feat: v0.5.0 审计修复版 — 类型基线重建 + 会话隔离 + SubAgent 可观测性 + 三项功能补全

P0 安全与工程基线（止血）:
- .npmrc 移除硬编码 Gitea npm 凭据，改为 GITEA_NPM_AUTH 环境变量注入（已验证未设变量时 401）
- 修复 typecheck 空操作缺陷：solution-style 根 tsconfig 改为双工程真检查（node + web），
  pre-commit 与 CI 门禁恢复拦截能力
- 修复 4 处 v0.4.1 遗留类型错误：confirmation-hook.test 枚举名 FILE_SYSTEM→FILESYSTEM、
  agent.ts VALIDATION 事件 severity 类型谓词收窄、ContextMenu.tsx 导出 attachments 类型
- 补装 v0.4.1 声明但未安装的 node-html-parser 依赖

P1 逻辑缺陷修复（跨模块边界）:
- ConfirmationHook 会话隔离：rememberedDecisions 与 pendingConfirmations 按 sessionId 隔离，
  abortSession 只清本会话 pending（修复 A 会话中断误杀 B 会话确认、拒绝记忆跨会话污染）
- SubAgent 可观测性：orchestrator 六个事件此前全项目零消费者，现接入
  ① subagent:event 生命周期广播（AgentMonitor 新增 SubAgent 状态区）
  ② SubEngine 流事件独立 TRACE 录制（sessionId=taskId 的 JSONL 文件）
- main.ts 启动链路异常兜底：初始化失败时记录日志 + 系统错误对话框 + 退出（原为白屏挂起）

P2 工程强化:
- CI：typecheck 双工程真检查；electron-test 从 experimental（continue-on-error）转正为阻塞门禁；
  GITEA_NPM_AUTH secret 注入说明
- 渲染 bundle 代码分割：单 2630KB chunk 拆为 main 557KB + vendor-react/mui/markdown/icons
  （业务代码变更不再使 vendor 缓存失效）
- database 建表 mcp_servers CHECK 直接含 streamable-http（新库不再依赖迁移 6 立即重建）

P3 功能补全:
- DeepSeek 余额显示：新增 llm:getBalance IPC + LLMSettings 余额卡片（复用适配器原死代码 getBalance）
- FTS5 会话内容搜索：messages_fts 虚表 + INSERT/UPDATE/DELETE 触发器实时同步 +
  存量库 rebuild 迁移 + sessions:searchContent IPC + Sidebar 搜索框标题∪内容联合搜索
  （短语转义防 FTS 运算符注入，按会话聚合展示 snippet）
- 审计日志导出：audit:export IPC（JSONL / CSV RFC 4180 转义）+ LogsSettings 导出按钮

文档一致性大扫除:
- README：工具数统一为 28（原 26/27/30 三口径）、handlers.ts→ipc/、录制事件名更正、
  删除虚构的审计导出/归档宣称与 Schema 虚构字段、MCP 三种传输、配置 key 更正、
  项目结构树对齐实际（settings 10 文件/lib 6 文件/react-virtuoso）、clone 地址改为 Gitea、
  新增 GITEA_NPM_AUTH 配置说明、测试数 207
- 架构/构建指南/UI UX/IR 标准 4 份 HTML 设计文档同步修正（工具数、表数 10、
  磁盘文件 2 个现状注记、ipc/*.ts 路径）
- eslint.config.js 与开发规范.md 注释对齐零容忍基线与 better-sqlite3 选型

测试: 199→207 用例（新增 ConfirmationHook 跨会话隔离 5 用例 + FTS5 搜索/审计导出 8 用例）
验证: lint 0 problems / typecheck 双工程 0 errors / test:electron 207 全过 / build 成功

