍需显式传入 `allowMutating=true`。
+
 ### 性能与交互
 - 大数据场景下保持流畅交互（含 DataGrid 列宽拖拽、批量编辑流程优化）。
 - 虚拟滚动渲染，降低大结果集卡顿风险。
@@ -119,17 +144,26 @@ GoNavi 面向开发者与 DBA，核心目标是让数据库操作在桌面端做
 - [Go](https://go.dev/dl/) 1.21+
 - [Node.js](https://nodejs.org/) 18+
 - [Wails CLI](https://wails.io/docs/gettingstarted/installation):
-  `go install github.com/wailsapp/wails/v2/cmd/wails@latest`
+  `go install github.com/wailsapp/wails/v2/cmd/wails@v2.11.0`
 
 ### 开发模式
 
-```bash
+```shell
 # 克隆项目
 git clone https://github.com/Syngnat/GoNavi.git
 cd GoNavi
 
 # 启动开发（热重载）
 wails dev
+
+# 本地快速启动：未修改 Go 导出方法签名时使用
+node tools/wails-fast-dev.mjs
+
+# 修改 Go 导出方法签名后刷新 Wails JS 绑定
+node tools/wails-fast-dev.mjs --refresh-bindings
+
+# Windows PowerShell 低内存视觉模式：关闭透明 WebView 和 Acrylic 背景
+$env:GONAVI_LOW_MEMORY_MODE="1"; node tools/wails-fast-dev.mjs
 ```
 
 ### 编译构建
@@ -144,6 +178,82 @@ wails build -clean
 
 构建产物位于 `build/bin`。
 
+### Docker / Podman（仅 MCP Server）
+
+当前容器化支持仅覆盖 `gonavi-mcp-server`，不包含桌面 GUI 主界面。
+
+### 浏览器访问版（实验中）
+
+仓库主程序现在额外提供了一个 `web-server` 运行模式，用同一套 Go 后端 + React 前端提供浏览器访问入口：
+
+```powershell
+go build .
+.\GoNavi-Wails.exe web-server --addr 127.0.0.1:34116
+```
+
+首次访问会进入 `/setup` 完成 Web 管理员密码初始化；可选启用 Google Authenticator，服务端会落地 `web_auth.json`、Session Cookie、恢复码与登录失败限流。
+
+当前阶段已具备：
+
+- 浏览器端 Wails bridge（`window.go.*` / `window.runtime.*` -> HTTP / SSE）
+- 首次初始化页、登录页、登出接口
+- Session 空闲超时 / 绝对超时 / 记住登录时长
+- Google Authenticator TOTP 与恢复码
+
+当前仍在继续收口：
+
+- 外部 SQL / 连接包导入导出等文件型能力的浏览器上传下载工作台
+- 更多桌面专属能力的 Web 门禁与替代交互
+- 反向代理 / HTTPS / 零信任部署说明
+
+```bash
+cp docker.mcp-server.env.example docker.mcp-server.env
+docker compose --env-file docker.mcp-server.env -f docker-compose.mcp-server.yml up -d
+```
+
+请把 GoNavi 的活动数据目录挂载进容器。该目录内至少应包含 `connections.json`、`daily_secrets.json`，如需可选驱动代理还应包含 `drivers/`。
+
+默认 Compose 会直接拉取 GHCR 预构建镜像。如果你要用当前仓库源码本地构建，再叠加一个 override：
+
+```bash
+docker compose --env-file docker.mcp-server.env \
+  -f docker-compose.mcp-server.yml \
+  -f docker-compose.mcp-server.local.yml \
+  up -d --build
+```
+
+如果你使用 Podman，可直接复用同一套 OCI 镜像，走 `podman run` 或 Quadlet。仓库内已经提供 [deploy/podman/gonavi-mcp-server](deploy/podman/gonavi-mcp-server) 作为 Podman 原生部署入口，适合 Linux 服务器 / NAS 的 rootless systemd 常驻服务。
+
+部署矩阵：
+
+- Docker Desktop / Linux 服务器 / NAS：`docker-compose.mcp-server.yml`
+- Podman / Quadlet：[deploy/podman/gonavi-mcp-server](deploy/podman/gonavi-mcp-server)
+- Kubernetes：[deploy/k8s/gonavi-mcp-server](deploy/k8s/gonavi-mcp-server)（`kustomization.yaml` + overlays）
+- Helm Chart：[deploy/helm/gonavi-mcp-server](deploy/helm/gonavi-mcp-server)
+- 仅构建环境：`Dockerfile.build-env`
+
+完整部署方式与安全边界见 [cmd/gonavi-mcp-server/README.md](cmd/gonavi-mcp-server/README.md)。
+
+### Docker / Podman（仅构建环境）
+
+如果只是想要一套稳定的 Linux 构建环境来编译 Wails，可直接使用 `Dockerfile.build-env`：
+
+```bash
+docker build -f Dockerfile.build-env -t gonavi-build-env:local .
+docker run --rm -it -v "$PWD:/workspace" -w /workspace gonavi-build-env:local bash
+```
+
+同一个 Dockerfile 也可以直接给 Podman 使用，例如 `podman build -f Dockerfile.build-env -t localhost/gonavi-build-env:local .`，然后执行 `podman run --rm -it -v "$PWD:/workspace" -w /workspace localhost/gonavi-build-env:local bash`。
+
+这个镜像默认安装 WebKitGTK 4.0 构建依赖，兼容面更适合常见 Linux / NAS 场景。镜像底座本身支持多架构，`amd64` / `arm64` 会跟随容器平台。
+
+仓库会把预构建镜像推送到 GHCR：
+
+- `ghcr.io/syngnat/gonavi-mcp-server:latest`
+- `ghcr.io/syngnat/gonavi-build-env:latest`
+
+这个镜像只负责构建 Linux 产物，不会把 Wails 桌面 GUI 变成可浏览器访问的 Web 服务。
+
 ### 跨平台发布（GitHub Actions）
 
 仓库内置发布流水线，推送 `v*` Tag 可自动构建并发布 Release。
@@ -178,6 +288,16 @@ sudo apt-get update
 sudo apt-get install -y libgtk-3-0 libwebkit2gtk-4.0-37 libjavascriptcoregtk-4.0-18
 ```
 
+### Linux 中文显示为方框
+
+Ubuntu 24.04 LTS 的最小化桌面或服务器环境可能没有安装中文 CJK 字体，GoNavi 打开后中文会显示为方框。安装 Noto / 文泉驿字体后重启 GoNavi：
+
+```bash
+sudo apt-get update
+sudo apt-get install -y fonts-noto-cjk fonts-wqy-microhei
+fc-cache -fv
+```
+
 ---
 
 ## 贡献指南
@@ -188,7 +308,22 @@ sudo apt-get install -y libgtk-3-0 libwebkit2gtk-4.0-37 libjavascriptcoregtk-4.0
 
 - [CONTRIBUTING.zh-CN.md](CONTRIBUTING.zh-CN.md)
 
-外部贡献者统一直接向 `main` 发起 Pull Request。
+外部贡献者应从 `dev` 拉出分支，并统一向 `dev` 发起 Pull Request。
+
+## Star History (Star 增长趋势)
+
+<a href="https://www.star-history.com/?repos=Syngnat%2FGoNavi&type=date&legend=top-left">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/image?repos=Syngnat/GoNavi&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/image?repos=Syngnat/GoNavi&type=date&legend=top-left" />
+   <img alt="Star History Chart" src="https://api.star-history.com/image?repos=Syngnat/GoNavi&type=date&legend=top-left" />
+ </picture>
+</a>
+
+## 友情链接
+
+- [linux.do](https://linux.do/)
+- [AI全书](https://aibook.ren/)
 
 ## 开源协议
 

assets_dev.go

@@ -0,0 +1,9 @@
+//go:build dev
+
+package main
+
+import "os"
+
+// 开发模式下由 Wails DevServer 提供前端资源，这里只提供一个稳定的占位 FS，
+// 避免编译时依赖 frontend/dist 被并发重建。
+var assets = os.DirFS(".")

assets_prod.go

@@ -0,0 +1,13 @@
+//go:build !dev
+
+package main
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed all:frontend/dist
+var embeddedAssets embed.FS
+
+var assets fs.FS = embeddedAssets

build-driver-agents.sh

@@ -5,7 +5,11 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$SCRIPT_DIR"
 
-DEFAULT_DRIVERS=(mariadb doris sphinx sqlserver sqlite duckdb dameng kingbase highgo vastbase mongodb tdengine clickhouse)
+DEFAULT_DRIVERS=(mariadb oceanbase doris starrocks sphinx sqlserver sqlite duckdb dameng kingbase highgo vastbase opengauss gaussdb iris mongodb tdengine iotdb clickhouse elasticsearch)
+DEFAULT_PLATFORMS=(darwin/amd64 darwin/arm64 windows/amd64 windows/arm64 linux/amd64 linux/arm64)
+DUCKDB_WINDOWS_LIBRARY_VERSION="v1.4.4"
+DUCKDB_WINDOWS_LIBRARY_URL="https://github.com/duckdb/duckdb/releases/download/${DUCKDB_WINDOWS_LIBRARY_VERSION}/libduckdb-windows-amd64.zip"
+DUCKDB_WINDOWS_SUPPORT_DLL="duckdb.dll"
 
 usage() {
   cat <<'EOF'
@@ -14,17 +18,21 @@ usage() {
 
 选项：
   --drivers <列表>      指定驱动列表（逗号分隔），例如：kingbase,mongodb
-  --platform <GOOS/GOARCH>
-                        目标平台，默认使用当前 Go 环境（go env GOOS/GOARCH）
+  --platform <目标>      目标平台：current、all、GOOS/GOARCH，或逗号分隔列表
+                        默认 current（当前 Go 环境）
   --out-dir <目录>      输出目录根路径，默认：dist/driver-agents
   --bundle-name <文件名> 驱动总包 zip 名称，默认：GoNavi-DriverAgents.zip
   --strict              任一驱动构建失败即中断（默认失败后继续，最后汇总）
+  --upx                 要求使用 UPX 压缩支持的平台产物（默认 auto：有 upx 则压缩）
+  --no-upx              禁用 UPX 压缩
   -h, --help            显示帮助
 
 示例：
   ./build-driver-agents.sh
   ./build-driver-agents.sh --drivers kingbase
   ./build-driver-agents.sh --platform windows/amd64 --drivers kingbase,mongodb
+  ./build-driver-agents.sh --platform all
+  ./build-driver-agents.sh --platform darwin/arm64,windows/amd64,linux/amd64
 EOF
 }
 
@@ -33,7 +41,10 @@ normalize_driver() {
   name="$(echo "${1:-}" | tr '[:upper:]' '[:lower:]' | xargs)"
   case "$name" in
     doris|diros) echo "doris" ;;
-    mariadb|sphinx|sqlserver|sqlite|duckdb|dameng|kingbase|highgo|vastbase|mongodb|tdengine|clickhouse)
+    open_gauss|open-gauss) echo "opengauss" ;;
+    gaussdb|gauss_db|gauss-db) echo "gaussdb" ;;
+    elasticsearch|elastic) echo "elasticsearch" ;;
+    mariadb|oceanbase|starrocks|sphinx|sqlserver|sqlite|duckdb|dameng|kingbase|highgo|vastbase|opengauss|gaussdb|iris|mongodb|tdengine|iotdb|clickhouse)
       echo "$name"
       ;;
     *)
@@ -58,11 +69,177 @@ platform_dir_name() {
   esac
 }
 
+current_platform() {
+  echo "$(go env GOOS)/$(go env GOARCH)"
+}
+
+append_platform() {
+  local candidate
+  candidate="$1"
+  if [[ "$platform_seen" == *"|$candidate|"* ]]; then
+    return 0
+  fi
+  platforms+=("$candidate")
+  platform_seen="${platform_seen}${candidate}|"
+}
+
+normalize_platform() {
+  local value goos goarch platform_dir
+  value="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+  case "$value" in
+    current|"")
+      current_platform
+      ;;
+    */*)
+      goos="${value%%/*}"
+      goarch="${value##*/}"
+      platform_dir="$(platform_dir_name "$goos")"
+      if [[ -z "$goos" || -z "$goarch" || "$platform_dir" == "Unknown" ]]; then
+        return 1
+      fi
+      echo "$goos/$goarch"
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+zip_bundle() {
+  local bundle_zip_path="$1"
+  local bundle_stage_dir="$2"
+  local -a bundle_dirs=()
+  local dir
+
+  for dir in "$bundle_stage_dir"/*; do
+    [[ -d "$dir" ]] || continue
+    bundle_dirs+=("$(basename "$dir")")
+  done
+
+  if [[ ${#bundle_dirs[@]} -eq 0 ]]; then
+    echo "❌ 驱动总包 staging 目录为空。"
+    exit 1
+  fi
+
+  rm -f "$bundle_zip_path"
+  if command -v zip >/dev/null 2>&1; then
+    (
+      cd "$bundle_stage_dir"
+      zip -qry "$bundle_zip_path" "${bundle_dirs[@]}"
+    )
+  elif command -v python3 >/dev/null 2>&1; then
+    BUNDLE_STAGE_DIR="$bundle_stage_dir" BUNDLE_ZIP_PATH="$bundle_zip_path" python3 - <<'PY'
+import os
+import zipfile
+from pathlib import Path
+
+stage = Path(os.environ["BUNDLE_STAGE_DIR"])
+target = Path(os.environ["BUNDLE_ZIP_PATH"])
+with zipfile.ZipFile(target, "w", compression=zipfile.ZIP_DEFLATED) as zf:
+    for path in stage.rglob("*"):
+        if path.is_file():
+            zf.write(path, path.relative_to(stage).as_posix())
+PY
+  else
+    echo "❌ 未找到 zip 或 python3，无法生成驱动总包 zip。"
+    exit 1
+  fi
+}
+
+zip_duckdb_windows_package() {
+  local bundle_stage_dir="$1"
+  local zip_path="$2"
+
+  rm -f "$zip_path"
+  if command -v python3 >/dev/null 2>&1; then
+    BUNDLE_STAGE_DIR="$bundle_stage_dir" BUNDLE_ZIP_PATH="$zip_path" python3 - <<'PY'
+import os
+import zipfile
+
+stage_dir = os.environ["BUNDLE_STAGE_DIR"]
+zip_path = os.environ["BUNDLE_ZIP_PATH"]
+entries = [
+    ("Windows/duckdb-driver-agent-windows-amd64.exe", os.path.join(stage_dir, "Windows", "duckdb-driver-agent-windows-amd64.exe")),
+    ("Windows/duckdb.dll", os.path.join(stage_dir, "Windows", "duckdb.dll")),
+]
+
+with zipfile.ZipFile(zip_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
+    for arcname, src in entries:
+        if not os.path.isfile(src):
+            raise FileNotFoundError(src)
+        zf.write(src, arcname)
+PY
+  elif command -v zip >/dev/null 2>&1; then
+    (
+      cd "$bundle_stage_dir"
+      zip -qry "$zip_path" "Windows/duckdb-driver-agent-windows-amd64.exe" "Windows/duckdb.dll"
+    )
+  else
+    echo "❌ 未找到 python3 或 zip，无法生成 DuckDB Windows 专属驱动包。"
+    exit 1
+  fi
+}
+
+prepare_duckdb_windows_library() {
+  local cache_root="$1"
+  local lib_dir="$cache_root/duckdb-windows-${DUCKDB_WINDOWS_LIBRARY_VERSION}"
+  local zip_path="$cache_root/libduckdb-windows-amd64.zip"
+
+  if [[ -f "$lib_dir/duckdb.dll" && -f "$lib_dir/duckdb.lib" ]]; then
+    printf '%s\n' "$lib_dir"
+    return 0
+  fi
+
+  mkdir -p "$lib_dir"
+  echo "⬇️  下载 DuckDB Windows 官方动态库：$DUCKDB_WINDOWS_LIBRARY_URL" >&2
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL "$DUCKDB_WINDOWS_LIBRARY_URL" -o "$zip_path"
+  elif command -v wget >/dev/null 2>&1; then
+    wget -q "$DUCKDB_WINDOWS_LIBRARY_URL" -O "$zip_path"
+  else
+    echo "❌ 未找到 curl 或 wget，无法下载 DuckDB Windows 动态库。" >&2
+    return 1
+  fi
+
+  if command -v unzip >/dev/null 2>&1; then
+    unzip -qo "$zip_path" -d "$lib_dir"
+  elif command -v python3 >/dev/null 2>&1; then
+    DUCKDB_LIB_ZIP="$zip_path" DUCKDB_LIB_DIR="$lib_dir" python3 - <<'PY'
+import os
+import zipfile
+
+zip_path = os.environ["DUCKDB_LIB_ZIP"]
+target = os.environ["DUCKDB_LIB_DIR"]
+with zipfile.ZipFile(zip_path) as zf:
+    zf.extractall(target)
+PY
+  else
+    echo "❌ 未找到 unzip 或 python3，无法解压 DuckDB Windows 动态库。" >&2
+    return 1
+  fi
+
+  if [[ ! -f "$lib_dir/duckdb.dll" || ! -f "$lib_dir/duckdb.lib" ]]; then
+    echo "❌ DuckDB Windows 动态库包缺少 duckdb.dll 或 duckdb.lib。" >&2
+    return 1
+  fi
+
+  cp "$lib_dir/duckdb.lib" "$lib_dir/libduckdb.dll.a"
+  cp "$lib_dir/duckdb.lib" "$lib_dir/libduckdb.a"
+  printf '%s\n' "$lib_dir"
+}
+
+join_by_comma() {
+  local IFS=,
+  echo "$*"
+}
+
 driver_csv=""
 target_platform=""
 out_root="dist/driver-agents"
 bundle_name="GoNavi-DriverAgents.zip"
+duckdb_windows_zip_name="duckdb-driver.zip"
 strict_mode="false"
+upx_mode="${GONAVI_DRIVER_AGENT_UPX:-auto}"
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -86,6 +263,14 @@ while [[ $# -gt 0 ]]; do
       strict_mode="true"
       shift
       ;;
+    --upx)
+      upx_mode="required"
+      shift
+      ;;
+    --no-upx)
+      upx_mode="off"
+      shift
+      ;;
     -h|--help)
       usage
       exit 0
@@ -103,20 +288,6 @@ if ! command -v go >/dev/null 2>&1; then
   exit 1
 fi
 
-if [[ -z "$target_platform" ]]; then
-  target_platform="$(go env GOOS)/$(go env GOARCH)"
-fi
-
-if [[ "$target_platform" != */* ]]; then
-  echo "❌ --platform 参数格式错误，应为 GOOS/GOARCH，例如 darwin/arm64"
-  exit 1
-fi
-
-goos="${target_platform%%/*}"
-goarch="${target_platform##*/}"
-platform_key="${goos}-${goarch}"
-platform_dir="$(platform_dir_name "$goos")"
-
 declare -a drivers=()
 if [[ -n "$driver_csv" ]]; then
   IFS=',' read -r -a raw_drivers <<<"$driver_csv"
@@ -130,67 +301,135 @@ if [[ -n "$driver_csv" ]]; then
 else
   drivers=("${DEFAULT_DRIVERS[@]}")
 fi
+revision_driver_csv="$(join_by_comma "${drivers[@]}")"
 
-output_dir="${out_root%/}/${platform_key}"
+declare -a platforms=()
+platform_seen="|"
+if [[ -z "$target_platform" ]]; then
+  target_platform="current"
+fi
+IFS=',' read -r -a raw_platforms <<<"$target_platform"
+for item in "${raw_platforms[@]}"; do
+  normalized_platform="$(printf '%s' "$item" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+  if [[ "$normalized_platform" == "all" ]]; then
+    for default_platform in "${DEFAULT_PLATFORMS[@]}"; do
+      append_platform "$default_platform"
+    done
+    continue
+  fi
+  normalized_platform="$(normalize_platform "$item")" || {
+    echo "❌ --platform 参数格式错误，应为 current、all、GOOS/GOARCH 或逗号分隔列表，例如 darwin/arm64,windows/amd64"
+    exit 1
+  }
+  append_platform "$normalized_platform"
+done
+
+if [[ ${#platforms[@]} -eq 0 ]]; then
+  echo "❌ 未指定有效目标平台。"
+  exit 1
+fi
+
+mkdir -p "$out_root"
+out_root_abs="$(cd "$out_root" && pwd)"
 bundle_stage_dir="$(mktemp -d "${TMPDIR:-/tmp}/gonavi-driver-bundle.XXXXXX")"
-bundle_platform_dir="$bundle_stage_dir/$platform_dir"
 
 cleanup() {
   rm -rf "$bundle_stage_dir"
 }
 trap cleanup EXIT
 
-mkdir -p "$output_dir" "$bundle_platform_dir"
-output_dir_abs="$(cd "$output_dir" && pwd)"
-bundle_zip_path="$output_dir_abs/$bundle_name"
+if [[ ${#platforms[@]} -eq 1 ]]; then
+  single_platform="${platforms[0]}"
+  single_platform_key="${single_platform/\//-}"
+  single_output_dir="${out_root%/}/$single_platform_key"
+  mkdir -p "$single_output_dir"
+  bundle_zip_path="$(cd "$single_output_dir" && pwd)/$bundle_name"
+else
+  bundle_zip_path="$out_root_abs/$bundle_name"
+fi
 
 declare -a built_assets=()
 declare -a failed_drivers=()
 declare -a skipped_drivers=()
 
 echo "🚀 开始构建 optional-driver-agent"
-echo "   平台：$goos/$goarch"
-echo "   输出目录：$output_dir_abs"
+echo "   平台：${platforms[*]}"
+echo "   输出根目录：$out_root_abs"
 echo "   驱动列表：${drivers[*]}"
 
-for driver in "${drivers[@]}"; do
-  if [[ "$driver" == "duckdb" && "$goos" == "windows" && "$goarch" != "amd64" ]]; then
-    echo "⚠️  跳过 duckdb（仅支持 windows/amd64）"
-    skipped_drivers+=("$driver")
-    continue
-  fi
+for platform in "${platforms[@]}"; do
+  goos="${platform%%/*}"
+  goarch="${platform##*/}"
+  platform_key="${goos}-${goarch}"
+  platform_dir="$(platform_dir_name "$goos")"
+  output_dir="${out_root%/}/${platform_key}"
+  bundle_platform_dir="$bundle_stage_dir/$platform_dir"
 
-  build_driver="$(build_driver_name "$driver")"
-  tag="gonavi_${build_driver}_driver"
-  asset_name="${driver}-driver-agent-${goos}-${goarch}"
-  if [[ "$goos" == "windows" ]]; then
-    asset_name="${asset_name}.exe"
-  fi
-  output_path="$output_dir_abs/$asset_name"
+  mkdir -p "$output_dir" "$bundle_platform_dir"
+  output_dir_abs="$(cd "$output_dir" && pwd)"
 
-  cgo_enabled=0
-  if [[ "$driver" == "duckdb" ]]; then
-    cgo_enabled=1
-  fi
+  echo ""
+  echo "🧭 生成 driver-agent revision 指纹：$platform"
+  "$SCRIPT_DIR/tools/generate-driver-agent-revisions.sh" --platform "$platform" --drivers "$revision_driver_csv"
 
-  echo "🔧 构建 $driver -> $asset_name (tag=$tag, CGO_ENABLED=$cgo_enabled)"
-  set +e
-  CGO_ENABLED="$cgo_enabled" GOOS="$goos" GOARCH="$goarch" GOTOOLCHAIN=auto \
-    go build -tags "$tag" -trimpath -ldflags "-s -w" -o "$output_path" ./cmd/optional-driver-agent
-  build_exit=$?
-  set -e
-
-  if [[ $build_exit -ne 0 ]]; then
-    echo "❌ 构建失败：$driver"
-    failed_drivers+=("$driver")
-    if [[ "$strict_mode" == "true" ]]; then
-      exit $build_exit
+  for driver in "${drivers[@]}"; do
+    if [[ "$driver" == "duckdb" && "$goos" == "windows" && "$goarch" != "amd64" ]]; then
+      echo "⚠️  跳过 duckdb（$platform 仅支持 windows/amd64）"
+      skipped_drivers+=("duckdb($platform)")
+      continue
     fi
-    continue
-  fi
 
-  cp "$output_path" "$bundle_platform_dir/$asset_name"
-  built_assets+=("$asset_name")
+    build_driver="$(build_driver_name "$driver")"
+    tag="gonavi_${build_driver}_driver"
+    build_tags="$tag"
+    asset_name="${driver}-driver-agent-${goos}-${goarch}"
+    if [[ "$goos" == "windows" ]]; then
+      asset_name="${asset_name}.exe"
+    fi
+    output_path="$output_dir_abs/$asset_name"
+
+    cgo_enabled=0
+    if [[ "$driver" == "duckdb" ]]; then
+      cgo_enabled=1
+    fi
+    duckdb_lib_dir=""
+    if [[ "$driver" == "duckdb" && "$goos" == "windows" && "$goarch" == "amd64" ]]; then
+      duckdb_lib_dir="$(prepare_duckdb_windows_library "$bundle_stage_dir")"
+      build_tags="$build_tags duckdb_use_lib"
+    fi
+
+    echo "🔧 构建 $driver -> $asset_name (platform=$platform, tags=$build_tags, CGO_ENABLED=$cgo_enabled)"
+    set +e
+    if [[ -n "$duckdb_lib_dir" ]]; then
+      CGO_ENABLED="$cgo_enabled" GOOS="$goos" GOARCH="$goarch" GOTOOLCHAIN=auto \
+        CGO_LDFLAGS="-L${duckdb_lib_dir} -lduckdb" PATH="${duckdb_lib_dir}:$PATH" \
+        go build -tags "$build_tags" -trimpath -ldflags "-s -w" -o "$output_path" ./cmd/optional-driver-agent
+    else
+      CGO_ENABLED="$cgo_enabled" GOOS="$goos" GOARCH="$goarch" GOTOOLCHAIN=auto \
+        go build -tags "$build_tags" -trimpath -ldflags "-s -w" -o "$output_path" ./cmd/optional-driver-agent
+    fi
+    build_exit=$?
+    set -e
+
+    if [[ $build_exit -ne 0 ]]; then
+      echo "❌ 构建失败：$driver ($platform)"
+      failed_drivers+=("$driver($platform)")
+      if [[ "$strict_mode" == "true" ]]; then
+        exit $build_exit
+      fi
+      continue
+    fi
+
+    GONAVI_DRIVER_AGENT_UPX="$upx_mode" "$SCRIPT_DIR/tools/compress-driver-artifact.sh" "$output_path" "$platform" "$platform_dir/$asset_name"
+    cp "$output_path" "$bundle_platform_dir/$asset_name"
+    if [[ -n "$duckdb_lib_dir" ]]; then
+      cp "$duckdb_lib_dir/$DUCKDB_WINDOWS_SUPPORT_DLL" "$output_dir_abs/$DUCKDB_WINDOWS_SUPPORT_DLL"
+      GONAVI_DRIVER_AGENT_UPX="$upx_mode" "$SCRIPT_DIR/tools/compress-driver-artifact.sh" "$output_dir_abs/$DUCKDB_WINDOWS_SUPPORT_DLL" "$platform" "$platform_dir/$DUCKDB_WINDOWS_SUPPORT_DLL"
+      cp "$output_dir_abs/$DUCKDB_WINDOWS_SUPPORT_DLL" "$bundle_platform_dir/$DUCKDB_WINDOWS_SUPPORT_DLL"
+      built_assets+=("$platform_dir/$DUCKDB_WINDOWS_SUPPORT_DLL")
+    fi
+    built_assets+=("$platform_dir/$asset_name")
+  done
 done
 
 if [[ ${#built_assets[@]} -eq 0 ]]; then
@@ -198,25 +437,19 @@ if [[ ${#built_assets[@]} -eq 0 ]]; then
   exit 1
 fi
 
