fix(query-editor): prevent AI inline completion from trapping cursor

♻️ perf(query-editor): 消除大库元数据下补全路径的全量扫描
延续上一轮 AI 补全卡顿修复：AI 元数据预热把整库列灌入共享缓存后，仍有三处热点会阻塞主线程——buildQueryEditorAiContext 每次请求全量重建合并 Map、普通补全 findPreloadedColumns/relevantColumns 对全量列逐条正则扫描、ghost 可见期间 scroll/layout 每帧全量重渲染 overlay。改为：AI 上下文按依赖引用相等缓存（并保持数组身份稳定使下游索引跨请求复用）、共享列按表名/标识符建 WeakMap 索引、重定位用 rAF 合并。
2026-08-25 18:21:22 +08:00 · 2026-07-07 15:10:45 +08:00 · 2026-07-06 22:25:39 +08:00 · 2026-07-06 20:29:23 +08:00 · 2026-07-06 19:36:43 +08:00 · 2026-07-06 17:40:45 +08:00
1303 changed files with 372789 additions and 34064 deletions
--- a/.containerignore
+++ b/.containerignore
@@ -0,0 +1,18 @@
+.git
+.github
+.idea
+.ace-tool
+.playwright-mcp
+.superpowers
+.worktrees
+bin
+build
+dist
+frontend/dist
+node_modules
+frontend/node_modules
+tools/__pycache__
+GoNavi-Wails
+GoNavi-Wails.exe
+optional-driver-agent
+optional-driver-agent.exe
--- a/.dockerignore
+++ b/.dockerignore
@@ -0,0 +1,18 @@
+.git
+.github
+.idea
+.ace-tool
+.playwright-mcp
+.superpowers
+.worktrees
+bin
+build
+dist
+frontend/dist
+node_modules
+frontend/node_modules
+tools/__pycache__
+GoNavi-Wails
+GoNavi-Wails.exe
+optional-driver-agent
+optional-driver-agent.exe
--- a/.github/workflows/dev-build.yml
+++ b/.github/workflows/dev-build.yml
@@ -12,12 +12,258 @@ concurrency:
 permissions:
  contents: write

-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
 jobs:
+  frontend:
+    name: Build frontend
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Cache frontend node_modules
+        uses: actions/cache@v5
+        with:
+          path: frontend/node_modules
+          key: ${{ runner.os }}-node20-frontend-${{ hashFiles('frontend/package-lock.json') }}
+
+      - name: Install Wails
+        run: go install -v github.com/wailsapp/wails/v2/cmd/wails@v2.11.0
+
+      - name: Build frontend dist
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p frontend/dist
+          printf '<!doctype html><title>GoNavi</title>\n' > frontend/dist/index.html
+          wails generate module
+          node frontend/scripts/wails-frontend-install.mjs
+          npm --prefix frontend run build
+
+      - name: Pack frontend dist
+        shell: bash
+        run: tar -cf frontend-dist.tar -C frontend/dist .
+
+      - name: Upload frontend dist
+        uses: actions/upload-artifact@v6
+        with:
+          name: frontend-dist
+          path: frontend-dist.tar
+          if-no-files-found: error
+          retention-days: 1
+
+  driver_agents:
+    name: Detect changed driver agents
+    runs-on: ubuntu-latest
+    outputs:
+      drivers: ${{ steps.detect.outputs.drivers }}
+      drivers_darwin_amd64: ${{ steps.detect.outputs.drivers_darwin_amd64 }}
+      drivers_darwin_arm64: ${{ steps.detect.outputs.drivers_darwin_arm64 }}
+      drivers_windows_amd64: ${{ steps.detect.outputs.drivers_windows_amd64 }}
+      drivers_windows_arm64: ${{ steps.detect.outputs.drivers_windows_arm64 }}
+      drivers_linux_amd64: ${{ steps.detect.outputs.drivers_linux_amd64 }}
+      drivers_linux_arm64: ${{ steps.detect.outputs.drivers_linux_arm64 }}
+      has_changes: ${{ steps.detect.outputs.has_changes }}
+      release_source: ${{ steps.detect.outputs.release_source }}
+      compare_base: ${{ steps.detect.outputs.compare_base }}
+      force_global_driver_builds: ${{ steps.detect.outputs.force_global_driver_builds }}
+      source_commit: ${{ steps.published_source.outputs.source_commit }}
+      has_manifest: ${{ steps.published_source.outputs.has_manifest }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+
+      - name: Resolve published driver release source
+        id: published_source
+        env:
+          DRIVER_RELEASE_TOKEN: ${{ secrets.DRIVER_RELEASE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          manifest_path="$RUNNER_TEMP/published-driver-manifest.json"
+          SOURCE_COMMIT="$(python3 tools/resolve-driver-release-source.py --repo Syngnat/GoNavi-DriverAgents --tag dev-latest --manifest-output "$manifest_path")"
+          echo "source_commit=${SOURCE_COMMIT}" >> "$GITHUB_OUTPUT"
+          if [[ -s "$manifest_path" ]]; then
+            echo "has_manifest=true" >> "$GITHUB_OUTPUT"
+            echo "🧭 Published dev driver release exposes revision manifest"
+          else
+            echo "has_manifest=false" >> "$GITHUB_OUTPUT"
+            echo "🧭 Published dev driver release has no revision manifest"
+          fi
+          if [[ -n "$SOURCE_COMMIT" && -s "$manifest_path" ]]; then
+            if bash ./tools/validate-driver-release-manifest.sh --commit "$SOURCE_COMMIT" --manifest "$manifest_path"; then
+              if python3 tools/validate-driver-release-assets.py --repo Syngnat/GoNavi-DriverAgents --tag dev-latest; then
+                echo "manifest_valid=true" >> "$GITHUB_OUTPUT"
+                echo "🧭 Published dev driver release manifest and actual assets are consistent with its source commit"
+              else
+                echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+                echo "⚠️ Published dev driver release assets do not match manifest; forcing full rebuild"
+              fi
+            else
+              echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+              echo "⚠️ Published dev driver release manifest is stale; forcing full rebuild"
+            fi
+          else
+            echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+          fi
+          if [[ -n "$SOURCE_COMMIT" ]]; then
+            echo "🧭 Last published dev driver release source commit: $SOURCE_COMMIT"
+          else
+            echo "🧭 Unable to resolve published dev driver release source commit; fallback to push diff base"
+          fi
+
+      - name: Detect changed driver agents
+        id: detect
+        shell: bash
+        run: |
+          set -euo pipefail
+          merge_csv() {
+            local current="$1"
+            local incoming="$2"
+            local merged="$current"
+            local seen=",${current},"
+            local item
+            IFS=',' read -r -a items <<< "$incoming"
+            for item in "${items[@]}"; do
+              item="$(printf '%s' "$item" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+              if [[ -z "$item" ]]; then
+                continue
+              fi
+              if [[ "$seen" == *",$item,"* ]]; then
+                continue
+              fi
+              if [[ -n "$merged" ]]; then
+                merged="${merged},${item}"
+              else
+                merged="$item"
+              fi
+              seen="${seen}${item},"
+            done
+            printf '%s\n' "$merged"
+          }
+
+          platform_output_key() {
+            case "$1" in
+              darwin/amd64) echo "darwin_amd64" ;;
+              darwin/arm64) echo "darwin_arm64" ;;
+              windows/amd64) echo "windows_amd64" ;;
+              windows/arm64) echo "windows_arm64" ;;
+              linux/amd64) echo "linux_amd64" ;;
+              linux/arm64) echo "linux_arm64" ;;
+              *)
+                echo "unknown platform: $1" >&2
+                return 1
+                ;;
+            esac
+          }
+
+          BASE_REF="${{ steps.published_source.outputs.source_commit }}"
+          HAS_MANIFEST="${{ steps.published_source.outputs.has_manifest }}"
+          MANIFEST_VALID="${{ steps.published_source.outputs.manifest_valid }}"
+          if [[ "$HAS_MANIFEST" != "true" ]]; then
+            echo "⚠️ Published driver release lacks revision manifest; forcing full rebuild to self-heal old assets"
+            BASE_REF="all"
+          elif [[ "$MANIFEST_VALID" != "true" ]]; then
+            echo "⚠️ Published driver release manifest is stale; forcing full rebuild to self-heal old assets"
+            BASE_REF="all"
+          fi
+          if [[ -n "$BASE_REF" ]]; then
+            if git rev-parse --verify "${BASE_REF}^{commit}" >/dev/null 2>&1 && git merge-base --is-ancestor "$BASE_REF" "$GITHUB_SHA"; then
+              echo "🧭 Using last published driver release source commit as detection base: $BASE_REF"
+            else
+              echo "⚠️ Published driver release source commit is unavailable or not an ancestor of $GITHUB_SHA: $BASE_REF"
+              BASE_REF=""
+            fi
+          fi
+
+          if [[ -z "$BASE_REF" ]]; then
+            echo "⚠️ Falling back to full driver rebuild because published driver release source commit is unavailable"
+            BASE_REF="all"
+          fi
+          echo "🧭 Final driver detection base: $BASE_REF"
+          FORCE_GLOBAL_DRIVER_BUILDS="$(bash ./tools/should-force-global-driver-builds.sh --base "$BASE_REF" --head "$GITHUB_SHA")"
+          DRIVERS="$(bash ./tools/detect-changed-driver-agents.sh --base "$BASE_REF" --head "$GITHUB_SHA")"
+          PLATFORM_OUTPUTS=()
+          PLATFORM_DIFF_FAILED=false
+          if [[ "$BASE_REF" != "all" && "$FORCE_GLOBAL_DRIVER_BUILDS" != "true" ]]; then
+            REVISION_DRIVERS=""
+            for PLATFORM in darwin/amd64 darwin/arm64 windows/amd64 windows/arm64 linux/amd64 linux/arm64; do
+              PLATFORM_KEY="$(platform_output_key "$PLATFORM")"
+              DIFF_ARGS=(bash ./tools/diff-driver-agent-revisions.sh --base "$BASE_REF" --head "$GITHUB_SHA" --platform "$PLATFORM")
+              if [[ -n "$DRIVERS" ]]; then
+                DIFF_ARGS+=(--drivers "$DRIVERS")
+              fi
+              PLATFORM_DRIVERS="$("${DIFF_ARGS[@]}")" || {
+                echo "⚠️ 平台 revision 差异对比失败（${PLATFORM}），保守回退为全量驱动重建"
+                DRIVERS="$(bash ./tools/detect-changed-driver-agents.sh --base all --head "$GITHUB_SHA")"
+                REVISION_DRIVERS=""
+                PLATFORM_DIFF_FAILED=true
+                PLATFORM_OUTPUTS=()
+                break
+              }
+              PLATFORM_OUTPUTS+=("drivers_${PLATFORM_KEY}=${PLATFORM_DRIVERS}")
+              REVISION_DRIVERS="$(merge_csv "$REVISION_DRIVERS" "$PLATFORM_DRIVERS")"
+            done
+            if [[ "$PLATFORM_DIFF_FAILED" == "false" && -n "$REVISION_DRIVERS" ]]; then
+              echo "🧭 Revision diff union drivers: $REVISION_DRIVERS"
+              DRIVERS="$(merge_csv "$DRIVERS" "$REVISION_DRIVERS")"
+            fi
+          fi
+          if [[ "$BASE_REF" == "all" || "$FORCE_GLOBAL_DRIVER_BUILDS" == "true" || "$PLATFORM_DIFF_FAILED" == "true" ]]; then
+            PLATFORM_OUTPUTS=()
+            for PLATFORM in darwin/amd64 darwin/arm64 windows/amd64 windows/arm64 linux/amd64 linux/arm64; do
+              PLATFORM_KEY="$(platform_output_key "$PLATFORM")"
+              PLATFORM_OUTPUTS+=("drivers_${PLATFORM_KEY}=${DRIVERS}")
+            done
+          elif [[ ${#PLATFORM_OUTPUTS[@]} -eq 0 ]]; then
+            for PLATFORM in darwin/amd64 darwin/arm64 windows/amd64 windows/arm64 linux/amd64 linux/arm64; do
+              PLATFORM_KEY="$(platform_output_key "$PLATFORM")"
+              PLATFORM_OUTPUTS+=("drivers_${PLATFORM_KEY}=")
+            done
+          fi
+
+          echo "drivers=${DRIVERS}" >> "$GITHUB_OUTPUT"
+          echo "compare_base=${BASE_REF}" >> "$GITHUB_OUTPUT"
+          echo "force_global_driver_builds=${FORCE_GLOBAL_DRIVER_BUILDS}" >> "$GITHUB_OUTPUT"
+          for OUTPUT_LINE in "${PLATFORM_OUTPUTS[@]}"; do
+            echo "$OUTPUT_LINE" >> "$GITHUB_OUTPUT"
+          done
+          if [ -n "$DRIVERS" ]; then
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+            echo "🧭 Changed driver agents: $DRIVERS"
+          else
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            echo "🧭 No driver-agent changes detected"
+          fi
+          if [[ "$FORCE_GLOBAL_DRIVER_BUILDS" == "true" ]]; then
+            echo "🧭 Driver build/release plumbing changed; preserve global driver rebuild set on every platform"
+          fi
+          echo "release_source=dev-latest" >> "$GITHUB_OUTPUT"
+
  build:
    name: Build ${{ matrix.platform }}
+    needs:
+      - frontend
+      - driver_agents
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
@@ -41,7 +287,7 @@ jobs:
            artifact_suffix: ""
            build_optional_agents: true
            linux_webkit: ""
-          - os: windows-latest
+          - os: windows-2025-vs2026
            platform: windows/amd64
            os_name: Windows
            arch_name: Amd64
@@ -50,7 +296,7 @@ jobs:
            artifact_suffix: ""
            build_optional_agents: true
            linux_webkit: ""
-          - os: windows-latest
+          - os: windows-2025-vs2026
            platform: windows/arm64
            os_name: Windows
            arch_name: Arm64
@@ -68,6 +314,15 @@ jobs:
            artifact_suffix: ""
            build_optional_agents: true
            linux_webkit: "4.0"
+          - os: ubuntu-22.04-arm
+            platform: linux/arm64
+            os_name: Linux
+            arch_name: Arm64
+            build_name: gonavi-build-linux-arm64
+            wails_tags: ""
+            artifact_suffix: ""
+            build_optional_agents: true
+            linux_webkit: "4.0"
          - os: ubuntu-24.04
            platform: linux/amd64
            os_name: Linux
@@ -80,21 +335,44 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5

      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
-          go-version: '1.24'
-          check-latest: true
+          go-version-file: 'go.mod'

-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Download frontend dist
+        id: download_frontend_dist
+        continue-on-error: true
+        uses: actions/download-artifact@v7
        with:
-          node-version: '20'
+          name: frontend-dist
+          path: frontend-artifact
+
+      - name: Reset failed frontend dist download
+        if: steps.download_frontend_dist.outcome != 'success'
+        shell: bash
+        run: rm -rf frontend-artifact
+
+      - name: Retry frontend dist download
+        if: steps.download_frontend_dist.outcome != 'success'
+        uses: actions/download-artifact@v7
+        with:
+          name: frontend-dist
+          path: frontend-artifact
+
+      - name: Extract frontend dist
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p frontend/dist
+          test -s frontend-artifact/frontend-dist.tar
+          tar -xf frontend-artifact/frontend-dist.tar -C frontend/dist
+          test -s frontend/dist/index.html

      - name: Install UPX (Windows)
-        if: contains(matrix.platform, 'windows')
+        if: matrix.platform == 'windows/amd64'
        shell: pwsh
        run: |
          $UPX_VERSION = "4.2.4"
@@ -130,6 +408,12 @@ jobs:

          sudo apt-get install -y libfuse2 || sudo apt-get install -y libfuse2t64 || true

+          if [ "${{ matrix.arch_name }}" != "Amd64" ]; then
+            echo "⚠️ Linux arm64 暂不生成 AppImage，仅产出 tar.gz"
+            touch /tmp/skip-appimage
+            exit 0
+          fi
+
          LINUXDEPLOY_URL="https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage"
          PLUGIN_URL="https://github.com/linuxdeploy/linuxdeploy-plugin-gtk/releases/download/continuous/linuxdeploy-plugin-gtk-x86_64.AppImage"

@@ -153,11 +437,11 @@ jobs:
          fi

      - name: Install Wails
-        run: go install -v github.com/wailsapp/wails/v2/cmd/wails@latest
+        run: go install -v github.com/wailsapp/wails/v2/cmd/wails@v2.11.0

      - name: Setup MSYS2 Toolchain For DuckDB (Windows AMD64)
        id: msys2_duckdb
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
+        if: ${{ matrix.platform == 'windows/amd64' }}
        continue-on-error: true
        uses: msys2/setup-msys2@v2
        with:
@@ -165,9 +449,10 @@ jobs:
          update: true
          install: >-
            mingw-w64-ucrt-x86_64-gcc
+            mingw-w64-ucrt-x86_64-binutils

      - name: Configure DuckDB CGO Toolchain (Windows AMD64)
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
+        if: ${{ matrix.platform == 'windows/amd64' }}
        shell: pwsh
        run: |
          function Find-MingwBin([string[]]$candidates) {
@@ -225,7 +510,7 @@ jobs:
          Write-Host "✅ 已配置 DuckDB cgo 编译器: gcc=$gcc g++=$gxx"

      - name: Verify DuckDB CGO Toolchain (Windows AMD64)
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
+        if: ${{ matrix.platform == 'windows/amd64' }}
        shell: pwsh
        run: |
          & "$env:CC" --version
@@ -246,58 +531,274 @@ jobs:
        run: |
          set -euo pipefail
          DEV_VERSION="${{ steps.version.outputs.version }}"
+          echo "🧭 为 ${{ matrix.platform }} 全量生成 driver-agent revision 指纹，避免跨平台沿用旧 revision"
          ./tools/generate-driver-agent-revisions.sh --platform "${{ matrix.platform }}"
+          REVISION_HASH="$(python3 - <<'PY'
+          import hashlib
+          from pathlib import Path
+
+          print(hashlib.sha256(Path("internal/db/driver_agent_revisions_gen.go").read_bytes()).hexdigest())
+          PY
+          )"
+          export GOCACHE="${RUNNER_TEMP}/go-build-${{ matrix.os_name }}-${{ matrix.arch_name }}-${REVISION_HASH}"
+          mkdir -p "$GOCACHE"
+          echo "🧭 使用隔离 GOCACHE：$GOCACHE"
          if [ -n "${{ matrix.wails_tags }}" ]; then
-            wails build -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -tags "${{ matrix.wails_tags }}" -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${DEV_VERSION}"
+            wails build -s -skipbindings -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -tags "${{ matrix.wails_tags }}" -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${DEV_VERSION}"
          else
-            wails build -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${DEV_VERSION}"
+            wails build -s -skipbindings -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${DEV_VERSION}"
+          fi
+
+      - name: Select Platform Driver Set
+        id: platform_drivers
+        if: ${{ matrix.build_optional_agents && needs.driver_agents.outputs.has_changes == 'true' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          case "${{ matrix.platform }}" in
+            darwin/amd64)
+              DRIVERS='${{ needs.driver_agents.outputs.drivers_darwin_amd64 }}'
+              ;;
+            darwin/arm64)
+              DRIVERS='${{ needs.driver_agents.outputs.drivers_darwin_arm64 }}'
+              ;;
+            windows/amd64)
+              DRIVERS='${{ needs.driver_agents.outputs.drivers_windows_amd64 }}'
+              ;;
+            windows/arm64)
+              DRIVERS='${{ needs.driver_agents.outputs.drivers_windows_arm64 }}'
+              ;;
+            linux/amd64)
+              DRIVERS='${{ needs.driver_agents.outputs.drivers_linux_amd64 }}'
+              ;;
+            linux/arm64)
+              DRIVERS='${{ needs.driver_agents.outputs.drivers_linux_arm64 }}'
+              ;;
+            *)
+              echo "unsupported platform: ${{ matrix.platform }}" >&2
+              exit 1
+              ;;
+          esac
+          echo "drivers=${DRIVERS}" >> "$GITHUB_OUTPUT"
+          if [[ -n "$DRIVERS" ]]; then
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+            echo "🧭 当前平台最终需要重建的 driver agents: ${DRIVERS}"
+          else
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            echo "🧭 当前平台无需重建 driver agents"
          fi

      - name: Build Optional Driver Agents
-        if: ${{ matrix.build_optional_agents }}
+        if: ${{ matrix.build_optional_agents && steps.platform_drivers.outputs.has_changes == 'true' }}
        shell: bash
+        env:
+          CHANGED_DRIVER_AGENTS: ${{ steps.platform_drivers.outputs.drivers }}
        run: |
          set -euo pipefail
          TARGET_PLATFORM="${{ matrix.platform }}"
          GOOS="${TARGET_PLATFORM%%/*}"
          GOARCH="${TARGET_PLATFORM##*/}"
-          DRIVERS=(mariadb doris sphinx sqlserver sqlite duckdb dameng kingbase highgo vastbase mongodb tdengine clickhouse)
+          REVISION_HASH="$(python3 - <<'PY'
+          import hashlib
+          from pathlib import Path
+
+          print(hashlib.sha256(Path("internal/db/driver_agent_revisions_gen.go").read_bytes()).hexdigest())
+          PY
+          )"
+          export GOCACHE="${RUNNER_TEMP}/go-build-${{ matrix.os_name }}-${{ matrix.arch_name }}-${REVISION_HASH}"
+          mkdir -p "$GOCACHE"
+          echo "🧭 可选驱动使用隔离 GOCACHE：$GOCACHE"
+          normalize_driver_token() {
+            local value
+            value="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+            case "$value" in
+              "") return 1 ;;
+              doris|diros) echo "doris" ;;
+              open_gauss|open-gauss) echo "opengauss" ;;
+              gaussdb|gauss_db|gauss-db) echo "gaussdb" ;;
+              elastic|elasticsearch) echo "elasticsearch" ;;
+              mariadb|oceanbase|starrocks|sphinx|sqlserver|sqlite|duckdb|dameng|kingbase|highgo|vastbase|opengauss|gaussdb|iris|mongodb|tdengine|iotdb|clickhouse)
+                echo "$value"
+                ;;
+              *)
+                echo "❌ 不支持的 driver-agent：${1:-}" >&2
+                return 1
+                ;;
+            esac
+          }
+
+          build_driver_name() {
+            case "$1" in
+              doris) echo "diros" ;;
+              *) echo "$1" ;;
+            esac
+          }
+
+          declare -a RAW_DRIVERS=()
+          declare -a DRIVERS=()
+          IFS=',' read -r -a RAW_DRIVERS <<< "$CHANGED_DRIVER_AGENTS"
+          for RAW_DRIVER in "${RAW_DRIVERS[@]}"; do
+            DRIVER="$(normalize_driver_token "$RAW_DRIVER")" || continue
+            DRIVERS+=("$DRIVER")
+          done
+          if [ ${#DRIVERS[@]} -eq 0 ]; then
+            echo "🧭 没有需要构建的 driver-agent"
+            exit 0
+          fi
+          NORMALIZED_CHANGED_DRIVER_AGENTS="$(IFS=,; echo "${DRIVERS[*]}")"
+          echo "🧭 归一后的 driver-agent 构建列表：${NORMALIZED_CHANGED_DRIVER_AGENTS}"
          OUTDIR="drivers/${{ matrix.os_name }}"
          mkdir -p "$OUTDIR"
+          DUCKDB_WINDOWS_LIBRARY_VERSION="v1.4.4"
+          DUCKDB_WINDOWS_LIBRARY_URL="https://github.com/duckdb/duckdb/releases/download/${DUCKDB_WINDOWS_LIBRARY_VERSION}/libduckdb-windows-amd64.zip"
+
+          prepare_duckdb_windows_library() {
+            local lib_dir="$RUNNER_TEMP/duckdb-windows-${DUCKDB_WINDOWS_LIBRARY_VERSION}"
+            local extract_dir="$RUNNER_TEMP/duckdb-windows-extract-${DUCKDB_WINDOWS_LIBRARY_VERSION}"
+            local zip_path="$RUNNER_TEMP/libduckdb-windows-amd64.zip"
+            if [ -f "$lib_dir/duckdb.dll" ] && [ -f "$lib_dir/libduckdb.dll.a" ] && [ -f "$lib_dir/libduckdb.a" ]; then
+              echo "$lib_dir"
+              return 0
+            fi
+            mkdir -p "$lib_dir"
+            rm -rf "$extract_dir"
+            rm -f "$zip_path"
+            local attempt dll_path
+            for attempt in 1 2 3; do
+              echo "📥 下载 DuckDB Windows 动态库 (${attempt}/3): ${DUCKDB_WINDOWS_LIBRARY_URL}" >&2
+              if curl --retry 3 --retry-delay 2 --retry-all-errors --connect-timeout 20 --max-time 300 -fsSL "$DUCKDB_WINDOWS_LIBRARY_URL" -o "$zip_path"; then
+                if unzip -tq "$zip_path" >/dev/null 2>&1; then
+                  rm -rf "$lib_dir"
+                  rm -rf "$extract_dir"
+                  mkdir -p "$lib_dir"
+                  mkdir -p "$extract_dir"
+                  unzip -qo "$zip_path" -d "$extract_dir"
+                  dll_path="$(find "$extract_dir" -type f -name duckdb.dll | head -n 1 || true)"
+                  if [ -n "$dll_path" ]; then
+                    cp "$dll_path" "$lib_dir/duckdb.dll"
+                    go run ./cmd/mingw-import-lib \
+                      --dll "$lib_dir/duckdb.dll" \
+                      --output-lib "$lib_dir/libduckdb.dll.a"
+                    cp "$lib_dir/libduckdb.dll.a" "$lib_dir/libduckdb.a"
+                    rm -rf "$extract_dir"
+                    echo "$lib_dir"
+                    return 0
+                  fi
+                  echo "⚠️ DuckDB Windows 动态库压缩包缺少 duckdb.dll，准备重试" >&2
+                else
+                  echo "⚠️ DuckDB Windows 动态库压缩包校验失败，准备重试" >&2
+                fi
+              else
+                echo "⚠️ DuckDB Windows 动态库下载失败，准备重试" >&2
+              fi
+              rm -f "$zip_path"
+              rm -rf "$lib_dir"
+              rm -rf "$extract_dir"
+              mkdir -p "$lib_dir"
+              sleep $((attempt * 2))
+            done
+            echo "❌ 无法准备 DuckDB Windows 动态库：${DUCKDB_WINDOWS_LIBRARY_URL}" >&2
+            return 1
+          }

          for DRIVER in "${DRIVERS[@]}"; do
-            BUILD_DRIVER="$DRIVER"
-            if [ "$DRIVER" = "doris" ]; then
-              BUILD_DRIVER="diros"
-            fi
+            BUILD_DRIVER="$(build_driver_name "$DRIVER")"
            if [ "$DRIVER" = "duckdb" ] && [ "$GOOS" = "windows" ] && [ "$GOARCH" != "amd64" ]; then
              echo "⚠️ 跳过 DuckDB driver（当前平台 ${GOOS}/${GOARCH} 不受支持，仅支持 windows/amd64）"
              continue
            fi
-            TAG="gonavi_${BUILD_DRIVER}_driver"
-            OUTPUT="${DRIVER}-driver-agent-${GOOS}-${GOARCH}"
-            if [ "$GOOS" = "windows" ]; then
-              OUTPUT="${OUTPUT}.exe"
-            fi
-            OUTPUT_PATH="${OUTDIR}/${OUTPUT}"
-            echo "🔧 构建 ${OUTPUT_PATH} (tag=${TAG})"
-            if [ "$DRIVER" = "duckdb" ]; then
-              CGO_ENABLED=1 GOOS="$GOOS" GOARCH="$GOARCH" go build \
-                -tags "${TAG}" \
-                -trimpath \
-                -ldflags "-s -w" \
-                -o "${OUTPUT_PATH}" \
-                ./cmd/optional-driver-agent
-            else
-              CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" go build \
-                -tags "${TAG}" \
-                -trimpath \
-                -ldflags "-s -w" \
-                -o "${OUTPUT_PATH}" \
-                ./cmd/optional-driver-agent
+            DRIVER_VARIANTS=("")
+            if [ "$DRIVER" = "mongodb" ]; then
+              DRIVER_VARIANTS=("v1" "v2" "")
            fi
+            for DRIVER_VARIANT in "${DRIVER_VARIANTS[@]}"; do
+              TAG="gonavi_${BUILD_DRIVER}_driver"
+              BUILD_TAGS="$TAG"
+              OUTPUT_STEM="${DRIVER}-driver-agent"
+              if [ "$DRIVER" = "mongodb" ]; then
+                if [ "$DRIVER_VARIANT" = "v1" ]; then
+                  BUILD_TAGS="gonavi_mongodb_driver_v1"
+                  OUTPUT_STEM="mongodb-driver-agent-v1"
+                elif [ "$DRIVER_VARIANT" = "v2" ]; then
+                  BUILD_TAGS="gonavi_mongodb_driver"
+                  OUTPUT_STEM="mongodb-driver-agent-v2"
+                else
+                  BUILD_TAGS="gonavi_mongodb_driver"
+                fi
+              fi
+              OUTPUT="${OUTPUT_STEM}-${GOOS}-${GOARCH}"
+              if [ "$GOOS" = "windows" ]; then
+                OUTPUT="${OUTPUT}.exe"
+              fi
+              OUTPUT_PATH="${OUTDIR}/${OUTPUT}"
+              DUCKDB_LIB_DIR=""
+              if [ "$DRIVER" = "duckdb" ] && [ "$GOOS" = "windows" ] && [ "$GOARCH" = "amd64" ]; then
+                DUCKDB_LIB_DIR="$(prepare_duckdb_windows_library)"
+                BUILD_TAGS="${BUILD_TAGS} duckdb_use_lib"
+              fi
+              echo "🔧 构建 ${OUTPUT_PATH} (tags=${BUILD_TAGS})"
+              if [ "$DRIVER" = "duckdb" ]; then
+                if [ -n "$DUCKDB_LIB_DIR" ]; then
+                  DUCKDB_LIB_DIR_GCC="$(cygpath -m "$DUCKDB_LIB_DIR")"
+                  DUCKDB_LIB_DIR_PATH="$(cygpath -u "$DUCKDB_LIB_DIR")"
+                  # cgo 会把每个 CGO_LDFLAGS 片段转成 //go:cgo_ldflag，-L 参数不能再额外包引号。
+                  DUCKDB_WINDOWS_CGO_LDFLAGS="-L${DUCKDB_LIB_DIR_GCC} -lduckdb -lstdc++ -lm -lws2_32 -lwsock32 -lrstrtmgr"
+                  CGO_ENABLED=1 GOOS="$GOOS" GOARCH="$GOARCH" CGO_LDFLAGS="${DUCKDB_WINDOWS_CGO_LDFLAGS}" PATH="${DUCKDB_LIB_DIR_PATH}:$PATH" go build \
+                    -tags "${BUILD_TAGS}" \
+                    -trimpath \
+                    -ldflags "-s -w" \
+                    -o "${OUTPUT_PATH}" \
+                    ./cmd/optional-driver-agent
+                  cp "$DUCKDB_LIB_DIR/duckdb.dll" "$OUTDIR/duckdb.dll"
+                  bash ./tools/compress-driver-artifact.sh "$OUTDIR/duckdb.dll" "$TARGET_PLATFORM" "${{ matrix.os_name }}/duckdb.dll"
+                else
+                  CGO_ENABLED=1 GOOS="$GOOS" GOARCH="$GOARCH" go build \
+                    -tags "${BUILD_TAGS}" \
+                    -trimpath \
+                    -ldflags "-s -w" \
+                    -o "${OUTPUT_PATH}" \
+                    ./cmd/optional-driver-agent
+                fi
+              else
+                CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" go build \
+                  -tags "${BUILD_TAGS}" \
+                  -trimpath \
+                  -ldflags "-s -w" \
+                  -o "${OUTPUT_PATH}" \
+                  ./cmd/optional-driver-agent
+              fi
+              bash ./tools/compress-driver-artifact.sh "${OUTPUT_PATH}" "$TARGET_PLATFORM" "${{ matrix.os_name }}/${OUTPUT}"
+              if [ "$DRIVER" = "duckdb" ] && [ -n "$DUCKDB_LIB_DIR" ]; then
+                DUCKDB_ZIP_PATH="${OUTDIR}/duckdb-driver.zip"
+                export DUCKDB_ZIP_PATH
+                export DUCKDB_AGENT_PATH="${OUTPUT_PATH}"
+                export DUCKDB_DLL_PATH="${OUTDIR}/duckdb.dll"
+              python3 - <<'PY'
+          import os
+          import zipfile
+
+          zip_path = os.environ["DUCKDB_ZIP_PATH"]
+          entries = [
+              ("Windows/duckdb-driver-agent-windows-amd64.exe", os.environ["DUCKDB_AGENT_PATH"]),
+              ("Windows/duckdb.dll", os.environ["DUCKDB_DLL_PATH"]),
+          ]
+
+          with zipfile.ZipFile(zip_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
+              for arcname, src in entries:
+                  if not os.path.isfile(src):
+                      raise FileNotFoundError(src)
+                  zf.write(src, arcname)
+          PY
+                echo "📦 已生成 DuckDB Windows 专属驱动包: ${DUCKDB_ZIP_PATH}"
+              fi
+            done
          done

+          bash ./tools/verify-driver-agent-revisions.sh \
+            --assets-dir drivers \
+            --platform "$TARGET_PLATFORM" \
+            --drivers "$NORMALIZED_CHANGED_DRIVER_AGENTS"
+
      # macOS Packaging
      - name: Package macOS DMG
        if: contains(matrix.platform, 'darwin')
@@ -491,7 +992,7 @@ jobs:
          fi

      - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
        with:
          name: dev-build-artifacts-${{ strategy.job-index }}
          path: |
@@ -505,11 +1006,16 @@ jobs:
  # 汇总所有产物并发布为 Pre-release
  release:
    name: Publish Dev Pre-release
-    needs: build
+    needs:
+      - build
+      - driver_agents
    runs-on: ubuntu-latest
    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
      - name: Download All Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
        with:
          path: release-assets
          pattern: dev-build-artifacts-*
@@ -518,57 +1024,45 @@ jobs:
      - name: List Assets
        run: ls -R release-assets

+      - name: Complete Driver Agent Assets
+        if: needs.driver_agents.outputs.has_changes == 'true'
+        env:
+          DRIVER_RELEASE_TOKEN: ${{ secrets.DRIVER_RELEASE_TOKEN }}
+        run: |
+          python3 tools/complete-driver-release-assets.py \
+            --assets-dir release-assets \
+            --source "${{ needs.driver_agents.outputs.release_source }}" \
+            --require-complete
+
      - name: Package Driver Agents Bundle
+        id: driver_assets
        shell: bash
        run: |
          set -euo pipefail
          cd release-assets
          if [ ! -d drivers ]; then
            echo "⚠️ 未找到 drivers 目录，跳过驱动总包打包"
+            echo "has_driver_assets=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if [ -z "$(find drivers -type f 2>/dev/null | head -n 1)" ]; then
            echo "⚠️ drivers 目录为空，跳过驱动总包打包"
            rm -rf drivers
+            echo "has_driver_assets=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "📦 打包驱动总包：GoNavi-DriverAgents.zip"
-          python3 - <<'PY'
-          import json
-          import os
-          import zipfile
-          from pathlib import Path
+          python3 ../tools/package-driver-release-assets.py \
+            drivers \
+            ../driver-release-assets

-          out_name = "GoNavi-DriverAgents.zip"
-          index_name = "GoNavi-DriverAgents-Index.json"
-          base = Path("drivers")
-          out_path = Path(out_name)
-          index_path = Path(index_name)
-          if out_path.exists():
-              out_path.unlink()
-          if index_path.exists():
-              index_path.unlink()
-
-          size_index = {}
-          with zipfile.ZipFile(out_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
-              for p in base.rglob("*"):
-                  if not p.is_file():
-                      continue
-                  arcname = p.relative_to(base).as_posix()
-                  zf.write(p, arcname)
-                  size_index[p.name] = p.stat().st_size
-
-          index_path.write_text(
-              json.dumps({"assets": size_index}, ensure_ascii=False, indent=2),
-              encoding="utf-8",
-          )
-
-          print(f"created {out_name} size={out_path.stat().st_size} bytes")
-          print(f"created {index_name} entries={len(size_index)}")
-          PY
+          python3 ../tools/generate-driver-release-manifest.py \
+            --assets-dir drivers \
+            --output ../driver-release-assets/GoNavi-DriverAgents-Manifest.json

          rm -rf drivers
+          echo "has_driver_assets=true" >> "$GITHUB_OUTPUT"

      - name: Generate SHA256SUMS
        shell: bash
@@ -587,6 +1081,23 @@ jobs:
            sha256sum "${FILES[@]}" > SHA256SUMS
          fi

+      - name: Generate Driver SHA256SUMS
+        if: steps.driver_assets.outputs.has_driver_assets == 'true'
+        shell: bash
+        run: |
+          cd driver-release-assets
+          FILES=()
+          while IFS= read -r file; do
+            if [ -n "$file" ]; then
+              FILES+=("$file")
+            fi
+          done < <(find . -maxdepth 1 -type f ! -name SHA256SUMS -exec basename {} \; | sort)
+          if [ ${#FILES[@]} -eq 0 ]; then
+            echo "❌ 未找到驱动发布资产"
+            exit 1
+          fi
+          sha256sum "${FILES[@]}" > SHA256SUMS
+
      - name: Generate Dev Version
        id: version
        run: |
@@ -610,7 +1121,7 @@ jobs:

      # 删除旧的 dev pre-release（保持只有最新一个）
      - name: Reset Previous Dev Release
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
@@ -645,15 +1156,90 @@ jobs:
              });
              core.info(`Deleted ref ${ref}`);
            } catch (error) {
-              if (error.status === 404) {
+              const message = String(error.response?.data?.message || error.message || '');
+              if (error.status === 404 || (error.status === 422 && message.includes('Reference does not exist'))) {
                core.info(`No existing ref found for ${ref}`);
              } else {
                throw error;
              }
            }

+      - name: Reset Previous Driver Dev Release
+        if: steps.driver_assets.outputs.has_driver_assets == 'true'
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{ secrets.DRIVER_RELEASE_TOKEN }}
+          script: |
+            const tag = 'dev-latest';
+            const ref = `tags/${tag}`;
+            const [owner, repo] = 'Syngnat/GoNavi-DriverAgents'.split('/');
+            const releases = await github.paginate(github.rest.repos.listReleases, {
+              owner,
+              repo,
+              per_page: 100,
+            });
+
+            const matchedReleases = releases.filter((release) => release.tag_name === tag);
+            if (matchedReleases.length === 0) {
+              core.info(`No existing driver releases found for tag ${tag}`);
+            } else {
+              for (const release of matchedReleases) {
+                core.info(`Deleting driver release ${release.id} (${release.name || 'unnamed'}) for tag ${tag}`);
+                await github.rest.repos.deleteRelease({
+                  owner,
+                  repo,
+                  release_id: release.id,
+                });
+              }
+            }
+
+            try {
+              await github.rest.git.deleteRef({
+                owner,
+                repo,
+                ref,
+              });
+              core.info(`Deleted driver ref ${ref}`);
+            } catch (error) {
+              const message = String(error.response?.data?.message || error.message || '');
+              if (error.status === 404 || (error.status === 422 && message.includes('Reference does not exist'))) {
+                core.info(`No existing driver ref found for ${ref}`);
+              } else {
+                throw error;
+              }
+            }
+
+      - name: Create Dev Driver Agents Pre-release
+        if: steps.driver_assets.outputs.has_driver_assets == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.DRIVER_RELEASE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -t DRIVER_RELEASE_ASSETS < <(find driver-release-assets -maxdepth 1 -type f | sort)
+          if [ ${#DRIVER_RELEASE_ASSETS[@]} -eq 0 ]; then
+            echo "未找到 driver release assets"
+            exit 1
+          fi
+
+          NOTES_FILE="$RUNNER_TEMP/dev-driver-release-notes.md"
+          cat > "$NOTES_FILE" <<'EOF'
+            GoNavi dev driver-agent assets.
+
+            **版本**: `${{ steps.version.outputs.version }}`
+            **来源仓库**: `${{ github.repository }}`
+            **提交**: [`${{ github.sha }}`](${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }})
+          EOF
+
+          gh release create dev-latest "${DRIVER_RELEASE_ASSETS[@]}" \
+            --repo Syngnat/GoNavi-DriverAgents \
+            --title "GoNavi Driver Agents (${{ steps.version.outputs.version }})" \
+            --notes-file "$NOTES_FILE" \
+            --prerelease \
+            --latest=false
+
      - name: Create Dev Pre-release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
        with:
          tag_name: dev-latest
          name: "🧪 Dev Build (${{ steps.version.outputs.version }})"
--- a/.github/workflows/docker-images.yml
+++ b/.github/workflows/docker-images.yml
@@ -0,0 +1,204 @@
+name: Docker Images
+
+on:
+  push:
+    branches:
+      - dev
+    tags:
+      - 'v*'
+
+concurrency:
+  group: docker-images-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    name: Build ${{ matrix.image_name }} (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        image_name:
+          - gonavi-mcp-server
+          - gonavi-build-env
+        platform:
+          - linux/amd64
+          - linux/arm64
+        include:
+          - image_name: gonavi-mcp-server
+            dockerfile: Dockerfile.mcp-server
+            description: GoNavi MCP Server container image
+          - image_name: gonavi-build-env
+            dockerfile: Dockerfile.build-env
+            description: GoNavi Linux build environment image
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Prepare build variables
+        id: prep
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "owner_lc=$(printf '%s' "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
+          echo "platform_pair=$(printf '%s' "${{ matrix.platform }}" | tr '/' '-')" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ steps.prep.outputs.owner_lc }}/${{ matrix.image_name }}
+          labels: |
+            org.opencontainers.image.title=${{ matrix.image_name }}
+            org.opencontainers.image.description=${{ matrix.description }}
+
+      - name: Build smoke image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          platforms: ${{ matrix.platform }}
+          load: true
+          tags: codex-smoke/${{ matrix.image_name }}:local
+          cache-from: type=gha,scope=${{ matrix.image_name }}-${{ steps.prep.outputs.platform_pair }}
+
+      - name: Smoke test MCP Server image
+        if: matrix.image_name == 'gonavi-mcp-server'
+        shell: bash
+        run: |
+          set -euo pipefail
+          cid="$(docker run -d -p 8765:8765 -e GONAVI_MCP_HTTP_TOKEN=smoke-token codex-smoke/${{ matrix.image_name }}:local http)"
+          trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
+          for _ in 1 2 3 4 5 6 7 8 9 10; do
+            if curl --fail --silent http://127.0.0.1:8765/healthz >/dev/null; then
+              exit 0
+            fi
+            sleep 1
+          done
+          docker logs "$cid"
+          echo "MCP Server image smoke test failed" >&2
+          exit 1
+
+      - name: Smoke test build environment image
+        if: matrix.image_name == 'gonavi-build-env'
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm codex-smoke/${{ matrix.image_name }}:local \
+            bash -lc 'go version && node -v && npm -v && wails version'
+
+      - name: Push by digest
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
+          tags: ghcr.io/${{ steps.prep.outputs.owner_lc }}/${{ matrix.image_name }}
+          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=${{ matrix.image_name }}-${{ steps.prep.outputs.platform_pair }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.image_name }}-${{ steps.prep.outputs.platform_pair }}
+
+      - name: Export digest
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "${{ runner.temp }}/digests"
+          digest="${{ steps.push.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ matrix.image_name }}-${{ steps.prep.outputs.platform_pair }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    name: Publish ${{ matrix.image_name }}
+    runs-on: ubuntu-latest
+    needs: build
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image_name: gonavi-mcp-server
+            description: GoNavi MCP Server container image
+          - image_name: gonavi-build-env
+            description: GoNavi Linux build environment image
+    steps:
+      - name: Normalize image namespace
+        id: vars
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "owner_lc=$(printf '%s' "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
+
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-${{ matrix.image_name }}-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ steps.vars.outputs.owner_lc }}/${{ matrix.image_name }}
+          flavor: |
+            latest=false
+          tags: |
+            type=raw,value=dev-latest,enable=${{ github.ref == 'refs/heads/dev' }}
+            type=sha,format=short,prefix=dev-,enable=${{ github.ref == 'refs/heads/dev' }}
+            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+          labels: |
+            org.opencontainers.image.title=${{ matrix.image_name }}
+            org.opencontainers.image.description=${{ matrix.description }}
+
+      - name: Create manifest list and push
+        working-directory: ${{ runner.temp }}/digests
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf 'ghcr.io/${{ steps.vars.outputs.owner_lc }}/${{ matrix.image_name }}@sha256:%s ' *)
+
+      - name: Inspect image
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker buildx imagetools inspect "ghcr.io/${{ steps.vars.outputs.owner_lc }}/${{ matrix.image_name }}:${{ steps.meta.outputs.version }}"
--- a/.github/workflows/release-winget.yml
+++ b/.github/workflows/release-winget.yml
@@ -1,25 +0,0 @@
-name: Publish to WinGet
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-    inputs:
-      release_tag:
-        required: true
-        description: 'Tag of release you want to publish'
-        type: string
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
-jobs:
-  publish:
-    runs-on: windows-latest
-    steps:
-      - uses: vedantmgoyal9/winget-releaser@v2
-        with:
-          identifier: Syngnat.GoNavi
-          installers-regex: 'GoNavi-windows-(amd64|arm64)\.exe$'
-          release-tag: ${{ inputs.release_tag || github.ref_name }}
-          token: ${{ secrets.WINGET_TOKEN }}
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,13 +8,211 @@ on:
 permissions:
  contents: write

-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-
 jobs:
+  frontend:
+    name: Build frontend
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Cache frontend node_modules
+        uses: actions/cache@v5
+        with:
+          path: frontend/node_modules
+          key: ${{ runner.os }}-node20-frontend-${{ hashFiles('frontend/package-lock.json') }}
+
+      - name: Install Wails
+        run: go install -v github.com/wailsapp/wails/v2/cmd/wails@v2.11.0
+
+      - name: Build frontend dist
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p frontend/dist
+          printf '<!doctype html><title>GoNavi</title>\n' > frontend/dist/index.html
+          wails generate module
+          node frontend/scripts/wails-frontend-install.mjs
+          npm --prefix frontend run build
+
+      - name: Pack frontend dist
+        shell: bash
+        run: tar -cf frontend-dist.tar -C frontend/dist .
+
+      - name: Upload frontend dist
+        uses: actions/upload-artifact@v6
+        with:
+          name: frontend-dist
+          path: frontend-dist.tar
+          if-no-files-found: error
+          retention-days: 1
+
+  driver_agents:
+    name: Detect changed driver agents
+    runs-on: ubuntu-latest
+    outputs:
+      drivers: ${{ steps.detect.outputs.drivers }}
+      has_changes: ${{ steps.detect.outputs.has_changes }}
+      release_source: ${{ steps.detect.outputs.release_source }}
+      compare_base: ${{ steps.detect.outputs.compare_base }}
+      force_global_driver_builds: ${{ steps.detect.outputs.force_global_driver_builds }}
+      published_source_commit: ${{ steps.published_source.outputs.source_commit }}
+      has_manifest: ${{ steps.published_source.outputs.has_manifest }}
+      manifest_valid: ${{ steps.published_source.outputs.manifest_valid }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Resolve published driver release source
+        id: published_source
+        env:
+          DRIVER_RELEASE_TOKEN: ${{ secrets.DRIVER_RELEASE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          PREV_TAG="$(git describe --tags --match 'v*' --abbrev=0 "${GITHUB_SHA}^" 2>/dev/null || true)"
+          manifest_path="$RUNNER_TEMP/published-driver-manifest.json"
+          if [[ -z "$PREV_TAG" ]]; then
+            echo "source_commit=" >> "$GITHUB_OUTPUT"
+            echo "has_manifest=false" >> "$GITHUB_OUTPUT"
+            echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+            echo "🧭 No previous stable tag found; full rebuild will be used"
+            exit 0
+          fi
+          SOURCE_COMMIT="$(python3 tools/resolve-driver-release-source.py --repo Syngnat/GoNavi-DriverAgents --tag "$PREV_TAG" --manifest-output "$manifest_path")"
+          echo "source_commit=${SOURCE_COMMIT}" >> "$GITHUB_OUTPUT"
+          if [[ -s "$manifest_path" ]]; then
+            echo "has_manifest=true" >> "$GITHUB_OUTPUT"
+            echo "🧭 Published driver release exposes revision manifest"
+          else
+            echo "has_manifest=false" >> "$GITHUB_OUTPUT"
+            echo "🧭 Published driver release has no revision manifest"
+          fi
+          if [[ -n "$SOURCE_COMMIT" && -s "$manifest_path" ]]; then
+            if bash ./tools/validate-driver-release-manifest.sh --commit "$SOURCE_COMMIT" --manifest "$manifest_path"; then
+              if python3 tools/validate-driver-release-assets.py --repo Syngnat/GoNavi-DriverAgents --tag "$PREV_TAG"; then
+                echo "manifest_valid=true" >> "$GITHUB_OUTPUT"
+                echo "🧭 Published driver release manifest and actual assets are consistent with its source commit"
+              else
+                echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+                echo "⚠️ Published driver release assets do not match manifest; forcing full rebuild"
+              fi
+            else
+              echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+              echo "⚠️ Published driver release manifest is stale; forcing full rebuild"
+            fi
+          else
+            echo "manifest_valid=false" >> "$GITHUB_OUTPUT"
+          fi
+          if [[ -n "$SOURCE_COMMIT" ]]; then
+            echo "🧭 Last published release source commit (${PREV_TAG}): $SOURCE_COMMIT"
+          else
+            echo "🧭 Unable to resolve published release source commit for ${PREV_TAG}; fallback to previous tag diff"
+          fi
+
+      - name: Detect changed driver agents
+        id: detect
+        shell: bash
+        run: |
+          set -euo pipefail
+          merge_csv() {
+            local current="$1"
+            local incoming="$2"
+            local merged="$current"
+            local seen=",${current},"
+            local item
+            IFS=',' read -r -a items <<< "$incoming"
+            for item in "${items[@]}"; do
+              item="$(printf '%s' "$item" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+              if [[ -z "$item" ]]; then
+                continue
+              fi
+              if [[ "$seen" == *",$item,"* ]]; then
+                continue
+              fi
+              if [[ -n "$merged" ]]; then
+                merged="${merged},${item}"
+              else
+                merged="$item"
+              fi
+              seen="${seen}${item},"
+            done
+            printf '%s\n' "$merged"
+          }
+
+          git fetch --force --tags
+          PREV_TAG="$(git describe --tags --match 'v*' --abbrev=0 "${GITHUB_SHA}^" 2>/dev/null || true)"
+          if [ -n "$PREV_TAG" ]; then
+            BASE_REF="$PREV_TAG"
+            RELEASE_SOURCE="$PREV_TAG"
+          else
+            BASE_REF="all"
+            RELEASE_SOURCE="all"
+          fi
+          HAS_MANIFEST="${{ steps.published_source.outputs.has_manifest }}"
+          MANIFEST_VALID="${{ steps.published_source.outputs.manifest_valid }}"
+          if [[ "$RELEASE_SOURCE" != "all" && "$HAS_MANIFEST" != "true" ]]; then
+            echo "⚠️ Published driver release lacks revision manifest; forcing full rebuild to self-heal old assets"
+            BASE_REF="all"
+            RELEASE_SOURCE="all"
+          elif [[ "$RELEASE_SOURCE" != "all" && "$MANIFEST_VALID" != "true" ]]; then
+            echo "⚠️ Published driver release manifest is stale; forcing full rebuild to self-heal old assets"
+            BASE_REF="all"
+            RELEASE_SOURCE="all"
+          fi
+          DRIVERS="$(bash ./tools/detect-changed-driver-agents.sh --base "$BASE_REF" --head "$GITHUB_SHA")"
+          if [[ "$BASE_REF" != "all" ]]; then
+            REVISION_DRIVERS=""
+            for PLATFORM in darwin/amd64 darwin/arm64 windows/amd64 windows/arm64 linux/amd64 linux/arm64; do
+              PLATFORM_DRIVERS="$(bash ./tools/diff-driver-agent-revisions.sh --base "$BASE_REF" --head "$GITHUB_SHA" --platform "$PLATFORM")" || {
+                echo "⚠️ 平台 revision 差异对比失败（${PLATFORM}），保守回退为全量驱动重建"
+                DRIVERS="$(bash ./tools/detect-changed-driver-agents.sh --base all --head "$GITHUB_SHA")"
+                REVISION_DRIVERS=""
+                break
+              }
+              REVISION_DRIVERS="$(merge_csv "$REVISION_DRIVERS" "$PLATFORM_DRIVERS")"
+            done
+            if [[ -n "$REVISION_DRIVERS" ]]; then
+              echo "🧭 Revision diff union drivers: $REVISION_DRIVERS"
+              DRIVERS="$(merge_csv "$DRIVERS" "$REVISION_DRIVERS")"
+            fi
+          fi
+          FORCE_GLOBAL_DRIVER_BUILDS="$(bash ./tools/should-force-global-driver-builds.sh --base "$BASE_REF" --head "$GITHUB_SHA")"
+          echo "drivers=${DRIVERS}" >> "$GITHUB_OUTPUT"
+          echo "release_source=${RELEASE_SOURCE}" >> "$GITHUB_OUTPUT"
+          echo "compare_base=${BASE_REF}" >> "$GITHUB_OUTPUT"
+          echo "force_global_driver_builds=${FORCE_GLOBAL_DRIVER_BUILDS}" >> "$GITHUB_OUTPUT"
+          if [ -n "$DRIVERS" ]; then
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+            echo "🧭 Changed driver agents since ${BASE_REF}: $DRIVERS"
+          else
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+            echo "🧭 No driver-agent changes since ${BASE_REF}"
+          fi
+          if [[ "$FORCE_GLOBAL_DRIVER_BUILDS" == "true" ]]; then
+            echo "🧭 Driver build/release plumbing changed; preserve global driver rebuild set on every platform"
+          fi
+
  # Phase 1: Build in parallel and output artifacts
  build:
    name: Build ${{ matrix.platform }}
+    needs:
+      - frontend
+      - driver_agents
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
@@ -38,7 +236,7 @@ jobs:
            artifact_suffix: ""
            build_optional_agents: true
            linux_webkit: ""
-          - os: windows-latest
+          - os: windows-2025-vs2026
            platform: windows/amd64
            os_name: Windows
            arch_name: Amd64
@@ -47,7 +245,7 @@ jobs:
            artifact_suffix: ""
            build_optional_agents: true
            linux_webkit: ""
-          - os: windows-latest
+          - os: windows-2025-vs2026
            platform: windows/arm64
            os_name: Windows
            arch_name: Arm64
@@ -65,6 +263,15 @@ jobs:
            artifact_suffix: ""
            build_optional_agents: true
            linux_webkit: "4.0"
+          - os: ubuntu-22.04-arm
+            platform: linux/arm64
+            os_name: Linux
+            arch_name: Arm64
+            build_name: gonavi-build-linux-arm64
+            wails_tags: ""
+            artifact_suffix: ""
+            build_optional_agents: true
+            linux_webkit: "4.0"
          # Debian 13 (trixie) 默认仓库已切到 WebKitGTK 4.1：单独提供 4.1 变体产物
          - os: ubuntu-24.04
            platform: linux/amd64
@@ -78,21 +285,46 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0