electron/services/__tests__/session-search.test.ts

@@ -0,0 +1,270 @@
+/**
+ * FTS5 会话内容搜索 + 审计日志导出 回归测试（v0.5.0）
+ *
+ * 覆盖：
+ * 1. messages_fts 虚表创建与触发器实时同步（INSERT / DELETE）
+ * 2. searchMessages：短语命中、跨会话聚合、FTS 运算符输入安全、snippet 生成
+ * 3. 审计导出：JSONL 行格式、CSV RFC 4180 转义（逗号/引号/换行）
+ *
+ * 运行要求：better-sqlite3 为 Electron ABI 构建，需 test:electron 模式
+ * （cross-env ELECTRON_RUN_AS_NODE=1 electron ...）执行；系统 Node 下自动跳过。
+ */
+
+import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
+
+vi.mock('electron-log', () => ({
+  default: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+}));
+
+import { mkdtempSync, rmSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+
+let dbAvailable = true;
+let Database: typeof import('better-sqlite3');
+try {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  Database = require('better-sqlite3');
+  const probe = new Database(':memory:');
+  probe.close();
+} catch {
+  dbAvailable = false;
+}
+
+describe.skipIf(!dbAvailable)('FTS5 会话内容搜索', () => {
+  let db: any;
+  let dir: string;
+  let sessionService: any;
+
+  beforeAll(async () => {
+    const { SessionService } = await import('../session.service');
+    dir = mkdtempSync(join(tmpdir(), 'metona-search-'));
+    db = new Database(':memory:');
+    // 与 DatabaseService.createTables 一致的最小 schema（含 FTS 虚表 + 触发器）
+    db.exec(`
+      CREATE TABLE sessions (
+        id TEXT PRIMARY KEY,
+        title TEXT DEFAULT '新会话',
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        message_count INTEGER DEFAULT 0,
+        pinned INTEGER DEFAULT 0,
+        archived INTEGER DEFAULT 0,
+        metadata TEXT DEFAULT '{}'
+      );
+      CREATE TABLE messages (
+        id TEXT PRIMARY KEY,
+        session_id TEXT NOT NULL,
+        role TEXT NOT NULL,
+        content TEXT,
+        created_at INTEGER NOT NULL
+      );
+      CREATE VIRTUAL TABLE messages_fts USING fts5(
+        content,
+        content=messages,
+        content_rowid=rowid
+      );
+      CREATE TRIGGER messages_fts_insert AFTER INSERT ON messages BEGIN
+        INSERT INTO messages_fts(rowid, content) VALUES (new.rowid, new.content);
+      END;
+      CREATE TRIGGER messages_fts_delete AFTER DELETE ON messages BEGIN
+        INSERT INTO messages_fts(messages_fts, rowid, content) VALUES ('delete', old.rowid, old.content);
+      END;
+    `);
+    sessionService = new SessionService(() => db);
+  });
+
+  afterAll(() => {
+    try {
+      db?.close();
+    } catch {
+      /* ignore */
+    }
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  const insertMessage = (
+    id: string,
+    sessionId: string,
+    role: string,
+    content: string | null,
+    ts: number,
+  ): void => {
+    db.prepare(
+      `INSERT INTO messages (id, session_id, role, content, created_at) VALUES (?, ?, ?, ?, ?)`,
+    ).run(id, sessionId, role, content, ts);
+  };
+
+  it('FTS5 可用且插入消息实时进入索引', () => {
+    // FTS5 编译可用性（better-sqlite3 预编译含 FTS5，此处防御性验证）
+    insertMessage('m1', 's1', 'user', 'Hello FTS5 world', 1000);
+    const rows = db
+      .prepare(`SELECT COUNT(*) AS c FROM messages_fts WHERE messages_fts MATCH 'hello'`)
+      .all() as Array<{ c: number }>;
+    expect(rows[0].c).toBe(1);
+  });
+
+  it('searchMessages 按会话聚合返回（最新匹配 + 匹配计数 + snippet）', () => {
+    db.prepare(
+      `INSERT INTO sessions (id, title, created_at, updated_at) VALUES ('s1', '会话一', 1, 1)`,
+    ).run();
+    db.prepare(
+      `INSERT INTO sessions (id, title, created_at, updated_at) VALUES ('s2', '会话二', 1, 1)`,
+    ).run();
+    insertMessage('m2', 's1', 'assistant', 'uniquekeyword 出现了一次', 2000);
+    insertMessage('m3', 's2', 'user', 'uniquekeyword 在另一个会话', 3000);
+    insertMessage('m4', 's2', 'assistant', 'uniquekeyword 再次出现', 4000);
+
+    const results = sessionService.searchMessages('uniquekeyword');
+    expect(results).toHaveLength(2);
+    // s2 的最新匹配（m4）先返回（按时间倒序聚合）
+    expect(results[0].sessionId).toBe('s2');
+    expect(results[0].matchCount).toBe(2);
+    expect(results[0].lastMessageId).toBe('m4');
+    expect(results[0].sessionTitle).toBe('会话二');
+    expect(results[0].snippet).toContain('uniquekeyword');
+    // s1 单条匹配
+    expect(results[1].sessionId).toBe('s1');
+    expect(results[1].matchCount).toBe(1);
+  });
+
+  it('删除消息后索引同步（搜索不再命中）', () => {