-rm -f "$bundle_zip_path"
-if command -v zip >/dev/null 2>&1; then
-  (
-    cd "$bundle_stage_dir"
-    zip -qry "$bundle_zip_path" "$platform_dir"
-  )
-elif command -v ditto >/dev/null 2>&1; then
-  (
-    cd "$bundle_stage_dir"
-    ditto -c -k --sequesterRsrc --keepParent "$platform_dir" "$bundle_zip_path"
-  )
-else
-  echo "❌ 未找到 zip/ditto，无法生成驱动总包 zip。"
-  exit 1
+zip_bundle "$bundle_zip_path" "$bundle_stage_dir"
+
+duckdb_asset_path="$out_root_abs/windows-amd64/duckdb-driver-agent-windows-amd64.exe"
+duckdb_dll_path="$out_root_abs/windows-amd64/$DUCKDB_WINDOWS_SUPPORT_DLL"
+if [[ -f "$duckdb_asset_path" && -f "$duckdb_dll_path" ]]; then
+  duckdb_zip_path="$out_root_abs/windows-amd64/$duckdb_windows_zip_name"
+  zip_duckdb_windows_package "$bundle_stage_dir" "$duckdb_zip_path"
+  built_assets+=("Windows/$duckdb_windows_zip_name")
 fi
 
 echo ""
 echo "✅ 构建完成"
-echo "   单文件输出目录：$output_dir_abs"
+echo "   单文件输出根目录：$out_root_abs"
 echo "   驱动总包：$bundle_zip_path"
 echo "   已构建：${built_assets[*]}"
 if [[ ${#skipped_drivers[@]} -gt 0 ]]; then

build-release.sh

@@ -1,16 +1,42 @@
 #!/bin/bash
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
 # 配置
 APP_NAME="GoNavi"
 DIST_DIR="dist"
 BUILD_BIN_DIR="build/bin"
 DEFAULT_BINARY_NAME="GoNavi" # 对应 wails.json 中的 outputfilename
+DEV_VERSION_FILE="version/dev-version.txt"
+DEFAULT_DEV_VERSION="0.0.1-test"
 
-# 提取版本号
-VERSION=$(grep '"version":' frontend/package.json | head -1 | awk -F: '{ print $2 }' | sed 's/[",]//g' | tr -d '[[:space:]]')
-if [ -z "$VERSION" ]; then
-    VERSION="0.0.0"
-fi
+resolve_build_version() {
+    if [ -n "${GONAVI_VERSION:-}" ]; then
+        printf '%s\n' "${GONAVI_VERSION}"
+        return
+    fi
+
+    if [ -f "$DEV_VERSION_FILE" ]; then
+        local dev_version
+        dev_version=$(head -n 1 "$DEV_VERSION_FILE" | tr -d '\r' | tr -d '[:space:]')
+        if [ -n "$dev_version" ]; then
+            printf '%s\n' "$dev_version"
+            return
+        fi
+    fi
+
+    local package_version
+    package_version=$(grep '"version":' frontend/package.json | head -1 | awk -F: '{ print $2 }' | sed 's/[",]//g' | tr -d '[:space:]')
+    if [ -n "$package_version" ]; then
+        printf '%s\n' "$package_version"
+        return
+    fi
+
+    printf '%s\n' "$DEFAULT_DEV_VERSION"
+}
+
+VERSION="$(resolve_build_version)"
 echo "ℹ️  检测到版本号: $VERSION"
 LDFLAGS="-s -w -X GoNavi-Wails/internal/app.AppVersion=$VERSION"
 
@@ -20,6 +46,13 @@ RED='\033[0;31m'
 YELLOW='\033[1;33m'
 NC='\033[0m'
 
+BUILD_FAILURES=()
+
+record_build_failure() {
+    local target="$1"
+    BUILD_FAILURES+=("$target")
+}
+
 get_file_size_bytes() {
     local target="$1"
     if [ ! -f "$target" ]; then
@@ -84,229 +117,102 @@ try_compress_binary_with_upx() {
     fi
 }
 
-MAC_VOLICON_PATH="build/darwin/icon.icns"
-if [ ! -f "$MAC_VOLICON_PATH" ]; then
-    MAC_VOLICON_PATH=""
-fi
+clear_macos_bundle_xattrs() {
+    local bundle_path="$1"
+    if [ -z "$bundle_path" ] || [ ! -e "$bundle_path" ]; then
+        return
+    fi
+    if command -v xattr >/dev/null 2>&1; then
+        xattr -cr "$bundle_path" >/dev/null 2>&1 || true
+    fi
+}
+
+package_macos_bundle_zip() {
+    local app_path="$1"
+    local archive_path="$2"
+    local archive_abs
+
+    if [ ! -d "$app_path" ]; then
+        echo -e "${RED}   ❌ 未找到 macOS 应用包：$app_path${NC}"
+        exit 1
+    fi
+
+    archive_abs="$(cd "$(dirname "$archive_path")" && pwd)/$(basename "$archive_path")"
+    rm -f "$archive_path"
+    if command -v ditto >/dev/null 2>&1; then
+        ditto -c -k --sequesterRsrc --keepParent "$app_path" "$archive_abs"
+    elif command -v zip >/dev/null 2>&1; then
+        (
+            cd "$(dirname "$app_path")" && \
+            zip -qry "$archive_abs" "$(basename "$app_path")"
+        )
+    else
+        echo -e "${RED}   ❌ 未找到 ditto/zip，无法打包 macOS 应用。${NC}"
+        exit 1
+    fi
+
+    if [ ! -f "$archive_abs" ]; then
+        echo -e "${RED}   ❌ macOS 应用归档失败：$archive_abs${NC}"
+        exit 1
+    fi
+}
+
+package_macos_release() {
+    local platform="$1"
+    local archive_suffix="$2"
+
+    echo -e "${GREEN}🍎 正在构建 macOS (${platform})...${NC}"
+    generate_driver_agent_revisions "darwin/${platform}"
+    wails build -platform "darwin/${platform}" -clean -ldflags "$LDFLAGS"
+    if [ $? -ne 0 ]; then
+        echo -e "${RED}   ❌ macOS ${platform} 构建失败。${NC}"
+        record_build_failure "macOS ${platform}"
+        return
+    fi
+
+    local app_src="$BUILD_BIN_DIR/$DEFAULT_BINARY_NAME.app"
+    local app_dest_name="${APP_NAME}-${VERSION}-${archive_suffix}.app"
+    local zip_name="${APP_NAME}-${VERSION}-${archive_suffix}.zip"
+
+    mv "$app_src" "$DIST_DIR/$app_dest_name"
+
+    local app_bin_path
+    app_bin_path=$(find "$DIST_DIR/$app_dest_name/Contents/MacOS" -maxdepth 1 -type f -print -quit)
+    if [ -z "$app_bin_path" ] || [ ! -f "$app_bin_path" ]; then
+        echo -e "${RED}   ❌ 未找到 macOS ${platform} 主程序文件。${NC}"
+        exit 1
+    fi
+
+    echo -e "${YELLOW}   ⚠️  macOS ${platform} 改为无交互 ZIP 打包，不再生成 DMG。${NC}"
+    echo "   🔏 正在对 .app 进行 ad-hoc 签名 (${platform})..."
+    clear_macos_bundle_xattrs "$DIST_DIR/$app_dest_name"
+    codesign --force --deep --sign - "$DIST_DIR/$app_dest_name"
+
+    echo "   📦 正在打包 macOS 应用归档 (${platform})..."
+    package_macos_bundle_zip "$DIST_DIR/$app_dest_name" "$DIST_DIR/$zip_name"
+    rm -rf "$DIST_DIR/$app_dest_name"
+    echo "   ✅ 已生成 $zip_name"
+}
+
+generate_driver_agent_revisions() {
+    local platform="$1"
+    echo "   🧭 正在生成 driver-agent revision 指纹 (${platform})..."
+    ./tools/generate-driver-agent-revisions.sh --platform "$platform"
+}
 
 echo -e "${GREEN}🚀 开始构建 $APP_NAME $VERSION...${NC}"
 
 # 清理并创建输出目录
-rm -rf $DIST_DIR
-mkdir -p $DIST_DIR
+rm -rf "$DIST_DIR"
+mkdir -p "$DIST_DIR"
 
-# --- macOS ARM64 构建 ---
-echo -e "${GREEN}🍎 正在构建 macOS (arm64)...${NC}"
-wails build -platform darwin/arm64 -clean -ldflags "$LDFLAGS"
-if [ $? -eq 0 ]; then
-    APP_SRC="$BUILD_BIN_DIR/$DEFAULT_BINARY_NAME.app"
-    APP_DEST_NAME="${APP_NAME}-${VERSION}-mac-arm64.app"
-    DMG_NAME="${APP_NAME}-${VERSION}-mac-arm64.dmg"
-    
-    # 移动 .app 到 dist
-    mv "$APP_SRC" "$DIST_DIR/$APP_DEST_NAME"
-
-    APP_BIN_PATH=$(find "$DIST_DIR/$APP_DEST_NAME/Contents/MacOS" -maxdepth 1 -type f -print -quit)
-    if [ -n "$APP_BIN_PATH" ] && [ -f "$APP_BIN_PATH" ]; then
-        echo -e "${YELLOW}   ⚠️  macOS arm64 不再执行 UPX 压缩，保留原始主程序。${NC}"
-    else
-        echo -e "${RED}   ❌ 未找到 macOS arm64 主程序文件。${NC}"
-        exit 1
-    fi
-    
-	    # Ad-hoc 代码签名（无 Apple Developer 账号时防止 Gatekeeper 报已损坏）
-	    echo "   🔏 正在对 .app 进行 ad-hoc 签名 (arm64)..."
-	    codesign --force --deep --sign - "$DIST_DIR/$APP_DEST_NAME"
-
-	    # 创建 DMG
-	    if command -v create-dmg &> /dev/null; then
-	        echo "   📦 正在打包 DMG (arm64)..."
-	        # 移除已存在的 DMG (以防万一)
-	        rm -f "$DIST_DIR/$DMG_NAME"
-	        # create-dmg 的 source 需要是“包含 .app 的目录”，不能直接传 .app 路径。
-	        STAGE_DIR=$(mktemp -d "$DIST_DIR/.dmg-stage-${APP_NAME}-${VERSION}-arm64.XXXXXX")
-	        if [ -z "$STAGE_DIR" ] || [ ! -d "$STAGE_DIR" ]; then
-	            echo -e "${RED}   ❌ 创建 DMG 临时目录失败，跳过 DMG 打包。${NC}"
-	        else
-	            if command -v ditto &> /dev/null; then
-	                ditto "$DIST_DIR/$APP_DEST_NAME" "$STAGE_DIR/$APP_DEST_NAME"
-	            else
-	                cp -R "$DIST_DIR/$APP_DEST_NAME" "$STAGE_DIR/$APP_DEST_NAME"
-	            fi
-
-	        # --sandbox-safe 会跳过 Finder 的 AppleScript 排版，避免打包过程中弹出/打开挂载窗口（CI/本地静默打包更友好）。
-	        CREATE_DMG_ARGS=(--volname "${APP_NAME} ${VERSION}" --format UDZO --sandbox-safe)
-	        if [ -n "$MAC_VOLICON_PATH" ]; then
-	            CREATE_DMG_ARGS+=(--volicon "$MAC_VOLICON_PATH")
-        else
-            echo -e "${YELLOW}   ⚠️  未找到 macOS 卷图标 (build/darwin/icon.icns)，跳过 --volicon。${NC}"
-        fi
-
-	        create-dmg "${CREATE_DMG_ARGS[@]}" \
-	            --window-pos 200 120 \
-	            --window-size 800 400 \
-	            --icon-size 100 \
-	            --icon "$APP_DEST_NAME" 200 190 \
-	            --hide-extension "$APP_DEST_NAME" \
-	            --app-drop-link 600 185 \
-	            "$DIST_DIR/$DMG_NAME" \
-	            "$STAGE_DIR"
-
-	        CREATE_DMG_EXIT_CODE=$?
-	        rm -rf "$STAGE_DIR"
-	        
-	        if [ $CREATE_DMG_EXIT_CODE -ne 0 ]; then
-	            echo -e "${RED}   ❌ create-dmg 执行失败 (exit=$CREATE_DMG_EXIT_CODE)，保留 .app 以便排查。${NC}"
-	        else
-            # create-dmg 可能会在失败时遗留 rw.*.dmg 中间产物；不要直接当作最终产物使用
-            if [ ! -f "$DIST_DIR/$DMG_NAME" ]; then
-                RW_FILE=$(find "$DIST_DIR" -maxdepth 1 -name "rw.*.dmg" -print -quit)
-                if [ -n "$RW_FILE" ]; then
-                    echo -e "${YELLOW}   ⚠️  检测到 create-dmg 中间产物: $(basename "$RW_FILE")，正在转换为可分发 DMG...${NC}"
-                    hdiutil convert "$RW_FILE" -format UDZO -o "$DIST_DIR/$DMG_NAME" >/dev/null 2>&1
-                    rm -f "$RW_FILE"
-                fi
-            fi
-
-            # 防御性：即使生成了目标文件，也要确保不是 UDRW（UDRW 在 Finder 下可能表现为“已损坏/无法打开”）
-            if [ -f "$DIST_DIR/$DMG_NAME" ] && command -v hdiutil &> /dev/null; then
-                DMG_FORMAT=$(hdiutil imageinfo "$DIST_DIR/$DMG_NAME" 2>/dev/null | awk -F': ' '/^Format:/{print $2; exit}')
-                if [ "$DMG_FORMAT" = "UDRW" ]; then
-                    echo -e "${YELLOW}   ⚠️  检测到 UDRW（可写原始映像），正在转换为 UDZO...${NC}"
-                    TMP_UDZO="$DIST_DIR/.tmp.$DMG_NAME"
-                    rm -f "$TMP_UDZO"
-                    hdiutil convert "$DIST_DIR/$DMG_NAME" -format UDZO -o "$TMP_UDZO" >/dev/null 2>&1 && mv "$TMP_UDZO" "$DIST_DIR/$DMG_NAME"
-                fi
-            fi
-
-            if [ -f "$DIST_DIR/$DMG_NAME" ] && command -v hdiutil &> /dev/null; then
-                hdiutil verify "$DIST_DIR/$DMG_NAME" >/dev/null 2>&1
-                if [ $? -ne 0 ]; then
-                    echo -e "${RED}   ❌ DMG 校验失败，保留 .app 以便排查。${NC}"
-                else
-                    # 删除中间的 .app 文件，保持目录整洁
-                    rm -rf "$DIST_DIR/$APP_DEST_NAME"
-                    echo "   ✅ 已生成 $DMG_NAME"
-                fi
-            fi
-        fi
-
-	        if [ ! -f "$DIST_DIR/$DMG_NAME" ]; then
-	            echo -e "${RED}   ❌ DMG 生成失败，请检查 create-dmg 输出。${NC}"
-	        fi
-	        fi
-	    else
-	        echo -e "${YELLOW}   ⚠️  未找到 create-dmg 工具，跳过 DMG 打包，仅保留 .app。${NC}"
-	        echo "      安装命令: brew install create-dmg"
-	    fi
-	else
-    echo -e "${RED}   ❌ macOS arm64 构建失败。${NC}"
-fi
-
-# --- macOS AMD64 构建 ---
-echo -e "${GREEN}🍎 正在构建 macOS (amd64)...${NC}"
-wails build -platform darwin/amd64 -clean -ldflags "$LDFLAGS"
-if [ $? -eq 0 ]; then
-    APP_SRC="$BUILD_BIN_DIR/$DEFAULT_BINARY_NAME.app"
-    APP_DEST_NAME="${APP_NAME}-${VERSION}-mac-amd64.app"
-    DMG_NAME="${APP_NAME}-${VERSION}-mac-amd64.dmg"
-    
-    mv "$APP_SRC" "$DIST_DIR/$APP_DEST_NAME"
-
-    APP_BIN_PATH=$(find "$DIST_DIR/$APP_DEST_NAME/Contents/MacOS" -maxdepth 1 -type f -print -quit)
-    if [ -n "$APP_BIN_PATH" ] && [ -f "$APP_BIN_PATH" ]; then
-        echo -e "${YELLOW}   ⚠️  macOS amd64 不再执行 UPX 压缩，保留原始主程序。${NC}"
-    else
-        echo -e "${RED}   ❌ 未找到 macOS amd64 主程序文件。${NC}"
-        exit 1
-    fi
-    
-	    # Ad-hoc 代码签名
-	    echo "   🔏 正在对 .app 进行 ad-hoc 签名 (amd64)..."
-	    codesign --force --deep --sign - "$DIST_DIR/$APP_DEST_NAME"
-
-	    if command -v create-dmg &> /dev/null; then
-	        echo "   📦 正在打包 DMG (amd64)..."
-	        rm -f "$DIST_DIR/$DMG_NAME"
-	        # create-dmg 的 source 需要是“包含 .app 的目录”，不能直接传 .app 路径。
-	        STAGE_DIR=$(mktemp -d "$DIST_DIR/.dmg-stage-${APP_NAME}-${VERSION}-amd64.XXXXXX")
-	        if [ -z "$STAGE_DIR" ] || [ ! -d "$STAGE_DIR" ]; then
-	            echo -e "${RED}   ❌ 创建 DMG 临时目录失败，跳过 DMG 打包。${NC}"
-	        else
-	            if command -v ditto &> /dev/null; then
-	                ditto "$DIST_DIR/$APP_DEST_NAME" "$STAGE_DIR/$APP_DEST_NAME"
-	            else
-	                cp -R "$DIST_DIR/$APP_DEST_NAME" "$STAGE_DIR/$APP_DEST_NAME"
-	            fi
-
-	        # --sandbox-safe 会跳过 Finder 的 AppleScript 排版，避免打包过程中弹出/打开挂载窗口（CI/本地静默打包更友好）。
-	        CREATE_DMG_ARGS=(--volname "${APP_NAME} ${VERSION}" --format UDZO --sandbox-safe)
-	        if [ -n "$MAC_VOLICON_PATH" ]; then
-	            CREATE_DMG_ARGS+=(--volicon "$MAC_VOLICON_PATH")
-        else
-            echo -e "${YELLOW}   ⚠️  未找到 macOS 卷图标 (build/darwin/icon.icns)，跳过 --volicon。${NC}"
-        fi
-
-	        create-dmg "${CREATE_DMG_ARGS[@]}" \
-	            --window-pos 200 120 \
-	            --window-size 800 400 \
-	            --icon-size 100 \
-	            --icon "$APP_DEST_NAME" 200 190 \
-	            --hide-extension "$APP_DEST_NAME" \
-	            --app-drop-link 600 185 \
-	            "$DIST_DIR/$DMG_NAME" \
-	            "$STAGE_DIR"
-
-	        CREATE_DMG_EXIT_CODE=$?
-	        rm -rf "$STAGE_DIR"
-
-	        if [ $CREATE_DMG_EXIT_CODE -ne 0 ]; then
-	            echo -e "${RED}   ❌ create-dmg 执行失败 (exit=$CREATE_DMG_EXIT_CODE)，保留 .app 以便排查。${NC}"
-	        else
-            if [ ! -f "$DIST_DIR/$DMG_NAME" ]; then
-                RW_FILE=$(find "$DIST_DIR" -maxdepth 1 -name "rw.*.dmg" -print -quit)
-                if [ -n "$RW_FILE" ]; then
-                    echo -e "${YELLOW}   ⚠️  检测到 create-dmg 中间产物: $(basename "$RW_FILE")，正在转换为可分发 DMG...${NC}"
-                    hdiutil convert "$RW_FILE" -format UDZO -o "$DIST_DIR/$DMG_NAME" >/dev/null 2>&1
-                    rm -f "$RW_FILE"
-                fi
-            fi
-
-            if [ -f "$DIST_DIR/$DMG_NAME" ] && command -v hdiutil &> /dev/null; then
-                DMG_FORMAT=$(hdiutil imageinfo "$DIST_DIR/$DMG_NAME" 2>/dev/null | awk -F': ' '/^Format:/{print $2; exit}')
-                if [ "$DMG_FORMAT" = "UDRW" ]; then
-                    echo -e "${YELLOW}   ⚠️  检测到 UDRW（可写原始映像），正在转换为 UDZO...${NC}"
-                    TMP_UDZO="$DIST_DIR/.tmp.$DMG_NAME"
-                    rm -f "$TMP_UDZO"
-                    hdiutil convert "$DIST_DIR/$DMG_NAME" -format UDZO -o "$TMP_UDZO" >/dev/null 2>&1 && mv "$TMP_UDZO" "$DIST_DIR/$DMG_NAME"
-                fi
-            fi
-
-            if [ -f "$DIST_DIR/$DMG_NAME" ] && command -v hdiutil &> /dev/null; then
-                hdiutil verify "$DIST_DIR/$DMG_NAME" >/dev/null 2>&1
-                if [ $? -ne 0 ]; then
-                    echo -e "${RED}   ❌ DMG 校验失败，保留 .app 以便排查。${NC}"
-                else
-                    rm -rf "$DIST_DIR/$APP_DEST_NAME"
-                    echo "   ✅ 已生成 $DMG_NAME"
-                fi
-            fi
-        fi
-        
-	        if [ ! -f "$DIST_DIR/$DMG_NAME" ]; then
-	            echo -e "${RED}   ❌ DMG 生成失败。${NC}"
-	        fi
-	        fi
-	    else
-	        echo -e "${YELLOW}   ⚠️  未找到 create-dmg 工具。${NC}"
-	    fi
-	else
-	    echo -e "${RED}   ❌ macOS amd64 构建失败。${NC}"
-fi
+package_macos_release "arm64" "mac-arm64"
+package_macos_release "amd64" "mac-amd64"
 
 # --- Windows AMD64 构建 ---
 echo -e "${GREEN}🪟 正在构建 Windows (amd64)...${NC}"
 if command -v x86_64-w64-mingw32-gcc &> /dev/null; then
+    generate_driver_agent_revisions "windows/amd64"
     wails build -platform windows/amd64 -clean -ldflags "$LDFLAGS"
     if [ $? -eq 0 ]; then
         TARGET_EXE="$DIST_DIR/${APP_NAME}-${VERSION}-windows-amd64.exe"
@@ -315,6 +221,7 @@ if command -v x86_64-w64-mingw32-gcc &> /dev/null; then
         echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-windows-amd64.exe"
     else
         echo -e "${RED}   ❌ Windows amd64 构建失败。${NC}"
+        record_build_failure "Windows amd64"
     fi
 else
     echo -e "${YELLOW}   ⚠️  未找到 MinGW 工具 (x86_64-w64-mingw32-gcc)，跳过 Windows amd64 构建。${NC}"
@@ -323,6 +230,7 @@ fi
 # --- Windows ARM64 构建 ---
 echo -e "${GREEN}🪟 正在构建 Windows (arm64)...${NC}"
 if command -v aarch64-w64-mingw32-gcc &> /dev/null; then
+    generate_driver_agent_revisions "windows/arm64"
     wails build -platform windows/arm64 -clean -ldflags "$LDFLAGS"
     if [ $? -eq 0 ]; then
         TARGET_EXE="$DIST_DIR/${APP_NAME}-${VERSION}-windows-arm64.exe"
@@ -331,6 +239,7 @@ if command -v aarch64-w64-mingw32-gcc &> /dev/null; then
         echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-windows-arm64.exe"
     else
         echo -e "${RED}   ❌ Windows arm64 构建失败。${NC}"
+        record_build_failure "Windows arm64"
     fi
 else
     echo -e "${YELLOW}   ⚠️  未找到 MinGW ARM64 工具 (aarch64-w64-mingw32-gcc)，跳过 Windows arm64 构建。${NC}"
@@ -345,6 +254,7 @@ CURRENT_ARCH=$(uname -m)
 
 if [ "$CURRENT_OS" = "Linux" ] && [ "$CURRENT_ARCH" = "x86_64" ]; then
     # 本机 Linux amd64，直接构建
+    generate_driver_agent_revisions "linux/amd64"
     wails build -platform linux/amd64 -clean -ldflags "$LDFLAGS"
     if [ $? -eq 0 ]; then
         TARGET_LINUX_BIN="$DIST_DIR/${APP_NAME}-${VERSION}-linux-amd64"
@@ -359,12 +269,14 @@ if [ "$CURRENT_OS" = "Linux" ] && [ "$CURRENT_ARCH" = "x86_64" ]; then
         echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-linux-amd64.tar.gz"
     else
         echo -e "${RED}   ❌ Linux amd64 构建失败。${NC}"
+        record_build_failure "Linux amd64"
     fi
 elif command -v x86_64-linux-gnu-gcc &> /dev/null; then
     # macOS 或其他系统，尝试交叉编译
     export CC=x86_64-linux-gnu-gcc
     export CXX=x86_64-linux-gnu-g++
     export CGO_ENABLED=1
+    generate_driver_agent_revisions "linux/amd64"
     wails build -platform linux/amd64 -clean -ldflags "$LDFLAGS"
     if [ $? -eq 0 ]; then
         TARGET_LINUX_BIN="$DIST_DIR/${APP_NAME}-${VERSION}-linux-amd64"
@@ -378,6 +290,7 @@ elif command -v x86_64-linux-gnu-gcc &> /dev/null; then
         echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-linux-amd64.tar.gz"
     else
         echo -e "${RED}   ❌ Linux amd64 交叉编译失败。${NC}"
+        record_build_failure "Linux amd64"
     fi
     unset CC CXX CGO_ENABLED
 else
@@ -389,6 +302,7 @@ fi
 echo -e "${GREEN}🐧 正在构建 Linux (arm64)...${NC}"
 if [ "$CURRENT_OS" = "Linux" ] && [ "$CURRENT_ARCH" = "aarch64" ]; then
     # 本机 Linux arm64，直接构建
+    generate_driver_agent_revisions "linux/arm64"
     wails build -platform linux/arm64 -clean -ldflags "$LDFLAGS"
     if [ $? -eq 0 ]; then
         TARGET_LINUX_BIN="$DIST_DIR/${APP_NAME}-${VERSION}-linux-arm64"
@@ -402,12 +316,14 @@ if [ "$CURRENT_OS" = "Linux" ] && [ "$CURRENT_ARCH" = "aarch64" ]; then
         echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-linux-arm64.tar.gz"
     else
         echo -e "${RED}   ❌ Linux arm64 构建失败。${NC}"
+        record_build_failure "Linux arm64"
     fi
 elif command -v aarch64-linux-gnu-gcc &> /dev/null; then
     # 交叉编译
     export CC=aarch64-linux-gnu-gcc
     export CXX=aarch64-linux-gnu-g++
     export CGO_ENABLED=1
+    generate_driver_agent_revisions "linux/arm64"
     wails build -platform linux/arm64 -clean -ldflags "$LDFLAGS"
     if [ $? -eq 0 ]; then
         TARGET_LINUX_BIN="$DIST_DIR/${APP_NAME}-${VERSION}-linux-arm64"
@@ -421,6 +337,7 @@ elif command -v aarch64-linux-gnu-gcc &> /dev/null; then
         echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-linux-arm64.tar.gz"
     else
         echo -e "${RED}   ❌ Linux arm64 交叉编译失败。${NC}"
+        record_build_failure "Linux arm64"
     fi
     unset CC CXX CGO_ENABLED
 else
@@ -454,12 +371,21 @@ else
 fi
 
 echo ""
-echo -e "${GREEN}🎉 所有任务完成！构建产物在 'dist/' 目录下：${NC}"
+if [ "${#BUILD_FAILURES[@]}" -gt 0 ]; then
+    echo -e "${RED}❌ 构建未完全成功，失败平台：${BUILD_FAILURES[*]}${NC}"
+    echo -e "${YELLOW}📦 已成功生成的产物在 'dist/' 目录下：${NC}"
+else
+    echo -e "${GREEN}🎉 所有任务完成！构建产物在 'dist/' 目录下：${NC}"
+fi
 ls -lh "$DIST_DIR"
 echo ""
 echo -e "${GREEN}📋 支持的平台：${NC}"
-echo "   • macOS (Intel/Apple Silicon): .dmg"
+echo "   • macOS (Intel/Apple Silicon): .zip"
 echo "   • Windows (x64/ARM64): .exe"
 echo "   • Linux (x64/ARM64): .tar.gz"
 echo ""
 echo -e "${YELLOW}💡 提示：Linux AppImage 包请使用 GitHub Actions CI/CD 构建。${NC}"
+
+if [ "${#BUILD_FAILURES[@]}" -gt 0 ]; then
+    exit 1
+fi