      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
-          go-version: '1.24'
-          check-latest: true
+          go-version-file: 'go.mod'

-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Download frontend dist
+        id: download_frontend_dist
+        continue-on-error: true
+        uses: actions/download-artifact@v7
        with:
-          node-version: '20'
+          name: frontend-dist
+          path: frontend-artifact
+
+      - name: Reset failed frontend dist download
+        if: steps.download_frontend_dist.outcome != 'success'
+        shell: bash
+        run: rm -rf frontend-artifact
+
+      - name: Retry frontend dist download
+        if: steps.download_frontend_dist.outcome != 'success'
+        uses: actions/download-artifact@v7
+        with:
+          name: frontend-dist
+          path: frontend-artifact
+
+      - name: Extract frontend dist
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p frontend/dist
+          test -s frontend-artifact/frontend-dist.tar
+          tar -xf frontend-artifact/frontend-dist.tar -C frontend/dist
+          test -s frontend/dist/index.html

      - name: Install UPX (Windows)
-        if: contains(matrix.platform, 'windows')
+        if: matrix.platform == 'windows/amd64'
        shell: pwsh
        run: |
          $UPX_VERSION = "4.2.4"
@@ -131,6 +363,12 @@ jobs:
          # AppImage 运行/打包可能需要 FUSE2。不同发行版/版本包名不同，做兼容兜底。
          sudo apt-get install -y libfuse2 || sudo apt-get install -y libfuse2t64 || true

+          if [ "${{ matrix.arch_name }}" != "Amd64" ]; then
+            echo "⚠️ Linux arm64 暂不生成 AppImage，仅产出 tar.gz"
+            touch /tmp/skip-appimage
+            exit 0
+          fi
+
          # Download linuxdeploy tools for AppImage packaging
          LINUXDEPLOY_URL="https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage"
          PLUGIN_URL="https://github.com/linuxdeploy/linuxdeploy-plugin-gtk/releases/download/continuous/linuxdeploy-plugin-gtk-x86_64.AppImage"
@@ -155,11 +393,11 @@ jobs:
          fi

      - name: Install Wails
-        run: go install -v github.com/wailsapp/wails/v2/cmd/wails@latest
+        run: go install -v github.com/wailsapp/wails/v2/cmd/wails@v2.11.0

      - name: Setup MSYS2 Toolchain For DuckDB (Windows AMD64)
        id: msys2_duckdb
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
+        if: ${{ matrix.platform == 'windows/amd64' }}
        continue-on-error: true
        uses: msys2/setup-msys2@v2
        with:
@@ -167,9 +405,10 @@ jobs:
          update: true
          install: >-
            mingw-w64-ucrt-x86_64-gcc
+            mingw-w64-ucrt-x86_64-binutils

      - name: Configure DuckDB CGO Toolchain (Windows AMD64)
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
+        if: ${{ matrix.platform == 'windows/amd64' }}
        shell: pwsh
        run: |
          function Find-MingwBin([string[]]$candidates) {
@@ -227,7 +466,7 @@ jobs:
          Write-Host "✅ 已配置 DuckDB cgo 编译器: gcc=$gcc g++=$gxx"

      - name: Verify DuckDB CGO Toolchain (Windows AMD64)
-        if: ${{ matrix.build_optional_agents && matrix.platform == 'windows/amd64' }}
+        if: ${{ matrix.platform == 'windows/amd64' }}
        shell: pwsh
        run: |
          & "$env:CC" --version
@@ -237,58 +476,271 @@ jobs:
        shell: bash
        run: |
          set -euo pipefail
+          echo "🧭 为 ${{ matrix.platform }} 全量生成 driver-agent revision 指纹，避免跨平台沿用旧 revision"
          ./tools/generate-driver-agent-revisions.sh --platform "${{ matrix.platform }}"
+          REVISION_HASH="$(python3 - <<'PY'
+          import hashlib
+          from pathlib import Path
+
+          print(hashlib.sha256(Path("internal/db/driver_agent_revisions_gen.go").read_bytes()).hexdigest())
+          PY
+          )"
+          export GOCACHE="${RUNNER_TEMP}/go-build-${{ matrix.os_name }}-${{ matrix.arch_name }}-${REVISION_HASH}"
+          mkdir -p "$GOCACHE"
+          echo "🧭 使用隔离 GOCACHE：$GOCACHE"
          if [ -n "${{ matrix.wails_tags }}" ]; then
-            wails build -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -tags "${{ matrix.wails_tags }}" -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${{ github.ref_name }}"
+            wails build -s -skipbindings -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -tags "${{ matrix.wails_tags }}" -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${{ github.ref_name }}"
          else
-            wails build -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${{ github.ref_name }}"
+            wails build -s -skipbindings -platform ${{ matrix.platform }} -clean -o ${{ matrix.build_name }} -ldflags "-s -w -X GoNavi-Wails/internal/app.AppVersion=${{ github.ref_name }}"
+          fi
+
+      - name: Resolve Platform Driver Revision Diff
+        id: revision_diff
+        if: ${{ matrix.build_optional_agents && needs.driver_agents.outputs.has_changes == 'true' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          BASE_REF="${{ needs.driver_agents.outputs.compare_base }}"
+          FALLBACK_DRIVERS="${{ needs.driver_agents.outputs.drivers }}"
+          FORCE_GLOBAL_DRIVER_BUILDS="${{ needs.driver_agents.outputs.force_global_driver_builds }}"
+
+          if [[ -z "$BASE_REF" || "$BASE_REF" == "all" || "$FORCE_GLOBAL_DRIVER_BUILDS" == "true" ]]; then
+            if [[ "$FORCE_GLOBAL_DRIVER_BUILDS" == "true" && -n "$BASE_REF" && "$BASE_REF" != "all" ]]; then
+              echo "⚠️ 当前提交涉及 driver 构建/发布链路，保留全局驱动重建结果：${FALLBACK_DRIVERS}"
+            else
+              echo "⚠️ 未拿到可比对的历史 release 基线，回退使用全局检测结果：${FALLBACK_DRIVERS}"
+            fi
+            echo "drivers=${FALLBACK_DRIVERS}" >> "$GITHUB_OUTPUT"
+          else
+            echo "🧭 对比当前平台 revision：base=${BASE_REF} head=${GITHUB_SHA} platform=${{ matrix.platform }}"
+            if DRIVERS="$(bash ./tools/diff-driver-agent-revisions.sh --base "$BASE_REF" --head "$GITHUB_SHA" --platform "${{ matrix.platform }}")"; then
+              echo "🧭 当前平台实际需要重建的 driver agents: ${DRIVERS:-<empty>}"
+              echo "drivers=${DRIVERS}" >> "$GITHUB_OUTPUT"
+            else
+              echo "⚠️ revision 差异对比失败，保守回退为全量重建"
+              ALL_DRIVERS="$(bash ./tools/detect-changed-driver-agents.sh --base all --head "$GITHUB_SHA")"
+              echo "drivers=${ALL_DRIVERS}" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+
+          DRIVERS="$(sed -n 's/^drivers=//p' "$GITHUB_OUTPUT" | tail -n 1)"
+          if [[ -n "$DRIVERS" ]]; then
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Build Optional Driver Agents
-        if: ${{ matrix.build_optional_agents }}
+        if: ${{ matrix.build_optional_agents && steps.revision_diff.outputs.has_changes == 'true' }}
        shell: bash
+        env:
+          CHANGED_DRIVER_AGENTS: ${{ steps.revision_diff.outputs.drivers }}
        run: |
          set -euo pipefail
          TARGET_PLATFORM="${{ matrix.platform }}"
          GOOS="${TARGET_PLATFORM%%/*}"
          GOARCH="${TARGET_PLATFORM##*/}"
-          DRIVERS=(mariadb doris sphinx sqlserver sqlite duckdb dameng kingbase highgo vastbase mongodb tdengine clickhouse)
+          REVISION_HASH="$(python3 - <<'PY'
+          import hashlib
+          from pathlib import Path
+
+          print(hashlib.sha256(Path("internal/db/driver_agent_revisions_gen.go").read_bytes()).hexdigest())
+          PY
+          )"
+          export GOCACHE="${RUNNER_TEMP}/go-build-${{ matrix.os_name }}-${{ matrix.arch_name }}-${REVISION_HASH}"
+          mkdir -p "$GOCACHE"
+          echo "🧭 可选驱动使用隔离 GOCACHE：$GOCACHE"
+          normalize_driver_token() {
+            local value
+            value="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+            case "$value" in
+              "") return 1 ;;
+              doris|diros) echo "doris" ;;
+              open_gauss|open-gauss) echo "opengauss" ;;
+              gaussdb|gauss_db|gauss-db) echo "gaussdb" ;;
+              elastic|elasticsearch) echo "elasticsearch" ;;
+              mariadb|oceanbase|starrocks|sphinx|sqlserver|sqlite|duckdb|dameng|kingbase|highgo|vastbase|opengauss|gaussdb|iris|mongodb|tdengine|iotdb|clickhouse)
+                echo "$value"
+                ;;
+              *)
+                echo "❌ 不支持的 driver-agent：${1:-}" >&2
+                return 1
+                ;;
+            esac
+          }
+
+          build_driver_name() {
+            case "$1" in
+              doris) echo "diros" ;;
+              *) echo "$1" ;;
+            esac
+          }
+
+          declare -a RAW_DRIVERS=()
+          declare -a DRIVERS=()
+          IFS=',' read -r -a RAW_DRIVERS <<< "$CHANGED_DRIVER_AGENTS"
+          for RAW_DRIVER in "${RAW_DRIVERS[@]}"; do
+            DRIVER="$(normalize_driver_token "$RAW_DRIVER")" || continue
+            DRIVERS+=("$DRIVER")
+          done
+          if [ ${#DRIVERS[@]} -eq 0 ]; then
+            echo "🧭 没有需要构建的 driver-agent"
+            exit 0
+          fi
+          NORMALIZED_CHANGED_DRIVER_AGENTS="$(IFS=,; echo "${DRIVERS[*]}")"
+          echo "🧭 归一后的 driver-agent 构建列表：${NORMALIZED_CHANGED_DRIVER_AGENTS}"
          OUTDIR="drivers/${{ matrix.os_name }}"
          mkdir -p "$OUTDIR"
+          DUCKDB_WINDOWS_LIBRARY_VERSION="v1.4.4"
+          DUCKDB_WINDOWS_LIBRARY_URL="https://github.com/duckdb/duckdb/releases/download/${DUCKDB_WINDOWS_LIBRARY_VERSION}/libduckdb-windows-amd64.zip"
+
+          prepare_duckdb_windows_library() {
+            local lib_dir="$RUNNER_TEMP/duckdb-windows-${DUCKDB_WINDOWS_LIBRARY_VERSION}"
+            local extract_dir="$RUNNER_TEMP/duckdb-windows-extract-${DUCKDB_WINDOWS_LIBRARY_VERSION}"
+            local zip_path="$RUNNER_TEMP/libduckdb-windows-amd64.zip"
+            if [ -f "$lib_dir/duckdb.dll" ] && [ -f "$lib_dir/libduckdb.dll.a" ] && [ -f "$lib_dir/libduckdb.a" ]; then
+              echo "$lib_dir"
+              return 0
+            fi
+            mkdir -p "$lib_dir"
+            rm -rf "$extract_dir"
+            rm -f "$zip_path"
+            local attempt dll_path
+            for attempt in 1 2 3; do
+              echo "📥 下载 DuckDB Windows 动态库 (${attempt}/3): ${DUCKDB_WINDOWS_LIBRARY_URL}" >&2
+              if curl --retry 3 --retry-delay 2 --retry-all-errors --connect-timeout 20 --max-time 300 -fsSL "$DUCKDB_WINDOWS_LIBRARY_URL" -o "$zip_path"; then
+                if unzip -tq "$zip_path" >/dev/null 2>&1; then
+                  rm -rf "$lib_dir"
+                  rm -rf "$extract_dir"
+                  mkdir -p "$lib_dir"
+                  mkdir -p "$extract_dir"
+                  unzip -qo "$zip_path" -d "$extract_dir"
+                  dll_path="$(find "$extract_dir" -type f -name duckdb.dll | head -n 1 || true)"
+                  if [ -n "$dll_path" ]; then
+                    cp "$dll_path" "$lib_dir/duckdb.dll"
+                    go run ./cmd/mingw-import-lib \
+                      --dll "$lib_dir/duckdb.dll" \
+                      --output-lib "$lib_dir/libduckdb.dll.a"
+                    cp "$lib_dir/libduckdb.dll.a" "$lib_dir/libduckdb.a"
+                    rm -rf "$extract_dir"
+                    echo "$lib_dir"
+                    return 0
+                  fi
+                  echo "⚠️ DuckDB Windows 动态库压缩包缺少 duckdb.dll，准备重试" >&2
+                else
+                  echo "⚠️ DuckDB Windows 动态库压缩包校验失败，准备重试" >&2
+                fi
+              else
+                echo "⚠️ DuckDB Windows 动态库下载失败，准备重试" >&2
+              fi
+              rm -f "$zip_path"
+              rm -rf "$lib_dir"
+              rm -rf "$extract_dir"
+              mkdir -p "$lib_dir"
+              sleep $((attempt * 2))
+            done
+            echo "❌ 无法准备 DuckDB Windows 动态库：${DUCKDB_WINDOWS_LIBRARY_URL}" >&2
+            return 1
+          }

          for DRIVER in "${DRIVERS[@]}"; do
-            BUILD_DRIVER="$DRIVER"
-            if [ "$DRIVER" = "doris" ]; then
-              BUILD_DRIVER="diros"
-            fi
+            BUILD_DRIVER="$(build_driver_name "$DRIVER")"
            if [ "$DRIVER" = "duckdb" ] && [ "$GOOS" = "windows" ] && [ "$GOARCH" != "amd64" ]; then
              echo "⚠️ 跳过 DuckDB driver（当前平台 ${GOOS}/${GOARCH} 不受支持，仅支持 windows/amd64）"
              continue
            fi
-            TAG="gonavi_${BUILD_DRIVER}_driver"
-            OUTPUT="${DRIVER}-driver-agent-${GOOS}-${GOARCH}"
-            if [ "$GOOS" = "windows" ]; then
-              OUTPUT="${OUTPUT}.exe"
-            fi
-            OUTPUT_PATH="${OUTDIR}/${OUTPUT}"
-            echo "🔧 构建 ${OUTPUT_PATH} (tag=${TAG})"
-            if [ "$DRIVER" = "duckdb" ]; then
-              CGO_ENABLED=1 GOOS="$GOOS" GOARCH="$GOARCH" go build \
-                -tags "${TAG}" \
-                -trimpath \
-                -ldflags "-s -w" \
-                -o "${OUTPUT_PATH}" \
-                ./cmd/optional-driver-agent
-            else
-              CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" go build \
-                -tags "${TAG}" \
-                -trimpath \
-                -ldflags "-s -w" \
-                -o "${OUTPUT_PATH}" \
-                ./cmd/optional-driver-agent
+            DRIVER_VARIANTS=("")
+            if [ "$DRIVER" = "mongodb" ]; then
+              DRIVER_VARIANTS=("v1" "v2" "")
            fi
+            for DRIVER_VARIANT in "${DRIVER_VARIANTS[@]}"; do
+              TAG="gonavi_${BUILD_DRIVER}_driver"
+              BUILD_TAGS="$TAG"
+              OUTPUT_STEM="${DRIVER}-driver-agent"
+              if [ "$DRIVER" = "mongodb" ]; then
+                if [ "$DRIVER_VARIANT" = "v1" ]; then
+                  BUILD_TAGS="gonavi_mongodb_driver_v1"
+                  OUTPUT_STEM="mongodb-driver-agent-v1"
+                elif [ "$DRIVER_VARIANT" = "v2" ]; then
+                  BUILD_TAGS="gonavi_mongodb_driver"
+                  OUTPUT_STEM="mongodb-driver-agent-v2"
+                else
+                  BUILD_TAGS="gonavi_mongodb_driver"
+                fi
+              fi
+              OUTPUT="${OUTPUT_STEM}-${GOOS}-${GOARCH}"
+              if [ "$GOOS" = "windows" ]; then
+                OUTPUT="${OUTPUT}.exe"
+              fi
+              OUTPUT_PATH="${OUTDIR}/${OUTPUT}"
+              DUCKDB_LIB_DIR=""
+              if [ "$DRIVER" = "duckdb" ] && [ "$GOOS" = "windows" ] && [ "$GOARCH" = "amd64" ]; then
+                DUCKDB_LIB_DIR="$(prepare_duckdb_windows_library)"
+                BUILD_TAGS="${BUILD_TAGS} duckdb_use_lib"
+              fi
+              echo "🔧 构建 ${OUTPUT_PATH} (tags=${BUILD_TAGS})"
+              if [ "$DRIVER" = "duckdb" ]; then
+                if [ -n "$DUCKDB_LIB_DIR" ]; then
+                  DUCKDB_LIB_DIR_GCC="$(cygpath -m "$DUCKDB_LIB_DIR")"
+                  DUCKDB_LIB_DIR_PATH="$(cygpath -u "$DUCKDB_LIB_DIR")"
+                  # cgo 会把每个 CGO_LDFLAGS 片段转成 //go:cgo_ldflag，-L 参数不能再额外包引号。
+                  DUCKDB_WINDOWS_CGO_LDFLAGS="-L${DUCKDB_LIB_DIR_GCC} -lduckdb -lstdc++ -lm -lws2_32 -lwsock32 -lrstrtmgr"
+                  CGO_ENABLED=1 GOOS="$GOOS" GOARCH="$GOARCH" CGO_LDFLAGS="${DUCKDB_WINDOWS_CGO_LDFLAGS}" PATH="${DUCKDB_LIB_DIR_PATH}:$PATH" go build \
+                    -tags "${BUILD_TAGS}" \
+                    -trimpath \
+                    -ldflags "-s -w" \
+                    -o "${OUTPUT_PATH}" \
+                    ./cmd/optional-driver-agent
+                  cp "$DUCKDB_LIB_DIR/duckdb.dll" "$OUTDIR/duckdb.dll"
+                  bash ./tools/compress-driver-artifact.sh "$OUTDIR/duckdb.dll" "$TARGET_PLATFORM" "${{ matrix.os_name }}/duckdb.dll"
+                else
+                  CGO_ENABLED=1 GOOS="$GOOS" GOARCH="$GOARCH" go build \
+                    -tags "${BUILD_TAGS}" \
+                    -trimpath \
+                    -ldflags "-s -w" \
+                    -o "${OUTPUT_PATH}" \
+                    ./cmd/optional-driver-agent
+                fi
+              else
+                CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" go build \
+                  -tags "${BUILD_TAGS}" \
+                  -trimpath \
+                  -ldflags "-s -w" \
+                  -o "${OUTPUT_PATH}" \
+                  ./cmd/optional-driver-agent
+              fi
+              bash ./tools/compress-driver-artifact.sh "${OUTPUT_PATH}" "$TARGET_PLATFORM" "${{ matrix.os_name }}/${OUTPUT}"
+              if [ "$DRIVER" = "duckdb" ] && [ -n "$DUCKDB_LIB_DIR" ]; then
+                DUCKDB_ZIP_PATH="${OUTDIR}/duckdb-driver.zip"
+                export DUCKDB_ZIP_PATH
+                export DUCKDB_AGENT_PATH="${OUTPUT_PATH}"
+                export DUCKDB_DLL_PATH="${OUTDIR}/duckdb.dll"
+              python3 - <<'PY'
+          import os
+          import zipfile
+
+          zip_path = os.environ["DUCKDB_ZIP_PATH"]
+          entries = [
+              ("Windows/duckdb-driver-agent-windows-amd64.exe", os.environ["DUCKDB_AGENT_PATH"]),
+              ("Windows/duckdb.dll", os.environ["DUCKDB_DLL_PATH"]),
+          ]
+
+          with zipfile.ZipFile(zip_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
+              for arcname, src in entries:
+                  if not os.path.isfile(src):
+                      raise FileNotFoundError(src)
+                  zf.write(src, arcname)
+          PY
+                echo "📦 已生成 DuckDB Windows 专属驱动包: ${DUCKDB_ZIP_PATH}"
+              fi
+            done
          done

+          bash ./tools/verify-driver-agent-revisions.sh \
+            --assets-dir drivers \
+            --platform "$TARGET_PLATFORM" \
+            --drivers "$NORMALIZED_CHANGED_DRIVER_AGENTS"
+
      # macOS Packaging
      - name: Package macOS DMG
        if: contains(matrix.platform, 'darwin')
@@ -499,7 +951,7 @@ jobs:

      # Upload to Actions Artifacts (Temporary Storage)
      - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
        with:
          name: build-artifacts-${{ strategy.job-index }} # Unique name per job
          path: |
@@ -513,11 +965,16 @@ jobs:
  # Phase 2: Collect all artifacts and Publish Release (Single Job)
  release:
    name: Publish Release
-    needs: build
+    needs:
+      - build
+      - driver_agents
    runs-on: ubuntu-latest
    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
      - name: Download All Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
        with:
          path: release-assets
          pattern: build-artifacts-*
@@ -526,31 +983,49 @@ jobs:
      - name: List Assets
        run: ls -R release-assets

+      - name: Complete Driver Agent Assets
+        if: needs.driver_agents.outputs.has_changes == 'true' && needs.driver_agents.outputs.release_source != 'all'
+        env:
+          DRIVER_RELEASE_TOKEN: ${{ secrets.DRIVER_RELEASE_TOKEN }}
+        run: |
+          python3 tools/complete-driver-release-assets.py \
+            --assets-dir release-assets \
+            --source "${{ needs.driver_agents.outputs.release_source }}" \
+            --require-complete
+
      - name: Verify Optional Driver Assets
+        if: needs.driver_agents.outputs.has_changes == 'true'
        shell: bash
+        env:
+          CHANGED_DRIVER_AGENTS: ${{ needs.driver_agents.outputs.drivers }}
        run: |
          set -euo pipefail
          cd release-assets

-          REQUIRED_FILES=(
-            "drivers/Windows/duckdb-driver-agent-windows-amd64.exe"
-            "drivers/MacOS/duckdb-driver-agent-darwin-amd64"
-            "drivers/MacOS/duckdb-driver-agent-darwin-arm64"
-            "drivers/Linux/duckdb-driver-agent-linux-amd64"
-            "drivers/Windows/clickhouse-driver-agent-windows-amd64.exe"
-            "drivers/MacOS/clickhouse-driver-agent-darwin-amd64"
-            "drivers/MacOS/clickhouse-driver-agent-darwin-arm64"
-            "drivers/Linux/clickhouse-driver-agent-linux-amd64"
-          )
-
          missing=0
-          for file in "${REQUIRED_FILES[@]}"; do
-            if [ ! -f "$file" ]; then
-              echo "❌ 缺少驱动资产：$file"
-              missing=1
+          IFS=',' read -r -a DRIVERS <<< "$CHANGED_DRIVER_AGENTS"
+          for driver in "${DRIVERS[@]}"; do
+            REQUIRED_FILES=(
+              "drivers/Windows/${driver}-driver-agent-windows-amd64.exe"
+              "drivers/MacOS/${driver}-driver-agent-darwin-amd64"
+              "drivers/MacOS/${driver}-driver-agent-darwin-arm64"
+              "drivers/Linux/${driver}-driver-agent-linux-amd64"
+            )
+            if [ "$driver" != "duckdb" ]; then
+              REQUIRED_FILES+=("drivers/Windows/${driver}-driver-agent-windows-arm64.exe")
            else
-              echo "✅ 已找到驱动资产：$file"
+              REQUIRED_FILES+=("drivers/Windows/duckdb.dll")
+              REQUIRED_FILES+=("drivers/Windows/duckdb-driver.zip")
            fi
+
+            for file in "${REQUIRED_FILES[@]}"; do
+              if [ ! -f "$file" ]; then
+                echo "❌ 缺少驱动资产：$file"
+                missing=1
+              else
+                echo "✅ 已找到驱动资产：$file"
+              fi
+            done
          done

          if [ "$missing" -ne 0 ]; then
@@ -559,57 +1034,35 @@ jobs:
          fi

      - name: Package Driver Agents Bundle
+        id: driver_assets
        shell: bash
        run: |
          set -euo pipefail
          cd release-assets
          if [ ! -d drivers ]; then
            echo "⚠️ 未找到 drivers 目录，跳过驱动总包打包"
+            echo "has_driver_assets=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if [ -z "$(find drivers -type f 2>/dev/null | head -n 1)" ]; then
            echo "⚠️ drivers 目录为空，跳过驱动总包打包"
            rm -rf drivers
+            echo "has_driver_assets=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "📦 打包驱动总包：GoNavi-DriverAgents.zip"
-          python3 - <<'PY'
-          import json
-          import os
-          import zipfile
-          from pathlib import Path
+          python3 ../tools/package-driver-release-assets.py \
+            drivers \
+            ../driver-release-assets

-          out_name = "GoNavi-DriverAgents.zip"
-          index_name = "GoNavi-DriverAgents-Index.json"
-          base = Path("drivers")
-          out_path = Path(out_name)
-          index_path = Path(index_name)
-          if out_path.exists():
-              out_path.unlink()
-          if index_path.exists():
-              index_path.unlink()
+          python3 ../tools/generate-driver-release-manifest.py \
+            --assets-dir drivers \
+            --output ../driver-release-assets/GoNavi-DriverAgents-Manifest.json

-          size_index = {}
-          with zipfile.ZipFile(out_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
-              for p in base.rglob("*"):
-                  if not p.is_file():
-                      continue
-                  arcname = p.relative_to(base).as_posix()
-                  zf.write(p, arcname)
-                  size_index[p.name] = p.stat().st_size
-
-          index_path.write_text(
-              json.dumps({"assets": size_index}, ensure_ascii=False, indent=2),
-              encoding="utf-8",
-          )
-
-          print(f"created {out_name} size={out_path.stat().st_size} bytes")
-          print(f"created {index_name} entries={len(size_index)}")
-          PY
-
-          # Release 只发布一个驱动总包，避免大量平铺资产污染 Release 页面
+          # GoNavi 主仓库只保留主程序包；驱动资产发布到独立仓库。
          rm -rf drivers
+          echo "has_driver_assets=true" >> "$GITHUB_OUTPUT"

      - name: Generate SHA256SUMS
        shell: bash
@@ -628,8 +1081,49 @@ jobs:
            sha256sum "${FILES[@]}" > SHA256SUMS
          fi

+      - name: Generate Driver SHA256SUMS
+        if: steps.driver_assets.outputs.has_driver_assets == 'true'
+        shell: bash
+        run: |
+          cd driver-release-assets
+          FILES=()
+          while IFS= read -r file; do
+            if [ -n "$file" ]; then
+              FILES+=("$file")
+            fi
+          done < <(find . -maxdepth 1 -type f ! -name SHA256SUMS -exec basename {} \; | sort)
+          if [ ${#FILES[@]} -eq 0 ]; then
+            echo "❌ 未找到驱动发布资产"
+            exit 1
+          fi
+          sha256sum "${FILES[@]}" > SHA256SUMS
+
+      - name: Create Driver Agents Release
+        if: startsWith(github.ref, 'refs/tags/') && steps.driver_assets.outputs.has_driver_assets == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.DRIVER_RELEASE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -t DRIVER_RELEASE_ASSETS < <(find driver-release-assets -maxdepth 1 -type f | sort)
+          if [ ${#DRIVER_RELEASE_ASSETS[@]} -eq 0 ]; then
+            echo "未找到 driver release assets"
+            exit 1
+          fi
+
+          NOTES_FILE="$RUNNER_TEMP/driver-release-notes.md"
+          cat > "$NOTES_FILE" <<'EOF'
+            GoNavi driver-agent assets for `${{ github.ref_name }}`.
+          EOF
+
+          gh release create "${{ github.ref_name }}" "${DRIVER_RELEASE_ASSETS[@]}" \
+            --repo Syngnat/GoNavi-DriverAgents \
+            --title "GoNavi Driver Agents ${{ github.ref_name }}" \
+            --notes-file "$NOTES_FILE" \
+            --latest
+
      - name: Checkout code for changelog
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0
          path: repo-for-changelog
@@ -697,7 +1191,7 @@ jobs:
          echo "changelog_file=/tmp/changelog.md" >> "$GITHUB_OUTPUT"

      - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: release-assets/*
--- a/.gitignore
+++ b/.gitignore
@@ -10,12 +10,15 @@ build/bin/

 # wails / node artifacts (按需)
 node_modules/
+frontend/wailsjs/tsconfig.json

 dist/
 .DS_Store
 .gemini-clipboard
 GoNavi-Wails
 GoNavi-Wails.exe
+optional-driver-agent
+optional-driver-agent.exe
 .ace-tool/
 .superpowers/
 .claude/
--- a/AI_EXTENSIONS_ROADMAP.md
+++ b/AI_EXTENSIONS_ROADMAP.md
@@ -0,0 +1,106 @@
+# AI 扩展能力路线
+
+当前 GoNavi 的 AI 链路是：
+
+1. 前端 `AIChatPanel` 组装 system messages。
+2. 前端声明本地固定工具 `LOCAL_TOOLS`。
+3. 后端 `aiservice.Service` 只负责 Provider 配置、安全级别与模型转发。
+
+这套结构已经足够承接“用户级提示词”，但要继续承接 MCP 和 Skills，需要先把“提示词 / 工具 / 技能”三层职责拆开。
+
+## 1. 用户级自定义提示词
+
+已落地的方向：
+
+- 配置存储在 `ai_config.json` 的 `userPromptSettings`。
+- 由 `AISettingsModal` 提供编辑入口。
+- 由 `AIChatPanel` 在运行时追加为 system message。
+
+建议长期保持 4 个层级：
+
+- `global`: 所有 AI 会话统一追加。
+- `database`: 数据库 / SQL 场景追加。
+- `jvm`: JVM 资源浏览与分析场景追加。
+- `jvmDiagnostic`: JVM 诊断命令规划场景追加。
+
+这样既能满足“个人习惯”定制，也不会把所有场景揉成一条超长总提示词。
+
+## 2. MCP 能力开放
+
+目标不是把 MCP 做成新的聊天面板，而是把它变成“外部工具源”。
+
+建议后续拆成三层：
+
+1. `tool registry`
+   - 统一收口内置工具、本地扩展工具、MCP 工具。
+   - 对模型只暴露统一的 `tools[]`。
+2. `mcp server config`
+   - 保存 server 名称、transport、启动命令或 URL、超时、启用状态。
+   - 由后端维护生命周期与连通性。
+3. `mcp runtime bridge`
+   - 负责 `list tools / call tool / errors / timeout / auth`。
+
+### MCP 是否需要单独 GitHub 仓库
+
+不需要把“GoNavi 对 MCP 的支持”单独拆仓库。
+
+更合理的边界是：
+
+- `GoNavi 主仓库`
+  - 维护 MCP client、配置、UI、工具注册和运行时桥接。
+- `单独仓库（可选）`
+  - 只在你要发布一个可复用的 MCP Server 时才有价值。
+  - 例如 `gonavi-mcp-sql-tools`、`gonavi-mcp-jvm-agent` 这类独立 server。
+
+结论：
+
+- “客户端支持 MCP” 不需要新仓库。
+- “某个独立 MCP Server” 是否拆仓库，取决于它要不要单独发布、复用或部署。
+
+## 3. Skills 设计
+
+Skills 不建议直接等同于“另一种提示词”。
+
+更合适的定义是：
+
+- `skill manifest`
+  - 名称、说明、适用场景、是否默认启用。
+- `skill prompt`
+  - 该技能追加的 system prompt / few-shot / 输出约束。
+- `skill tool requirements`
+  - 该技能依赖哪些内置工具或 MCP 工具。
+- `skill shortcuts`
+  - 可选地给欢迎卡片、斜杠命令或快速动作提供入口。
+
+一个 Skill 本质上应该是“提示词 + 工具依赖 + 使用入口”的组合，而不是单独一段文案。
+
+### Skills 是否需要单独 GitHub 仓库
+
+第一阶段不需要。
+
+建议顺序：
+
+1. 先在 GoNavi 主仓库内把 Skills manifest/runtime 跑通。
+2. 等格式稳定后，再考虑增加“本地目录导入”或“Git 仓库导入”。
+
+只有当你明确要做下面两件事时，独立仓库才值得：
+
+- 把 Skills 当作社区共享资产分发。
+- 让不同团队独立维护自己的 skill pack。
+
+## 建议的下一步实现顺序
+
+1. 抽出统一 `ToolRegistry`，让 `LOCAL_TOOLS` 不再硬编码在聊天面板内部。
+2. 在 AI 设置中新增 `MCP Servers` 配置页。
+3. 后端先支持最小 transport：
+   - `stdio`
+   - `http/sse`（如果后续确认需要）
+4. 在 AI 设置中新增 `Skills` 配置页。
+5. 让 Skill 以 manifest 形式声明：
+   - `id`
+   - `name`
+   - `description`
+   - `systemPrompt`
+   - `requiredTools`
+   - `scopes`
+6. 再决定是否增加“从 Git 仓库同步 MCP/Skills 包”的分发能力。
--- a/Dockerfile.build-env
+++ b/Dockerfile.build-env
@@ -0,0 +1,55 @@
+# syntax=docker/dockerfile:1.7
+
+ARG GO_IMAGE=golang:1.25-bookworm
+ARG NODE_IMAGE=node:20-bookworm
+
+FROM ${NODE_IMAGE} AS node
+
+FROM ${GO_IMAGE}
+
+ARG WEBKIT_API=4.0
+ARG WAILS_VERSION=v2.11.0
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV PATH=/go/bin:/usr/local/go/bin:${PATH}
+
+# Debian's /etc/profile resets PATH in login shells (bash -l), dropping the Go
+# toolchain; restore it via profile.d which is sourced after that reset.
+RUN printf 'export PATH=/go/bin:/usr/local/go/bin:$PATH\n' > /etc/profile.d/10-gonavi-build-env.sh
+
+# Copy only Node.js runtime assets so the Go toolchain from the base image
+# stays intact for smoke tests and interactive build shells.
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+
+# npm/npx/corepack are symlinks in the node image; COPY dereferences them into
+# standalone scripts whose relative requires break, so recreate the symlinks.
+RUN ln -sf ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -sf ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
+    && ln -sf ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        bash \
+        build-essential \
+        ca-certificates \
+        curl \
+        file \
+        git \
+        make \
+        pkg-config \
+        python3 \
+        unzip \
+        zip \
+        libgtk-3-dev \
+    && if [ "${WEBKIT_API}" = "4.1" ]; then \
+        apt-get install -y --no-install-recommends libwebkit2gtk-4.1-dev libsoup-3.0-dev; \
+    else \
+        apt-get install -y --no-install-recommends libwebkit2gtk-4.0-dev; \
+    fi \
+    && go install github.com/wailsapp/wails/v2/cmd/wails@${WAILS_VERSION} \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+CMD ["bash"]
--- a/Dockerfile.mcp-server
+++ b/Dockerfile.mcp-server
@@ -0,0 +1,46 @@
+# syntax=docker/dockerfile:1.7
+
+FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS builder
+
+# Declared without defaults so BuildKit injects the real target platform;
+# a default like TARGETARCH=amd64 would win and ship amd64 binaries to arm64.
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+COPY third_party/highgo-pq/go.mod ./third_party/highgo-pq/go.mod
+COPY third_party/go-irisnative/go.mod third_party/go-irisnative/go.sum ./third_party/go-irisnative/
+RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
+    go build -trimpath -ldflags="-s -w" -o /out/gonavi-mcp-server ./cmd/gonavi-mcp-server
+
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates tzdata \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --system --create-home --home-dir /var/lib/gonavi --uid 10001 gonavi \
+    && mkdir -p /data /var/lib/gonavi/logs \
+    && chown -R gonavi:gonavi /data /var/lib/gonavi
+
+COPY --from=builder /out/gonavi-mcp-server /usr/local/bin/gonavi-mcp-server
+
+ENV HOME=/var/lib/gonavi \
+    GONAVI_DATA_ROOT=/data \
+    GONAVI_LOG_DIR=/var/lib/gonavi/logs \
+    GONAVI_MCP_HTTP_ADDR=0.0.0.0:8765 \
+    GONAVI_MCP_HTTP_PATH=/mcp \
+    GONAVI_MCP_SCHEMA_ONLY=true
+
+VOLUME ["/data"]
+EXPOSE 8765
+
+USER gonavi
+
+ENTRYPOINT ["/usr/local/bin/gonavi-mcp-server"]
+CMD ["http"]
--- a/README.md
+++ b/README.md
@@ -34,22 +34,37 @@ GoNavi is designed for developers and DBAs who need a unified desktop experience
 | Category | Data Source | Driver Mode | Typical Capabilities |
 |---|---|---|---|
 | Relational | MySQL | Built-in | Schema browsing, SQL query, data editing, export/backup |
+| Domestic DB | GoldenDB | Built-in | MySQL-compatible query workflow and distributed transaction scenarios |
 | Relational | PostgreSQL | Built-in | Schema browsing, SQL query, data editing, object management |
 | Relational | Oracle | Built-in | Query execution, object browsing, data editing |
 | Cache | Redis | Built-in | Key browsing, command execution, encoding/view switch |
+| Vector Database | Chroma | Built-in | Collection browsing, vector retrieval, metadata filtering |
+| Vector Database | Qdrant | Built-in | Collection browsing, vector search, payload filtering |
+| Message Queue | RocketMQ | Built-in | Topic browsing, consumer-group inspection, message-oriented workflow |
+| Message Queue | MQTT | Built-in | Broker and topic-filter workflow with QoS-aware connection settings |
+| Message Queue | Kafka | Built-in | Topic browsing, broker metadata, consumer-group workflow |
+| Message Queue | RabbitMQ | Built-in | Queue/exchange browsing, virtual host inspection, management API workflow |
 | Relational | MariaDB | Optional driver agent | Querying, object management, data editing |
 | Relational | Doris | Optional driver agent | Querying, object browsing, SQL execution |
+| Columnar Analytics | StarRocks | Optional driver agent | Querying, object browsing, SQL execution |
 | Search | Sphinx | Optional driver agent | SphinxQL querying and object browsing |
 | Relational | SQL Server | Optional driver agent | Schema browsing, SQL query, object management |
 | File-based | SQLite | Optional driver agent | Local DB browsing, editing, export |
 | File-based | DuckDB | Optional driver agent | Large-table query, pagination, file-DB workflow |
+| Domestic DB | OceanBase | Optional driver agent | MySQL / Oracle tenant access, object browsing, query workflow |
 | Domestic DB | Dameng | Optional driver agent | Querying, object browsing, data editing |
 | Domestic DB | Kingbase | Optional driver agent | Querying, object browsing, data editing |
 | Domestic DB | HighGo | Optional driver agent | Querying, object browsing, data editing |
 | Domestic DB | Vastbase | Optional driver agent | Querying, object browsing, data editing |
+| Domestic DB | OpenGauss | Optional driver agent | PostgreSQL-like schema browsing, SQL query, object management |
+| Domestic DB | GaussDB | Optional driver agent | PostgreSQL-like schema browsing, SQL query, object management |
+| Multi-model | InterSystems IRIS | Optional driver agent | Namespace browsing, SQL query, object management |
 | Document | MongoDB | Optional driver agent | Document query, collection browsing, connection management |
 | Time-series | TDengine | Optional driver agent | Time-series schema browsing and querying |
+| Time-series | Apache IoTDB | Optional driver agent | Storage group / device / timeseries browsing and querying |
 | Columnar Analytics | ClickHouse | Optional driver agent | Analytical query, object browsing, SQL execution |
+| Federated Query | Trino | Optional driver agent | Cross-source SQL via multiple catalogs, `catalog.schema` browsing, SQL execution |
+| Search | Elasticsearch | Optional driver agent | Index browsing, mapping inspection, JSON DSL / query_string search |
 | Extensibility | Custom Driver/DSN | Custom | Extend to more data sources via Driver + DSN |

 <h2 align="center">📸 Screenshots</h2>
@@ -72,6 +87,9 @@ GoNavi is designed for developers and DBAs who need a unified desktop experience
 - **Multi-provider Support**: OpenAI, Google Gemini, Anthropic Claude, and custom API support.
 - **Context-Aware Chat**: Attach table schemas to the AI context for accurate SQL generation and assistance.
 - **Slash Commands**: Quick commands for generating SQL, explaining queries, optimizing performance, and reviewing schema designs.
+- **Built-in MCP Workflow**: Manage MCP servers in AI Settings, install GoNavi MCP to Claude Code / Codex, or expose Streamable HTTP for remote Agents.
+- **Remote-Agent Boundary**: Keep saved connections and database passwords on the host running GoNavi while cloud Agents consume schema tools over MCP.
+- **Safety Guardrails**: Remote `schema-only` mode omits `execute_sql`; when SQL execution is enabled, non-read-only statements still require explicit `allowMutating=true`.

 ### Performance
 - **Smooth interaction under load**: optimized table interaction (including column resize workflow on large datasets).
@@ -132,17 +150,26 @@ GoNavi is designed for developers and DBAs who need a unified desktop experience
 - [Go](https://go.dev/dl/) 1.21+
 - [Node.js](https://nodejs.org/) 18+
 - [Wails CLI](https://wails.io/docs/gettingstarted/installation):
-  `go install github.com/wailsapp/wails/v2/cmd/wails@latest`
+  `go install github.com/wailsapp/wails/v2/cmd/wails@v2.11.0`

 ### Development Mode

-```bash
+```shell
 # Clone
 git clone https://github.com/Syngnat/GoNavi.git
 cd GoNavi

 # Start development with hot reload
 wails dev
+
+# Faster local startup when exported Go method signatures are unchanged
+node tools/wails-fast-dev.mjs
+
+# Refresh Wails JS bindings after changing exported Go method signatures
+node tools/wails-fast-dev.mjs --refresh-bindings
+
+# Windows PowerShell low-memory visual mode: disables transparent WebView/Acrylic backdrop
+$env:GONAVI_LOW_MEMORY_MODE="1"; node tools/wails-fast-dev.mjs
 ```

 ### Build
@@ -157,6 +184,82 @@ wails build -clean

 Artifacts are generated in `build/bin`.

+### Docker / Podman (MCP Server Only)
+
+The desktop GUI is not packaged as a container service. Current container support targets `gonavi-mcp-server` only.
+
+### Browser Access Mode (Experimental)
+
+The main GoNavi application now also exposes a `web-server` mode that reuses the same Go backend and React frontend for browser access:
+
+```powershell
+go build .
+.\GoNavi-Wails.exe web-server --addr 127.0.0.1:34116
+```
+
+The first browser visit is redirected to `/setup` to create the web admin password. Google Authenticator is optional but supported out of the box, together with `web_auth.json`, session cookies, recovery codes, and login rate limiting.
+
+Current scope already includes:
+
+- Browser-side Wails bridge (`window.go.*` / `window.runtime.*` -> HTTP / SSE)
+- First-run setup page, login page, and logout endpoint
+- Session idle timeout / absolute timeout / remember-login window
+- Google Authenticator TOTP plus recovery codes
+
+Still in progress:
+
+- Browser upload/download workbenches for external SQL and connection-package flows
+- More web capability gating for desktop-only features
+- Reverse-proxy / HTTPS / zero-trust deployment guidance
+
+```bash
+cp docker.mcp-server.env.example docker.mcp-server.env
+docker compose --env-file docker.mcp-server.env -f docker-compose.mcp-server.yml up -d
+```
+
+Mount the GoNavi active data root into the container. The mounted directory should contain `connections.json`, `daily_secrets.json`, and optional `drivers/` assets when optional driver agents are required.
+
+The default Compose file pulls the published GHCR image. For local source builds, add the override file:
+
+```bash
+docker compose --env-file docker.mcp-server.env \
+  -f docker-compose.mcp-server.yml \
+  -f docker-compose.mcp-server.local.yml \
+  up -d --build
+```
+
+For Podman, use the same published OCI image with `podman run`, or the native Quadlet example under [deploy/podman/gonavi-mcp-server](deploy/podman/gonavi-mcp-server). That path is intended for Linux servers / NAS hosts where rootless systemd services are preferred.
+
+Deployment matrix:
+
+- Docker Desktop / Linux server / NAS: `docker-compose.mcp-server.yml`
+- Podman / Quadlet: [deploy/podman/gonavi-mcp-server](deploy/podman/gonavi-mcp-server)
+- Kubernetes: [deploy/k8s/gonavi-mcp-server](deploy/k8s/gonavi-mcp-server) (`kustomization.yaml` + overlays)
+- Helm chart: [deploy/helm/gonavi-mcp-server](deploy/helm/gonavi-mcp-server)
+- Build-only Linux environment: `Dockerfile.build-env`
+
+See [cmd/gonavi-mcp-server/README.md](cmd/gonavi-mcp-server/README.md) for deployment details and security boundaries.
+
+### Docker / Podman (Build Environment Only)
+
+If you only need a reproducible Linux build environment for Wails, use `Dockerfile.build-env`:
+
+```bash
+docker build -f Dockerfile.build-env -t gonavi-build-env:local .
+docker run --rm -it -v "$PWD:/workspace" -w /workspace gonavi-build-env:local bash
+```
+
+The same Dockerfile also works with Podman, for example `podman build -f Dockerfile.build-env -t localhost/gonavi-build-env:local .` and `podman run --rm -it -v "$PWD:/workspace" -w /workspace localhost/gonavi-build-env:local bash`.
+
+The default image installs the WebKitGTK 4.0 build toolchain for broader Linux/NAS compatibility. The image bases are multi-arch, so `amd64` and `arm64` follow the target container platform.
+
+Published images are pushed to GHCR:
+
+- `ghcr.io/syngnat/gonavi-mcp-server:latest`
+- `ghcr.io/syngnat/gonavi-build-env:latest`
+
+This image is for building Linux artifacts only. It does not turn the Wails desktop GUI into a browser-accessible web application.
+
 ### Cross-Platform Release (GitHub Actions)

 The repository includes a release workflow.
@@ -202,6 +305,16 @@ sudo apt-get install -y libgtk-3-0 libwebkit2gtk-4.0-37 libjavascriptcoregtk-4.0

 If you use Linux artifacts with the `-WebKit41` suffix, prefer Debian 13 / Ubuntu 24.04+.

+### Linux: Chinese text appears as square boxes
+
+Minimal Ubuntu 24.04 LTS desktop/server environments may not include Chinese CJK fonts. Install Noto / WenQuanYi fonts and restart GoNavi:
+
+```bash
+sudo apt-get update
+sudo apt-get install -y fonts-noto-cjk fonts-wqy-microhei
+fc-cache -fv
+```
+
 ---

 ## Contributing
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -33,22 +33,37 @@ GoNavi 面向开发者与 DBA，核心目标是让数据库操作在桌面端做
 | 类别 | 数据源 | 驱动模式 | 典型能力 |
 |---|---|---|---|
 | 关系型 | MySQL | 内置 | 库表浏览、SQL 查询、数据编辑、导出/备份 |
+| 国产数据库 | GoldenDB | 内置 | MySQL 兼容查询工作流、分布式事务场景 |
 | 关系型 | PostgreSQL | 内置 | 库表浏览、SQL 查询、数据编辑、对象管理 |
 | 关系型 | Oracle | 内置 | 连接查询、对象浏览、数据编辑 |
 | 缓存 | Redis | 内置 | Key 浏览、命令执行、编码/视图切换 |
+| 向量数据库 | Chroma | 内置 | Collection 浏览、向量检索、元数据过滤 |
+| 向量数据库 | Qdrant | 内置 | Collection 浏览、向量搜索、Payload 过滤 |
+| 消息队列 | RocketMQ | 内置 | Topic 浏览、消费组检查、消息型工作流 |
+| 消息队列 | MQTT | 内置 | Broker / Topic Filter 工作流与 QoS 连接配置 |
+| 消息队列 | Kafka | 内置 | Topic 浏览、Broker 元数据、消费组工作流 |
+| 消息队列 | RabbitMQ | 内置 | Queue / Exchange 浏览、Virtual Host 检查、Management API 工作流 |
 | 关系型 | MariaDB | 可选驱动代理 | 连接查询、对象管理、数据编辑 |
 | 关系型 | Doris | 可选驱动代理 | 连接查询、对象浏览、SQL 执行 |
+| 列式分析 | StarRocks | 可选驱动代理 | 连接查询、对象浏览、SQL 执行 |
 | 搜索 | Sphinx | 可选驱动代理 | SphinxQL 查询与对象浏览 |
 | 关系型 | SQL Server | 可选驱动代理 | 库表浏览、SQL 查询、对象管理 |
 | 文件型 | SQLite | 可选驱动代理 | 本地文件库浏览、编辑、导出 |
 | 文件型 | DuckDB | 可选驱动代理 | 大表查询、分页浏览、文件库管理 |
+| 国产数据库 | OceanBase | 可选驱动代理 | MySQL / Oracle 租户接入、对象浏览、查询工作流 |
 | 国产数据库 | Dameng | 可选驱动代理 | 连接查询、对象浏览、数据编辑 |
 | 国产数据库 | Kingbase | 可选驱动代理 | 连接查询、对象浏览、数据编辑 |
 | 国产数据库 | HighGo | 可选驱动代理 | 连接查询、对象浏览、数据编辑 |
 | 国产数据库 | Vastbase | 可选驱动代理 | 连接查询、对象浏览、数据编辑 |
+| 国产数据库 | OpenGauss | 可选驱动代理 | 类 PostgreSQL 的库表浏览、SQL 查询、对象管理 |
+| 国产数据库 | GaussDB | 可选驱动代理 | 类 PostgreSQL 的库表浏览、SQL 查询、对象管理 |
+| 多模型数据库 | InterSystems IRIS | 可选驱动代理 | Namespace 浏览、SQL 查询、对象管理 |
 | 文档型 | MongoDB | 可选驱动代理 | 文档查询、集合浏览、连接管理 |
 | 时序 | TDengine | 可选驱动代理 | 时序库表浏览、查询分析 |
+| 时序 | Apache IoTDB | 可选驱动代理 | Storage Group / Device / Timeseries 浏览与查询 |
 | 列式分析 | ClickHouse | 可选驱动代理 | 分析查询、对象浏览、SQL 执行 |
+| 联邦查询 | Trino | 可选驱动代理 | 跨多数据源联邦 SQL、`catalog.schema` 浏览、SQL 执行 |
+| 搜索 | Elasticsearch | 可选驱动代理 | 索引浏览、Mapping 检查、JSON DSL / query_string 查询 |
 | 扩展接入 | Custom Driver/DSN | 自定义 | 通过 Driver + DSN 接入更多数据源 |

 <h2 align="center">📸 项目截图</h2>
@@ -71,6 +86,9 @@ GoNavi 面向开发者与 DBA，核心目标是让数据库操作在桌面端做
 - **多模型服务商支持**：内置跨平台接入 OpenAI, Google Gemini, Anthropic Claude，同时支持任意自定义兼容 OpenAI 格式的 API。
 - **关联表结构上下文**：原生支持将当前数据库表结构直接提取作为上下文发送给 AI，让 SQL 生成、分析变得更精准。
 - **快捷指令**：内置多种快捷对话指（如一键生成 SQL、解释执行逻辑、分析性能优化、表字段代码评审等）。
+- **内置 MCP 工作流**：可在 AI 设置里管理 MCP 服务，一键安装 GoNavi MCP 到 Claude Code / Codex，或开启 Streamable HTTP 供远端 Agent 使用。
+- **远端 Agent 边界清晰**：数据库连接与密码继续保留在运行 GoNavi 的主机上，云端 Agent 通过 MCP 读取结构与上下文。
+- **安全控制可追溯**：远端 `schema-only` 模式默认不暴露 `execute_sql`；如开启 SQL 执行，非只读语句仍需显式传入 `allowMutating=true`。

 ### 性能与交互
 - 大数据场景下保持流畅交互（含 DataGrid 列宽拖拽、批量编辑流程优化）。
@@ -126,17 +144,26 @@ GoNavi 面向开发者与 DBA，核心目标是让数据库操作在桌面端做
 - [Go](https://go.dev/dl/) 1.21+
 - [Node.js](https://nodejs.org/) 18+
 - [Wails CLI](https://wails.io/docs/gettingstarted/installation):
-  `go install github.com/wailsapp/wails/v2/cmd/wails@latest`
+  `go install github.com/wailsapp/wails/v2/cmd/wails@v2.11.0`

 ### 开发模式

-```bash
+```shell
 # 克隆项目
 git clone https://github.com/Syngnat/GoNavi.git
 cd GoNavi

 # 启动开发（热重载）
 wails dev
+
+# 本地快速启动：未修改 Go 导出方法签名时使用
+node tools/wails-fast-dev.mjs
+
+# 修改 Go 导出方法签名后刷新 Wails JS 绑定
+node tools/wails-fast-dev.mjs --refresh-bindings
+
+# Windows PowerShell 低内存视觉模式：关闭透明 WebView 和 Acrylic 背景
+$env:GONAVI_LOW_MEMORY_MODE="1"; node tools/wails-fast-dev.mjs
 ```

 ### 编译构建
@@ -151,6 +178,82 @@ wails build -clean

 构建产物位于 `build/bin`。

+### Docker / Podman（仅 MCP Server）
+
+当前容器化支持仅覆盖 `gonavi-mcp-server`，不包含桌面 GUI 主界面。
+
+### 浏览器访问版（实验中）
+
+仓库主程序现在额外提供了一个 `web-server` 运行模式，用同一套 Go 后端 + React 前端提供浏览器访问入口：
+
+```powershell
+go build .
+.\GoNavi-Wails.exe web-server --addr 127.0.0.1:34116
+```
+
+首次访问会进入 `/setup` 完成 Web 管理员密码初始化；可选启用 Google Authenticator，服务端会落地 `web_auth.json`、Session Cookie、恢复码与登录失败限流。
+
+当前阶段已具备：
+
+- 浏览器端 Wails bridge（`window.go.*` / `window.runtime.*` -> HTTP / SSE）
+- 首次初始化页、登录页、登出接口
+- Session 空闲超时 / 绝对超时 / 记住登录时长
+- Google Authenticator TOTP 与恢复码
+
+当前仍在继续收口：
+
+- 外部 SQL / 连接包导入导出等文件型能力的浏览器上传下载工作台
+- 更多桌面专属能力的 Web 门禁与替代交互
+- 反向代理 / HTTPS / 零信任部署说明
+
+```bash
+cp docker.mcp-server.env.example docker.mcp-server.env
+docker compose --env-file docker.mcp-server.env -f docker-compose.mcp-server.yml up -d
+```
+
+请把 GoNavi 的活动数据目录挂载进容器。该目录内至少应包含 `connections.json`、`daily_secrets.json`，如需可选驱动代理还应包含 `drivers/`。
+
+默认 Compose 会直接拉取 GHCR 预构建镜像。如果你要用当前仓库源码本地构建，再叠加一个 override：
+
+```bash
+docker compose --env-file docker.mcp-server.env \
+  -f docker-compose.mcp-server.yml \
+  -f docker-compose.mcp-server.local.yml \
+  up -d --build
+```
+
+如果你使用 Podman，可直接复用同一套 OCI 镜像，走 `podman run` 或 Quadlet。仓库内已经提供 [deploy/podman/gonavi-mcp-server](deploy/podman/gonavi-mcp-server) 作为 Podman 原生部署入口，适合 Linux 服务器 / NAS 的 rootless systemd 常驻服务。
+
+部署矩阵：
+
+- Docker Desktop / Linux 服务器 / NAS：`docker-compose.mcp-server.yml`
+- Podman / Quadlet：[deploy/podman/gonavi-mcp-server](deploy/podman/gonavi-mcp-server)
+- Kubernetes：[deploy/k8s/gonavi-mcp-server](deploy/k8s/gonavi-mcp-server)（`kustomization.yaml` + overlays）
+- Helm Chart：[deploy/helm/gonavi-mcp-server](deploy/helm/gonavi-mcp-server)
+- 仅构建环境：`Dockerfile.build-env`
+
+完整部署方式与安全边界见 [cmd/gonavi-mcp-server/README.md](cmd/gonavi-mcp-server/README.md)。
+
+### Docker / Podman（仅构建环境）
+
+如果只是想要一套稳定的 Linux 构建环境来编译 Wails，可直接使用 `Dockerfile.build-env`：
+
+```bash
+docker build -f Dockerfile.build-env -t gonavi-build-env:local .
+docker run --rm -it -v "$PWD:/workspace" -w /workspace gonavi-build-env:local bash
+```
+
+同一个 Dockerfile 也可以直接给 Podman 使用，例如 `podman build -f Dockerfile.build-env -t localhost/gonavi-build-env:local .`，然后执行 `podman run --rm -it -v "$PWD:/workspace" -w /workspace localhost/gonavi-build-env:local bash`。
+
+这个镜像默认安装 WebKitGTK 4.0 构建依赖，兼容面更适合常见 Linux / NAS 场景。镜像底座本身支持多架构，`amd64` / `arm64` 会跟随容器平台。
+
+仓库会把预构建镜像推送到 GHCR：
+
+- `ghcr.io/syngnat/gonavi-mcp-server:latest`
+- `ghcr.io/syngnat/gonavi-build-env:latest`
+
+这个镜像只负责构建 Linux 产物，不会把 Wails 桌面 GUI 变成可浏览器访问的 Web 服务。
+
 ### 跨平台发布（GitHub Actions）

