feat: 升级至 v0.3.16 — 工单修复 51 项 + 审查修复 30 项（安全加固/适配器/工具系统/数据层/前端）

electron/services/session.service.ts

@@ -175,15 +175,26 @@ export class SessionService {
 
   /**
    * 获取会话消息列表
+   *
+   * #44 修复: 添加 limit/offset 参数支持分页，避免超长会话一次性加载导致 OOM
+   *   默认不限制（limit=0），保持向后兼容；调用者可传 limit 限制返回条数
    */
-  getMessages(sessionId: string): MessageInfo[] {
+  getMessages(
+    sessionId: string,
+    options: { limit?: number; offset?: number } = {},
+  ): MessageInfo[] {
     const db = this.getDBFn();
+    const { limit = 0, offset = 0 } = options;
 
-    const rows = db.prepare(`
-      SELECT * FROM messages
-      WHERE session_id = ?
-      ORDER BY created_at ASC
-    `).all(sessionId) as MessageRow[];
+    const rows = (limit > 0
+      ? db
+          .prepare(
+            'SELECT * FROM messages WHERE session_id = ? ORDER BY created_at ASC LIMIT ? OFFSET ?',
+          )
+          .all(sessionId, limit, offset)
+      : db
+          .prepare('SELECT * FROM messages WHERE session_id = ? ORDER BY created_at ASC')
+          .all(sessionId)) as MessageRow[];
 
     return rows.map((row) => this.toMessageInfo(row));
   }
@@ -206,28 +217,34 @@ export class SessionService {
     const id = `msg_${nanoid(12)}`;
     const now = Date.now();
 
-    db.prepare(`
-      INSERT INTO messages (id, session_id, role, content, reasoning_content, tool_calls, tool_result, attachments, iteration, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(
-      id,
-      params.sessionId,
-      params.role,
-      params.content,
-      params.reasoningContent ?? null,
-      params.toolCalls ? JSON.stringify(params.toolCalls) : null,
-      params.toolResult ? JSON.stringify(params.toolResult) : null,
-      params.attachments ? JSON.stringify(params.attachments) : null,
-      params.iteration ?? null,
-      now,
-    );
+    // #34 修复: 包裹事务保证 INSERT messages 和 UPDATE sessions 原子执行
+    //   message_count = message_count + 1 已是原子 SQL 表达式（避免读-改-写竞态）
+    //   事务进一步保证消息插入和计数更新要么全部成功，要么全部回滚
+    const saveMessageTxn = db.transaction(() => {
+      db.prepare(`
+        INSERT INTO messages (id, session_id, role, content, reasoning_content, tool_calls, tool_result, attachments, iteration, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        id,
+        params.sessionId,
+        params.role,
+        params.content,
+        params.reasoningContent ?? null,
+        params.toolCalls ? JSON.stringify(params.toolCalls) : null,
+        params.toolResult ? JSON.stringify(params.toolResult) : null,
+        params.attachments ? JSON.stringify(params.attachments) : null,
+        params.iteration ?? null,
+        now,
+      );
 
-    // 更新会话的 updated_at 和 message_count
-    db.prepare(`
-      UPDATE sessions
-      SET updated_at = ?, message_count = message_count + 1
-      WHERE id = ?
-    `).run(now, params.sessionId);
+      // 更新会话的 updated_at 和 message_count
+      db.prepare(`
+        UPDATE sessions
+        SET updated_at = ?, message_count = message_count + 1
+        WHERE id = ?
+      `).run(now, params.sessionId);
+    });
+    saveMessageTxn();
 
     return {
       id,