cmd/gonavi-mcp-server/README.md

@@ -0,0 +1,381 @@
+# GoNavi MCP Server
+
+`gonavi-mcp-server` 会把 GoNavi 已保存连接背后的数据库能力通过 MCP 暴露给外部客户端。本机客户端默认使用 `stdio`；云端 Agent 可使用显式开启的 Streamable HTTP 模式。
+
+## 当前提供的 tools
+
+- `get_connections`
+  - 返回 GoNavi 已保存连接的 `id/name/type/target/defaultDatabase` 等摘要信息
+- `get_databases`
+  - 入参：`connectionId`
+- `get_tables`
+  - 入参：`connectionId`、可选 `dbName`
+  - 返回表列表，并在 `views` 字段附带视图列表，兼容旧客户端只调用 `get_tables` 的场景
+- `get_views`
+  - 入参：`connectionId`、可选 `dbName`
+  - 返回视图列表
+- `get_objects`
+  - 入参：`connectionId`、可选 `dbName`、可选 `objectTypes`
+  - 返回表、视图、触发器、函数、过程、序列、包、事件，以及消息队列类 `topic/queue/exchange` 等对象清单
+- `get_columns`
+  - 入参：`connectionId`、可选 `dbName`、`tableName`
+- `get_table_ddl`
+  - 入参：`connectionId`、可选 `dbName`、`tableName`
+- `execute_sql`
+  - 入参：`connectionId`、可选 `dbName`、`sql`
+  - 默认只允许只读 SQL
+  - 如果 SQL 包含 DDL/DML，必须显式传 `allowMutating=true`
+  - `maxRowsPerResult` 用来限制单个结果集返回的行数，默认 `200`
+
+远程 Agent 只需要结构元数据时，启动 HTTP 模式请加 `--schema-only`。该模式不注册 `execute_sql`，只保留连接摘要、对象清单、表/视图、字段、索引、外键、触发器和 DDL 工具。
+
+## 运行方式
+
+开发态直接运行：
+
+```powershell
+go run ./cmd/gonavi-mcp-server
+```
+
+显式运行本机 `stdio`：
+
+```powershell
+go run ./cmd/gonavi-mcp-server stdio
+```
+
+也可以先编译：
+
+```powershell
+go build -o .\bin\gonavi-mcp-server.exe .\cmd\gonavi-mcp-server
+```
+
+## Docker / Podman / Compose
+
+当前容器化支持仅覆盖 `gonavi-mcp-server`，不包含 Wails 桌面 GUI。
+
+当前支持矩阵：
+
+- Docker Desktop / Linux 服务器 / NAS：直接使用 Compose 或 `docker run`
+- Podman / Quadlet：使用 `deploy/podman/gonavi-mcp-server`
+- Kubernetes：使用 `deploy/k8s/gonavi-mcp-server`
+- Helm：使用 `deploy/helm/gonavi-mcp-server`
+- 仅构建环境：使用仓库根目录 `Dockerfile.build-env`
+- 桌面 GUI 浏览器访问版：当前不提供，此仓库主应用仍是 Wails 桌面程序，不是现成的 Web 服务
+
+仓库根目录已提供以下文件：
+
+- `Dockerfile.mcp-server`
+- `docker-compose.mcp-server.yml`
+- `docker.mcp-server.env.example`
+- `deploy/podman/gonavi-mcp-server/*`
+
+推荐流程：
+
+```bash
+cp docker.mcp-server.env.example docker.mcp-server.env
+docker compose --env-file docker.mcp-server.env -f docker-compose.mcp-server.yml up -d
+```
+
+默认 Compose 会拉取 GHCR 预构建镜像。如果你要基于当前工作区源码本地构建，再叠加：
+
+```bash
+docker compose --env-file docker.mcp-server.env \
+  -f docker-compose.mcp-server.yml \
+  -f docker-compose.mcp-server.local.yml \
+  up -d --build
+```
+
+其中 `GONAVI_HOST_DATA_ROOT` 必须指向 GoNavi 当前活动数据目录。该目录内至少应包含：
+
+- `connections.json`
+- `daily_secrets.json`
+- `drivers/`（如果目标连接依赖可选 driver agent）
+
+容器内默认会设置：
+
+- `GONAVI_DATA_ROOT=/data`
+- `GONAVI_MCP_HTTP_ADDR=0.0.0.0:8765`
+- `GONAVI_MCP_HTTP_PATH=/mcp`
+
+`GONAVI_DATA_ROOT` 会覆盖默认活动数据目录解析逻辑，避免宿主机路径与容器内路径不一致时依赖 `storage_root.json` 的绝对路径。
+
+如果你只想手动构建镜像：
+
+```bash
+docker build -f Dockerfile.mcp-server -t gonavi-mcp-server:local .
+docker run --rm -p 8765:8765 \
+  -e GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token \
+  -e GONAVI_MCP_SCHEMA_ONLY=true \
+  -e GONAVI_DATA_ROOT=/data \
+  -v /absolute/path/to/gonavi-data:/data \
+  gonavi-mcp-server:local http
+```
+
+如果你直接使用已发布镜像：
+
+```bash
+docker run --rm -p 8765:8765 \
+  -e GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token \
+  -e GONAVI_MCP_SCHEMA_ONLY=true \
+  -e GONAVI_DATA_ROOT=/data \
+  -v /absolute/path/to/gonavi-data:/data \
+  ghcr.io/syngnat/gonavi-mcp-server:latest http
+```
+
+### Podman
+
+仓库内还提供了 Podman 原生部署样例：
+
+- `deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example`
+- `deploy/podman/gonavi-mcp-server/gonavi-mcp-server.container`
+- `deploy/podman/gonavi-mcp-server/README.md`
+
+直接运行已发布镜像：
+
+```bash
+cp deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example ./gonavi-mcp-server.env
+podman run -d --name gonavi-mcp-server --replace \
+  -p 8765:8765 \
+  --env-file ./gonavi-mcp-server.env \
+  -v /absolute/path/to/gonavi-data:/data:Z \
+  ghcr.io/syngnat/gonavi-mcp-server:latest http
+```
+
+如果你要基于当前源码本地构建：
+
+```bash
+podman build -f Dockerfile.mcp-server -t localhost/gonavi-mcp-server:local .
+podman run -d --name gonavi-mcp-server --replace \
+  -p 8765:8765 \
+  --env-file ./gonavi-mcp-server.env \
+  -v /absolute/path/to/gonavi-data:/data:Z \
+  localhost/gonavi-mcp-server:local http
+```
+
+其中：
+
+- `gonavi-mcp-server.env` 用 `deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example` 初始化
+- `:Z` 适用于开启 SELinux 的宿主机；未启用 SELinux 可去掉
+- 更适合长期运行的方式见 [deploy/podman/gonavi-mcp-server/README.md](../../deploy/podman/gonavi-mcp-server/README.md) 中的 Quadlet 示例
+
+`podman compose` 本身依赖外部 compose provider，所以仓库对 Podman 的主支持路径是 `podman run` 与 Quadlet，而不是假设所有环境都能直接复用 Compose。
+
+## Kubernetes
+
+仓库内置了最小 K8s 示例：
+
+- `deploy/k8s/gonavi-mcp-server/kustomization.yaml`
+- `deploy/k8s/gonavi-mcp-server/base/deployment.yaml`
+- `deploy/k8s/gonavi-mcp-server/base/service.yaml`
+- `deploy/k8s/gonavi-mcp-server/README.md`
+- `deploy/k8s/gonavi-mcp-server/overlays/*`
+
+推荐先从现有 GoNavi 数据目录生成 Secret：
+
+```bash
+kubectl create namespace gonavi
+kubectl -n gonavi create secret generic gonavi-mcp-server-data \
+  --from-file=connections.json=/absolute/path/to/gonavi-data/connections.json \
+  --from-file=daily_secrets.json=/absolute/path/to/gonavi-data/daily_secrets.json \
+  --from-literal=GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token
+kubectl apply -k deploy/k8s/gonavi-mcp-server
+```
+
+如果需要 NAS hostPath、可选 driver agent PVC、Ingress，或两者组合，可直接使用 `overlays/nas-hostpath`、`overlays/drivers-pvc`、`overlays/ingress`、`overlays/ingress-with-drivers-pvc`。
+
+更完整的说明见 [deploy/k8s/gonavi-mcp-server/README.md](../../deploy/k8s/gonavi-mcp-server/README.md)。
+
+## Helm
+
+如果你希望把镜像、Secret、Ingress、hostPath / PVC 挂载做成参数化部署，而不是维护多份 Kustomize overlay，可直接使用：
+
+- `deploy/helm/gonavi-mcp-server`
+
+快速安装：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server -n gonavi --create-namespace
+```
+
+Chart 详细说明见 [deploy/helm/gonavi-mcp-server/README.md](../../deploy/helm/gonavi-mcp-server/README.md)。
+
+## Docker / Podman Build Environment
+
+如果你的目标不是运行 MCP，而是给 Linux 服务器 / NAS / CI 准备一套可重复的 Wails 构建环境，可直接使用仓库根目录的 `Dockerfile.build-env`：
+
+```bash
+docker build -f Dockerfile.build-env -t gonavi-build-env:local .
+docker run --rm -it -v "$PWD:/workspace" -w /workspace gonavi-build-env:local bash
+```
+
+如果你使用 Podman，也可以直接执行：
+
+```bash
+podman build -f Dockerfile.build-env -t localhost/gonavi-build-env:local .
+podman run --rm -it -v "$PWD:/workspace" -w /workspace localhost/gonavi-build-env:local bash
+```
+
+镜像内已预装 Go、Node、Wails CLI、GTK3 与 WebKitGTK 开发依赖，适合执行：
+
+```bash
+wails build
+```
+
+这个镜像默认安装 WebKitGTK 4.0 构建依赖，适合作为通用 Linux / NAS 构建环境。镜像基座支持多架构，`amd64` / `arm64` 会跟随容器平台。
+
+预构建镜像会发布到 GHCR：
+
+- `ghcr.io/syngnat/gonavi-mcp-server:latest`
+- `ghcr.io/syngnat/gonavi-build-env:latest`
+
+它只负责构建 Linux 产物，不会把 Wails 主程序变成浏览器版服务。
+
+远程 Agent 使用 Streamable HTTP 时必须设置 bearer token：
+
+```powershell
+$env:GONAVI_MCP_HTTP_TOKEN = "<随机token>"
+go run ./cmd/gonavi-mcp-server http --addr 127.0.0.1:8765 --path /mcp --schema-only
+```
+
+安装包主程序也支持同样模式：
+
+```powershell
+& "C:\Program Files\GoNavi\GoNavi.exe" mcp-server http --addr 127.0.0.1:8765 --path /mcp --token "<随机token>" --schema-only
+```
+
+默认建议只监听 `127.0.0.1`，再通过 SSH 隧道、反向代理或内网网关暴露给云端 Agent。不要在没有 TLS、防火墙和鉴权的情况下直接监听公网地址。
+
+无图形界面或需要把配置交给云端 Agent 时，可直接生成 OpenClaw / Hermans 等远程 MCP 配置：
+
+```powershell
+& "C:\Program Files\GoNavi\GoNavi.exe" mcp-server remote-config --client openclaw --url "https://<你的域名或隧道地址>/mcp" --token "<随机token>" --schema-only
+```
+
+独立 server 开发态也支持同样能力：
+
+```powershell
+go run ./cmd/gonavi-mcp-server remote-config --client hermans --url "https://<你的域名或隧道地址>/mcp" --token "<随机token>" --schema-only
+```
+
+## Claude Code / Codex / OpenClaw / Hermans
+
+正式安装包场景，推荐直接在 GoNavi 里使用“AI 设置 -> MCP 服务 -> 安装到 Claude Code / 安装到 Codex”。
+
+它会自动把当前安装的 `GoNavi.exe` 写入 Claude Code 的用户级 `~/.claude.json`，命令形态类似：
+
+```json
+{
+  "mcpServers": {
+    "gonavi": {
+      "type": "stdio",
+      "command": "C:\\Program Files\\GoNavi\\GoNavi.exe",
+      "args": ["mcp-server"],
+      "env": {}
+    }
+  }
+}
+```
+
+这样用户不需要自己找本机 `gonavi-mcp-server.exe` 路径，安装包本体就能直接作为 MCP 入口。
+
+Codex 当前使用 `~/.codex/config.toml`，GoNavi 会写入类似下面这段：
+
+```toml
+[mcp_servers.gonavi]
+command = 'C:\Program Files\GoNavi\GoNavi.exe'
+args = ['mcp-server']
+startup_timeout_sec = 60
+```
+
+仓库开发态如果要在本机 `Claude Code CLI` 里稳定使用这个 MCP，仍然推荐走仓库内包装脚本：
+
+```powershell
+.\tools\claude-gonavi-mcp.ps1 -p "必须调用 gonavi MCP 的 get_connections 工具"
+```
+
+或者：
+
+```cmd
+tools\claude-gonavi-mcp.cmd -p "必须调用 gonavi MCP 的 get_connections 工具"
+```
+
+这个脚本会先构建 `bin\gonavi-mcp-server.exe`，再通过 `--mcp-config` 和 `--strict-mcp-config` 把 GoNavi MCP 单独注入当前 Claude 会话，避免默认混合 MCP 加载时序导致的首轮工具未挂载问题。
+
+OpenClaw、Hermans 这类部署在云端或远端 Linux 的 Agent，不能直接使用 Windows 本机的 `stdio` 命令。GoNavi 的连接信息和数据库密码仍应留在 Windows 本机，由 GoNavi MCP 读取保存连接和系统凭据；远端 Agent 只拿到 MCP tools 和 `connectionId`。
+
+推荐接入形态：
+
+1. Windows 本机运行 GoNavi，并保持能访问已保存的数据库连接。
+2. 在 Windows 本机启动 `GoNavi.exe mcp-server http --addr 127.0.0.1:8765 --path /mcp --token <随机token> --schema-only`。
+3. 通过 SSH 隧道、反向代理或内网网关把 `http://127.0.0.1:8765/mcp` 暴露为云端 Agent 可访问的 HTTPS 地址。
+4. 在 OpenClaw / Hermans 中添加远程 MCP Server，transport 选择 Streamable HTTP，URL 指向 `/mcp` 地址，并设置请求头 `Authorization: Bearer <随机token>`。
+5. 先调用 `get_connections` 获取 `connectionId`，再调用 `get_databases`、`get_objects`、`get_tables`、`get_views`、`get_columns`、`get_table_ddl` 等工具读取结构。
+
+如果目标 Agent 支持 `mcpServers` JSON，可按下面的通用片段配置：
+
+```json
+{
+  "mcpServers": {
+    "gonavi": {
+      "type": "streamable-http",
+      "url": "https://<你的域名或隧道地址>/mcp",
+      "headers": {
+        "Authorization": "Bearer <随机token>"
+      }
+    }
+  }
+}
+```
+
+不要把数据库 `host/user/password` 写入云端 Agent 的配置文件。默认 `--schema-only` 不暴露 `execute_sql`；如果你明确需要远程执行 SQL，可以去掉该参数，此时 `execute_sql` 仍受 GoNavi AI 安全设置控制，写操作必须显式传 `allowMutating=true`。
+
+## MCP 客户端配置示例
+
+开发态：
+
+```json
+{
+  "mcpServers": {
+    "gonavi": {
+      "command": "go",
+      "args": ["run", "./cmd/gonavi-mcp-server"]
+    }
+  }
+}
+```
+
+Windows 独立 server 编译产物（开发态）：
+
+```json
+{
+  "mcpServers": {
+    "gonavi": {
+      "command": "D:\\Work\\CodeRepos\\GoNavi\\bin\\gonavi-mcp-server.exe",
+      "args": []
+    }
+  }
+}
+```
+
+Windows 已安装 GoNavi（推荐给最终用户）：
+
+```json
+{
+  "mcpServers": {
+    "gonavi": {
+      "type": "stdio",
+      "command": "C:\\Program Files\\GoNavi\\GoNavi.exe",
+      "args": ["mcp-server"],
+      "env": {}
+    }
+  }
+}
+```
+
+## 使用说明
+
+- 先调用 `get_connections`，拿到 `connectionId`
+- 之后所有数据库工具都只传 `connectionId`，由 GoNavi 服务端内部解析保存连接和密钥
+- 如果 `dbName` 为空，会优先使用该保存连接里的默认数据库
+- Server 会读取 GoNavi 当前活动数据目录里的连接配置，并通过系统 keyring/凭据管理器解析密文
+- 如果本机凭据存储不可用，依赖密钥的连接会返回对应错误

cmd/gonavi-mcp-server/main.go

@@ -0,0 +1,42 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+	"strings"
+
+	"GoNavi-Wails/internal/mcpserver"
+)
+
+func main() {
+	ctx := context.Background()
+	err := run(ctx, os.Args[1:])
+	if err != nil {
+		log.Printf("GoNavi MCP Server 退出: %v", err)
+	}
+}
+
+func run(ctx context.Context, args []string) error {
+	if len(args) == 0 {
+		return mcpserver.RunAppStdioServer(ctx)
+	}
+
+	mode := strings.ToLower(strings.TrimSpace(args[0]))
+	switch mode {
+	case "stdio", "--stdio":
+		return mcpserver.RunAppStdioServer(ctx)
+	case "http", "--http", "streamable-http", "--streamable-http":
+		options, err := mcpserver.ParseHTTPServerOptions(args[1:])
+		if err != nil {
+			return err
+		}
+		log.Printf("GoNavi MCP Streamable HTTP Server 启动：addr=%s path=%s schemaOnly=%v", options.Addr, options.Path, options.SchemaOnly)
+		return mcpserver.RunAppStreamableHTTPServer(ctx, options)
+	case "remote-config", "--remote-config":
+		return mcpserver.WriteRemoteMCPClientConfig(os.Stdout, args[1:])
+	default:
+		return fmt.Errorf("未知 MCP server 模式: %s（支持 stdio/http/remote-config）", args[0])
+	}
+}

cmd/manualtestseed/main.go

@@ -0,0 +1,339 @@
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"GoNavi-Wails/internal/ai"
+	aiservice "GoNavi-Wails/internal/ai/service"
+	"GoNavi-Wails/internal/app"
+	"GoNavi-Wails/internal/connection"
+	"GoNavi-Wails/internal/secretstore"
+)
+
+const (
+	modeSeedSecureStorage = "seed-secure-storage"
+	modeSeedAIUpdate      = "seed-ai-update"
+)
+
+const (
+	testConnectionID       = "manualtest-postgres"
+	testSecureProviderID   = "manualtest-secure-provider"
+	testPendingProviderID  = "manualtest-pending-provider"
+	testBackupDirName      = "manual-test-backups"
+	connectionsFileName    = "connections.json"
+	globalProxyFileName    = "global_proxy.json"
+	aiConfigFileName       = "ai_config.json"
+	securityUpdateFileName = "config-security-update.json"
+)
+
+type backupManifest struct {
+	CreatedAt string               `json:"createdAt"`
+	ConfigDir string               `json:"configDir"`
+	Files     []backupManifestFile `json:"files"`
+}
+
+type backupManifestFile struct {
+	RelativePath string `json:"relativePath"`
+	Existed      bool   `json:"existed"`
+}
+
+type storedAIConfig struct {
+	SchemaVersion  int                 `json:"schemaVersion,omitempty"`
+	Providers      []ai.ProviderConfig `json:"providers"`
+	ActiveProvider string              `json:"activeProvider"`
+	SafetyLevel    string              `json:"safetyLevel"`
+	ContextLevel   string              `json:"contextLevel"`
+}
+
+func main() {
+	mode := flag.String("mode", modeSeedSecureStorage, "seed mode: seed-secure-storage | seed-ai-update")
+	flag.Parse()
+
+	configDir, err := resolveConfigDir()
+	if err != nil {
+		fatalf("resolve config dir failed: %v", err)
+	}
+
+	store := secretstore.NewKeyringStore()
+	if err := store.HealthCheck(); err != nil {
+		fatalf("secret store unavailable: %v", err)
+	}
+
+	backupDir, err := backupConfigFiles(configDir)
+	if err != nil {
+		fatalf("backup config files failed: %v", err)
+	}
+
+	switch strings.TrimSpace(*mode) {
+	case modeSeedSecureStorage:
+		if err := seedSecureStorage(configDir, store); err != nil {
+			fatalf("seed secure storage failed: %v", err)
+		}
+		fmt.Printf("mode=%s\nbackup=%s\nconnectionId=%s\nproviderId=%s\n", modeSeedSecureStorage, backupDir, testConnectionID, testSecureProviderID)
+	case modeSeedAIUpdate:
+		if err := seedAIUpdate(configDir, store); err != nil {
+			fatalf("seed ai update failed: %v", err)
+		}
+		fmt.Printf("mode=%s\nbackup=%s\npendingProviderId=%s\n", modeSeedAIUpdate, backupDir, testPendingProviderID)
+	default:
+		fatalf("unsupported mode: %s", *mode)
+	}
+}
+
+func fatalf(format string, args ...any) {
+	fmt.Fprintf(os.Stderr, format+"\n", args...)
+	os.Exit(1)
+}
+
+func resolveConfigDir() (string, error) {
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(homeDir, ".gonavi"), nil
+}
+
+func backupConfigFiles(configDir string) (string, error) {
+	backupDir := filepath.Join(configDir, testBackupDirName, time.Now().Format("20060102-150405"))
+	files := []string{
+		connectionsFileName,
+		globalProxyFileName,
+		aiConfigFileName,
+		filepath.Join("migrations", securityUpdateFileName),
+	}
+
+	manifest := backupManifest{
+		CreatedAt: time.Now().Format(time.RFC3339),
+		ConfigDir: configDir,
+		Files:     make([]backupManifestFile, 0, len(files)),
+	}
+
+	for _, relativePath := range files {
+		srcPath := filepath.Join(configDir, relativePath)
+		info, err := os.Stat(srcPath)
+		if err != nil {
+			if os.IsNotExist(err) {
+				manifest.Files = append(manifest.Files, backupManifestFile{
+					RelativePath: relativePath,
+					Existed:      false,
+				})
+				continue
+			}
+			return "", err
+		}
+		if info.IsDir() {
+			continue
+		}
+
+		dstPath := filepath.Join(backupDir, relativePath)
+		if err := os.MkdirAll(filepath.Dir(dstPath), 0o755); err != nil {
+			return "", err
+		}
+		data, err := os.ReadFile(srcPath)
+		if err != nil {
+			return "", err
+		}
+		if err := os.WriteFile(dstPath, data, 0o644); err != nil {
+			return "", err
+		}
+		manifest.Files = append(manifest.Files, backupManifestFile{
+			RelativePath: relativePath,
+			Existed:      true,
+		})
+	}
+
+	if err := os.MkdirAll(backupDir, 0o755); err != nil {
+		return "", err
+	}
+	manifestData, err := json.MarshalIndent(manifest, "", "  ")
+	if err != nil {
+		return "", err
+	}
+	if err := os.WriteFile(filepath.Join(backupDir, "manifest.json"), manifestData, 0o644); err != nil {
+		return "", err
+	}
+	return backupDir, nil
+}
+
+func seedSecureStorage(configDir string, store secretstore.SecretStore) error {
+	if err := cleanupKnownTestSecrets(store); err != nil {
+		return err
+	}
+
+	appService := app.NewAppWithSecretStore(store)
+	_ = appService.DeleteConnection(testConnectionID)
+
+	if _, err := appService.SaveConnection(connection.SavedConnectionInput{
+		ID:   testConnectionID,
+		Name: "手工测试 PostgreSQL",
+		Config: connection.ConnectionConfig{
+			ID:       testConnectionID,
+			Type:     "postgres",
+			Host:     "127.0.0.1",
+			Port:     5432,
+			User:     "postgres",
+			Password: "manualtest-pg-secret",
+			Database: "postgres",
+		},
+	}); err != nil {
+		return err
+	}
+
+	if _, err := appService.SaveGlobalProxy(connection.SaveGlobalProxyInput{
+		Enabled:  true,
+		Type:     "http",
+		Host:     "127.0.0.1",
+		Port:     7890,
+		User:     "manual-test",
+		Password: "manualtest-proxy-secret",
+	}); err != nil {
+		return err
+	}
+
+	storeConfig := aiservice.NewProviderConfigStore(configDir, store)
+	snapshot, err := storeConfig.LoadRuntime()
+	if err != nil {
+		return err
+	}
+	snapshot.Providers = filterProviders(snapshot.Providers, testSecureProviderID, testPendingProviderID)
+	snapshot.Providers = append(snapshot.Providers, ai.ProviderConfig{
+		ID:        testSecureProviderID,
+		Type:      "custom",
+		Name:      "手工测试 Secure Provider",
+		APIKey:    "manualtest-ai-secret",
+		BaseURL:   "https://api.openai.com/v1",
+		Model:     "gpt-4o-mini",
+		APIFormat: "openai",
+		Headers: map[string]string{
+			"Authorization": "Bearer manualtest-header-secret",
+			"X-Trace-Id":    "manualtest-visible",
+		},
+		MaxTokens:   2048,
+		Temperature: 0.2,
+	})
+	if snapshot.SafetyLevel == "" {
+		snapshot.SafetyLevel = ai.PermissionReadOnly
+	}
+	if snapshot.ContextLevel == "" {
+		snapshot.ContextLevel = ai.ContextSchemaOnly
+	}
+	return storeConfig.Save(snapshot)
+}
+
+func seedAIUpdate(configDir string, store secretstore.SecretStore) error {
+	if err := cleanupKnownTestSecrets(store); err != nil {
+		return err
+	}
+
+	configPath := filepath.Join(configDir, aiConfigFileName)
+	cfg, err := readStoredAIConfig(configPath)
+	if err != nil {
+		return err
+	}
+
+	cfg.Providers = filterProviders(cfg.Providers, testSecureProviderID, testPendingProviderID)
+	cfg.Providers = append(cfg.Providers, ai.ProviderConfig{
+		ID:        testPendingProviderID,
+		Type:      "custom",
+		Name:      "手工测试 待迁移 AI",
+		APIKey:    "manualtest-ai-update-secret",
+		BaseURL:   "https://api.openai.com/v1",
+		Model:     "gpt-4o-mini",
+		APIFormat: "openai",
+		MaxTokens: 1024,
+	})
+	if cfg.SchemaVersion == 0 {
+		cfg.SchemaVersion = 2
+	}
+	if cfg.Providers == nil {
+		cfg.Providers = []ai.ProviderConfig{}
+	}
+	if err := os.MkdirAll(configDir, 0o755); err != nil {
+		return err
+	}
+	data, err := json.MarshalIndent(cfg, "", "  ")
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(configPath, data, 0o644)
+}
+
+func readStoredAIConfig(configPath string) (storedAIConfig, error) {
+	cfg := storedAIConfig{
+		Providers:      []ai.ProviderConfig{},
+		SafetyLevel:    string(ai.PermissionReadOnly),
+		ContextLevel:   string(ai.ContextSchemaOnly),
+		SchemaVersion:  2,
+		ActiveProvider: "",
+	}
+
+	data, err := os.ReadFile(configPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return cfg, nil
+		}
+		return storedAIConfig{}, err
+	}
+	if err := json.Unmarshal(data, &cfg); err != nil {
+		return storedAIConfig{}, err
+	}
+	if cfg.Providers == nil {
+		cfg.Providers = []ai.ProviderConfig{}
+	}
+	return cfg, nil
+}
+
+func filterProviders(providers []ai.ProviderConfig, excludedIDs ...string) []ai.ProviderConfig {
+	excluded := make(map[string]struct{}, len(excludedIDs))
+	for _, id := range excludedIDs {
+		excluded[strings.TrimSpace(id)] = struct{}{}
+	}
+	filtered := make([]ai.ProviderConfig, 0, len(providers))
+	for _, provider := range providers {
+		if _, skip := excluded[strings.TrimSpace(provider.ID)]; skip {
+			continue
+		}
+		filtered = append(filtered, provider)
+	}
+	return filtered
+}
+
+func cleanupKnownTestSecrets(store secretstore.SecretStore) error {
+	type secretRef struct {
+		kind string
+		id   string
+	}
+	refs := []secretRef{
+		{kind: "connection", id: testConnectionID},
+		{kind: "global-proxy", id: "default"},
+		{kind: "ai-provider", id: testSecureProviderID},
+		{kind: "ai-provider", id: testPendingProviderID},
+	}
+
+	for _, item := range refs {
+		ref, err := secretstore.BuildRef(item.kind, item.id)
+		if err != nil {
+			return err
+		}
+		if err := store.Delete(ref); err != nil && !isIgnorableDeleteError(err) {
+			return err
+		}
+	}
+	return nil
+}
+
+func isIgnorableDeleteError(err error) bool {
+	if err == nil || os.IsNotExist(err) {
+		return true
+	}
+	message := strings.ToLower(strings.TrimSpace(err.Error()))
+	return strings.Contains(message, "could not be found") ||
+		strings.Contains(message, "not be found in the keyring") ||
+		strings.Contains(message, "element not found")
+}

cmd/mingw-import-lib/main.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"GoNavi-Wails/internal/buildutil"
+)
+
+func main() {
+	var (
+		dllPath     string
+		dlltoolPath string
+		outputLib   string
+	)
+
+	flag.StringVar(&dllPath, "dll", "", "Path to the source DLL")
+	flag.StringVar(&dlltoolPath, "dlltool", "", "Optional path to dlltool executable")
+	flag.StringVar(&outputLib, "output-lib", "", "Output import library path")
+	flag.Parse()
+
+	if err := buildutil.GenerateWindowsImportLibraryFromDLL(dllPath, dlltoolPath, outputLib); err != nil {
+		fmt.Fprintf(os.Stderr, "generate mingw import library failed: %v\n", err)
+		os.Exit(1)
+	}
+}

cmd/optional-driver-agent/main.go

@@ -7,7 +7,11 @@ import (
 	"fmt"
 	"os"
 	"reflect"
+	"runtime"
+	"runtime/debug"
+	"strconv"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"GoNavi-Wails/internal/connection"
@@ -17,6 +21,7 @@ import (
 type agentRequest struct {
 	ID        int64                        `json:"id"`
 	Method    string                       `json:"method"`
+	SessionID string                       `json:"sessionId,omitempty"`
 	Config    *connection.ConnectionConfig `json:"config,omitempty"`
 	Query     string                       `json:"query,omitempty"`
 	TimeoutMs int64                        `json:"timeoutMs,omitempty"`
@@ -31,14 +36,21 @@ type agentResponse struct {
 	Error        string      `json:"error,omitempty"`
 	Data         interface{} `json:"data,omitempty"`
 	Fields       []string    `json:"fields,omitempty"`
+	Messages     []string    `json:"messages,omitempty"`
+	ChunkType    string      `json:"chunkType,omitempty"`
 	RowsAffected int64       `json:"rowsAffected,omitempty"`
 }
 
 const (
 	agentMethodConnect       = "connect"
 	agentMethodClose         = "close"
+	agentMethodMetadata      = "metadata"
 	agentMethodPing          = "ping"
+	agentMethodOpenSession   = "openSession"
+	agentMethodCloseSession  = "closeSession"
 	agentMethodQuery         = "query"
+	agentMethodQueryMulti    = "queryMulti"
+	agentMethodStreamQuery   = "streamQuery"
 	agentMethodExec          = "exec"
 	agentMethodGetDatabases  = "getDatabases"
 	agentMethodGetTables     = "getTables"
@@ -53,23 +65,67 @@ const (
 
 const legacyClickHouseDefaultTimeout = 2 * time.Hour
 
-var (
-	agentDriverType      string
-	agentDatabaseFactory func() db.Database
+const (
+	agentChunkColumns = "columns"
+	agentChunkRows    = "rows"
+	agentChunkDone    = "done"
+	// agentStreamBatchSize 控制 driver-agent 向主进程发送 row chunk 的批次大小。
+	// 调小到 64：单批 JSON 编码 + 主进程解码的瞬时内存峰值降为原来的 1/4，
+	// 代价是 IPC 次数变为 4 倍，但每批仅一次 stdin/stdout 行读写，整体影响可忽略。
+	// 重要：减小批次不能根除内存峰值，仍需配合 SetGCPercent + 周期 GC（见 main）。
+	agentStreamBatchSize         = 64
+	agentMemoryTrimRowsThreshold = 100000
+	agentMemoryTrimMinInterval   = 3 * time.Second
 )
 