 仓库内置发布流水线，推送 `v*` Tag 可自动构建并发布 Release。
@@ -185,6 +288,16 @@ sudo apt-get update
 sudo apt-get install -y libgtk-3-0 libwebkit2gtk-4.0-37 libjavascriptcoregtk-4.0-18
 ```

+### Linux 中文显示为方框
+
+Ubuntu 24.04 LTS 的最小化桌面或服务器环境可能没有安装中文 CJK 字体，GoNavi 打开后中文会显示为方框。安装 Noto / 文泉驿字体后重启 GoNavi：
+
+```bash
+sudo apt-get update
+sudo apt-get install -y fonts-noto-cjk fonts-wqy-microhei
+fc-cache -fv
+```
+
 ---

 ## 贡献指南
--- a/build-driver-agents.sh
+++ b/build-driver-agents.sh
@@ -5,7 +5,11 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$SCRIPT_DIR"

-DEFAULT_DRIVERS=(mariadb doris sphinx sqlserver sqlite duckdb dameng kingbase highgo vastbase mongodb tdengine clickhouse)
+DEFAULT_DRIVERS=(mariadb oceanbase doris starrocks sphinx sqlserver sqlite duckdb dameng kingbase highgo vastbase opengauss gaussdb iris mongodb tdengine iotdb clickhouse elasticsearch)
+DEFAULT_PLATFORMS=(darwin/amd64 darwin/arm64 windows/amd64 windows/arm64 linux/amd64 linux/arm64)
+DUCKDB_WINDOWS_LIBRARY_VERSION="v1.4.4"
+DUCKDB_WINDOWS_LIBRARY_URL="https://github.com/duckdb/duckdb/releases/download/${DUCKDB_WINDOWS_LIBRARY_VERSION}/libduckdb-windows-amd64.zip"
+DUCKDB_WINDOWS_SUPPORT_DLL="duckdb.dll"

 usage() {
  cat <<'EOF'
@@ -14,17 +18,21 @@ usage() {

 选项：
  --drivers <列表>      指定驱动列表（逗号分隔），例如：kingbase,mongodb
-  --platform <GOOS/GOARCH>
-                        目标平台，默认使用当前 Go 环境（go env GOOS/GOARCH）
+  --platform <目标>      目标平台：current、all、GOOS/GOARCH，或逗号分隔列表
+                        默认 current（当前 Go 环境）
  --out-dir <目录>      输出目录根路径，默认：dist/driver-agents
  --bundle-name <文件名> 驱动总包 zip 名称，默认：GoNavi-DriverAgents.zip
  --strict              任一驱动构建失败即中断（默认失败后继续，最后汇总）
+  --upx                 要求使用 UPX 压缩支持的平台产物（默认 auto：有 upx 则压缩）
+  --no-upx              禁用 UPX 压缩
  -h, --help            显示帮助

 示例：
  ./build-driver-agents.sh
  ./build-driver-agents.sh --drivers kingbase
  ./build-driver-agents.sh --platform windows/amd64 --drivers kingbase,mongodb
+  ./build-driver-agents.sh --platform all
+  ./build-driver-agents.sh --platform darwin/arm64,windows/amd64,linux/amd64
 EOF
 }

@@ -33,7 +41,10 @@ normalize_driver() {
  name="$(echo "${1:-}" | tr '[:upper:]' '[:lower:]' | xargs)"
  case "$name" in
    doris|diros) echo "doris" ;;
-    mariadb|sphinx|sqlserver|sqlite|duckdb|dameng|kingbase|highgo|vastbase|mongodb|tdengine|clickhouse)
+    open_gauss|open-gauss) echo "opengauss" ;;
+    gaussdb|gauss_db|gauss-db) echo "gaussdb" ;;
+    elasticsearch|elastic) echo "elasticsearch" ;;
+    mariadb|oceanbase|starrocks|sphinx|sqlserver|sqlite|duckdb|dameng|kingbase|highgo|vastbase|opengauss|gaussdb|iris|mongodb|tdengine|iotdb|clickhouse)
      echo "$name"
      ;;
    *)
@@ -58,11 +69,177 @@ platform_dir_name() {
  esac
 }

+current_platform() {
+  echo "$(go env GOOS)/$(go env GOARCH)"
+}
+
+append_platform() {
+  local candidate
+  candidate="$1"
+  if [[ "$platform_seen" == *"|$candidate|"* ]]; then
+    return 0
+  fi
+  platforms+=("$candidate")
+  platform_seen="${platform_seen}${candidate}|"
+}
+
+normalize_platform() {
+  local value goos goarch platform_dir
+  value="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+  case "$value" in
+    current|"")
+      current_platform
+      ;;
+    */*)
+      goos="${value%%/*}"
+      goarch="${value##*/}"
+      platform_dir="$(platform_dir_name "$goos")"
+      if [[ -z "$goos" || -z "$goarch" || "$platform_dir" == "Unknown" ]]; then
+        return 1
+      fi
+      echo "$goos/$goarch"
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+zip_bundle() {
+  local bundle_zip_path="$1"
+  local bundle_stage_dir="$2"
+  local -a bundle_dirs=()
+  local dir
+
+  for dir in "$bundle_stage_dir"/*; do
+    [[ -d "$dir" ]] || continue
+    bundle_dirs+=("$(basename "$dir")")
+  done
+
+  if [[ ${#bundle_dirs[@]} -eq 0 ]]; then
+    echo "❌ 驱动总包 staging 目录为空。"
+    exit 1
+  fi
+
+  rm -f "$bundle_zip_path"
+  if command -v zip >/dev/null 2>&1; then
+    (
+      cd "$bundle_stage_dir"
+      zip -qry "$bundle_zip_path" "${bundle_dirs[@]}"
+    )
+  elif command -v python3 >/dev/null 2>&1; then
+    BUNDLE_STAGE_DIR="$bundle_stage_dir" BUNDLE_ZIP_PATH="$bundle_zip_path" python3 - <<'PY'
+import os
+import zipfile
+from pathlib import Path
+
+stage = Path(os.environ["BUNDLE_STAGE_DIR"])
+target = Path(os.environ["BUNDLE_ZIP_PATH"])
+with zipfile.ZipFile(target, "w", compression=zipfile.ZIP_DEFLATED) as zf:
+    for path in stage.rglob("*"):
+        if path.is_file():
+            zf.write(path, path.relative_to(stage).as_posix())
+PY
+  else
+    echo "❌ 未找到 zip 或 python3，无法生成驱动总包 zip。"
+    exit 1
+  fi
+}
+
+zip_duckdb_windows_package() {
+  local bundle_stage_dir="$1"
+  local zip_path="$2"
+
+  rm -f "$zip_path"
+  if command -v python3 >/dev/null 2>&1; then
+    BUNDLE_STAGE_DIR="$bundle_stage_dir" BUNDLE_ZIP_PATH="$zip_path" python3 - <<'PY'
+import os
+import zipfile
+
+stage_dir = os.environ["BUNDLE_STAGE_DIR"]
+zip_path = os.environ["BUNDLE_ZIP_PATH"]
+entries = [
+    ("Windows/duckdb-driver-agent-windows-amd64.exe", os.path.join(stage_dir, "Windows", "duckdb-driver-agent-windows-amd64.exe")),
+    ("Windows/duckdb.dll", os.path.join(stage_dir, "Windows", "duckdb.dll")),
+]
+
+with zipfile.ZipFile(zip_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
+    for arcname, src in entries:
+        if not os.path.isfile(src):
+            raise FileNotFoundError(src)
+        zf.write(src, arcname)
+PY
+  elif command -v zip >/dev/null 2>&1; then
+    (
+      cd "$bundle_stage_dir"
+      zip -qry "$zip_path" "Windows/duckdb-driver-agent-windows-amd64.exe" "Windows/duckdb.dll"
+    )
+  else
+    echo "❌ 未找到 python3 或 zip，无法生成 DuckDB Windows 专属驱动包。"
+    exit 1
+  fi
+}
+
+prepare_duckdb_windows_library() {
+  local cache_root="$1"
+  local lib_dir="$cache_root/duckdb-windows-${DUCKDB_WINDOWS_LIBRARY_VERSION}"
+  local zip_path="$cache_root/libduckdb-windows-amd64.zip"
+
+  if [[ -f "$lib_dir/duckdb.dll" && -f "$lib_dir/duckdb.lib" ]]; then
+    printf '%s\n' "$lib_dir"
+    return 0
+  fi
+
+  mkdir -p "$lib_dir"
+  echo "⬇️  下载 DuckDB Windows 官方动态库：$DUCKDB_WINDOWS_LIBRARY_URL" >&2
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL "$DUCKDB_WINDOWS_LIBRARY_URL" -o "$zip_path"
+  elif command -v wget >/dev/null 2>&1; then
+    wget -q "$DUCKDB_WINDOWS_LIBRARY_URL" -O "$zip_path"
+  else
+    echo "❌ 未找到 curl 或 wget，无法下载 DuckDB Windows 动态库。" >&2
+    return 1
+  fi
+
+  if command -v unzip >/dev/null 2>&1; then
+    unzip -qo "$zip_path" -d "$lib_dir"
+  elif command -v python3 >/dev/null 2>&1; then
+    DUCKDB_LIB_ZIP="$zip_path" DUCKDB_LIB_DIR="$lib_dir" python3 - <<'PY'
+import os
+import zipfile
+
+zip_path = os.environ["DUCKDB_LIB_ZIP"]
+target = os.environ["DUCKDB_LIB_DIR"]
+with zipfile.ZipFile(zip_path) as zf:
+    zf.extractall(target)
+PY
+  else
+    echo "❌ 未找到 unzip 或 python3，无法解压 DuckDB Windows 动态库。" >&2
+    return 1
+  fi
+
+  if [[ ! -f "$lib_dir/duckdb.dll" || ! -f "$lib_dir/duckdb.lib" ]]; then
+    echo "❌ DuckDB Windows 动态库包缺少 duckdb.dll 或 duckdb.lib。" >&2
+    return 1
+  fi
+
+  cp "$lib_dir/duckdb.lib" "$lib_dir/libduckdb.dll.a"
+  cp "$lib_dir/duckdb.lib" "$lib_dir/libduckdb.a"
+  printf '%s\n' "$lib_dir"
+}
+
+join_by_comma() {
+  local IFS=,
+  echo "$*"
+}
+
 driver_csv=""
 target_platform=""
 out_root="dist/driver-agents"
 bundle_name="GoNavi-DriverAgents.zip"
+duckdb_windows_zip_name="duckdb-driver.zip"
 strict_mode="false"
+upx_mode="${GONAVI_DRIVER_AGENT_UPX:-auto}"

 while [[ $# -gt 0 ]]; do
  case "$1" in
@@ -86,6 +263,14 @@ while [[ $# -gt 0 ]]; do
      strict_mode="true"
      shift
      ;;
+    --upx)
+      upx_mode="required"
+      shift
+      ;;
+    --no-upx)
+      upx_mode="off"
+      shift
+      ;;
    -h|--help)
      usage
      exit 0
@@ -103,20 +288,6 @@ if ! command -v go >/dev/null 2>&1; then
  exit 1
 fi

-if [[ -z "$target_platform" ]]; then
-  target_platform="$(go env GOOS)/$(go env GOARCH)"
-fi
-
-if [[ "$target_platform" != */* ]]; then
-  echo "❌ --platform 参数格式错误，应为 GOOS/GOARCH，例如 darwin/arm64"
-  exit 1
-fi
-
-goos="${target_platform%%/*}"
-goarch="${target_platform##*/}"
-platform_key="${goos}-${goarch}"
-platform_dir="$(platform_dir_name "$goos")"
-
 declare -a drivers=()
 if [[ -n "$driver_csv" ]]; then
  IFS=',' read -r -a raw_drivers <<<"$driver_csv"
@@ -130,69 +301,135 @@ if [[ -n "$driver_csv" ]]; then
 else
  drivers=("${DEFAULT_DRIVERS[@]}")
 fi
+revision_driver_csv="$(join_by_comma "${drivers[@]}")"

-output_dir="${out_root%/}/${platform_key}"
+declare -a platforms=()
+platform_seen="|"
+if [[ -z "$target_platform" ]]; then
+  target_platform="current"
+fi
+IFS=',' read -r -a raw_platforms <<<"$target_platform"
+for item in "${raw_platforms[@]}"; do
+  normalized_platform="$(printf '%s' "$item" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+  if [[ "$normalized_platform" == "all" ]]; then
+    for default_platform in "${DEFAULT_PLATFORMS[@]}"; do
+      append_platform "$default_platform"
+    done
+    continue
+  fi
+  normalized_platform="$(normalize_platform "$item")" || {
+    echo "❌ --platform 参数格式错误，应为 current、all、GOOS/GOARCH 或逗号分隔列表，例如 darwin/arm64,windows/amd64"
+    exit 1
+  }
+  append_platform "$normalized_platform"
+done
+
+if [[ ${#platforms[@]} -eq 0 ]]; then
+  echo "❌ 未指定有效目标平台。"
+  exit 1
+fi
+
+mkdir -p "$out_root"
+out_root_abs="$(cd "$out_root" && pwd)"
 bundle_stage_dir="$(mktemp -d "${TMPDIR:-/tmp}/gonavi-driver-bundle.XXXXXX")"
-bundle_platform_dir="$bundle_stage_dir/$platform_dir"

 cleanup() {
  rm -rf "$bundle_stage_dir"
 }
 trap cleanup EXIT

-mkdir -p "$output_dir" "$bundle_platform_dir"
-output_dir_abs="$(cd "$output_dir" && pwd)"
-bundle_zip_path="$output_dir_abs/$bundle_name"
+if [[ ${#platforms[@]} -eq 1 ]]; then
+  single_platform="${platforms[0]}"
+  single_platform_key="${single_platform/\//-}"
+  single_output_dir="${out_root%/}/$single_platform_key"
+  mkdir -p "$single_output_dir"
+  bundle_zip_path="$(cd "$single_output_dir" && pwd)/$bundle_name"
+else
+  bundle_zip_path="$out_root_abs/$bundle_name"
+fi

 declare -a built_assets=()
 declare -a failed_drivers=()
 declare -a skipped_drivers=()

 echo "🚀 开始构建 optional-driver-agent"
-echo "   平台：$goos/$goarch"
-echo "   输出目录：$output_dir_abs"
+echo "   平台：${platforms[*]}"
+echo "   输出根目录：$out_root_abs"
 echo "   驱动列表：${drivers[*]}"
-echo "🧭 生成 driver-agent revision 指纹"
-"$SCRIPT_DIR/tools/generate-driver-agent-revisions.sh" --platform "$target_platform"

-for driver in "${drivers[@]}"; do
-  if [[ "$driver" == "duckdb" && "$goos" == "windows" && "$goarch" != "amd64" ]]; then
-    echo "⚠️  跳过 duckdb（仅支持 windows/amd64）"
-    skipped_drivers+=("$driver")
-    continue
-  fi
+for platform in "${platforms[@]}"; do
+  goos="${platform%%/*}"
+  goarch="${platform##*/}"
+  platform_key="${goos}-${goarch}"
+  platform_dir="$(platform_dir_name "$goos")"
+  output_dir="${out_root%/}/${platform_key}"
+  bundle_platform_dir="$bundle_stage_dir/$platform_dir"

-  build_driver="$(build_driver_name "$driver")"
-  tag="gonavi_${build_driver}_driver"
-  asset_name="${driver}-driver-agent-${goos}-${goarch}"
-  if [[ "$goos" == "windows" ]]; then
-    asset_name="${asset_name}.exe"
-  fi
-  output_path="$output_dir_abs/$asset_name"
+  mkdir -p "$output_dir" "$bundle_platform_dir"
+  output_dir_abs="$(cd "$output_dir" && pwd)"

-  cgo_enabled=0
-  if [[ "$driver" == "duckdb" ]]; then
-    cgo_enabled=1
-  fi
+  echo ""
+  echo "🧭 生成 driver-agent revision 指纹：$platform"
+  "$SCRIPT_DIR/tools/generate-driver-agent-revisions.sh" --platform "$platform" --drivers "$revision_driver_csv"

-  echo "🔧 构建 $driver -> $asset_name (tag=$tag, CGO_ENABLED=$cgo_enabled)"
-  set +e
-  CGO_ENABLED="$cgo_enabled" GOOS="$goos" GOARCH="$goarch" GOTOOLCHAIN=auto \
-    go build -tags "$tag" -trimpath -ldflags "-s -w" -o "$output_path" ./cmd/optional-driver-agent
-  build_exit=$?
-  set -e
-
-  if [[ $build_exit -ne 0 ]]; then
-    echo "❌ 构建失败：$driver"
-    failed_drivers+=("$driver")
-    if [[ "$strict_mode" == "true" ]]; then
-      exit $build_exit
+  for driver in "${drivers[@]}"; do
+    if [[ "$driver" == "duckdb" && "$goos" == "windows" && "$goarch" != "amd64" ]]; then
+      echo "⚠️  跳过 duckdb（$platform 仅支持 windows/amd64）"
+      skipped_drivers+=("duckdb($platform)")
+      continue
    fi
-    continue
-  fi

-  cp "$output_path" "$bundle_platform_dir/$asset_name"
-  built_assets+=("$asset_name")
+    build_driver="$(build_driver_name "$driver")"
+    tag="gonavi_${build_driver}_driver"
+    build_tags="$tag"
+    asset_name="${driver}-driver-agent-${goos}-${goarch}"
+    if [[ "$goos" == "windows" ]]; then
+      asset_name="${asset_name}.exe"
+    fi
+    output_path="$output_dir_abs/$asset_name"
+
+    cgo_enabled=0
+    if [[ "$driver" == "duckdb" ]]; then
+      cgo_enabled=1
+    fi
+    duckdb_lib_dir=""
+    if [[ "$driver" == "duckdb" && "$goos" == "windows" && "$goarch" == "amd64" ]]; then
+      duckdb_lib_dir="$(prepare_duckdb_windows_library "$bundle_stage_dir")"
+      build_tags="$build_tags duckdb_use_lib"
+    fi
+
+    echo "🔧 构建 $driver -> $asset_name (platform=$platform, tags=$build_tags, CGO_ENABLED=$cgo_enabled)"
+    set +e
+    if [[ -n "$duckdb_lib_dir" ]]; then
+      CGO_ENABLED="$cgo_enabled" GOOS="$goos" GOARCH="$goarch" GOTOOLCHAIN=auto \
+        CGO_LDFLAGS="-L${duckdb_lib_dir} -lduckdb" PATH="${duckdb_lib_dir}:$PATH" \
+        go build -tags "$build_tags" -trimpath -ldflags "-s -w" -o "$output_path" ./cmd/optional-driver-agent
+    else
+      CGO_ENABLED="$cgo_enabled" GOOS="$goos" GOARCH="$goarch" GOTOOLCHAIN=auto \
+        go build -tags "$build_tags" -trimpath -ldflags "-s -w" -o "$output_path" ./cmd/optional-driver-agent
+    fi
+    build_exit=$?
+    set -e
+
+    if [[ $build_exit -ne 0 ]]; then
+      echo "❌ 构建失败：$driver ($platform)"
+      failed_drivers+=("$driver($platform)")
+      if [[ "$strict_mode" == "true" ]]; then
+        exit $build_exit
+      fi
+      continue
+    fi
+
+    GONAVI_DRIVER_AGENT_UPX="$upx_mode" "$SCRIPT_DIR/tools/compress-driver-artifact.sh" "$output_path" "$platform" "$platform_dir/$asset_name"
+    cp "$output_path" "$bundle_platform_dir/$asset_name"
+    if [[ -n "$duckdb_lib_dir" ]]; then
+      cp "$duckdb_lib_dir/$DUCKDB_WINDOWS_SUPPORT_DLL" "$output_dir_abs/$DUCKDB_WINDOWS_SUPPORT_DLL"
+      GONAVI_DRIVER_AGENT_UPX="$upx_mode" "$SCRIPT_DIR/tools/compress-driver-artifact.sh" "$output_dir_abs/$DUCKDB_WINDOWS_SUPPORT_DLL" "$platform" "$platform_dir/$DUCKDB_WINDOWS_SUPPORT_DLL"
+      cp "$output_dir_abs/$DUCKDB_WINDOWS_SUPPORT_DLL" "$bundle_platform_dir/$DUCKDB_WINDOWS_SUPPORT_DLL"
+      built_assets+=("$platform_dir/$DUCKDB_WINDOWS_SUPPORT_DLL")
+    fi
+    built_assets+=("$platform_dir/$asset_name")
+  done
 done

 if [[ ${#built_assets[@]} -eq 0 ]]; then
@@ -200,25 +437,19 @@ if [[ ${#built_assets[@]} -eq 0 ]]; then
  exit 1
 fi

-rm -f "$bundle_zip_path"
-if command -v zip >/dev/null 2>&1; then
-  (
-    cd "$bundle_stage_dir"
-    zip -qry "$bundle_zip_path" "$platform_dir"
-  )
-elif command -v ditto >/dev/null 2>&1; then
-  (
-    cd "$bundle_stage_dir"
-    ditto -c -k --sequesterRsrc --keepParent "$platform_dir" "$bundle_zip_path"
-  )
-else
-  echo "❌ 未找到 zip/ditto，无法生成驱动总包 zip。"
-  exit 1
+zip_bundle "$bundle_zip_path" "$bundle_stage_dir"
+
+duckdb_asset_path="$out_root_abs/windows-amd64/duckdb-driver-agent-windows-amd64.exe"
+duckdb_dll_path="$out_root_abs/windows-amd64/$DUCKDB_WINDOWS_SUPPORT_DLL"
+if [[ -f "$duckdb_asset_path" && -f "$duckdb_dll_path" ]]; then
+  duckdb_zip_path="$out_root_abs/windows-amd64/$duckdb_windows_zip_name"
+  zip_duckdb_windows_package "$bundle_stage_dir" "$duckdb_zip_path"
+  built_assets+=("Windows/$duckdb_windows_zip_name")
 fi

 echo ""
 echo "✅ 构建完成"
-echo "   单文件输出目录：$output_dir_abs"
+echo "   单文件输出根目录：$out_root_abs"
 echo "   驱动总包：$bundle_zip_path"
 echo "   已构建：${built_assets[*]}"
 if [[ ${#skipped_drivers[@]} -gt 0 ]]; then
--- a/build-release.sh
+++ b/build-release.sh
@@ -46,6 +46,13 @@ RED='\033[0;31m'
 YELLOW='\033[1;33m'
 NC='\033[0m'

+BUILD_FAILURES=()
+
+record_build_failure() {
+    local target="$1"
+    BUILD_FAILURES+=("$target")
+}
+
 get_file_size_bytes() {
    local target="$1"
    if [ ! -f "$target" ]; then
@@ -159,6 +166,7 @@ package_macos_release() {
    wails build -platform "darwin/${platform}" -clean -ldflags "$LDFLAGS"
    if [ $? -ne 0 ]; then
        echo -e "${RED}   ❌ macOS ${platform} 构建失败。${NC}"
+        record_build_failure "macOS ${platform}"
        return
    fi

@@ -213,6 +221,7 @@ if command -v x86_64-w64-mingw32-gcc &> /dev/null; then
        echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-windows-amd64.exe"
    else
        echo -e "${RED}   ❌ Windows amd64 构建失败。${NC}"
+        record_build_failure "Windows amd64"
    fi
 else
    echo -e "${YELLOW}   ⚠️  未找到 MinGW 工具 (x86_64-w64-mingw32-gcc)，跳过 Windows amd64 构建。${NC}"
@@ -230,6 +239,7 @@ if command -v aarch64-w64-mingw32-gcc &> /dev/null; then
        echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-windows-arm64.exe"
    else
        echo -e "${RED}   ❌ Windows arm64 构建失败。${NC}"
+        record_build_failure "Windows arm64"
    fi
 else
    echo -e "${YELLOW}   ⚠️  未找到 MinGW ARM64 工具 (aarch64-w64-mingw32-gcc)，跳过 Windows arm64 构建。${NC}"
@@ -259,6 +269,7 @@ if [ "$CURRENT_OS" = "Linux" ] && [ "$CURRENT_ARCH" = "x86_64" ]; then
        echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-linux-amd64.tar.gz"
    else
        echo -e "${RED}   ❌ Linux amd64 构建失败。${NC}"
+        record_build_failure "Linux amd64"
    fi
 elif command -v x86_64-linux-gnu-gcc &> /dev/null; then
    # macOS 或其他系统，尝试交叉编译
@@ -279,6 +290,7 @@ elif command -v x86_64-linux-gnu-gcc &> /dev/null; then
        echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-linux-amd64.tar.gz"
    else
        echo -e "${RED}   ❌ Linux amd64 交叉编译失败。${NC}"
+        record_build_failure "Linux amd64"
    fi
    unset CC CXX CGO_ENABLED
 else
@@ -304,6 +316,7 @@ if [ "$CURRENT_OS" = "Linux" ] && [ "$CURRENT_ARCH" = "aarch64" ]; then
        echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-linux-arm64.tar.gz"
    else
        echo -e "${RED}   ❌ Linux arm64 构建失败。${NC}"
+        record_build_failure "Linux arm64"
    fi
 elif command -v aarch64-linux-gnu-gcc &> /dev/null; then
    # 交叉编译
@@ -324,6 +337,7 @@ elif command -v aarch64-linux-gnu-gcc &> /dev/null; then
        echo "   ✅ 已生成 ${APP_NAME}-${VERSION}-linux-arm64.tar.gz"
    else
        echo -e "${RED}   ❌ Linux arm64 交叉编译失败。${NC}"
+        record_build_failure "Linux arm64"
    fi
    unset CC CXX CGO_ENABLED
 else
@@ -357,12 +371,21 @@ else
 fi

 echo ""
-echo -e "${GREEN}🎉 所有任务完成！构建产物在 'dist/' 目录下：${NC}"
+if [ "${#BUILD_FAILURES[@]}" -gt 0 ]; then
+    echo -e "${RED}❌ 构建未完全成功，失败平台：${BUILD_FAILURES[*]}${NC}"
+    echo -e "${YELLOW}📦 已成功生成的产物在 'dist/' 目录下：${NC}"
+else
+    echo -e "${GREEN}🎉 所有任务完成！构建产物在 'dist/' 目录下：${NC}"
+fi
 ls -lh "$DIST_DIR"
 echo ""
 echo -e "${GREEN}📋 支持的平台：${NC}"
-echo "   • macOS (Intel/Apple Silicon): .dmg"
+echo "   • macOS (Intel/Apple Silicon): .zip"
 echo "   • Windows (x64/ARM64): .exe"
 echo "   • Linux (x64/ARM64): .tar.gz"
 echo ""
 echo -e "${YELLOW}💡 提示：Linux AppImage 包请使用 GitHub Actions CI/CD 构建。${NC}"
+
+if [ "${#BUILD_FAILURES[@]}" -gt 0 ]; then
+    exit 1
+fi
--- a/cmd/gonavi-mcp-server/README.md
+++ b/cmd/gonavi-mcp-server/README.md
@@ -0,0 +1,381 @@
+# GoNavi MCP Server
+
+`gonavi-mcp-server` 会把 GoNavi 已保存连接背后的数据库能力通过 MCP 暴露给外部客户端。本机客户端默认使用 `stdio`；云端 Agent 可使用显式开启的 Streamable HTTP 模式。
+
+## 当前提供的 tools
+
+- `get_connections`
+  - 返回 GoNavi 已保存连接的 `id/name/type/target/defaultDatabase` 等摘要信息
+- `get_databases`
+  - 入参：`connectionId`
+- `get_tables`
+  - 入参：`connectionId`、可选 `dbName`
+  - 返回表列表，并在 `views` 字段附带视图列表，兼容旧客户端只调用 `get_tables` 的场景
+- `get_views`
+  - 入参：`connectionId`、可选 `dbName`
+  - 返回视图列表
+- `get_objects`
+  - 入参：`connectionId`、可选 `dbName`、可选 `objectTypes`
+  - 返回表、视图、触发器、函数、过程、序列、包、事件，以及消息队列类 `topic/queue/exchange` 等对象清单
+- `get_columns`
+  - 入参：`connectionId`、可选 `dbName`、`tableName`
+- `get_table_ddl`
+  - 入参：`connectionId`、可选 `dbName`、`tableName`
+- `execute_sql`
+  - 入参：`connectionId`、可选 `dbName`、`sql`
+  - 默认只允许只读 SQL
+  - 如果 SQL 包含 DDL/DML，必须显式传 `allowMutating=true`
+  - `maxRowsPerResult` 用来限制单个结果集返回的行数，默认 `200`
+
+远程 Agent 只需要结构元数据时，启动 HTTP 模式请加 `--schema-only`。该模式不注册 `execute_sql`，只保留连接摘要、对象清单、表/视图、字段、索引、外键、触发器和 DDL 工具。
+
+## 运行方式
+
+开发态直接运行：
+
+```powershell
+go run ./cmd/gonavi-mcp-server
+```
+
+显式运行本机 `stdio`：
+
+```powershell
+go run ./cmd/gonavi-mcp-server stdio
+```
+
+也可以先编译：
+
+```powershell
+go build -o .\bin\gonavi-mcp-server.exe .\cmd\gonavi-mcp-server
+```
+
+## Docker / Podman / Compose
+
+当前容器化支持仅覆盖 `gonavi-mcp-server`，不包含 Wails 桌面 GUI。
+
+当前支持矩阵：
+
+- Docker Desktop / Linux 服务器 / NAS：直接使用 Compose 或 `docker run`
+- Podman / Quadlet：使用 `deploy/podman/gonavi-mcp-server`
+- Kubernetes：使用 `deploy/k8s/gonavi-mcp-server`
+- Helm：使用 `deploy/helm/gonavi-mcp-server`
+- 仅构建环境：使用仓库根目录 `Dockerfile.build-env`
+- 桌面 GUI 浏览器访问版：当前不提供，此仓库主应用仍是 Wails 桌面程序，不是现成的 Web 服务
+
+仓库根目录已提供以下文件：
+
+- `Dockerfile.mcp-server`
+- `docker-compose.mcp-server.yml`
+- `docker.mcp-server.env.example`
+- `deploy/podman/gonavi-mcp-server/*`
+
+推荐流程：
+
+```bash
+cp docker.mcp-server.env.example docker.mcp-server.env
+docker compose --env-file docker.mcp-server.env -f docker-compose.mcp-server.yml up -d
+```
+
+默认 Compose 会拉取 GHCR 预构建镜像。如果你要基于当前工作区源码本地构建，再叠加：
+
+```bash
+docker compose --env-file docker.mcp-server.env \
+  -f docker-compose.mcp-server.yml \
+  -f docker-compose.mcp-server.local.yml \
+  up -d --build
+```
+
+其中 `GONAVI_HOST_DATA_ROOT` 必须指向 GoNavi 当前活动数据目录。该目录内至少应包含：
+
+- `connections.json`
+- `daily_secrets.json`
+- `drivers/`（如果目标连接依赖可选 driver agent）
+
+容器内默认会设置：
+
+- `GONAVI_DATA_ROOT=/data`
+- `GONAVI_MCP_HTTP_ADDR=0.0.0.0:8765`
+- `GONAVI_MCP_HTTP_PATH=/mcp`
+
+`GONAVI_DATA_ROOT` 会覆盖默认活动数据目录解析逻辑，避免宿主机路径与容器内路径不一致时依赖 `storage_root.json` 的绝对路径。
+
+如果你只想手动构建镜像：
+
+```bash
+docker build -f Dockerfile.mcp-server -t gonavi-mcp-server:local .
+docker run --rm -p 8765:8765 \
+  -e GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token \
+  -e GONAVI_MCP_SCHEMA_ONLY=true \
+  -e GONAVI_DATA_ROOT=/data \
+  -v /absolute/path/to/gonavi-data:/data \
+  gonavi-mcp-server:local http
+```
+
+如果你直接使用已发布镜像：
+
+```bash
+docker run --rm -p 8765:8765 \
+  -e GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token \
+  -e GONAVI_MCP_SCHEMA_ONLY=true \
+  -e GONAVI_DATA_ROOT=/data \
+  -v /absolute/path/to/gonavi-data:/data \
+  ghcr.io/syngnat/gonavi-mcp-server:latest http
+```
+
+### Podman
+
+仓库内还提供了 Podman 原生部署样例：
+
+- `deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example`
+- `deploy/podman/gonavi-mcp-server/gonavi-mcp-server.container`
+- `deploy/podman/gonavi-mcp-server/README.md`
+
+直接运行已发布镜像：
+
+```bash
+cp deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example ./gonavi-mcp-server.env
+podman run -d --name gonavi-mcp-server --replace \
+  -p 8765:8765 \
+  --env-file ./gonavi-mcp-server.env \
+  -v /absolute/path/to/gonavi-data:/data:Z \
+  ghcr.io/syngnat/gonavi-mcp-server:latest http
+```
+
+如果你要基于当前源码本地构建：
+
+```bash
+podman build -f Dockerfile.mcp-server -t localhost/gonavi-mcp-server:local .
+podman run -d --name gonavi-mcp-server --replace \
+  -p 8765:8765 \
+  --env-file ./gonavi-mcp-server.env \
+  -v /absolute/path/to/gonavi-data:/data:Z \
+  localhost/gonavi-mcp-server:local http
+```
+
+其中：
+
+- `gonavi-mcp-server.env` 用 `deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example` 初始化
+- `:Z` 适用于开启 SELinux 的宿主机；未启用 SELinux 可去掉
+- 更适合长期运行的方式见 [deploy/podman/gonavi-mcp-server/README.md](../../deploy/podman/gonavi-mcp-server/README.md) 中的 Quadlet 示例
+
+`podman compose` 本身依赖外部 compose provider，所以仓库对 Podman 的主支持路径是 `podman run` 与 Quadlet，而不是假设所有环境都能直接复用 Compose。
+
+## Kubernetes
+
+仓库内置了最小 K8s 示例：
+
+- `deploy/k8s/gonavi-mcp-server/kustomization.yaml`
+- `deploy/k8s/gonavi-mcp-server/base/deployment.yaml`
+- `deploy/k8s/gonavi-mcp-server/base/service.yaml`
+- `deploy/k8s/gonavi-mcp-server/README.md`
+- `deploy/k8s/gonavi-mcp-server/overlays/*`
+
+推荐先从现有 GoNavi 数据目录生成 Secret：
+
+```bash
+kubectl create namespace gonavi
+kubectl -n gonavi create secret generic gonavi-mcp-server-data \
+  --from-file=connections.json=/absolute/path/to/gonavi-data/connections.json \
+  --from-file=daily_secrets.json=/absolute/path/to/gonavi-data/daily_secrets.json \
+  --from-literal=GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token
+kubectl apply -k deploy/k8s/gonavi-mcp-server
+```
+
+如果需要 NAS hostPath、可选 driver agent PVC、Ingress，或两者组合，可直接使用 `overlays/nas-hostpath`、`overlays/drivers-pvc`、`overlays/ingress`、`overlays/ingress-with-drivers-pvc`。
+
+更完整的说明见 [deploy/k8s/gonavi-mcp-server/README.md](../../deploy/k8s/gonavi-mcp-server/README.md)。
+
+## Helm
+
+如果你希望把镜像、Secret、Ingress、hostPath / PVC 挂载做成参数化部署，而不是维护多份 Kustomize overlay，可直接使用：
+
+- `deploy/helm/gonavi-mcp-server`
+
+快速安装：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server -n gonavi --create-namespace
+```
+
+Chart 详细说明见 [deploy/helm/gonavi-mcp-server/README.md](../../deploy/helm/gonavi-mcp-server/README.md)。
+
+## Docker / Podman Build Environment
+
+如果你的目标不是运行 MCP，而是给 Linux 服务器 / NAS / CI 准备一套可重复的 Wails 构建环境，可直接使用仓库根目录的 `Dockerfile.build-env`：
+
+```bash
+docker build -f Dockerfile.build-env -t gonavi-build-env:local .
+docker run --rm -it -v "$PWD:/workspace" -w /workspace gonavi-build-env:local bash
+```
+
+如果你使用 Podman，也可以直接执行：
+
+```bash
+podman build -f Dockerfile.build-env -t localhost/gonavi-build-env:local .
+podman run --rm -it -v "$PWD:/workspace" -w /workspace localhost/gonavi-build-env:local bash
+```
+
+镜像内已预装 Go、Node、Wails CLI、GTK3 与 WebKitGTK 开发依赖，适合执行：
+
+```bash
+wails build
+```
+
+这个镜像默认安装 WebKitGTK 4.0 构建依赖，适合作为通用 Linux / NAS 构建环境。镜像基座支持多架构，`amd64` / `arm64` 会跟随容器平台。
+
+预构建镜像会发布到 GHCR：
+
+- `ghcr.io/syngnat/gonavi-mcp-server:latest`
+- `ghcr.io/syngnat/gonavi-build-env:latest`
+
+它只负责构建 Linux 产物，不会把 Wails 主程序变成浏览器版服务。
+
+远程 Agent 使用 Streamable HTTP 时必须设置 bearer token：
+
+```powershell
+$env:GONAVI_MCP_HTTP_TOKEN = "<随机token>"
+go run ./cmd/gonavi-mcp-server http --addr 127.0.0.1:8765 --path /mcp --schema-only
+```
+
+安装包主程序也支持同样模式：
+
+```powershell
+& "C:\Program Files\GoNavi\GoNavi.exe" mcp-server http --addr 127.0.0.1:8765 --path /mcp --token "<随机token>" --schema-only
+```
+
+默认建议只监听 `127.0.0.1`，再通过 SSH 隧道、反向代理或内网网关暴露给云端 Agent。不要在没有 TLS、防火墙和鉴权的情况下直接监听公网地址。
+
+无图形界面或需要把配置交给云端 Agent 时，可直接生成 OpenClaw / Hermans 等远程 MCP 配置：
+
+```powershell
+& "C:\Program Files\GoNavi\GoNavi.exe" mcp-server remote-config --client openclaw --url "https://<你的域名或隧道地址>/mcp" --token "<随机token>" --schema-only
+```
+
+独立 server 开发态也支持同样能力：
+
+```powershell
+go run ./cmd/gonavi-mcp-server remote-config --client hermans --url "https://<你的域名或隧道地址>/mcp" --token "<随机token>" --schema-only
+```
+
+## Claude Code / Codex / OpenClaw / Hermans
+
+正式安装包场景，推荐直接在 GoNavi 里使用“AI 设置 -> MCP 服务 -> 安装到 Claude Code / 安装到 Codex”。
+
+它会自动把当前安装的 `GoNavi.exe` 写入 Claude Code 的用户级 `~/.claude.json`，命令形态类似：
+
+```json
+{
+  "mcpServers": {
+    "gonavi": {
+      "type": "stdio",
+      "command": "C:\\Program Files\\GoNavi\\GoNavi.exe",
+      "args": ["mcp-server"],
+      "env": {}
+    }
+  }
+}
+```
+
+这样用户不需要自己找本机 `gonavi-mcp-server.exe` 路径，安装包本体就能直接作为 MCP 入口。
+
+Codex 当前使用 `~/.codex/config.toml`，GoNavi 会写入类似下面这段：
+
+```toml
+[mcp_servers.gonavi]
+command = 'C:\Program Files\GoNavi\GoNavi.exe'
+args = ['mcp-server']
+startup_timeout_sec = 60
+```
+
+仓库开发态如果要在本机 `Claude Code CLI` 里稳定使用这个 MCP，仍然推荐走仓库内包装脚本：
+
+```powershell
+.\tools\claude-gonavi-mcp.ps1 -p "必须调用 gonavi MCP 的 get_connections 工具"
+```
+
+或者：
+
+```cmd
+tools\claude-gonavi-mcp.cmd -p "必须调用 gonavi MCP 的 get_connections 工具"
+```
+
+这个脚本会先构建 `bin\gonavi-mcp-server.exe`，再通过 `--mcp-config` 和 `--strict-mcp-config` 把 GoNavi MCP 单独注入当前 Claude 会话，避免默认混合 MCP 加载时序导致的首轮工具未挂载问题。
+
+OpenClaw、Hermans 这类部署在云端或远端 Linux 的 Agent，不能直接使用 Windows 本机的 `stdio` 命令。GoNavi 的连接信息和数据库密码仍应留在 Windows 本机，由 GoNavi MCP 读取保存连接和系统凭据；远端 Agent 只拿到 MCP tools 和 `connectionId`。
+
+推荐接入形态：
+
+1. Windows 本机运行 GoNavi，并保持能访问已保存的数据库连接。
+2. 在 Windows 本机启动 `GoNavi.exe mcp-server http --addr 127.0.0.1:8765 --path /mcp --token <随机token> --schema-only`。
+3. 通过 SSH 隧道、反向代理或内网网关把 `http://127.0.0.1:8765/mcp` 暴露为云端 Agent 可访问的 HTTPS 地址。
+4. 在 OpenClaw / Hermans 中添加远程 MCP Server，transport 选择 Streamable HTTP，URL 指向 `/mcp` 地址，并设置请求头 `Authorization: Bearer <随机token>`。
+5. 先调用 `get_connections` 获取 `connectionId`，再调用 `get_databases`、`get_objects`、`get_tables`、`get_views`、`get_columns`、`get_table_ddl` 等工具读取结构。
+
+如果目标 Agent 支持 `mcpServers` JSON，可按下面的通用片段配置：
+
+```json
+{
+  "mcpServers": {
+    "gonavi": {
+      "type": "streamable-http",
+      "url": "https://<你的域名或隧道地址>/mcp",
+      "headers": {
+        "Authorization": "Bearer <随机token>"
+      }
+    }
+  }
+}
+```
+
+不要把数据库 `host/user/password` 写入云端 Agent 的配置文件。默认 `--schema-only` 不暴露 `execute_sql`；如果你明确需要远程执行 SQL，可以去掉该参数，此时 `execute_sql` 仍受 GoNavi AI 安全设置控制，写操作必须显式传 `allowMutating=true`。
+
+## MCP 客户端配置示例
+
+开发态：
+
+```json
+{
+  "mcpServers": {
+    "gonavi": {
+      "command": "go",
+      "args": ["run", "./cmd/gonavi-mcp-server"]
+    }
+  }
+}
+```
+
+Windows 独立 server 编译产物（开发态）：
+
+```json
+{
+  "mcpServers": {
+    "gonavi": {
+      "command": "D:\\Work\\CodeRepos\\GoNavi\\bin\\gonavi-mcp-server.exe",
+      "args": []
+    }
+  }
+}
+```
+
+Windows 已安装 GoNavi（推荐给最终用户）：
+
+```json
+{
+  "mcpServers": {
+    "gonavi": {
+      "type": "stdio",
+      "command": "C:\\Program Files\\GoNavi\\GoNavi.exe",
+      "args": ["mcp-server"],
+      "env": {}
+    }
+  }
+}
+```
+
+## 使用说明
+
+- 先调用 `get_connections`，拿到 `connectionId`
+- 之后所有数据库工具都只传 `connectionId`，由 GoNavi 服务端内部解析保存连接和密钥
+- 如果 `dbName` 为空，会优先使用该保存连接里的默认数据库
+- Server 会读取 GoNavi 当前活动数据目录里的连接配置，并通过系统 keyring/凭据管理器解析密文
+- 如果本机凭据存储不可用，依赖密钥的连接会返回对应错误
--- a/cmd/gonavi-mcp-server/main.go
+++ b/cmd/gonavi-mcp-server/main.go
@@ -0,0 +1,42 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+	"strings"
+
+	"GoNavi-Wails/internal/mcpserver"
+)
+
+func main() {
+	ctx := context.Background()
+	err := run(ctx, os.Args[1:])
+	if err != nil {
+		log.Printf("GoNavi MCP Server 退出: %v", err)
+	}
+}
+
+func run(ctx context.Context, args []string) error {
+	if len(args) == 0 {
+		return mcpserver.RunAppStdioServer(ctx)
+	}
+
+	mode := strings.ToLower(strings.TrimSpace(args[0]))
+	switch mode {
+	case "stdio", "--stdio":
+		return mcpserver.RunAppStdioServer(ctx)
+	case "http", "--http", "streamable-http", "--streamable-http":
+		options, err := mcpserver.ParseHTTPServerOptions(args[1:])
+		if err != nil {
+			return err
+		}
+		log.Printf("GoNavi MCP Streamable HTTP Server 启动：addr=%s path=%s schemaOnly=%v", options.Addr, options.Path, options.SchemaOnly)
+		return mcpserver.RunAppStreamableHTTPServer(ctx, options)
+	case "remote-config", "--remote-config":
+		return mcpserver.WriteRemoteMCPClientConfig(os.Stdout, args[1:])
+	default:
+		return fmt.Errorf("未知 MCP server 模式: %s（支持 stdio/http/remote-config）", args[0])
+	}
+}
--- a/cmd/mingw-import-lib/main.go
+++ b/cmd/mingw-import-lib/main.go
@@ -0,0 +1,27 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"GoNavi-Wails/internal/buildutil"
+)
+
+func main() {
+	var (
+		dllPath     string
+		dlltoolPath string
+		outputLib   string
+	)
+
+	flag.StringVar(&dllPath, "dll", "", "Path to the source DLL")
+	flag.StringVar(&dlltoolPath, "dlltool", "", "Optional path to dlltool executable")
+	flag.StringVar(&outputLib, "output-lib", "", "Output import library path")
+	flag.Parse()
+
+	if err := buildutil.GenerateWindowsImportLibraryFromDLL(dllPath, dlltoolPath, outputLib); err != nil {
+		fmt.Fprintf(os.Stderr, "generate mingw import library failed: %v\n", err)
+		os.Exit(1)
+	}
+}
--- a/cmd/optional-driver-agent/main.go
+++ b/cmd/optional-driver-agent/main.go
@@ -7,7 +7,11 @@ import (
 	"fmt"
 	"os"
 	"reflect"
+	"runtime"
+	"runtime/debug"
+	"strconv"
 	"strings"
+	"sync/atomic"
 	"time"

 	"GoNavi-Wails/internal/connection"
@@ -17,6 +21,7 @@ import (
 type agentRequest struct {
 	ID        int64                        `json:"id"`
 	Method    string                       `json:"method"`
+	SessionID string                       `json:"sessionId,omitempty"`
 	Config    *connection.ConnectionConfig `json:"config,omitempty"`
 	Query     string                       `json:"query,omitempty"`
 	TimeoutMs int64                        `json:"timeoutMs,omitempty"`
@@ -31,6 +36,8 @@ type agentResponse struct {
 	Error        string      `json:"error,omitempty"`
 	Data         interface{} `json:"data,omitempty"`
 	Fields       []string    `json:"fields,omitempty"`
+	Messages     []string    `json:"messages,omitempty"`
+	ChunkType    string      `json:"chunkType,omitempty"`
 	RowsAffected int64       `json:"rowsAffected,omitempty"`
 }

@@ -39,7 +46,11 @@ const (
 	agentMethodClose         = "close"
 	agentMethodMetadata      = "metadata"
 	agentMethodPing          = "ping"
+	agentMethodOpenSession   = "openSession"
+	agentMethodCloseSession  = "closeSession"
 	agentMethodQuery         = "query"
+	agentMethodQueryMulti    = "queryMulti"
+	agentMethodStreamQuery   = "streamQuery"
 	agentMethodExec          = "exec"
 	agentMethodGetDatabases  = "getDatabases"
 	agentMethodGetTables     = "getTables"
@@ -54,23 +65,67 @@ const (

 const legacyClickHouseDefaultTimeout = 2 * time.Hour

-var (
-	agentDriverType      string
-	agentDatabaseFactory func() db.Database
+const (
+	agentChunkColumns = "columns"
+	agentChunkRows    = "rows"
+	agentChunkDone    = "done"
+	// agentStreamBatchSize 控制 driver-agent 向主进程发送 row chunk 的批次大小。
+	// 调小到 64：单批 JSON 编码 + 主进程解码的瞬时内存峰值降为原来的 1/4，
+	// 代价是 IPC 次数变为 4 倍，但每批仅一次 stdin/stdout 行读写，整体影响可忽略。
+	// 重要：减小批次不能根除内存峰值，仍需配合 SetGCPercent + 周期 GC（见 main）。
+	agentStreamBatchSize         = 64
+	agentMemoryTrimRowsThreshold = 100000
+	agentMemoryTrimMinInterval   = 3 * time.Second
 )

+var (
+	agentDriverType         string
+	agentDatabaseFactory    func() db.Database
+	agentMemoryTrimRunning  atomic.Bool
+	agentMemoryTrimLastAt   atomic.Int64
+	runAgentMemoryTrimAsync = func(fn func()) {
+		go fn()
+	}
+	agentMemoryTrimFn = func() {
+		runtime.GC()
+		debug.FreeOSMemory()
+	}
+)
+
+type agentRuntime struct {
+	inst          db.Database
+	sessions      map[string]db.StatementExecer
+	nextSessionID int64
+}
+
 func main() {
 	if agentDatabaseFactory == nil || strings.TrimSpace(agentDriverType) == "" {
 		fmt.Fprintf(os.Stderr, "未配置驱动代理 provider，请使用 gonavi_<driver>_driver 标签构建\n")
 		os.Exit(2)
 	}

+	// driver-agent 是独立进程，主进程无法控制其 GC 行为。
+	// 大结果集（88W+ 行）通过 JSON-lines 跨进程传输时，每行有 5-8 倍内存副本；
+	// Go 默认 GOGC=100 + Windows MADV_FREE 不归还 RSS，会导致 driver-agent 进程
+	// 内存峰值达到数据总量的 10+ 倍（用户实测 88W 普通业务表撑到 8G+）。
+	//
+	// GC 策略组合：
+	//   - SetGCPercent(50)：堆增长 50% 即触发 GC，比默认 100 更早收敛
+	//   - InitMemorySoftLimit：起始 2GB，运行时由 MaybeGrowMemoryLimit 自适应抬升到最多 8GB
+	//     （起步保守 + 按需扩张，避免静态 2GB 限制在大表场景触发 GC 硬模式降速 15-25%）
+	//
+	// 代价：CPU 开销增加约 5-10%。导出场景是 I/O 密集型，可忽略。
+	debug.SetGCPercent(50)
+	db.InitMemorySoftLimit(db.MemorySoftLimitInitialBytes)
+
 	scanner := bufio.NewScanner(os.Stdin)
 	scanner.Buffer(make([]byte, 0, 16<<10), 8<<20)
 	writer := bufio.NewWriter(os.Stdout)
 	defer writer.Flush()

-	var inst db.Database
+	runtimeState := &agentRuntime{
+		sessions: make(map[string]db.StatementExecer),
+	}
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
 		if line == "" {
@@ -87,23 +142,32 @@ func main() {
 			continue
 		}

-		resp := handleRequest(&inst, req)
+		if strings.TrimSpace(req.Method) == agentMethodStreamQuery {
+			if err := handleStreamRequest(runtimeState, req, writer); err != nil {
+				fmt.Fprintf(os.Stderr, "写入流式响应失败：%v\n", err)
+				break
+			}
+			continue
+		}
+
+		resp := handleRequest(runtimeState, req)
 		if err := writeResponse(writer, resp); err != nil {
 			fmt.Fprintf(os.Stderr, "写入响应失败：%v\n", err)
 			break
 		}
+		if strings.TrimSpace(req.Method) == agentMethodQuery {
+			maybeReleaseAgentMemory("query-response", countAgentResponseRows(resp.Data))
+		}
 	}

-	if inst != nil {
-		_ = inst.Close()
-	}
+	runtimeState.close()

 	if err := scanner.Err(); err != nil {
 		fmt.Fprintf(os.Stderr, "读取请求失败：%v\n", err)
 	}
 }

-func handleRequest(inst *db.Database, req agentRequest) agentResponse {
+func handleRequest(runtimeState *agentRuntime, req agentRequest) agentResponse {
 	resp := agentResponse{ID: req.ID, Success: true}
 	method := strings.TrimSpace(req.Method)

@@ -112,9 +176,7 @@ func handleRequest(inst *db.Database, req agentRequest) agentResponse {
 		if req.Config == nil {
 			return fail(resp, "连接配置为空")
 		}
-		if *inst != nil {
-			_ = (*inst).Close()
-		}
+		runtimeState.close()
 		next := agentDatabaseFactory()
 		if next == nil {
 			return fail(resp, "驱动代理初始化失败")
@@ -122,14 +184,13 @@ func handleRequest(inst *db.Database, req agentRequest) agentResponse {
 		if err := next.Connect(*req.Config); err != nil {
 			return fail(resp, err.Error())
 		}
-		*inst = next
+		runtimeState.inst = next
 		return resp
 	case agentMethodClose:
-		if *inst != nil {
-			if err := (*inst).Close(); err != nil {
+		if runtimeState.inst != nil {
+			if err := runtimeState.close(); err != nil {
 				return fail(resp, err.Error())
 			}
-			*inst = nil
 		}
 		return resp
 	case agentMethodMetadata:
@@ -139,74 +200,146 @@ func handleRequest(inst *db.Database, req agentRequest) agentResponse {
 			"protocolSchema": "json-lines-v1",
 		}
 		return resp
+	case agentMethodOpenSession:
+		if runtimeState.inst == nil {
+			return fail(resp, "connection not open")
+		}
+		provider, ok := runtimeState.inst.(db.SessionExecerProvider)
+		if !ok {
+			return fail(resp, fmt.Sprintf("当前数据源（%s）不支持 SQL 编辑器托管事务", strings.TrimSpace(agentDriverType)))
+		}
+		openCtx := context.Background()
+		var cancel context.CancelFunc
+		if req.TimeoutMs > 0 {
+			openCtx, cancel = context.WithTimeout(context.Background(), time.Duration(req.TimeoutMs)*time.Millisecond)
+			defer cancel()
+		}
+		session, err := provider.OpenSessionExecer(openCtx)
+		if err != nil {
+			return fail(resp, err.Error())
+		}
+		sessionID := runtimeState.nextID()
+		runtimeState.sessions[sessionID] = session
+		resp.Data = sessionID
+		return resp
+	case agentMethodCloseSession:
+		if err := runtimeState.closeSession(req.SessionID); err != nil {
+			return fail(resp, err.Error())
+		}
+		return resp
 	}

-	if *inst == nil {
+	if runtimeState.inst == nil {
 		return fail(resp, "connection not open")
 	}

+	if session, ok, err := runtimeState.session(req.SessionID); err != nil {
+		return fail(resp, err.Error())
+	} else if ok {
+		switch method {
+		case agentMethodQuery:
+			data, fields, messages, err := queryStatementWithMessagesOptionalTimeout(session, req.Query, req.TimeoutMs)
+			if err != nil {
+				return fail(resp, err.Error())
+			}
+			resp.Data = data
+			resp.Fields = fields
+			resp.Messages = messages
+		case agentMethodQueryMulti:
+			data, messages, supported, err := queryMultiStatementWithMessagesOptionalTimeout(session, req.Query, req.TimeoutMs)
+			if err != nil {
+				return fail(resp, err.Error())
+			}
+			if !supported {
+				return fail(resp, "当前事务会话不支持多结果集查询")
+			}
+			resp.Data = data
+			resp.Messages = messages
+		case agentMethodExec:
+			affected, err := execStatementWithOptionalTimeout(session, req.Query, req.TimeoutMs)
+			if err != nil {
+				return fail(resp, err.Error())
+			}
+			resp.RowsAffected = affected
+		default:
+			return fail(resp, "当前事务会话不支持该方法")
+		}
+		return resp
+	}
+
 	switch method {
 	case agentMethodPing:
-		if err := (*inst).Ping(); err != nil {
+		if err := runtimeState.inst.Ping(); err != nil {
 			return fail(resp, err.Error())
 		}
 	case agentMethodQuery:
-		data, fields, err := queryWithOptionalTimeout(*inst, req.Query, req.TimeoutMs)
+		data, fields, messages, err := queryWithMessagesOptionalTimeout(runtimeState.inst, req.Query, req.TimeoutMs)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 		resp.Fields = fields
+		resp.Messages = messages
+	case agentMethodQueryMulti:
+		data, messages, supported, err := queryMultiWithMessagesOptionalTimeout(runtimeState.inst, req.Query, req.TimeoutMs)
+		if err != nil {
+			return fail(resp, err.Error())
+		}
+		if !supported {
+			return fail(resp, "当前驱动不支持原生多结果集查询")
+		}
+		resp.Data = data
+		resp.Messages = messages
 	case agentMethodExec:
-		affected, err := execWithOptionalTimeout(*inst, req.Query, req.TimeoutMs)
+		affected, err := execWithOptionalTimeout(runtimeState.inst, req.Query, req.TimeoutMs)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.RowsAffected = affected
 	case agentMethodGetDatabases:
-		data, err := (*inst).GetDatabases()
+		data, err := runtimeState.inst.GetDatabases()
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetTables:
-		data, err := (*inst).GetTables(req.DBName)
+		data, err := runtimeState.inst.GetTables(req.DBName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetCreateStmt:
-		data, err := (*inst).GetCreateStatement(req.DBName, req.TableName)
+		data, err := runtimeState.inst.GetCreateStatement(req.DBName, req.TableName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetColumns:
-		data, err := (*inst).GetColumns(req.DBName, req.TableName)