+    db.prepare(`DELETE FROM messages WHERE id = 'm2'`).run();
+    const results = sessionService.searchMessages('uniquekeyword');
+    expect(results).toHaveLength(1);
+    expect(results[0].sessionId).toBe('s2');
+  });
+
+  it('FTS 运算符/引号输入安全（不抛错，按短语匹配）', () => {
+    insertMessage('m5', 's1', 'user', '包含 AND OR NOT 与 "引号" 的消息', 5000);
+    // 含 FTS 保留字与引号的查询不抛异常
+    expect(() => sessionService.searchMessages('AND OR NOT')).not.toThrow();
+    expect(() => sessionService.searchMessages('x"y')).not.toThrow();
+    // 引号内容作为短语可命中
+    const hit = sessionService.searchMessages('引号');
+    expect(hit.some((r: any) => r.lastMessageId === 'm5')).toBe(true);
+  });
+
+  it('空查询与无匹配返回空数组', () => {
+    expect(sessionService.searchMessages('')).toHaveLength(0);
+    expect(sessionService.searchMessages('   ')).toHaveLength(0);
+    expect(sessionService.searchMessages('不存在的关键词xyz')).toHaveLength(0);
+  });
+
+  it('NULL content 消息不进索引（assistant 仅有 tool_calls 场景）', () => {
+    insertMessage('m6', 's1', 'assistant', null, 6000);
+    const rows = db
+      .prepare(`SELECT COUNT(*) AS c FROM messages_fts WHERE messages_fts MATCH 'nulltest'`)
+      .all() as Array<{ c: number }>;
+    expect(rows[0].c).toBe(0);
+    // FTS 行数与 messages 行数一致（NULL 行在 FTS 中占位但不索引内容）
+    const fts = (db.prepare('SELECT COUNT(*) AS c FROM messages_fts').get() as { c: number }).c;
+    const msg = (db.prepare('SELECT COUNT(*) AS c FROM messages').get() as { c: number }).c;
+    expect(fts).toBe(msg);
+  });
+});
+
+describe.skipIf(!dbAvailable)('审计日志导出（v0.5.0）', () => {
+  let db: any;
+  let dir: string;
+  let auditService: any;
+
+  beforeAll(async () => {
+    const { AuditService } = await import('../audit.service');
+    dir = mkdtempSync(join(tmpdir(), 'metona-audit-export-'));
+    db = new Database(':memory:');
+    db.exec(`
+      CREATE TABLE audit_logs (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        session_id TEXT,
+        iteration INTEGER,
+        event_type TEXT NOT NULL,
+        actor TEXT NOT NULL DEFAULT 'system',
+        target TEXT NOT NULL,
+        details TEXT,
+        outcome TEXT,
+        duration_ms INTEGER,
+        created_at INTEGER NOT NULL,
+        prev_hash TEXT,
+        current_hash TEXT
+      );
+    `);
+    auditService = new AuditService(() => db);
+  });
+
+  afterAll(() => {
+    try {
+      db?.close();
+    } catch {
+      /* ignore */
+    }
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  it('exportJSONL 每行一条 JSON 记录（含链式哈希字段）', () => {
+    auditService.log({
+      sessionId: 's1',
+      eventType: 'tool_call',
+      actor: 'agent',
+      target: 'run_command',
+      details: { command: 'ls' },
+      outcome: 'success',
+      durationMs: 10,
+    });
+    auditService.log({
+      sessionId: 's1',
+      eventType: 'session_end',
+      actor: 'agent',
+      target: 'session',
+      outcome: 'success',
+    });
+
+    const jsonl = auditService.exportJSONL();
+    const lines = jsonl.trim().split('\n');
+    expect(lines).toHaveLength(2);
+    const first = JSON.parse(lines[0]);
+    expect(first.event_type).toBe('tool_call');
+    expect(first.session_id).toBe('s1');
+    expect(first.current_hash).toMatch(/^[0-9a-f]{64}$/);
+    // 第二条 prev_hash 等于第一条 current_hash（链完整保留在导出中）
+    const second = JSON.parse(lines[1]);
+    expect(second.prev_hash).toBe(first.current_hash);
+  });
+
+  it('exportCSV 含表头且 RFC 4180 转义（逗号/引号/换行字段）', () => {
+    auditService.log({
+      sessionId: 's2',
+      eventType: 'error',
+      actor: 'agent',
+      target: 'target,with,commas',
+      details: { msg: '含"双引号"和\n换行' },
+      outcome: 'error',
+    });
+
+    const csv = auditService.exportCSV();
+    const lines = csv.split('\n');
+    // 表头
+    expect(lines[0]).toBe(
+      'id,session_id,iteration,event_type,actor,target,details,outcome,duration_ms,created_at,prev_hash,current_hash',
+    );
+    // 含特殊字符的 target 字段被双引号包裹
+    expect(csv).toContain('"target,with,commas"');
+    // details 存储为 JSON 字符串（内部双引号为 \" 转义），CSV 再转义后为 \""（反斜杠保留 + 引号翻倍）
+    expect(csv).toContain('\\""双引号\\""');
+    // 记录数与 JSONL 一致
+    const parsed = auditService
+      .exportJSONL()
+      .trim()
+      .split('\n')
+      .map((l: string) => JSON.parse(l));
+    expect(parsed.length).toBeGreaterThanOrEqual(3);
+  });
+});