+var (
+	agentDriverType         string
+	agentDatabaseFactory    func() db.Database
+	agentMemoryTrimRunning  atomic.Bool
+	agentMemoryTrimLastAt   atomic.Int64
+	runAgentMemoryTrimAsync = func(fn func()) {
+		go fn()
+	}
+	agentMemoryTrimFn = func() {
+		runtime.GC()
+		debug.FreeOSMemory()
+	}
+)
+
+type agentRuntime struct {
+	inst          db.Database
+	sessions      map[string]db.StatementExecer
+	nextSessionID int64
+}
+
 func main() {
 	if agentDatabaseFactory == nil || strings.TrimSpace(agentDriverType) == "" {
 		fmt.Fprintf(os.Stderr, "未配置驱动代理 provider，请使用 gonavi_<driver>_driver 标签构建\n")
 		os.Exit(2)
 	}
 
+	// driver-agent 是独立进程，主进程无法控制其 GC 行为。
+	// 大结果集（88W+ 行）通过 JSON-lines 跨进程传输时，每行有 5-8 倍内存副本；
+	// Go 默认 GOGC=100 + Windows MADV_FREE 不归还 RSS，会导致 driver-agent 进程
+	// 内存峰值达到数据总量的 10+ 倍（用户实测 88W 普通业务表撑到 8G+）。
+	//
+	// GC 策略组合：
+	//   - SetGCPercent(50)：堆增长 50% 即触发 GC，比默认 100 更早收敛
+	//   - InitMemorySoftLimit：起始 2GB，运行时由 MaybeGrowMemoryLimit 自适应抬升到最多 8GB
+	//     （起步保守 + 按需扩张，避免静态 2GB 限制在大表场景触发 GC 硬模式降速 15-25%）
+	//
+	// 代价：CPU 开销增加约 5-10%。导出场景是 I/O 密集型，可忽略。
+	debug.SetGCPercent(50)
+	db.InitMemorySoftLimit(db.MemorySoftLimitInitialBytes)
+
 	scanner := bufio.NewScanner(os.Stdin)
 	scanner.Buffer(make([]byte, 0, 16<<10), 8<<20)
 	writer := bufio.NewWriter(os.Stdout)
 	defer writer.Flush()
 
-	var inst db.Database
+	runtimeState := &agentRuntime{
+		sessions: make(map[string]db.StatementExecer),
+	}
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
 		if line == "" {
@@ -86,23 +142,32 @@ func main() {
 			continue
 		}
 
-		resp := handleRequest(&inst, req)
+		if strings.TrimSpace(req.Method) == agentMethodStreamQuery {
+			if err := handleStreamRequest(runtimeState, req, writer); err != nil {
+				fmt.Fprintf(os.Stderr, "写入流式响应失败：%v\n", err)
+				break
+			}
+			continue
+		}
+
+		resp := handleRequest(runtimeState, req)
 		if err := writeResponse(writer, resp); err != nil {
 			fmt.Fprintf(os.Stderr, "写入响应失败：%v\n", err)
 			break
 		}
+		if strings.TrimSpace(req.Method) == agentMethodQuery {
+			maybeReleaseAgentMemory("query-response", countAgentResponseRows(resp.Data))
+		}
 	}
 
-	if inst != nil {
-		_ = inst.Close()
-	}
+	runtimeState.close()
 
 	if err := scanner.Err(); err != nil {
 		fmt.Fprintf(os.Stderr, "读取请求失败：%v\n", err)
 	}
 }
 
-func handleRequest(inst *db.Database, req agentRequest) agentResponse {
+func handleRequest(runtimeState *agentRuntime, req agentRequest) agentResponse {
 	resp := agentResponse{ID: req.ID, Success: true}
 	method := strings.TrimSpace(req.Method)
 
@@ -111,9 +176,7 @@ func handleRequest(inst *db.Database, req agentRequest) agentResponse {
 		if req.Config == nil {
 			return fail(resp, "连接配置为空")
 		}
-		if *inst != nil {
-			_ = (*inst).Close()
-		}
+		runtimeState.close()
 		next := agentDatabaseFactory()
 		if next == nil {
 			return fail(resp, "驱动代理初始化失败")
@@ -121,84 +184,162 @@ func handleRequest(inst *db.Database, req agentRequest) agentResponse {
 		if err := next.Connect(*req.Config); err != nil {
 			return fail(resp, err.Error())
 		}
-		*inst = next
+		runtimeState.inst = next
 		return resp
 	case agentMethodClose:
-		if *inst != nil {
-			if err := (*inst).Close(); err != nil {
+		if runtimeState.inst != nil {
+			if err := runtimeState.close(); err != nil {
 				return fail(resp, err.Error())
 			}
-			*inst = nil
+		}
+		return resp
+	case agentMethodMetadata:
+		resp.Data = map[string]string{
+			"driverType":     strings.TrimSpace(agentDriverType),
+			"agentRevision":  db.OptionalDriverAgentRevision(agentDriverType),
+			"protocolSchema": "json-lines-v1",
+		}
+		return resp
+	case agentMethodOpenSession:
+		if runtimeState.inst == nil {
+			return fail(resp, "connection not open")
+		}
+		provider, ok := runtimeState.inst.(db.SessionExecerProvider)
+		if !ok {
+			return fail(resp, fmt.Sprintf("当前数据源（%s）不支持 SQL 编辑器托管事务", strings.TrimSpace(agentDriverType)))
+		}
+		openCtx := context.Background()
+		var cancel context.CancelFunc
+		if req.TimeoutMs > 0 {
+			openCtx, cancel = context.WithTimeout(context.Background(), time.Duration(req.TimeoutMs)*time.Millisecond)
+			defer cancel()
+		}
+		session, err := provider.OpenSessionExecer(openCtx)
+		if err != nil {
+			return fail(resp, err.Error())
+		}
+		sessionID := runtimeState.nextID()
+		runtimeState.sessions[sessionID] = session
+		resp.Data = sessionID
+		return resp
+	case agentMethodCloseSession:
+		if err := runtimeState.closeSession(req.SessionID); err != nil {
+			return fail(resp, err.Error())
 		}
 		return resp
 	}
 
-	if *inst == nil {
+	if runtimeState.inst == nil {
 		return fail(resp, "connection not open")
 	}
 
+	if session, ok, err := runtimeState.session(req.SessionID); err != nil {
+		return fail(resp, err.Error())
+	} else if ok {
+		switch method {
+		case agentMethodQuery:
+			data, fields, messages, err := queryStatementWithMessagesOptionalTimeout(session, req.Query, req.TimeoutMs)
+			if err != nil {
+				return fail(resp, err.Error())
+			}
+			resp.Data = data
+			resp.Fields = fields
+			resp.Messages = messages
+		case agentMethodQueryMulti:
+			data, messages, supported, err := queryMultiStatementWithMessagesOptionalTimeout(session, req.Query, req.TimeoutMs)
+			if err != nil {
+				return fail(resp, err.Error())
+			}
+			if !supported {
+				return fail(resp, "当前事务会话不支持多结果集查询")
+			}
+			resp.Data = data
+			resp.Messages = messages
+		case agentMethodExec:
+			affected, err := execStatementWithOptionalTimeout(session, req.Query, req.TimeoutMs)
+			if err != nil {
+				return fail(resp, err.Error())
+			}
+			resp.RowsAffected = affected
+		default:
+			return fail(resp, "当前事务会话不支持该方法")
+		}
+		return resp
+	}
+
 	switch method {
 	case agentMethodPing:
-		if err := (*inst).Ping(); err != nil {
+		if err := runtimeState.inst.Ping(); err != nil {
 			return fail(resp, err.Error())
 		}
 	case agentMethodQuery:
-		data, fields, err := queryWithOptionalTimeout(*inst, req.Query, req.TimeoutMs)
+		data, fields, messages, err := queryWithMessagesOptionalTimeout(runtimeState.inst, req.Query, req.TimeoutMs)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 		resp.Fields = fields
+		resp.Messages = messages
+	case agentMethodQueryMulti:
+		data, messages, supported, err := queryMultiWithMessagesOptionalTimeout(runtimeState.inst, req.Query, req.TimeoutMs)
+		if err != nil {
+			return fail(resp, err.Error())
+		}
+		if !supported {
+			return fail(resp, "当前驱动不支持原生多结果集查询")
+		}
+		resp.Data = data
+		resp.Messages = messages
 	case agentMethodExec:
-		affected, err := execWithOptionalTimeout(*inst, req.Query, req.TimeoutMs)
+		affected, err := execWithOptionalTimeout(runtimeState.inst, req.Query, req.TimeoutMs)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.RowsAffected = affected
 	case agentMethodGetDatabases:
-		data, err := (*inst).GetDatabases()
+		data, err := runtimeState.inst.GetDatabases()
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetTables:
-		data, err := (*inst).GetTables(req.DBName)
+		data, err := runtimeState.inst.GetTables(req.DBName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetCreateStmt:
-		data, err := (*inst).GetCreateStatement(req.DBName, req.TableName)
+		data, err := runtimeState.inst.GetCreateStatement(req.DBName, req.TableName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetColumns:
-		data, err := (*inst).GetColumns(req.DBName, req.TableName)
+		data, err := runtimeState.inst.GetColumns(req.DBName, req.TableName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetAllColumns:
-		data, err := (*inst).GetAllColumns(req.DBName)
+		data, err := runtimeState.inst.GetAllColumns(req.DBName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetIndexes:
-		data, err := (*inst).GetIndexes(req.DBName, req.TableName)
+		data, err := runtimeState.inst.GetIndexes(req.DBName, req.TableName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetForeignKey:
-		data, err := (*inst).GetForeignKeys(req.DBName, req.TableName)
+		data, err := runtimeState.inst.GetForeignKeys(req.DBName, req.TableName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetTriggers:
-		data, err := (*inst).GetTriggers(req.DBName, req.TableName)
+		data, err := runtimeState.inst.GetTriggers(req.DBName, req.TableName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
@@ -207,7 +348,7 @@ func handleRequest(inst *db.Database, req agentRequest) agentResponse {
 		if req.Changes == nil {
 			return fail(resp, "变更集为空")
 		}
-		applier, ok := (*inst).(interface {
+		applier, ok := runtimeState.inst.(interface {
 			ApplyChanges(tableName string, changes connection.ChangeSet) error
 		})
 		if !ok {
@@ -223,6 +364,169 @@ func handleRequest(inst *db.Database, req agentRequest) agentResponse {
 	return resp
 }
 
+type agentStreamResponseWriter struct {
+	writer    *bufio.Writer
+	requestID int64
+	columns   []string
+	rows      [][]interface{}
+	rowCount  int64
+}
+
+func newAgentStreamResponseWriter(writer *bufio.Writer, requestID int64) *agentStreamResponseWriter {
+	return &agentStreamResponseWriter{
+		writer:    writer,
+		requestID: requestID,
+	}
+}
+
+func (w *agentStreamResponseWriter) SetColumns(columns []string) error {
+	w.columns = append([]string(nil), columns...)
+	return writeResponse(w.writer, agentResponse{
+		ID:        w.requestID,
+		Success:   true,
+		ChunkType: agentChunkColumns,
+		Fields:    w.columns,
+	})
+}
+
+func (w *agentStreamResponseWriter) ConsumeRow(row map[string]interface{}) error {
+	if len(w.columns) == 0 {
+		return fmt.Errorf("流式查询缺少列定义")
+	}
+	values := make([]interface{}, len(w.columns))
+	for idx, column := range w.columns {
+		values[idx] = row[column]
+	}
+	return w.ConsumeRowValues(values)
+}
+
+func (w *agentStreamResponseWriter) ConsumeRowValues(values []interface{}) error {
+	row := append([]interface{}(nil), values...)
+	w.rows = append(w.rows, row)
+	w.rowCount++
+	if len(w.rows) < agentStreamBatchSize {
+		return nil
+	}
+	return w.flushRows()
+}
+
+func (w *agentStreamResponseWriter) flushRows() error {
+	if len(w.rows) == 0 {
+		return nil
+	}
+	rows := w.rows
+	w.rows = nil
+	return writeResponse(w.writer, agentResponse{
+		ID:        w.requestID,
+		Success:   true,
+		ChunkType: agentChunkRows,
+		Data:      rows,
+	})
+}
+
+func (w *agentStreamResponseWriter) finish() error {
+	return w.flushRows()
+}
+
+func handleStreamRequest(runtimeState *agentRuntime, req agentRequest, writer *bufio.Writer) error {
+	resp := agentResponse{ID: req.ID, Success: true}
+	if runtimeState.inst == nil {
+		return writeResponse(writer, fail(resp, "connection not open"))
+	}
+
+	streamWriter := newAgentStreamResponseWriter(writer, req.ID)
+	if session, ok, err := runtimeState.session(req.SessionID); err != nil {
+		return writeResponse(writer, fail(resp, err.Error()))
+	} else if ok {
+		if err := streamStatementWithOptionalTimeout(session, req.Query, req.TimeoutMs, streamWriter); err != nil {
+			_ = streamWriter.finish()
+			return writeResponse(writer, fail(resp, err.Error()))
+		}
+		if err := streamWriter.finish(); err != nil {
+			return err
+		}
+		if err := writeResponse(writer, agentResponse{ID: req.ID, Success: true, ChunkType: agentChunkDone}); err != nil {
+			return err
+		}
+		maybeReleaseAgentMemory("stream-query-session", streamWriter.rowCount)
+		return nil
+	}
+
+	if err := streamDatabaseWithOptionalTimeout(runtimeState.inst, req.Query, req.TimeoutMs, streamWriter); err != nil {
+		_ = streamWriter.finish()
+		return writeResponse(writer, fail(resp, err.Error()))
+	}
+	if err := streamWriter.finish(); err != nil {
+		return err
+	}
+	if err := writeResponse(writer, agentResponse{ID: req.ID, Success: true, ChunkType: agentChunkDone}); err != nil {
+		return err
+	}
+	maybeReleaseAgentMemory("stream-query-db", streamWriter.rowCount)
+	return nil
+}
+
+func (r *agentRuntime) nextID() string {
+	r.ensureSessionMap()
+	r.nextSessionID++
+	return "session-" + strconv.FormatInt(r.nextSessionID, 10)
+}
+
+func (r *agentRuntime) session(sessionID string) (db.StatementExecer, bool, error) {
+	r.ensureSessionMap()
+	sessionID = strings.TrimSpace(sessionID)
+	if sessionID == "" {
+		return nil, false, nil
+	}
+	session, ok := r.sessions[sessionID]
+	if !ok || session == nil {
+		return nil, false, fmt.Errorf("事务会话不存在或已结束")
+	}
+	return session, true, nil
+}
+
+func (r *agentRuntime) closeSession(sessionID string) error {
+	r.ensureSessionMap()
+	sessionID = strings.TrimSpace(sessionID)
+	if sessionID == "" {
+		return fmt.Errorf("事务会话 ID 不能为空")
+	}
+	session, ok := r.sessions[sessionID]
+	if ok {
+		delete(r.sessions, sessionID)
+	}
+	if !ok || session == nil {
+		return fmt.Errorf("事务会话不存在或已结束")
+	}
+	return session.Close()
+}
+
+func (r *agentRuntime) close() error {
+	var closeErr error
+	r.ensureSessionMap()
+	for sessionID, session := range r.sessions {
+		delete(r.sessions, sessionID)
+		if session != nil {
+			if err := session.Close(); err != nil && closeErr == nil {
+				closeErr = err
+			}
+		}
+	}
+	if r.inst != nil {
+		if err := r.inst.Close(); err != nil && closeErr == nil {
+			closeErr = err
+		}
+		r.inst = nil
+	}
+	return closeErr
+}
+
+func (r *agentRuntime) ensureSessionMap() {
+	if r.sessions == nil {
+		r.sessions = make(map[string]db.StatementExecer)
+	}
+}
+
 func writeResponse(writer *bufio.Writer, resp agentResponse) error {
 	// 对响应数据做统一 JSON 安全归一化：
 	// 将 map[any]any（如 duckdb.Map）递归转换为 map[string]any，避免序列化失败导致代理进程退出。
@@ -293,25 +597,234 @@ func normalizeAgentResponseData(v interface{}) interface{} {
 	}
 }
 
-func queryWithOptionalTimeout(inst db.Database, query string, timeoutMs int64) ([]map[string]interface{}, []string, error) {
+type agentQueryRunner interface {
+	Query(string) ([]map[string]interface{}, []string, error)
+}
+
+type agentQueryContextRunner interface {
+	QueryContext(context.Context, string) ([]map[string]interface{}, []string, error)
+}
+
+type agentQueryMessageRunner interface {
+	QueryWithMessages(query string) ([]map[string]interface{}, []string, []string, error)
+}
+
+type agentQueryMessageContextRunner interface {
+	QueryContextWithMessages(context.Context, string) ([]map[string]interface{}, []string, []string, error)
+}
+
+type agentMultiResultMessageRunner interface {
+	QueryMultiWithMessages(query string) ([]connection.ResultSetData, []string, error)
+}
+
+type agentMultiResultMessageContextRunner interface {
+	QueryMultiContextWithMessages(context.Context, string) ([]connection.ResultSetData, []string, error)
+}
+
+type agentMultiResultRunner interface {
+	QueryMulti(query string) ([]connection.ResultSetData, error)
+}
+
+type agentMultiResultContextRunner interface {
+	QueryMultiContext(context.Context, string) ([]connection.ResultSetData, error)
+}
+
+type agentExecRunner interface {
+	Exec(string) (int64, error)
+}
+
+type agentExecContextRunner interface {
+	ExecContext(context.Context, string) (int64, error)
+}
+
+func queryWithMessagesOptionalTimeout(inst agentQueryRunner, query string, timeoutMs int64) ([]map[string]interface{}, []string, []string, error) {
 	effectiveTimeoutMs := timeoutMs
 	if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
 		effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
 	}
 	if effectiveTimeoutMs <= 0 {
-		return inst.Query(query)
+		if q, ok := inst.(agentQueryMessageRunner); ok {
+			return q.QueryWithMessages(query)
+		}
+		data, fields, err := inst.Query(query)
+		return data, fields, nil, err
 	}
-	if q, ok := inst.(interface {
-		QueryContext(context.Context, string) ([]map[string]interface{}, []string, error)
-	}); ok {
+	if q, ok := inst.(agentQueryMessageContextRunner); ok {
 		ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
 		defer cancel()
-		return q.QueryContext(ctx, query)
+		return q.QueryContextWithMessages(ctx, query)
 	}
-	return inst.Query(query)
+	if q, ok := inst.(agentQueryContextRunner); ok {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+		defer cancel()
+		data, fields, err := q.QueryContext(ctx, query)
+		return data, fields, nil, err
+	}
+	if q, ok := inst.(agentQueryMessageRunner); ok {
+		return q.QueryWithMessages(query)
+	}
+	data, fields, err := inst.Query(query)
+	return data, fields, nil, err
 }
 
-func execWithOptionalTimeout(inst db.Database, query string, timeoutMs int64) (int64, error) {
+func queryWithOptionalTimeout(inst agentQueryRunner, query string, timeoutMs int64) ([]map[string]interface{}, []string, error) {
+	data, fields, _, err := queryWithMessagesOptionalTimeout(inst, query, timeoutMs)
+	return data, fields, err
+}
+
+func queryStatementWithOptionalTimeout(inst db.StatementExecer, query string, timeoutMs int64) ([]map[string]interface{}, []string, error) {
+	queryRunner, ok := inst.(agentQueryRunner)
+	if !ok {
+		return nil, nil, fmt.Errorf("当前事务会话不支持查询语句")
+	}
+	return queryWithOptionalTimeout(queryRunner, query, timeoutMs)
+}
+
+func queryStatementWithMessagesOptionalTimeout(inst db.StatementExecer, query string, timeoutMs int64) ([]map[string]interface{}, []string, []string, error) {
+	queryRunner, ok := inst.(agentQueryRunner)
+	if !ok {
+		return nil, nil, nil, fmt.Errorf("当前事务会话不支持查询语句")
+	}
+	return queryWithMessagesOptionalTimeout(queryRunner, query, timeoutMs)
+}
+
+func queryMultiWithMessagesOptionalTimeout(inst db.Database, query string, timeoutMs int64) ([]connection.ResultSetData, []string, bool, error) {
+	effectiveTimeoutMs := timeoutMs
+	if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
+		effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
+	}
+	if effectiveTimeoutMs > 0 {
+		if q, ok := inst.(agentMultiResultMessageContextRunner); ok {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+			defer cancel()
+			data, messages, err := q.QueryMultiContextWithMessages(ctx, query)
+			return data, messages, true, err
+		}
+		if q, ok := inst.(agentMultiResultContextRunner); ok {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+			defer cancel()
+			data, err := q.QueryMultiContext(ctx, query)
+			return data, nil, true, err
+		}
+	}
+	if q, ok := inst.(agentMultiResultMessageRunner); ok {
+		data, messages, err := q.QueryMultiWithMessages(query)
+		return data, messages, true, err
+	}
+	if q, ok := inst.(agentMultiResultRunner); ok {
+		data, err := q.QueryMulti(query)
+		return data, nil, true, err
+	}
+	return nil, nil, false, nil
+}
+
+func queryMultiStatementWithMessagesOptionalTimeout(inst db.StatementExecer, query string, timeoutMs int64) ([]connection.ResultSetData, []string, bool, error) {
+	effectiveTimeoutMs := timeoutMs
+	if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
+		effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
+	}
+	if effectiveTimeoutMs > 0 {
+		if q, ok := inst.(agentMultiResultMessageContextRunner); ok {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+			defer cancel()
+			data, messages, err := q.QueryMultiContextWithMessages(ctx, query)
+			return data, messages, true, err
+		}
+		if q, ok := inst.(agentMultiResultContextRunner); ok {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+			defer cancel()
+			data, err := q.QueryMultiContext(ctx, query)
+			return data, nil, true, err
+		}
+	}
+	if q, ok := inst.(agentMultiResultMessageRunner); ok {
+		data, messages, err := q.QueryMultiWithMessages(query)
+		return data, messages, true, err
+	}
+	if q, ok := inst.(agentMultiResultRunner); ok {
+		data, err := q.QueryMulti(query)
+		return data, nil, true, err
+	}
+	return nil, nil, false, nil
+}
+
+func streamWithOptionalTimeout(inst db.StreamQueryExecer, query string, timeoutMs int64, consumer db.QueryStreamConsumer) error {
+	effectiveTimeoutMs := timeoutMs
+	if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
+		effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
+	}
+	if effectiveTimeoutMs <= 0 {
+		return inst.StreamQuery(query, consumer)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+	defer cancel()
+	return inst.StreamQueryContext(ctx, query, consumer)
+}
+
+func streamBufferedQueryResult(fields []string, data []map[string]interface{}, consumer db.QueryStreamConsumer) error {
+	if err := consumer.SetColumns(fields); err != nil {
+		return err
+	}
+	if valueConsumer, ok := consumer.(db.QueryStreamValueConsumer); ok {
+		for _, row := range data {
+			values := make([]interface{}, len(fields))
+			for idx, field := range fields {
+				values[idx] = row[field]
+			}
+			if err := valueConsumer.ConsumeRowValues(values); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+	for _, row := range data {
+		if err := consumer.ConsumeRow(row); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func streamStatementWithOptionalTimeout(inst db.StatementExecer, query string, timeoutMs int64, consumer db.QueryStreamConsumer) error {
+	if streamer, ok := inst.(db.StreamQueryExecer); ok {
+		return streamWithOptionalTimeout(streamer, query, timeoutMs, consumer)
+	}
+	data, fields, err := queryStatementWithOptionalTimeout(inst, query, timeoutMs)
+	if err != nil {
+		return err
+	}
+	return streamBufferedQueryResult(fields, data, consumer)
+}
+
+func streamDatabaseWithOptionalTimeout(inst db.Database, query string, timeoutMs int64, consumer db.QueryStreamConsumer) error {
+	if streamer, ok := inst.(db.StreamQueryExecer); ok {
+		return streamWithOptionalTimeout(streamer, query, timeoutMs, consumer)
+	}
+	if provider, ok := inst.(db.SessionExecerProvider); ok {
+		openCtx := context.Background()
+		var cancel context.CancelFunc
+		effectiveTimeoutMs := timeoutMs
+		if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
+			effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
+		}
+		if effectiveTimeoutMs > 0 {
+			openCtx, cancel = context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+			defer cancel()
+		}
+		session, err := provider.OpenSessionExecer(openCtx)
+		if err == nil {
+			defer session.Close()
+			return streamStatementWithOptionalTimeout(session, query, timeoutMs, consumer)
+		}
+	}
+	data, fields, err := queryWithOptionalTimeout(inst, query, timeoutMs)
+	if err != nil {
+		return err
+	}
+	return streamBufferedQueryResult(fields, data, consumer)
+}
+
+func execWithOptionalTimeout(inst agentExecRunner, query string, timeoutMs int64) (int64, error) {
 	effectiveTimeoutMs := timeoutMs
 	if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
 		effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
@@ -319,12 +832,52 @@ func execWithOptionalTimeout(inst db.Database, query string, timeoutMs int64) (i
 	if effectiveTimeoutMs <= 0 {
 		return inst.Exec(query)
 	}
-	if e, ok := inst.(interface {
-		ExecContext(context.Context, string) (int64, error)
-	}); ok {
+	if e, ok := inst.(agentExecContextRunner); ok {
 		ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
 		defer cancel()
 		return e.ExecContext(ctx, query)
 	}
 	return inst.Exec(query)
 }
+
+func execStatementWithOptionalTimeout(inst db.StatementExecer, query string, timeoutMs int64) (int64, error) {
+	return execWithOptionalTimeout(inst, query, timeoutMs)
+}
+
+func countAgentResponseRows(data interface{}) int64 {
+	rows, ok := data.([]map[string]interface{})
+	if !ok {
+		return 0
+	}
+	return int64(len(rows))
+}
+
+func maybeReleaseAgentMemory(reason string, rows int64) {
+	if rows < agentMemoryTrimRowsThreshold {
+		return
+	}
+	if !agentMemoryTrimRunning.CompareAndSwap(false, true) {
+		return
+	}
+
+	runAgentMemoryTrimAsync(func() {
+		defer agentMemoryTrimRunning.Store(false)
+		if delay := nextAgentMemoryTrimDelay(); delay > 0 {
+			time.Sleep(delay)
+		}
+		agentMemoryTrimFn()
+		agentMemoryTrimLastAt.Store(time.Now().UnixNano())
+	})
+}
+
+func nextAgentMemoryTrimDelay() time.Duration {
+	lastUnixNano := agentMemoryTrimLastAt.Load()
+	if lastUnixNano <= 0 {
+		return 0
+	}
+	elapsed := time.Since(time.Unix(0, lastUnixNano))
+	if elapsed >= agentMemoryTrimMinInterval {
+		return 0
+	}
+	return agentMemoryTrimMinInterval - elapsed
+}

cmd/optional-driver-agent/main_test.go

@@ -6,10 +6,12 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"strings"
 	"testing"
 	"time"
 