+		data, err := runtimeState.inst.GetColumns(req.DBName, req.TableName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetAllColumns:
-		data, err := (*inst).GetAllColumns(req.DBName)
+		data, err := runtimeState.inst.GetAllColumns(req.DBName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetIndexes:
-		data, err := (*inst).GetIndexes(req.DBName, req.TableName)
+		data, err := runtimeState.inst.GetIndexes(req.DBName, req.TableName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetForeignKey:
-		data, err := (*inst).GetForeignKeys(req.DBName, req.TableName)
+		data, err := runtimeState.inst.GetForeignKeys(req.DBName, req.TableName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
 		resp.Data = data
 	case agentMethodGetTriggers:
-		data, err := (*inst).GetTriggers(req.DBName, req.TableName)
+		data, err := runtimeState.inst.GetTriggers(req.DBName, req.TableName)
 		if err != nil {
 			return fail(resp, err.Error())
 		}
@@ -215,7 +348,7 @@ func handleRequest(inst *db.Database, req agentRequest) agentResponse {
 		if req.Changes == nil {
 			return fail(resp, "变更集为空")
 		}
-		applier, ok := (*inst).(interface {
+		applier, ok := runtimeState.inst.(interface {
 			ApplyChanges(tableName string, changes connection.ChangeSet) error
 		})
 		if !ok {
@@ -231,6 +364,169 @@ func handleRequest(inst *db.Database, req agentRequest) agentResponse {
 	return resp
 }

+type agentStreamResponseWriter struct {
+	writer    *bufio.Writer
+	requestID int64
+	columns   []string
+	rows      [][]interface{}
+	rowCount  int64
+}
+
+func newAgentStreamResponseWriter(writer *bufio.Writer, requestID int64) *agentStreamResponseWriter {
+	return &agentStreamResponseWriter{
+		writer:    writer,
+		requestID: requestID,
+	}
+}
+
+func (w *agentStreamResponseWriter) SetColumns(columns []string) error {
+	w.columns = append([]string(nil), columns...)
+	return writeResponse(w.writer, agentResponse{
+		ID:        w.requestID,
+		Success:   true,
+		ChunkType: agentChunkColumns,
+		Fields:    w.columns,
+	})
+}
+
+func (w *agentStreamResponseWriter) ConsumeRow(row map[string]interface{}) error {
+	if len(w.columns) == 0 {
+		return fmt.Errorf("流式查询缺少列定义")
+	}
+	values := make([]interface{}, len(w.columns))
+	for idx, column := range w.columns {
+		values[idx] = row[column]
+	}
+	return w.ConsumeRowValues(values)
+}
+
+func (w *agentStreamResponseWriter) ConsumeRowValues(values []interface{}) error {
+	row := append([]interface{}(nil), values...)
+	w.rows = append(w.rows, row)
+	w.rowCount++
+	if len(w.rows) < agentStreamBatchSize {
+		return nil
+	}
+	return w.flushRows()
+}
+
+func (w *agentStreamResponseWriter) flushRows() error {
+	if len(w.rows) == 0 {
+		return nil
+	}
+	rows := w.rows
+	w.rows = nil
+	return writeResponse(w.writer, agentResponse{
+		ID:        w.requestID,
+		Success:   true,
+		ChunkType: agentChunkRows,
+		Data:      rows,
+	})
+}
+
+func (w *agentStreamResponseWriter) finish() error {
+	return w.flushRows()
+}
+
+func handleStreamRequest(runtimeState *agentRuntime, req agentRequest, writer *bufio.Writer) error {
+	resp := agentResponse{ID: req.ID, Success: true}
+	if runtimeState.inst == nil {
+		return writeResponse(writer, fail(resp, "connection not open"))
+	}
+
+	streamWriter := newAgentStreamResponseWriter(writer, req.ID)
+	if session, ok, err := runtimeState.session(req.SessionID); err != nil {
+		return writeResponse(writer, fail(resp, err.Error()))
+	} else if ok {
+		if err := streamStatementWithOptionalTimeout(session, req.Query, req.TimeoutMs, streamWriter); err != nil {
+			_ = streamWriter.finish()
+			return writeResponse(writer, fail(resp, err.Error()))
+		}
+		if err := streamWriter.finish(); err != nil {
+			return err
+		}
+		if err := writeResponse(writer, agentResponse{ID: req.ID, Success: true, ChunkType: agentChunkDone}); err != nil {
+			return err
+		}
+		maybeReleaseAgentMemory("stream-query-session", streamWriter.rowCount)
+		return nil
+	}
+
+	if err := streamDatabaseWithOptionalTimeout(runtimeState.inst, req.Query, req.TimeoutMs, streamWriter); err != nil {
+		_ = streamWriter.finish()
+		return writeResponse(writer, fail(resp, err.Error()))
+	}
+	if err := streamWriter.finish(); err != nil {
+		return err
+	}
+	if err := writeResponse(writer, agentResponse{ID: req.ID, Success: true, ChunkType: agentChunkDone}); err != nil {
+		return err
+	}
+	maybeReleaseAgentMemory("stream-query-db", streamWriter.rowCount)
+	return nil
+}
+
+func (r *agentRuntime) nextID() string {
+	r.ensureSessionMap()
+	r.nextSessionID++
+	return "session-" + strconv.FormatInt(r.nextSessionID, 10)
+}
+
+func (r *agentRuntime) session(sessionID string) (db.StatementExecer, bool, error) {
+	r.ensureSessionMap()
+	sessionID = strings.TrimSpace(sessionID)
+	if sessionID == "" {
+		return nil, false, nil
+	}
+	session, ok := r.sessions[sessionID]
+	if !ok || session == nil {
+		return nil, false, fmt.Errorf("事务会话不存在或已结束")
+	}
+	return session, true, nil
+}
+
+func (r *agentRuntime) closeSession(sessionID string) error {
+	r.ensureSessionMap()
+	sessionID = strings.TrimSpace(sessionID)
+	if sessionID == "" {
+		return fmt.Errorf("事务会话 ID 不能为空")
+	}
+	session, ok := r.sessions[sessionID]
+	if ok {
+		delete(r.sessions, sessionID)
+	}
+	if !ok || session == nil {
+		return fmt.Errorf("事务会话不存在或已结束")
+	}
+	return session.Close()
+}
+
+func (r *agentRuntime) close() error {
+	var closeErr error
+	r.ensureSessionMap()
+	for sessionID, session := range r.sessions {
+		delete(r.sessions, sessionID)
+		if session != nil {
+			if err := session.Close(); err != nil && closeErr == nil {
+				closeErr = err
+			}
+		}
+	}
+	if r.inst != nil {
+		if err := r.inst.Close(); err != nil && closeErr == nil {
+			closeErr = err
+		}
+		r.inst = nil
+	}
+	return closeErr
+}
+
+func (r *agentRuntime) ensureSessionMap() {
+	if r.sessions == nil {
+		r.sessions = make(map[string]db.StatementExecer)
+	}
+}
+
 func writeResponse(writer *bufio.Writer, resp agentResponse) error {
 	// 对响应数据做统一 JSON 安全归一化：
 	// 将 map[any]any（如 duckdb.Map）递归转换为 map[string]any，避免序列化失败导致代理进程退出。
@@ -301,25 +597,234 @@ func normalizeAgentResponseData(v interface{}) interface{} {
 	}
 }

-func queryWithOptionalTimeout(inst db.Database, query string, timeoutMs int64) ([]map[string]interface{}, []string, error) {
+type agentQueryRunner interface {
+	Query(string) ([]map[string]interface{}, []string, error)
+}
+
+type agentQueryContextRunner interface {
+	QueryContext(context.Context, string) ([]map[string]interface{}, []string, error)
+}
+
+type agentQueryMessageRunner interface {
+	QueryWithMessages(query string) ([]map[string]interface{}, []string, []string, error)
+}
+
+type agentQueryMessageContextRunner interface {
+	QueryContextWithMessages(context.Context, string) ([]map[string]interface{}, []string, []string, error)
+}
+
+type agentMultiResultMessageRunner interface {
+	QueryMultiWithMessages(query string) ([]connection.ResultSetData, []string, error)
+}
+
+type agentMultiResultMessageContextRunner interface {
+	QueryMultiContextWithMessages(context.Context, string) ([]connection.ResultSetData, []string, error)
+}
+
+type agentMultiResultRunner interface {
+	QueryMulti(query string) ([]connection.ResultSetData, error)
+}
+
+type agentMultiResultContextRunner interface {
+	QueryMultiContext(context.Context, string) ([]connection.ResultSetData, error)
+}
+
+type agentExecRunner interface {
+	Exec(string) (int64, error)
+}
+
+type agentExecContextRunner interface {
+	ExecContext(context.Context, string) (int64, error)
+}
+
+func queryWithMessagesOptionalTimeout(inst agentQueryRunner, query string, timeoutMs int64) ([]map[string]interface{}, []string, []string, error) {
 	effectiveTimeoutMs := timeoutMs
 	if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
 		effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
 	}
 	if effectiveTimeoutMs <= 0 {
-		return inst.Query(query)
+		if q, ok := inst.(agentQueryMessageRunner); ok {
+			return q.QueryWithMessages(query)
+		}
+		data, fields, err := inst.Query(query)
+		return data, fields, nil, err
 	}
-	if q, ok := inst.(interface {
-		QueryContext(context.Context, string) ([]map[string]interface{}, []string, error)
-	}); ok {
+	if q, ok := inst.(agentQueryMessageContextRunner); ok {
 		ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
 		defer cancel()
-		return q.QueryContext(ctx, query)
+		return q.QueryContextWithMessages(ctx, query)
 	}
-	return inst.Query(query)
+	if q, ok := inst.(agentQueryContextRunner); ok {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+		defer cancel()
+		data, fields, err := q.QueryContext(ctx, query)
+		return data, fields, nil, err
+	}
+	if q, ok := inst.(agentQueryMessageRunner); ok {
+		return q.QueryWithMessages(query)
+	}
+	data, fields, err := inst.Query(query)
+	return data, fields, nil, err
 }

-func execWithOptionalTimeout(inst db.Database, query string, timeoutMs int64) (int64, error) {
+func queryWithOptionalTimeout(inst agentQueryRunner, query string, timeoutMs int64) ([]map[string]interface{}, []string, error) {
+	data, fields, _, err := queryWithMessagesOptionalTimeout(inst, query, timeoutMs)
+	return data, fields, err
+}
+
+func queryStatementWithOptionalTimeout(inst db.StatementExecer, query string, timeoutMs int64) ([]map[string]interface{}, []string, error) {
+	queryRunner, ok := inst.(agentQueryRunner)
+	if !ok {
+		return nil, nil, fmt.Errorf("当前事务会话不支持查询语句")
+	}
+	return queryWithOptionalTimeout(queryRunner, query, timeoutMs)
+}
+
+func queryStatementWithMessagesOptionalTimeout(inst db.StatementExecer, query string, timeoutMs int64) ([]map[string]interface{}, []string, []string, error) {
+	queryRunner, ok := inst.(agentQueryRunner)
+	if !ok {
+		return nil, nil, nil, fmt.Errorf("当前事务会话不支持查询语句")
+	}
+	return queryWithMessagesOptionalTimeout(queryRunner, query, timeoutMs)
+}
+
+func queryMultiWithMessagesOptionalTimeout(inst db.Database, query string, timeoutMs int64) ([]connection.ResultSetData, []string, bool, error) {
+	effectiveTimeoutMs := timeoutMs
+	if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
+		effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
+	}
+	if effectiveTimeoutMs > 0 {
+		if q, ok := inst.(agentMultiResultMessageContextRunner); ok {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+			defer cancel()
+			data, messages, err := q.QueryMultiContextWithMessages(ctx, query)
+			return data, messages, true, err
+		}
+		if q, ok := inst.(agentMultiResultContextRunner); ok {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+			defer cancel()
+			data, err := q.QueryMultiContext(ctx, query)
+			return data, nil, true, err
+		}
+	}
+	if q, ok := inst.(agentMultiResultMessageRunner); ok {
+		data, messages, err := q.QueryMultiWithMessages(query)
+		return data, messages, true, err
+	}
+	if q, ok := inst.(agentMultiResultRunner); ok {
+		data, err := q.QueryMulti(query)
+		return data, nil, true, err
+	}
+	return nil, nil, false, nil
+}
+
+func queryMultiStatementWithMessagesOptionalTimeout(inst db.StatementExecer, query string, timeoutMs int64) ([]connection.ResultSetData, []string, bool, error) {
+	effectiveTimeoutMs := timeoutMs
+	if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
+		effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
+	}
+	if effectiveTimeoutMs > 0 {
+		if q, ok := inst.(agentMultiResultMessageContextRunner); ok {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+			defer cancel()
+			data, messages, err := q.QueryMultiContextWithMessages(ctx, query)
+			return data, messages, true, err
+		}
+		if q, ok := inst.(agentMultiResultContextRunner); ok {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+			defer cancel()
+			data, err := q.QueryMultiContext(ctx, query)
+			return data, nil, true, err
+		}
+	}
+	if q, ok := inst.(agentMultiResultMessageRunner); ok {
+		data, messages, err := q.QueryMultiWithMessages(query)
+		return data, messages, true, err
+	}
+	if q, ok := inst.(agentMultiResultRunner); ok {
+		data, err := q.QueryMulti(query)
+		return data, nil, true, err
+	}
+	return nil, nil, false, nil
+}
+
+func streamWithOptionalTimeout(inst db.StreamQueryExecer, query string, timeoutMs int64, consumer db.QueryStreamConsumer) error {
+	effectiveTimeoutMs := timeoutMs
+	if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
+		effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
+	}
+	if effectiveTimeoutMs <= 0 {
+		return inst.StreamQuery(query, consumer)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+	defer cancel()
+	return inst.StreamQueryContext(ctx, query, consumer)
+}
+
+func streamBufferedQueryResult(fields []string, data []map[string]interface{}, consumer db.QueryStreamConsumer) error {
+	if err := consumer.SetColumns(fields); err != nil {
+		return err
+	}
+	if valueConsumer, ok := consumer.(db.QueryStreamValueConsumer); ok {
+		for _, row := range data {
+			values := make([]interface{}, len(fields))
+			for idx, field := range fields {
+				values[idx] = row[field]
+			}
+			if err := valueConsumer.ConsumeRowValues(values); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+	for _, row := range data {
+		if err := consumer.ConsumeRow(row); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func streamStatementWithOptionalTimeout(inst db.StatementExecer, query string, timeoutMs int64, consumer db.QueryStreamConsumer) error {
+	if streamer, ok := inst.(db.StreamQueryExecer); ok {
+		return streamWithOptionalTimeout(streamer, query, timeoutMs, consumer)
+	}
+	data, fields, err := queryStatementWithOptionalTimeout(inst, query, timeoutMs)
+	if err != nil {
+		return err
+	}
+	return streamBufferedQueryResult(fields, data, consumer)
+}
+
+func streamDatabaseWithOptionalTimeout(inst db.Database, query string, timeoutMs int64, consumer db.QueryStreamConsumer) error {
+	if streamer, ok := inst.(db.StreamQueryExecer); ok {
+		return streamWithOptionalTimeout(streamer, query, timeoutMs, consumer)
+	}
+	if provider, ok := inst.(db.SessionExecerProvider); ok {
+		openCtx := context.Background()
+		var cancel context.CancelFunc
+		effectiveTimeoutMs := timeoutMs
+		if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
+			effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
+		}
+		if effectiveTimeoutMs > 0 {
+			openCtx, cancel = context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
+			defer cancel()
+		}
+		session, err := provider.OpenSessionExecer(openCtx)
+		if err == nil {
+			defer session.Close()
+			return streamStatementWithOptionalTimeout(session, query, timeoutMs, consumer)
+		}
+	}
+	data, fields, err := queryWithOptionalTimeout(inst, query, timeoutMs)
+	if err != nil {
+		return err
+	}
+	return streamBufferedQueryResult(fields, data, consumer)
+}
+
+func execWithOptionalTimeout(inst agentExecRunner, query string, timeoutMs int64) (int64, error) {
 	effectiveTimeoutMs := timeoutMs
 	if effectiveTimeoutMs <= 0 && strings.EqualFold(strings.TrimSpace(agentDriverType), "clickhouse") {
 		effectiveTimeoutMs = int64(legacyClickHouseDefaultTimeout / time.Millisecond)
@@ -327,12 +832,52 @@ func execWithOptionalTimeout(inst db.Database, query string, timeoutMs int64) (i
 	if effectiveTimeoutMs <= 0 {
 		return inst.Exec(query)
 	}
-	if e, ok := inst.(interface {
-		ExecContext(context.Context, string) (int64, error)
-	}); ok {
+	if e, ok := inst.(agentExecContextRunner); ok {
 		ctx, cancel := context.WithTimeout(context.Background(), time.Duration(effectiveTimeoutMs)*time.Millisecond)
 		defer cancel()
 		return e.ExecContext(ctx, query)
 	}
 	return inst.Exec(query)
 }
+
+func execStatementWithOptionalTimeout(inst db.StatementExecer, query string, timeoutMs int64) (int64, error) {
+	return execWithOptionalTimeout(inst, query, timeoutMs)
+}
+
+func countAgentResponseRows(data interface{}) int64 {
+	rows, ok := data.([]map[string]interface{})
+	if !ok {
+		return 0
+	}
+	return int64(len(rows))
+}
+
+func maybeReleaseAgentMemory(reason string, rows int64) {
+	if rows < agentMemoryTrimRowsThreshold {
+		return
+	}
+	if !agentMemoryTrimRunning.CompareAndSwap(false, true) {
+		return
+	}
+
+	runAgentMemoryTrimAsync(func() {
+		defer agentMemoryTrimRunning.Store(false)
+		if delay := nextAgentMemoryTrimDelay(); delay > 0 {
+			time.Sleep(delay)
+		}
+		agentMemoryTrimFn()
+		agentMemoryTrimLastAt.Store(time.Now().UnixNano())
+	})
+}
+
+func nextAgentMemoryTrimDelay() time.Duration {
+	lastUnixNano := agentMemoryTrimLastAt.Load()
+	if lastUnixNano <= 0 {
+		return 0
+	}
+	elapsed := time.Since(time.Unix(0, lastUnixNano))
+	if elapsed >= agentMemoryTrimMinInterval {
+		return 0
+	}
+	return agentMemoryTrimMinInterval - elapsed
+}
--- a/cmd/optional-driver-agent/main_test.go
+++ b/cmd/optional-driver-agent/main_test.go
@@ -6,6 +6,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"strings"
 	"testing"
 	"time"

@@ -77,8 +78,8 @@ func TestHandleRequestMetadataReportsAgentRevision(t *testing.T) {
 	agentDriverType = "clickhouse"
 	agentDatabaseFactory = func() db.Database { return nil }

-	var inst db.Database
-	resp := handleRequest(&inst, agentRequest{ID: 7, Method: agentMethodMetadata})
+	runtimeState := &agentRuntime{sessions: make(map[string]db.StatementExecer)}
+	resp := handleRequest(runtimeState, agentRequest{ID: 7, Method: agentMethodMetadata})
 	if !resp.Success {
 		t.Fatalf("metadata request failed: %s", resp.Error)
 	}
@@ -100,6 +101,9 @@ type fakeAgentTimeoutDB struct {
 	execCalled         bool
 	execContextCalled  bool
 	deadlineSet        bool
+	queryMessages      []string
+	multiResults       []connection.ResultSetData
+	multiMessages      []string
 }

 func (f *fakeAgentTimeoutDB) Connect(config connection.ConnectionConfig) error { return nil }
@@ -116,6 +120,14 @@ func (f *fakeAgentTimeoutDB) QueryContext(ctx context.Context, query string) ([]
 	}
 	return []map[string]interface{}{{"ok": 1}}, []string{"ok"}, nil
 }
+func (f *fakeAgentTimeoutDB) QueryWithMessages(query string) ([]map[string]interface{}, []string, []string, error) {
+	data, fields, err := f.QueryContext(context.Background(), query)
+	return data, fields, append([]string(nil), f.queryMessages...), err
+}
+func (f *fakeAgentTimeoutDB) QueryContextWithMessages(ctx context.Context, query string) ([]map[string]interface{}, []string, []string, error) {
+	data, fields, err := f.QueryContext(ctx, query)
+	return data, fields, append([]string(nil), f.queryMessages...), err
+}
 func (f *fakeAgentTimeoutDB) Exec(query string) (int64, error) {
 	f.execCalled = true
 	return 0, errors.New("exec should not be called")
@@ -149,6 +161,121 @@ func (f *fakeAgentTimeoutDB) GetForeignKeys(dbName, tableName string) ([]connect
 func (f *fakeAgentTimeoutDB) GetTriggers(dbName, tableName string) ([]connection.TriggerDefinition, error) {
 	return nil, nil
 }
+func (f *fakeAgentTimeoutDB) QueryMultiWithMessages(query string) ([]connection.ResultSetData, []string, error) {
+	return append([]connection.ResultSetData(nil), f.multiResults...), append([]string(nil), f.multiMessages...), nil
+}
+func (f *fakeAgentTimeoutDB) QueryMultiContextWithMessages(ctx context.Context, query string) ([]connection.ResultSetData, []string, error) {
+	if _, ok := ctx.Deadline(); ok {
+		f.deadlineSet = true
+	}
+	return f.QueryMultiWithMessages(query)
+}
+
+type fakeAgentSessionDB struct {
+	fakeAgentTimeoutDB
+	session *fakeAgentStatementSession
+}
+
+func (f *fakeAgentSessionDB) OpenSessionExecer(ctx context.Context) (db.StatementExecer, error) {
+	f.session = &fakeAgentStatementSession{}
+	return f.session, nil
+}
+
+type fakeAgentStatementSession struct {
+	queryCalls int
+	execCalls  int
+	closed     bool
+	messages   []string
+}
+
+func (f *fakeAgentStatementSession) Query(query string) ([]map[string]interface{}, []string, error) {
+	return f.QueryContext(context.Background(), query)
+}
+
+func (f *fakeAgentStatementSession) QueryContext(ctx context.Context, query string) ([]map[string]interface{}, []string, error) {
+	f.queryCalls++
+	return []map[string]interface{}{{"session_ok": 1}}, []string{"session_ok"}, nil
+}
+func (f *fakeAgentStatementSession) QueryWithMessages(query string) ([]map[string]interface{}, []string, []string, error) {
+	data, fields, err := f.QueryContext(context.Background(), query)
+	return data, fields, append([]string(nil), f.messages...), err
+}
+func (f *fakeAgentStatementSession) QueryContextWithMessages(ctx context.Context, query string) ([]map[string]interface{}, []string, []string, error) {
+	data, fields, err := f.QueryContext(ctx, query)
+	return data, fields, append([]string(nil), f.messages...), err
+}
+
+func (f *fakeAgentStatementSession) Exec(query string) (int64, error) {
+	return f.ExecContext(context.Background(), query)
+}
+
+func (f *fakeAgentStatementSession) ExecContext(ctx context.Context, query string) (int64, error) {
+	f.execCalls++
+	return 9, nil
+}
+
+func (f *fakeAgentStatementSession) Close() error {
+	f.closed = true
+	return nil
+}
+
+type fakeAgentStreamSession struct {
+	closed      bool
+	streamCalls int
+	deadlineSet bool
+}
+
+func (f *fakeAgentStreamSession) Exec(query string) (int64, error) {
+	return 0, nil
+}
+
+func (f *fakeAgentStreamSession) ExecContext(ctx context.Context, query string) (int64, error) {
+	return 0, nil
+}
+
+func (f *fakeAgentStreamSession) Close() error {
+	f.closed = true
+	return nil
+}
+
+func (f *fakeAgentStreamSession) StreamQuery(query string, consumer db.QueryStreamConsumer) error {
+	return f.StreamQueryContext(context.Background(), query, consumer)
+}
+
+func (f *fakeAgentStreamSession) StreamQueryContext(ctx context.Context, query string, consumer db.QueryStreamConsumer) error {
+	f.streamCalls++
+	if _, ok := ctx.Deadline(); ok {
+		f.deadlineSet = true
+	}
+	if err := consumer.SetColumns([]string{"id", "name"}); err != nil {
+		return err
+	}
+	if valueConsumer, ok := consumer.(db.QueryStreamValueConsumer); ok {
+		if err := valueConsumer.ConsumeRowValues([]interface{}{1, "alice"}); err != nil {
+			return err
+		}
+		if err := valueConsumer.ConsumeRowValues([]interface{}{2, "bob"}); err != nil {
+			return err
+		}
+		return nil
+	}
+	if err := consumer.ConsumeRow(map[string]interface{}{"id": 1, "name": "alice"}); err != nil {
+		return err
+	}
+	return consumer.ConsumeRow(map[string]interface{}{"id": 2, "name": "bob"})
+}
+
+type fakeAgentSessionStreamDB struct {
+	fakeAgentTimeoutDB
+	session   *fakeAgentStreamSession
+	openCalls int
+}
+
+func (f *fakeAgentSessionStreamDB) OpenSessionExecer(ctx context.Context) (db.StatementExecer, error) {
+	f.openCalls++
+	f.session = &fakeAgentStreamSession{}
+	return f.session, nil
+}

 func TestQueryWithOptionalTimeout_UsesQueryContext(t *testing.T) {
 	fake := &fakeAgentTimeoutDB{}
@@ -198,3 +325,277 @@ func TestQueryWithOptionalTimeout_ClickHouseLegacyModeUsesQueryContext(t *testin
 		t.Fatalf("clickhouse legacy query 调用路径异常，QueryContext=%v Query=%v", fake.queryContextCalled, fake.queryCalled)
 	}
 }
+
+func TestHandleRequest_QueryIncludesServerMessages(t *testing.T) {
+	old := agentDriverType
+	defer func() { agentDriverType = old }()
+	agentDriverType = "sqlserver"
+
+	fake := &fakeAgentTimeoutDB{
+		queryMessages: []string{"PRINT sql line 1", "PRINT sql line 2"},
+	}
+	runtimeState := &agentRuntime{inst: fake, sessions: make(map[string]db.StatementExecer)}
+
+	resp := handleRequest(runtimeState, agentRequest{
+		ID:        11,
+		Method:    agentMethodQuery,
+		Query:     "exec dbo.p_get_select",
+		TimeoutMs: int64((2 * time.Second).Milliseconds()),
+	})
+	if !resp.Success {
+		t.Fatalf("query request failed: %s", resp.Error)
+	}
+	if len(resp.Messages) != 2 || resp.Messages[0] != "PRINT sql line 1" {
+		t.Fatalf("expected query messages to be preserved, got %#v", resp.Messages)
+	}
+}
+
+func TestHandleRequest_QueryMultiIncludesResultSetsAndMessages(t *testing.T) {
+	old := agentDriverType
+	defer func() { agentDriverType = old }()
+	agentDriverType = "sqlserver"
+
+	fake := &fakeAgentTimeoutDB{
+		multiResults: []connection.ResultSetData{
+			{
+				StatementIndex: 1,
+				Rows:           []map[string]interface{}{{"name": "master"}},
+				Columns:        []string{"name"},
+			},
+			{
+				StatementIndex: 1,
+				Rows:           []map[string]interface{}{},
+				Columns:        []string{},
+				Messages:       []string{"PRINT generated sql"},
+			},
+		},
+		multiMessages: []string{"batch top-level message"},
+	}
+	runtimeState := &agentRuntime{inst: fake, sessions: make(map[string]db.StatementExecer)}
+
+	resp := handleRequest(runtimeState, agentRequest{
+		ID:        12,
+		Method:    agentMethodQueryMulti,
+		Query:     "exec dbo.p_get_select",
+		TimeoutMs: int64((2 * time.Second).Milliseconds()),
+	})
+	if !resp.Success {
+		t.Fatalf("queryMulti request failed: %s", resp.Error)
+	}
+	if len(resp.Messages) != 1 || resp.Messages[0] != "batch top-level message" {
+		t.Fatalf("expected top-level messages to be preserved, got %#v", resp.Messages)
+	}
+	resultSets, ok := resp.Data.([]connection.ResultSetData)
+	if !ok {
+		t.Fatalf("expected []connection.ResultSetData, got %T", resp.Data)
+	}
+	if len(resultSets) != 2 {
+		t.Fatalf("expected 2 result sets, got %#v", resultSets)
+	}
+	if len(resultSets[1].Messages) != 1 || resultSets[1].Messages[0] != "PRINT generated sql" {
+		t.Fatalf("expected message-only result set to be preserved, got %#v", resultSets[1])
+	}
+}
+
+func TestHandleRequest_UsesPinnedSessionForSessionScopedQueryAndExec(t *testing.T) {
+	old := agentDriverType
+	defer func() { agentDriverType = old }()
+	agentDriverType = "sqlserver"
+
+	fake := &fakeAgentSessionDB{}
+	runtimeState := &agentRuntime{
+		inst:     fake,
+		sessions: make(map[string]db.StatementExecer),
+	}
+
+	openResp := handleRequest(runtimeState, agentRequest{ID: 1, Method: agentMethodOpenSession})
+	if !openResp.Success {
+		t.Fatalf("openSession failed: %s", openResp.Error)
+	}
+	sessionID, ok := openResp.Data.(string)
+	if !ok || strings.TrimSpace(sessionID) == "" {
+		t.Fatalf("unexpected session id payload: %#v", openResp.Data)
+	}
+	if fake.session == nil {
+		t.Fatal("expected OpenSessionExecer to create a pinned session")
+	}
+
+	queryResp := handleRequest(runtimeState, agentRequest{
+		ID:        2,
+		Method:    agentMethodQuery,
+		SessionID: sessionID,
+		Query:     "SELECT 1",
+	})
+	if !queryResp.Success {
+		t.Fatalf("session query failed: %s", queryResp.Error)
+	}
+	if len(queryResp.Messages) != 0 {
+		t.Fatalf("expected empty default session messages, got %#v", queryResp.Messages)
+	}
+	if fake.queryCalled || fake.queryContextCalled {
+		t.Fatalf("expected session query to bypass database-level query path, got Query=%v QueryContext=%v", fake.queryCalled, fake.queryContextCalled)
+	}
+	if fake.session.queryCalls != 1 {
+		t.Fatalf("expected pinned session queryCalls=1, got %d", fake.session.queryCalls)
+	}
+
+	execResp := handleRequest(runtimeState, agentRequest{
+		ID:        3,
+		Method:    agentMethodExec,
+		SessionID: sessionID,
+		Query:     "UPDATE t SET v = 1",
+	})
+	if !execResp.Success {
+		t.Fatalf("session exec failed: %s", execResp.Error)
+	}
+	if fake.execCalled || fake.execContextCalled {
+		t.Fatalf("expected session exec to bypass database-level exec path, got Exec=%v ExecContext=%v", fake.execCalled, fake.execContextCalled)
+	}
+	if fake.session.execCalls != 1 {
+		t.Fatalf("expected pinned session execCalls=1, got %d", fake.session.execCalls)
+	}
+
+	closeResp := handleRequest(runtimeState, agentRequest{
+		ID:        4,
+		Method:    agentMethodCloseSession,
+		SessionID: sessionID,
+	})
+	if !closeResp.Success {
+		t.Fatalf("closeSession failed: %s", closeResp.Error)
+	}
+	if !fake.session.closed {
+		t.Fatal("expected pinned session to close")
+	}
+}
+
+func TestHandleStreamRequest_UsesSessionStreamerAndWritesChunks(t *testing.T) {
+	old := agentDriverType
+	originalAsync := runAgentMemoryTrimAsync
+	originalTrim := agentMemoryTrimFn
+	originalLastAt := agentMemoryTrimLastAt.Load()
+	defer func() { agentDriverType = old }()
+	defer func() {
+		runAgentMemoryTrimAsync = originalAsync
+		agentMemoryTrimFn = originalTrim
+		agentMemoryTrimRunning.Store(false)
+		agentMemoryTrimLastAt.Store(originalLastAt)
+	}()
+	agentDriverType = "oceanbase"
+	agentMemoryTrimRunning.Store(false)
+	agentMemoryTrimLastAt.Store(0)
+
+	fake := &fakeAgentSessionStreamDB{}
+	runtimeState := &agentRuntime{
+		inst:     fake,
+		sessions: make(map[string]db.StatementExecer),
+	}
+
+	trimmed := 0
+	runAgentMemoryTrimAsync = func(fn func()) {
+		fn()
+	}
+	agentMemoryTrimFn = func() {
+		trimmed++
+	}
+
+	var out bytes.Buffer
+	writer := bufio.NewWriter(&out)
+	if err := handleStreamRequest(runtimeState, agentRequest{
+		ID:        9,
+		Method:    agentMethodStreamQuery,
+		Query:     "SELECT * FROM person_info",
+		TimeoutMs: int64((2 * time.Second).Milliseconds()),
+	}, writer); err != nil {
+		t.Fatalf("handleStreamRequest 返回错误: %v", err)
+	}
+
+	if fake.openCalls != 1 {
+		t.Fatalf("expected OpenSessionExecer called once, got %d", fake.openCalls)
+	}
+	if fake.session == nil || fake.session.streamCalls != 1 {
+		t.Fatalf("expected session streamer used once, session=%#v", fake.session)
+	}
+	if !fake.session.deadlineSet {
+		t.Fatal("expected stream query context deadline to be set")
+	}
+	if !fake.session.closed {
+		t.Fatal("expected session to close after streaming")
+	}
+	if fake.queryCalled || fake.queryContextCalled {
+		t.Fatalf("unexpected fallback query path, Query=%v QueryContext=%v", fake.queryCalled, fake.queryContextCalled)
+	}
+
+	lines := strings.Split(strings.TrimSpace(out.String()), "\n")
+	if len(lines) != 3 {
+		t.Fatalf("expected 3 stream responses, got %d: %q", len(lines), out.String())
+	}
+
+	var columnsResp struct {
+		Success   bool     `json:"success"`
+		ChunkType string   `json:"chunkType"`
+		Fields    []string `json:"fields"`
+	}
+	if err := json.Unmarshal([]byte(lines[0]), &columnsResp); err != nil {
+		t.Fatalf("decode columns response failed: %v", err)
+	}
+	if !columnsResp.Success || columnsResp.ChunkType != agentChunkColumns || len(columnsResp.Fields) != 2 {
+		t.Fatalf("unexpected columns response: %#v", columnsResp)
+	}
+
+	var rowsResp struct {
+		Success   bool            `json:"success"`
+		ChunkType string          `json:"chunkType"`
+		Data      [][]interface{} `json:"data"`
+	}
+	if err := json.Unmarshal([]byte(lines[1]), &rowsResp); err != nil {
+		t.Fatalf("decode rows response failed: %v", err)
+	}
+	if !rowsResp.Success || rowsResp.ChunkType != agentChunkRows || len(rowsResp.Data) != 2 {
+		t.Fatalf("unexpected rows response: %#v", rowsResp)
+	}
+	if got := rowsResp.Data[1][1]; got != "bob" {
+		t.Fatalf("unexpected streamed row payload: %v", rowsResp.Data)
+	}
+
+	var doneResp struct {
+		Success   bool   `json:"success"`
+		ChunkType string `json:"chunkType"`
+	}
+	if err := json.Unmarshal([]byte(lines[2]), &doneResp); err != nil {
+		t.Fatalf("decode done response failed: %v", err)
+	}
+	if !doneResp.Success || doneResp.ChunkType != agentChunkDone {
+		t.Fatalf("unexpected done response: %#v", doneResp)
+	}
+	if trimmed != 0 {
+		t.Fatalf("小流式任务不应触发内存回收，got=%d", trimmed)
+	}
+}
+
+func TestMaybeReleaseAgentMemory_TriggersTrimForLargeJobs(t *testing.T) {
+	originalAsync := runAgentMemoryTrimAsync
+	originalTrim := agentMemoryTrimFn
+	originalLastAt := agentMemoryTrimLastAt.Load()
+	t.Cleanup(func() {
+		runAgentMemoryTrimAsync = originalAsync
+		agentMemoryTrimFn = originalTrim
+		agentMemoryTrimRunning.Store(false)
+		agentMemoryTrimLastAt.Store(originalLastAt)
+	})
+
+	agentMemoryTrimRunning.Store(false)
+	agentMemoryTrimLastAt.Store(0)
+	triggered := 0
+	runAgentMemoryTrimAsync = func(fn func()) {
+		fn()
+	}
+	agentMemoryTrimFn = func() {
+		triggered++
+	}
+
+	maybeReleaseAgentMemory("test-large-query", agentMemoryTrimRowsThreshold)
+
+	if triggered != 1 {
+		t.Fatalf("大查询完成后应触发一次内存回收，got=%d", triggered)
+	}
+}
--- a/cmd/optional-driver-agent/provider_elasticsearch.go
+++ b/cmd/optional-driver-agent/provider_elasticsearch.go
@@ -0,0 +1,12 @@
+//go:build gonavi_elasticsearch_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "elasticsearch"
+	agentDatabaseFactory = func() db.Database {
+		return &db.ElasticsearchDB{}
+	}
+}
--- a/cmd/optional-driver-agent/provider_gaussdb.go
+++ b/cmd/optional-driver-agent/provider_gaussdb.go
@@ -0,0 +1,12 @@
+//go:build gonavi_gaussdb_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "gaussdb"
+	agentDatabaseFactory = func() db.Database {
+		return &db.GaussDB{}
+	}
+}
--- a/cmd/optional-driver-agent/provider_iotdb.go
+++ b/cmd/optional-driver-agent/provider_iotdb.go
@@ -0,0 +1,12 @@
+//go:build gonavi_iotdb_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "iotdb"
+	agentDatabaseFactory = func() db.Database {
+		return &db.IoTDBDB{}
+	}
+}
--- a/cmd/optional-driver-agent/provider_iris.go
+++ b/cmd/optional-driver-agent/provider_iris.go
@@ -0,0 +1,12 @@
+//go:build gonavi_iris_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "iris"
+	agentDatabaseFactory = func() db.Database {
+		return &db.IrisDB{}
+	}
+}
--- a/cmd/optional-driver-agent/provider_oceanbase.go
+++ b/cmd/optional-driver-agent/provider_oceanbase.go
@@ -0,0 +1,12 @@
+//go:build gonavi_oceanbase_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "oceanbase"
+	agentDatabaseFactory = func() db.Database {
+		return &db.OceanBaseDB{}
+	}
+}
--- a/cmd/optional-driver-agent/provider_opengauss.go
+++ b/cmd/optional-driver-agent/provider_opengauss.go
@@ -0,0 +1,12 @@
+//go:build gonavi_opengauss_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "opengauss"
+	agentDatabaseFactory = func() db.Database {
+		return &db.OpenGaussDB{}
+	}
+}
--- a/cmd/optional-driver-agent/provider_starrocks.go
+++ b/cmd/optional-driver-agent/provider_starrocks.go
@@ -0,0 +1,12 @@
+//go:build gonavi_starrocks_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "starrocks"
+	agentDatabaseFactory = func() db.Database {
+		return &db.StarRocksDB{}
+	}
+}
--- a/cmd/optional-driver-agent/provider_trino.go
+++ b/cmd/optional-driver-agent/provider_trino.go
@@ -0,0 +1,12 @@
+//go:build gonavi_trino_driver
+
+package main
+
+import "GoNavi-Wails/internal/db"
+
+func init() {
+	agentDriverType = "trino"
+	agentDatabaseFactory = func() db.Database {
+		return &db.TrinoDB{}
+	}
+}
--- a/deploy/helm/gonavi-mcp-server/Chart.yaml
+++ b/deploy/helm/gonavi-mcp-server/Chart.yaml
@@ -0,0 +1,7 @@
+apiVersion: v2
+name: gonavi-mcp-server
+description: Helm chart for deploying GoNavi MCP Server
+type: application
+version: 0.1.0
+appVersion: "latest"
+kubeVersion: ">=1.24.0-0"
--- a/deploy/helm/gonavi-mcp-server/README.md
+++ b/deploy/helm/gonavi-mcp-server/README.md
@@ -0,0 +1,94 @@
+# GoNavi MCP Server Helm Chart
+
+这个 Chart 用来部署 `gonavi-mcp-server`，覆盖当前仓库 K8s 示例里的几类常见场景：
+
+- 基于现有 Secret 直接部署
+- 通过 Helm values 内联创建测试用 Secret
+- 启用 Ingress
+- 追加 `drivers/` PVC
+- NAS / k3s 单机节点直接挂宿主机数据目录
+
+Chart 目录：
+
+- `Chart.yaml`
+- `values.yaml`
+- `values-examples/*.yaml`
+- `templates/*.yaml`
+
+## 1. 默认安装
+
+默认值假设你已经有一个现成 Secret：
+
+- 名称：`gonavi-mcp-server-data`
+- 至少包含：
+  - `connections.json`
+  - `daily_secrets.json`
+  - `GONAVI_MCP_HTTP_TOKEN`
+
+安装命令：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server -n gonavi --create-namespace
+```
+
+## 2. 直接创建测试用 Secret
+
+如果只是本地验证模板或快速试跑，可以使用示例 values：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server \
+  -n gonavi --create-namespace \
+  -f deploy/helm/gonavi-mcp-server/values-examples/inline-secret.yaml
+```
+
+这个示例只适合最小联调，不适合真实生产连接数据。
+
+## 3. 常用示例
+
+启用 Ingress：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server \
+  -n gonavi --create-namespace \
+  -f deploy/helm/gonavi-mcp-server/values-examples/ingress.yaml
+```
+
+挂载 drivers PVC：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server \
+  -n gonavi --create-namespace \
+  -f deploy/helm/gonavi-mcp-server/values-examples/drivers-pvc.yaml
+```
+
+同时启用 Ingress 与 drivers PVC：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server \
+  -n gonavi --create-namespace \
+  -f deploy/helm/gonavi-mcp-server/values-examples/ingress-with-drivers-pvc.yaml
+```
+
+NAS / k3s hostPath：
+
+```bash
+helm upgrade --install gonavi-mcp-server deploy/helm/gonavi-mcp-server \
+  -n gonavi --create-namespace \
+  -f deploy/helm/gonavi-mcp-server/values-examples/nas-hostpath.yaml
+```
+
+## 4. 关键参数
+
+- `image.repository` / `image.tag`
+- `secret.create`
+- `secret.name`
+- `data.mode=secret|hostPath|pvc`
+- `drivers.mode=none|pvc|hostPath`
+- `ingress.enabled`
+
+## 5. 约束
+
+- `data.mode=secret` 时，Secret 必须能提供 `connections.json` 和 `daily_secrets.json`
+- `data.mode=hostPath` 时，宿主机目录需要包含 GoNavi 活动数据目录内容
+- `drivers.mode!=none` 时，会在 `/data/drivers` 追加独立挂载
+- Chart 默认只部署 MCP Server，不部署桌面 GUI
--- a/deploy/helm/gonavi-mcp-server/templates/_helpers.tpl
+++ b/deploy/helm/gonavi-mcp-server/templates/_helpers.tpl
@@ -0,0 +1,49 @@
+{{- define "gonavi-mcp-server.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := include "gonavi-mcp-server.name" . -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" -}}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.labels" -}}
+helm.sh/chart: {{ include "gonavi-mcp-server.chart" . }}
+app.kubernetes.io/name: {{ include "gonavi-mcp-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "gonavi-mcp-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.namespace" -}}
+{{- default .Release.Namespace .Values.namespaceOverride -}}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.secretName" -}}
+{{- if .Values.secret.name -}}
+{{- .Values.secret.name -}}
+{{- else -}}
+{{- include "gonavi-mcp-server.fullname" . -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "gonavi-mcp-server.serviceName" -}}
+{{- include "gonavi-mcp-server.fullname" . -}}
+{{- end -}}
--- a/deploy/helm/gonavi-mcp-server/templates/deployment.yaml
+++ b/deploy/helm/gonavi-mcp-server/templates/deployment.yaml
@@ -0,0 +1,130 @@
+{{- $dataMode := .Values.data.mode -}}
+{{- $driversMode := .Values.drivers.mode -}}
+{{- if not (or (eq $dataMode "secret") (eq $dataMode "hostPath") (eq $dataMode "pvc")) -}}
+{{- fail "data.mode must be one of: secret, hostPath, pvc" -}}
+{{- end -}}
+{{- if not (or (eq $driversMode "none") (eq $driversMode "pvc") (eq $driversMode "hostPath")) -}}
+{{- fail "drivers.mode must be one of: none, pvc, hostPath" -}}
+{{- end -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "gonavi-mcp-server.fullname" . }}
+  namespace: {{ include "gonavi-mcp-server.namespace" . }}
+  labels:
+    {{- include "gonavi-mcp-server.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "gonavi-mcp-server.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "gonavi-mcp-server.selectorLabels" . | nindent 8 }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: gonavi-mcp-server
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            - http
+            {{- range .Values.mcp.extraArgs }}
+            - {{ . | quote }}
+            {{- end }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          env:
+            - name: GONAVI_DATA_ROOT
+              value: {{ .Values.mcp.dataRoot | quote }}
+            - name: GONAVI_LOG_DIR
+              value: {{ .Values.mcp.logDir | quote }}
+            - name: GONAVI_MCP_HTTP_ADDR
+              value: {{ .Values.mcp.httpAddr | quote }}
+            - name: GONAVI_MCP_HTTP_PATH
+              value: {{ .Values.mcp.httpPath | quote }}
+            - name: GONAVI_MCP_SCHEMA_ONLY
+              value: {{ ternary "true" "false" .Values.mcp.schemaOnly | quote }}
+            - name: GONAVI_MCP_HTTP_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "gonavi-mcp-server.secretName" . }}
+                  key: {{ .Values.secret.tokenKey }}
+            {{- with .Values.mcp.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          volumeMounts:
+            - name: gonavi-data
+              mountPath: {{ .Values.data.mountPath | quote }}
+              readOnly: true
+            {{- if ne $driversMode "none" }}
+            - name: gonavi-drivers
+              mountPath: {{ .Values.drivers.mountPath | quote }}
+              readOnly: true
+            {{- end }}
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 20
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+      volumes:
+        - name: gonavi-data
+          {{- if eq $dataMode "secret" }}
+          projected:
+            sources:
+              - secret:
+                  name: {{ include "gonavi-mcp-server.secretName" . }}
+                  items:
+                    - key: {{ .Values.secret.connectionsJsonKey }}
+                      path: connections.json
+                    - key: {{ .Values.secret.dailySecretsJsonKey }}
+                      path: daily_secrets.json
+          {{- else if eq $dataMode "hostPath" }}
+          hostPath:
+            path: {{ required "data.hostPath.path is required when data.mode=hostPath" .Values.data.hostPath.path | quote }}
+            type: {{ default "Directory" .Values.data.hostPath.type | quote }}
+          {{- else if eq $dataMode "pvc" }}
+          persistentVolumeClaim:
+            claimName: {{ required "data.pvc.claimName is required when data.mode=pvc" .Values.data.pvc.claimName | quote }}
+          {{- end }}
+        {{- if eq $driversMode "pvc" }}
+        - name: gonavi-drivers
+          persistentVolumeClaim:
+            claimName: {{ required "drivers.pvc.claimName is required when drivers.mode=pvc" .Values.drivers.pvc.claimName | quote }}
+        {{- else if eq $driversMode "hostPath" }}
+        - name: gonavi-drivers
+          hostPath:
+            path: {{ required "drivers.hostPath.path is required when drivers.mode=hostPath" .Values.drivers.hostPath.path | quote }}
+            type: {{ default "Directory" .Values.drivers.hostPath.type | quote }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
--- a/deploy/helm/gonavi-mcp-server/templates/ingress.yaml
+++ b/deploy/helm/gonavi-mcp-server/templates/ingress.yaml
@@ -0,0 +1,34 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "gonavi-mcp-server.fullname" . }}
+  namespace: {{ include "gonavi-mcp-server.namespace" . }}
+  labels:
+    {{- include "gonavi-mcp-server.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className | quote }}
+  {{- with .Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path | quote }}
+            pathType: {{ .pathType | quote }}
+            backend:
+              service:
+                name: {{ include "gonavi-mcp-server.serviceName" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}
--- a/deploy/helm/gonavi-mcp-server/templates/secret.yaml
+++ b/deploy/helm/gonavi-mcp-server/templates/secret.yaml
@@ -0,0 +1,27 @@
+{{- if .Values.secret.create }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gonavi-mcp-server.secretName" . }}
+  namespace: {{ include "gonavi-mcp-server.namespace" . }}
+  labels:
+    {{- include "gonavi-mcp-server.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  {{ .Values.secret.tokenKey }}: {{ required "secret.stringData.token is required when secret.create=true" .Values.secret.stringData.token | quote }}
+  {{- if eq .Values.data.mode "secret" }}
+  {{ .Values.secret.connectionsJsonKey }}: |
+{{ required "secret.stringData.connectionsJson is required when data.mode=secret and secret.create=true" .Values.secret.stringData.connectionsJson | nindent 4 }}
+  {{ .Values.secret.dailySecretsJsonKey }}: |
+{{ required "secret.stringData.dailySecretsJson is required when data.mode=secret and secret.create=true" .Values.secret.stringData.dailySecretsJson | nindent 4 }}
+  {{- else }}
+  {{- if .Values.secret.stringData.connectionsJson }}
+  {{ .Values.secret.connectionsJsonKey }}: |
+{{ .Values.secret.stringData.connectionsJson | nindent 4 }}
+  {{- end }}
+  {{- if .Values.secret.stringData.dailySecretsJson }}
+  {{ .Values.secret.dailySecretsJsonKey }}: |
+{{ .Values.secret.stringData.dailySecretsJson | nindent 4 }}
+  {{- end }}
+  {{- end }}
+{{- end }}
--- a/deploy/helm/gonavi-mcp-server/templates/service.yaml
+++ b/deploy/helm/gonavi-mcp-server/templates/service.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "gonavi-mcp-server.serviceName" . }}
+  namespace: {{ include "gonavi-mcp-server.namespace" . }}
+  labels:
+    {{- include "gonavi-mcp-server.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  selector:
+    {{- include "gonavi-mcp-server.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
--- a/deploy/helm/gonavi-mcp-server/values-examples/drivers-pvc.yaml
+++ b/deploy/helm/gonavi-mcp-server/values-examples/drivers-pvc.yaml
@@ -0,0 +1,4 @@
+drivers:
+  mode: pvc
+  pvc:
+    claimName: gonavi-drivers
--- a/deploy/helm/gonavi-mcp-server/values-examples/ingress-with-drivers-pvc.yaml
+++ b/deploy/helm/gonavi-mcp-server/values-examples/ingress-with-drivers-pvc.yaml
@@ -0,0 +1,19 @@
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: gonavi-mcp.example.com
+      paths:
+        - path: /mcp
+          pathType: Prefix
+        - path: /healthz
+          pathType: Prefix
+  tls:
+    - secretName: gonavi-mcp-server-tls
+      hosts:
+        - gonavi-mcp.example.com
+
+drivers:
+  mode: pvc
+  pvc:
+    claimName: gonavi-drivers
--- a/deploy/helm/gonavi-mcp-server/values-examples/ingress.yaml
+++ b/deploy/helm/gonavi-mcp-server/values-examples/ingress.yaml
@@ -0,0 +1,14 @@
+ingress:
+  enabled: true
+  className: nginx
+  hosts:
+    - host: gonavi-mcp.example.com
+      paths:
+        - path: /mcp
+          pathType: Prefix
+        - path: /healthz
+          pathType: Prefix
+  tls:
+    - secretName: gonavi-mcp-server-tls
+      hosts:
+        - gonavi-mcp.example.com
--- a/deploy/helm/gonavi-mcp-server/values-examples/inline-secret.yaml
+++ b/deploy/helm/gonavi-mcp-server/values-examples/inline-secret.yaml
@@ -0,0 +1,13 @@
+secret:
+  create: true
+  stringData:
+    token: replace-with-a-random-token
+    connectionsJson: |
+      {
+        "connections": []
+      }
+    dailySecretsJson: |
+      {
+        "schemaVersion": 1,
+        "connections": {}
+      }
--- a/deploy/helm/gonavi-mcp-server/values-examples/nas-hostpath.yaml
+++ b/deploy/helm/gonavi-mcp-server/values-examples/nas-hostpath.yaml
@@ -0,0 +1,10 @@
+data:
+  mode: hostPath
+  hostPath:
+    path: /volume1/docker/gonavi/data
+    type: Directory
+
+secret:
+  create: true
+  stringData:
+    token: replace-with-a-random-token
--- a/deploy/helm/gonavi-mcp-server/values.yaml
+++ b/deploy/helm/gonavi-mcp-server/values.yaml
@@ -0,0 +1,99 @@
+nameOverride: ""
+fullnameOverride: ""
+namespaceOverride: ""
+
+replicaCount: 1
+
+image:
+  repository: ghcr.io/syngnat/gonavi-mcp-server
+  tag: latest
+  pullPolicy: IfNotPresent
+
+service:
+  type: ClusterIP
+  port: 8765
+  annotations: {}
+
+mcp:
+  dataRoot: /data
+  logDir: /var/lib/gonavi/logs
+  httpAddr: 0.0.0.0:8765
+  httpPath: /mcp
+  schemaOnly: true
+  extraArgs: []
+  extraEnv: []
+
+secret:
+  create: false
+  name: gonavi-mcp-server-data
+  tokenKey: GONAVI_MCP_HTTP_TOKEN
+  connectionsJsonKey: connections.json
+  dailySecretsJsonKey: daily_secrets.json
+  stringData:
+    token: ""
+    connectionsJson: ""
+    dailySecretsJson: ""
+
+data:
+  mode: secret
+  mountPath: /data
+  hostPath:
+    path: /volume1/docker/gonavi/data
+    type: Directory
+  pvc:
+    claimName: ""
+
+drivers:
+  mode: none
+  mountPath: /data/drivers
+  pvc:
+    claimName: gonavi-drivers
+  hostPath:
+    path: /volume1/docker/gonavi/drivers
+    type: Directory
+
+ingress:
+  enabled: false
+  className: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+  hosts:
+    - host: gonavi-mcp.example.com
+      paths:
+        - path: /mcp
+          pathType: Prefix
+        - path: /healthz
+          pathType: Prefix
+  tls:
+    - secretName: gonavi-mcp-server-tls
+      hosts:
+        - gonavi-mcp.example.com
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+
+podAnnotations: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 10001
+  runAsGroup: 10001
+  seccompProfile:
+    type: RuntimeDefault
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
+nodeSelector: {}
+tolerations: []
+affinity: {}
--- a/deploy/k8s/gonavi-mcp-server/README.md
+++ b/deploy/k8s/gonavi-mcp-server/README.md
@@ -0,0 +1,151 @@
+# GoNavi MCP Server Kubernetes 示例
+
+这个目录提供 `gonavi-mcp-server` 的最小 K8s 部署清单，适合：
+
+- Linux 服务器上的单集群部署
+- NAS 自带 K8s / k3s / k8s-lite 环境
+- 需要把 GoNavi MCP 通过 Ingress / Gateway 暴露给远端 Agent 的场景
+
+如果你希望通过 values 参数统一控制镜像、Secret、Ingress、PVC/hostPath，而不是维护多份 overlay，请直接使用 [deploy/helm/gonavi-mcp-server](../../helm/gonavi-mcp-server)。
+
+目录结构：
+
+- `kustomization.yaml`：基础部署入口
+- `base/kustomization.yaml`：基础资源集合
+- `overlays/nas-hostpath`：直接挂 NAS / 单机节点上的 GoNavi 数据目录
+- `base/deployment.yaml` / `base/service.yaml`：基础资源
+- `overlays/drivers-pvc`：为 `/data/drivers` 增加 PVC 挂载
+- `overlays/ingress`：增加 Ingress 暴露 `/mcp`
+- `overlays/ingress-with-drivers-pvc`：同时启用 Ingress 和 drivers PVC
+
+## 前提
+
+容器仍然依赖 GoNavi 的活动数据目录。至少要准备：
+
+- `connections.json`
+- `daily_secrets.json`
+
+如果目标连接依赖可选 driver agent，还需要额外挂载 `/data/drivers`。
+
+`base/deployment.yaml` 默认镜像指向：
+
+```text
+ghcr.io/syngnat/gonavi-mcp-server:latest
+```
+
+如果你要跟随 `dev` 分支，可以改成：
+
+```text
+ghcr.io/syngnat/gonavi-mcp-server:dev-latest
+```
+
+如果你要使用自建镜像，再按下面方式覆盖 `image`：
+
+- 在当前节点可访问的 Docker / Podman / containerd 环境中构建并导入这个镜像
+- 把镜像推送到你的私有仓库，并同步修改 `base/deployment.yaml` 里的 `image`
+
+例如：
+
+```bash
+docker build -f Dockerfile.mcp-server -t gonavi-mcp-server:local .
+# or
+podman build -f Dockerfile.mcp-server -t localhost/gonavi-mcp-server:local .
+```
+
+## 1. 创建 Secret
+
+推荐直接从现有 GoNavi 数据文件生成：
+
+```bash
+kubectl create secret generic gonavi-mcp-server-data \
+  --from-file=connections.json=/absolute/path/to/gonavi-data/connections.json \
+  --from-file=daily_secrets.json=/absolute/path/to/gonavi-data/daily_secrets.json \
+  --from-literal=GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token
+```
+
+如需单独 namespace，请先执行：
+
+```bash
+kubectl create namespace gonavi
+kubectl -n gonavi create secret generic gonavi-mcp-server-data \
+  --from-file=connections.json=/absolute/path/to/gonavi-data/connections.json \
+  --from-file=daily_secrets.json=/absolute/path/to/gonavi-data/daily_secrets.json \
+  --from-literal=GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token
+```
+
+## 2. 应用清单
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server
+```
+
+如果使用独立 namespace，请先把 YAML 里的 `namespace` 改成你的目标值，或自行用 `kustomize` / Helm 做二次封装。
+
+清单内已经带了基础安全上下文和默认资源配额；如果你的连接数量、对象规模或并发访问更高，建议按实际负载调整 `resources`。
+
+### 常用 Overlay
+
+仅基础部署：
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server
+```
+
+需要可选 driver agent：
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server/overlays/drivers-pvc
+```
+
+NAS / k3s 单机节点直接挂宿主机目录：
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server/overlays/nas-hostpath
+```
+
+需要对外暴露 `/mcp`：
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server/overlays/ingress
+```
+
+同时需要 Ingress 与 drivers PVC：
+
+```bash
+kubectl apply -k deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc
+```
+
+应用 overlay 前，记得先改里面的占位值，例如：
+
+- `overlays/ingress/ingress.yaml` 里的域名、TLS Secret、`ingressClassName`
+- `overlays/drivers-pvc/patch-deployment.yaml` 里的 PVC 名称 `gonavi-drivers`
+- `overlays/nas-hostpath/patch-deployment.yaml` 里的宿主机目录 `/volume1/docker/gonavi/data`
+
+`nas-hostpath` overlay 会直接把整个 GoNavi 数据目录挂到 `/data`，因此 `connections.json`、`daily_secrets.json`、`drivers/` 都从宿主机目录读取；此时仍建议保留 `GONAVI_MCP_HTTP_TOKEN` 的 Secret 注入，不要把 token 直接硬编码进 Deployment。
+
+## 3. 校验
+
+```bash
+kubectl get pods -n gonavi
+kubectl get svc -n gonavi
+kubectl port-forward -n gonavi svc/gonavi-mcp-server 8765:8765
+curl -H "Authorization: Bearer replace-with-a-random-token" http://127.0.0.1:8765/healthz
+```
+
+`/healthz` 返回 `ok` 说明 Pod 已对外提供 HTTP 服务。
+
+## 4. 暴露给远端 Agent
+
+- 集群内使用：直接访问 `http://gonavi-mcp-server.gonavi.svc.cluster.local:8765/mcp`
+- 集群外使用：通过 Ingress / Gateway / 反向代理暴露 `/mcp`
+- 远端 Agent 请求头：`Authorization: Bearer <你的 token>`
+
+## 5. drivers 挂载
+
+当前示例默认只挂载 `connections.json` 与 `daily_secrets.json`。如果保存连接里包含 Dameng、ClickHouse、DuckDB 等依赖 driver agent 的数据源，请在 Deployment 中额外补一个卷，把宿主机或 PVC 中的 `drivers/` 目录挂载到：
+
+```text
+/data/drivers
+```
+
+否则对应连接会因为缺少 driver agent 无法使用。
--- a/deploy/k8s/gonavi-mcp-server/base/deployment.yaml
+++ b/deploy/k8s/gonavi-mcp-server/base/deployment.yaml
@@ -0,0 +1,89 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+  labels:
+    app.kubernetes.io/name: gonavi-mcp-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: gonavi-mcp-server
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: gonavi-mcp-server
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: gonavi-mcp-server
+          # 如需跟随 dev 分支，可改成 ghcr.io/syngnat/gonavi-mcp-server:dev-latest
+          image: ghcr.io/syngnat/gonavi-mcp-server:latest
+          imagePullPolicy: IfNotPresent
+          args:
+            - http
+          ports:
+            - name: http
+              containerPort: 8765
+              protocol: TCP
+          env:
+            - name: GONAVI_DATA_ROOT
+              value: /data
+            - name: GONAVI_LOG_DIR
+              value: /var/lib/gonavi/logs
+            - name: GONAVI_MCP_HTTP_ADDR
+              value: 0.0.0.0:8765
+            - name: GONAVI_MCP_HTTP_PATH
+              value: /mcp
+            - name: GONAVI_MCP_SCHEMA_ONLY
+              value: "true"
+            - name: GONAVI_MCP_HTTP_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: gonavi-mcp-server-data
+                  key: GONAVI_MCP_HTTP_TOKEN
+          volumeMounts:
+            - name: gonavi-data
+              mountPath: /data
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+      volumes:
+        - name: gonavi-data
+          projected:
+            sources:
+              - secret:
+                  name: gonavi-mcp-server-data
+                  items:
+                    - key: connections.json
+                      path: connections.json
+                    - key: daily_secrets.json
+                      path: daily_secrets.json
--- a/deploy/k8s/gonavi-mcp-server/base/kustomization.yaml
+++ b/deploy/k8s/gonavi-mcp-server/base/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml
--- a/deploy/k8s/gonavi-mcp-server/base/service.yaml
+++ b/deploy/k8s/gonavi-mcp-server/base/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+  labels:
+    app.kubernetes.io/name: gonavi-mcp-server
+spec:
+  selector:
+    app.kubernetes.io/name: gonavi-mcp-server
+  ports:
+    - name: http
+      port: 8765
+      targetPort: http
+      protocol: TCP
--- a/deploy/k8s/gonavi-mcp-server/kustomization.yaml
+++ b/deploy/k8s/gonavi-mcp-server/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - base
--- a/deploy/k8s/gonavi-mcp-server/overlays/drivers-pvc/kustomization.yaml
+++ b/deploy/k8s/gonavi-mcp-server/overlays/drivers-pvc/kustomization.yaml
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+patches:
+  - path: patch-deployment.yaml
--- a/deploy/k8s/gonavi-mcp-server/overlays/drivers-pvc/patch-deployment.yaml
+++ b/deploy/k8s/gonavi-mcp-server/overlays/drivers-pvc/patch-deployment.yaml
@@ -0,0 +1,18 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+spec:
+  template:
+    spec:
+      containers:
+        - name: gonavi-mcp-server
+          volumeMounts:
+            - name: gonavi-drivers
+              mountPath: /data/drivers
+              readOnly: true
+      volumes:
+        - name: gonavi-drivers
+          persistentVolumeClaim:
+            claimName: gonavi-drivers
--- a/deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc/ingress.yaml
+++ b/deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc/ingress.yaml
@@ -0,0 +1,33 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - gonavi-mcp.example.com
+      secretName: gonavi-mcp-server-tls
+  rules:
+    - host: gonavi-mcp.example.com
+      http:
+        paths:
+          - path: /mcp
+            pathType: Prefix
+            backend:
+              service:
+                name: gonavi-mcp-server
+                port:
+                  number: 8765
+          - path: /healthz
+            pathType: Prefix
+            backend:
+              service:
+                name: gonavi-mcp-server
+                port:
+                  number: 8765
--- a/deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc/kustomization.yaml
+++ b/deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+  - ingress.yaml
+
+patches:
+  - path: patch-deployment.yaml
--- a/deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc/patch-deployment.yaml
+++ b/deploy/k8s/gonavi-mcp-server/overlays/ingress-with-drivers-pvc/patch-deployment.yaml
@@ -0,0 +1,18 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+spec:
+  template:
+    spec:
+      containers:
+        - name: gonavi-mcp-server
+          volumeMounts:
+            - name: gonavi-drivers
+              mountPath: /data/drivers
+              readOnly: true
+      volumes:
+        - name: gonavi-drivers
+          persistentVolumeClaim:
+            claimName: gonavi-drivers
--- a/deploy/k8s/gonavi-mcp-server/overlays/ingress/ingress.yaml
+++ b/deploy/k8s/gonavi-mcp-server/overlays/ingress/ingress.yaml
@@ -0,0 +1,33 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - gonavi-mcp.example.com
+      secretName: gonavi-mcp-server-tls
+  rules:
+    - host: gonavi-mcp.example.com
+      http:
+        paths:
+          - path: /mcp
+            pathType: Prefix
+            backend:
+              service:
+                name: gonavi-mcp-server
+                port:
+                  number: 8765
+          - path: /healthz
+            pathType: Prefix
+            backend:
+              service:
+                name: gonavi-mcp-server
+                port:
+                  number: 8765
--- a/deploy/k8s/gonavi-mcp-server/overlays/ingress/kustomization.yaml
+++ b/deploy/k8s/gonavi-mcp-server/overlays/ingress/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+  - ingress.yaml
--- a/deploy/k8s/gonavi-mcp-server/overlays/nas-hostpath/kustomization.yaml
+++ b/deploy/k8s/gonavi-mcp-server/overlays/nas-hostpath/kustomization.yaml
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../base
+
+patches:
+  - path: patch-deployment.yaml
--- a/deploy/k8s/gonavi-mcp-server/overlays/nas-hostpath/patch-deployment.yaml
+++ b/deploy/k8s/gonavi-mcp-server/overlays/nas-hostpath/patch-deployment.yaml
@@ -0,0 +1,14 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gonavi-mcp-server
+  namespace: gonavi
+spec:
+  template:
+    spec:
+      volumes:
+        - $patch: replace
+          name: gonavi-data
+          hostPath:
+            path: /volume1/docker/gonavi/data
+            type: Directory
--- a/deploy/podman/gonavi-mcp-server/README.md
+++ b/deploy/podman/gonavi-mcp-server/README.md
@@ -0,0 +1,101 @@
+# GoNavi MCP Server Podman 示例
+
+这个目录提供 `gonavi-mcp-server` 的 Podman 原生部署入口，覆盖两类常见场景：
+
+- 直接用 `podman run` 在 Linux 服务器 / NAS 上启动
+- 用 rootless Quadlet + systemd 做常驻服务
+
+目录内容：
+
+- `gonavi-mcp-server.env.example`：给 `podman run` / Quadlet 共用的容器环境变量示例
+- `gonavi-mcp-server.container`：Quadlet 示例
+
+前提仍然一样：宿主机 GoNavi 活动数据目录内至少应包含：
+
+- `connections.json`
+- `daily_secrets.json`
+
+如果目标连接依赖可选 driver agent，还要保证同一数据目录下已有 `drivers/`。
+
+## 1. 直接运行已发布镜像
+
+```bash
+cp deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example ./gonavi-mcp-server.env
+```
+
+把 `GONAVI_MCP_HTTP_TOKEN` 改成随机值后运行：
+
+```bash
+podman run -d --name gonavi-mcp-server --replace \
+  -p 8765:8765 \
+  --env-file ./gonavi-mcp-server.env \
+  -v /absolute/path/to/gonavi-data:/data:Z \
+  ghcr.io/syngnat/gonavi-mcp-server:latest http
+```
+
+查看状态：
+
+```bash
+podman ps
+podman logs -f gonavi-mcp-server
+```
+
+如果你的宿主机没有启用 SELinux，可把挂载参数末尾的 `:Z` 去掉；如果启用了 SELinux，建议保留它。
+
+## 2. 本地源码构建镜像
+
+仓库根目录已经提供 `.containerignore`，Podman 会优先读取它来裁剪构建上下文。
+
+```bash
+podman build -f Dockerfile.mcp-server -t localhost/gonavi-mcp-server:local .
+podman run -d --name gonavi-mcp-server --replace \
+  -p 8765:8765 \
+  --env-file ./gonavi-mcp-server.env \
+  -v /absolute/path/to/gonavi-data:/data:Z \
+  localhost/gonavi-mcp-server:local http
+```
+
+## 3. Rootless Quadlet 常驻服务
+
+Podman Quadlet 适合 Linux 服务器 / NAS 上做 rootless 常驻服务。
+
+把文件放到用户级目录：
+
+```bash
+mkdir -p ~/.config/containers/systemd
+cp deploy/podman/gonavi-mcp-server/gonavi-mcp-server.container ~/.config/containers/systemd/
+cp deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example ~/.config/containers/systemd/gonavi-mcp-server.env
+```
+
+然后修改两处：
+
+- `~/.config/containers/systemd/gonavi-mcp-server.container` 里的 `Volume=/absolute/path/to/gonavi-data:/data:Z`
+- `~/.config/containers/systemd/gonavi-mcp-server.env` 里的 `GONAVI_MCP_HTTP_TOKEN`
+
+启动服务：
+
+```bash
+systemctl --user daemon-reload
+systemctl --user enable --now gonavi-mcp-server.service
+systemctl --user status gonavi-mcp-server.service
+journalctl --user -u gonavi-mcp-server.service -f
+```
+
+如果你希望用户退出登录后服务仍然保持运行，再执行：
+
+```bash
+loginctl enable-linger "$USER"
+```
+
+Rootless Quadlet 默认搜索路径是 `~/.config/containers/systemd/`；如果你要做系统级 rootful 部署，可改放到 `/etc/containers/systemd/`。
+
+## 4. 关于 Compose
+
+Podman 的 `podman compose` 依赖外部 compose provider。也就是说，是否能直接复用仓库根目录的 `docker-compose.mcp-server.yml`，取决于你的 Podman 环境是否已经安装并配置了对应 provider。
+
+因此，这个仓库对 Podman 的主支持路径是：
+
+- `podman run`
+- Quadlet（推荐长期运行）
+
+如果你的环境已经有可用的 compose provider，再去复用根目录 Compose 文件即可。
--- a/deploy/podman/gonavi-mcp-server/gonavi-mcp-server.container
+++ b/deploy/podman/gonavi-mcp-server/gonavi-mcp-server.container
@@ -0,0 +1,22 @@
+[Unit]
+Description=GoNavi MCP Server (rootless Podman)
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+ContainerName=gonavi-mcp-server
+Image=ghcr.io/syngnat/gonavi-mcp-server:latest
+Pull=newer
+EnvironmentFile=./gonavi-mcp-server.env
+# 修改成你的 GoNavi 活动数据目录；SELinux 主机建议保留 :Z
+Volume=/absolute/path/to/gonavi-data:/data:Z
+PublishPort=8765:8765
+Exec=http
+LogDriver=journald
+
+[Service]
+Restart=always
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target
--- a/deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example
+++ b/deploy/podman/gonavi-mcp-server/gonavi-mcp-server.env.example
@@ -0,0 +1,15 @@
+# 容器内 GoNavi 活动数据根目录。通常不需要修改；Volume= 已把宿主机目录挂到 /data。
+GONAVI_DATA_ROOT=/data
+
+# 日志目录。默认与镜像内目录保持一致。
+GONAVI_LOG_DIR=/var/lib/gonavi/logs
+
+# MCP HTTP 监听地址与路径。
+GONAVI_MCP_HTTP_ADDR=0.0.0.0:8765
+GONAVI_MCP_HTTP_PATH=/mcp
+
+# 远程 MCP 客户端访问时必须携带的 Bearer Token
+GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token
+
+# true = 只暴露结构查询工具，不注册 execute_sql
+GONAVI_MCP_SCHEMA_ONLY=true
--- a/docker-compose.mcp-server.local.yml
+++ b/docker-compose.mcp-server.local.yml
@@ -0,0 +1,7 @@
+services:
+  gonavi-mcp-server:
+    build:
+      context: .
+      dockerfile: Dockerfile.mcp-server
+    image: ${GONAVI_MCP_IMAGE_LOCAL:-gonavi-mcp-server:local}
+    pull_policy: never
--- a/docker-compose.mcp-server.yml
+++ b/docker-compose.mcp-server.yml
@@ -0,0 +1,20 @@
+services:
+  gonavi-mcp-server:
+    image: ${GONAVI_MCP_IMAGE:-ghcr.io/syngnat/gonavi-mcp-server:latest}
+    pull_policy: ${GONAVI_MCP_PULL_POLICY:-missing}
+    container_name: gonavi-mcp-server
+    restart: unless-stopped
+    ports:
+      - "${GONAVI_MCP_HTTP_PORT:-8765}:8765"
+    environment:
+      GONAVI_DATA_ROOT: /data
+      GONAVI_LOG_DIR: /var/lib/gonavi/logs
+      GONAVI_MCP_HTTP_ADDR: 0.0.0.0:8765
+      GONAVI_MCP_HTTP_PATH: ${GONAVI_MCP_HTTP_PATH:-/mcp}
+      GONAVI_MCP_HTTP_TOKEN: ${GONAVI_MCP_HTTP_TOKEN}
+      GONAVI_MCP_SCHEMA_ONLY: ${GONAVI_MCP_SCHEMA_ONLY:-true}
+    volumes:
+      - type: bind
+        source: ${GONAVI_HOST_DATA_ROOT}
+        target: /data
+    command: ["http"]
--- a/docker.mcp-server.env.example
+++ b/docker.mcp-server.env.example
@@ -0,0 +1,20 @@
+# 宿主机 GoNavi 活动数据目录，目录内至少应包含 connections.json 与 daily_secrets.json
+GONAVI_HOST_DATA_ROOT=/absolute/path/to/gonavi-data
+
+# 预构建镜像地址。稳定版通常使用 latest，跟随 dev 分支可改成 ghcr.io/syngnat/gonavi-mcp-server:dev-latest
+GONAVI_MCP_IMAGE=ghcr.io/syngnat/gonavi-mcp-server:latest
+
+# 预构建镜像拉取策略：always / missing / never
+GONAVI_MCP_PULL_POLICY=missing
+
+# 远程 MCP 客户端访问时必须携带的 Bearer Token
+GONAVI_MCP_HTTP_TOKEN=replace-with-a-random-token
+
+# 宿主机暴露端口
+GONAVI_MCP_HTTP_PORT=8765
+
+# MCP HTTP 路径
+GONAVI_MCP_HTTP_PATH=/mcp
+
+# true = 只暴露结构查询工具，不注册 execute_sql
+GONAVI_MCP_SCHEMA_ONLY=true
--- a/docs/driver-manifest.json
+++ b/docs/driver-manifest.json
@@ -7,6 +7,12 @@
      "checksumPolicy": "off",
      "downloadUrl": "builtin://activate/mariadb"
    },
+    "oceanbase": {
+      "engine": "go",
+      "version": "1.9.3",
+      "checksumPolicy": "off",
+      "downloadUrl": "builtin://activate/oceanbase"
+    },
    "doris": {
      "engine": "go",
      "version": "1.9.3",
@@ -61,6 +67,12 @@
      "checksumPolicy": "off",
      "downloadUrl": "builtin://activate/vastbase"
    },
+    "opengauss": {
+      "engine": "go",
+      "version": "1.11.1",
+      "checksumPolicy": "off",
+      "downloadUrl": "builtin://activate/opengauss"
+    },
    "mongodb": {
      "engine": "go",
      "version": "2.5.0",
@@ -84,6 +96,12 @@
      "version": "1.11.1",
      "checksumPolicy": "off",
      "downloadUrl": "builtin://activate/postgres"
+    },
+    "elasticsearch": {
+      "engine": "go",
+      "version": "8.19.0",
+      "checksumPolicy": "off",
+      "downloadUrl": "builtin://activate/elasticsearch"
    }
  }
 }
--- a/docs/superpowers/plans/2026-04-22-jvm-connector-mvp.md
+++ b/docs/superpowers/plans/2026-04-22-jvm-connector-mvp.md
--- a/docs/superpowers/specs/2026-04-22-jvm-cache-visual-editing-design.md
+++ b/docs/superpowers/specs/2026-04-22-jvm-cache-visual-editing-design.md
@@ -1,483 +0,0 @@
-# JVM 缓存可视化编辑设计
-
-## 1. 背景
-
-当前用户在公司 Java 项目中经常把缓存或运行时状态直接保存在 JVM 内存中。出现数据脏值、缓存穿透、临时纠偏或排障时，通常只有两种方式：
-
- 为特定业务临时补管理接口
- 重启应用并依赖重新初始化
-
-这两种方式都存在明显问题：
-
- 临时接口会污染业务代码，并带来后续维护和权限风险
- 重启应用成本高，且不适合用于精确修复单个缓存项
-
-GoNavi 现有已具备三类可复用基础：
-
- 统一连接与工作台能力：`frontend/src/components/ConnectionModal.tsx`、`frontend/src/components/Sidebar.tsx`、`frontend/src/components/TabManager.tsx`
- 独立运行时能力样板：Redis 通过 `internal/app/methods_redis.go` 和专用前端视图实现，不依赖 SQL `Database` 抽象
- AI 与日志能力底座：`frontend/src/components/AIChatPanel.tsx`、`frontend/src/components/QueryEditor.tsx`、`frontend/src/components/LogPanel.tsx`
-
-因此，GoNavi 有条件扩展出 JVM 运行时连接与受控编辑能力，但不能简单把该需求理解为“新数据库驱动”。
-
-## 2. 目标
-
- 为 GoNavi 增加统一的 `JVM Connector` 子系统，用于连接和浏览 Java 服务的运行时缓存/管理对象
- 在同一套 UI 下支持多种接入模式，并根据目标 JVM 能力自动协商或手动切换
- 提供结构化的缓存浏览、值检查、受控修改、操作预览和审计记录
- 允许 AI 参与解释、分析和生成修改计划，但不默认开放 AI 自动执行
- 尽量避免强依赖 `-javaagent` 或运行时动态 attach，适配企业内对生产进程注入普遍敏感的环境
-
-## 3. 非目标
-
- 不承诺“任意 JVM 内任意对象均可直接读写”
- 不在首期支持任意 Java 表达式执行、任意反射路径写值或任意 classloader 深度探测
- 不把 JVM 功能强行塞进现有 SQL `Database` / driver-agent 抽象
- 不承诺通过 Agent 模式支持所有缓存框架或任意深层对象写入
- 不绕过目标服务现有认证、鉴权和网络边界
-
-## 4. 需求与约束
-
-### 4.1 需求清单
-
- 统一配置 JVM 连接
- 探测当前 JVM 支持的接入模式与可用能力
- 浏览缓存空间、管理对象和受控操作
- 查看值快照与元数据
- 执行受控修改，并提供 before/after 预览
- 将操作结果写入审计记录
- 支持 AI 对资源结构和修改方案进行分析
-
-### 4.2 已确认约束
-
- 用户倾向通用型产品形态，但目标 Java 服务大概率不允许 `-javaagent` 或运行时动态 attach
- 企业环境下，稳定性与安全性优先级高于“黑科技式通用能力”
- 一期应优先基于标准协议和业务可控接入面，而不是侵入式 runtime 操作
-
-## 5. 现状分析
-
-### 5.1 GoNavi 架构启示
-
- `internal/db/database.go` 面向标准化数据源 CRUD，适合 SQL 类资源
- `internal/app/methods_redis.go` 证明 GoNavi 已支持“独立运行时系统能力线”
- `frontend/src/components/RedisViewer.tsx` 与 `frontend/src/components/RedisCommandEditor.tsx` 提供了树形浏览、结构化值编辑和控制台交互样板
- `frontend/src/components/AIChatPanel.tsx` 与 `frontend/src/components/ai/AIMessageBubble.tsx` 已具备 AI 交互和危险执行确认能力
-
-### 5.2 结论
-
-JVM 缓存可视化编辑应当比照 Redis 独立建模，新增 `JVM Connector` 子系统，而不是复用 SQL `Database` 接口。
-
-## 6. 方案比较
-
-### 方案 A：单一路径通用 Agent
-
- 描述：统一要求目标 JVM 通过 `-javaagent` 或运行时 attach 暴露运行时对象访问能力
- 优点：
-  - 理论能力上限最高
-  - 可覆盖更多自研缓存和深层对象
- 缺点：
-  - 与已知企业约束直接冲突
-  - 风险最高，部署与安全成本高
-  - 与首期产品化目标不匹配
-
-### 方案 B：多接入模式 + 能力协商
-
- 描述：统一做 `JVM Connector`，底层同时支持 `JMX`、`Management Endpoint`、`Agent`
- 优点：
-  - 产品形态统一
-  - 能根据目标 JVM 能力降级
-  - 可先做低风险路径，后续再扩展高级模式
- 缺点：
-  - 不同模式能力不一致，UI 与权限模型更复杂
-
-### 方案 C：只做业务侧管理端点
-
- 描述：完全放弃通用接入，只提供官方 Starter/管理端点接入
- 优点：
-  - 结构最稳，AI 最容易接入
-  - 权限、审计、预览、回滚最好做
- 缺点：
-  - 不满足“尽量通用”的产品定位
-  - 无法覆盖仅开放 JMX 的存量系统
-
-## 7. 选型
-
-采用方案 B。当前已落地：
-
- `JMX Provider`
- `Management Endpoint Provider`
- `Agent Provider`（高级可选模式，要求目标 Java 服务显式预埋 GoNavi Java Agent）
-
-## 8. 目标架构
-
-### 8.1 总体结构
-
-新增统一的 `JVM Connector` 子系统，分为五层：
-
- `Connection Layer`
-  - 新增 `jvm` 连接类型
-  - 保存目标地址、认证、允许模式、首选模式、环境标签等配置
- `Capability Layer`
-  - 建立连接后探测当前支持的 provider 与能力矩阵
- `Provider Layer`
-  - `JMX Provider`
-  - `Management Endpoint Provider`
-  - `Agent Provider`（预留）
- `Resource Layer`
-  - 将不同来源统一映射为结构化资源
- `Guard Layer`
-  - 统一负责预览、确认、审计、回读验证、错误归一化
-
-### 8.2 设计原则
-
- UI 统一，协议多态
- 读写分离，修改必须经过 Guard Layer
- provider 不得自行绕过权限与审计链路
- 能力不足时显式降级，不提供“看似可用、实际不可执行”的假入口
-
-## 9. Provider 设计
-
-### 9.1 JMX Provider
-
- 负责：
-  - 建立 JMX/RMI 连接
-  - 发现 MBean
-  - 读取属性
-  - 调用白名单操作
-  - 写入允许修改的白名单属性
- 适用场景：
-  - 目标 JVM 已开放 JMX
-  - 缓存或管理对象已暴露为 MBean
- 特点：
-  - 低侵入、标准化、可落地
-  - key/value 级资源能力通常有限
-
-### 9.2 Management Endpoint Provider
-
- 负责：
-  - 调用业务服务暴露的 GoNavi 管理端点或 Starter
-  - 返回结构化缓存资源、元数据和受控动作
-  - 提供修改预览与回滚信息
- 适用场景：
-  - 业务方愿意接入轻量 Starter/管理端点
-  - 需要更强的 key/value 级浏览与修改能力
- 特点：
-  - 最适合产品化和 AI 协同
-  - 权限、脱敏、审计、回滚最容易做
-
-### 9.3 Agent Provider
-
- 负责：
-  - 在特定环境下通过 GoNavi Java Agent 暴露受控管理端口
-  - 提供比 JMX 更贴近缓存资源模型的结构化浏览、预览与写入能力
- 定位：
-  - 高级模式
-  - 不默认启用
-  - 需要目标 Java 服务以 `-javaagent` 方式显式启动
-
-## 10. 统一资源模型
-
-建议统一抽象以下资源：
-
- `runtime`
-  - 目标 JVM 实例
- `cacheNamespace`
-  - 缓存空间，如某个 CacheManager 下的 cacheName
- `cacheEntry`
-  - 具体缓存项 key/value
- `managedBean`
-  - 可读写的托管对象或 MBean
- `operation`
-  - 受控操作，如 `evict`、`put`、`refresh`、`clear`
- `auditRecord`
-  - 每次读写与 AI 建议的审计记录
-
-统一资源模型要求：
-
- 每个资源都有稳定 ID、显示名、provider 来源、能力标签、敏感级别
- 值快照必须区分原始值、展示值和可编辑值
- 资源定位信息必须可写入审计
-
-## 11. AI 协同设计
-
-### 11.1 AI 的角色
-
-AI 在 JVM 场景中只能作为“受控编排者”，不能作为直接执行者。
-
-AI 可以：
-
- 解释缓存/Bean 的结构和当前状态
- 生成筛选条件和定位建议
- 生成结构化修改计划
- 生成风险说明和回滚建议
- 对执行前后结果做对比分析
-
-AI 不应默认做：
-
- 直接执行 JVM 修改
- 自由生成任意脚本并直写内存
- 绕过人工确认直接调用 provider
-
-### 11.2 AI 输出形态
-
-AI 不直接输出脚本，而输出结构化变更计划，例如：
-
-```json
-{
-  "targetType": "cacheEntry",
-  "selector": {
-    "namespace": "userSessionCache",
-    "key": "user:1001"
-  },
-  "action": "updateValue",
-  "payload": {
-    "format": "json",
-    "value": {
-      "status": "ACTIVE"
-    }
-  },
-  "reason": "修复错误缓存态"
-}
-```
-
-### 11.3 AI 执行链路
-
-1. AI 读取结构化上下文
-2. AI 产出结构化变更计划
-3. Guard Layer 校验目标资源、能力和权限
-4. UI 展示修改预览与风险提示
-5. 用户确认
-6. provider 执行
-7. 系统回读验证并写审计
-
-### 11.4 一期 AI 边界
-
- 支持 AI 分析资源
- 支持 AI 生成修改计划
- 不默认支持 AI 自动执行修改
-
-## 12. 页面与交互设计
-
-### 12.1 连接层
-
-在 `ConnectionModal` 中新增 `JVM` 类型，建议配置：
-
- 连接名称
- 目标地址/端口
- 认证信息
- 允许模式列表
- 首选模式
- 环境标签（DEV/UAT/PROD）
- 默认权限级别（只读/读写）
-
-### 12.2 侧边栏
-
-展示结构：
-
- 连接
- 模式能力
- 资源类型
- `cacheNamespace` / `managedBean` / `operation`
-
-每个连接或节点显示能力徽标，例如：
-
- `JMX`
- `Endpoint`
- `Agent`
- `只读`
- `可写`
-
-### 12.3 主工作区 Tab
-
-建议新增以下 Tab 类型：
-
- `概览`
- `资源浏览`
- `值检查器`
- `修改预览`
- `AI 助手`
- `审计记录`
-
-### 12.4 标准操作流
-
-1. 用户连接 JVM
-2. 系统探测 provider 能力
-3. 用户选择资源并读取快照
-4. 用户手工修改或让 AI 生成计划
-5. 系统生成 before/after 预览
-6. 用户二次确认
-7. provider 执行
-8. 系统回读验证
-9. 写入审计与操作日志
-
-## 13. 权限与审计
-
-### 13.1 权限模型
-
-权限建议分四层：
-
- `连接级`
-  - 决定默认 `readonly` / `readwrite`
- `模式级`
-  - 决定某 provider 支持哪些动作
- `资源级`
-  - 某些资源永远只读
- `环境级`
-  - `PROD` 默认强制二次确认，禁用 AI 自动执行
-
-### 13.2 审计要求
-
-JVM 审计日志不应复用 SQL 日志数据结构，但可以复用现有 LogPanel 样式。
-
-建议记录：
-
- 连接 ID / 名称
- provider 类型
- 资源定位信息
- 动作类型
- 修改原因
- AI 是否参与
- 执行前摘要
- 执行后摘要
- 结果状态
- 耗时
- 错误信息
-
-建议本地独立落盘为 `jvm_audit.jsonl` 或等价结构，不混入 `sqlLogs`。
-
-## 14. 错误处理与兼容性边界
-
-### 14.1 错误分层
-
- `连接层失败`
-  - 认证失败、证书失败、JMX/RMI 不通、端点 401/403
- `能力层失败`
-  - 连接成功但不支持列 key、写值或批量操作
- `执行层失败`
-  - 资源不存在、值格式非法、provider 拒绝写入
- `验证层失败`
-  - 执行返回成功但回读校验不一致
-
-所有错误都应显式标明是哪个 provider、哪一层失败，避免泛化为“修改失败”。
-
-### 14.2 首期兼容性承诺
-
-优先承诺以下边界：
-
- Java 8 / 11 / 17 / 21
- Spring Boot 服务优先
- JMX 标准 MBean
- Management Endpoint 模式下优先支持：
-  - Caffeine
-  - Ehcache
-  - Guava Cache
-  - Spring Cache 抽象下可枚举缓存
-  - 接入 GoNavi Starter 的自研缓存
- 值类型首期优先：
-  - string
-  - number
-  - boolean
-  - JSON object / JSON array
-  - map / list 的结构化展示
-
-### 14.3 首期不承诺
-
- 任意 Java 对象深度反射编辑
- 无类型信息的二进制对象直接改写
- 跨 classloader 任意对象定位
- 生产环境默认开放批量危险写入
-
-## 15. MVP 分期
-
-### Phase 1：连接与只读探测
-
- JVM 连接类型
- JMX / Endpoint 能力探测
- 资源树浏览
- 值查看
- 概览页与能力徽标
- 不开放写入
-
-### Phase 2：受控修改与审计
-
- 白名单资源写入
- before/after 预览
- 二次确认
- 审计日志
- 回读验证
- 环境级保护策略
-
-### Phase 3：AI 协同
-
- AI 解释资源
- AI 生成修改计划
- AI 风险分析
- AI 回滚建议
- 仍默认不允许 AI 自动执行
-
-### Phase 4：高级模式
-
- Agent Provider
- 预埋 Java Agent 的 runtime 资源治理能力
- 仅在特殊环境启用
-
-## 16. 验证策略
-
-### 16.1 功能验证
-
- 能连接 JMX 目标
- 能连接 Endpoint 目标
- 能列出缓存空间
- 能查看 key/value
- 能完成受控修改并回读成功
-
-### 16.2 兼容性验证
-
- Java 8 / 11 / 17 / 21
- 本地、容器、K8s 内网场景
- 开启认证 / 不开启认证
- 仅 JMX、仅 Endpoint、双模式并存
-
-### 16.3 安全验证
-
- 只读连接无法写入
- `PROD` 环境必须二次确认
- AI 无法绕过人工确认直接执行
- 审计日志完整记录修改链路
-
-### 16.4 稳定性验证
-
- 目标 JVM 不可达时 UI 不假死
- 资源树大数量时支持分页或懒加载
- 回读失败时标识“不确定状态”
- provider 超时、部分失败、降级路径清晰
-
-## 17. 风险与缓解
-
-### 17.1 风险
-
- 多 provider 模式会带来能力不一致，用户可能误解“所有 JVM 都能随便改”
- JMX 模式的 key/value 级能力可能明显不足
- 管理端点模式需要业务接入，推广成本高于纯客户端方案
- 若未来引入 Agent 模式，可能引入新的安全审核和兼容性成本
-
-### 17.2 缓解
-
- 在 UI 中显式展示能力矩阵和当前 provider 来源
- 所有修改都强制经过预览、确认与审计
- 首期将“通用”定义为“统一入口 + 多模式协商”，而不是“单通道万能能力”
- Agent 仅作为高级扩展位，避免污染 MVP 边界
-
-## 18. 最终结论
-
-JVM 缓存可视化编辑能力在 GoNavi 中具备落地基础，但必须采用“统一入口、多 provider、能力协商、强 Guard Layer”的产品化方案。
-
-推荐结论如下：
-
- 新增独立的 `JVM Connector` 子系统
- 首期支持 `JMX + Management Endpoint`
- `Agent` 作为高级可选模式交付
- AI 首期支持分析与生成修改计划，不默认开放自动执行
- 所有修改必须经过预览、确认、审计和回读验证
-
-这一路径能够在兼顾企业安全约束的前提下，为用户提供可持续演进的 JVM 运行时缓存治理能力。
--- a/docs/需求追踪/需求进度追踪-AI聊天发送快捷键-20260428.md
+++ b/docs/需求追踪/需求进度追踪-AI聊天发送快捷键-20260428.md
@@ -1,73 +0,0 @@
-# 需求进度追踪 - AI聊天发送快捷键
-
-## 1. 需求摘要
- 需求名称：AI 聊天发送快捷键
- 提出日期：2026-04-28
- 负责人：Claude Code
- 目标：将 AI 聊天发送快捷键纳入工具中心快捷键管理，支持录制自定义 Enter 相关组合键，降低输入法 Enter 上屏时误发送的风险。
- 非目标：不调整后端 AI 服务配置，不改发送按钮行为，不把 AI 发送快捷键放在 AI 设置弹窗的独立入口。
-
-## 2. 范围与验收
- 范围：工具中心快捷键管理、AI 聊天输入框、本地前端偏好持久化。
- 验收标准：工具中心出现“AI 聊天发送”快捷键；默认 Enter 发送；可录制 Enter / Cmd+Enter / Ctrl+Enter / Alt+Enter 等 Enter 相关组合；普通字符键不可录制为 AI 发送；Shift+Enter 始终换行；输入法 composing 状态不发送；刷新后快捷键保持；AI 设置弹窗不再出现独立“聊天输入”快捷键入口。
- 依赖与约束：沿用 Zustand `lite-db-storage` 中的 `shortcutOptions` 持久化；保持现有 AI 后端接口不变。
-
-## 3. 里程碑与进度
- [x] 阶段 1（需求澄清）：确认输入法 Enter 上屏导致误发送，需要支持录制自定义快捷键，并复用工具中心快捷键体系。
- [x] 阶段 2（影响分析）：影响工具中心快捷键配置、AIChatPanel、AIChatInput、store 和相关测试。
- [x] 阶段 3（方案设计）：采用共享 `shortcutOptions` action，AI 输入框局部消费，不走全局快捷键执行器。
- [x] 阶段 4（实施计划）：计划已按用户反馈调整为工具中心统一方案。
- [x] 阶段 5（实现与自检）：目标红灯测试已补充，新方案核心实现已完成。
- [x] 阶段 6（评审与交付）：已完成代码审查反馈修复、目标测试、全量测试、构建、diff 检查和浏览器手工验证。
- [ ] 阶段 7（发布与观察）：发布后观察用户输入法场景反馈。
-
-## 4. 变更清单
- 已完成：新增工具中心 AI 发送 action 目标测试；实现 Enter 默认快捷键、Enter 组合录制规则、AI 输入框按 `shortcutOptions` 判定发送；移除 AI 设置独立入口；修复刷新后录制值被启动配置刷新覆盖的问题；限制 AI 发送快捷键只能录制 0 或 1 个修饰键的 Enter 组合；消费 AI 发送快捷键后阻止事件继续冒泡；更新 store、工具函数和输入框提示测试。
- 进行中：无。
- 待处理：发布后观察输入法场景反馈。
-
-## 5. 风险与阻塞
- 风险：默认 Enter 发送在少数未标记 composing 的输入法中仍可能误发。
- 阻塞：无。
- 缓解措施：用户可在工具中心录制 Cmd+Enter / Ctrl+Enter / Alt+Enter，普通 Enter 不再触发发送；AI 发送录制限制为 Enter 相关组合并保留 Shift+Enter 换行；输入法 composing 状态始终不发送。
-
-## 6. 决策记录
- 决策 1：AI 发送快捷键作为工具中心快捷键 action 持久化，不写入后端 AI provider 配置。
- 决策 2：`sendAIChatMessage` 仅由 AI 输入框处理，全局快捷键执行器跳过该局部 action。
- 决策 3：AI 发送快捷键允许默认无修饰键 Enter，但录制时只接受 Enter 相关组合，拒绝普通字符键和含 Shift 的组合。
- 决策 4：输入法 composing 状态始终不发送。
- 决策 5：AI 发送快捷键仅允许 Enter / Ctrl+Enter / Cmd+Enter / Alt+Enter，拒绝 Ctrl+Alt+Enter 等多修饰键组合，避免扩大局部快捷键冲突面。
- 决策 6：AI 输入框命中发送快捷键后同时执行 `preventDefault` 和 `stopPropagation`，避免事件继续冒泡到全局快捷键处理器。
-
-## 7. 验证记录
- 验证项：初版两档下拉方案红灯测试。
- 结果：已确认旧实现失败。
- 证据：`aiChatSendShortcut.test.ts` 缺模块失败；`store.test.ts` 新增字段缺失失败；`AIChatInput.notice.test.tsx` placeholder 仍为 Enter 失败。
- 验证项：工具中心统一方案红灯测试。
- 结果：已确认旧实现失败。
- 证据：`npm --prefix frontend test -- --run src/utils/aiChatSendShortcut.test.ts` 显示缺少 `sendAIChatMessage` action、`canRecordShortcutForAction` 和自定义 binding 判定失败；`src/store.test.ts` 显示 `shortcutOptions.sendAIChatMessage` 缺失；`src/components/ai/AIChatInput.notice.test.tsx` 显示 placeholder 未渲染 `Meta+Enter 发送`。
- 验证项：工具中心统一方案目标绿灯测试。
- 结果：已通过。
- 证据：`npm --prefix frontend test -- --run src/utils/aiChatSendShortcut.test.ts`（6 passed）、`src/components/ai/AIChatInput.notice.test.tsx`（2 passed）、`src/store.test.ts`（10 passed）。
- 验证项：代码审查反馈红灯测试。
- 结果：已确认旧实现失败。
- 证据：多修饰键 Enter 组合被误放行、缺少 `consumeAIChatSendShortcutOnKeyDown`、脏持久化 `sendAIChatMessage: A` 未回退到 Enter。
- 验证项：代码审查反馈修复后目标测试。
- 结果：已通过。
- 证据：`npm --prefix frontend test -- --run src/utils/aiChatSendShortcut.test.ts src/components/ai/AIChatInput.notice.test.tsx src/store.test.ts`（3 files passed，22 tests passed）。
- 验证项：浏览器手工验证。
- 结果：已通过。
- 证据：工具中心录制 `Meta+Enter` 后刷新仍保持；AI 输入框 placeholder 显示 `输入消息... (Meta+Enter 发送，Shift+Enter 换行，/ 快捷命令)`；普通 Enter 和 Shift+Enter 不触发发送；Meta+Enter 触发发送、调用 `preventDefault` 且事件不冒泡。
- 验证项：前端全量测试。
- 结果：已通过。
- 证据：`npm --prefix frontend test -- --run`（88 files passed，421 tests passed）。
- 验证项：diff 空白检查。
- 结果：已通过。
- 证据：`git diff --check` 无输出。
- 验证项：生产构建。
- 结果：已通过。
- 证据：`npm --prefix frontend run build` 通过，仅有既有 dynamic import / chunk size 警告。
-
-## 8. 下一步
- 下一步行动：提交并推送本次改动，发布后观察用户输入法场景反馈。
- 负责人：Claude Code
--- a/docs/需求追踪/需求进度追踪-JVM缓存可视化编辑-20260422.md
+++ b/docs/需求追踪/需求进度追踪-JVM缓存可视化编辑-20260422.md
@@ -1,246 +0,0 @@
-# 需求进度追踪 - JVM缓存可视化编辑
-
-## 1. 需求摘要
- 需求名称：JVM缓存可视化编辑
- 提出日期：2026-04-22
- 负责人：Codex
- 目标：完成 GoNavi 连接 Java JVM、可视化查看并修改 JVM 内缓存/对象值的通用能力交付，降低“改缓存只能写接口或重启应用”的运维与排障成本
- 非目标：不承诺覆盖所有 Java 框架/所有对象类型，不绕过目标应用现有安全控制，不在首期开放脚本式任意表达式执行
-
-## 2. 范围与验收
- 范围：
-  - 交付 JVM 共享契约、连接配置、provider 注册、连接测试与能力探测
-  - 交付 Endpoint / JMX / Agent 三种接入模式及其资源浏览、读值、预览、执行链路
-  - 交付 JVM 资源页、预览弹窗、审计查看、AI 草稿生成与回填能力
-  - 交付 Guard、审计、来源标记、真实集成测试与构建验证
- 验收标准：
-  - 可以在 GoNavi 中新增 JVM 连接并完成连接测试
-  - 可以按资源树浏览 JVM 对象并查看结构化快照
-  - 可以对支持写入的资源执行预览和确认写入，且带 Guard 与审计
-  - 可以通过 AI 生成结构化修改草稿，但不会跳过人工确认直接执行
-  - 可以通过真实 JMX 与真实 HTTP contract 完成端到端验证，并通过前后端构建回归
- 依赖与约束：
-  - 需复用 GoNavi 当前 Wails + React + driver-agent 架构
-  - 新能力不得破坏现有数据库/Redis 工作流
-  - 高风险写操作必须具备明确鉴权、审计与回滚思路
-  - JMX 模式要求 GoNavi 运行机器本地可用 `java` 可执行文件
-
-## 3. 里程碑与进度
- [x] 阶段 1（需求澄清）：完成
- [x] 阶段 2（影响分析）：完成
- [x] 阶段 3（方案设计）：完成（已形成正式设计文档）
- [x] 阶段 4（实施计划）：完成（已形成正式实施计划）
- [x] 阶段 5（实现与自检）：完成（Task 1 至 Task 7 已完成，代码与构建回归通过）
- [x] 阶段 6（评审与交付）：完成（已完成契约复核、上下文隔离修正、文档回填与交付检查）
- [ ] 阶段 7（发布与观察）：未开始
-
-## 4. 变更清单
- 已完成：
-  - 确认 GoNavi 当前存在统一驱动接口与可选 driver-agent 机制
-  - 确认前端已有 Redis 结构化浏览、命令编辑器、Monaco 编辑器、DataGrid 编辑能力可复用
-  - 初步判断 JVM 运行时对象编辑不适合直接复用 SQL/Database 抽象，需新增非数据库协议层
-  - 用户已确认目标方向为“通用型 JVM 接入”
-  - 用户已确认升级到完整模式，开始高风险架构评估
-  - 用户明确目标 Java 服务大概率不允许 `-javaagent` 或运行时动态 attach
-  - 已形成 JVM 缓存可视化编辑正式设计文档
-  - 已形成 JVM Connector MVP 正式实施计划文档
-  - 已完成 Task 1：JVM 共享契约与配置归一化
-  - 已完成 Task 2：Provider 注册、连接测试与能力探测 API
-  - 已完成 Task 3：JVM 连接表单、图标与展示文案接入
-  - 已完成 Task 4：只读资源浏览与 JVM Tab
-  - 已完成 Task 5：写入预览、Guard 和审计记录
-  - 已完成 Task 6：AI 结构化变更计划
-  - 已完成 Task 7：全量回归、文档回填与交付检查
-  - 已完成 JVM AI 计划解析、资源定位解析、AI 计划到当前 JVM 变更草稿的显式映射，避免把 `payload.format/value` 包装层直接透传到现有 JVM 写入契约
-  - 已完成 AI 聊天面板 JVM 上下文注入、AI 气泡“应用到 JVM 预览”入口以及 JVM 资源页草稿回填闭环
-  - 已完成 JVM AI 计划来源上下文绑定：消息现在绑定生成时的 `tabId + connectionId + providerMode + resourcePath`，避免切换 JVM 页签后误投递到当前激活页
-  - 已完成 Endpoint provider 真实 HTTP contract 与补测，支持资源浏览、读值、预览和执行
-  - 已完成可手工启动的 Java Endpoint fixture 与真实集成补测，可直接验证 Endpoint 模式端到端行为
-  - 已完成 JMX provider 真实 helper 接入与补测，支持 `domain -> mbean -> attribute/operation` 浏览、attribute `set`、operation `invoke`
-  - 已完成 JMX helper 预编译 runtime jar 内嵌分发，运行时不再依赖仓库源码目录，也不再要求本地 `javac`
-  - 已完成 JVM 快照动作提示与 payload 模板回填，前端可直接根据 `supportedActions` 生成草稿
-  - 已完成 AI 参与来源写入 JVM 审计记录，审计页可区分“手工”与“AI 辅助”
-  - 已完成 Agent provider、Agent 连接表单与概览展示，支持通过独立 Agent Base URL 接入 GoNavi Java Agent
-  - 已完成真实 Java Agent fixture 与集成验证，可通过 `-javaagent` 方式真实验证 Agent 模式资源浏览、预览与执行
-  - 已完成 JVM 收口优化：Endpoint 能力探测遵循只读配置，概览页能力矩阵补齐模式能力探测与多行错误展示，能力探测失败与风险/结果状态文案统一收口为中文业务语义
- 待处理：
-  - 无阻塞性交付项；后续仅保留复杂对象参数、`CompositeData` / `TabularData` 等高级类型写入扩展作为增强项
-
-## 5. 风险与阻塞
- 风险：
-  - 直接修改 JVM 内对象属于高风险运行时操作，误改可能造成业务状态污染
-  - 不同缓存框架（Caffeine/Ehcache/Guava/自研 Map）缺少统一标准协议
-  - 若依赖 attach agent 或表达式执行，需严格控制安全边界与可观测性
-  - 若目标 JVM 不允许预埋或动态注入 Agent，则“通用型”能力边界会明显收缩
-  - 多接入模式会带来能力不一致问题，UI 与权限模型必须显式展示“当前模式支持什么/不支持什么”
-  - 当前 AI 能力边界仍是“分析 + 生成结构化计划 + 回填预览草稿”，不直接执行 JVM 写入，真实执行仍取决于 Guard、人工确认和 provider 能力
-  - 当前 AI 计划若只提供 `namespace + key`，仍更适合 endpoint/cache 风格资源；JMX 复杂 target 仍建议优先使用 `resourcePath`
-  - JMX helper 已改为内嵌 jar 分发，但操作者机器仍需本地存在可用 `java`
-  - Agent 模式要求目标 Java 服务显式以 `-javaagent` 方式启动 GoNavi Java Agent，并额外暴露管理端口
-  - JMX operation preview 仅做参数/签名校验和预览快照，不预测真实副作用
-  - JMX 参数转换当前覆盖基础类型、`ObjectName` 和部分数组；复杂对象写入仍是后续扩展项
-  - 历史旧 AI 消息不包含 JVM 来源上下文，若需要应用到预览，需在目标 JVM 资源页重新生成计划
- 阻塞：
-  - 当前开发收口阶段无新增阻塞
- 缓解措施：
-  - 优先收敛到标准接入面（JMX / Spring Actuator / Java Agent 三选一）
-  - 首期只支持白名单对象类型与受控写操作
-  - 要求变更审计、预览、确认与失败回滚路径
-  - 在交付说明中明确“AI 只生成草稿，不直接执行 JVM 写入”
-  - JMX helper 改为内嵌 runtime jar，默认写入用户缓存目录；必要时允许通过 `GONAVI_JMX_HELPER_CLASSPATH` 覆盖 classpath
-  - 对复杂参数调用保持白名单和人工确认，不开放脚本式自由执行
-
-## 6. 决策记录
- 决策 1：先做可行性评估与方案设计，不直接进入实现
- 决策 2：默认优先复用 GoNavi 现有 driver-agent 与前端编辑器能力，避免侵入式重构主流程
- 决策 3：已按完整模式推进，后续方案将优先评估通用 Agent 路径是否成立
- 决策 4：由于目标服务大概率不允许 agent/attach，后续推荐方向转为“多接入模式 + 能力协商”
- 决策 5：AI 在 JVM 场景中只负责分析与生成结构化计划，不直接执行运行时写入
- 决策 6：AI 计划应用入口只回填 JVM 预览草稿，后续仍必须经过 `JVMPreviewChange`、Guard 校验和人工确认
- 决策 7：当前 MVP 中 `updateValue` 会映射到现有 JVM 变更 contract 的 `put`，且 payload 仅接受 JSON 对象
- 决策 8：JVM AI 计划必须绑定生成时的 JVM 上下文，只允许投递到匹配的 `tabId + connectionId + providerMode + resourcePath`
- 决策 9：JMX helper 采用 Java 8 兼容的预编译 runtime jar 内嵌分发，运行时只依赖本地 `java`
- 决策 10：Agent 模式按“预埋 GoNavi Java Agent + 独立 Agent Base URL 接入”落地，不在当前版本实现动态 attach
-
-## 7. 验证记录
- 验证项：
-  - GoNavi 驱动代理机制核查
-  - GoNavi 现有 Redis/编辑器/UI 复用能力核查
-  - JVM Connector 正式设计文档自检
-  - JVM Connector 实施计划文档自检
-  - Task 1：JVM 共享契约与配置归一化
-  - Task 2：Provider 注册、连接测试与能力探测 API
-  - Task 6：AI 计划解析、资源定位解析、契约映射与页签上下文隔离
-  - Task 7：Java Endpoint fixture 真实集成验证
-  - Task 7：JMX helper 内嵌分发与运行时缓存验证
-  - Task 7：Agent provider 与真实 Java Agent 集成验证
-  - Task 7：后端全量测试
-  - Task 7：前端全量测试
-  - Task 7：前端生产构建
-  - Task 7：Wails 生产构建
- 结果：
-  - 已确认存在可复用的连接桥接与编辑器基础设施
-  - 已完成正式设计文档落盘与自检，未发现占位词和明显范围冲突
-  - 已完成正式实施计划落盘与自检，已补齐共享 DTO、provider factory 和审计落盘等关键实现细节
-  - 已完成 JVM 连接共享契约、默认只读/默认 JMX 归一化、前端配置收敛与补测
-  - Task 1 已完成规格审查与代码质量审查，结论均通过
-  - 已完成 JVM Provider 工厂、JMX/Endpoint provider 骨架、App 层连接测试与能力探测 API
-  - Task 2 已完成规格审查与代码质量审查，结论均通过
-  - 已完成 JVM 连接类型卡片、最小表单字段、连接测试分发与展示文案接入
-  - Task 3 已完成规格审查与代码质量审查；过程中修复了 JVM 标题文案偏差、模式选项暴露范围、编辑态模式静默降级和 endpoint timeout 失真问题
-  - 已完成 JVM 只读资源浏览链路：后端新增 `JVMListResources` / `JVMGetValue`，前端新增 `jvm-overview` / `jvm-resource` tab 与侧边栏 JVM 模式/资源节点
-  - Task 4 已完成规格复审；代码质量复审确认真实 provider 浏览能力仍为后续任务范围，另外已修正 JVM 资源 tab 同名问题
-  - 已完成 Task 5：后端新增 `JVMPreviewChange` / `JVMApplyChange` / `JVMListAuditRecords`，补齐 Guard、审计 JSONL 落盘与审计读取能力