electron/services/audit.service.ts

@@ -37,10 +37,34 @@ function stableStringify(obj: unknown): string {
   );
 }
 
-export type AuditEventType = 'tool_call' | 'permission_check' | 'error' | 'llm_request' | 'llm_response' | 'session_start' | 'session_end' | 'config_change';
+export type AuditEventType =
+  | 'tool_call'
+  | 'permission_check'
+  | 'error'
+  | 'llm_request'
+  | 'llm_response'
+  | 'session_start'
+  | 'session_end'
+  | 'config_change';
 export type AuditActor = 'agent' | 'user' | 'system';
 export type AuditOutcome = 'success' | 'denied' | 'error';
 
+/** v0.5.0: 审计日志行类型（导出/查询共用） */
+interface AuditRecordRow {
+  id: number;
+  session_id: string;
+  iteration: number | null;
+  event_type: string;
+  actor: string;
+  target: string;
+  details: string | null;
+  outcome: string | null;
+  duration_ms: number | null;
+  created_at: number;
+  prev_hash: string | null;
+  current_hash: string | null;
+}
+
 export interface AuditEntry {
   sessionId: string;
   iteration?: number;
@@ -64,9 +88,15 @@ export class AuditService {
   private computeHash(
     prevHash: string,
     entry: {
-      sessionId: string; iteration: number | null; eventType: string;
-      actor: string; target: string; details: string | null;
-      outcome: string | null; durationMs: number | null; createdAt: number;
+      sessionId: string;
+      iteration: number | null;
+      eventType: string;
+      actor: string;
+      target: string;
+      details: string | null;
+      outcome: string | null;
+      durationMs: number | null;
+      createdAt: number;
     },
   ): string {
     // #36 修复: 使用 stableStringify 避免分隔符碰撞且保证 key 顺序稳定
@@ -94,8 +124,11 @@ export class AuditService {
   private getLastHash(): string {
     if (this.cachedLastHash !== null) return this.cachedLastHash;
     const db = this.getDB();
-    const row = db.prepare('SELECT current_hash FROM audit_logs ORDER BY id DESC LIMIT 1').get() as { current_hash: string | null } | undefined;
-    this.cachedLastHash = row?.current_hash ?? '0000000000000000000000000000000000000000000000000000000000000000';
+    const row = db.prepare('SELECT current_hash FROM audit_logs ORDER BY id DESC LIMIT 1').get() as
+      | { current_hash: string | null }
+      | undefined;
+    this.cachedLastHash =
+      row?.current_hash ?? '0000000000000000000000000000000000000000000000000000000000000000';
     return this.cachedLastHash;
   }
 
@@ -120,10 +153,12 @@ export class AuditService {
         createdAt: now,
       });
 
-      db.prepare(`
+      db.prepare(
+        `
         INSERT INTO audit_logs (session_id, iteration, event_type, actor, target, details, outcome, duration_ms, created_at, prev_hash, current_hash)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(
+      `,
+      ).run(
         entry.sessionId,
         entry.iteration ?? null,
         entry.eventType,
@@ -257,11 +292,7 @@ export class AuditService {
   /**
    * 查询审计日志
    */
-  query(filters?: {
-    sessionId?: string;
-    eventType?: AuditEventType;
-    limit?: number;
-  }): Array<{
+  query(filters?: { sessionId?: string; eventType?: AuditEventType; limit?: number }): Array<{
     id: number;
     session_id: string;
     iteration: number | null;
@@ -311,6 +342,68 @@ export class AuditService {
     }>;
   }
 