 	"GoNavi-Wails/internal/connection"
+	"GoNavi-Wails/internal/db"
 )
 
 type duckMapLike map[any]any
@@ -66,12 +68,42 @@ func TestNormalizeAgentResponseData_KeepByteSlice(t *testing.T) {
 	}
 }
 
+func TestHandleRequestMetadataReportsAgentRevision(t *testing.T) {
+	previousDriverType := agentDriverType
+	previousFactory := agentDatabaseFactory
+	t.Cleanup(func() {
+		agentDriverType = previousDriverType
+		agentDatabaseFactory = previousFactory
+	})
+	agentDriverType = "clickhouse"
+	agentDatabaseFactory = func() db.Database { return nil }
+
+	runtimeState := &agentRuntime{sessions: make(map[string]db.StatementExecer)}
+	resp := handleRequest(runtimeState, agentRequest{ID: 7, Method: agentMethodMetadata})
+	if !resp.Success {
+		t.Fatalf("metadata request failed: %s", resp.Error)
+	}
+	data, ok := resp.Data.(map[string]string)
+	if !ok {
+		t.Fatalf("metadata response data type = %T", resp.Data)
+	}
+	if data["driverType"] != "clickhouse" {
+		t.Fatalf("unexpected driver type: %q", data["driverType"])
+	}
+	if data["agentRevision"] != db.OptionalDriverAgentRevision("clickhouse") {
+		t.Fatalf("unexpected agent revision: %q", data["agentRevision"])
+	}
+}
+
 type fakeAgentTimeoutDB struct {
 	queryCalled        bool
 	queryContextCalled bool
 	execCalled         bool
 	execContextCalled  bool
 	deadlineSet        bool
+	queryMessages      []string
+	multiResults       []connection.ResultSetData
+	multiMessages      []string
 }
 
 func (f *fakeAgentTimeoutDB) Connect(config connection.ConnectionConfig) error { return nil }
@@ -88,6 +120,14 @@ func (f *fakeAgentTimeoutDB) QueryContext(ctx context.Context, query string) ([]
 	}
 	return []map[string]interface{}{{"ok": 1}}, []string{"ok"}, nil
 }
+func (f *fakeAgentTimeoutDB) QueryWithMessages(query string) ([]map[string]interface{}, []string, []string, error) {
+	data, fields, err := f.QueryContext(context.Background(), query)
+	return data, fields, append([]string(nil), f.queryMessages...), err
+}
+func (f *fakeAgentTimeoutDB) QueryContextWithMessages(ctx context.Context, query string) ([]map[string]interface{}, []string, []string, error) {
+	data, fields, err := f.QueryContext(ctx, query)
+	return data, fields, append([]string(nil), f.queryMessages...), err
+}
 func (f *fakeAgentTimeoutDB) Exec(query string) (int64, error) {
 	f.execCalled = true
 	return 0, errors.New("exec should not be called")
@@ -121,6 +161,121 @@ func (f *fakeAgentTimeoutDB) GetForeignKeys(dbName, tableName string) ([]connect
 func (f *fakeAgentTimeoutDB) GetTriggers(dbName, tableName string) ([]connection.TriggerDefinition, error) {
 	return nil, nil
 }
+func (f *fakeAgentTimeoutDB) QueryMultiWithMessages(query string) ([]connection.ResultSetData, []string, error) {
+	return append([]connection.ResultSetData(nil), f.multiResults...), append([]string(nil), f.multiMessages...), nil
+}
+func (f *fakeAgentTimeoutDB) QueryMultiContextWithMessages(ctx context.Context, query string) ([]connection.ResultSetData, []string, error) {
+	if _, ok := ctx.Deadline(); ok {
+		f.deadlineSet = true
+	}
+	return f.QueryMultiWithMessages(query)
+}
+
+type fakeAgentSessionDB struct {
+	fakeAgentTimeoutDB
+	session *fakeAgentStatementSession
+}
+
+func (f *fakeAgentSessionDB) OpenSessionExecer(ctx context.Context) (db.StatementExecer, error) {
+	f.session = &fakeAgentStatementSession{}
+	return f.session, nil
+}
+
+type fakeAgentStatementSession struct {
+	queryCalls int
+	execCalls  int
+	closed     bool
+	messages   []string
+}
+
+func (f *fakeAgentStatementSession) Query(query string) ([]map[string]interface{}, []string, error) {
+	return f.QueryContext(context.Background(), query)
+}
+
+func (f *fakeAgentStatementSession) QueryContext(ctx context.Context, query string) ([]map[string]interface{}, []string, error) {
+	f.queryCalls++
+	return []map[string]interface{}{{"session_ok": 1}}, []string{"session_ok"}, nil
+}
+func (f *fakeAgentStatementSession) QueryWithMessages(query string) ([]map[string]interface{}, []string, []string, error) {
+	data, fields, err := f.QueryContext(context.Background(), query)
+	return data, fields, append([]string(nil), f.messages...), err
+}
+func (f *fakeAgentStatementSession) QueryContextWithMessages(ctx context.Context, query string) ([]map[string]interface{}, []string, []string, error) {
+	data, fields, err := f.QueryContext(ctx, query)
+	return data, fields, append([]string(nil), f.messages...), err
+}
+
+func (f *fakeAgentStatementSession) Exec(query string) (int64, error) {
+	return f.ExecContext(context.Background(), query)
+}
+
+func (f *fakeAgentStatementSession) ExecContext(ctx context.Context, query string) (int64, error) {
+	f.execCalls++
+	return 9, nil
+}
+
+func (f *fakeAgentStatementSession) Close() error {
+	f.closed = true
+	return nil
+}
+
+type fakeAgentStreamSession struct {
+	closed      bool
+	streamCalls int
+	deadlineSet bool
+}
+
+func (f *fakeAgentStreamSession) Exec(query string) (int64, error) {
+	return 0, nil
+}
+
+func (f *fakeAgentStreamSession) ExecContext(ctx context.Context, query string) (int64, error) {
+	return 0, nil
+}
+
+func (f *fakeAgentStreamSession) Close() error {
+	f.closed = true
+	return nil
+}
+
+func (f *fakeAgentStreamSession) StreamQuery(query string, consumer db.QueryStreamConsumer) error {
+	return f.StreamQueryContext(context.Background(), query, consumer)
+}
+
+func (f *fakeAgentStreamSession) StreamQueryContext(ctx context.Context, query string, consumer db.QueryStreamConsumer) error {
+	f.streamCalls++
+	if _, ok := ctx.Deadline(); ok {
+		f.deadlineSet = true
+	}
+	if err := consumer.SetColumns([]string{"id", "name"}); err != nil {
+		return err
+	}
+	if valueConsumer, ok := consumer.(db.QueryStreamValueConsumer); ok {
+		if err := valueConsumer.ConsumeRowValues([]interface{}{1, "alice"}); err != nil {
+			return err
+		}
+		if err := valueConsumer.ConsumeRowValues([]interface{}{2, "bob"}); err != nil {
+			return err
+		}
+		return nil
+	}
+	if err := consumer.ConsumeRow(map[string]interface{}{"id": 1, "name": "alice"}); err != nil {
+		return err
+	}
+	return consumer.ConsumeRow(map[string]interface{}{"id": 2, "name": "bob"})
+}
+
+type fakeAgentSessionStreamDB struct {
+	fakeAgentTimeoutDB
+	session   *fakeAgentStreamSession
+	openCalls int
+}
+
+func (f *fakeAgentSessionStreamDB) OpenSessionExecer(ctx context.Context) (db.StatementExecer, error) {
+	f.openCalls++
+	f.session = &fakeAgentStreamSession{}
+	return f.session, nil
+}
 
 func TestQueryWithOptionalTimeout_UsesQueryContext(t *testing.T) {
 	fake := &fakeAgentTimeoutDB{}
@@ -170,3 +325,277 @@ func TestQueryWithOptionalTimeout_ClickHouseLegacyModeUsesQueryContext(t *testin
 		t.Fatalf("clickhouse legacy query 调用路径异常，QueryContext=%v Query=%v", fake.queryContextCalled, fake.queryCalled)
 	}
 }
+
+func TestHandleRequest_QueryIncludesServerMessages(t *testing.T) {
+	old := agentDriverType
+	defer func() { agentDriverType = old }()
+	agentDriverType = "sqlserver"
+
+	fake := &fakeAgentTimeoutDB{
+		queryMessages: []string{"PRINT sql line 1", "PRINT sql line 2"},
+	}
+	runtimeState := &agentRuntime{inst: fake, sessions: make(map[string]db.StatementExecer)}
+
+	resp := handleRequest(runtimeState, agentRequest{
+		ID:        11,
+		Method:    agentMethodQuery,
+		Query:     "exec dbo.p_get_select",
+		TimeoutMs: int64((2 * time.Second).Milliseconds()),
+	})
+	if !resp.Success {
+		t.Fatalf("query request failed: %s", resp.Error)
+	}
+	if len(resp.Messages) != 2 || resp.Messages[0] != "PRINT sql line 1" {
+		t.Fatalf("expected query messages to be preserved, got %#v", resp.Messages)
+	}
+}
+
+func TestHandleRequest_QueryMultiIncludesResultSetsAndMessages(t *testing.T) {
+	old := agentDriverType
+	defer func() { agentDriverType = old }()
+	agentDriverType = "sqlserver"
+
+	fake := &fakeAgentTimeoutDB{
+		multiResults: []connection.ResultSetData{
+			{
+				StatementIndex: 1,
+				Rows:           []map[string]interface{}{{"name": "master"}},
+				Columns:        []string{"name"},
+			},
+			{
+				StatementIndex: 1,
+				Rows:           []map[string]interface{}{},
+				Columns:        []string{},
+				Messages:       []string{"PRINT generated sql"},
+			},
+		},
+		multiMessages: []string{"batch top-level message"},
+	}
+	runtimeState := &agentRuntime{inst: fake, sessions: make(map[string]db.StatementExecer)}
+
+	resp := handleRequest(runtimeState, agentRequest{
+		ID:        12,
+		Method:    agentMethodQueryMulti,
+		Query:     "exec dbo.p_get_select",
+		TimeoutMs: int64((2 * time.Second).Milliseconds()),
+	})
+	if !resp.Success {
+		t.Fatalf("queryMulti request failed: %s", resp.Error)
+	}
+	if len(resp.Messages) != 1 || resp.Messages[0] != "batch top-level message" {
+		t.Fatalf("expected top-level messages to be preserved, got %#v", resp.Messages)
+	}
+	resultSets, ok := resp.Data.([]connection.ResultSetData)
+	if !ok {
+		t.Fatalf("expected []connection.ResultSetData, got %T", resp.Data)
+	}
+	if len(resultSets) != 2 {
+		t.Fatalf("expected 2 result sets, got %#v", resultSets)
+	}
+	if len(resultSets[1].Messages) != 1 || resultSets[1].Messages[0] != "PRINT generated sql" {
+		t.Fatalf("expected message-only result set to be preserved, got %#v", resultSets[1])
+	}
+}
+
+func TestHandleRequest_UsesPinnedSessionForSessionScopedQueryAndExec(t *testing.T) {
+	old := agentDriverType
+	defer func() { agentDriverType = old }()
+	agentDriverType = "sqlserver"
+
+	fake := &fakeAgentSessionDB{}
+	runtimeState := &agentRuntime{
+		inst:     fake,
+		sessions: make(map[string]db.StatementExecer),
+	}
+
+	openResp := handleRequest(runtimeState, agentRequest{ID: 1, Method: agentMethodOpenSession})
+	if !openResp.Success {
+		t.Fatalf("openSession failed: %s", openResp.Error)
+	}
+	sessionID, ok := openResp.Data.(string)
+	if !ok || strings.TrimSpace(sessionID) == "" {
+		t.Fatalf("unexpected session id payload: %#v", openResp.Data)
+	}
+	if fake.session == nil {
+		t.Fatal("expected OpenSessionExecer to create a pinned session")
+	}
+
+	queryResp := handleRequest(runtimeState, agentRequest{
+		ID:        2,
+		Method:    agentMethodQuery,
+		SessionID: sessionID,
+		Query:     "SELECT 1",
+	})
+	if !queryResp.Success {
+		t.Fatalf("session query failed: %s", queryResp.Error)
+	}
+	if len(queryResp.Messages) != 0 {
+		t.Fatalf("expected empty default session messages, got %#v", queryResp.Messages)
+	}
+	if fake.queryCalled || fake.queryContextCalled {
+		t.Fatalf("expected session query to bypass database-level query path, got Query=%v QueryContext=%v", fake.queryCalled, fake.queryContextCalled)
+	}
+	if fake.session.queryCalls != 1 {
+		t.Fatalf("expected pinned session queryCalls=1, got %d", fake.session.queryCalls)
+	}
+
+	execResp := handleRequest(runtimeState, agentRequest{
+		ID:        3,
+		Method:    agentMethodExec,
+		SessionID: sessionID,
+		Query:     "UPDATE t SET v = 1",
+	})
+	if !execResp.Success {
+		t.Fatalf("session exec failed: %s", execResp.Error)
+	}
+	if fake.execCalled || fake.execContextCalled {
+		t.Fatalf("expected session exec to bypass database-level exec path, got Exec=%v ExecContext=%v", fake.execCalled, fake.execContextCalled)
+	}
+	if fake.session.execCalls != 1 {
+		t.Fatalf("expected pinned session execCalls=1, got %d", fake.session.execCalls)
+	}
+
+	closeResp := handleRequest(runtimeState, agentRequest{
+		ID:        4,
+		Method:    agentMethodCloseSession,
+		SessionID: sessionID,
+	})
+	if !closeResp.Success {
+		t.Fatalf("closeSession failed: %s", closeResp.Error)
+	}
+	if !fake.session.closed {
+		t.Fatal("expected pinned session to close")
+	}
+}
+
+func TestHandleStreamRequest_UsesSessionStreamerAndWritesChunks(t *testing.T) {
+	old := agentDriverType
+	originalAsync := runAgentMemoryTrimAsync
+	originalTrim := agentMemoryTrimFn
+	originalLastAt := agentMemoryTrimLastAt.Load()
+	defer func() { agentDriverType = old }()
+	defer func() {
+		runAgentMemoryTrimAsync = originalAsync
+		agentMemoryTrimFn = originalTrim
+		agentMemoryTrimRunning.Store(false)
+		agentMemoryTrimLastAt.Store(originalLastAt)
+	}()
+	agentDriverType = "oceanbase"
+	agentMemoryTrimRunning.Store(false)
+	agentMemoryTrimLastAt.Store(0)
+
+	fake := &fakeAgentSessionStreamDB{}
+	runtimeState := &agentRuntime{
+		inst:     fake,
+		sessions: make(map[string]db.StatementExecer),
+	}
+
+	trimmed := 0
+	runAgentMemoryTrimAsync = func(fn func()) {
+		fn()
+	}
+	agentMemoryTrimFn = func() {
+		trimmed++
+	}
+
+	var out bytes.Buffer
+	writer := bufio.NewWriter(&out)
+	if err := handleStreamRequest(runtimeState, agentRequest{
+		ID:        9,
+		Method:    agentMethodStreamQuery,
+		Query:     "SELECT * FROM person_info",
+		TimeoutMs: int64((2 * time.Second).Milliseconds()),
+	}, writer); err != nil {
+		t.Fatalf("handleStreamRequest 返回错误: %v", err)
+	}
+
+	if fake.openCalls != 1 {
+		t.Fatalf("expected OpenSessionExecer called once, got %d", fake.openCalls)
+	}
+	if fake.session == nil || fake.session.streamCalls != 1 {
+		t.Fatalf("expected session streamer used once, session=%#v", fake.session)
+	}
+	if !fake.session.deadlineSet {
+		t.Fatal("expected stream query context deadline to be set")
+	}
+	if !fake.session.closed {
+		t.Fatal("expected session to close after streaming")
+	}
+	if fake.queryCalled || fake.queryContextCalled {
+		t.Fatalf("unexpected fallback query path, Query=%v QueryContext=%v", fake.queryCalled, fake.queryContextCalled)
+	}
+
+	lines := strings.Split(strings.TrimSpace(out.String()), "\n")
+	if len(lines) != 3 {
+		t.Fatalf("expected 3 stream responses, got %d: %q", len(lines), out.String())
+	}
+
+	var columnsResp struct {
+		Success   bool     `json:"success"`
+		ChunkType string   `json:"chunkType"`
+		Fields    []string `json:"fields"`
+	}
+	if err := json.Unmarshal([]byte(lines[0]), &columnsResp); err != nil {
+		t.Fatalf("decode columns response failed: %v", err)
+	}
+	if !columnsResp.Success || columnsResp.ChunkType != agentChunkColumns || len(columnsResp.Fields) != 2 {
+		t.Fatalf("unexpected columns response: %#v", columnsResp)
+	}
+
+	var rowsResp struct {
+		Success   bool            `json:"success"`
+		ChunkType string          `json:"chunkType"`
+		Data      [][]interface{} `json:"data"`
+	}
+	if err := json.Unmarshal([]byte(lines[1]), &rowsResp); err != nil {
+		t.Fatalf("decode rows response failed: %v", err)
+	}
+	if !rowsResp.Success || rowsResp.ChunkType != agentChunkRows || len(rowsResp.Data) != 2 {
+		t.Fatalf("unexpected rows response: %#v", rowsResp)
+	}
+	if got := rowsResp.Data[1][1]; got != "bob" {
+		t.Fatalf("unexpected streamed row payload: %v", rowsResp.Data)
+	}
+
+	var doneResp struct {
+		Success   bool   `json:"success"`
+		ChunkType string `json:"chunkType"`
+	}
+	if err := json.Unmarshal([]byte(lines[2]), &doneResp); err != nil {
+		t.Fatalf("decode done response failed: %v", err)
+	}
+	if !doneResp.Success || doneResp.ChunkType != agentChunkDone {
+		t.Fatalf("unexpected done response: %#v", doneResp)
+	}
+	if trimmed != 0 {
+		t.Fatalf("小流式任务不应触发内存回收，got=%d", trimmed)
+	}
+}
+
+func TestMaybeReleaseAgentMemory_TriggersTrimForLargeJobs(t *testing.T) {
+	originalAsync := runAgentMemoryTrimAsync
+	originalTrim := agentMemoryTrimFn
+	originalLastAt := agentMemoryTrimLastAt.Load()
+	t.Cleanup(func() {
+		runAgentMemoryTrimAsync = originalAsync
+		agentMemoryTrimFn = originalTrim
+		agentMemoryTrimRunning.Store(false)
+		agentMemoryTrimLastAt.Store(originalLastAt)
+	})
+
+	agentMemoryTrimRunning.Store(false)
+	agentMemoryTrimLastAt.Store(0)
+	triggered := 0
+	runAgentMemoryTrimAsync = func(fn func()) {
+		fn()
+	}
+	agentMemoryTrimFn = func() {
+		triggered++
+	}
+
+	maybeReleaseAgentMemory("test-large-query", agentMemoryTrimRowsThreshold)
+
+	if triggered != 1 {
+		t.Fatalf("大查询完成后应触发一次内存回收，got=%d", triggered)
+	}
+}

cmd/optional-driver-agent/provider_elasticsearch.go

@@ -0,0 +1,12 @@
+//go:build gonavi_elasticsearch_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "elasticsearch"
+	agentDatabaseFactory = func() db.Database {
+		return &db.ElasticsearchDB{}
+	}
+}

cmd/optional-driver-agent/provider_gaussdb.go

@@ -0,0 +1,12 @@
+//go:build gonavi_gaussdb_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "gaussdb"
+	agentDatabaseFactory = func() db.Database {
+		return &db.GaussDB{}
+	}
+}

cmd/optional-driver-agent/provider_iotdb.go

@@ -0,0 +1,12 @@
+//go:build gonavi_iotdb_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "iotdb"
+	agentDatabaseFactory = func() db.Database {
+		return &db.IoTDBDB{}
+	}
+}

cmd/optional-driver-agent/provider_iris.go

@@ -0,0 +1,12 @@
+//go:build gonavi_iris_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "iris"
+	agentDatabaseFactory = func() db.Database {
+		return &db.IrisDB{}
+	}
+}

cmd/optional-driver-agent/provider_oceanbase.go

@@ -0,0 +1,12 @@
+//go:build gonavi_oceanbase_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "oceanbase"
+	agentDatabaseFactory = func() db.Database {
+		return &db.OceanBaseDB{}
+	}
+}

cmd/optional-driver-agent/provider_opengauss.go

@@ -0,0 +1,12 @@
+//go:build gonavi_opengauss_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "opengauss"
+	agentDatabaseFactory = func() db.Database {
+		return &db.OpenGaussDB{}
+	}
+}

cmd/optional-driver-agent/provider_starrocks.go

@@ -0,0 +1,12 @@
+//go:build gonavi_starrocks_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "starrocks"
+	agentDatabaseFactory = func() db.Database {
+		return &db.StarRocksDB{}
+	}
+}

cmd/optional-driver-agent/provider_trino.go

@@ -0,0 +1,12 @@
+//go:build gonavi_trino_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "trino"
+	agentDatabaseFactory = func() db.Database {
+		return &db.TrinoDB{}
+	}
+}

deploy/helm/gonavi-mcp-server/Chart.yaml

@@ -0,0 +1,7 @@
+apiVersion: v2
+name: gonavi-mcp-server
+description: Helm chart for deploying GoNavi MCP Server
+type: application
+version: 0.1.0
+appVersion: "latest"
+kubeVersion: ">=1.24.0-0"

deploy/helm/gonavi-mcp-server/README.md

@@ -0,0 +1,94 @@
+# GoNavi MCP Server Helm Chart
+
+这个 Chart 用来部署 `gonavi-mcp-server`，覆盖当前仓库 K8s 示例里的几类常见场景：
+
+- 基于现有 Secret 直接部署
+- 通过 Helm values 内联创建测试用 Secret
+- 启用 Ingress
+- 追加 `drivers/` PVC
+- NAS / k3s 单机节点直接挂宿主机数据目录
+
+Chart 目录：
+
+- `Chart.yaml`
+- `values.yaml`
+- `values-examples/*.yaml`
+- `templates/*.yaml`
+
+## 1. 默认安装
+
+默认值假设你已经有一个现成 Secret：
+
+- 名称：`gonavi-mcp-server-data`
+- 至少包含：
+  - `connections.json`
+  - `daily_secrets.json`
+  - `GONAVI_MCP_HTTP_TOKEN`
+
+安装命令：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server -n gonavi --create-namespace
+```
+
+## 2. 直接创建测试用 Secret
+
+如果只是本地验证模板或快速试跑，可以使用示例 values：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server \
+  -n gonavi --create-namespace \
+  -f deploy/helm/gonavi-mcp-server/values-examples/inline-secret.yaml
+```
+
+这个示例只适合最小联调，不适合真实生产连接数据。
+
+## 3. 常用示例
+
+启用 Ingress：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server \
+  -n gonavi --create-namespace \
+  -f deploy/helm/gonavi-mcp-server/values-examples/ingress.yaml
+```
+
+挂载 drivers PVC：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server \
+  -n gonavi --create-namespace \
+  -f deploy/helm/gonavi-mcp-server/values-examples/drivers-pvc.yaml
+```
+
+同时启用 Ingress 与 drivers PVC：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server \
+  -n gonavi --create-namespace \
+  -f deploy/helm/gonavi-mcp-server/values-examples/ingress-with-drivers-pvc.yaml
+```
+
+NAS / k3s hostPath：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server \
+  -n gonavi --create-namespace \
+  -f deploy/helm/gonavi-mcp-server/values-examples/nas-hostpath.yaml
+```
+
+## 4. 关键参数
+
+- `image.repository` / `image.tag`
+- `secret.create`
+- `secret.name`
+- `data.mode=secret|hostPath|pvc`
+- `drivers.mode=none|pvc|hostPath`
+- `ingress.enabled`
+
+## 5. 约束
+
+- `data.mode=secret` 时，Secret 必须能提供 `connections.json` 和 `daily_secrets.json`
+- `data.mode=hostPath` 时，宿主机目录需要包含 GoNavi 活动数据目录内容
+- `drivers.mode!=none` 时，会在 `/data/drivers` 追加独立挂载
+- Chart 默认只部署 MCP Server，不部署桌面 GUI

deploy/helm/gonavi-mcp-server/templates/_helpers.tpl

@@ -0,0 +1,49 @@
+{{- define "gonavi-mcp-server.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := include "gonavi-mcp-server.name" . -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" -}}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.labels" -}}
+helm.sh/chart: {{ include "gonavi-mcp-server.chart" . }}
+app.kubernetes.io/name: {{ include "gonavi-mcp-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "gonavi-mcp-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.namespace" -}}
+{{- default .Release.Namespace .Values.namespaceOverride -}}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.secretName" -}}
+{{- if .Values.secret.name -}}
+{{- .Values.secret.name -}}
+{{- else -}}
+{{- include "gonavi-mcp-server.fullname" . -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.serviceName" -}}
+{{- include "gonavi-mcp-server.fullname" . -}}
+{{- end -}}