-  - Task 5 已补齐只读拦截、`prod` 环境确认、provider preview 错误透出、审计写入失败显式回传、连接 `allowedModes` 约束和局部快照合并保底
-  - 前端已完成 JVM 变更草稿区、预览弹窗、执行确认、审计记录页签与按 provider mode 的审计过滤
-  - 已完成 Task 6：AI 计划解析、资源定位解析、`updateValue -> put` 显式映射、JSON 对象 payload 约束和上下文绑定单测
-  - 已完成 Task 6：AI 聊天消息与 JVM 来源页签绑定，AI 气泡应用按钮不再依赖点击时的 `activeTabId`，避免跨 JVM 页签误投递
-  - 已完成 Task 7：Java Endpoint fixture，可真实验证 `resources / value / preview / apply` 四个 endpoint contract
-  - `go test ./internal/jvm -run 'TestHTTPProvider' -count=1` 通过
-  - 已完成 Task 7：JMX helper 改为预编译 jar 内嵌分发，并补齐 classpath 覆盖与缓存落盘单测
-  - `go test ./internal/jvm -run 'TestEnsureJMXHelperRuntime|TestJMXProvider' -count=1` 通过
-  - 已完成 Task 7：Agent provider、Java agent fixture 与真实 `-javaagent` 集成测试
-  - `go test ./internal/jvm -run 'TestAgentProvider' -count=1` 通过
-  - `cd frontend && npm test -- --run src/utils/jvmAiPlan.test.ts` 通过（11 tests）
-  - `go test ./... -count=1` 通过
-  - `cd frontend && npm test -- --run` 通过（61 files，259 tests）
-  - `cd frontend && npm run build` 通过；构建中存在既有 chunk size / dynamic import 警告，但未阻塞产物生成
-  - `wails build -clean` 通过，成功生成 macOS 应用包
-  - 已完成 JVM 收口优化：模式能力探测现在按当前 mode 做业务化错误翻译，避免概览页继续回显 `non-JRMP server`、`baseURL is required` 这类原始报错
-  - `go test ./internal/jvm -run 'TestHTTPProvider' -count=1` 再次通过（Endpoint 能力探测只读语义回归）
-  - `go test ./internal/app -run 'Test(TestJVMConnection|JVMProbeCapabilities)' -count=1` 再次通过（能力探测模式透传与中文错误翻译回归）
-  - `cd frontend && npm test -- --run src/components/JVMResourceBrowser.layout.test.tsx` 通过（JVM 资源页布局回归）
-  - `cd frontend && npm test -- --run src/utils/jvmResourcePresentation.test.ts` 通过（风险等级、审计结果等本地化展示回归）
-  - `cd frontend && npm run build` 再次通过
-  - `wails build -clean` 再次通过，成功生成最新可验收桌面包
- 证据（日志/截图/链接）：
-  - `cmd/optional-driver-agent/main.go`
-  - `internal/db/database.go`
-  - `frontend/src/components/RedisViewer.tsx`
-  - `frontend/src/components/RedisCommandEditor.tsx`
-  - `frontend/src/components/QueryEditor.tsx`
-  - `docs/superpowers/specs/2026-04-22-jvm-cache-visual-editing-design.md`
-  - `docs/superpowers/plans/2026-04-22-jvm-connector-mvp.md`
-  - `internal/connection/types.go`
-  - `internal/jvm/types.go`
-  - `internal/jvm/config.go`
-  - `internal/jvm/config_test.go`
-  - `frontend/src/types.ts`
-  - `frontend/src/utils/jvmConnectionConfig.ts`
-  - `frontend/src/utils/jvmConnectionConfig.test.ts`
-  - `go test ./internal/jvm -count=1`
-  - `go test ./...`
-  - `cd frontend && npm test -- src/utils/jvmConnectionConfig.test.ts`
-  - `cd frontend && npm test -- --run`
-  - `cd frontend && npm run build`
-  - `internal/jvm/provider.go`
-  - `internal/jvm/jmx_provider.go`
-  - `internal/jvm/http_provider.go`
-  - `internal/jvm/http_provider_test.go`
-  - `internal/jvm/jmx_helper.go`
-  - `internal/jvm/jmx_helper_test.go`
-  - `internal/jvm/provider_contract_test.go`
-  - `internal/jvm/jmxhelper_assets/jmx-helper-runtime.jar`
-  - `internal/jvm/jmxhelper_assets/README.md`
-  - `internal/jvm/testdata/endpointfixture/src/com/gonavi/fixture/EndpointTestServer.java`
-  - `internal/jvm/testdata/endpointfixture/src/com/gonavi/fixture/MiniJson.java`
-  - `tools/jmx-helper/src/com/gonavi/jmxhelper/JmxHelperMain.java`
-  - `internal/app/methods_jvm.go`
-  - `internal/app/methods_jvm_test.go`
-  - `frontend/wailsjs/go/app/App.d.ts`
-  - `frontend/wailsjs/go/app/App.js`
-  - `frontend/wailsjs/go/models.ts`
-  - `go test ./internal/app -run 'Test(TestJVMConnection|JVMProbeCapabilities)' -count=1`
-  - `go test ./internal/jvm ./internal/app -count=1`
-  - `wails build -clean`
-  - `frontend/src/components/DatabaseIcons.tsx`
-  - `frontend/src/components/ConnectionModal.tsx`
-  - `frontend/src/utils/jvmRuntimePresentation.ts`
-  - `frontend/src/utils/jvmRuntimePresentation.test.ts`
-  - `frontend/src/utils/jvmConnectionConfig.ts`
-  - `frontend/src/utils/jvmConnectionConfig.test.ts`
-  - `cd frontend && npm test -- src/utils/jvmRuntimePresentation.test.ts`
-  - `cd frontend && npm test -- src/utils/jvmConnectionConfig.test.ts`
-  - `cd frontend && npm run build`
-  - `internal/app/methods_jvm.go`
-  - `internal/app/methods_jvm_test.go`
-  - `frontend/src/components/Sidebar.tsx`
-  - `frontend/src/components/TabManager.tsx`
-  - `frontend/src/components/JVMOverview.tsx`
-  - `frontend/src/components/JVMResourceBrowser.tsx`
-  - `frontend/src/components/jvm/JVMModeBadge.tsx`
-  - `frontend/src/store.ts`
-  - `frontend/src/types.ts`
-  - `go test ./internal/app -run 'TestJVM(ListResources|GetValue)' -count=1`
-  - `go test ./internal/app -run 'TestJVMProbeCapabilities|TestTestJVMConnection' -count=1`
-  - `cd frontend && npm test -- src/utils/jvmRuntimePresentation.test.ts`
-  - `cd frontend && npm run build`
-  - `internal/jvm/guard.go`
-  - `internal/jvm/guard_test.go`
-  - `internal/jvm/audit_store.go`
-  - `internal/jvm/audit_store_test.go`
-  - `internal/app/methods_jvm.go`
-  - `internal/app/methods_jvm_test.go`
-  - `frontend/src/components/JVMAuditViewer.tsx`
-  - `frontend/src/components/jvm/JVMChangePreviewModal.tsx`
-  - `go test ./internal/jvm ./internal/app -run 'TestPreviewChangeBlocksReadOnlyConnection|TestPreviewChangeReturnsProviderPreviewErrorWhenWriteAllowed|TestPreviewChangeMarksProdWritesAsConfirmationRequired|TestPreviewChangeMergesProviderSnapshotsWithoutDroppingDefaults|TestJVMApplyChangeReturnsProviderPayload|TestJVMPreviewChangeRejectsModeOutsideAllowedModes|TestJVMListAuditRecordsReturnsLatestRecords|TestJVMApplyChangeSurfacesAuditWriteFailure' -count=1`
-  - `go test ./internal/jvm ./internal/app -count=1`
-  - `cd frontend && npm run build`
-  - `frontend/src/utils/jvmAiPlan.ts`
-  - `frontend/src/utils/jvmAiPlan.test.ts`
-  - `frontend/src/components/AIChatPanel.tsx`
-  - `frontend/src/components/ai/AIMessageBubble.tsx`
-  - `frontend/src/components/JVMResourceBrowser.tsx`
-  - `frontend/src/types.ts`
-  - `cd frontend && npm test -- --run src/utils/jvmAiPlan.test.ts`
-  - `go test ./... -count=1`
-  - `go test ./internal/jvm -run 'TestHTTPProvider' -count=1`
-  - `go test ./internal/jvm -run 'TestEnsureJMXHelperRuntime|TestJMXProvider' -count=1`
-  - `cd frontend && npm test -- --run src/components/JVMResourceBrowser.layout.test.tsx`
-  - `cd frontend && npm test -- --run src/utils/jvmResourcePresentation.test.ts`
-  - `cd frontend && npm test -- --run`
-  - `wails build -clean`
-
-## 8. 下一步
- 下一步行动：由用户按真实 JVM / endpoint 场景执行验收验证；若验收通过，再决定是否提交、推送或继续扩展高级类型写入
- 负责人：Codex
--- a/docs/需求追踪/需求进度追踪-Oracle对象跳转与存储过程修改执行-20260625.md
+++ b/docs/需求追踪/需求进度追踪-Oracle对象跳转与存储过程修改执行-20260625.md
@@ -0,0 +1,45 @@
+# 需求进度追踪 - Oracle对象跳转与存储过程修改执行
+
+## 1. 需求摘要
+- 需求名称：Oracle对象跳转与存储过程修改执行
+- 提出日期：2026-06-25
+- 负责人：Codex
+- 目标：SQL编辑器支持 Oracle 序列、存储包 Ctrl/Cmd 点击跳转；对象编辑执行 Oracle 存储过程时不再生成非法第二条语句。
+- 非目标：不调整 Oracle 连接驱动、不改数据库 schema、不重构侧栏对象树。
+
+## 2. 范围与验收
+- 范围：QueryEditor 对象元数据、hover/跳转逻辑、DefinitionViewer 对象编辑 SQL 生成、相关 i18n 和回归测试。
+- 验收标准：序列/存储包在 SQL 编辑器可出现链接提示并打开定义页；带 SQLPlus `/` 的 Oracle PL/SQL 编辑 SQL 不生成 `/;`，执行时保留完整定义交给后端拆分。
+- 依赖与约束：复用现有侧栏 sequence/package tab 类型；不混入 `frontend/wailsjs/go/models.ts` 既有未提交改动。
+
+## 3. 里程碑与进度
+- [x] 阶段 1（需求澄清）：确认序列/存储包侧栏已可打开，但 SQL 编辑器跳转缺失；存储过程修改仍报 ORA-00900。
+- [x] 阶段 2（影响分析）：影响前端 QueryEditor、DefinitionViewer、i18n、测试；后端拆分已有基础保护。
+- [x] 阶段 3（方案设计）：补齐元数据与跳转类型；对象编辑 SQL 保留 SQLPlus `/` 语义。
+- [x] 阶段 4（实施计划）：先补导航闭环，再修 PL/SQL 生成/执行，最后跑定向测试。
+- [x] 阶段 5（实现与自检）：已完成定向测试、QueryEditor 全文件测试、前端 build、后端 Oracle 拆分测试。
+- [ ] 阶段 6（评审与交付）：待提交推送。
+- [ ] 阶段 7（发布与观察）：发布后验证 Oracle 对象编辑与 SQL 编辑器跳转。
+
+## 4. 变更清单
+- 已完成：补齐 QueryEditor sequence/package 元数据、hover、点击打开定义页；修复对象编辑 SQLPlus `/;`；执行路径兼容旧编辑页 `/;`。
+- 进行中：提交并推送。
+- 待处理：发布后验证 Oracle 实库。
+
+## 5. 风险与阻塞
+- 风险：三段名称 `schema.package.proc` 与 `db.schema.table` 存在歧义。
+- 阻塞：无。
+- 缓解措施：仅当第一段不是可见数据库时，将三段名称按 Oracle schema-qualified sequence/package 解析。
+
+## 6. 决策记录
+- 决策 1：序列和存储包复用侧栏现有 `sequence-def` / `package-def` tab 结构。
+- 决策 2：Oracle PL/SQL 定义执行时保留 SQLPlus `/` 分隔符，由后端拆分器去掉 delimiter，避免前端用分号重组造成 ORA-00900。
+
+## 7. 验证记录
+- 验证项：QueryEditor 导航回归测试、DefinitionViewer 对象编辑测试、SQL 语句拆分测试、i18n catalog 测试、前端 build、后端 Oracle 拆分测试。
+- 结果：通过。
+- 证据（日志/截图/链接）：`npm test -- src/components/QueryEditor.external-sql-save.test.tsx`；`npm test -- src/components/DefinitionViewer.object-edit.test.tsx src/i18n/catalog.test.ts src/utils/sqlStatementSelection.test.ts`；`go test ./internal/app -run 'TestDBQueryMultiKeepsOracle|TestDBQueryMultiSkipsOracle'`；`npm run build`。
+
+## 8. 下一步
+- 下一步行动：提交并推送到 dev。
+- 负责人：Codex
--- a/docs/需求追踪/需求进度追踪-SQL方言适配-20260426.md
+++ b/docs/需求追踪/需求进度追踪-SQL方言适配-20260426.md
@@ -1,24 +0,0 @@
-# SQL 方言适配需求进度追踪
-
-## 背景
-
- Oracle 等非 MySQL 数据源在表设计 DDL 预览中可能回落到 MySQL 语法，导致修改字段名、字段属性等操作执行失败。
- GitHub 相关问题：Refs #402（金仓字段类型/DDL 方言）、Refs #409（Oracle 删除数据 DATE 字面量）。
-
-## 范围
-
- 表设计 ALTER TABLE 预览：按 MySQL-family、PostgreSQL-family、Oracle/Dameng、SQL Server、SQLite、DuckDB、ClickHouse、TDengine 分支生成。
- 新建表 DDL 预览：避免 Oracle/Dameng/SQL Server/SQLite/DuckDB/ClickHouse/TDengine 输出 MySQL 表选项。
- SQL 自动补全：按当前连接方言解析关键字和函数，避免 Oracle/SQL Server 出现 MySQL-only 提示。
- 表设计字段类型：按数据源给出候选类型，不再大量回退到 MySQL 通用类型。
- Oracle/Dameng 数据复制/删除 SQL：DATE/TIMESTAMP 字段使用 Oracle 时间构造函数。
-
-## 验证
-
- `npm test -- tableDesignerSchemaSql.test.ts sqlDialect.test.ts dataGridCopyInsert.test.ts`
- `npm run build`
-
-## 风险与后续
-
- ClickHouse/TDengine 的字段约束、默认值、备注语法差异较大，当前策略是生成有限原生 ALTER，并用中文注释阻止 MySQL 专属子句外溢。
- SQL Server 删除旧主键约束需要真实约束名，当前预览会提示先在索引页确认。
--- a/docs/需求追踪/需求进度追踪-发布脚本测试版号与Mac打包无交互-20260424.md
+++ b/docs/需求追踪/需求进度追踪-发布脚本测试版号与Mac打包无交互-20260424.md
@@ -1,71 +0,0 @@
-# 需求进度追踪 - 发布脚本测试版号与 Mac 打包无交互
-
-## 1. 需求摘要
- 需求名称：发布脚本测试版号与 Mac 打包无交互
- 提出日期：2026-04-24
- 负责人：Codex
- 目标：
-  - `build-release.sh` 不再触发 macOS DMG/Finder 排版交互。
-  - `build-release.sh` 与开发态应用内版本号统一使用测试版号来源。
- 非目标：
-  - 不调整 GitHub Release 工作流。
-  - 不修改正式发布 tag 版本策略。
-
-## 2. 范围与验收
- 范围：
-  - 发布脚本 `build-release.sh`
-  - 版本解析逻辑 `internal/app/version.go`
-  - 共享测试版号文件
- 验收标准：
-  - `bash build-release.sh` 的 macOS 打包不再调用 `create-dmg` 或触发 Finder 排版。
-  - 本地开发态版本显示与发布脚本默认版本号一致。
-  - 保留环境变量覆盖版本号能力。
- 依赖与约束：
-  - 维持现有 Windows/Linux 构建逻辑不变。
-
-## 3. 里程碑与进度
- [x] 阶段 1（需求澄清）：确认去掉 DMG 排版，统一测试版号来源
- [x] 阶段 2（影响分析）：锁定 `build-release.sh` 与 `internal/app/version.go`
- [x] 阶段 3（方案设计）：共享 `version/dev-version.txt`，macOS 改 ZIP 打包
- [x] 阶段 4（实施计划）：先补版本回归测试，再改实现
- [ ] 阶段 5（实现与自检）：
- [ ] 阶段 6（评审与交付）：
- [ ] 阶段 7（发布与观察）：
-
-## 4. 变更清单
- 已完成：
-  - 新增共享测试版号文件。
-  - 新增版本回归测试。
-  - 改造发布脚本 macOS 打包为无交互 ZIP。
- 进行中：
-  - 自检验证。
- 待处理：
-  - 无。
-
-## 5. 风险与阻塞
- 风险：
-  - 正式发版若未覆盖 `GONAVI_VERSION`，默认会使用测试版号。
- 阻塞：
-  - 无。
- 缓解措施：
-  - 允许通过 `GONAVI_VERSION` 环境变量显式覆盖。
-
-## 6. 决策记录
- 决策 1：以 `version/dev-version.txt` 作为本地开发/测试共享版本号来源。
- 决策 2：发布脚本的 macOS 产物改为 ZIP，避免 `create-dmg` 的 Finder 交互。
-
-## 7. 验证记录
- 验证项：
-  - 版本回归测试
-  - 发布脚本语法检查
-  - 发布脚本运行输出
- 结果：
-  - 进行中
- 证据（日志/截图/链接）：
-  - 待补充
-
-## 8. 下一步
- 下一步行动：
-  - 跑通回归测试和脚本验证，确认输出产物与版本号
- 负责人：
-  - Codex
--- a/docs/需求追踪/需求进度追踪-生产连接只读保护-20260623.md
+++ b/docs/需求追踪/需求进度追踪-生产连接只读保护-20260623.md
@@ -0,0 +1,74 @@
+# 需求进度追踪 - 生产连接只读保护
+
+## 1. 需求摘要
+- 需求名称：生产连接只读保护
+- 提出日期：2026-06-23
+- 负责人：Codex
+- 目标：为 SQL 类数据库与 MongoDB 连接增加连接级只读保护，启用后仅允许查询，阻止写入、DDL、导入和同步目标操作
+- 非目标：不为所有侧栏写操作都新增前端隐藏逻辑；不引入新的环境分级体系；不改造 JVM 只读能力
+
+## 2. 范围与验收
+- 范围：
+- 连接配置模型、保存/回填与 RPC 序列化链路
+- 连接弹窗只读开关、查询编辑器本地拦截、DataGrid 导入入口收口
+- 后端 SQL/Mongo 查询判定与写操作统一守卫
+- 验收标准：
+- 支持的数据源出现“生产连接/只允许查询”开关
+- 启用后普通查询仍可执行，非查询 SQL / Mongo 写命令被前后端阻止
+- 导入、结构变更、清表、同步目标等关键写入口被后端拒绝
+- 依赖与约束：
+- 保持现有数据源能力判定与 QueryEditor 执行链路
+- MongoDB 前端判定以保守拦截为主，最终正确性由后端守卫兜底
+
+## 3. 里程碑与进度
+- [x] 阶段 1（需求澄清）：确认采用连接级 `readOnly` 布尔字段，不新建环境系统
+- [x] 阶段 2（影响分析）：梳理前端能力面板、查询执行、导入与后端写入口
+- [x] 阶段 3（方案设计）：确定“前端预拦截 + 后端最终守卫”双层保护
+- [x] 阶段 4（实施计划）：接入配置链路、能力判定、查询判定与写入口守卫
+- [x] 阶段 5（实现与自检）：补文案、测试与定向验证
+- [x] 阶段 6（评审与交付）：确认范围、风险、回滚点和验证命令
+- [ ] 阶段 7（发布与观察）：待体验验证
+
+## 4. 变更清单
+- 已完成：
+- 新增连接级 `readOnly` 配置字段及前后端序列化支持
+- 连接弹窗为 SQL 类数据库与 MongoDB 增加生产连接保护开关
+- QueryEditor 增加本地非查询拦截，DataGrid 导入入口在只读连接下禁用
+- 后端为查询、DDL、导入、清表、同步等写入口增加统一只读守卫
+- MongoDB 查询判定改为命令级白名单，不再把所有 JSON 命令都视为只读
+- 补充前端/后端定向测试与需求追踪文档
+- 进行中：
+- 等待体验包验证连接弹窗、查询拦截和写操作拒绝文案
+- 待处理：
+- 如需进一步优化体验，再补侧栏对象级写菜单的前端隐藏/禁用
+
+## 5. 风险与阻塞
+- 风险：
+- 前端 SQL/Mongo 只读判定是保守策略，边界命令可能仍需后端兜底
+- 现有部分侧栏写菜单仍可能显示，但执行时会被后端拒绝
+- 阻塞：
+- 暂无
+- 缓解措施：
+- 关键写入口统一走后端守卫；前端只负责提前反馈与减少误操作
+
+## 6. 决策记录
+- 决策 1：只对 SQL 类数据库和 MongoDB 支持连接级生产保护，其他数据源忽略 `readOnly`
+- 决策 2：采用顶层 `readOnly` 布尔字段，避免新增环境枚举和迁移成本
+- 决策 3：MongoDB 只读判定按命令白名单处理，防止把写命令误放行
+
+## 7. 验证记录
+- 验证项：
+- 前端数据源能力判定、RPC 配置、连接配置测试
+- 后端只读连接守卫与 SQL/Mongo 查询判定测试
+- 结果：
+- 通过
+- 证据（日志/截图/链接）：
+- `go test ./internal/app -run 'Test(EnsureReadOnlyConnectionAllows|SupportsConnectionReadOnlyMode|IsReadOnlySQLQuery)'`
+- `npm --prefix frontend test -- src/utils/dataSourceCapabilities.test.ts src/utils/connectionRpcConfig.test.ts src/components/connectionModal/connectionModalConfig.keepalive.test.ts`
+
+## 8. 下一步
+- 下一步行动：
+- 用体验包回归验证生产连接下的查询、导入、建库删库、同步目标和 Mongo 命令拦截
+- 如需更完整 UX，再补侧栏写菜单的只读态收口
+- 负责人：
+- Codex
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -14,15 +14,19 @@
        "@dnd-kit/sortable": "^10.0.0",
        "@dnd-kit/utilities": "^3.2.2",
        "@monaco-editor/react": "^4.6.0",
+        "@types/dagre": "^0.7.54",
        "@types/react-syntax-highlighter": "^15.5.13",
        "antd": "^5.12.0",
        "clsx": "^2.1.0",
+        "dagre": "^0.8.5",
+        "fflate": "^0.8.3",
        "mermaid": "^11.13.0",
        "react": "^18.2.0",
        "react-dom": "^18.2.0",
        "react-markdown": "^10.1.0",
        "react-resizable": "^3.1.3",
        "react-syntax-highlighter": "^16.1.1",
+        "reactflow": "^11.11.4",
        "recharts": "^3.8.1",
        "remark-gfm": "^4.0.1",
        "sql-formatter": "^15.7.0",
@@ -1213,6 +1217,108 @@
        "react-dom": ">=16.9.0"
      }
    },
+    "node_modules/@reactflow/background": {
+      "version": "11.3.14",
+      "resolved": "https://registry.npmmirror.com/@reactflow/background/-/background-11.3.14.tgz",
+      "integrity": "sha512-Gewd7blEVT5Lh6jqrvOgd4G6Qk17eGKQfsDXgyRSqM+CTwDqRldG2LsWN4sNeno6sbqVIC2fZ+rAUBFA9ZEUDA==",
+      "license": "MIT",
+      "dependencies": {
+        "@reactflow/core": "11.11.4",
+        "classcat": "^5.0.3",
+        "zustand": "^4.4.1"
+      },
+      "peerDependencies": {
+        "react": ">=17",
+        "react-dom": ">=17"
+      }
+    },
+    "node_modules/@reactflow/controls": {
+      "version": "11.2.14",
+      "resolved": "https://registry.npmmirror.com/@reactflow/controls/-/controls-11.2.14.tgz",
+      "integrity": "sha512-MiJp5VldFD7FrqaBNIrQ85dxChrG6ivuZ+dcFhPQUwOK3HfYgX2RHdBua+gx+40p5Vw5It3dVNp/my4Z3jF0dw==",
+      "license": "MIT",
+      "dependencies": {
+        "@reactflow/core": "11.11.4",
+        "classcat": "^5.0.3",
+        "zustand": "^4.4.1"
+      },
+      "peerDependencies": {
+        "react": ">=17",
+        "react-dom": ">=17"
+      }
+    },
+    "node_modules/@reactflow/core": {
+      "version": "11.11.4",
+      "resolved": "https://registry.npmmirror.com/@reactflow/core/-/core-11.11.4.tgz",
+      "integrity": "sha512-H4vODklsjAq3AMq6Np4LE12i1I4Ta9PrDHuBR9GmL8uzTt2l2jh4CiQbEMpvMDcp7xi4be0hgXj+Ysodde/i7Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3": "^7.4.0",
+        "@types/d3-drag": "^3.0.1",
+        "@types/d3-selection": "^3.0.3",
+        "@types/d3-zoom": "^3.0.1",
+        "classcat": "^5.0.3",
+        "d3-drag": "^3.0.0",
+        "d3-selection": "^3.0.0",
+        "d3-zoom": "^3.0.0",
+        "zustand": "^4.4.1"
+      },
+      "peerDependencies": {
+        "react": ">=17",
+        "react-dom": ">=17"
+      }
+    },
+    "node_modules/@reactflow/minimap": {
+      "version": "11.7.14",
+      "resolved": "https://registry.npmmirror.com/@reactflow/minimap/-/minimap-11.7.14.tgz",
+      "integrity": "sha512-mpwLKKrEAofgFJdkhwR5UQ1JYWlcAAL/ZU/bctBkuNTT1yqV+y0buoNVImsRehVYhJwffSWeSHaBR5/GJjlCSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@reactflow/core": "11.11.4",
+        "@types/d3-selection": "^3.0.3",
+        "@types/d3-zoom": "^3.0.1",
+        "classcat": "^5.0.3",
+        "d3-selection": "^3.0.0",
+        "d3-zoom": "^3.0.0",
+        "zustand": "^4.4.1"
+      },
+      "peerDependencies": {
+        "react": ">=17",
+        "react-dom": ">=17"
+      }
+    },
+    "node_modules/@reactflow/node-resizer": {
+      "version": "2.2.14",
+      "resolved": "https://registry.npmmirror.com/@reactflow/node-resizer/-/node-resizer-2.2.14.tgz",
+      "integrity": "sha512-fwqnks83jUlYr6OHcdFEedumWKChTHRGw/kbCxj0oqBd+ekfs+SIp4ddyNU0pdx96JIm5iNFS0oNrmEiJbbSaA==",
+      "license": "MIT",
+      "dependencies": {
+        "@reactflow/core": "11.11.4",
+        "classcat": "^5.0.4",
+        "d3-drag": "^3.0.0",
+        "d3-selection": "^3.0.0",
+        "zustand": "^4.4.1"
+      },
+      "peerDependencies": {
+        "react": ">=17",
+        "react-dom": ">=17"
+      }
+    },
+    "node_modules/@reactflow/node-toolbar": {
+      "version": "1.3.14",
+      "resolved": "https://registry.npmmirror.com/@reactflow/node-toolbar/-/node-toolbar-1.3.14.tgz",
+      "integrity": "sha512-rbynXQnH/xFNu4P9H+hVqlEUafDCkEoCy0Dg9mG22Sg+rY/0ck6KkrAQrYrTgXusd+cEJOMK0uOOFCK2/5rSGQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@reactflow/core": "11.11.4",
+        "classcat": "^5.0.3",
+        "zustand": "^4.4.1"
+      },
+      "peerDependencies": {
+        "react": ">=17",
+        "react-dom": ">=17"
+      }
+    },
    "node_modules/@reduxjs/toolkit": {
      "version": "2.11.2",
      "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.11.2.tgz",
@@ -1927,6 +2033,12 @@
        "@types/d3-selection": "*"
      }
    },
+    "node_modules/@types/dagre": {
+      "version": "0.7.54",
+      "resolved": "https://registry.npmmirror.com/@types/dagre/-/dagre-0.7.54.tgz",
+      "integrity": "sha512-QjcRY+adGbYvBFS7cwv5txhVIwX1XXIUswWl+kSQTbI6NjgZydrZkEKX/etzVd7i+bCsCb40Z/xlBY5eoFuvWQ==",
+      "license": "MIT"
+    },
    "node_modules/@types/debug": {
      "version": "4.1.13",
      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
@@ -2508,6 +2620,12 @@
        "chevrotain": "^11.0.0"
      }
    },
+    "node_modules/classcat": {
+      "version": "5.0.5",
+      "resolved": "https://registry.npmmirror.com/classcat/-/classcat-5.0.5.tgz",
+      "integrity": "sha512-JhZUT7JFcQy/EzW605k/ktHtncoo9vnyW/2GspNYwFlN1C/WmjuV/xtS04e9SOkL2sTdw0VAZ2UGCcQ9lR6p6w==",
+      "license": "MIT"
+    },
    "node_modules/classnames": {
      "version": "2.5.1",
      "resolved": "https://registry.npmjs.org/classnames/-/classnames-2.5.1.tgz",
@@ -3080,6 +3198,16 @@
        "node": ">=12"
      }
    },
+    "node_modules/dagre": {
+      "version": "0.8.5",
+      "resolved": "https://registry.npmmirror.com/dagre/-/dagre-0.8.5.tgz",
+      "integrity": "sha512-/aTqmnRta7x7MCCpExk7HQL2O4owCT2h8NT//9I1OQ9vt29Pa0BzSAkR5lwFUcQ7491yVi/3CXU9jQ5o0Mn2Sw==",
+      "license": "MIT",
+      "dependencies": {
+        "graphlib": "^2.1.8",
+        "lodash": "^4.17.15"
+      }
+    },
    "node_modules/dagre-d3-es": {
      "version": "7.0.14",
      "resolved": "https://registry.npmjs.org/dagre-d3-es/-/dagre-d3-es-7.0.14.tgz",
@@ -3347,6 +3475,12 @@
        }
      }
    },
+    "node_modules/fflate": {
+      "version": "0.8.3",
+      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.3.tgz",
+      "integrity": "sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==",
+      "license": "MIT"
+    },
    "node_modules/format": {
      "version": "0.2.2",
      "resolved": "https://registry.npmjs.org/format/-/format-0.2.2.tgz",
@@ -3380,6 +3514,15 @@
        "node": ">=6.9.0"
      }
    },
+    "node_modules/graphlib": {
+      "version": "2.1.8",
+      "resolved": "https://registry.npmmirror.com/graphlib/-/graphlib-2.1.8.tgz",
+      "integrity": "sha512-jcLLfkpoVGmH7/InMC/1hIvOPSUh38oJtGhvrOFGzioE1DZ+0YW16RgmOJhHiuWTvGiJQ9Z1Ik43JvkRPRvE+A==",
+      "license": "MIT",
+      "dependencies": {
+        "lodash": "^4.17.15"
+      }
+    },
    "node_modules/hachure-fill": {
      "version": "0.5.2",
      "resolved": "https://registry.npmjs.org/hachure-fill/-/hachure-fill-0.5.2.tgz",
@@ -3668,6 +3811,12 @@
      "integrity": "sha512-8h2oVEZNktL4BH2JCOI90iD1yXwL6iNW7KcCKT2QZgQJR2vbqDsldCTPRU9NifTCqHZci57XvQQ15YTu+sTYPg==",
      "license": "MIT"
    },
+    "node_modules/lodash": {
+      "version": "4.18.1",
+      "resolved": "https://registry.npmmirror.com/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
+      "license": "MIT"
+    },
    "node_modules/lodash-es": {
      "version": "4.17.23",
      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.23.tgz",
@@ -5706,6 +5855,24 @@
        "react": "^18.2.0"
      }
    },
+    "node_modules/reactflow": {
+      "version": "11.11.4",
+      "resolved": "https://registry.npmmirror.com/reactflow/-/reactflow-11.11.4.tgz",
+      "integrity": "sha512-70FOtJkUWH3BAOsN+LU9lCrKoKbtOPnz2uq0CV2PLdNSwxTXOhCbsZr50GmZ+Rtw3jx8Uv7/vBFtCGixLfd4Og==",
+      "license": "MIT",
+      "dependencies": {
+        "@reactflow/background": "11.3.14",
+        "@reactflow/controls": "11.2.14",
+        "@reactflow/core": "11.11.4",
+        "@reactflow/minimap": "11.7.14",
+        "@reactflow/node-resizer": "2.2.14",
+        "@reactflow/node-toolbar": "1.3.14"
+      },
+      "peerDependencies": {
+        "react": ">=17",
+        "react-dom": ">=17"
+      }
+    },
    "node_modules/recharts": {
      "version": "3.8.1",
      "resolved": "https://registry.npmjs.org/recharts/-/recharts-3.8.1.tgz",
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -7,7 +7,8 @@
    "dev": "vite",
    "build": "tsc && vite build",
    "preview": "vite preview",
-    "test": "vitest run"
+    "test": "vitest run",
+    "i18n:scan": "go run ../tools/i18n-scan --root .."
  },
  "dependencies": {
    "@ant-design/icons": "^5.2.6",
@@ -16,15 +17,19 @@
    "@dnd-kit/sortable": "^10.0.0",
    "@dnd-kit/utilities": "^3.2.2",
    "@monaco-editor/react": "^4.6.0",
+    "@types/dagre": "^0.7.54",
    "@types/react-syntax-highlighter": "^15.5.13",
    "antd": "^5.12.0",
    "clsx": "^2.1.0",
+    "dagre": "^0.8.5",
+    "fflate": "^0.8.3",
    "mermaid": "^11.13.0",
    "react": "^18.2.0",
    "react-dom": "^18.2.0",
    "react-markdown": "^10.1.0",
    "react-resizable": "^3.1.3",
    "react-syntax-highlighter": "^16.1.1",
+    "reactflow": "^11.11.4",
    "recharts": "^3.8.1",
    "remark-gfm": "^4.0.1",
    "sql-formatter": "^15.7.0",
--- a/frontend/package.json.md5
+++ b/frontend/package.json.md5
@@ -1 +1 @@
-d0464f9da25e9356e61652e638c99ffe
+1d8f9adbde8018f90d013cc740e0405b
--- a/frontend/public/db-icons/chroma.svg
+++ b/frontend/public/db-icons/chroma.svg
@@ -0,0 +1 @@
+<svg width="163" height="40" fill="none" xmlns="http://www.w3.org/2000/svg"><mask id="prefix__a" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="0" y="2" width="53" height="36"><path d="M52.503 2.501H.003v35h52.5v-35z" fill="#fff"/></mask><g mask="url(#prefix__a)"><path d="M17.503 2.501c-9.665 0-17.5 7.835-17.5 17.5s7.835 17.5 17.5 17.5 17.5-7.835 17.5-17.5-7.835-17.5-17.5-17.5z" fill="#327EFF"/><path d="M35.003 2.501c-9.665 0-17.5 7.835-17.5 17.5s7.835 17.5 17.5 17.5 17.5-7.834 17.5-17.5c0-9.665-7.835-17.5-17.5-17.5z" fill="#FFDE2D"/><path d="M17.503 20.002c0-9.665 7.835-17.5 17.5-17.5v17.5h-17.5z" fill="#FF6446"/><path d="M35.003 20.001c0 9.665-7.835 17.5-17.5 17.5v-17.5h17.5z" fill="#FF6446"/></g><path d="M68.543 30.45c-6.03 0-10.32-4.65-10.32-11.1 0-6.36 3.96-11.22 10.29-11.22 5.28 0 8.4 3.15 8.85 7.23h-4.32c-.39-2.16-2.01-3.57-4.53-3.57-3.96 0-5.85 3.3-5.85 7.56 0 4.38 2.28 7.53 5.88 7.53 2.55 0 4.35-1.53 4.62-3.78h4.26a7.596 7.596 0 01-2.37 5.07c-1.47 1.38-3.54 2.28-6.51 2.28zM83.41 8.55v8.07h.09c1.11-1.62 2.37-2.43 4.47-2.43 3.18 0 5.31 2.4 5.31 5.76V30H89.2v-9.45c0-1.65-.96-2.82-2.67-2.82-1.8 0-3.12 1.44-3.12 3.54V30h-4.08V8.55h4.08zm16.315 6.06v2.46h.09c.93-1.74 1.98-2.64 3.78-2.64.45 0 .72.03.96.12v3.57h-.09c-2.67-.27-4.59 1.14-4.59 4.38V30h-4.08V14.61h3.93zm13.438 15.84c-4.77 0-8.04-3.54-8.04-8.13 0-4.59 3.27-8.13 8.04-8.13s8.04 3.54 8.04 8.13c0 4.59-3.27 8.13-8.04 8.13zm0-3.12c2.49 0 3.9-2.01 3.9-5.01s-1.41-5.04-3.9-5.04c-2.52 0-3.9 2.04-3.9 5.04s1.38 5.01 3.9 5.01zM123.1 30V14.61h3.93v2.07h.09c.84-1.41 2.34-2.49 4.47-2.49 1.95 0 3.51 1.08 4.26 2.7h.06c1.05-1.68 2.67-2.7 4.62-2.7 3.24 0 5.07 2.1 5.07 5.46V30h-4.08v-9.66c0-1.74-.87-2.64-2.37-2.64-1.71 0-2.76 1.32-2.76 3.36V30h-4.08v-9.66c0-1.74-.87-2.64-2.37-2.64-1.65 0-2.76 1.32-2.76 3.36V30h-4.08zm34.71 0c-.24-.3-.39-1.02-.48-1.71h-.06c-.78 1.17-1.89 2.07-4.53 2.07-3.15 0-5.37-1.65-5.37-4.71 0-3.39 2.76-4.47 6.18-4.95 2.55-.36 3.72-.57 3.72-1.74 0-1.11-.87-1.83-2.58-1.83-1.92 0-2.85.69-2.97 2.16h-3.63c.12-2.7 2.13-5.07 6.629-5.07 4.621 0 6.481 2.07 6.481 5.67v7.83c0 1.17.18 1.86.54 2.13V30h-3.93zm-4.08-2.49c2.34 0 3.63-1.44 3.63-2.94v-2.31c-.72.42-1.83.66-2.851.9-2.129.48-3.179.96-3.179 2.4s.96 1.95 2.4 1.95z" fill="#000"/></svg>
--- a/frontend/public/db-icons/dameng.png
+++ b/frontend/public/db-icons/dameng.png
--- a/frontend/public/db-icons/elasticsearch.svg
+++ b/frontend/public/db-icons/elasticsearch.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="-15 0 286 286" width="800px" height="800px" preserveAspectRatio="xMidYMid">
+  <g>
+    <path d="M14.3443,80.1733 L203.5503,80.1733 C224.4013,80.1733 243.0203,70.6123 255.5133,55.6863 C229.4533,21.8353 188.5523,0.0003 142.5303,0.0003 C86.1783,0.0003 37.4763,32.7113 14.3443,80.1733" fill="#F0BF1A"/>
+    <path d="M187.5152,102.4438 L5.7552,102.4438 C2.0332,115.1648 0.0002,128.6068 0.0002,142.5298 C0.0002,156.4538 2.0332,169.8968 5.7552,182.6168 L187.5152,182.6168 C209.3402,182.6168 227.6022,164.8008 227.6022,142.5298 C227.6022,120.2598 209.7862,102.4438 187.5152,102.4438" fill="#07A5DE"/>
+    <path d="M255.9996,228.7548 C243.5856,214.1638 225.1166,204.8868 204.4406,204.8868 L14.3446,204.8868 C37.4766,252.3498 86.1786,285.0598 142.5296,285.0598 C188.8356,285.0598 229.9656,262.9628 255.9996,228.7548" fill="#3EBEB0"/>
+    <path d="M5.7555,102.4438 C2.0325,115.1648 0.0005,128.6068 0.0005,142.5298 C0.0005,156.4538 2.0325,169.8968 5.7555,182.6168 L124.7135,182.6168 C127.8315,170.5908 129.6125,157.2288 129.6125,142.5298 C129.6125,127.8318 127.8315,114.4698 124.7135,102.4438 L5.7555,102.4438 Z" fill="#231F20"/>
+    <path d="M70.8199,19.1528 C46.7669,33.4058 26.7239,54.7848 14.2529,80.1738 L119.3689,80.1738 C108.6789,55.6758 91.7539,35.1878 70.8199,19.1528" fill="#D7A229"/>
+    <path d="M75.274,268.1347 C95.762,251.6547 112.242,229.8297 122.487,204.8867 L14.253,204.8867 C27.615,231.6117 48.995,253.8817 75.274,268.1347" fill="#019B8F"/>
+  </g>
+</svg>
--- a/frontend/public/db-icons/gaussdb.ico
+++ b/frontend/public/db-icons/gaussdb.ico
--- a/frontend/public/db-icons/goldendb.ico
+++ b/frontend/public/db-icons/goldendb.ico
--- a/frontend/public/db-icons/highgo.ico
+++ b/frontend/public/db-icons/highgo.ico
--- a/frontend/public/db-icons/iotdb.svg
+++ b/frontend/public/db-icons/iotdb.svg
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 24.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1"
+	 id="Õ_xBA__x2264__x201E__1" xmlns:cc="http://creativecommons.org/ns#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:svg="http://www.w3.org/2000/svg"
+	 xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 107.7 107.7"
+	 style="enable-background:new 0 0 107.7 107.7;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill-rule:evenodd;clip-rule:evenodd;fill:#9E2878;}
+</style>
+<g>
+	<g id="g1133" transform="translate(-244.51235,-228.78793)">
+		<path id="path1119" class="st0" d="M340.8,253.8c2.6-1,5.5,0.4,6.2,3c0.7,2.6-1.1,5.7-3.7,6.4c-3.2,0.6-6.2-1.4-9.3,0.2
+			c-3.1,1.7-4,5.2-4.7,8.3c-1.4,5-8.5,7.3-12.1,4.2c-3.3-2.4-3.4-7.8-0.2-11c2.2-2.5,5.9-3.3,8.8-2c2.7,1.2,6,1.7,8.6-0.4
+			C337.5,260.1,336.7,255.1,340.8,253.8L340.8,253.8z"/>
+		<path id="path1121" class="st0" d="M280.5,244.7c4.2-2.2,9.5,1.5,8.2,6.1c-1.4,5.4-0.7,11.5,2.9,15.5c3.4,4,9.8,4.8,14.6,1.9
+			c3.7-2.1,6-5.8,7.4-9.6c1-3.1,0.6-6.2,1.1-9.3c1-3.8,5.8-6,9.1-4.2c3.2,1.4,4,5.9,1.7,8.8c-1.4,2.2-4.2,2.7-6.3,3.8
+			c-3.6,1.9-6.5,4.9-8.4,8.6c-1.2,2.1-1.1,4.5-1.7,6.7c-0.9,1.9-3,2.7-4.8,2.9c-4.8,0.6-9.5,3-13,6.7c-1.7,1.7-3.1,4.2-5.6,4.2
+			c-2.7-0.2-4.7-2.6-7.4-2.7c-4.9-0.7-10.2,0.7-14.4,4c-3.7,3.1-9.4,0.8-9.6-3.7c-0.9-5.1,6.2-9.5,10.1-6.2c4.3,4,10.8,5.6,16.9,3.7
+			c5.6-1.9,9.7-8.3,8.6-14c-0.9-4.9-4.2-9.3-8.6-11.4c-1.7-0.8-3.6-1.6-4.2-3.5C275.6,250.2,277.3,246.2,280.5,244.7L280.5,244.7z"
+			/>
+		<path id="path1123" class="st0" d="M277.8,235.9c2.2-0.8,4.2,1.3,3.3,3.4c-0.6,2.1-3.7,2.7-4.8,1.1
+			C275,238.9,276,236.4,277.8,235.9z"/>
+		<path id="path1125" class="st0" d="M246.9,278.8c2.2-0.8,4.2,1.2,3.3,3.4c-0.6,2.1-3.7,2.7-4.8,1C244,281.9,245,279.3,246.9,278.8
+			L246.9,278.8z"/>
+		<path id="path1127" class="st0" d="M328.2,236.2c2.2-0.7,4.2,1.3,3.3,3.5c-0.6,2-3.7,2.7-4.8,1
+			C325.4,239.2,326.3,236.8,328.2,236.2z"/>
+		<path id="path1129" class="st0" d="M253.6,257.7c0.4-3.7,5.5-5.9,8.1-3.6c1.9,1.1,1.6,3.6,2.2,5.4c0.4,2.4,2.7,4.3,5.2,4.3
+			c3.2,0.3,6.4-2.3,9.5-1.2c4.8,1.2,6.5,7.5,3.2,11.5c-2.9,4.1-9.3,4.5-12,0.7c-2.4-2.8-0.5-7.1-2.7-10.1c-1.7-2.9-5.4-2.7-8.3-1.9
+			C255.8,263.8,253,260.7,253.6,257.7L253.6,257.7z"/>
+		<path id="path1131" class="st0" d="M300.8,230c3.3-1.9,7.5,0.9,6.7,4.6c0,2.3-2.2,3.6-3.5,5.2c-1.9,1.9-2.3,4.9-1.2,7
+			c1.3,2.9,4.9,4,5.5,7.2c1.2,4.8-3.3,10.1-8.2,9.8c-4.8,0.1-8.3-5-6.3-9.5c1.2-3.8,5.8-4.9,7.2-8.5c1.7-3.2-0.4-6.1-2.4-8.1
+			C296.7,235.6,297.9,231.4,300.8,230z"/>
+	</g>
+	<g id="g1149" transform="translate(-244.51235,-228.78793)">
+		<path id="path1135" class="st0" d="M256,311.5c-2.6,1-5.5-0.4-6.2-3c-0.7-2.6,1.1-5.7,3.7-6.4c3.2-0.6,6.2,1.4,9.3-0.2
+			c3.1-1.6,4-5.1,4.7-8.2c1.4-5,8.5-7.3,12.1-4.2c3.3,2.4,3.4,7.8,0.2,10.9c-2.2,2.5-5.9,3.3-8.8,2c-2.7-1.2-6-1.7-8.6,0.4
+			C259.1,305,259.9,310.2,256,311.5L256,311.5z"/>
+		<path id="path1137" class="st0" d="M316.1,320.5c-4.2,2.2-9.5-1.5-8.2-6c1.4-5.4,0.7-11.6-2.9-15.6c-3.4-4-9.8-4.7-14.6-1.9
+			c-3.7,2-6,5.7-7.4,9.5c-1,3.1-0.6,6.2-1.1,9.3c-1,3.8-5.8,6-9.1,4.3c-3.2-1.4-4-5.9-1.7-8.9c1.4-2.2,4.2-2.7,6.3-3.8
+			c3.6-1.9,6.5-4.9,8.4-8.6c1.2-2,1.1-4.5,1.7-6.6c0.9-1.9,3-2.7,4.8-2.9c4.8-0.6,9.5-3,13-6.7c1.7-1.6,3.1-4.2,5.6-4.1
+			c2.7,0.1,4.7,2.5,7.4,2.7c4.9,0.6,10.2-0.8,14.4-4c3.7-3.2,9.4-0.9,9.6,3.6c0.9,5.1-6.2,9.5-10.1,6.2c-4.3-4-10.8-5.6-16.9-3.7
+			c-5.6,1.9-9.7,8.3-8.6,14c0.9,4.8,4.2,9.3,8.6,11.3c1.7,0.8,3.6,1.6,4.2,3.5C321.2,314.9,319.4,319.1,316.1,320.5L316.1,320.5z"/>
+		<path id="path1139" class="st0" d="M318.9,329.4c-2.2,0.8-4.2-1.3-3.3-3.4c0.6-2.1,3.7-2.7,4.8-1.1
+			C321.7,326.3,320.7,328.8,318.9,329.4z"/>
+		<path id="path1141" class="st0" d="M349.9,286.5c-2.2,0.7-4.2-1.3-3.3-3.5c0.6-2.1,3.7-2.7,4.8-1
+			C352.8,283.5,351.8,285.9,349.9,286.5z"/>
+		<path id="path1143" class="st0" d="M268.5,329c-2.2,0.7-4.2-1.3-3.3-3.5c0.6-2,3.7-2.7,4.8-1C271.3,325.9,270.3,328.5,268.5,329z"
+			/>
+		<path id="path1145" class="st0" d="M343.1,307.4c-0.4,3.7-5.5,5.9-8.1,3.6c-1.9-1.1-1.6-3.6-2.2-5.4c-0.4-2.4-2.7-4.3-5.2-4.3
+			c-3.2-0.3-6.4,2.3-9.5,1.2c-4.8-1.2-6.5-7.5-3.2-11.5c2.9-4.1,9.3-4.5,12-0.7c2.4,2.8,0.5,7,2.7,10c1.7,2.9,5.4,2.7,8.3,1.9
+			C341,301.4,343.8,304.4,343.1,307.4L343.1,307.4z"/>
+		<path id="path1147" class="st0" d="M295.8,335.2c-3.3,2-7.5-0.9-6.7-4.6c0-2.3,2.2-3.6,3.5-5.2c1.9-1.9,2.3-4.9,1.2-7
+			c-1.3-2.9-4.9-4-5.5-7.2c-1.2-4.8,3.3-10.1,8.2-9.8c4.8-0.1,8.3,5,6.3,9.6c-1.2,3.7-5.8,4.8-7.2,8.4c-1.7,3.2,0.4,6.1,2.4,8.2
+			C300,329.6,298.8,333.8,295.8,335.2L295.8,335.2z"/>
+	</g>
+</g>
+</svg>
--- a/frontend/public/db-icons/iris.png
+++ b/frontend/public/db-icons/iris.png
--- a/frontend/public/db-icons/jvm.ico
+++ b/frontend/public/db-icons/jvm.ico
--- a/frontend/public/db-icons/kafka.png
+++ b/frontend/public/db-icons/kafka.png
--- a/frontend/public/db-icons/kingbase.ico
+++ b/frontend/public/db-icons/kingbase.ico
--- a/frontend/public/db-icons/mqtt.svg
+++ b/frontend/public/db-icons/mqtt.svg
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 24.2.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.2" baseProfile="tiny" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px"
+	 y="0px" viewBox="0 0 1100 300" overflow="visible" xml:space="preserve">
+<g id="black_bg" display="none">
+	<rect x="-2384.9" y="-306.8" display="inline" width="4531.8" height="1152"/>
+</g>
+<g id="logos">
+	<g>
+		<path fill="#FFFFFF" d="M388,150.1c1.7,3.7,3.3,7.5,4.8,11.4c1.5-4,3.1-7.8,4.9-11.6c1.7-3.7,3.5-7.4,5.3-10.9l50.5-99.5
+			c0.9-1.7,1.8-3,2.8-4c0.9-0.9,2-1.6,3.2-2.1c1.2-0.5,2.5-0.7,4-0.7c1.5,0,3.2,0,5.2,0h34.8v196.6h-40.2V116.3
+			c0-5.5,0.3-11.4,0.8-17.8l-52.1,101.1c-1.6,3.2-3.8,5.5-6.5,7.2c-2.7,1.6-5.9,2.4-9.4,2.4h-6.2c-3.5,0-6.6-0.8-9.4-2.4
+			c-2.7-1.6-4.9-4-6.5-7.2L321.4,98.3c0.4,3.2,0.6,6.3,0.8,9.4c0.2,3.1,0.3,6,0.3,8.6v113.1h-40.2V32.8h34.8c2,0,3.7,0,5.2,0
+			c1.5,0,2.8,0.2,4,0.7c1.2,0.5,2.2,1.1,3.2,2.1c0.9,0.9,1.9,2.3,2.8,4l50.6,99.9C384.6,142.9,386.3,146.4,388,150.1z"/>
+		<path fill="#FFFFFF" d="M719.1,131c0,8.5-0.9,16.6-2.6,24.4c-1.8,7.8-4.3,15.1-7.6,21.9c-3.3,6.8-7.3,13.2-12.2,19
+			c-4.8,5.9-10.3,11-16.4,15.5l49.8,54.4h-37.5c-5.4,0-10.3-0.7-14.7-2c-4.4-1.3-8.3-3.9-11.7-7.9L641.7,229c-4,0.8-8,1.4-12.1,1.9
+			c-4.1,0.4-8.3,0.7-12.6,0.7c-15.3,0-29.2-2.6-41.8-7.7c-12.6-5.1-23.4-12.2-32.3-21.3c-9-9-15.9-19.7-20.8-31.9
+			c-4.9-12.2-7.4-25.5-7.4-39.7c0-14.2,2.5-27.4,7.4-39.7c4.9-12.2,11.8-22.9,20.8-31.9c9-9,19.7-16.1,32.3-21.2
+			c12.6-5.1,26.5-7.7,41.8-7.7c15.3,0,29.2,2.6,41.8,7.8c12.6,5.2,23.3,12.3,32.2,21.3c8.9,9,15.8,19.6,20.7,31.9
+			C716.6,103.7,719.1,116.8,719.1,131z M672.4,131c0-9.7-1.3-18.5-3.8-26.3c-2.5-7.8-6.1-14.4-10.9-19.8
+			c-4.7-5.4-10.5-9.5-17.3-12.4c-6.8-2.9-14.6-4.3-23.4-4.3c-8.8,0-16.7,1.4-23.6,4.3c-6.9,2.9-12.7,7-17.4,12.4
+			c-4.7,5.4-8.3,12-10.9,19.8c-2.5,7.8-3.8,16.5-3.8,26.3c0,9.8,1.3,18.6,3.8,26.4c2.5,7.8,6.1,14.4,10.9,19.8
+			c4.7,5.4,10.5,9.5,17.4,12.4c6.9,2.8,14.7,4.3,23.6,4.3c8.7,0,16.5-1.4,23.4-4.3c6.8-2.8,12.6-7,17.3-12.4
+			c4.7-5.4,8.3-12,10.9-19.8C671.1,149.6,672.4,140.8,672.4,131z"/>
+		<path fill="#FFFFFF" d="M865.6,32.7v36.2h-53.3v160.5h-45.6V68.9h-53.3V32.7H865.6z"/>
+		<path fill="#FFFFFF" d="M1040.1,32.7v36.2h-55.3v160.5h-45.6V68.9h-53.3V32.7H1040.1z"/>
+	</g>
+	<path fill="#FFFFFF" d="M34.9,144c-0.2,0-0.4,0-0.6,0v77.6c0,5.6,4.6,10.2,10.2,10.2h79.9C123.7,183.3,83.8,144,34.9,144z"/>
+	<path fill="#FFFFFF" d="M34.9,80c-0.2,0-0.4,0-0.6,0v33c65.9,0.3,119.5,53.3,120.2,118.8h34.2C188.1,148,119.3,80,34.9,80z"/>
+	<path fill="#FFFFFF" d="M237.2,221.7v-70.1C214,94.8,167.3,50,109.1,29H44.5c-5.6,0-10.2,4.6-10.2,10.2V49
+		c101.4,0.3,183.9,82,184.5,182.8h8.2C232.6,231.8,237.2,227.3,237.2,221.7z"/>
+	<path fill="#FFFFFF" d="M210.5,57.3c9.4,9.4,19,21.3,26.7,31.8v-50c0-5.6-4.5-10.1-10.1-10.1h-51.5
+		C187.5,37.3,199.9,46.8,210.5,57.3z"/>
+</g>
+</svg>
--- a/frontend/public/db-icons/oceanbase.png
+++ b/frontend/public/db-icons/oceanbase.png
--- a/frontend/public/db-icons/opengauss.ico
+++ b/frontend/public/db-icons/opengauss.ico
--- a/frontend/public/db-icons/oracle.ico
+++ b/frontend/public/db-icons/oracle.ico
--- a/frontend/public/db-icons/qdrant.svg
+++ b/frontend/public/db-icons/qdrant.svg
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Capa_2" data-name="Capa 2" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 346.42 400">
+  <defs>
+    <style>
+      .cls-1 {
+        fill: #9e0d38;
+      }
+
+      .cls-2 {
+        fill: #dc244c;
+      }
+
+      .cls-3 {
+        fill: #ff516b;
+      }
+    </style>
+  </defs>
+  <g id="Vectors">
+    <g>
+      <g>
+        <polygon class="cls-2" points="173.21 0 0 100 0 300 173.21 400 238.16 362.5 238.16 287.5 173.21 325 64.96 262.5 64.96 137.5 173.21 75 281.46 137.5 281.46 387.5 346.42 350 346.42 100 173.21 0"/>
+        <polygon class="cls-2" points="108.26 162.5 108.26 237.5 173.21 275 238.16 237.5 238.16 162.5 173.21 125 108.26 162.5"/>
+      </g>
+      <g>
+        <polygon class="cls-1" points="238.16 287.5 238.16 362.5 173.21 400 173.21 325 238.16 287.5"/>
+        <polygon class="cls-1" points="346.42 100 346.42 350 281.46 387.5 281.46 137.5 346.42 100"/>
+        <polygon class="cls-3" points="346.42 100 281.46 137.5 173.21 75 64.96 137.5 0 100 173.21 0 346.42 100"/>
+        <polygon class="cls-2" points="173.21 325 173.21 400 0 300 0 100 64.96 137.5 64.96 262.5 173.21 325"/>
+        <polygon class="cls-3" points="238.16 162.5 173.21 200 108.26 162.5 173.21 125 238.16 162.5"/>
+        <polygon class="cls-2" points="173.21 200 173.21 275 108.26 237.5 108.26 162.5 173.21 200"/>
+        <polygon class="cls-1" points="238.16 162.5 238.16 237.5 173.21 275 173.21 200 238.16 162.5"/>
+      </g>
+    </g>
+  </g>
+</svg>
--- a/frontend/public/db-icons/rabbitmq.svg
+++ b/frontend/public/db-icons/rabbitmq.svg
@@ -0,0 +1,7 @@
+<svg role="img" viewBox="0 0 132.29167 132.29166" xmlns="http://www.w3.org/2000/svg">
+  <title>RabbitMQ</title>
+  <path
+    d="M 127.32189 54.270409 H 84.999977 a 5.2690424 5.2690424 0 0 1 -5.302308 -5.302309 V 6.6461888 A 5.2690424 5.2690424 0 0 0 74.39536 1.3438804 H 58.555783 A 5.2690424 5.2690424 0 0 0 53.253474 6.6461888 V 48.9681 a 5.2690424 5.2690424 0 0 1 -5.302309 5.302309 H 32.111589 A 5.2690424 5.2690424 0 0 1 26.80928 48.9681 V 6.6461888 A 5.2690424 5.2690424 0 0 0 21.506972 1.3106149 H 5.6341299 A 5.2690424 5.2690424 0 0 0 0.3650864 6.6461888 V 128.31903 a 5.2690424 5.2690424 0 0 0 5.3023089 5.30231 H 127.32189 a 5.2690424 5.2690424 0 0 0 5.30231 -5.30231 V 59.572717 a 5.2690424 5.2690424 0 0 0 -5.30231 -5.302308 z m -21.17517 44.908545 a 7.9542581 7.9542581 0 0 1 -7.95425 7.987516 H 87.573659 a 7.9542581 7.9542581 0 0 1 -7.954257 -7.987516 V 88.593818 a 7.9542581 7.9542581 0 0 1 7.954257 -7.987517 h 10.618811 a 7.9542581 7.9542581 0 0 1 7.95425 7.987517 z"
+    fill="#FF6600"
+  />
+</svg>
--- a/frontend/public/db-icons/rocketmq.png
+++ b/frontend/public/db-icons/rocketmq.png
--- a/frontend/public/db-icons/starrocks.png
+++ b/frontend/public/db-icons/starrocks.png
--- a/frontend/public/db-icons/tdengine.ico
+++ b/frontend/public/db-icons/tdengine.ico
--- a/frontend/public/db-icons/vastbase.svg
+++ b/frontend/public/db-icons/vastbase.svg
@@ -0,0 +1,72 @@
+<svg width="159" height="48" viewBox="0 0 159 48" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_1_798)">
+<path d="M93.932 39.4721C93.6905 39.3017 93.4059 39.1653 93.0955 39.0461C92.7764 38.9268 92.4573 38.8246 92.1382 38.7223C91.8277 38.6371 90.0598 38.2623 89.7062 38.1004C88.7404 37.6403 89.1888 37.1717 89.3527 37.061C89.4993 36.9673 89.6545 36.9332 89.8615 36.8906C90.0598 36.848 90.422 36.8054 91.0602 36.8054C91.4052 36.8054 91.8019 36.848 92.0865 36.8991C92.371 36.9502 92.6298 37.0184 92.8454 37.078C93.0092 37.1206 93.0868 37.1547 93.3456 37.1717C93.587 37.1973 93.7509 37.078 93.8716 36.9843C93.9751 36.9076 94.0441 36.7372 94.0441 36.6605C94.0441 36.5583 94.0441 36.2601 94.0441 36.2175C94.0441 35.996 93.8199 35.8171 93.5353 35.7319C93.5094 35.7234 93.4749 35.7149 93.4404 35.6978C93.2421 35.6382 93.0265 35.5871 92.7764 35.5445C92.5263 35.5019 92.2503 35.4593 91.9657 35.4337C91.6725 35.4082 91.3879 35.3911 91.0947 35.3911C90.5428 35.3911 90.0081 35.4337 89.5079 35.5274C89.0077 35.6126 88.5765 35.7489 88.2143 35.9364C87.8435 36.1153 87.5502 36.3453 87.3346 36.6265C87.1191 36.8991 87.0156 37.2228 87.0156 37.5807C87.0156 37.8959 87.0932 38.1685 87.2398 38.3986C87.3864 38.6286 87.5934 38.8246 87.8262 38.9864C88.0677 39.1568 88.3437 39.2931 88.6455 39.4124C89.3354 39.685 91.2758 40.0173 92.052 40.2729C92.8281 40.5285 92.7591 41.3634 92.2589 41.5935C91.7501 41.8235 91.1033 41.832 90.3703 41.832C89.9132 41.832 89.3958 41.7809 89.0508 41.7127C88.7059 41.6446 88.4989 41.5594 88.2574 41.4827C88.0073 41.406 87.7227 41.2186 87.4468 41.2186C87.1104 41.2186 86.8086 41.3634 86.8086 41.6616C86.8086 41.7894 86.8086 41.7979 86.8086 41.832C86.8086 41.8661 86.8086 41.9172 86.8086 41.9683V42.275C86.8086 42.488 86.9379 42.6073 87.0587 42.6755C87.1708 42.7436 87.2484 42.7777 87.4295 42.8459C87.6106 42.9055 87.8435 42.9736 88.1194 43.0333C88.3954 43.0929 88.7145 43.1526 89.0767 43.1952C89.4389 43.2378 89.7149 43.2633 90.1288 43.2633C90.7497 43.2633 91.4569 43.2122 92.0002 43.11C92.5435 43.0077 93.0178 42.8629 93.4318 42.6499C93.8371 42.4539 94.1648 42.1984 94.3977 41.9002C94.6391 41.602 94.7599 41.2527 94.7599 40.8522C94.7599 40.5455 94.6823 40.2814 94.527 40.0599C94.3718 39.8384 94.1735 39.6424 93.932 39.4721Z" fill="#A0A0A0"/>
+<path d="M119.071 36.0554C118.235 35.3994 117.528 35.3057 115.777 35.3057H113.078C113.078 35.3057 113.034 35.3057 113 35.3227H112.965C112.534 35.3227 112.181 35.672 112.181 36.098V42.4707C112.181 42.8967 112.534 43.246 112.965 43.246H113.103C113.103 43.246 113.147 43.246 113.164 43.246H115.587C117.321 43.246 118.088 43.1779 118.968 42.5304C120.003 41.7636 120.218 41.0479 120.218 39.1651C120.218 37.4697 120.054 36.8392 119.063 36.0639L119.071 36.0554ZM118.028 41.2524L117.881 41.3717C117.579 41.6699 116.475 41.7977 115.579 41.7977H114.294C114.104 41.7892 113.905 41.6784 113.905 41.4824V37.2056C113.905 37.0096 114.121 36.7285 114.311 36.7285L115.544 36.7114C116.57 36.7114 117.433 36.737 118.054 37.3419C118.416 37.6997 118.485 38.2024 118.485 39.2247C118.485 40.3664 118.459 40.8264 118.019 41.2609L118.028 41.2524Z" fill="#A0A0A0"/>
+<path d="M107.101 35.3911H99.9258C99.7016 35.3911 99.5205 35.57 99.5205 35.7915V36.6605C99.5205 36.8906 99.7102 37.0695 99.9345 37.0695H102.582V42.4284C102.582 42.8544 102.642 43.2037 103.074 43.2037H103.832C104.264 43.2037 104.281 42.8544 104.281 42.4284V37.0695H107.101C107.299 37.0695 107.455 36.9076 107.455 36.7117V35.7489C107.455 35.553 107.291 35.3911 107.092 35.3911H107.101Z" fill="#A0A0A0"/>