+  /**
+   * v0.5.0: 导出审计日志为 JSONL 文本（每行一条 JSON 记录）
+   *
+   * @returns JSONL 格式字符串（含全部记录，按 id 升序）
+   */
+  exportJSONL(): string {
+    const db = this.getDB();
+    const rows = db
+      .prepare(
+        'SELECT id, session_id, iteration, event_type, actor, target, details, outcome, duration_ms, created_at, prev_hash, current_hash FROM audit_logs ORDER BY id ASC',
+      )
+      .all() as AuditRecordRow[];
+    return rows.map((r) => JSON.stringify(r)).join('\n') + (rows.length > 0 ? '\n' : '');
+  }
+
+  /**
+   * v0.5.0: 导出审计日志为 CSV 文本
+   *
+   * 字段含逗号/引号/换行时按 RFC 4180 转义（双引号包裹 + 内部双引号翻倍）。
+   *
+   * @returns CSV 格式字符串（含表头，按 id 升序）
+   */
+  exportCSV(): string {
+    const db = this.getDB();
+    const rows = db
+      .prepare(
+        'SELECT id, session_id, iteration, event_type, actor, target, details, outcome, duration_ms, created_at, prev_hash, current_hash FROM audit_logs ORDER BY id ASC',
+      )
+      .all() as AuditRecordRow[];
+
+    const headers = [
+      'id',
+      'session_id',
+      'iteration',
+      'event_type',
+      'actor',
+      'target',
+      'details',
+      'outcome',
+      'duration_ms',
+      'created_at',
+      'prev_hash',
+      'current_hash',
+    ];
+    const escapeCsv = (value: string | number | null): string => {
+      const s = value === null ? '' : String(value);
+      if (/[",\r\n]/.test(s)) {
+        return `"${s.replace(/"/g, '""')}"`;
+      }
+      return s;
+    };
+    const lines = [headers.join(',')];
+    for (const r of rows) {
+      lines.push(
+        headers
+          .map((h) => escapeCsv((r as unknown as Record<string, string | number | null>)[h]))
+          .join(','),
+      );
+    }
+    return lines.join('\n') + '\n';
+  }
+
   /**
    * v0.2.0: 验证链式哈希完整性
    *
@@ -319,12 +412,30 @@ export class AuditService {
    *
    * @returns 验证结果，包括是否通过、首个篡改位置的 ID
    */
-  verifyChain(): { valid: boolean; totalRecords: number; verifiedRecords: number; tamperedId: number | null } {
+  verifyChain(): {
+    valid: boolean;
+    totalRecords: number;
+    verifiedRecords: number;
+    tamperedId: number | null;
+  } {
     const db = this.getDB();
-    const rows = db.prepare('SELECT id, session_id, iteration, event_type, actor, target, details, outcome, duration_ms, created_at, prev_hash, current_hash FROM audit_logs ORDER BY id ASC').all() as Array<{
-      id: number; session_id: string; iteration: number | null; event_type: string; actor: string;
-      target: string; details: string | null; outcome: string | null; duration_ms: number | null;
-      created_at: number; prev_hash: string | null; current_hash: string | null;
+    const rows = db
+      .prepare(
+        'SELECT id, session_id, iteration, event_type, actor, target, details, outcome, duration_ms, created_at, prev_hash, current_hash FROM audit_logs ORDER BY id ASC',
+      )
+      .all() as Array<{
+      id: number;
+      session_id: string;
+      iteration: number | null;
+      event_type: string;
+      actor: string;
+      target: string;
+      details: string | null;
+      outcome: string | null;
+      duration_ms: number | null;
+      created_at: number;
+      prev_hash: string | null;
+      current_hash: string | null;
     }>;
 
     let prevHash = '0000000000000000000000000000000000000000000000000000000000000000';
@@ -369,7 +480,12 @@ export class AuditService {
           prevHash = row.current_hash;
           continue;
         }
-        return { valid: false, totalRecords: rows.length, verifiedRecords: verified, tamperedId: row.id };
+        return {
+          valid: false,
+          totalRecords: rows.length,
+          verifiedRecords: verified,
+          tamperedId: row.id,
+        };
       }
 
       prevHash = row.current_hash;

electron/services/database.service.ts

@@ -211,10 +211,12 @@ export class DatabaseService {
       );
 
       -- ===== MCP 服务配置表 =====
+      -- v0.5.0: 建表 CHECK 直接含 streamable-http（与迁移 6 的重建后 schema 对齐，
+      -- 新库不再依赖迁移 6 立即重建一次表）
       CREATE TABLE IF NOT EXISTS mcp_servers (
         id              TEXT PRIMARY KEY,
         name            TEXT NOT NULL UNIQUE,
-        transport       TEXT NOT NULL CHECK(transport IN ('stdio', 'sse')),
+        transport       TEXT NOT NULL CHECK(transport IN ('stdio', 'sse', 'streamable-http')),
         command         TEXT,
         args            TEXT,
         url             TEXT,
@@ -305,6 +307,28 @@ export class DatabaseService {
       CREATE INDEX IF NOT EXISTS idx_tasks_session ON tasks(session_id, order_idx);
       CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(session_id, status);
       CREATE INDEX IF NOT EXISTS idx_tasks_parent ON tasks(parent_id);
+
+      -- ===== v0.5.0: 消息全文搜索（FTS5 外内容表模式，content 列索引） =====
+      -- 会话内容搜索通过 sessions:searchContent IPC 使用 MATCH 查询；
+      -- 触发器保持索引与 messages 表实时同步（INSERT/UPDATE/DELETE）
+      CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
+        content,
+        content=messages,
+        content_rowid=rowid
+      );
+
+      CREATE TRIGGER IF NOT EXISTS messages_fts_insert AFTER INSERT ON messages BEGIN
+        INSERT INTO messages_fts(rowid, content) VALUES (new.rowid, new.content);
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS messages_fts_delete AFTER DELETE ON messages BEGIN
+        INSERT INTO messages_fts(messages_fts, rowid, content) VALUES ('delete', old.rowid, old.content);
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS messages_fts_update AFTER UPDATE ON messages BEGIN
+        INSERT INTO messages_fts(messages_fts, rowid, content) VALUES ('delete', old.rowid, old.content);
+        INSERT INTO messages_fts(rowid, content) VALUES (new.rowid, new.content);
+      END;
     `);
 