deploy/helm/gonavi-mcp-server/templates/deployment.yaml

@@ -0,0 +1,130 @@
+{{- $dataMode := .Values.data.mode -}}
+{{- $driversMode := .Values.drivers.mode -}}
+{{- if not (or (eq $dataMode "secret") (eq $dataMode "hostPath") (eq $dataMode "pvc")) -}}
+{{- fail "data.mode must be one of: secret, hostPath, pvc" -}}
+{{- end -}}
+{{- if not (or (eq $driversMode "none") (eq $driversMode "pvc") (eq $driversMode "hostPath")) -}}
+{{- fail "drivers.mode must be one of: none, pvc, hostPath" -}}
+{{- end -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "gonavi-mcp-server.fullname" . }}
+  namespace: {{ include "gonavi-mcp-server.namespace" . }}
+  labels:
+    {{- include "gonavi-mcp-server.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "gonavi-mcp-server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "gonavi-mcp-server.selectorLabels" . | nindent 8 }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: gonavi-mcp-server
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            - http
+            {{- range .Values.mcp.extraArgs }}
+            - {{ . | quote }}
+            {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          env:
+            - name: GONAVI_DATA_ROOT
+              value: {{ .Values.mcp.dataRoot | quote }}
+            - name: GONAVI_LOG_DIR
+              value: {{ .Values.mcp.logDir | quote }}
+            - name: GONAVI_MCP_HTTP_ADDR
+              value: {{ .Values.mcp.httpAddr | quote }}
+            - name: GONAVI_MCP_HTTP_PATH
+              value: {{ .Values.mcp.httpPath | quote }}
+            - name: GONAVI_MCP_SCHEMA_ONLY
+              value: {{ ternary "true" "false" .Values.mcp.schemaOnly | quote }}
+            - name: GONAVI_MCP_HTTP_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "gonavi-mcp-server.secretName" . }}
+                  key: {{ .Values.secret.tokenKey }}
+            {{- with .Values.mcp.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          volumeMounts:
+            - name: gonavi-data
+              mountPath: {{ .Values.data.mountPath | quote }}
+              readOnly: true
+            {{- if ne $driversMode "none" }}
+            - name: gonavi-drivers
+              mountPath: {{ .Values.drivers.mountPath | quote }}
+              readOnly: true
+            {{- end }}
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 20
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+      volumes:
+        - name: gonavi-data
+          {{- if eq $dataMode "secret" }}
+          projected:
+            sources:
+              - secret:
+                  name: {{ include "gonavi-mcp-server.secretName" . }}
+                  items:
+                    - key: {{ .Values.secret.connectionsJsonKey }}
+                      path: connections.json
+                    - key: {{ .Values.secret.dailySecretsJsonKey }}
+                      path: daily_secrets.json
+          {{- else if eq $dataMode "hostPath" }}
+          hostPath:
+            path: {{ required "data.hostPath.path is required when data.mode=hostPath" .Values.data.hostPath.path | quote }}
+            type: {{ default "Directory" .Values.data.hostPath.type | quote }}
+          {{- else if eq $dataMode "pvc" }}
+          persistentVolumeClaim:
+            claimName: {{ required "data.pvc.claimName is required when data.mode=pvc" .Values.data.pvc.claimName | quote }}
+          {{- end }}
+        {{- if eq $driversMode "pvc" }}
+        - name: gonavi-drivers
+          persistentVolumeClaim:
+            claimName: {{ required "drivers.pvc.claimName is required when drivers.mode=pvc" .Values.drivers.pvc.claimName | quote }}
+        {{- else if eq $driversMode "hostPath" }}
+        - name: gonavi-drivers
+          hostPath:
+            path: {{ required "drivers.hostPath.path is required when drivers.mode=hostPath" .Values.drivers.hostPath.path | quote }}
+            type: {{ default "Directory" .Values.drivers.hostPath.type | quote }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

deploy/helm/gonavi-mcp-server/templates/ingress.yaml

@@ -0,0 +1,34 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "gonavi-mcp-server.fullname" . }}
+  namespace: {{ include "gonavi-mcp-server.namespace" . }}
+  labels:
+    {{- include "gonavi-mcp-server.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className | quote }}
+  {{- with .Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path | quote }}
+            pathType: {{ .pathType | quote }}
+            backend:
+              service:
+                name: {{ include "gonavi-mcp-server.serviceName" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

deploy/helm/gonavi-mcp-server/templates/secret.yaml

@@ -0,0 +1,27 @@
+{{- if .Values.secret.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gonavi-mcp-server.secretName" . }}
+  namespace: {{ include "gonavi-mcp-server.namespace" . }}
+  labels:
+    {{- include "gonavi-mcp-server.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  {{ .Values.secret.tokenKey }}: {{ required "secret.stringData.token is required when secret.create=true" .Values.secret.stringData.token | quote }}
+  {{- if eq .Values.data.mode "secret" }}
+  {{ .Values.secret.connectionsJsonKey }}: |
+{{ required "secret.stringData.connectionsJson is required when data.mode=secret and secret.create=true" .Values.secret.stringData.connectionsJson | nindent 4 }}
+  {{ .Values.secret.dailySecretsJsonKey }}: |
+{{ required "secret.stringData.dailySecretsJson is required when data.mode=secret and secret.create=true" .Values.secret.stringData.dailySecretsJson | nindent 4 }}
+  {{- else }}
+  {{- if .Values.secret.stringData.connectionsJson }}
+  {{ .Values.secret.connectionsJsonKey }}: |
+{{ .Values.secret.stringData.connectionsJson | nindent 4 }}
+  {{- end }}
+  {{- if .Values.secret.stringData.dailySecretsJson }}
+  {{ .Values.secret.dailySecretsJsonKey }}: |
+{{ .Values.secret.stringData.dailySecretsJson | nindent 4 }}
+  {{- end }}
+  {{- end }}
+{{- end }}

deploy/helm/gonavi-mcp-server/templates/service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "gonavi-mcp-server.serviceName" . }}
+  namespace: {{ include "gonavi-mcp-server.namespace" . }}
+  labels:
+    {{- include "gonavi-mcp-server.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  selector:
+    {{- include "gonavi-mcp-server.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP

deploy/helm/gonavi-mcp-server/values-examples/drivers-pvc.yaml

@@ -0,0 +1,4 @@
+drivers:
+  mode: pvc
+  pvc:
+    claimName: gonavi-drivers

deploy/helm/gonavi-mcp-server/values-examples/ingress-with-drivers-pvc.yaml

@@ -0,0 +1,19 @@
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: gonavi-mcp.example.com
+      paths:
+        - path: /mcp
+          pathType: Prefix
+        - path: /healthz
+          pathType: Prefix
+  tls:
+    - secretName: gonavi-mcp-server-tls
+      hosts:
+        - gonavi-mcp.example.com
+
+drivers:
+  mode: pvc
+  pvc:
+    claimName: gonavi-drivers

deploy/helm/gonavi-mcp-server/values-examples/ingress.yaml

@@ -0,0 +1,14 @@
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: gonavi-mcp.example.com
+      paths:
+        - path: /mcp
+          pathType: Prefix
+        - path: /healthz
+          pathType: Prefix
+  tls:
+    - secretName: gonavi-mcp-server-tls
+      hosts:
+        - gonavi-mcp.example.com

deploy/helm/gonavi-mcp-server/values-examples/inline-secret.yaml

@@ -0,0 +1,13 @@
+secret:
+  create: true
+  stringData:
+    token: replace-with-a-random-token
+    connectionsJson: |
+      {
+        "connections": []
+      }
+    dailySecretsJson: |
+      {
+        "schemaVersion": 1,
+        "connections": {}
+      }

deploy/helm/gonavi-mcp-server/values-examples/nas-hostpath.yaml

@@ -0,0 +1,10 @@
+data:
+  mode: hostPath
+  hostPath:
+    path: /volume1/docker/gonavi/data
+    type: Directory
+
+secret:
+  create: true
+  stringData:
+    token: replace-with-a-random-token

deploy/helm/gonavi-mcp-server/values.yaml

@@ -0,0 +1,99 @@
+nameOverride: ""
+fullnameOverride: ""
+namespaceOverride: ""
+
+replicaCount: 1
+
+image:
+  repository: ghcr.io/syngnat/gonavi-mcp-server
+  tag: latest
+  pullPolicy: IfNotPresent
+
+service:
+  type: ClusterIP
+  port: 8765
+  annotations: {}
+
+mcp:
+  dataRoot: /data
+  logDir: /var/lib/gonavi/logs
+  httpAddr: 0.0.0.0:8765
+  httpPath: /mcp
+  schemaOnly: true
+  extraArgs: []
+  extraEnv: []
+
+secret:
+  create: false
+  name: gonavi-mcp-server-data
+  tokenKey: GONAVI_MCP_HTTP_TOKEN
+  connectionsJsonKey: connections.json
+  dailySecretsJsonKey: daily_secrets.json
+  stringData:
+    token: ""
+    connectionsJson: ""
+    dailySecretsJson: ""
+
+data:
+  mode: secret
+  mountPath: /data
+  hostPath:
+    path: /volume1/docker/gonavi/data
+    type: Directory
+  pvc:
+    claimName: ""
+
+drivers:
+  mode: none
+  mountPath: /data/drivers
+  pvc:
+    claimName: gonavi-drivers
+  hostPath:
+    path: /volume1/docker/gonavi/drivers
+    type: Directory
+
+ingress:
+  enabled: false
+  className: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+  hosts:
+    - host: gonavi-mcp.example.com
+      paths:
+        - path: /mcp
+          pathType: Prefix
+        - path: /healthz
+          pathType: Prefix
+  tls:
+    - secretName: gonavi-mcp-server-tls
+      hosts:
+        - gonavi-mcp.example.com
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+
+podAnnotations: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 10001
+  runAsGroup: 10001
+  seccompProfile:
+    type: RuntimeDefault
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
+nodeSelector: {}
+tolerations: []
+affinity: {}

deploy/k8s/gonavi-mcp-server/README.md

@@ -0,0 +1,151 @@
+# GoNavi MCP Server Kubernetes 示例
+
+这个目录提供 `gonavi-mcp-server` 的最小 K8s 部署清单，适合：
+
+- Linux 服务器上的单集群部署
+- NAS 自带 K8s / k3s / k8s-lite 环境
+- 需要把 GoNavi MCP 通过 Ingress / Gateway 暴露给远端 Agent 的场景
+
+如果你希望通过 values 参数统一控制镜像、Secret、Ingress、PVC/hostPath，而不是维护多份 overlay，请直接使用 [deploy/helm/gonavi-mcp-server](../../helm/gonavi-mcp-server)。
+
+目录结构：
+
+- `kustomization.yaml`：基础部署入口
+- `base/kustomization.yaml`：基础资源集合
+- `overlays/nas-hostpath`：直接挂 NAS / 单机节点上的 GoNavi 数据目录
+- `base/deployment.yaml` / `base/service.yaml`：基础资源
+- `overlays/drivers-pvc`：为 `/data/drivers` 增加 PVC 挂载
+- `overlays/ingress`：增加 Ingress 暴露 `/mcp`
+- `overlays/ingress-with-drivers-pvc`：同时启用 Ingress 和 drivers PVC
+
+## 前提
+
+容器仍然依赖 GoNavi 的活动数据目录。至少要准备：
+
+- `connections.json`
+- `daily_secrets.json`
+
+如果目标连接依赖可选 driver agent，还需要额外挂载 `/data/drivers`。
+
+`base/deployment.yaml` 默认镜像指向：
+
+```text
+ghcr.io/syngnat/gonavi-mcp-server:latest
+```
+
+如果你要跟随 `dev` 分支，可以改成：
+
+```text
+ghcr.io/syngnat/gonavi-mcp-server:dev-latest
+```
+
+如果你要使用自建镜像，再按下面方式覆盖 `image`：
+
+- 在当前节点可访问的 Docker / Podman / containerd 环境中构建并导入这个镜像
+- 把镜像推送到你的私有仓库，并同步修改 `base/deployment.yaml` 里的 `image`
+
+例如：
+
+```bash
+docker build -f Dockerfile.mcp-server -t gonavi-mcp-server:local .
+# or
+podman build -f Dockerfile.mcp-server -t localhost/gonavi-mcp-server:local .
+```
+
+## 1. 创建 Secret
+
+推荐直接从现有 GoNavi 数据文件生成：
+
+```bash
+kubectl create secret generic gonavi-mcp-server-data \
+  --from-file=connections.json=/absolute/path/to/gonavi-data/connections.json \
+  --from-file=daily_secrets.json=/absolute/path/to/gonavi-data/daily_secrets.json \
+  --from-literal=GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token
+```
+
+如需单独 namespace，请先执行：
+
+```bash
+kubectl create namespace gonavi
+kubectl -n gonavi create secret generic gonavi-mcp-server-data \
+  --from-file=connections.json=/absolute/path/to/gonavi-data/connections.json \
+  --from-file=daily_secrets.json=/absolute/path/to/gonavi-data/daily_secrets.json \
+  --from-literal=GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token
+```
+
+## 2. 应用清单
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server
+```
+
+如果使用独立 namespace，请先把 YAML 里的 `namespace` 改成你的目标值，或自行用 `kustomize` / Helm 做二次封装。
+
+清单内已经带了基础安全上下文和默认资源配额；如果你的连接数量、对象规模或并发访问更高，建议按实际负载调整 `resources`。
+
+### 常用 Overlay
+
+仅基础部署：
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server
+```
+
+需要可选 driver agent：
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server/overlays/drivers-pvc
+```
+
+NAS / k3s 单机节点直接挂宿主机目录：
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server/overlays/nas-hostpath
+```
+
+需要对外暴露 `/mcp`：
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server/overlays/ingress
+```
+
+同时需要 Ingress 与 drivers PVC：
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc
+```
+
+应用 overlay 前，记得先改里面的占位值，例如：
+
+- `overlays/ingress/ingress.yaml` 里的域名、TLS Secret、`ingressClassName`
+- `overlays/drivers-pvc/patch-deployment.yaml` 里的 PVC 名称 `gonavi-drivers`
+- `overlays/nas-hostpath/patch-deployment.yaml` 里的宿主机目录 `/volume1/docker/gonavi/data`
+
+`nas-hostpath` overlay 会直接把整个 GoNavi 数据目录挂到 `/data`，因此 `connections.json`、`daily_secrets.json`、`drivers/` 都从宿主机目录读取；此时仍建议保留 `GONAVI_MCP_HTTP_TOKEN` 的 Secret 注入，不要把 token 直接硬编码进 Deployment。
+
+## 3. 校验
+
+```bash
+kubectl get pods -n gonavi
+kubectl get svc -n gonavi
+kubectl port-forward -n gonavi svc/gonavi-mcp-server 8765:8765
+curl -H "Authorization: Bearer replace-with-a-random-token" http://127.0.0.1:8765/healthz
+```
+
+`/healthz` 返回 `ok` 说明 Pod 已对外提供 HTTP 服务。
+
+## 4. 暴露给远端 Agent
+
+- 集群内使用：直接访问 `http://gonavi-mcp-server.gonavi.svc.cluster.local:8765/mcp`
+- 集群外使用：通过 Ingress / Gateway / 反向代理暴露 `/mcp`
+- 远端 Agent 请求头：`Authorization: Bearer <你的 token>`
+
+## 5. drivers 挂载
+
+当前示例默认只挂载 `connections.json` 与 `daily_secrets.json`。如果保存连接里包含 Dameng、ClickHouse、DuckDB 等依赖 driver agent 的数据源，请在 Deployment 中额外补一个卷，把宿主机或 PVC 中的 `drivers/` 目录挂载到：
+
+```text
+/data/drivers
+```
+
+否则对应连接会因为缺少 driver agent 无法使用。

deploy/k8s/gonavi-mcp-server/base/deployment.yaml

@@ -0,0 +1,89 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+  labels:
+    app.kubernetes.io/name: gonavi-mcp-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: gonavi-mcp-server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: gonavi-mcp-server
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: gonavi-mcp-server
+          # 如需跟随 dev 分支，可改成 ghcr.io/syngnat/gonavi-mcp-server:dev-latest
+          image: ghcr.io/syngnat/gonavi-mcp-server:latest
+          imagePullPolicy: IfNotPresent
+          args:
+            - http
+          ports:
+            - name: http
+              containerPort: 8765
+              protocol: TCP
+          env:
+            - name: GONAVI_DATA_ROOT
+              value: /data
+            - name: GONAVI_LOG_DIR
+              value: /var/lib/gonavi/logs
+            - name: GONAVI_MCP_HTTP_ADDR
+              value: 0.0.0.0:8765
+            - name: GONAVI_MCP_HTTP_PATH
+              value: /mcp
+            - name: GONAVI_MCP_SCHEMA_ONLY
+              value: "true"
+            - name: GONAVI_MCP_HTTP_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: gonavi-mcp-server-data
+                  key: GONAVI_MCP_HTTP_TOKEN
+          volumeMounts:
+            - name: gonavi-data
+              mountPath: /data
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+      volumes:
+        - name: gonavi-data
+          projected:
+            sources:
+              - secret:
+                  name: gonavi-mcp-server-data
+                  items:
+                    - key: connections.json
+                      path: connections.json
+                    - key: daily_secrets.json
+                      path: daily_secrets.json

deploy/k8s/gonavi-mcp-server/base/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml

deploy/k8s/gonavi-mcp-server/base/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+  labels:
+    app.kubernetes.io/name: gonavi-mcp-server
+spec:
+  selector:
+    app.kubernetes.io/name: gonavi-mcp-server
+  ports:
+    - name: http
+      port: 8765
+      targetPort: http
+      protocol: TCP

deploy/k8s/gonavi-mcp-server/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - base

deploy/k8s/gonavi-mcp-server/overlays/drivers-pvc/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+patches:
+  - path: patch-deployment.yaml

deploy/k8s/gonavi-mcp-server/overlays/drivers-pvc/patch-deployment.yaml

@@ -0,0 +1,18 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+spec:
+  template:
+    spec:
+      containers:
+        - name: gonavi-mcp-server
+          volumeMounts:
+            - name: gonavi-drivers
+              mountPath: /data/drivers
+              readOnly: true
+      volumes:
+        - name: gonavi-drivers
+          persistentVolumeClaim:
+            claimName: gonavi-drivers

deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - gonavi-mcp.example.com
+      secretName: gonavi-mcp-server-tls
+  rules:
+    - host: gonavi-mcp.example.com
+      http:
+        paths:
+          - path: /mcp
+            pathType: Prefix
+            backend:
+              service:
+                name: gonavi-mcp-server
+                port:
+                  number: 8765
+          - path: /healthz
+            pathType: Prefix
+            backend:
+              service:
+                name: gonavi-mcp-server
+                port:
+                  number: 8765

deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+  - ingress.yaml
+
+patches:
+  - path: patch-deployment.yaml

deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc/patch-deployment.yaml

@@ -0,0 +1,18 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+spec:
+  template:
+    spec:
+      containers:
+        - name: gonavi-mcp-server
+          volumeMounts:
+            - name: gonavi-drivers
+              mountPath: /data/drivers
+              readOnly: true
+      volumes:
+        - name: gonavi-drivers
+          persistentVolumeClaim:
+            claimName: gonavi-drivers

deploy/k8s/gonavi-mcp-server/overlays/ingress/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - gonavi-mcp.example.com
+      secretName: gonavi-mcp-server-tls
+  rules:
+    - host: gonavi-mcp.example.com
+      http:
+        paths:
+          - path: /mcp
+            pathType: Prefix
+            backend:
+              service:
+                name: gonavi-mcp-server
+                port:
+                  number: 8765
+          - path: /healthz
+            pathType: Prefix
+            backend:
+              service:
+                name: gonavi-mcp-server
+                port:
+                  number: 8765

deploy/k8s/gonavi-mcp-server/overlays/ingress/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+  - ingress.yaml

deploy/k8s/gonavi-mcp-server/overlays/nas-hostpath/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+patches:
+  - path: patch-deployment.yaml

deploy/k8s/gonavi-mcp-server/overlays/nas-hostpath/patch-deployment.yaml

@@ -0,0 +1,14 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+spec:
+  template:
+    spec:
+      volumes:
+        - $patch: replace
+          name: gonavi-data
+          hostPath:
+            path: /volume1/docker/gonavi/data
+            type: Directory

deploy/podman/gonavi-mcp-server/README.md

@@ -0,0 +1,101 @@
+# GoNavi MCP Server Podman 示例
+
+这个目录提供 `gonavi-mcp-server` 的 Podman 原生部署入口，覆盖两类常见场景：
+
+- 直接用 `podman run` 在 Linux 服务器 / NAS 上启动
+- 用 rootless Quadlet + systemd 做常驻服务
+
+目录内容：
+
+- `gonavi-mcp-server.env.example`：给 `podman run` / Quadlet 共用的容器环境变量示例
+- `gonavi-mcp-server.container`：Quadlet 示例
+
+前提仍然一样：宿主机 GoNavi 活动数据目录内至少应包含：
+
+- `connections.json`
+- `daily_secrets.json`
+
+如果目标连接依赖可选 driver agent，还要保证同一数据目录下已有 `drivers/`。
+
+## 1. 直接运行已发布镜像
+
+```bash
+cp deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example ./gonavi-mcp-server.env
+```
+
+把 `GONAVI_MCP_HTTP_TOKEN` 改成随机值后运行：
+
+```bash
+podman run -d --name gonavi-mcp-server --replace \
+  -p 8765:8765 \
+  --env-file ./gonavi-mcp-server.env \
+  -v /absolute/path/to/gonavi-data:/data:Z \
+  ghcr.io/syngnat/gonavi-mcp-server:latest http
+```
+
+查看状态：
+
+```bash
+podman ps
+podman logs -f gonavi-mcp-server
+```
+
+如果你的宿主机没有启用 SELinux，可把挂载参数末尾的 `:Z` 去掉；如果启用了 SELinux，建议保留它。
+
+## 2. 本地源码构建镜像
+
+仓库根目录已经提供 `.containerignore`，Podman 会优先读取它来裁剪构建上下文。
+
+```bash
+podman build -f Dockerfile.mcp-server -t localhost/gonavi-mcp-server:local .
+podman run -d --name gonavi-mcp-server --replace \
+  -p 8765:8765 \
+  --env-file ./gonavi-mcp-server.env \
+  -v /absolute/path/to/gonavi-data:/data:Z \
+  localhost/gonavi-mcp-server:local http
+```
+
+## 3. Rootless Quadlet 常驻服务
+
+Podman Quadlet 适合 Linux 服务器 / NAS 上做 rootless 常驻服务。
+
+把文件放到用户级目录：
+
+```bash
+mkdir -p ~/.config/containers/systemd
+cp deploy/podman/gonavi-mcp-server/gonavi-mcp-server.container ~/.config/containers/systemd/
+cp deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example ~/.config/containers/systemd/gonavi-mcp-server.env
+```
+
+然后修改两处：
+
+- `~/.config/containers/systemd/gonavi-mcp-server.container` 里的 `Volume=/absolute/path/to/gonavi-data:/data:Z`
+- `~/.config/containers/systemd/gonavi-mcp-server.env` 里的 `GONAVI_MCP_HTTP_TOKEN`
+
+启动服务：
+
+```bash
+systemctl --user daemon-reload
+systemctl --user enable --now gonavi-mcp-server.service
+systemctl --user status gonavi-mcp-server.service
+journalctl --user -u gonavi-mcp-server.service -f
+```
+
+如果你希望用户退出登录后服务仍然保持运行，再执行：
+
+```bash
+loginctl enable-linger "$USER"
+```
+
+Rootless Quadlet 默认搜索路径是 `~/.config/containers/systemd/`；如果你要做系统级 rootful 部署，可改放到 `/etc/containers/systemd/`。
+
+## 4. 关于 Compose
+
+Podman 的 `podman compose` 依赖外部 compose provider。也就是说，是否能直接复用仓库根目录的 `docker-compose.mcp-server.yml`，取决于你的 Podman 环境是否已经安装并配置了对应 provider。
+
+因此，这个仓库对 Podman 的主支持路径是：
+
+- `podman run`
+- Quadlet（推荐长期运行）
+
+如果你的环境已经有可用的 compose provider，再去复用根目录 Compose 文件即可。

deploy/podman/gonavi-mcp-server/gonavi-mcp-server.container

@@ -0,0 +1,22 @@
+[Unit]
+Description=GoNavi MCP Server (rootless Podman)
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+ContainerName=gonavi-mcp-server
+Image=ghcr.io/syngnat/gonavi-mcp-server:latest
+Pull=newer
+EnvironmentFile=./gonavi-mcp-server.env
+# 修改成你的 GoNavi 活动数据目录；SELinux 主机建议保留 :Z
+Volume=/absolute/path/to/gonavi-data:/data:Z
+PublishPort=8765:8765
+Exec=http
+LogDriver=journald
+
+[Service]
+Restart=always
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target

deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example

@@ -0,0 +1,15 @@
+# 容器内 GoNavi 活动数据根目录。通常不需要修改；Volume= 已把宿主机目录挂到 /data。
+GONAVI_DATA_ROOT=/data
+
+# 日志目录。默认与镜像内目录保持一致。
+GONAVI_LOG_DIR=/var/lib/gonavi/logs
+
+# MCP HTTP 监听地址与路径。
+GONAVI_MCP_HTTP_ADDR=0.0.0.0:8765
+GONAVI_MCP_HTTP_PATH=/mcp
+
+# 远程 MCP 客户端访问时必须携带的 Bearer Token
+GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token
+
+# true = 只暴露结构查询工具，不注册 execute_sql
+GONAVI_MCP_SCHEMA_ONLY=true

docker-compose.mcp-server.local.yml

@@ -0,0 +1,7 @@
+services:
+  gonavi-mcp-server:
+    build:
+      context: .
+      dockerfile: Dockerfile.mcp-server
+    image: ${GONAVI_MCP_IMAGE_LOCAL:-gonavi-mcp-server:local}
+    pull_policy: never

docker-compose.mcp-server.yml

@@ -0,0 +1,20 @@
+services:
+  gonavi-mcp-server:
+    image: ${GONAVI_MCP_IMAGE:-ghcr.io/syngnat/gonavi-mcp-server:latest}
+    pull_policy: ${GONAVI_MCP_PULL_POLICY:-missing}
+    container_name: gonavi-mcp-server
+    restart: unless-stopped
+    ports:
+      - "${GONAVI_MCP_HTTP_PORT:-8765}:8765"
+    environment:
+      GONAVI_DATA_ROOT: /data
+      GONAVI_LOG_DIR: /var/lib/gonavi/logs
+      GONAVI_MCP_HTTP_ADDR: 0.0.0.0:8765
+      GONAVI_MCP_HTTP_PATH: ${GONAVI_MCP_HTTP_PATH:-/mcp}
+      GONAVI_MCP_HTTP_TOKEN: ${GONAVI_MCP_HTTP_TOKEN}
+      GONAVI_MCP_SCHEMA_ONLY: ${GONAVI_MCP_SCHEMA_ONLY:-true}
+    volumes:
+      - type: bind
+        source: ${GONAVI_HOST_DATA_ROOT}
+        target: /data
+    command: ["http"]

docker.mcp-server.env.example

@@ -0,0 +1,20 @@
+# 宿主机 GoNavi 活动数据目录，目录内至少应包含 connections.json 与 daily_secrets.json
+GONAVI_HOST_DATA_ROOT=/absolute/path/to/gonavi-data
+
+# 预构建镜像地址。稳定版通常使用 latest，跟随 dev 分支可改成 ghcr.io/syngnat/gonavi-mcp-server:dev-latest
+GONAVI_MCP_IMAGE=ghcr.io/syngnat/gonavi-mcp-server:latest
+
+# 预构建镜像拉取策略：always / missing / never
+GONAVI_MCP_PULL_POLICY=missing
+
+# 远程 MCP 客户端访问时必须携带的 Bearer Token
+GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token
+
+# 宿主机暴露端口
+GONAVI_MCP_HTTP_PORT=8765
+
+# MCP HTTP 路径
+GONAVI_MCP_HTTP_PATH=/mcp
+
+# true = 只暴露结构查询工具，不注册 execute_sql
+GONAVI_MCP_SCHEMA_ONLY=true