+<path d="M145.236 35.3911H138.061C137.836 35.3911 137.655 35.57 137.655 35.7915V36.6605C137.655 36.8906 137.845 37.0695 138.069 37.0695H140.717V42.4284C140.717 42.8544 140.777 43.2037 141.208 43.2037H141.967C142.398 43.2037 142.416 42.8544 142.416 42.4284V37.0695H145.236C145.434 37.0695 145.598 36.9076 145.598 36.7117V35.7489C145.598 35.553 145.434 35.3911 145.236 35.3911Z" fill="#A0A0A0"/>
+<path d="M69.535 35.3994H68.9572C68.5174 35.3738 68.4139 35.4164 68.2846 35.655L68.1811 35.8424L68.1121 35.9702L67.9482 36.2684C67.9482 36.2684 67.9482 36.2684 67.9482 36.2769L65.3697 40.9542L62.5755 35.9276C62.5755 35.9276 62.5755 35.9191 62.5669 35.9105L62.4203 35.6464C62.2909 35.4164 62.1012 35.3908 61.7821 35.3823H61.1439C60.661 35.3908 60.6179 35.7742 60.7472 36.0128L61.256 36.9499C61.256 36.9499 61.2733 36.984 61.2819 37.0011L64.4555 42.6922C64.6366 42.9989 64.9643 43.2119 65.3352 43.2119C65.706 43.2119 66.0337 42.9989 66.2148 42.6922L69.4143 37.0181L69.949 35.9872C70.0783 35.7572 70.0611 35.3823 69.535 35.3994Z" fill="#A0A0A0"/>
+<path d="M82.0395 41.585L78.8831 35.9279C78.702 35.6127 78.3829 35.4082 78.0121 35.4082C77.6413 35.4082 77.3222 35.6127 77.1411 35.9279L73.9933 41.6191C73.9933 41.6191 73.9761 41.6531 73.9675 41.6702L73.4587 42.6073C73.3293 42.8374 73.4587 43.1015 73.6829 43.2378H74.4677C74.873 43.2378 74.9851 43.2037 75.1145 42.9737L75.2611 42.7096C75.2611 42.7096 75.2611 42.7011 75.2697 42.6925L75.8389 41.6531H78.6934C78.8486 41.6531 79.116 41.4316 78.9349 41.0738L78.5295 40.3496C78.4951 40.2815 78.4261 40.2389 78.3484 40.2389H76.6064L78.0207 37.6659L80.5734 42.3432C80.5734 42.3432 80.5734 42.3432 80.5734 42.3518L80.7373 42.65L80.8063 42.7777L80.9098 42.9652C81.0391 43.1952 81.272 43.2293 81.6169 43.2293L82.3758 43.2463C82.5483 43.2378 82.807 42.9141 82.6259 42.6159L82.0136 41.585H82.0395Z" fill="#A0A0A0"/>
+<path d="M132.895 41.585L129.739 35.9279C129.558 35.6127 129.238 35.4082 128.868 35.4082C128.497 35.4082 128.178 35.6127 127.997 35.9279L124.849 41.6191C124.849 41.6191 124.832 41.6531 124.823 41.6702L124.314 42.6073C124.185 42.8374 124.314 43.1015 124.538 43.2378H125.323C125.728 43.2378 125.841 43.2037 125.97 42.9737L126.117 42.7096C126.117 42.7096 126.117 42.7011 126.125 42.6925L126.694 41.6531H129.549C129.704 41.6531 129.971 41.4316 129.79 41.0738L129.385 40.3496C129.351 40.2815 129.282 40.2389 129.204 40.2389H127.462L128.876 37.6659L131.429 42.3432C131.429 42.3432 131.429 42.3432 131.429 42.3518L131.593 42.6585L131.662 42.7863L131.765 42.9737C131.895 43.2037 132.127 43.2378 132.481 43.2378L133.24 43.2548C133.412 43.2463 133.671 42.9226 133.49 42.6244L132.878 41.585H132.895Z" fill="#A0A0A0"/>
+<path d="M158.94 42.6156L158.328 41.5762L155.171 35.9191C154.99 35.6039 154.671 35.3994 154.3 35.3994C153.929 35.3994 153.61 35.6039 153.429 35.9191L150.281 41.6103C150.281 41.6103 150.264 41.6444 150.256 41.6614L149.747 42.5986C149.617 42.8286 149.747 43.0927 149.971 43.229H150.756C151.161 43.229 151.273 43.1949 151.403 42.9649L151.549 42.7008C151.549 42.7008 151.549 42.6923 151.558 42.6838L152.127 41.6444H154.981C155.137 41.6444 155.404 41.4228 155.223 41.065L154.818 40.3408C154.783 40.2727 154.714 40.2301 154.637 40.2301H152.894L154.309 37.6571L156.862 42.3345C156.862 42.3345 156.862 42.3345 156.862 42.343L157.025 42.6497L157.094 42.7775L157.198 42.9649C157.327 43.1949 157.56 43.229 157.905 43.229L158.664 43.2461C158.836 43.2375 159.095 42.9138 158.914 42.6156H158.94Z" fill="#A0A0A0"/>
+<path d="M141.476 29.751V22.2366C141.89 22.0833 142.304 21.9214 142.718 21.751C143.192 21.5551 143.244 21.4869 143.235 21.112C143.235 20.8053 143.244 20.0556 143.244 19.5615C143.244 19.1951 143.02 19.0758 142.692 19.161C142.295 19.2633 141.881 19.3655 141.467 19.4677V14.9523H142.977C143.14 14.9523 143.27 14.8245 143.27 14.6626V12.7372C143.27 12.5753 143.14 12.4475 142.977 12.4475H141.467V10.1813C141.467 10.0194 141.338 9.8916 141.174 9.8916H138.828C138.665 9.8916 138.535 10.0194 138.535 9.90864V12.4475H137.095C136.931 12.4475 136.802 12.5753 136.802 12.7372V14.6626C136.802 14.8245 136.931 14.9523 137.095 14.9523H138.535V20.0812C138.061 20.1578 137.595 20.2175 137.129 20.2516C137.026 20.2601 136.922 20.2686 136.871 20.3538C136.793 20.4816 136.81 20.6861 136.81 20.6861V22.6712C136.81 22.6712 136.767 23.1653 136.897 23.2931C136.966 23.3612 137.164 23.4038 137.336 23.3698C137.742 23.2931 138.138 23.1994 138.535 23.1057V28.4901C138.509 28.6009 138.458 28.6861 138.328 28.7968C138.251 28.8565 138.138 28.8991 137.992 28.9161L137.224 28.9417C137.06 28.9417 136.931 29.0695 136.931 29.2313V31.1568C136.931 31.3186 137.06 31.4464 137.224 31.4464H139.863L139.898 31.4294C140.769 31.3357 141.441 30.4837 141.467 29.8107V29.7936C141.467 29.7936 141.467 29.7766 141.467 29.7681C141.467 29.7595 141.467 29.7425 141.467 29.734L141.476 29.751Z" fill="#19140F"/>
+<path d="M158.361 19.1268H153.98V17.3121H157.792C158.033 17.3121 158.223 17.1162 158.223 16.8861V10.2663C158.223 10.0278 158.025 9.84033 157.792 9.84033L146.426 9.92553C146.426 9.92553 146.365 9.90849 146.331 9.90849H143.985C143.821 9.90849 143.692 10.0363 143.692 10.1982V23.0714C143.562 25.3632 143.131 26.8797 142.234 28.8904V31.4548H142.303C142.898 31.4037 146.279 27.6209 146.615 22.0576L146.633 21.6486H151.057V23.4719H147.141C146.969 23.4719 146.822 23.6167 146.822 23.7871V31.2077C146.822 31.3781 146.969 31.523 147.141 31.523H157.913C158.085 31.523 158.232 31.3781 158.232 31.2077V23.7871C158.232 23.6167 158.085 23.4719 157.913 23.4719H153.997V21.6486H158.378C158.542 21.6486 158.672 21.5208 158.672 21.359V19.4335C158.672 19.2716 158.542 19.1438 158.378 19.1438L158.361 19.1268ZM155.222 26.2408V28.7626C155.222 28.8819 155.127 28.9756 155.006 28.9756H149.979C149.858 28.9756 149.763 28.8819 149.763 28.7626V26.2408C149.763 26.1215 149.858 26.0278 149.979 26.0278H155.006C155.127 26.0278 155.222 26.1215 155.222 26.2408ZM147.124 12.4303H154.696C154.972 12.4303 155.205 12.6604 155.205 12.933V14.4154C155.205 14.688 154.972 14.9181 154.696 14.9181H147.124C146.883 14.9181 146.684 14.7477 146.633 14.5262V12.8307C146.676 12.6007 146.883 12.4303 147.124 12.4303ZM146.641 19.1268V17.3121H151.048V19.1268H146.641Z" fill="#19140F"/>
+<path d="M114.397 10.4023H112.051C111.889 10.4023 111.758 10.532 111.758 10.692V13.0094C111.758 13.1694 111.889 13.299 112.051 13.299H114.397C114.559 13.299 114.69 13.1694 114.69 13.0094V10.692C114.69 10.532 114.559 10.4023 114.397 10.4023Z" fill="#19140F"/>
+<path d="M122.58 10.4023H120.235C120.073 10.4023 119.941 10.532 119.941 10.692V13.0094C119.941 13.1694 120.073 13.299 120.235 13.299H122.58C122.742 13.299 122.874 13.1694 122.874 13.0094V10.692C122.874 10.532 122.742 10.4023 122.58 10.4023Z" fill="#19140F"/>
+<path d="M122.132 29.1031C122.046 29.1031 121.951 29.1031 121.865 29.1031C121.123 29.1031 120.382 28.9839 119.692 28.7794C121.003 27.6633 121.908 26.232 122.072 24.5536H123.176C123.34 24.5536 123.469 24.4258 123.469 24.264V22.3385C123.469 22.1766 123.34 22.0488 123.176 22.0488H115.182V21.3502C115.182 21.1883 115.052 21.0605 114.888 21.0605H112.543C112.379 21.0605 112.249 21.1883 112.249 21.3502V22.0488H111.646C111.482 22.0488 111.353 22.1766 111.353 22.3385V24.264C111.353 24.4258 111.482 24.5536 111.646 24.5536H112.482C112.698 26.249 113.431 27.6378 114.509 28.7112C113.707 28.9583 112.87 29.1031 112.068 29.1031C111.991 29.1031 111.913 29.1031 111.835 29.1031C111.585 29.1031 111.378 29.2991 111.378 29.5462V30.969C111.378 31.2075 111.577 31.412 111.818 31.412C111.896 31.412 111.982 31.412 112.06 31.412C113.716 31.412 115.44 31.0542 116.984 30.4067C118.441 31.0712 120.132 31.412 121.857 31.412C121.934 31.412 122.02 31.412 122.098 31.412C122.348 31.412 122.546 31.2075 122.546 30.9604V29.4865C122.546 29.265 122.357 29.0861 122.132 29.0946V29.1031ZM115.354 24.5621H119.2C119.14 25.5845 118.321 26.6324 117.122 27.4588C116.113 26.6495 115.44 25.6186 115.354 24.5621Z" fill="#19140F"/>
+<path d="M132.714 29.0521C131.636 28.9755 130.644 28.5239 129.782 27.8338C131.187 26.164 132.041 24.017 132.093 21.6144C132.11 21.4526 132.11 21.3333 132.11 21.2907V14.9435H132.86C133.024 14.9435 133.154 14.8072 133.154 14.6538V12.7284C133.154 12.5665 133.024 12.4387 132.86 12.4387H128.1C128.16 12.2257 128.221 11.9957 128.281 11.7657C128.402 11.263 128.462 10.8455 128.454 10.2918C128.454 10.0617 128.264 9.88281 128.031 9.88281H125.332C124.987 9.88281 124.719 10.1725 124.745 10.5048C124.754 10.6496 124.762 10.8029 124.762 10.9563C124.762 12.4302 124.193 13.7763 123.262 14.7902V14.1597C123.262 13.9978 123.133 13.87 122.969 13.87H118.777V10.198C118.777 10.0362 118.648 9.90837 118.484 9.90837H116.139C115.975 9.90837 115.845 10.0362 115.845 10.198V13.87H111.628C111.464 13.87 111.335 13.9978 111.335 14.1597V16.4771C111.335 16.6389 111.464 16.7667 111.628 16.7667H113.293C113.293 16.7667 113.293 16.7923 113.293 16.8093C113.293 17.6187 112.378 18.1725 111.723 18.5559C111.585 18.6325 111.464 18.6922 111.378 18.8029C111.361 18.8285 111.344 18.8881 111.335 18.9648V20.3791C111.344 20.4472 111.369 20.5069 111.395 20.541C111.464 20.6262 111.585 20.6602 111.697 20.6688C111.818 20.6858 111.87 20.6858 111.99 20.6858C113.715 20.6858 115.595 19.3312 115.845 17.6613V20.4728C115.845 20.6347 115.975 20.7625 116.139 20.7625H118.484C118.648 20.7625 118.777 20.6347 118.777 20.4728V17.6443C119.019 19.3141 120.908 20.6858 122.632 20.6858C122.753 20.6858 122.813 20.6858 122.926 20.6688C123.046 20.6517 123.158 20.6262 123.227 20.541C123.253 20.5069 123.279 20.4558 123.288 20.3961V18.9478C123.279 18.8796 123.271 18.8285 123.245 18.8029C123.158 18.6922 123.029 18.6325 122.9 18.5559C122.244 18.1725 121.33 17.6187 121.33 16.8093C121.33 16.7923 121.33 16.7838 121.33 16.7667H122.831V16.903C122.831 16.903 122.788 17.1331 122.969 17.3205C123.15 17.5079 123.374 17.4227 123.633 17.3546C123.745 17.3205 123.857 17.2864 123.96 17.2524V21.7678C123.96 21.8189 123.96 21.8615 123.96 21.8956C123.96 21.9808 123.96 22.066 123.96 22.1512V22.2449C123.96 22.2449 123.96 22.2449 123.96 22.2534C124.038 24.3407 124.788 26.2321 126.004 27.7401C125.185 28.3535 124.236 28.7965 123.227 28.984C123.003 29.0266 122.839 29.2311 122.839 29.4611V30.9265C122.839 31.1821 123.064 31.3695 123.314 31.3354C125.03 31.0969 126.599 30.4749 127.91 29.5463C129.281 30.526 130.92 31.1735 132.705 31.378C132.947 31.4036 133.154 31.2247 133.154 30.9861C133.154 30.6624 133.154 29.8786 133.154 29.5889C133.154 29.0351 132.757 29.0777 132.679 29.0777L132.714 29.0521ZM127.039 14.9435H128.824C128.824 14.9435 129.178 14.9776 129.178 15.3695V22.066C129.074 23.3525 128.626 24.5878 127.936 25.6613C127.289 24.5282 126.918 23.2417 126.918 21.9978C126.918 21.9297 126.918 21.87 126.901 21.8274V17.0308C126.901 16.869 126.772 16.7412 126.608 16.7412H125.142C125.944 16.2896 126.556 15.6847 127.031 14.952L127.039 14.9435Z" fill="#19140F"/>
+<path d="M107.308 29.8531H98.5372V29.0097H105.937C106.161 29.0097 106.351 28.8223 106.351 28.6007V27.7828C106.351 27.5613 106.161 27.3739 105.937 27.3739H98.5372V26.5134H105.117C105.264 26.5134 105.376 26.3941 105.376 26.2493V20.1748C105.376 20.0299 105.255 19.9106 105.117 19.9106H88.4472C88.3006 19.9106 88.1885 20.0299 88.1885 20.1748V26.2493C88.1885 26.3941 88.3092 26.5134 88.4472 26.5134H95.0273V27.3739H87.6279C87.4037 27.3739 87.214 27.5613 87.214 27.7828V28.6007C87.214 28.8223 87.4037 29.0097 87.6279 29.0097H95.0273V29.8531H86.2567C86.0325 29.8531 85.8428 30.0406 85.8428 30.2621V31.08C85.8428 31.3015 86.0325 31.4889 86.2567 31.4889H107.299C107.523 31.4889 107.713 31.3015 107.713 31.08V30.2621C107.713 30.0406 107.523 29.8531 107.299 29.8531H107.308ZM102.125 24.5368C102.125 24.7158 101.978 24.8606 101.797 24.8606H98.5372V24.0001H101.797C101.978 24.0001 102.125 24.1449 102.125 24.3238V24.5368ZM101.797 21.5464C101.978 21.5464 102.125 21.6913 102.125 21.8702V22.0832C102.125 22.2621 101.978 22.4069 101.797 22.4069H98.5372V21.5464H101.797ZM91.5001 21.8702C91.5001 21.6913 91.6467 21.5464 91.8278 21.5464H95.0445V22.4069H91.8278C91.6467 22.4069 91.5001 22.2621 91.5001 22.0832V21.8702ZM91.8278 24.8606C91.6467 24.8606 91.5001 24.7158 91.5001 24.5368V24.3238C91.5001 24.1449 91.6467 24.0001 91.8278 24.0001H95.0445V24.8606H91.8278Z" fill="#19140F"/>
+<path d="M107.317 17.3975H86.2655C86.0369 17.3975 85.8516 17.5806 85.8516 17.8064V18.6158C85.8516 18.8416 86.0369 19.0247 86.2655 19.0247H107.317C107.545 19.0247 107.731 18.8416 107.731 18.6158V17.8064C107.731 17.5806 107.545 17.3975 107.317 17.3975Z" fill="#19140F"/>
+<path d="M88.2919 16.4944H105.298C105.445 16.4944 105.557 16.3751 105.557 16.2303V10.1557C105.557 10.0109 105.436 9.8916 105.298 9.8916H88.2919C88.1453 9.8916 88.0332 10.0109 88.0332 10.1557V16.2303C88.0332 16.3751 88.1539 16.4944 88.2919 16.4944ZM91.3189 11.8341C91.3189 11.6552 91.4655 11.5103 91.6466 11.5103H101.944C102.125 11.5103 102.271 11.6552 102.271 11.8341V12.0471C102.271 12.226 102.125 12.3708 101.944 12.3708H91.6466C91.4655 12.3708 91.3189 12.226 91.3189 12.0471V11.8341ZM91.3189 14.3304C91.3189 14.1515 91.4655 14.0066 91.6466 14.0066H101.944C102.125 14.0066 102.271 14.1515 102.271 14.3304V14.5434C102.271 14.7223 102.125 14.8671 101.944 14.8671H91.6466C91.4655 14.8671 91.3189 14.7223 91.3189 14.5434V14.3304Z" fill="#19140F"/>
+<path d="M63.7749 16.043H61.1274C60.9721 16.043 60.8428 16.1708 60.8428 16.3241V20.2176C60.8428 20.371 60.9721 20.4988 61.1274 20.4988H63.7059C63.8612 20.4988 64.0509 20.3284 64.0509 20.175V16.3241C64.0509 16.1708 63.9388 16.043 63.7835 16.043H63.7749Z" fill="#19140F"/>
+<path d="M63.749 21.606H61.1274C60.9721 21.606 60.8428 21.7338 60.8428 21.8871V31.1651C60.8428 31.3184 60.9721 31.4462 61.1274 31.4462H63.7404C63.8957 31.4462 64.0164 31.3184 64.0164 31.1651V21.8871C64.0164 21.7338 63.9043 21.606 63.749 21.606Z" fill="#19140F"/>
+<path d="M81.5318 20.4731H80.0916V15.4635C80.0916 15.1568 79.8415 14.9097 79.5311 14.9097H68.3975C68.7425 14.6797 69.2082 14.2963 69.6911 13.7936H81.0489C81.2041 13.7936 81.3248 13.6743 81.3248 13.5125V11.5615C81.3248 11.4081 81.1955 11.2888 81.0489 11.2888H70.8726C70.8898 11.1696 70.933 10.1728 70.933 10.1728C70.933 10.0194 70.8036 9.8916 70.6484 9.8916H68.1474C67.9922 9.8916 67.8628 10.0194 67.8628 10.1728V10.8714C67.8628 12.03 66.5692 13.1546 65.4568 13.3591C65.4568 13.3591 65.0342 13.3762 65.0342 13.7169V15.1057C65.0342 15.259 65.1635 15.3868 65.3101 15.3868L66.5951 15.1823V20.4646H65.7413C65.5861 20.4646 65.4568 20.5838 65.4568 20.7457V22.6882C65.4568 22.8415 65.5861 22.9693 65.7413 22.9693H66.5951V27.9448C66.5951 28.2856 66.828 28.3879 67.1384 28.3879H77.1163V28.7627C77.1163 28.9757 77.1163 29.2228 76.78 29.2228H74.2101C74.0548 29.2228 73.822 29.325 73.8737 29.5636C73.9255 29.8021 74.6758 31.0119 74.6758 31.0119C74.762 31.1653 74.8482 31.4209 75.1328 31.4209H79.6087C80.0399 31.4209 80.0485 31.2079 80.0485 30.9779L80.0744 28.3879L80.954 28.4049C81.1092 28.4049 81.2903 28.2686 81.2903 28.1152V26.1983C81.2817 26.045 81.1179 25.8831 80.9626 25.8831H80.0744V22.9608H81.5059C81.6612 22.9608 81.7905 22.833 81.7905 22.6797V20.7372C81.7905 20.5838 81.6784 20.456 81.5232 20.456L81.5318 20.4731ZM77.1508 25.619C77.1508 25.7723 77.0215 25.9001 76.8663 25.9001H75.0294V24.1365C75.0294 23.8554 74.9172 23.7446 74.6326 23.7446H72.4163C72.2611 23.7446 72.08 23.8639 72.08 24.0684V25.9001H69.9067C69.8205 25.9001 69.5531 25.8234 69.5531 25.6275V23.3101C69.5531 23.1568 69.6739 23.0205 69.8377 23.0205H76.8663C77.0215 23.0205 77.1508 23.2249 77.1508 23.3783V25.619ZM77.1336 20.4731H75.038V18.6925C75.038 18.4965 74.9172 18.3261 74.762 18.3261H72.3645C72.2093 18.3261 72.08 18.4965 72.08 18.6499V20.4731H69.5359V17.7979C69.5359 17.5082 69.7774 17.3719 69.9326 17.3719L76.8318 17.3975C76.987 17.3975 77.1508 17.5338 77.1508 17.7382L77.1336 20.4731Z" fill="#19140F"/>
+<path d="M61.1184 14.9353H63.7401C63.8953 14.9353 64.0161 14.816 64.0161 14.6541V10.7606C64.0161 10.6073 63.8695 10.4795 63.7142 10.4795H61.1098C60.9546 10.4795 60.8252 10.6073 60.8252 10.7606V14.6541C60.8252 14.8075 60.9546 14.9353 61.1098 14.9353H61.1184Z" fill="#19140F"/>
+<path d="M34.323 44.7455L34.2626 44.6518C34.2109 44.5411 34.1591 44.4388 34.1074 44.3451L26.915 32.1364C26.5097 31.4718 25.768 31.0288 24.9315 31.0288C24.095 31.0288 23.3447 31.4804 22.9394 32.1534L15.7211 44.2599C15.7211 44.2599 15.7039 44.2855 15.6952 44.3025L15.6435 44.3877C15.6004 44.4644 15.5573 44.5496 15.5141 44.6263L15.4365 44.7455C14.9105 45.606 15.1864 46.7391 16.0574 47.2588L16.8508 47.7359C17.7219 48.2556 18.8689 47.983 19.3949 47.1225L19.8779 46.3387C19.9124 46.2876 19.9382 46.2365 19.9641 46.1768L24.897 37.9383L29.7782 46.1002C29.8127 46.1768 29.8472 46.262 29.8989 46.3387L30.2007 46.8329C30.2439 46.9095 30.2956 46.9862 30.3387 47.0544L30.3818 47.1225C30.9079 47.983 32.0549 48.2556 32.9259 47.7359L33.7193 47.2588C34.5903 46.7391 34.8663 45.606 34.3402 44.7455H34.323Z" fill="url(#paint0_radial_1_798)"/>
+<path d="M47.7674 26.2578H47.6553C47.5346 26.2492 47.4138 26.2407 47.3017 26.2407L33.0032 26.2918C32.2184 26.3089 31.4595 26.7178 31.0369 27.442C30.6144 28.1662 30.6402 29.0267 31.0197 29.7082L38.031 41.9425C38.031 41.9596 38.0482 41.9681 38.0568 41.9851L38.1086 42.0788C38.1517 42.1555 38.2034 42.2322 38.2552 42.3089L38.3242 42.4367C38.8157 43.3227 39.9455 43.6465 40.8424 43.1609L41.653 42.7178C42.5499 42.2322 42.8776 41.1161 42.3861 40.2301L41.9376 39.4292C41.9117 39.3781 41.8773 39.327 41.8428 39.2759L37.091 30.9436L46.6808 30.8499C46.767 30.8584 46.8533 30.8669 46.9481 30.8669L47.526 30.8499C47.6122 30.8499 47.7071 30.8499 47.7933 30.8499H47.8709C48.8885 30.8243 49.7078 29.9809 49.6819 28.9755L49.6647 28.0639C49.6388 27.0586 48.785 26.2492 47.7674 26.2748V26.2578Z" fill="url(#paint1_radial_1_798)"/>
+<path d="M38.2819 5.51233L38.2302 5.61457C38.1612 5.70829 38.0922 5.81052 38.0405 5.90424L30.9343 18.1641C30.5549 18.8457 30.5376 19.6976 30.9602 20.4218C31.3828 21.146 32.1503 21.5549 32.9437 21.572L47.1732 21.6912C47.1905 21.6912 47.2077 21.6912 47.2164 21.6912H47.3198C47.4061 21.6912 47.5009 21.6912 47.5958 21.6827H47.7424C48.76 21.7083 49.6138 20.9074 49.6397 19.8936L49.6569 18.982C49.6828 17.9767 48.8635 17.1332 47.8459 17.1076L46.9231 17.0906C46.8628 17.0906 46.8024 17.0906 46.742 17.0906L37.0573 16.9884L41.766 8.73278C41.8178 8.66462 41.8695 8.58795 41.9126 8.51127L42.1886 8.00861C42.2317 7.93193 42.2748 7.85525 42.3179 7.77858L42.3524 7.71042C42.844 6.82437 42.5077 5.70829 41.6194 5.22266L40.8088 4.77964C39.9119 4.29402 38.7821 4.62629 38.2906 5.50381L38.2819 5.51233Z" fill="url(#paint2_radial_1_798)"/>
+<path d="M15.359 3.25477L15.4194 3.34848C15.4711 3.45924 15.5229 3.56147 15.5746 3.65519L22.767 15.8639C23.1723 16.5285 23.914 16.9715 24.7505 16.9715C25.5871 16.9715 26.3373 16.5199 26.7427 15.8469L33.9609 3.74039C33.9609 3.74039 33.9782 3.71483 33.9868 3.69779L34.0385 3.61259C34.0817 3.53591 34.1248 3.45072 34.1679 3.37404L34.2455 3.25477C34.7716 2.39428 34.4956 1.26115 33.6246 0.741453L32.8312 0.26435C31.9602 -0.255352 30.8132 0.0172783 30.2871 0.877768L29.8042 1.66158C29.7697 1.7127 29.7438 1.76382 29.7179 1.82346L24.785 10.062L19.9039 1.90013C19.8694 1.82346 19.8349 1.73826 19.7831 1.66158L19.4813 1.16744C19.4382 1.09076 19.3864 1.01408 19.3433 0.945926L19.3002 0.877768C18.7741 0.0172783 17.6271 -0.255352 16.7561 0.26435L15.9627 0.741453C15.0917 1.26115 14.8157 2.39428 15.3418 3.25477H15.359Z" fill="url(#paint3_radial_1_798)"/>
+<path d="M1.91414 21.7426H2.02625C2.14699 21.7511 2.26772 21.7596 2.37983 21.7596L16.6784 21.7085C17.4631 21.6914 18.2221 21.2825 18.6446 20.5583C19.0672 19.8342 19.0413 18.9737 18.6619 18.2921L11.6506 6.05779C11.6506 6.04075 11.6333 6.03223 11.6247 6.0152L11.573 5.92148C11.5299 5.8448 11.4781 5.76812 11.4264 5.69145L11.3574 5.56365C10.8658 4.6776 9.73607 4.35385 8.83918 4.83948L8.02853 5.2825C7.13164 5.76812 6.80393 6.8842 7.29549 7.77025L7.74394 8.57111C7.76981 8.62222 7.80431 8.67334 7.8388 8.72446L12.5906 17.0567L3.00076 17.1504C2.91452 17.1419 2.82828 17.1334 2.73342 17.1334L2.15561 17.1504C2.06937 17.1504 1.97451 17.1504 1.88827 17.1504H1.81065C0.793024 17.1845 -0.0262521 18.028 -0.000380225 19.0418L0.0168677 19.9534C0.0427396 20.9588 0.896512 21.7681 1.91414 21.7426Z" fill="url(#paint4_radial_1_798)"/>
+<path d="M11.4002 42.488L11.4519 42.3858C11.5209 42.292 11.5899 42.1898 11.6417 42.0961L18.7478 29.8362C19.1273 29.1547 19.1445 28.3027 18.7219 27.5785C18.2994 26.8543 17.5318 26.4454 16.7384 26.4284L2.5175 26.3091C2.50025 26.3091 2.483 26.3091 2.47438 26.3091H2.37089C2.28465 26.3091 2.18979 26.3091 2.09493 26.3176H1.94832C0.930692 26.292 0.0769193 27.0929 0.0510474 28.1067L0.0337995 29.0183C0.00792757 30.0237 0.827204 30.8671 1.84483 30.8927L2.7676 30.9097C2.82796 30.9097 2.88833 30.9097 2.9487 30.9097L12.6334 31.012L7.92473 39.2675C7.87298 39.3357 7.82124 39.4124 7.77812 39.4891L7.50215 39.9917C7.45903 40.0684 7.41591 40.1451 7.37279 40.2218L7.3383 40.2899C6.84673 41.176 7.18306 42.292 8.07133 42.7777L8.88199 43.2207C9.77888 43.7063 10.9086 43.374 11.4002 42.4965V42.488Z" fill="url(#paint5_radial_1_798)"/>
+</g>
+<defs>
+<radialGradient id="paint0_radial_1_798" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(24.727 23.6565) scale(24.7299 24.4309)">
+<stop stop-color="#FFC80F"/>
+<stop offset="0.33" stop-color="#FFA512"/>
+<stop offset="0.77" stop-color="#FF7D17"/>
+<stop offset="1" stop-color="#FF6E19"/>
+</radialGradient>
+<radialGradient id="paint1_radial_1_798" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(24.7267 23.6564) scale(24.7299 24.4309)">
+<stop stop-color="#FFC80F"/>
+<stop offset="0.33" stop-color="#FFA512"/>
+<stop offset="0.77" stop-color="#FF7D17"/>
+<stop offset="1" stop-color="#FF6E19"/>
+</radialGradient>
+<radialGradient id="paint2_radial_1_798" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(24.7276 23.6565) scale(24.7299 24.4309)">
+<stop stop-color="#FFC80F"/>
+<stop offset="0.33" stop-color="#FFA512"/>
+<stop offset="0.77" stop-color="#FF7D17"/>
+<stop offset="1" stop-color="#FF6E19"/>
+</radialGradient>
+<radialGradient id="paint3_radial_1_798" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(24.7272 23.6566) scale(24.7299 24.4309)">
+<stop stop-color="#FFC80F"/>
+<stop offset="0.33" stop-color="#FFA512"/>
+<stop offset="0.77" stop-color="#FF7D17"/>
+<stop offset="1" stop-color="#FF6E19"/>
+</radialGradient>
+<radialGradient id="paint4_radial_1_798" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(24.727 23.6567) scale(24.7299 24.4309)">
+<stop stop-color="#FFC80F"/>
+<stop offset="0.33" stop-color="#FFA512"/>
+<stop offset="0.77" stop-color="#FF7D17"/>
+<stop offset="1" stop-color="#FF6E19"/>
+</radialGradient>
+<radialGradient id="paint5_radial_1_798" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(24.7267 23.6566) scale(24.7299 24.4309)">
+<stop stop-color="#FFC80F"/>
+<stop offset="0.33" stop-color="#FFA512"/>
+<stop offset="0.77" stop-color="#FF7D17"/>
+<stop offset="1" stop-color="#FF6E19"/>
+</radialGradient>
+<clipPath id="clip0_1_798">
+<rect width="159" height="48" fill="white"/>
+</clipPath>
+</defs>
+</svg>
--- a/frontend/scripts/wails-frontend-install.mjs
+++ b/frontend/scripts/wails-frontend-install.mjs
@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const frontendDir = path.resolve(scriptDir, '..');
+const packageJsonPath = path.join(frontendDir, 'package.json');
+const packageLockPath = path.join(frontendDir, 'package-lock.json');
+const nodeModulesPath = path.join(frontendDir, 'node_modules');
+const npmHiddenLockPath = path.join(nodeModulesPath, '.package-lock.json');
+const installStatePath = path.join(nodeModulesPath, '.gonavi-install-state.json');
+const npmCommand = 'npm';
+const commonArgs = [
+  '--prefer-offline',
+  '--no-audit',
+  '--fund=false',
+  '--fetch-retries=5',
+  '--fetch-retry-mintimeout=20000',
+  '--fetch-retry-maxtimeout=120000',
+];
+const isCI = process.env.CI === 'true' || process.env.GITHUB_ACTIONS === 'true';
+
+const fail = (message) => {
+  console.error(`[gonavi-frontend-install] ${message}`);
+  process.exit(1);
+};
+
+const exitWithStatus = (status) => {
+  process.exit(typeof status === 'number' && status > 0 && status <= 255 ? status : 1);
+};
+
+const hashFile = (filePath) => {
+  const hash = createHash('sha256');
+  hash.update(readFileSync(filePath));
+  return hash.digest('hex');
+};
+
+const currentState = () => ({
+  packageJson: hashFile(packageJsonPath),
+  packageLock: existsSync(packageLockPath) ? hashFile(packageLockPath) : '',
+});
+
+const readInstalledState = () => {
+  if (!existsSync(installStatePath)) return null;
+  try {
+    return JSON.parse(readFileSync(installStatePath, 'utf8'));
+  } catch {
+    return null;
+  }
+};
+
+const writeInstalledState = (state) => {
+  writeFileSync(installStatePath, `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+};
+
+const packageInputsAreOlderThanNpmLock = () => {
+  if (!existsSync(npmHiddenLockPath)) return false;
+  const markerTime = statSync(npmHiddenLockPath).mtimeMs;
+  return [packageJsonPath, packageLockPath]
+    .filter(existsSync)
+    .every((filePath) => statSync(filePath).mtimeMs <= markerTime);
+};
+
+const runNpm = (subcommand) => {
+  const args = [subcommand, ...commonArgs];
+  if (isCI) {
+    console.log(
+      `[gonavi-frontend-install] cwd=${process.cwd()} frontend=${frontendDir} node=${process.version} platform=${process.platform}/${process.arch} command=${npmCommand} ${args.join(' ')}`,
+    );
+  }
+
+  const result = spawnSync(npmCommand, args, {
+    cwd: frontendDir,
+    env: process.env,
+    stdio: 'inherit',
+    shell: process.platform === 'win32',
+  });
+  if (result.error) {
+    fail(`failed to start npm: ${result.error.message}`);
+  }
+  if (result.signal) {
+    fail(`npm was terminated by signal ${result.signal}`);
+  }
+  if (result.status !== 0) {
+    console.error(`[gonavi-frontend-install] npm exited with status ${result.status ?? 'unknown'}`);
+    exitWithStatus(result.status);
+  }
+};
+
+if (!existsSync(packageJsonPath)) {
+  fail(`package.json not found at ${packageJsonPath}; cwd=${process.cwd()}`);
+}
+
+const state = currentState();
+const installedState = readInstalledState();
+const forceInstall = process.env.GONAVI_FORCE_FRONTEND_INSTALL === '1';
+
+if (!forceInstall && existsSync(nodeModulesPath)) {
+  if (
+    installedState?.packageJson === state.packageJson &&
+    installedState?.packageLock === state.packageLock
+  ) {
+    console.log('Frontend dependencies are up to date; skipping npm install.');
+    process.exit(0);
+  }
+
+  if (!installedState && isCI && existsSync(npmHiddenLockPath)) {
+    writeInstalledState(state);
+    console.log('Frontend dependencies are up to date from CI cache; recorded install state.');
+    process.exit(0);
+  }
+
+  if (!installedState && packageInputsAreOlderThanNpmLock()) {
+    writeInstalledState(state);
+    console.log('Frontend dependencies are up to date; recorded install state.');
+    process.exit(0);
+  }
+}
+
+runNpm(isCI ? 'ci' : 'install');
+writeInstalledState(state);
--- a/frontend/src/App.ai-panel-error-boundary.test.ts
+++ b/frontend/src/App.ai-panel-error-boundary.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const appSource = readFileSync(
+  fileURLToPath(new globalThis.URL('./App.tsx', import.meta.url)),
+  'utf8',
+);
+const aiPanelBoundarySource = readFileSync(
+  fileURLToPath(new globalThis.URL('./components/ai/AIPanelErrorBoundary.tsx', import.meta.url)),
+  'utf8',
+);
+
+describe('AI panel lazy-load guard', () => {
+  it('keeps AI panel failures scoped to the panel area with retry support', () => {
+    expect(appSource).toContain("import AIChatPanel from './components/AIChatPanel';");
+    expect(appSource).toContain("import AIPanelErrorBoundary from './components/ai/AIPanelErrorBoundary';");
+    expect(aiPanelBoundarySource).toContain('class AIPanelErrorBoundary extends React.Component');
+    expect(appSource).toContain('<AIPanelErrorBoundary');
+    expect(appSource).toContain('key={aiPanelRenderNonce}');
+    expect(appSource).toContain('AI 面板加载失败');
+    expect(appSource).toContain('重新加载');
+    expect(appSource).toContain('setAiPanelRenderNonce((current) => current + 1)');
+    expect(appSource).toContain('<AIChatPanel width={aiPanelRenderWidth}');
+    expect(appSource).not.toContain('const loadAIChatPanelModule = async (retryNonce: number) => {');
+  });
+});
--- a/frontend/src/App.css
+++ b/frontend/src/App.css
@@ -1,3 +1,8 @@
+:root {
+  --gn-font-sans: "Inter", "PingFang SC", "Noto Sans CJK SC", "Noto Sans SC", "Source Han Sans SC", "WenQuanYi Micro Hei", "Microsoft YaHei", -apple-system, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", "Ubuntu", sans-serif;
+  --gn-font-mono: "JetBrains Mono", "Noto Sans Mono CJK SC", "Noto Sans Mono", ui-monospace, "SF Mono", Menlo, Consolas, "DejaVu Sans Mono", monospace;
+}
+
 html, body, #root {
  height: 100%;
  margin: 0;
@@ -10,6 +15,21 @@ body, #root {
  border-radius: var(--gonavi-border-radius); /* Slightly rounded app window corners */
 }

+body,
+button,
+input,
+textarea,
+select {
+  font-family: var(--gn-font-sans);
+}
+
+code,
+pre,
+kbd,
+samp {
+  font-family: var(--gn-font-mono);
+}
+
 /* 侧边栏 Tree 样式优化 */
 .ant-tree .ant-tree-treenode {
  width: 100%;
@@ -61,13 +81,32 @@ body, #root {
 }

 .sidebar-tree-scroll-shell .ant-tree .ant-tree-node-content-wrapper {
-  width: auto !important;
-  min-width: 0;
+  width: max-content !important;
+  min-width: 100%;
+  display: flex !important;
+  align-items: center;
+  gap: 8px;
+}
+
+.sidebar-tree-scroll-shell .ant-tree .ant-tree-switcher {
+  flex: 0 0 24px;
+  width: 24px;
+  min-width: 24px;
+}
+
+.sidebar-tree-scroll-shell .ant-tree .ant-tree-iconEle {
+  flex: 0 0 16px;
+  width: 16px;
+  min-width: 16px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  margin-inline-end: 0;
 }

 .sidebar-tree-scroll-shell .ant-tree .ant-tree-title {
  flex: 0 0 auto;
-  min-width: 0;
+  min-width: max-content;
  overflow: visible;
  text-overflow: clip;
 }
@@ -200,6 +239,35 @@ body[data-theme='light'] ::-webkit-scrollbar-thumb:hover {
    background-clip: content-box;
 }

+.gn-query-monaco-stage .monaco-editor .suggest-details-container {
+    min-height: 260px;
+}
+
+.gn-query-monaco-stage .monaco-editor .suggest-details {
+    min-height: 260px;
+}
+
+.gn-query-monaco-stage .monaco-editor .suggest-widget .monaco-list .monaco-list-row > .contents > .main {
+    justify-content: flex-start;
+    gap: 6px;
+}
+
+.gn-query-monaco-stage .monaco-editor .suggest-widget .monaco-list .monaco-list-row > .contents > .main > .left {
+    flex: 0 1 auto;
+    min-width: 0;
+}
+
+.gn-query-monaco-stage .monaco-editor .suggest-widget .monaco-list .monaco-list-row > .contents > .main > .right {
+    flex: 1 1 auto;
+    max-width: none;
+    min-width: 0;
+}
+
+.gn-query-monaco-stage .monaco-editor .suggest-widget .monaco-list .monaco-list-row.string-label > .contents > .main > .right > .details-label {
+    display: inline !important;
+    margin-left: 0;
+}
+
 /* Ensure body background matches theme to avoid white flashes, but kept transparent for window composition */
 body {
    transition: color 0.3s;
@@ -326,35 +394,217 @@ body[data-theme='light'] .redis-viewer-workbench .ant-radio-button-wrapper-check
    color: #fff !important;
 }

-/* 驱动管理：统一关闭 antd sticky 横向条，仅保留自定义独立横向条 */
-.driver-manager-table .ant-table-sticky-scroll {
-    display: none !important;
+.driver-manager-modal .ant-modal-body {
+    background: var(--ant-color-bg-layout, #f5f5f5);
 }

-/* 仅在独立横向条激活时隐藏表格自身横向滚动条，避免出现双横向条 */
-.driver-manager-table-wrap.driver-manager-table-wrap-external-active .driver-manager-table .ant-table-content,
-.driver-manager-table-wrap.driver-manager-table-wrap-external-active .driver-manager-table .ant-table-body {
-    overflow-x: auto !important;
-    -ms-overflow-style: none;
-    scrollbar-width: none;
-}
-
-.driver-manager-table-wrap.driver-manager-table-wrap-external-active .driver-manager-table .ant-table-content::-webkit-scrollbar:horizontal,
-.driver-manager-table-wrap.driver-manager-table-wrap-external-active .driver-manager-table .ant-table-body::-webkit-scrollbar:horizontal {
-    height: 0 !important;
-}
-
-.driver-manager-table-wrap {
-    width: 100%;
-    max-width: 100%;
-    overflow-x: hidden;
-}
-
-.driver-manager-footer {
-    width: 100%;
+.driver-manager-shell {
    display: flex;
    flex-direction: column;
+    gap: 14px;
+}
+
+.driver-manager-header {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) auto;
+    gap: 16px;
+    align-items: stretch;
+    padding: 14px 16px;
+    border: 1px solid rgba(5, 5, 5, 0.08);
+    border-radius: 8px;
+    background: var(--ant-color-bg-container, #fff);
+}
+
+.driver-manager-heading {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+    min-width: 0;
+}
+
+.driver-manager-stats {
+    display: grid;
+    grid-template-columns: repeat(4, minmax(64px, 1fr));
    gap: 8px;
+    min-width: 360px;
+}
+
+.driver-manager-stat {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+    justify-content: center;
+    min-height: 58px;
+    padding: 8px 10px;
+    border: 1px solid rgba(5, 5, 5, 0.08);
+    border-radius: 8px;
+    background: rgba(5, 5, 5, 0.02);
+}
+
+.driver-manager-stat span:first-child {
+    font-size: 20px;
+    font-weight: 700;
+    line-height: 1.2;
+}
+
+.driver-manager-stat-warning span:first-child {
+    color: #d48806;
+}
+
+.driver-manager-directory-panel {
+    border: 1px solid rgba(5, 5, 5, 0.08);
+    border-radius: 8px;
+    background: var(--ant-color-bg-container, #fff);
+}
+
+.driver-manager-toolbar {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+    align-items: center;
+    justify-content: space-between;
+}
+
+.driver-manager-search {
+    min-width: 280px;
+    flex: 1 1 360px;
+}
+
+.driver-manager-toolbar-actions {
+    justify-content: flex-end;
+}
+
+.driver-manager-batch-progress-panel {
+    display: grid;
+    gap: 8px;
+    padding: 12px 14px;
+    border-radius: 8px;
+}
+
+.driver-manager-batch-progress-header,
+.driver-manager-batch-progress-meta {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px 12px;
+    align-items: center;
+    justify-content: space-between;
+    min-width: 0;
+}
+
+.driver-manager-batch-progress-header span,
+.driver-manager-batch-progress-meta span {
+    min-width: 0;
+    word-break: break-word;
+}
+
+.driver-manager-list-head {
+    display: flex;
+    justify-content: space-between;
+    gap: 12px;
+    min-height: 24px;
+}
+
+.driver-manager-list {
+    display: flex;
+    flex-direction: column;
+    gap: 10px;
+}
+
+.driver-manager-card {
+    border: 1px solid rgba(5, 5, 5, 0.08);
+    border-radius: 8px;
+    background: var(--ant-color-bg-container, #fff);
+    overflow: hidden;
+}
+
+.driver-manager-card-warning {
+    border-color: rgba(250, 173, 20, 0.35);
+}
+
+.driver-manager-card-ready {
+    border-color: rgba(82, 196, 26, 0.22);
+}
+
+.driver-manager-card-main {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) minmax(300px, 38%);
+    gap: 16px;
+    padding: 16px;
+}
+
+.driver-manager-card-info {
+    display: flex;
+    flex-direction: column;
+    gap: 10px;
+    min-width: 0;
+}
+
+.driver-manager-title-row,
+.driver-manager-meta-row {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+    align-items: center;
+    min-width: 0;
+}
+
+.driver-manager-driver-name {
+    font-size: 16px;
+}
+
+.driver-manager-meta-row {
+    row-gap: 4px;
+}
+
+.driver-manager-update-note {
+    display: grid;
+    gap: 4px;
+    padding: 10px 12px;
+    border-radius: 8px;
+    background: rgba(250, 173, 20, 0.1);
+}
+
+.driver-manager-note-text,
+.driver-manager-muted-message {
+    margin-bottom: 0 !important;
+}
+
+.driver-manager-muted-message {
+    color: var(--ant-color-text-secondary);
+}
+
+.driver-manager-card-controls {
+    display: flex;
+    flex-direction: column;
+    gap: 10px;
+    min-width: 0;
+}
+
+.driver-manager-control-block {
+    display: grid;
+    gap: 4px;
+}
+
+.driver-manager-control-label,
+.driver-manager-small-text {
+    font-size: 12px;
+}
+
+.driver-manager-version-control {
+    display: grid;
+    gap: 4px;
+}
+
+.driver-manager-version-lock {
+    line-height: 24px;
+}
+
+.driver-manager-card-actions {
+    justify-content: flex-end;
+}
+
+.driver-manager-card-actions .ant-btn {
+    min-width: 88px;
 }

 .driver-manager-footer-actions {
@@ -363,17 +613,25 @@ body[data-theme='light'] .redis-viewer-workbench .ant-radio-button-wrapper-check
    justify-content: flex-end;
 }

-.driver-manager-hscroll {
-    width: 100%;
-    height: 12px;
-    overflow-x: auto;
-    overflow-y: hidden;
-    scrollbar-gutter: stable;
-    background: transparent;
-}
+@media (max-width: 900px) {
+    .driver-manager-header,
+    .driver-manager-card-main {
+        grid-template-columns: 1fr;
+    }

-.driver-manager-hscroll-inner {
-    height: 1px;
+    .driver-manager-stats {
+        min-width: 0;
+        grid-template-columns: repeat(2, minmax(0, 1fr));
+    }
+
+    .driver-manager-card-actions {
+        justify-content: flex-start;
+    }
+
+    .driver-manager-batch-progress-header,
+    .driver-manager-batch-progress-meta {
+        justify-content: flex-start;
+    }
 }

 .security-update-action-btn.ant-btn,
@@ -419,3 +677,69 @@ body[data-theme='light'] .redis-viewer-workbench .ant-radio-button-wrapper-check
        transform: translateY(0);
    }
 }
+.gonavi-query-editor-link-hint {
+  color: #1677ff !important;
+  cursor: pointer;
+  text-decoration: underline;
+  text-decoration-style: solid;
+  text-decoration-color: currentColor;
+  text-decoration-thickness: 1px;
+  text-underline-offset: 3px;
+}
+
+.gonavi-query-editor-object-token {
+  color: #2563eb;
+}
+
+.gonavi-query-editor-column-token {
+  color: #0f766e;
+}
+
+.gonavi-query-editor-db-token {
+  color: #7c3aed;
+}
+
+body[data-theme='dark'] .gonavi-query-editor-object-token {
+  color: #7dd3fc;
+}
+
+body[data-theme='dark'] .gonavi-query-editor-link-hint {
+  color: #69b1ff !important;
+}
+
+body[data-theme='dark'] .gonavi-query-editor-column-token {
+  color: #5eead4;
+}
+
+body[data-theme='dark'] .gonavi-query-editor-db-token {
+  color: #c4b5fd;
+}
+
+.gonavi-query-editor-ai-inline-ghost {
+  color: rgba(100, 116, 139, 0.7);
+  font-style: italic;
+  pointer-events: none;
+}
+
+.gonavi-query-editor-ai-inline-ghost-overlay {
+  color: rgba(100, 116, 139, 0.7);
+  font-style: italic;
+  pointer-events: none;
+  position: absolute;
+  white-space: pre;
+  z-index: 6;
+}
+
+body[data-theme='dark'] .gonavi-query-editor-ai-inline-ghost {
+  color: rgba(203, 213, 225, 0.56);
+}
+
+body[data-theme='dark'] .gonavi-query-editor-ai-inline-ghost-overlay {
+  color: rgba(203, 213, 225, 0.56);
+}
+
+/* Legacy sidebar resize bounds — mirror v2 .gn-v2-app-sider so Ant Design inline width locks do not collapse drag range. */
+body[data-ui-version="legacy"] .ant-layout-sider {
+  min-width: 232px !important;
+  max-width: min(960px, calc(100vw - 360px)) !important;
+}
--- a/frontend/src/App.settings-center.test.ts
+++ b/frontend/src/App.settings-center.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const appSource = readFileSync(
+  fileURLToPath(new globalThis.URL('./App.tsx', import.meta.url)),
+  'utf8',
+);
+
+describe('settings center layout', () => {
+  it('uses the same split navigation shell as the tool center', () => {
+    expect(appSource).toContain("type SettingsCenterGroupKey = 'preferences' | 'services' | 'about';");
+    expect(appSource).toContain("type SettingsCenterPaneKey = 'language' | 'sidebar-metadata' | 'proxy' | 'web-auth';");
+    expect(appSource).toContain("const [activeSettingsCenterGroupKey, setActiveSettingsCenterGroupKey] = useState<SettingsCenterGroupKey>('preferences');");
+    expect(appSource).toContain("const [activeSettingsCenterPane, setActiveSettingsCenterPane] = useState<SettingsCenterPaneState | null>(null);");
+    expect(appSource).toContain('style={toolCenterModalWorkspaceStyle}');
+    expect(appSource).toContain('style={toolCenterModalSplitStyle}');
+    expect(appSource).toContain('style={toolCenterNavPanelStyle}');
+    expect(appSource).toContain('style={toolCenterNavScrollStyle}');
+    expect(appSource).toContain('style={toolCenterContentPanelStyle}');
+    expect(appSource).toContain('style={toolCenterDetailPanelStyle}');
+    expect(appSource).toContain('style={toolCenterDetailBodyStyle}');
+    expect(appSource).toContain('style={toolCenterScrollableListStyle}');
+    expect(appSource).toContain("title: t('app.settings.group.preferences.title')");
+    expect(appSource).toContain("title: t('app.settings.group.services.title')");
+    expect(appSource).toContain("title: t('app.settings.group.about.title')");
+  });
+
+  it('moves sidebar table metadata configuration into the settings center', () => {
+    expect(appSource).toContain("key: 'sidebar-metadata'");
+    expect(appSource).toContain("title: t('app.settings.sidebar_metadata.title')");
+    expect(appSource).toContain("description: t('app.settings.sidebar_metadata.description')");
+    expect(appSource).toContain("handleOpenSettingsCenterPane('preferences', 'sidebar-metadata')");
+    expect(appSource).toContain("setSidebarTableMetadataFieldSelected(");