     // 审计日志防篡改触发器（INSERT-ONLY）
@@ -414,6 +438,28 @@ export class DatabaseService {
         // 非致命 — 迁移失败时仅无法添加 streamable-http 服务器，stdio/sse 不受影响
       }
 
+      // v0.5.0 迁移 7: 存量库 FTS 索引回填
+      // messages_fts 虚表由 createTables 创建（IF NOT EXISTS），但升级到 v0.5.0 的存量库
+      // 已有消息不会自动进入索引（触发器只覆盖新写入）。行数不一致时执行 rebuild 全量回填。
+      try {
+        const ftsCount = db.prepare('SELECT COUNT(*) AS c FROM messages_fts').get() as {
+          c: number;
+        };
+        const msgCount = db.prepare('SELECT COUNT(*) AS c FROM messages').get() as { c: number };
+        if (ftsCount.c !== msgCount.c) {
+          log.info(
+            `[DB] Migration: rebuilding messages_fts index (fts=${ftsCount.c}, messages=${msgCount.c})`,
+          );
+          db.exec(`INSERT INTO messages_fts(messages_fts) VALUES ('rebuild')`);
+          log.info('[DB] Migration: messages_fts index rebuilt successfully');
+        }
+      } catch (error) {
+        const msg = toErrorMessage(error);
+        log.warn(`[DB] Migration 7 (messages_fts rebuild) skipped: ${msg}`);
+        // 非致命 — 索引回填失败仅影响全文搜索结果完整性，不影响消息读写；
+        // 新写入的消息仍通过触发器正常进入索引
+      }
+
       // C-6 修复 迁移 5: 重建 messages 表，将 content 列从 NOT NULL 改为允许 NULL
       // @see project_memory.md — Assistant messages with tool_calls must set content to null
       // SQLite 不支持 ALTER COLUMN，需要重建表
@@ -457,13 +503,30 @@ export class DatabaseService {
             // #42 确认: idx_messages_session 已是 (session_id, created_at) 复合索引，
             //   覆盖 getMessages 的 WHERE session_id = ? ORDER BY created_at ASC 查询，
             //   工单描述"仅有 session_id 单字段索引"不准确，无需额外添加 idx_messages_session_timestamp
+            // v0.5.0: DROP TABLE messages 连带删除了 FTS 触发器，此处必须重建
             db.exec(`
-              CREATE INDEX IF NOT EXISTS idx_messages_session ON messages(session_id, created_at);
-              CREATE INDEX IF NOT EXISTS idx_messages_role ON messages(role);
-            `);
+            CREATE INDEX IF NOT EXISTS idx_messages_session ON messages(session_id, created_at);
+            CREATE INDEX IF NOT EXISTS idx_messages_role ON messages(role);
+
+            CREATE TRIGGER IF NOT EXISTS messages_fts_insert AFTER INSERT ON messages BEGIN
+              INSERT INTO messages_fts(rowid, content) VALUES (new.rowid, new.content);
+            END;
+
+            CREATE TRIGGER IF NOT EXISTS messages_fts_delete AFTER DELETE ON messages BEGIN
+              INSERT INTO messages_fts(messages_fts, rowid, content) VALUES ('delete', old.rowid, old.content);
+            END;
+
+            CREATE TRIGGER IF NOT EXISTS messages_fts_update AFTER UPDATE ON messages BEGIN
+              INSERT INTO messages_fts(messages_fts, rowid, content) VALUES ('delete', old.rowid, old.content);
+              INSERT INTO messages_fts(rowid, content) VALUES (new.rowid, new.content);
+            END;
+          `);
           });
           rebuildMessages();
 
+          // v0.5.0: 表重建后 rowid 全部重排，FTS 索引指向的旧 rowid 已失效 — 无条件全量回填
+          db.exec(`INSERT INTO messages_fts(messages_fts) VALUES ('rebuild')`);
+
           log.info('[DB] Migration: messages table rebuilt successfully (content now allows NULL)');
         }
       } catch (error) {

electron/services/session.service.ts

@@ -86,11 +86,15 @@ export class SessionService {
     const db = this.getDBFn();
     const archived = options?.archived ?? false;
 
-    const rows = db.prepare(`
+    const rows = db
+      .prepare(
+        `
       SELECT * FROM sessions
       WHERE archived = ?
       ORDER BY pinned DESC, updated_at DESC
-    `).all(archived ? 1 : 0) as SessionRow[];
+    `,
+      )
+      .all(archived ? 1 : 0) as SessionRow[];
 
     return rows.map((row) => this.toSessionInfo(row));
   }
@@ -104,10 +108,12 @@ export class SessionService {
     const now = Date.now();
     const sessionTitle = title ?? '新会话';
 