docs/driver-manifest.json

@@ -7,6 +7,12 @@
       "checksumPolicy": "off",
       "downloadUrl": "builtin://activate/mariadb"
     },
+    "oceanbase": {
+      "engine": "go",
+      "version": "1.9.3",
+      "checksumPolicy": "off",
+      "downloadUrl": "builtin://activate/oceanbase"
+    },
     "doris": {
       "engine": "go",
       "version": "1.9.3",
@@ -61,6 +67,12 @@
       "checksumPolicy": "off",
       "downloadUrl": "builtin://activate/vastbase"
     },
+    "opengauss": {
+      "engine": "go",
+      "version": "1.11.1",
+      "checksumPolicy": "off",
+      "downloadUrl": "builtin://activate/opengauss"
+    },
     "mongodb": {
       "engine": "go",
       "version": "2.5.0",
@@ -84,6 +96,12 @@
       "version": "1.11.1",
       "checksumPolicy": "off",
       "downloadUrl": "builtin://activate/postgres"
+    },
+    "elasticsearch": {
+      "engine": "go",
+      "version": "8.19.0",
+      "checksumPolicy": "off",
+      "downloadUrl": "builtin://activate/elasticsearch"
     }
   }
 }

docs/需求追踪/需求进度追踪-Oracle对象跳转与存储过程修改执行-20260625.md

@@ -0,0 +1,45 @@
+# 需求进度追踪 - Oracle对象跳转与存储过程修改执行
+
+## 1. 需求摘要
+- 需求名称：Oracle对象跳转与存储过程修改执行
+- 提出日期：2026-06-25
+- 负责人：Codex
+- 目标：SQL编辑器支持 Oracle 序列、存储包 Ctrl/Cmd 点击跳转；对象编辑执行 Oracle 存储过程时不再生成非法第二条语句。
+- 非目标：不调整 Oracle 连接驱动、不改数据库 schema、不重构侧栏对象树。
+
+## 2. 范围与验收
+- 范围：QueryEditor 对象元数据、hover/跳转逻辑、DefinitionViewer 对象编辑 SQL 生成、相关 i18n 和回归测试。
+- 验收标准：序列/存储包在 SQL 编辑器可出现链接提示并打开定义页；带 SQLPlus `/` 的 Oracle PL/SQL 编辑 SQL 不生成 `/;`，执行时保留完整定义交给后端拆分。
+- 依赖与约束：复用现有侧栏 sequence/package tab 类型；不混入 `frontend/wailsjs/go/models.ts` 既有未提交改动。
+
+## 3. 里程碑与进度
+- [x] 阶段 1（需求澄清）：确认序列/存储包侧栏已可打开，但 SQL 编辑器跳转缺失；存储过程修改仍报 ORA-00900。
+- [x] 阶段 2（影响分析）：影响前端 QueryEditor、DefinitionViewer、i18n、测试；后端拆分已有基础保护。
+- [x] 阶段 3（方案设计）：补齐元数据与跳转类型；对象编辑 SQL 保留 SQLPlus `/` 语义。
+- [x] 阶段 4（实施计划）：先补导航闭环，再修 PL/SQL 生成/执行，最后跑定向测试。
+- [x] 阶段 5（实现与自检）：已完成定向测试、QueryEditor 全文件测试、前端 build、后端 Oracle 拆分测试。
+- [ ] 阶段 6（评审与交付）：待提交推送。
+- [ ] 阶段 7（发布与观察）：发布后验证 Oracle 对象编辑与 SQL 编辑器跳转。
+
+## 4. 变更清单
+- 已完成：补齐 QueryEditor sequence/package 元数据、hover、点击打开定义页；修复对象编辑 SQLPlus `/;`；执行路径兼容旧编辑页 `/;`。
+- 进行中：提交并推送。
+- 待处理：发布后验证 Oracle 实库。
+
+## 5. 风险与阻塞
+- 风险：三段名称 `schema.package.proc` 与 `db.schema.table` 存在歧义。
+- 阻塞：无。
+- 缓解措施：仅当第一段不是可见数据库时，将三段名称按 Oracle schema-qualified sequence/package 解析。
+
+## 6. 决策记录
+- 决策 1：序列和存储包复用侧栏现有 `sequence-def` / `package-def` tab 结构。
+- 决策 2：Oracle PL/SQL 定义执行时保留 SQLPlus `/` 分隔符，由后端拆分器去掉 delimiter，避免前端用分号重组造成 ORA-00900。
+
+## 7. 验证记录
+- 验证项：QueryEditor 导航回归测试、DefinitionViewer 对象编辑测试、SQL 语句拆分测试、i18n catalog 测试、前端 build、后端 Oracle 拆分测试。
+- 结果：通过。
+- 证据（日志/截图/链接）：`npm test -- src/components/QueryEditor.external-sql-save.test.tsx`；`npm test -- src/components/DefinitionViewer.object-edit.test.tsx src/i18n/catalog.test.ts src/utils/sqlStatementSelection.test.ts`；`go test ./internal/app -run 'TestDBQueryMultiKeepsOracle|TestDBQueryMultiSkipsOracle'`；`npm run build`。
+
+## 8. 下一步
+- 下一步行动：提交并推送到 dev。
+- 负责人：Codex

docs/需求追踪/需求进度追踪-生产连接只读保护-20260623.md

@@ -0,0 +1,74 @@
+# 需求进度追踪 - 生产连接只读保护
+
+## 1. 需求摘要
+- 需求名称：生产连接只读保护
+- 提出日期：2026-06-23
+- 负责人：Codex
+- 目标：为 SQL 类数据库与 MongoDB 连接增加连接级只读保护，启用后仅允许查询，阻止写入、DDL、导入和同步目标操作
+- 非目标：不为所有侧栏写操作都新增前端隐藏逻辑；不引入新的环境分级体系；不改造 JVM 只读能力
+
+## 2. 范围与验收
+- 范围：
+- 连接配置模型、保存/回填与 RPC 序列化链路
+- 连接弹窗只读开关、查询编辑器本地拦截、DataGrid 导入入口收口
+- 后端 SQL/Mongo 查询判定与写操作统一守卫
+- 验收标准：
+- 支持的数据源出现“生产连接/只允许查询”开关
+- 启用后普通查询仍可执行，非查询 SQL / Mongo 写命令被前后端阻止
+- 导入、结构变更、清表、同步目标等关键写入口被后端拒绝
+- 依赖与约束：
+- 保持现有数据源能力判定与 QueryEditor 执行链路
+- MongoDB 前端判定以保守拦截为主，最终正确性由后端守卫兜底
+
+## 3. 里程碑与进度
+- [x] 阶段 1（需求澄清）：确认采用连接级 `readOnly` 布尔字段，不新建环境系统
+- [x] 阶段 2（影响分析）：梳理前端能力面板、查询执行、导入与后端写入口
+- [x] 阶段 3（方案设计）：确定“前端预拦截 + 后端最终守卫”双层保护
+- [x] 阶段 4（实施计划）：接入配置链路、能力判定、查询判定与写入口守卫
+- [x] 阶段 5（实现与自检）：补文案、测试与定向验证
+- [x] 阶段 6（评审与交付）：确认范围、风险、回滚点和验证命令
+- [ ] 阶段 7（发布与观察）：待体验验证
+
+## 4. 变更清单
+- 已完成：
+- 新增连接级 `readOnly` 配置字段及前后端序列化支持
+- 连接弹窗为 SQL 类数据库与 MongoDB 增加生产连接保护开关
+- QueryEditor 增加本地非查询拦截，DataGrid 导入入口在只读连接下禁用
+- 后端为查询、DDL、导入、清表、同步等写入口增加统一只读守卫
+- MongoDB 查询判定改为命令级白名单，不再把所有 JSON 命令都视为只读
+- 补充前端/后端定向测试与需求追踪文档
+- 进行中：
+- 等待体验包验证连接弹窗、查询拦截和写操作拒绝文案
+- 待处理：
+- 如需进一步优化体验，再补侧栏对象级写菜单的前端隐藏/禁用
+
+## 5. 风险与阻塞
+- 风险：
+- 前端 SQL/Mongo 只读判定是保守策略，边界命令可能仍需后端兜底
+- 现有部分侧栏写菜单仍可能显示，但执行时会被后端拒绝
+- 阻塞：
+- 暂无
+- 缓解措施：
+- 关键写入口统一走后端守卫；前端只负责提前反馈与减少误操作
+
+## 6. 决策记录
+- 决策 1：只对 SQL 类数据库和 MongoDB 支持连接级生产保护，其他数据源忽略 `readOnly`
+- 决策 2：采用顶层 `readOnly` 布尔字段，避免新增环境枚举和迁移成本
+- 决策 3：MongoDB 只读判定按命令白名单处理，防止把写命令误放行
+
+## 7. 验证记录
+- 验证项：
+- 前端数据源能力判定、RPC 配置、连接配置测试
+- 后端只读连接守卫与 SQL/Mongo 查询判定测试
+- 结果：
+- 通过
+- 证据（日志/截图/链接）：
+- `go test ./internal/app -run 'Test(EnsureReadOnlyConnectionAllows|SupportsConnectionReadOnlyMode|IsReadOnlySQLQuery)'`
+- `npm --prefix frontend test -- src/utils/dataSourceCapabilities.test.ts src/utils/connectionRpcConfig.test.ts src/components/connectionModal/connectionModalConfig.keepalive.test.ts`
+
+## 8. 下一步
+- 下一步行动：
+- 用体验包回归验证生产连接下的查询、导入、建库删库、同步目标和 Mongo 命令拦截
+- 如需更完整 UX，再补侧栏写菜单的只读态收口
+- 负责人：
+- Codex

frontend/ai_ui_mockups_wip.html

@@ -0,0 +1,182 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <title>AI UI Brainstorming Prototypes</title>
+    <!-- React & ReactDOM -->
+    <script crossorigin src="https://unpkg.com/react@18/umd/react.development.js"></script>
+    <script crossorigin src="https://unpkg.com/react-dom@18/umd/react-dom.development.js"></script>
+    <!-- Babel -->
+    <script src="https://unpkg.com/@babel/standalone/babel.min.js"></script>
+    <!-- Ant Design -->
+    <script src="https://unpkg.com/dayjs/dayjs.min.js"></script>
+    <script src="https://unpkg.com/antd/dist/antd.min.js"></script>
+    <link rel="stylesheet" href="https://unpkg.com/antd/dist/reset.css" />
+    <!-- Icons -->
+    <script src="https://unpkg.com/@ant-design/icons/dist/index.umd.js"></script>
+    <style>
+        body { padding: 40px; background: #f0f2f5; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial; }
+        .prototype-container { display: flex; gap: 40px; }
+        .prototype-column { flex: 1; max-width: 600px; background: white; border-radius: 12px; box-shadow: 0 4px 12px rgba(0,0,0,0.05); overflow: hidden; }
+        .prototype-header { padding: 16px 24px; border-bottom: 1px solid #f0f0f0; background: #fafafa; font-weight: bold; }
+        .prototype-body { padding: 24px; }
+        
+        /* Default App Theme Colors (Light Mode) */
+        :root {
+            --gn-border: rgba(16,24,40,0.08);
+            --gn-bg: rgba(255,255,255,0.84);
+            --gn-text: #162033;
+            --gn-muted: rgba(16,24,40,0.55);
+            --gn-primary: #1677ff;
+            --gn-primary-bg: rgba(24,144,255,0.1);
+        }
+
+        /* V1 Styles: Professional List */
+        .v1-list-item {
+            display: flex; align-items: center; justify-content: space-between;
+            padding: 12px 16px; margin-bottom: 8px; border-radius: 8px;
+            border: 1px solid transparent; cursor: pointer; transition: all 0.2s;
+        }
+        .v1-list-item:hover { background: #f5f5f5; }
+        .v1-list-item.selected {
+            background: var(--gn-primary-bg); border-color: var(--gn-primary);
+        }
+        
+        /* V2 Styles: Refined Cards (ConnectionModal Style) */
+        .v2-card-grid {
+            display: grid; grid-template-columns: 1fr 1fr; gap: 12px;
+        }
+        .v2-card {
+            padding: 16px; border-radius: 12px; border: 1px solid var(--gn-border);
+            cursor: pointer; transition: all 0.2s; background: white;
+            box-shadow: inset 0 0 0 1px rgba(16,24,40,0.01);
+        }
+        .v2-card:hover { border-color: #d9d9d9; background: #fafafa; }
+        .v2-card.selected {
+            border-color: var(--gn-primary); box-shadow: 0 0 0 1px var(--gn-primary) inset;
+        }
+        
+        .section-title { font-size: 13px; font-weight: 600; color: var(--gn-muted); margin-bottom: 12px; text-transform: uppercase; letter-spacing: 0.5px; }
+    </style>
+</head>
+<body>
+    <div id="root"></div>
+    <script type="text/babel">
+        const { useState } = React;
+        const { Input, Slider, Select, Button, Form, ConfigProvider } = antd;
+        const { ThunderboltOutlined, CloudOutlined, ExperimentOutlined, AppstoreOutlined, SettingOutlined, LinkOutlined, KeyOutlined } = icons;
+
+        const PROVIDERS = [
+            { key: 'openai', label: 'OpenAI', icon: <ThunderboltOutlined />, desc: 'GPT-4o / o1' },
+            { key: 'deepseek', label: 'DeepSeek', icon: <ThunderboltOutlined />, desc: 'V3 / R1' },
+            { key: 'anthropic', label: 'Claude', icon: <ExperimentOutlined />, desc: 'Sonnet 3.5' },
+            { key: 'custom', label: '自定义', icon: <AppstoreOutlined />, desc: '通用 API' },
+        ];
+
+        const V1ListDesign = () => {
+            const [selected, setSelected] = useState('openai');
+            return (
+                <div className="prototype-column">
+                    <div className="prototype-header">方案一：IDE 专业列表风格 (更克制、无彩色渐变)</div>
+                    <div className="prototype-body">
+                        <div className="section-title">提供商选择</div>
+                        <div style={{ marginBottom: 24, padding: 8, background: '#fafafa', borderRadius: 10, border: '1px solid #f0f0f0' }}>
+                            {PROVIDERS.map(p => (
+                                <div key={p.key} className={`v1-list-item ${selected === p.key ? 'selected' : ''}`} onClick={() => setSelected(p.key)}>
+                                    <div style={{ display: 'flex', alignItems: 'center', gap: 12 }}>
+                                        <div style={{ 
+                                            width: 32, height: 32, borderRadius: 6, display: 'grid', placeItems: 'center',
+                                            background: selected === p.key ? '#1677ff' : '#e6f4ff', 
+                                            color: selected === p.key ? '#fff' : '#1677ff', fontSize: 16
+                                        }}>
+                                            {p.icon}
+                                        </div>
+                                        <div>
+                                            <div style={{ fontWeight: 500, color: 'var(--gn-text)', fontSize: 14 }}>{p.label}</div>
+                                            <div style={{ fontSize: 12, color: 'var(--gn-muted)' }}>{p.desc}</div>
+                                        </div>
+                                    </div>
+                                    <div style={{ width: 16, height: 16, borderRadius: '50%', border: `2px solid ${selected === p.key ? 'var(--gn-primary)' : '#d9d9d9'}`, padding: 2 }}>
+                                        {selected === p.key && <div style={{ width: '100%', height: '100%', background: 'var(--gn-primary)', borderRadius: '50%' }} />}
+                                    </div>
+                                </div>
+                            ))}
+                        </div>
+                        
+                        <div className="section-title">连接配置 (紧凑表单)</div>
+                        <Form layout="vertical" size="middle">
+                            <Form.Item label="API Endpoint">
+                                <Input placeholder="https://api.openai.com/v1" prefix={<LinkOutlined style={{color: 'var(--gn-muted)'}}/>} />
+                            </Form.Item>
+                            <Form.Item label="API Key">
+                                <Input.Password placeholder="sk-..." prefix={<KeyOutlined style={{color: 'var(--gn-muted)'}}/>} />
+                            </Form.Item>
+                            <Form.Item label="Model Name">
+                                <Input placeholder="gpt-4o" prefix={<AppstoreOutlined style={{color: 'var(--gn-muted)'}}/>} />
+                            </Form.Item>
+                        </Form>
+                    </div>
+                </div>
+            );
+        };
+
+        const V2CardDesign = () => {
+            const [selected, setSelected] = useState('openai');
+            return (
+                <div className="prototype-column">
+                    <div className="prototype-header">方案二：GoNavi 统一卡片风格 (类似 ConnectionModal)</div>
+                    <div className="prototype-body">
+                        <div className="section-title">选择服务提供商</div>
+                        <div className="v2-card-grid" style={{ marginBottom: 24 }}>
+                            {PROVIDERS.map(p => (
+                                <div key={p.key} className={`v2-card ${selected === p.key ? 'selected' : ''}`} onClick={() => setSelected(p.key)}>
+                                    <div style={{ display: 'flex', alignItems: 'flex-start', gap: 12 }}>
+                                        <div style={{ color: selected === p.key ? 'var(--gn-primary)' : 'var(--gn-muted)', fontSize: 20, marginTop: 2 }}>
+                                            {p.icon}
+                                        </div>
+                                        <div>
+                                            <div style={{ fontWeight: 600, color: 'var(--gn-text)', fontSize: 14 }}>{p.label}</div>
+                                            <div style={{ fontSize: 12, color: 'var(--gn-muted)', marginTop: 4 }}>{p.desc}</div>
+                                        </div>
+                                    </div>
+                                </div>
+                            ))}
+                        </div>
+
+                        <div style={{ padding: 20, borderRadius: 12, border: '1px solid var(--gn-border)', background: '#fafafa' }}>
+                            <div className="section-title" style={{ marginTop: 0 }}>认证与设置</div>
+                            <Form layout="horizontal" labelCol={{ span: 6 }} wrapperCol={{ span: 18 }} size="middle">
+                                <Form.Item label="Endpoint" style={{ marginBottom: 16 }}>
+                                    <Input placeholder="https://api..." />
+                                </Form.Item>
+                                <Form.Item label="API Key" style={{ marginBottom: 16 }}>
+                                    <Input.Password placeholder="sk-..." />
+                                </Form.Item>
+                                <Form.Item label="模型名称" style={{ marginBottom: 0 }}>
+                                    <Input placeholder="例如 gpt-4o" />
+                                </Form.Item>
+                            </Form>
+                        </div>
+                    </div>
+                </div>
+            );
+        };
+
+        const App = () => (
+            <ConfigProvider theme={{ token: { colorPrimary: '#1677ff', borderRadius: 6 } }}>
+                <div style={{ marginBottom: 24 }}>
+                    <h1 style={{ fontSize: 24, margin: 0 }}>AI 设置 UI 重构探讨</h1>
+                    <p style={{ color: 'var(--gn-muted)' }}>当前设计带有太多渐变和鲜艳色彩（"AI 味"）。以下是遵循 GoNavi 本身设计规范（克制、专业）的两个方案：</p>
+                </div>
+                <div className="prototype-container">
+                    <V1ListDesign />
+                    <V2CardDesign />
+                </div>
+            </ConfigProvider>
+        );
+
+        const root = ReactDOM.createRoot(document.getElementById('root'));
+        root.render(<App />);
+    </script>
+</body>
+</html>

frontend/package.json

@@ -1,12 +1,14 @@
 {
   "name": "gonavi-client",
   "private": true,
-  "version": "0.0.1",
+  "version": "0.6.5",
   "type": "module",
   "scripts": {
     "dev": "vite",
     "build": "tsc && vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "test": "vitest run",
+    "i18n:scan": "go run ../tools/i18n-scan --root .."
   },
   "dependencies": {
     "@ant-design/icons": "^5.2.6",
@@ -15,11 +17,21 @@
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
     "@monaco-editor/react": "^4.6.0",
+    "@types/dagre": "^0.7.54",
+    "@types/react-syntax-highlighter": "^15.5.13",
     "antd": "^5.12.0",
     "clsx": "^2.1.0",
+    "dagre": "^0.8.5",
+    "fflate": "^0.8.3",
+    "mermaid": "^11.13.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
+    "react-markdown": "^10.1.0",
     "react-resizable": "^3.1.3",
+    "react-syntax-highlighter": "^16.1.1",
+    "reactflow": "^11.11.4",
+    "recharts": "^3.8.1",
+    "remark-gfm": "^4.0.1",
     "sql-formatter": "^15.7.0",
     "uuid": "^9.0.1",
     "zustand": "^4.4.7"
@@ -28,9 +40,12 @@
     "@types/react": "^18.2.43",
     "@types/react-dom": "^18.2.17",
     "@types/react-resizable": "^3.0.8",
+    "@types/react-test-renderer": "^18.0.7",
     "@types/uuid": "^9.0.7",
     "@vitejs/plugin-react": "^4.2.1",
+    "react-test-renderer": "^18.2.0",
     "typescript": "^5.2.2",
-    "vite": "^5.0.8"
+    "vite": "^5.0.8",
+    "vitest": "^3.2.4"
   }
-}
+}

frontend/package.json.md5

@@ -1 +1 @@
-5b8157374dae5f9340e31b2d0bd2c00e
+1d8f9adbde8018f90d013cc740e0405b

frontend/public/db-icons/chroma.svg

@@ -0,0 +1 @@
+<svg width="163" height="40" fill="none" xmlns="http://www.w3.org/2000/svg"><mask id="prefix__a" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="0" y="2" width="53" height="36"><path d="M52.503 2.501H.003v35h52.5v-35z" fill="#fff"/></mask><g mask="url(#prefix__a)"><path d="M17.503 2.501c-9.665 0-17.5 7.835-17.5 17.5s7.835 17.5 17.5 17.5 17.5-7.835 17.5-17.5-7.835-17.5-17.5-17.5z" fill="#327EFF"/><path d="M35.003 2.501c-9.665 0-17.5 7.835-17.5 17.5s7.835 17.5 17.5 17.5 17.5-7.834 17.5-17.5c0-9.665-7.835-17.5-17.5-17.5z" fill="#FFDE2D"/><path d="M17.503 20.002c0-9.665 7.835-17.5 17.5-17.5v17.5h-17.5z" fill="#FF6446"/><path d="M35.003 20.001c0 9.665-7.835 17.5-17.5 17.5v-17.5h17.5z" fill="#FF6446"/></g><path d="M68.543 30.45c-6.03 0-10.32-4.65-10.32-11.1 0-6.36 3.96-11.22 10.29-11.22 5.28 0 8.4 3.15 8.85 7.23h-4.32c-.39-2.16-2.01-3.57-4.53-3.57-3.96 0-5.85 3.3-5.85 7.56 0 4.38 2.28 7.53 5.88 7.53 2.55 0 4.35-1.53 4.62-3.78h4.26a7.596 7.596 0 01-2.37 5.07c-1.47 1.38-3.54 2.28-6.51 2.28zM83.41 8.55v8.07h.09c1.11-1.62 2.37-2.43 4.47-2.43 3.18 0 5.31 2.4 5.31 5.76V30H89.2v-9.45c0-1.65-.96-2.82-2.67-2.82-1.8 0-3.12 1.44-3.12 3.54V30h-4.08V8.55h4.08zm16.315 6.06v2.46h.09c.93-1.74 1.98-2.64 3.78-2.64.45 0 .72.03.96.12v3.57h-.09c-2.67-.27-4.59 1.14-4.59 4.38V30h-4.08V14.61h3.93zm13.438 15.84c-4.77 0-8.04-3.54-8.04-8.13 0-4.59 3.27-8.13 8.04-8.13s8.04 3.54 8.04 8.13c0 4.59-3.27 8.13-8.04 8.13zm0-3.12c2.49 0 3.9-2.01 3.9-5.01s-1.41-5.04-3.9-5.04c-2.52 0-3.9 2.04-3.9 5.04s1.38 5.01 3.9 5.01zM123.1 30V14.61h3.93v2.07h.09c.84-1.41 2.34-2.49 4.47-2.49 1.95 0 3.51 1.08 4.26 2.7h.06c1.05-1.68 2.67-2.7 4.62-2.7 3.24 0 5.07 2.1 5.07 5.46V30h-4.08v-9.66c0-1.74-.87-2.64-2.37-2.64-1.71 0-2.76 1.32-2.76 3.36V30h-4.08v-9.66c0-1.74-.87-2.64-2.37-2.64-1.65 0-2.76 1.32-2.76 3.36V30h-4.08zm34.71 0c-.24-.3-.39-1.02-.48-1.71h-.06c-.78 1.17-1.89 2.07-4.53 2.07-3.15 0-5.37-1.65-5.37-4.71 0-3.39 2.76-4.47 6.18-4.95 2.55-.36 3.72-.57 3.72-1.74 0-1.11-.87-1.83-2.58-1.83-1.92 0-2.85.69-2.97 2.16h-3.63c.12-2.7 2.13-5.07 6.629-5.07 4.621 0 6.481 2.07 6.481 5.67v7.83c0 1.17.18 1.86.54 2.13V30h-3.93zm-4.08-2.49c2.34 0 3.63-1.44 3.63-2.94v-2.31c-.72.42-1.83.66-2.851.9-2.129.48-3.179.96-3.179 2.4s.96 1.95 2.4 1.95z" fill="#000"/></svg>

frontend/public/db-icons/clickhouse.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>ClickHouse</title><path d="M21.333 10H24v4h-2.667ZM16 1.335h2.667v21.33H16Zm-5.333 0h2.666v21.33h-2.666ZM0 22.665V1.335h2.667v21.33zm5.333-21.33H8v21.33H5.333Z"/></svg>

frontend/public/db-icons/diros.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Apache Doris</title><path d="M8.666.0001c-.5355-.004-1.068.1072-1.5241.3384-.207.1048-.5749.3802-.8177.6118-1.0278.9803-1.2876 2.5138-.6553 3.8679.205.439.5068.7694 2.8476 3.1166 2.4527 2.4594 2.6352 2.6255 2.8852 2.6258.2446.0003.3647-.099 1.4408-1.19.9367-.9496 1.2306-1.2992 1.4536-1.7286.5966-1.149.6487-2.0513.174-3.014-.2264-.459-.4816-.7514-1.9012-2.176-.9018-.9052-1.7907-1.7496-1.9751-1.8765C10.0488.2005 9.3548.0052 8.666 0ZM3.5518 5.5737c-.2176.0031-.6097.085-.6097.3285v12.0904l.1642.175c.1123.1194.2498.1748.4342.1748.2545 0 .4436-.1738 3.349-3.0786 2.6868-2.6862 3.079-2.909 3.0791-3.305.0002-.3961-.3924-.6194-3.0784-3.306-2.8612-2.8619-3.0968-3.079-3.3384-3.079Zm13.0967.861c-.0481.0184-.112.1636-.1418.3225-.0756.403-.3719 1.109-.6572 1.5663-.1407.2253-2.2392 2.3955-5.049 5.2212-2.7513 2.7667-4.9104 4.9985-5.0468 5.2165-.4552.7275-.5967 1.3905-.4684 2.1964.222 1.3947 1.3263 2.6812 2.5486 2.9693.4667.11 1.618.0927 2.0329-.0305.2084-.062.526-.2112.7055-.3318.5023-.3373 9.341-9.0562 9.6463-9.5154.449-.6753.8356-1.0716.8395-1.9762-.0056-.5935-.1305-1.1138-1.0715-2.306-.5094-.6523-3.2341-3.3723-3.338-3.3324Z"/></svg>

frontend/public/db-icons/duckdb.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>DuckDB</title><path d="M12 0C5.363 0 0 5.363 0 12s5.363 12 12 12 12-5.363 12-12S18.637 0 12 0zM9.502 7.03a4.974 4.974 0 0 1 4.97 4.97 4.974 4.974 0 0 1-4.97 4.97A4.974 4.974 0 0 1 4.532 12a4.974 4.974 0 0 1 4.97-4.97zm6.563 3.183h2.351c.98 0 1.787.782 1.787 1.762s-.807 1.789-1.787 1.789h-2.351v-3.551z"/></svg>