+    expect(appSource).toContain('DndContext');
+    expect(appSource).toContain('SortableContext');
+    expect(appSource).toContain('handleSidebarMetadataDragEnd');
+    expect(appSource).toContain('sidebarTableMetadataFieldOrder');
+    expect(appSource).toContain('data-sidebar-metadata-field={field}');
+    expect(appSource).toContain("sidebarTableMetadataFields: DEFAULT_SIDEBAR_TABLE_METADATA_FIELDS");
+    expect(appSource).toContain("t('sidebar.v2_table_group_menu.display_table_rows')");
+    expect(appSource).not.toContain("setIsLanguageModalOpen(true)");
+  });
+
+  it('adds browser auth management into the services settings group', () => {
+    expect(appSource).toContain("key: 'web-auth' as const");
+    expect(appSource).toContain("title: t('app.settings.entry.web_auth.title')");
+    expect(appSource).toContain("description: t('app.settings.entry.web_auth.description')");
+    expect(appSource).toContain("handleOpenSettingsCenterPane('services', 'web-auth')");
+    expect(appSource).toContain("<WebAuthSettingsPanel");
+  });
+});
--- a/frontend/src/App.tab-display.i18n.test.ts
+++ b/frontend/src/App.tab-display.i18n.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, it } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const appSource = readFileSync(
+  fileURLToPath(new globalThis.URL('./App.tsx', import.meta.url)),
+  'utf8',
+);
+
+const tabDisplaySource = readFileSync(
+  fileURLToPath(new globalThis.URL('./utils/tabDisplay.ts', import.meta.url)),
+  'utf8',
+);
+
+describe('App tab display i18n guards', () => {
+  it('localizes the tab display settings copy and preview labels', () => {
+    [
+      'app.theme.tab_display.title',
+      'app.theme.tab_display.description',
+      'app.theme.tab_display.layout.single',
+      'app.theme.tab_display.layout.double',
+      'app.theme.tab_display.badge.current',
+      'app.theme.tab_display.row.primary',
+      'app.theme.tab_display.row.secondary',
+      'app.theme.tab_display.action.move_up',
+      'app.theme.tab_display.action.move_down',
+      'app.theme.tab_display.preview.prefix',
+      'app.theme.tab_display.preview.default_label',
+      'app.theme.tab_display.preview.secondary',
+      'app.theme.tab_display.preview.focused',
+    ].forEach((key) => {
+      expect(appSource).toContain(`t('${key}'`);
+    });
+
+    [
+      'Tab 标签展示',
+      '自定义连接名、对象类型、对象名、数据库、Schema 和 Host/IP 的展示顺序',
+      "'单行'",
+      "'双行'",
+      '当前预览：',
+      '默认标签',
+      '，副行',
+      '；当前选中',
+      '上移',
+      '下移',
+    ].forEach((legacyText) => {
+      expect(appSource).not.toContain(legacyText);
+    });
+  });
+
+  it('keeps tab display element metadata as i18n keys', () => {
+    [
+      'connection',
+      'kind',
+      'object',
+      'database',
+      'schema',
+      'host',
+    ].forEach((elementKey) => {
+      expect(tabDisplaySource).toContain(`labelKey: 'app.theme.tab_display.element.${elementKey}.label'`);
+      expect(tabDisplaySource).toContain(`descriptionKey: 'app.theme.tab_display.element.${elementKey}.description'`);
+    });
+
+    [
+      '连接名',
+      '连接简称或环境名',
+      '对象类型',
+      '对象名',
+      '当前 DB / catalog 名称',
+      '连接目标地址摘要',
+    ].forEach((legacyText) => {
+      expect(tabDisplaySource).not.toContain(legacyText);
+    });
+  });
+});
--- a/frontend/src/App.tool-center.test.ts
+++ b/frontend/src/App.tool-center.test.ts
@@ -0,0 +1,510 @@
+import { describe, expect, it } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const appSource = readFileSync(
+  fileURLToPath(new globalThis.URL('./App.tsx', import.meta.url)),
+  'utf8',
+);
+const appCss = readFileSync(
+  fileURLToPath(new globalThis.URL('./App.css', import.meta.url)),
+  'utf8',
+);
+const v2ThemeCss = readFileSync(
+  fileURLToPath(new globalThis.URL('./v2-theme.css', import.meta.url)),
+  'utf8',
+);
+const linuxCJKFontBannerSource = readFileSync(
+  fileURLToPath(new globalThis.URL('./components/LinuxCJKFontBanner.tsx', import.meta.url)),
+  'utf8',
+);
+const appUtilityStylesSource = readFileSync(
+  fileURLToPath(new globalThis.URL('./hooks/useAppUtilityStyles.tsx', import.meta.url)),
+  'utf8',
+);
+const appSidebarResizeSource = readFileSync(
+  fileURLToPath(new globalThis.URL('./hooks/useAppSidebarResize.ts', import.meta.url)),
+  'utf8',
+);
+const sidebarLayoutSource = readFileSync(
+  fileURLToPath(new globalThis.URL('./utils/sidebarLayout.ts', import.meta.url)),
+  'utf8',
+);
+
+const getGlobalShortcutCaseBlock = (action: string) => {
+  const caseToken = `case '${action}':`;
+  const start = appSource.indexOf(caseToken);
+  expect(start).toBeGreaterThan(-1);
+
+  const afterCase = appSource.slice(start + caseToken.length);
+  const nextCaseIndex = afterCase.search(/\n\s+case '[^']+':/);
+  const switchEndIndex = afterCase.indexOf("window.addEventListener('keydown', handleGlobalShortcut, true);");
+  const endIndex = nextCaseIndex >= 0 ? nextCaseIndex : switchEndIndex;
+
+  expect(endIndex).toBeGreaterThan(-1);
+  return afterCase.slice(0, endIndex);
+};
+
+describe('tool center menu entries', () => {
+  it('exposes snippet management next to shortcut management', () => {
+    expect(appSource).toContain("key: 'snippet-settings'");
+    expect(appSource).toContain("title: t('app.tools.entry.snippets.title')");
+    expect(appSource).toContain("description: t('app.tools.entry.snippets.description')");
+    expect(appSource).toContain("handleOpenToolCenterPane('workspace', 'snippet-settings')");
+    expect(appSource).toContain('gonavi:open-snippet-settings');
+    expect(appSource).toContain("setIsSnippetModalOpen(false);");
+    expect(appSource).not.toContain('setIsSnippetModalOpen(true)');
+
+    const snippetIndex = appSource.indexOf("key: 'snippet-settings'");
+    const shortcutIndex = appSource.indexOf("key: 'shortcut-settings'", snippetIndex);
+    expect(snippetIndex).toBeGreaterThan(-1);
+    expect(shortcutIndex).toBeGreaterThan(snippetIndex);
+  });
+
+  it('uses scalable side navigation for the tool center instead of horizontal segmented switching', () => {
+    expect(appSource).toContain("type ToolCenterGroupKey = 'config' | 'workflow' | 'workspace';");
+    expect(appSource).toContain("const [activeToolCenterGroupKey, setActiveToolCenterGroupKey] = useState<ToolCenterGroupKey>('config');");
+    expect(appSource).toContain("const [toolCenterBackGroupKey, setToolCenterBackGroupKey] = useState<ToolCenterGroupKey | null>(null);");
+    expect(appSource).toContain("title: t('app.tools.group.config.title')");
+    expect(appSource).toContain("title: t('app.tools.group.workflow.title')");
+    expect(appSource).toContain("title: t('app.tools.group.workspace.title')");
+    expect(appSource).toContain("toolCenterGroups.find((group) => group.key === activeToolCenterGroupKey)");
+    expect(appUtilityStylesSource).toContain("const toolCenterModalSplitStyle = useMemo<React.CSSProperties>(() => ({");
+    expect(appUtilityStylesSource).toContain("gridTemplateColumns: '232px minmax(0, 1fr)'");
+    expect(appUtilityStylesSource).toContain("const toolCenterNavPanelStyle = useMemo<React.CSSProperties>(() => ({");
+    expect(appUtilityStylesSource).toContain("const toolCenterNavScrollStyle = useMemo<React.CSSProperties>(() => ({");
+    expect(appUtilityStylesSource).toContain("const toolCenterContentPanelStyle = useMemo<React.CSSProperties>(() => ({");
+    expect(appUtilityStylesSource).toContain("const toolCenterDetailPanelStyle = useMemo<React.CSSProperties>(() => ({");
+    expect(appUtilityStylesSource).toContain("const toolCenterDetailBodyStyle = useMemo<React.CSSProperties>(() => ({");
+    expect(appSource).toContain('role="tablist" aria-orientation="vertical"');
+    expect(appSource).toContain('role="tab"');
+    expect(appSource).toContain('aria-selected={active}');
+    expect(appSource).toContain('title={`${group.title} - ${group.description}`}');
+    expect(appUtilityStylesSource).toContain("borderRight: `1px solid ${overlayTheme.divider}`");
+    expect(appSource).toContain('setActiveToolCenterPane(null);');
+    expect(appSource).toContain('group.items.length');
+    expect(appSource).toContain("const handleOpenToolCenterPane = useCallback((group: ToolCenterGroupKey, key: ToolCenterPaneKey) => {");
+    expect(appSource).toContain("const [activeToolCenterPane, setActiveToolCenterPane] = useState<ToolCenterPaneState | null>(null);");
+    expect(appSource).toContain("const handleReturnToToolCenter = useCallback((closeChild?: () => void) => {");
+    expect(appSource).toContain("t('common.back_to_previous')");
+    expect(appSource).toContain("width={1080}");
+    expect(appSource).toContain('centered');
+  });
+
+  it('keeps the tool center modal height fixed across group switches and scrolls the list area internally', () => {
+    expect(appUtilityStylesSource).toContain('const toolCenterModalContentStyle = useMemo<React.CSSProperties>(() => ({');
+    expect(appUtilityStylesSource).toContain("height: 'min(820px, calc(100vh - 64px))'");
+    expect(appUtilityStylesSource).toContain("const toolCenterModalWorkspaceStyle = useMemo<React.CSSProperties>(() => ({");
+    expect(appUtilityStylesSource).toContain("const toolCenterModalSplitStyle = useMemo<React.CSSProperties>(() => ({");
+    expect(appUtilityStylesSource).toContain("const toolCenterScrollableListStyle = useMemo<React.CSSProperties>(() => ({");
+    expect(appSource).toContain("body: { paddingTop: 8, paddingBottom: 8, overflow: 'hidden', flex: 1, minHeight: 0 }");
+    expect(appSource).toContain('style={toolCenterModalWorkspaceStyle}');
+    expect(appSource).toContain('style={toolCenterModalSplitStyle}');
+    expect(appSource).toContain('style={toolCenterNavPanelStyle}');
+    expect(appSource).toContain('style={toolCenterNavScrollStyle}');
+    expect(appSource).toContain('style={toolCenterContentPanelStyle}');
+    expect(appSource).toContain('style={toolCenterDetailPanelStyle}');
+    expect(appSource).toContain('style={toolCenterDetailBodyStyle}');
+    expect(appSource).toContain('style={toolCenterScrollableListStyle}');
+    expect(appUtilityStylesSource).toContain("overflowY: 'auto'");
+    expect(appSource).toContain("borderTop: index === 0 ? `1px solid ${overlayTheme.divider}` : 'none'");
+    expect(appSource).toContain("borderBottom: `1px solid ${overlayTheme.divider}`");
+  });
+
+  it('lets the tool center detail header own embedded tool titles', () => {
+    const renderPaneStart = appSource.indexOf('const renderToolCenterPane = () => {');
+    const renderPaneSource = appSource.slice(
+      renderPaneStart,
+      appSource.indexOf('};\n\n            return (', renderPaneStart),
+    );
+    const connectionPackageSource = renderPaneSource.slice(
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'connection-package')"),
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'data-root')"),
+    );
+    const dataRootSource = renderPaneSource.slice(
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'data-root')"),
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'security-update')"),
+    );
+    const securityUpdateSource = renderPaneSource.slice(
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'security-update')"),
+      renderPaneSource.indexOf("activeToolCenterPane.key === 'schema-compare'"),
+    );
+    const dataSyncSource = renderPaneSource.slice(
+      renderPaneSource.indexOf("activeToolCenterPane.key === 'schema-compare'"),
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'drivers')"),
+    );
+    const driverSource = renderPaneSource.slice(
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'drivers')"),
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'snippet-settings')"),
+    );
+    const snippetSource = renderPaneSource.slice(
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'snippet-settings')"),
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'shortcut-settings')"),
+    );
+    const shortcutSource = renderPaneSource.slice(
+      renderPaneSource.indexOf("if (activeToolCenterPane.key === 'shortcut-settings')"),
+      renderPaneSource.indexOf('return null;', renderPaneSource.indexOf("if (activeToolCenterPane.key === 'shortcut-settings')")),
+    );
+
+    expect(appSource).toContain('activeToolCenterPaneItem?.title ?? activeToolCenterGroup.title');
+    expect(connectionPackageSource).toContain('<ConnectionPackagePasswordModal');
+    expect(connectionPackageSource).not.toContain('renderUtilityModalTitle');
+    expect(dataRootSource).toContain('title={null}');
+    expect(dataRootSource).toContain('closable={false}');
+    expect(dataRootSource).not.toContain('renderUtilityModalTitle');
+    expect(securityUpdateSource).toContain('<SecurityUpdateSettingsModal');
+    expect(securityUpdateSource).not.toContain('renderUtilityModalTitle');
+    expect(dataSyncSource).toContain('<DataSyncModal');
+    expect(dataSyncSource).not.toContain('renderUtilityModalTitle');
+    expect(driverSource).toContain('<DriverManagerModal');
+    expect(driverSource).not.toContain('renderUtilityModalTitle');
+    expect(snippetSource).toContain('<SnippetSettingsModal');
+    expect(snippetSource).not.toContain('renderUtilityModalTitle');
+    expect(shortcutSource).toContain('title={null}');
+    expect(shortcutSource).toContain('closable={false}');
+    expect(shortcutSource).not.toContain('renderUtilityModalTitle');
+  });
+
+  it('does not render an extra top back button in the tool center detail header', () => {
+    const detailHeaderSource = appSource.slice(
+      appSource.indexOf("{activeToolCenterPane ? ("),
+      appSource.indexOf('<div style={toolCenterDetailBodyStyle}>', appSource.indexOf("{activeToolCenterPane ? (")),
+    );
+
+    expect(detailHeaderSource).toContain('activeToolCenterPaneItem?.title ?? activeToolCenterGroup.title');
+    expect(detailHeaderSource).toContain('activeToolCenterPaneItem?.description ?? activeToolCenterGroup.description');
+    expect(detailHeaderSource).not.toContain('<Button onClick={closeToolCenterPane}>');
+    expect(detailHeaderSource).not.toContain("{t('common.back_to_previous')}");
+  });
+
+  it('keeps the v2 AI entry in the sidebar and the legacy AI entry on the content edge', () => {
+    expect(appSource).toContain('onToggleAI={toggleAIPanel}');
+    expect(appSource).toContain('renderLegacyAIEdgeHandle');
+    expect(appSource).toContain('resolveLegacyAIEdgeHandleDockStyle');
+    expect(appSource).toContain('data-gonavi-legacy-ai-edge-action="true"');
+    expect(appSource).toContain('{!isV2Ui && !aiPanelVisible && (');
+    expect(appSource).toContain('{!isV2Ui && (');
+    expect(appSource).not.toContain('data-gonavi-ai-entry-action="true"');
+  });
+
+  it('keeps sidebar utility handlers stable so v2 button clicks do not repaint the workspace', () => {
+    expect(appSource).toContain('const handleOpenToolsModal = useCallback(');
+    expect(appSource).toContain('const handleOpenSettingsModal = useCallback(');
+    expect(appSource).toContain('const handleToggleLogPanel = useCallback(');
+    expect(appSource).toContain('new CustomEvent');
+    expect(appSource).toContain("'gonavi:show-sql-execution-log'");
+    expect(appSource).toContain("detail: { mode: 'open' }");
+    expect(appSource).toContain('toggleAppLogPanel();');
+    expect(appSource).toContain('const handleFocusSidebarSearch = useCallback(');
+    expect(appSource).toContain('const antdTheme = useMemo(() => ({');
+    expect(appSource).toContain('theme={antdTheme}');
+    expect(appSource).toContain('onOpenTools={handleOpenToolsModal}');
+    expect(appSource).toContain('onOpenSettings={handleOpenSettingsModal}');
+    expect(appSource).toContain('onToggleLogPanel={handleToggleLogPanel}');
+    expect(appSource).toContain('onFocusCommandSearch={handleFocusSidebarSearch}');
+    expect(appSource).not.toContain('onOpenTools={() => setIsToolsModalOpen(true)}');
+    expect(appSource).not.toContain('onOpenSettings={() => setIsSettingsModalOpen(true)}');
+    expect(appSource).not.toContain('onToggleLogPanel={() => setIsLogPanelOpen((prev) => !prev)}');
+    expect(appSource).not.toContain('sqlLogCount={sqlLogCount}');
+    expect(appSource).not.toContain('theme={{');
+    expect(appSource).not.toContain('const sqlLogs = useStore(state => state.sqlLogs);');
+  });
+
+  it('renders the shared SQL log panel only for legacy layouts', () => {
+    const logPanelIndex = appSource.indexOf('<LogPanel', appSource.indexOf('<Content'));
+    const logPanelGuardIndex = appSource.lastIndexOf('{isLogPanelOpen && (', logPanelIndex);
+    const legacyOnlyGuardIndex = appSource.lastIndexOf('{!isV2Ui && isLogPanelOpen && (', logPanelIndex);
+
+    expect(logPanelIndex).toBeGreaterThan(-1);
+    expect(logPanelGuardIndex).toBe(-1);
+    expect(legacyOnlyGuardIndex).toBeGreaterThan(-1);
+    expect(appSource).toContain('onClose={handleCloseLogPanel}');
+    expect(appSource).toContain('onResizeStart={handleLogResizeStart}');
+  });
+
+  it('lets the v2 Sidebar own the entire left layout instead of stacking legacy controls above it', () => {
+    const siderIndex = appSource.indexOf("className={isV2Ui ? 'gn-v2-app-sider' : undefined}");
+    const legacyGuardIndex = appSource.indexOf('{!isV2Ui && (', siderIndex);
+    const legacyCreateIndex = appSource.indexOf('<Button icon={<PlusOutlined />} onClick={handleCreateConnection}', legacyGuardIndex);
+    const legacyCreateTitleIndex = appSource.indexOf("title={t('connection.new')}", legacyCreateIndex);
+    const legacyQueryIndex = appSource.indexOf('<Button icon={<ConsoleSqlOutlined />} onClick={handleNewQuery}', legacyGuardIndex);
+    const legacyQueryTitleIndex = appSource.indexOf("title={t('query.new')}", legacyQueryIndex);
+    const sidebarIndex = appSource.indexOf('<Sidebar', legacyGuardIndex);
+    const floatingLogIndex = appSource.indexOf('Floating SQL Log Toggle', sidebarIndex);
+    const floatingLogGuardIndex = appSource.indexOf('{!isV2Ui && (', floatingLogIndex);
+
+    expect(siderIndex).toBeGreaterThan(-1);
+    expect(legacyGuardIndex).toBeGreaterThan(siderIndex);
+    expect(legacyCreateIndex).toBeGreaterThan(legacyGuardIndex);
+    expect(legacyCreateIndex).toBeLessThan(sidebarIndex);
+    expect(legacyCreateTitleIndex).toBeGreaterThan(legacyCreateIndex);
+    expect(legacyQueryIndex).toBeGreaterThan(legacyCreateIndex);
+    expect(legacyQueryIndex).toBeLessThan(sidebarIndex);
+    expect(legacyQueryTitleIndex).toBeGreaterThan(legacyQueryIndex);
+    expect(appSource).toContain('paddingBottom: isV2Ui ? 0 : 58');
+    expect(floatingLogIndex).toBeGreaterThan(sidebarIndex);
+    expect(floatingLogGuardIndex).toBeGreaterThan(floatingLogIndex);
+  });
+
+  it('uses the v2 green accent for sidebar and log resize guide lines', () => {
+    expect(appSource).toContain('const resizeGuideColor = isV2Ui');
+    expect(appSource).toContain("'var(--gn-accent, #16a34a)'");
+    expect(appSource).toContain("darkMode ? 'rgba(246, 196, 83, 0.55)' : 'rgba(24, 144, 255, 0.5)'");
+  });
+
+  it('keeps tool center and settings v2 accents on the green palette instead of legacy yellow or blue tokens', () => {
+    expect(appSource).toContain("const v2AntPrimaryColor = darkMode ? '#22c55e' : '#16a34a';");
+    expect(appSource).toContain("colorPrimary: isV2Ui ? v2AntPrimaryColor : (darkMode ? '#f6c453' : '#1677ff')");
+    expect(appSource).toContain("background: active\n                                  ? overlayTheme.selectedBg");
+    expect(appSource).toContain("background: active\n                                    ? overlayTheme.selectedText");
+    expect(appSource).toContain("background: active\n                                        ? overlayTheme.iconBg");
+    expect(appSource).toContain("color: active\n                                        ? overlayTheme.iconColor");
+    expect(appSource).toContain("background: isV2Ui ? v2AntPrimaryBgColor : (darkMode ? 'rgba(255,214,102,0.16)' : 'rgba(24,144,255,0.10)')");
+    expect(appSource).toContain("color: isV2Ui ? v2AntPrimaryColor : (darkMode ? '#ffd666' : '#1677ff')");
+  });
+
+  it('does not start sidebar resize from right-clicking the resize handle', () => {
+    expect(appSidebarResizeSource).toContain('if (e.button !== 0)');
+    expect(appSource).toContain('onContextMenu={(event) => {');
+    expect(appSource).toContain('event.preventDefault();');
+    expect(appSource).toContain('event.stopPropagation();');
+
+    const guardIndex = appSidebarResizeSource.indexOf('if (e.button !== 0)');
+    const ghostDisplayIndex = appSidebarResizeSource.indexOf("ghostRef.current.style.display = 'block'", guardIndex);
+    const dragStartIndex = appSidebarResizeSource.indexOf('sidebarDragRef.current = {', guardIndex);
+
+    expect(guardIndex).toBeGreaterThan(-1);
+    expect(ghostDisplayIndex).toBeGreaterThan(guardIndex);
+    expect(dragStartIndex).toBeGreaterThan(guardIndex);
+  });
+
+  it('positions sidebar resize guide from the rendered sider edge', () => {
+    expect(appSidebarResizeSource).toContain('const siderRef = useRef<HTMLDivElement | null>(null);');
+    expect(appSource).toContain('ref={siderRef}');
+    expect(appSidebarResizeSource).toContain('const siderRect = siderRef.current?.getBoundingClientRect();');
+    expect(appSidebarResizeSource).toContain('const startGuideLeft = siderRect?.right ?? sidebarWidth;');
+    expect(appSidebarResizeSource).toContain('const startWidth = siderRect?.width ?? sidebarWidth;');
+    expect(appSidebarResizeSource).toContain('resolveSidebarResizeBounds(siderRef.current)');
+    expect(appSidebarResizeSource).toContain('ghostRef.current.style.left = `${startGuideLeft}px`;');
+    expect(appSidebarResizeSource).toContain('ghostRef.current.style.left = `${startGuideLeft + (newWidth - startWidth)}px`;');
+  });
+
+  it('keeps sidebar resize bounds aligned across drag logic and sider CSS limits', () => {
+    expect(sidebarLayoutSource).toContain('export const SIDEBAR_RESIZE_MAX_WIDTH = 960;');
+    expect(sidebarLayoutSource).toContain('export const SIDEBAR_MIN_WORKBENCH_WIDTH = 360;');
+    expect(appSidebarResizeSource).toContain('resolveSidebarResizeMaxWidth(window.innerWidth, minWidth)');
+    expect(appCss).toMatch(/body\[data-ui-version="legacy"\]\s+\.ant-layout-sider\s*\{[^}]*min-width:\s*232px\s*!important;[^}]*max-width:\s*min\(960px,\s*calc\(100vw - 360px\)\)\s*!important;/s);
+    expect(v2ThemeCss).toMatch(/body\[data-ui-version="v2"\]\s+\.gn-v2-app-sider\s*\{[^}]*min-width:\s*232px\s*!important;[^}]*max-width:\s*min\(960px,\s*calc\(100vw - 360px\)\)\s*!important;/s);
+  });
+
+  it('keeps connection modal warm-mounted while leaving the other heavyweight modals conditional', () => {
+    expect(appSource).toContain('const [isConnectionModalMounted, setIsConnectionModalMounted] = useState(false);');
+    expect(appSource).toContain('{isConnectionModalMounted && (');
+    expect(appSource).toContain('{isToolsModalOpen && (');
+    expect(appSource).toContain('{isSettingsModalOpen && (');
+    expect(appSource).toContain('{isThemeModalOpen && (');
+    expect(appSource).toContain('{isShortcutModalOpen && (');
+    expect(appSource).toContain('{isAISettingsOpen && (');
+    expect(appSource).toContain('{isDriverModalOpen && (');
+    expect(appSource).toContain('{isSyncModalOpen && (');
+  });
+
+  it('loads editable connection details before opening the edit modal so stored secrets can be shown', () => {
+    expect(appSource).toContain("typeof backendApp?.GetEditableSavedConnection === 'function'");
+    expect(appSource).toContain('const editableConnection = await backendApp.GetEditableSavedConnection(conn.id);');
+    expect(appSource).toContain('const errorMessage = error?.message;');
+    expect(appSource).toContain("typeof errorMessage === 'string'");
+    expect(appSource).toContain("t('app.connection.message.editable_load_failed_with_detail', { detail })");
+    expect(appSource).toContain("t('app.connection.message.editable_load_failed')");
+    expect(appSource).toContain('setEditingConnection(nextConnection);');
+    expect(appSource).toContain('setIsModalOpen(true);');
+  });
+
+  it('loads editable AI provider details before opening the edit modal so stored api keys can be shown', () => {
+    expect(appSource).toContain('<AISettingsModal');
+    const modalSource = readFileSync(new URL('./components/AISettingsModal.tsx', import.meta.url), 'utf8');
+    expect(modalSource).toContain("typeof Service?.AIGetEditableProvider === 'function'");
+    expect(modalSource).toContain('await Service.AIGetEditableProvider(p.id)');
+  });
+
+  it('keeps edit-mode passwords masked by default instead of forcing the eye toggle open', () => {
+    expect(appSource).not.toContain('setPrimaryPasswordVisible(String(config.password || "").trim() !== "")');
+  });
+
+  it('keeps shortcut manager scrolling inside the modal body', () => {
+    expect(appSource).toContain('centered');
+    expect(appSource).toContain("height: 'min(760px, calc(100vh - 80px))'");
+    expect(appSource).toContain("maxHeight: 'calc(100vh - 80px)'");
+    expect(appSource).toContain("body: { paddingTop: 8, overflow: 'hidden', flex: 1, minHeight: 0 }");
+    expect(appSource).toContain('data-gonavi-shortcut-modal-scroll="true"');
+    expect(appSource).toContain("height: '100%'");
+    expect(appSource).toContain("overflowY: 'auto'");
+  });
+
+  it('renders recorded shortcuts with platform-specific display labels', () => {
+    expect(appSource).toContain('getShortcutDisplayLabel');
+    expect(appSource).toContain('getShortcutDisplayLabel(binding.combo, activeShortcutPlatform)');
+  });
+
+  it('executes every global shortcut action exposed in the shortcut manager', () => {
+    const expectedHandlers = new Map([
+      ['runQuery', 'gonavi:run-active-query'],
+      ['focusSidebarSearch', 'gonavi:focus-sidebar-search'],
+      ['newQueryTab', 'handleNewQuery();'],
+      ['switchToNextTab', 'switchActiveTabByOffset(1);'],
+      ['switchToPreviousTab', 'switchActiveTabByOffset(-1);'],
+      ['newConnection', 'handleCreateConnection();'],
+      ['toggleAIPanel', 'toggleAIPanel();'],
+      ['toggleLogPanel', 'handleToggleLogPanel();'],
+      ['toggleTheme', 'setThemePreference('],
+      ['openShortcutManager', 'setIsShortcutModalOpen(true);'],
+      ['toggleMacFullscreen', 'handleTitleBarWindowToggle({ allowMacNativeFullscreen: true });'],
+      ['resetWindowZoom', 'handleManualResetWindowZoom();'],
+    ]);
+
+    for (const [action, handler] of expectedHandlers) {
+      expect(getGlobalShortcutCaseBlock(action)).toContain(handler);
+    }
+    expect(appSource).toContain('const switchActiveTabByOffset = useCallback((offset: 1 | -1) => {');
+    expect(appSource).toContain('const nextIndex = (baseIndex + offset + tabs.length) % tabs.length;');
+    expect(appSource).toContain('setActiveTab(tabs[nextIndex].id);');
+    expect(appSource).toContain('handleCreateConnection, handleManualResetWindowZoom');
+    expect(appSource).toContain('switchActiveTabByOffset, themeMode');
+  });
+
+  it('automatically resets WebView2 zoom when a Windows taskbar restore returns focus', () => {
+    expect(appSource).toContain('shouldResetWebViewZoomForScaleFix(reason, hasViewportScaleDrift)');
+    expect(appSource).toContain('const shouldResetWebViewZoom = shouldResetWebViewZoomForScaleFix(reason, hasViewportScaleDrift);');
+    expect(appSource).toContain('if (shouldResetWebViewZoom && !isMaximised)');
+    expect(appSource).toContain('const res = await (window as any).go?.app?.App?.ResetWebViewZoom?.();');
+    expect(appSource).toContain('if (!shouldApplyWindowsScaleFix(reason, hasViewportScaleDrift))');
+    expect(appSource).toContain('const nudgedWidth = getWindowsScaleFixNudgedWidth(width);');
+    expect(appSource).toContain('WindowSetSize(nudgedWidth, height);');
+    expect(appSource).toContain('该异常不一定表现为 viewport ratio drift');
+  });
+
+  it('captures window state on startup and lifecycle events instead of waiting only for the polling interval', () => {
+    expect(appSource).toContain('const scheduleWindowStateSave = (delayMs = 120) => {');
+    expect(appSource).toContain('const scheduleWindowBoundsRepair = (delayMs = 80) => {');
+    expect(appSource).toContain('if (hydrated) {');
+    expect(appSource).toContain('scheduleWindowBoundsRepair(360);');
+    expect(appSource).toContain('scheduleWindowStateSave(320);');
+    expect(appSource).toContain('const unsubscribeHydration = useStore.persist.onFinishHydration(() => {');
+    expect(appSource).toContain('scheduleWindowBoundsRepair();');
+    expect(appSource).toContain('scheduleWindowStateSave(260);');
+    expect(appSource).toContain("window.addEventListener('resize', handleWindowRuntimeChange);");
+    expect(appSource).toContain("window.addEventListener('focus', handleWindowRuntimeChange);");
+    expect(appSource).toContain("window.addEventListener('pageshow', handleWindowRuntimeChange);");
+    expect(appSource).toContain("window.addEventListener('pagehide', handleWindowLifecycleFlush, { capture: true });");
+    expect(appSource).toContain("window.addEventListener('beforeunload', handleWindowLifecycleFlush, { capture: true });");
+  });
+
+  it('clamps normal runtime window bounds back into the visible screen after display changes', () => {
+    expect(appSource).toContain('const readCurrentVisibleViewport = () => ({');
+    expect(appSource).toContain('const repairRuntimeWindowBounds = async () => {');
+    expect(appSource).toContain('const nextBounds = resolveVisibleStartupWindowBounds(currentBounds, readCurrentVisibleViewport());');
+    expect(appSource).toContain("void emitWindowDiagnostic('adjust:runtime-window-bounds'");
+    expect(appSource).toContain('WindowSetSize(nextBounds.width, nextBounds.height);');
+    expect(appSource).toContain('WindowSetPosition(nextBounds.x, nextBounds.y);');
+  });
+
+  it('keeps titlebar double-click on maximise while shortcuts may enter macOS fullscreen', () => {
+    expect(appSource).toContain('const handleTitleBarWindowToggle = async (options?: { allowMacNativeFullscreen?: boolean }) => {');
+    expect(appSource).toContain('const allowMacNativeFullscreen = options?.allowMacNativeFullscreen === true;');
+    expect(appSource).toContain('if (allowMacNativeFullscreen && useNativeMacWindowControls && isMacRuntime) {');
+    expect(appSource).toContain('void handleTitleBarWindowToggle({ allowMacNativeFullscreen: false });');
+    expect(getGlobalShortcutCaseBlock('toggleMacFullscreen')).toContain('handleTitleBarWindowToggle({ allowMacNativeFullscreen: true });');
+  });
+
+  it('captures global shortcuts before Monaco/editor defaults consume them', () => {
+    expect(appSource).toContain("window.addEventListener('keydown', handleGlobalShortcut, true);");
+    expect(appSource).toContain("window.removeEventListener('keydown', handleGlobalShortcut, true);");
+  });
+
+  it('skips the native mac titlebar bridge when the current runtime does not expose it', () => {
+    expect(appSource).toContain("const backendApp = (window as any).go?.app?.App;");
+    expect(appSource).toContain("if (typeof backendApp?.SetMacNativeWindowControls !== 'function') {");
+    expect(appSource).toContain('void safeWindowRuntimeCall(() => SetMacNativeWindowControls(useNativeMacWindowControls), undefined);');
+  });
+
+  it('listens for command search query-tab events and routes them through handleNewQuery', () => {
+    expect(appSource).toContain("window.addEventListener('gonavi:create-query-tab', handleCreateQueryTabEvent as EventListener);");
+    expect(appSource).toContain("window.removeEventListener('gonavi:create-query-tab', handleCreateQueryTabEvent as EventListener);");
+    expect(appSource).toContain('const handleCreateQueryTabEvent = () => {');
+    expect(appSource).toContain('handleNewQuery();');
+  });
+});
+
+describe('global appearance tokens', () => {
+  it('publishes v2 font and scale variables for non-AntD chrome', () => {
+    expect(appSource).toContain("setProperty('--gonavi-font-size'");
+    expect(appSource).toContain("setProperty('--gn-ui-scale'");
+    expect(appSource).toContain("setProperty('--gn-font-size'");
+    expect(appSource).toContain("setProperty('--gn-font-size-sm'");
+    expect(appSource).toContain("setProperty('--gn-font-size-xs'");
+    expect(appSource).toContain("setProperty('--gn-font-size-mono'");
+    expect(appSource).toContain("setProperty('--gn-data-table-font-size'");
+    expect(appSource).toContain("setProperty('--gn-sidebar-tree-font-size'");
+    expect(appSource).toContain("setProperty('--gn-sidebar-rail-scale'");
+    expect(appSource).toContain("setProperty('--gn-control-height'");
+    expect(appSource).toContain("setProperty('--gn-control-height-sm'");
+    expect(appSource).toContain('fontFamily: resolvedUiFontFamily');
+    expect(appSource).toContain('fontFamilyCode: resolvedMonoFontFamily');
+    expect(appSource).toContain('const effectiveSidebarRailScale = sanitizeV2SidebarRailScale(appearance.v2SidebarRailScale);');
+    expect(appSource).toContain("t('app.theme.appearance.sidebar_rail_scale_title')");
+    expect(appSource).toContain("t('app.theme.appearance.sidebar_rail_scale_hint')");
+    expect(appSource).toContain('v2SidebarRailScale: sanitizeV2SidebarRailScale(value)');
+    expect(appSource).toContain("t('app.theme.data_table.font_size')");
+    expect(appSource).toContain("t('app.theme.data_table.sidebar_tree_font_size')");
+    expect(v2ThemeCss).toContain('--gn-sidebar-rail-scale');
+    expect(v2ThemeCss).toContain('font-size: calc(var(--gn-font-size-sm, 12px) * var(--gn-sidebar-rail-scale, 1));');
+    expect(v2ThemeCss).toContain('width: calc(38px * var(--gn-v2-rail-scale));');
+    expect(appSource).toContain("const tableDoubleClickAction = appearance.tableDoubleClickAction === 'open-design' ? 'open-design' : 'open-data';");
+    expect(appSource).toContain("t('app.theme.data_table.table_double_click_action')");
+    expect(appSource).toContain("t('app.theme.data_table.table_double_click_action.open_data')");
+    expect(appSource).toContain("t('app.theme.data_table.table_double_click_action.open_design')");
+    expect(appSource).toContain("t('app.theme.data_table.table_double_click_action_hint')");
+    expect(appSource).toContain("setAppearance({ tableDoubleClickAction: value as 'open-data' | 'open-design' })");
+    expect(appSource).toContain('buildFontFamilyOptions(runtimePlatform, \'ui\', installedFontFamilies, t)');
+    expect(appSource).toContain('buildFontFamilyOptions(runtimePlatform, \'mono\', installedFontFamilies, t)');
+    expect(appSource).toContain('ListInstalledFontFamilies()');
+    expect(appSource).toContain('const [installedFontFamilies, setInstalledFontFamilies] = useState<InstalledFontFamily[]>(EMPTY_INSTALLED_FONT_FAMILIES);');
+    expect(appSource).toContain("import LinuxCJKFontBanner from './components/LinuxCJKFontBanner';");
+    expect(appSource).toContain('<LinuxCJKFontBanner');
+    expect(linuxCJKFontBannerSource).toContain('data-gonavi-linux-cjk-font-banner="true"');
+    expect(linuxCJKFontBannerSource).toContain('useI18n');
+    expect(linuxCJKFontBannerSource).toContain("t('app.linux_cjk_font_banner.title')");
+    expect(linuxCJKFontBannerSource).toContain("t('app.linux_cjk_font_banner.description')");
+    expect(linuxCJKFontBannerSource).toContain("t('app.linux_cjk_font_banner.action.open_font_settings')");
+    expect(linuxCJKFontBannerSource).toContain("t('common.close')");
+    expect(linuxCJKFontBannerSource).not.toContain('Linux CJK fonts missing / Ubuntu 中文字体缺失');
+    expect(linuxCJKFontBannerSource).not.toContain('Chinese text may render as');
+    expect(linuxCJKFontBannerSource).not.toContain('Font Settings');
+    expect(appSource).toContain("t('app.theme.font_family.linux_cjk_install_prefix')");
+    expect(appSource).toContain("t('app.theme.font_family.linux_cjk_install_suffix')");
+    expect(appSource).toContain("t('app.theme.query_template.title')");
+    expect(appSource).toContain("t('app.theme.query_template.description')");
+    expect(appSource).toContain("t('app.theme.query_template.hint')");
+    expect(appSource).toContain("t('app.theme.query_template.reset_default')");
+    expect(appSource).toContain("const newQuerySqlTemplate = appearance.newQuerySqlTemplate ?? DEFAULT_QUERY_TEMPLATE;");
+    expect(appSource).toContain("onChange={(event) => setAppearance({ newQuerySqlTemplate: event.target.value })}");
+    expect(appSource).toContain("onClick={() => setAppearance({ newQuerySqlTemplate: null })}");
+    expect(appSource).not.toContain('Ubuntu/Linux 未检测到中文 CJK 字体');
+    expect(appSource).not.toContain('，然后重启 GoNavi。');
+    expect(appSource).not.toContain('新建查询默认 SQL');
+    expect(appSource).not.toContain('清空后新建查询将保持空白');
+    expect(appSource).toContain('setIsLinuxCJKFontBannerDismissed(true)');
+    expect(appSource).toContain('matchFontFamilyOption');
+    expect(appSource).toContain('showSearch');
+    expect(appSource).toContain('const dataTableFontSizeFollowsGlobal = appearance.dataTableFontSizeFollowGlobal !== false;');
+    expect(appSource).toContain('const sidebarTreeFontSizeFollowsGlobal = appearance.sidebarTreeFontSizeFollowGlobal !== false;');
+    expect(appSource).toContain('disabled={dataTableFontSizeFollowsGlobal}');
+    expect(appSource).toContain('disabled={sidebarTreeFontSizeFollowsGlobal}');
+    expect(appSource).toContain("type={dataTableFontSizeFollowsGlobal ? 'primary' : 'default'}");
+    expect(appSource).toContain("type={sidebarTreeFontSizeFollowsGlobal ? 'primary' : 'default'}");
+    expect(appSource).toContain('dataTableFontSizeFollowGlobal: !dataTableFontSizeFollowsGlobal');
+    expect(appSource).toContain('sidebarTreeFontSizeFollowGlobal: !sidebarTreeFontSizeFollowsGlobal');
+    expect(appSource).toContain('dataTableFontSize: dataTableFontSizeFollowsGlobal');
+    expect(appSource).toContain('sidebarTreeFontSize: sidebarTreeFontSizeFollowsGlobal');
+  });
+});
--- a/frontend/src/App.tools-entry.i18n.test.ts
+++ b/frontend/src/App.tools-entry.i18n.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const appSource = readFileSync(
+  fileURLToPath(new globalThis.URL('./App.tsx', import.meta.url)),
+  'utf8',
+);
+
+describe('App tools entry i18n guards', () => {
+  it('localizes compare tool entry titles and descriptions', () => {
+    expect(appSource).toContain("t('app.tools.entry.schema_compare.title')");
+    expect(appSource).toContain("t('app.tools.entry.schema_compare.description')");
+    expect(appSource).toContain("t('app.tools.entry.data_compare.title')");
+    expect(appSource).toContain("t('app.tools.entry.data_compare.description')");
+
+    expect(appSource).not.toContain("title: '表结构比对'");
+    expect(appSource).not.toContain("description: '对比源表与目标表结构差异，只预览不执行。'");
+    expect(appSource).not.toContain("title: '数据比对'");
+    expect(appSource).not.toContain("description: '按主键分析新增、更新、删除和相同行。'");
+  });
+});
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				<svg width="163" height="40" fill="none" xmlns="http://www.w3.org/2000/svg"><mask id="prefix__a" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="0" y="2" width="53" height="36"><path d="M52.503 2.501H.003v35h52.5v-35z" fill="#fff"/></mask><g mask="url(#prefix__a)"><path d="M17.503 2.501c-9.665 0-17.5 7.835-17.5 17.5s7.835 17.5 17.5 17.5 17.5-7.835 17.5-17.5-7.835-17.5-17.5-17.5z" fill="#327EFF"/><path d="M35.003 2.501c-9.665 0-17.5 7.835-17.5 17.5s7.835 17.5 17.5 17.5 17.5-7.834 17.5-17.5c0-9.665-7.835-17.5-17.5-17.5z" fill="#FFDE2D"/><path d="M17.503 20.002c0-9.665 7.835-17.5 17.5-17.5v17.5h-17.5z" fill="#FF6446"/><path d="M35.003 20.001c0 9.665-7.835 17.5-17.5 17.5v-17.5h17.5z" fill="#FF6446"/></g><path d="M68.543 30.45c-6.03 0-10.32-4.65-10.32-11.1 0-6.36 3.96-11.22 10.29-11.22 5.28 0 8.4 3.15 8.85 7.23h-4.32c-.39-2.16-2.01-3.57-4.53-3.57-3.96 0-5.85 3.3-5.85 7.56 0 4.38 2.28 7.53 5.88 7.53 2.55 0 4.35-1.53 4.62-3.78h4.26a7.596 7.596 0 01-2.37 5.07c-1.47 1.38-3.54 2.28-6.51 2.28zM83.41 8.55v8.07h.09c1.11-1.62 2.37-2.43 4.47-2.43 3.18 0 5.31 2.4 5.31 5.76V30H89.2v-9.45c0-1.65-.96-2.82-2.67-2.82-1.8 0-3.12 1.44-3.12 3.54V30h-4.08V8.55h4.08zm16.315 6.06v2.46h.09c.93-1.74 1.98-2.64 3.78-2.64.45 0 .72.03.96.12v3.57h-.09c-2.67-.27-4.59 1.14-4.59 4.38V30h-4.08V14.61h3.93zm13.438 15.84c-4.77 0-8.04-3.54-8.04-8.13 0-4.59 3.27-8.13 8.04-8.13s8.04 3.54 8.04 8.13c0 4.59-3.27 8.13-8.04 8.13zm0-3.12c2.49 0 3.9-2.01 3.9-5.01s-1.41-5.04-3.9-5.04c-2.52 0-3.9 2.04-3.9 5.04s1.38 5.01 3.9 5.01zM123.1 30V14.61h3.93v2.07h.09c.84-1.41 2.34-2.49 4.47-2.49 1.95 0 3.51 1.08 4.26 2.7h.06c1.05-1.68 2.67-2.7 4.62-2.7 3.24 0 5.07 2.1 5.07 5.46V30h-4.08v-9.66c0-1.74-.87-2.64-2.37-2.64-1.71 0-2.76 1.32-2.76 3.36V30h-4.08v-9.66c0-1.74-.87-2.64-2.37-2.64-1.65 0-2.76 1.32-2.76 3.36V30h-4.08zm34.71 0c-.24-.3-.39-1.02-.48-1.71h-.06c-.78 1.17-1.89 2.07-4.53 2.07-3.15 0-5.37-1.65-5.37-4.71 0-3.39 2.76-4.47 6.18-4.95 2.55-.36 3.72-.57 3.72-1.74 0-1.11-.87-1.83-2.58-1.83-1.92 0-2.85.69-2.97 2.16h-3.63c.12-2.7 2.13-5.07 6.629-5.07 4.621 0 6.481 2.07 6.481 5.67v7.83c0 1.17.18 1.86.54 2.13V30h-3.93zm-4.08-2.49c2.34 0 3.63-1.44 3.63-2.94v-2.31c-.72.42-1.83.66-2.851.9-2.129.48-3.179.96-3.179 2.4s.96 1.95 2.4 1.95z" fill="#000"/></svg>