-    db.prepare(`
+    db.prepare(
+      `
       INSERT INTO sessions (id, title, created_at, updated_at)
       VALUES (?, ?, ?, ?)
-    `).run(id, sessionTitle, now, now);
+    `,
+    ).run(id, sessionTitle, now, now);
 
     log.info(`Session created: ${id} (${sessionTitle})`);
 
@@ -128,9 +134,13 @@ export class SessionService {
    */
   rename(sessionId: string, title: string): boolean {
     const db = this.getDBFn();
-    const result = db.prepare(`
+    const result = db
+      .prepare(
+        `
       UPDATE sessions SET title = ?, updated_at = ? WHERE id = ?
-    `).run(title, Date.now(), sessionId);
+    `,
+      )
+      .run(title, Date.now(), sessionId);
 
     if (result.changes > 0) {
       log.info(`Session renamed: ${sessionId} → ${title}`);
@@ -158,9 +168,13 @@ export class SessionService {
    */
   pin(sessionId: string, pinned: boolean): boolean {
     const db = this.getDBFn();
-    const result = db.prepare(`
+    const result = db
+      .prepare(
+        `
       UPDATE sessions SET pinned = ?, updated_at = ? WHERE id = ?
-    `).run(pinned ? 1 : 0, Date.now(), sessionId);
+    `,
+      )
+      .run(pinned ? 1 : 0, Date.now(), sessionId);
 
     return result.changes > 0;
   }
@@ -170,9 +184,13 @@ export class SessionService {
    */
   archive(sessionId: string, archived: boolean): boolean {
     const db = this.getDBFn();
-    const result = db.prepare(`
+    const result = db
+      .prepare(
+        `
       UPDATE sessions SET archived = ?, updated_at = ? WHERE id = ?
-    `).run(archived ? 1 : 0, Date.now(), sessionId);
+    `,
+      )
+      .run(archived ? 1 : 0, Date.now(), sessionId);
 
     return result.changes > 0;
   }
@@ -252,7 +270,9 @@ export class SessionService {
         'DELETE FROM session_summaries WHERE session_id = ? AND summarized_until_rowid >= ?',
       ).run(sessionId, anchor.rid + (inclusive ? 0 : 1));
 
-      log.info(`Session truncated: ${sessionId} (${result.changes} messages removed after ${messageId})`);
+      log.info(
+        `Session truncated: ${sessionId} (${result.changes} messages removed after ${messageId})`,
+      );
     }
     return result.changes > 0;
   }
@@ -279,10 +299,12 @@ export class SessionService {
     //   message_count = message_count + 1 已是原子 SQL 表达式（避免读-改-写竞态）
     //   事务进一步保证消息插入和计数更新要么全部成功，要么全部回滚
     const saveMessageTxn = db.transaction(() => {
-      db.prepare(`
+      db.prepare(
+        `
         INSERT INTO messages (id, session_id, role, content, reasoning_content, tool_calls, tool_result, attachments, iteration, created_at)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(
+      `,
+      ).run(
         id,
         params.sessionId,
         params.role,
@@ -296,11 +318,13 @@ export class SessionService {
       );
 
       // 更新会话的 updated_at 和 message_count
-      db.prepare(`
+      db.prepare(
+        `
         UPDATE sessions
         SET updated_at = ?, message_count = message_count + 1
         WHERE id = ?
-      `).run(now, params.sessionId);
+      `,
+      ).run(now, params.sessionId);
     });
     saveMessageTxn();
 
@@ -322,9 +346,11 @@ export class SessionService {
    */
   updateTokenUsage(sessionId: string, tokens: number): void {
     const db = this.getDBFn();
-    db.prepare(`
+    db.prepare(
+      `
       UPDATE sessions SET total_tokens = total_tokens + ? WHERE id = ?
-    `).run(tokens, sessionId);
+    `,
+    ).run(tokens, sessionId);
   }
 
   /**
@@ -342,19 +368,126 @@ export class SessionService {
   clearMessages(sessionId: string): boolean {
     const db = this.getDBFn();
     const result = db.prepare('DELETE FROM messages WHERE session_id = ?').run(sessionId);
-    db.prepare('UPDATE sessions SET message_count = 0, updated_at = ? WHERE id = ?').run(Date.now(), sessionId);
+    db.prepare('UPDATE sessions SET message_count = 0, updated_at = ? WHERE id = ?').run(
+      Date.now(),
+      sessionId,
+    );
     return result.changes > 0;
   }
 