frontend/public/db-icons/elasticsearch.svg

@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-15 0 286 286" width="800px" height="800px" preserveAspectRatio="xMidYMid">
+  <g>
+    <path d="M14.3443,80.1733 L203.5503,80.1733 C224.4013,80.1733 243.0203,70.6123 255.5133,55.6863 C229.4533,21.8353 188.5523,0.0003 142.5303,0.0003 C86.1783,0.0003 37.4763,32.7113 14.3443,80.1733" fill="#F0BF1A"/>
+    <path d="M187.5152,102.4438 L5.7552,102.4438 C2.0332,115.1648 0.0002,128.6068 0.0002,142.5298 C0.0002,156.4538 2.0332,169.8968 5.7552,182.6168 L187.5152,182.6168 C209.3402,182.6168 227.6022,164.8008 227.6022,142.5298 C227.6022,120.2598 209.7862,102.4438 187.5152,102.4438" fill="#07A5DE"/>
+    <path d="M255.9996,228.7548 C243.5856,214.1638 225.1166,204.8868 204.4406,204.8868 L14.3446,204.8868 C37.4766,252.3498 86.1786,285.0598 142.5296,285.0598 C188.8356,285.0598 229.9656,262.9628 255.9996,228.7548" fill="#3EBEB0"/>
+    <path d="M5.7555,102.4438 C2.0325,115.1648 0.0005,128.6068 0.0005,142.5298 C0.0005,156.4538 2.0325,169.8968 5.7555,182.6168 L124.7135,182.6168 C127.8315,170.5908 129.6125,157.2288 129.6125,142.5298 C129.6125,127.8318 127.8315,114.4698 124.7135,102.4438 L5.7555,102.4438 Z" fill="#231F20"/>
+    <path d="M70.8199,19.1528 C46.7669,33.4058 26.7239,54.7848 14.2529,80.1738 L119.3689,80.1738 C108.6789,55.6758 91.7539,35.1878 70.8199,19.1528" fill="#D7A229"/>
+    <path d="M75.274,268.1347 C95.762,251.6547 112.242,229.8297 122.487,204.8867 L14.253,204.8867 C27.615,231.6117 48.995,253.8817 75.274,268.1347" fill="#019B8F"/>
+  </g>
+</svg>

frontend/public/db-icons/iotdb.svg

@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 24.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1"
+	 id="Õ_xBA__x2264__x201E__1" xmlns:cc="http://creativecommons.org/ns#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:svg="http://www.w3.org/2000/svg"
+	 xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 107.7 107.7"
+	 style="enable-background:new 0 0 107.7 107.7;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill-rule:evenodd;clip-rule:evenodd;fill:#9E2878;}
+</style>
+<g>
+	<g id="g1133" transform="translate(-244.51235,-228.78793)">
+		<path id="path1119" class="st0" d="M340.8,253.8c2.6-1,5.5,0.4,6.2,3c0.7,2.6-1.1,5.7-3.7,6.4c-3.2,0.6-6.2-1.4-9.3,0.2
+			c-3.1,1.7-4,5.2-4.7,8.3c-1.4,5-8.5,7.3-12.1,4.2c-3.3-2.4-3.4-7.8-0.2-11c2.2-2.5,5.9-3.3,8.8-2c2.7,1.2,6,1.7,8.6-0.4
+			C337.5,260.1,336.7,255.1,340.8,253.8L340.8,253.8z"/>
+		<path id="path1121" class="st0" d="M280.5,244.7c4.2-2.2,9.5,1.5,8.2,6.1c-1.4,5.4-0.7,11.5,2.9,15.5c3.4,4,9.8,4.8,14.6,1.9
+			c3.7-2.1,6-5.8,7.4-9.6c1-3.1,0.6-6.2,1.1-9.3c1-3.8,5.8-6,9.1-4.2c3.2,1.4,4,5.9,1.7,8.8c-1.4,2.2-4.2,2.7-6.3,3.8
+			c-3.6,1.9-6.5,4.9-8.4,8.6c-1.2,2.1-1.1,4.5-1.7,6.7c-0.9,1.9-3,2.7-4.8,2.9c-4.8,0.6-9.5,3-13,6.7c-1.7,1.7-3.1,4.2-5.6,4.2
+			c-2.7-0.2-4.7-2.6-7.4-2.7c-4.9-0.7-10.2,0.7-14.4,4c-3.7,3.1-9.4,0.8-9.6-3.7c-0.9-5.1,6.2-9.5,10.1-6.2c4.3,4,10.8,5.6,16.9,3.7
+			c5.6-1.9,9.7-8.3,8.6-14c-0.9-4.9-4.2-9.3-8.6-11.4c-1.7-0.8-3.6-1.6-4.2-3.5C275.6,250.2,277.3,246.2,280.5,244.7L280.5,244.7z"
+			/>
+		<path id="path1123" class="st0" d="M277.8,235.9c2.2-0.8,4.2,1.3,3.3,3.4c-0.6,2.1-3.7,2.7-4.8,1.1
+			C275,238.9,276,236.4,277.8,235.9z"/>
+		<path id="path1125" class="st0" d="M246.9,278.8c2.2-0.8,4.2,1.2,3.3,3.4c-0.6,2.1-3.7,2.7-4.8,1C244,281.9,245,279.3,246.9,278.8
+			L246.9,278.8z"/>
+		<path id="path1127" class="st0" d="M328.2,236.2c2.2-0.7,4.2,1.3,3.3,3.5c-0.6,2-3.7,2.7-4.8,1
+			C325.4,239.2,326.3,236.8,328.2,236.2z"/>
+		<path id="path1129" class="st0" d="M253.6,257.7c0.4-3.7,5.5-5.9,8.1-3.6c1.9,1.1,1.6,3.6,2.2,5.4c0.4,2.4,2.7,4.3,5.2,4.3
+			c3.2,0.3,6.4-2.3,9.5-1.2c4.8,1.2,6.5,7.5,3.2,11.5c-2.9,4.1-9.3,4.5-12,0.7c-2.4-2.8-0.5-7.1-2.7-10.1c-1.7-2.9-5.4-2.7-8.3-1.9
+			C255.8,263.8,253,260.7,253.6,257.7L253.6,257.7z"/>
+		<path id="path1131" class="st0" d="M300.8,230c3.3-1.9,7.5,0.9,6.7,4.6c0,2.3-2.2,3.6-3.5,5.2c-1.9,1.9-2.3,4.9-1.2,7
+			c1.3,2.9,4.9,4,5.5,7.2c1.2,4.8-3.3,10.1-8.2,9.8c-4.8,0.1-8.3-5-6.3-9.5c1.2-3.8,5.8-4.9,7.2-8.5c1.7-3.2-0.4-6.1-2.4-8.1
+			C296.7,235.6,297.9,231.4,300.8,230z"/>
+	</g>
+	<g id="g1149" transform="translate(-244.51235,-228.78793)">
+		<path id="path1135" class="st0" d="M256,311.5c-2.6,1-5.5-0.4-6.2-3c-0.7-2.6,1.1-5.7,3.7-6.4c3.2-0.6,6.2,1.4,9.3-0.2
+			c3.1-1.6,4-5.1,4.7-8.2c1.4-5,8.5-7.3,12.1-4.2c3.3,2.4,3.4,7.8,0.2,10.9c-2.2,2.5-5.9,3.3-8.8,2c-2.7-1.2-6-1.7-8.6,0.4
+			C259.1,305,259.9,310.2,256,311.5L256,311.5z"/>
+		<path id="path1137" class="st0" d="M316.1,320.5c-4.2,2.2-9.5-1.5-8.2-6c1.4-5.4,0.7-11.6-2.9-15.6c-3.4-4-9.8-4.7-14.6-1.9
+			c-3.7,2-6,5.7-7.4,9.5c-1,3.1-0.6,6.2-1.1,9.3c-1,3.8-5.8,6-9.1,4.3c-3.2-1.4-4-5.9-1.7-8.9c1.4-2.2,4.2-2.7,6.3-3.8
+			c3.6-1.9,6.5-4.9,8.4-8.6c1.2-2,1.1-4.5,1.7-6.6c0.9-1.9,3-2.7,4.8-2.9c4.8-0.6,9.5-3,13-6.7c1.7-1.6,3.1-4.2,5.6-4.1
+			c2.7,0.1,4.7,2.5,7.4,2.7c4.9,0.6,10.2-0.8,14.4-4c3.7-3.2,9.4-0.9,9.6,3.6c0.9,5.1-6.2,9.5-10.1,6.2c-4.3-4-10.8-5.6-16.9-3.7
+			c-5.6,1.9-9.7,8.3-8.6,14c0.9,4.8,4.2,9.3,8.6,11.3c1.7,0.8,3.6,1.6,4.2,3.5C321.2,314.9,319.4,319.1,316.1,320.5L316.1,320.5z"/>
+		<path id="path1139" class="st0" d="M318.9,329.4c-2.2,0.8-4.2-1.3-3.3-3.4c0.6-2.1,3.7-2.7,4.8-1.1
+			C321.7,326.3,320.7,328.8,318.9,329.4z"/>
+		<path id="path1141" class="st0" d="M349.9,286.5c-2.2,0.7-4.2-1.3-3.3-3.5c0.6-2.1,3.7-2.7,4.8-1
+			C352.8,283.5,351.8,285.9,349.9,286.5z"/>
+		<path id="path1143" class="st0" d="M268.5,329c-2.2,0.7-4.2-1.3-3.3-3.5c0.6-2,3.7-2.7,4.8-1C271.3,325.9,270.3,328.5,268.5,329z"
+			/>
+		<path id="path1145" class="st0" d="M343.1,307.4c-0.4,3.7-5.5,5.9-8.1,3.6c-1.9-1.1-1.6-3.6-2.2-5.4c-0.4-2.4-2.7-4.3-5.2-4.3
+			c-3.2-0.3-6.4,2.3-9.5,1.2c-4.8-1.2-6.5-7.5-3.2-11.5c2.9-4.1,9.3-4.5,12-0.7c2.4,2.8,0.5,7,2.7,10c1.7,2.9,5.4,2.7,8.3,1.9
+			C341,301.4,343.8,304.4,343.1,307.4L343.1,307.4z"/>
+		<path id="path1147" class="st0" d="M295.8,335.2c-3.3,2-7.5-0.9-6.7-4.6c0-2.3,2.2-3.6,3.5-5.2c1.9-1.9,2.3-4.9,1.2-7
+			c-1.3-2.9-4.9-4-5.5-7.2c-1.2-4.8,3.3-10.1,8.2-9.8c4.8-0.1,8.3,5,6.3,9.6c-1.2,3.7-5.8,4.8-7.2,8.4c-1.7,3.2,0.4,6.1,2.4,8.2
+			C300,329.6,298.8,333.8,295.8,335.2L295.8,335.2z"/>
+	</g>
+</g>
+</svg>

frontend/public/db-icons/mariadb.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>MariaDB</title><path d="M23.157 4.412c-.676.284-.79.31-1.673.372-.65.045-.757.057-1.212.209-.75.246-1.395.75-2.02 1.59-.296.398-1.249 1.913-1.249 1.988 0 .057-.65.998-.915 1.32-.574.713-1.08 1.079-2.14 1.59-.77.36-1.224.524-4.102 1.477-1.073.353-2.133.738-2.367.864-.852.449-1.515 1.036-2.203 1.938-1.003 1.32-.972 1.313-3.042.947a12.264 12.264 0 00-.675-.063c-.644-.05-1.023.044-1.332.334L0 17.193l.177.088c.094.05.353.234.561.398.215.17.461.347.55.391.088.044.17.088.183.101.012.013-.089.17-.228.353-.435.581-.593.871-.574 1.048.019.164.032.17.43.17.517-.006.826-.056 1.261-.208.65-.233 2.058-.94 2.784-1.4.776-.5 1.717-.998 1.956-1.042.082-.02.354-.07.594-.114.58-.107 1.464-.095 2.587.05.108.013.373.045.6.064.227.025.43.057.454.076.026.012.474.037.998.056.934.026 1.104.007 1.3-.189.126-.133.385-.631.498-.985.209-.643.417-.921.366-.492-.113.966-.322 1.692-.713 2.411-.259.499-.663 1.092-.934 1.395-.322.347-.315.36.088.315.619-.063 1.471-.397 2.096-.82.827-.562 1.647-1.691 2.19-3.03.107-.27.22-.22.183.083-.013.094-.038.315-.057.498l-.031.328.353-.202c.833-.48 1.414-1.262 2.127-2.884.227-.518.877-2.922 1.073-3.976a9.64 9.64 0 01.271-1.042c.127-.429.196-.555.48-.858.183-.19.625-.555.978-.808.72-.505.953-.75 1.187-1.205.208-.417.284-1.13.132-1.357-.132-.202-.284-.196-.763.006Z"/></svg>

frontend/public/db-icons/mongodb.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>MongoDB</title><path d="M17.193 9.555c-1.264-5.58-4.252-7.414-4.573-8.115-.28-.394-.53-.954-.735-1.44-.036.495-.055.685-.523 1.184-.723.566-4.438 3.682-4.74 10.02-.282 5.912 4.27 9.435 4.888 9.884l.07.05A73.49 73.49 0 0111.91 24h.481c.114-1.032.284-2.056.51-3.07.417-.296.604-.463.85-.693a11.342 11.342 0 003.639-8.464c.01-.814-.103-1.662-.197-2.218zm-5.336 8.195s0-8.291.275-8.29c.213 0 .49 10.695.49 10.695-.381-.045-.765-1.76-.765-2.405z"/></svg>

frontend/public/db-icons/mqtt.svg

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 24.2.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.2" baseProfile="tiny" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px"
+	 y="0px" viewBox="0 0 1100 300" overflow="visible" xml:space="preserve">
+<g id="black_bg" display="none">
+	<rect x="-2384.9" y="-306.8" display="inline" width="4531.8" height="1152"/>
+</g>
+<g id="logos">
+	<g>
+		<path fill="#FFFFFF" d="M388,150.1c1.7,3.7,3.3,7.5,4.8,11.4c1.5-4,3.1-7.8,4.9-11.6c1.7-3.7,3.5-7.4,5.3-10.9l50.5-99.5
+			c0.9-1.7,1.8-3,2.8-4c0.9-0.9,2-1.6,3.2-2.1c1.2-0.5,2.5-0.7,4-0.7c1.5,0,3.2,0,5.2,0h34.8v196.6h-40.2V116.3
+			c0-5.5,0.3-11.4,0.8-17.8l-52.1,101.1c-1.6,3.2-3.8,5.5-6.5,7.2c-2.7,1.6-5.9,2.4-9.4,2.4h-6.2c-3.5,0-6.6-0.8-9.4-2.4
+			c-2.7-1.6-4.9-4-6.5-7.2L321.4,98.3c0.4,3.2,0.6,6.3,0.8,9.4c0.2,3.1,0.3,6,0.3,8.6v113.1h-40.2V32.8h34.8c2,0,3.7,0,5.2,0
+			c1.5,0,2.8,0.2,4,0.7c1.2,0.5,2.2,1.1,3.2,2.1c0.9,0.9,1.9,2.3,2.8,4l50.6,99.9C384.6,142.9,386.3,146.4,388,150.1z"/>
+		<path fill="#FFFFFF" d="M719.1,131c0,8.5-0.9,16.6-2.6,24.4c-1.8,7.8-4.3,15.1-7.6,21.9c-3.3,6.8-7.3,13.2-12.2,19
+			c-4.8,5.9-10.3,11-16.4,15.5l49.8,54.4h-37.5c-5.4,0-10.3-0.7-14.7-2c-4.4-1.3-8.3-3.9-11.7-7.9L641.7,229c-4,0.8-8,1.4-12.1,1.9
+			c-4.1,0.4-8.3,0.7-12.6,0.7c-15.3,0-29.2-2.6-41.8-7.7c-12.6-5.1-23.4-12.2-32.3-21.3c-9-9-15.9-19.7-20.8-31.9
+			c-4.9-12.2-7.4-25.5-7.4-39.7c0-14.2,2.5-27.4,7.4-39.7c4.9-12.2,11.8-22.9,20.8-31.9c9-9,19.7-16.1,32.3-21.2
+			c12.6-5.1,26.5-7.7,41.8-7.7c15.3,0,29.2,2.6,41.8,7.8c12.6,5.2,23.3,12.3,32.2,21.3c8.9,9,15.8,19.6,20.7,31.9
+			C716.6,103.7,719.1,116.8,719.1,131z M672.4,131c0-9.7-1.3-18.5-3.8-26.3c-2.5-7.8-6.1-14.4-10.9-19.8
+			c-4.7-5.4-10.5-9.5-17.3-12.4c-6.8-2.9-14.6-4.3-23.4-4.3c-8.8,0-16.7,1.4-23.6,4.3c-6.9,2.9-12.7,7-17.4,12.4
+			c-4.7,5.4-8.3,12-10.9,19.8c-2.5,7.8-3.8,16.5-3.8,26.3c0,9.8,1.3,18.6,3.8,26.4c2.5,7.8,6.1,14.4,10.9,19.8
+			c4.7,5.4,10.5,9.5,17.4,12.4c6.9,2.8,14.7,4.3,23.6,4.3c8.7,0,16.5-1.4,23.4-4.3c6.8-2.8,12.6-7,17.3-12.4
+			c4.7-5.4,8.3-12,10.9-19.8C671.1,149.6,672.4,140.8,672.4,131z"/>
+		<path fill="#FFFFFF" d="M865.6,32.7v36.2h-53.3v160.5h-45.6V68.9h-53.3V32.7H865.6z"/>
+		<path fill="#FFFFFF" d="M1040.1,32.7v36.2h-55.3v160.5h-45.6V68.9h-53.3V32.7H1040.1z"/>
+	</g>
+	<path fill="#FFFFFF" d="M34.9,144c-0.2,0-0.4,0-0.6,0v77.6c0,5.6,4.6,10.2,10.2,10.2h79.9C123.7,183.3,83.8,144,34.9,144z"/>
+	<path fill="#FFFFFF" d="M34.9,80c-0.2,0-0.4,0-0.6,0v33c65.9,0.3,119.5,53.3,120.2,118.8h34.2C188.1,148,119.3,80,34.9,80z"/>
+	<path fill="#FFFFFF" d="M237.2,221.7v-70.1C214,94.8,167.3,50,109.1,29H44.5c-5.6,0-10.2,4.6-10.2,10.2V49
+		c101.4,0.3,183.9,82,184.5,182.8h8.2C232.6,231.8,237.2,227.3,237.2,221.7z"/>
+	<path fill="#FFFFFF" d="M210.5,57.3c9.4,9.4,19,21.3,26.7,31.8v-50c0-5.6-4.5-10.1-10.1-10.1h-51.5
+		C187.5,37.3,199.9,46.8,210.5,57.3z"/>
+</g>
+</svg>

frontend/public/db-icons/mysql.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>MySQL</title><path d="M16.405 5.501c-.115 0-.193.014-.274.033v.013h.014c.054.104.146.18.214.273.054.107.1.214.154.32l.014-.015c.094-.066.14-.172.14-.333-.04-.047-.046-.094-.08-.14-.04-.067-.126-.1-.18-.153zM5.77 18.695h-.927a50.854 50.854 0 00-.27-4.41h-.008l-1.41 4.41H2.45l-1.4-4.41h-.01a72.892 72.892 0 00-.195 4.41H0c.055-1.966.192-3.81.41-5.53h1.15l1.335 4.064h.008l1.347-4.064h1.095c.242 2.015.384 3.86.428 5.53zm4.017-4.08c-.378 2.045-.876 3.533-1.492 4.46-.482.716-1.01 1.073-1.583 1.073-.153 0-.34-.046-.566-.138v-.494c.11.017.24.026.386.026.268 0 .483-.075.647-.222.197-.18.295-.382.295-.605 0-.155-.077-.47-.23-.944L6.23 14.615h.91l.727 2.36c.164.536.233.91.205 1.123.4-1.064.678-2.227.835-3.483zm12.325 4.08h-2.63v-5.53h.885v4.85h1.745zm-3.32.135l-1.016-.5c.09-.076.177-.158.255-.25.433-.506.648-1.258.648-2.253 0-1.83-.718-2.746-2.155-2.746-.704 0-1.254.232-1.65.697-.43.508-.646 1.256-.646 2.245 0 .972.19 1.686.574 2.14.35.41.877.615 1.583.615.264 0 .506-.033.725-.098l1.325.772.36-.622zM15.5 17.588c-.225-.36-.337-.94-.337-1.736 0-1.393.424-2.09 1.27-2.09.443 0 .77.167.977.5.224.362.336.936.336 1.723 0 1.404-.424 2.108-1.27 2.108-.445 0-.77-.167-.978-.5zm-1.658-.425c0 .47-.172.856-.516 1.156-.344.3-.803.45-1.384.45-.543 0-1.064-.172-1.573-.515l.237-.476c.438.22.833.328 1.19.328.332 0 .593-.073.783-.22a.754.754 0 00.3-.615c0-.33-.23-.61-.648-.845-.388-.213-1.163-.657-1.163-.657-.422-.307-.632-.636-.632-1.177 0-.45.157-.81.47-1.085.315-.278.72-.415 1.22-.415.512 0 .98.136 1.4.41l-.213.476a2.726 2.726 0 00-1.064-.23c-.283 0-.502.068-.654.206a.685.685 0 00-.248.524c0 .328.234.61.666.85.393.215 1.187.67 1.187.67.433.305.648.63.648 1.168zm9.382-5.852c-.535-.014-.95.04-1.297.188-.1.04-.26.04-.274.167.055.053.063.14.11.214.08.134.218.313.346.407.14.11.28.216.427.31.26.16.555.255.81.416.145.094.293.213.44.313.073.05.12.14.214.172v-.02c-.046-.06-.06-.147-.105-.214-.067-.067-.134-.127-.2-.193a3.223 3.223 0 00-.695-.675c-.214-.146-.682-.35-.77-.595l-.013-.014c.146-.013.32-.066.46-.106.227-.06.435-.047.67-.106.106-.027.213-.06.32-.094v-.06c-.12-.12-.21-.283-.334-.395a8.867 8.867 0 00-1.104-.823c-.21-.134-.476-.22-.697-.334-.08-.04-.214-.06-.26-.127-.12-.146-.19-.34-.275-.514a17.69 17.69 0 01-.547-1.163c-.12-.262-.193-.523-.34-.763-.69-1.137-1.437-1.826-2.586-2.5-.247-.14-.543-.2-.856-.274-.167-.008-.334-.02-.5-.027-.11-.047-.216-.174-.31-.235-.38-.24-1.364-.76-1.644-.072-.18.434.267.862.422 1.082.115.153.26.328.34.5.047.116.06.235.107.356.106.294.207.622.347.897.073.14.153.287.247.413.054.073.146.107.167.227-.094.136-.1.334-.154.5-.24.757-.146 1.693.194 2.25.107.166.362.534.703.393.3-.12.234-.5.32-.835.02-.08.007-.133.048-.187v.015c.094.188.188.367.274.555.206.328.566.668.867.895.16.12.287.328.487.402v-.02h-.015c-.043-.058-.1-.086-.154-.133a3.445 3.445 0 01-.35-.4 8.76 8.76 0 01-.747-1.218c-.11-.21-.202-.436-.29-.643-.04-.08-.04-.2-.107-.24-.1.146-.247.273-.32.453-.127.288-.14.642-.188 1.01-.027.007-.014 0-.027.014-.214-.052-.287-.274-.367-.46-.2-.475-.233-1.238-.06-1.785.047-.14.247-.582.167-.716-.042-.127-.174-.2-.247-.303a2.478 2.478 0 01-.24-.427c-.16-.374-.24-.788-.414-1.162-.08-.173-.22-.354-.334-.513-.127-.18-.267-.307-.368-.52-.033-.073-.08-.194-.027-.274.014-.054.042-.075.094-.09.088-.072.335.022.422.062.247.1.455.194.662.334.094.066.195.193.315.226h.14c.214.047.455.014.655.073.355.114.675.28.962.46a5.953 5.953 0 012.085 2.286c.08.154.115.295.188.455.14.33.313.663.455.982.14.315.275.636.476.897.1.14.502.213.682.286.133.06.34.115.46.188.23.14.454.3.67.454.11.076.443.243.463.378z"/></svg>

frontend/public/db-icons/qdrant.svg

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Capa_2" data-name="Capa 2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 346.42 400">
+  <defs>
+    <style>
+      .cls-1 {
+        fill: #9e0d38;
+      }
+
+      .cls-2 {
+        fill: #dc244c;
+      }
+
+      .cls-3 {
+        fill: #ff516b;
+      }
+    </style>
+  </defs>
+  <g id="Vectors">
+    <g>
+      <g>
+        <polygon class="cls-2" points="173.21 0 0 100 0 300 173.21 400 238.16 362.5 238.16 287.5 173.21 325 64.96 262.5 64.96 137.5 173.21 75 281.46 137.5 281.46 387.5 346.42 350 346.42 100 173.21 0"/>
+        <polygon class="cls-2" points="108.26 162.5 108.26 237.5 173.21 275 238.16 237.5 238.16 162.5 173.21 125 108.26 162.5"/>
+      </g>
+      <g>
+        <polygon class="cls-1" points="238.16 287.5 238.16 362.5 173.21 400 173.21 325 238.16 287.5"/>
+        <polygon class="cls-1" points="346.42 100 346.42 350 281.46 387.5 281.46 137.5 346.42 100"/>
+        <polygon class="cls-3" points="346.42 100 281.46 137.5 173.21 75 64.96 137.5 0 100 173.21 0 346.42 100"/>
+        <polygon class="cls-2" points="173.21 325 173.21 400 0 300 0 100 64.96 137.5 64.96 262.5 173.21 325"/>
+        <polygon class="cls-3" points="238.16 162.5 173.21 200 108.26 162.5 173.21 125 238.16 162.5"/>
+        <polygon class="cls-2" points="173.21 200 173.21 275 108.26 237.5 108.26 162.5 173.21 200"/>
+        <polygon class="cls-1" points="238.16 162.5 238.16 237.5 173.21 275 173.21 200 238.16 162.5"/>
+      </g>
+    </g>
+  </g>
+</svg>

frontend/public/db-icons/rabbitmq.svg

@@ -0,0 +1,7 @@
+<svg role="img" viewBox="0 0 132.29167 132.29166" xmlns="http://www.w3.org/2000/svg">
+  <title>RabbitMQ</title>
+  <path
+    d="M 127.32189 54.270409 H 84.999977 a 5.2690424 5.2690424 0 0 1 -5.302308 -5.302309 V 6.6461888 A 5.2690424 5.2690424 0 0 0 74.39536 1.3438804 H 58.555783 A 5.2690424 5.2690424 0 0 0 53.253474 6.6461888 V 48.9681 a 5.2690424 5.2690424 0 0 1 -5.302309 5.302309 H 32.111589 A 5.2690424 5.2690424 0 0 1 26.80928 48.9681 V 6.6461888 A 5.2690424 5.2690424 0 0 0 21.506972 1.3106149 H 5.6341299 A 5.2690424 5.2690424 0 0 0 0.3650864 6.6461888 V 128.31903 a 5.2690424 5.2690424 0 0 0 5.3023089 5.30231 H 127.32189 a 5.2690424 5.2690424 0 0 0 5.30231 -5.30231 V 59.572717 a 5.2690424 5.2690424 0 0 0 -5.30231 -5.302308 z m -21.17517 44.908545 a 7.9542581 7.9542581 0 0 1 -7.95425 7.987516 H 87.573659 a 7.9542581 7.9542581 0 0 1 -7.954257 -7.987516 V 88.593818 a 7.9542581 7.9542581 0 0 1 7.954257 -7.987517 h 10.618811 a 7.9542581 7.9542581 0 0 1 7.95425 7.987517 z"
+    fill="#FF6600"
+  />
+</svg>

frontend/public/db-icons/redis.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Redis</title><path d="M22.71 13.145c-1.66 2.092-3.452 4.483-7.038 4.483-3.203 0-4.397-2.825-4.48-5.12.701 1.484 2.073 2.685 4.214 2.63 4.117-.133 6.94-3.852 6.94-7.239 0-4.05-3.022-6.972-8.268-6.972-3.752 0-8.4 1.428-11.455 3.685C2.59 6.937 3.885 9.958 4.35 9.626c2.648-1.904 4.748-3.13 6.784-3.744C8.12 9.244.886 17.05 0 18.425c.1 1.261 1.66 4.648 2.424 4.648.232 0 .431-.133.664-.365a100.49 100.49 0 0 0 5.54-6.765c.222 3.104 1.748 6.898 6.014 6.898 3.819 0 7.604-2.756 9.33-8.965.2-.764-.73-1.361-1.261-.73zm-4.349-5.013c0 1.959-1.926 2.922-3.685 2.922-.941 0-1.664-.247-2.235-.568 1.051-1.592 2.092-3.225 3.21-4.973 1.972.334 2.71 1.43 2.71 2.619z"/></svg>