+  /**
+   * v0.5.0: 全文搜索会话内容（FTS5）
+   *
+   * 跨会话搜索消息内容，按会话聚合返回（每个会话取最新一条匹配 + 匹配总数）。
+   * 查询词按 FTS5 短语语法转义（内部双引号翻倍 + 整体加引号），防止用户输入的
+   * FTS 运算符（AND/OR/NOT/*）导致语法错误或语义偏移。
+   *
+   * @param query 搜索关键词
+   * @param options.maxSessions 返回的会话数上限（默认 20）
+   * @param options.scanLimit 匹配行扫描上限（默认 200，避免超大结果集拖慢聚合）
+   */
+  searchMessages(
+    query: string,
+    options: { maxSessions?: number; scanLimit?: number } = {},
+  ): Array<{
+    sessionId: string;
+    sessionTitle: string;
+    matchCount: number;
+    lastMessageId: string;
+    lastRole: string;
+    snippet: string;
+    timestamp: number;
+  }> {
+    const db = this.getDBFn();
+    const { maxSessions = 20, scanLimit = 200 } = options;
+    const trimmed = query.trim();
+    if (!trimmed) return [];
+
+    // FTS5 短语转义：内部双引号翻倍，整体作为带引号短语匹配
+    const phrase = `"${trimmed.replace(/"/g, '""')}"`;
+
+    interface MatchRow {
+      id: string;
+      session_id: string;
+      role: string;
+      created_at: number;
+      snip: string;
+    }
+    let rows: MatchRow[];
+    try {
+      rows = db
+        .prepare(
+          `
+          SELECT m.id, m.session_id, m.role, m.created_at,
+                 snippet(messages_fts, 0, '[', '] ', ' … ', 12) AS snip
+          FROM messages_fts f
+          JOIN messages m ON m.rowid = f.rowid
+          WHERE messages_fts MATCH ?
+          ORDER BY m.created_at DESC
+          LIMIT ?
+        `,
+        )
+        .all(phrase, scanLimit) as MatchRow[];
+    } catch (err) {
+      log.warn('[SessionService] FTS search failed:', (err as Error).message);
+      return [];
+    }
+
+    // 按会话聚合：取每个会话的最新匹配（rows 已按时间倒序，首次出现即最新）
+    const aggregated = new Map<
+      string,
+      {
+        matchCount: number;
+        lastMessageId: string;
+        lastRole: string;
+        snippet: string;
+        timestamp: number;
+      }
+    >();
+    for (const row of rows) {
+      const existing = aggregated.get(row.session_id);
+      if (existing) {
+        existing.matchCount++;
+      } else {
+        aggregated.set(row.session_id, {
+          matchCount: 1,
+          lastMessageId: row.id,
+          lastRole: row.role,
+          snippet: row.snip,
+          timestamp: row.created_at,
+        });
+      }
+    }
+    if (aggregated.size === 0) return [];
+
+    // 补全会话标题（archived 一起搜——搜索不应因归档而缺结果）
+    const sessionIds = Array.from(aggregated.keys());
+    const placeholders = sessionIds.map(() => '?').join(',');
+    const titleRows = db
+      .prepare(`SELECT id, title FROM sessions WHERE id IN (${placeholders})`)
+      .all(...sessionIds) as Array<{ id: string; title: string }>;
+    const titleMap = new Map(titleRows.map((r) => [r.id, r.title]));
+
+    return Array.from(aggregated.entries())
+      .map(([sessionId, info]) => ({
+        sessionId,
+        sessionTitle: titleMap.get(sessionId) ?? '（已删除会话）',
+        ...info,
+      }))
+      .slice(0, maxSessions);
+  }
+
   /**
    * 保存会话的 trace 步骤和 token 用量（存入 metadata JSON）
    */
   saveTraceData(sessionId: string, data: { traceSteps: unknown[]; tokenUsage: unknown }): void {
     const db = this.getDBFn();
     const metadata = JSON.stringify({ traceSteps: data.traceSteps, tokenUsage: data.tokenUsage });
-    db.prepare(`
+    db.prepare(
+      `
       UPDATE sessions SET metadata = ?, updated_at = ? WHERE id = ?
-    `).run(metadata, Date.now(), sessionId);
+    `,
+    ).run(metadata, Date.now(), sessionId);
   }
 
   /**
@@ -362,7 +495,9 @@ export class SessionService {
    */
   getTraceData(sessionId: string): { traceSteps: unknown[]; tokenUsage: unknown } | null {
     const db = this.getDBFn();
-    const row = db.prepare('SELECT metadata FROM sessions WHERE id = ?').get(sessionId) as { metadata: string } | undefined;
+    const row = db.prepare('SELECT metadata FROM sessions WHERE id = ?').get(sessionId) as
+      | { metadata: string }
+      | undefined;
     if (!row?.metadata) return null;
     try {
       const data = JSON.parse(row.metadata);