feat: v0.5.0 审计修复版 — 类型基线重建 + 会话隔离 + SubAgent 可观测性 + 三项功能补全

P0 安全与工程基线（止血）:
- .npmrc 移除硬编码 Gitea npm 凭据，改为 GITEA_NPM_AUTH 环境变量注入（已验证未设变量时 401）
- 修复 typecheck 空操作缺陷：solution-style 根 tsconfig 改为双工程真检查（node + web），
  pre-commit 与 CI 门禁恢复拦截能力
- 修复 4 处 v0.4.1 遗留类型错误：confirmation-hook.test 枚举名 FILE_SYSTEM→FILESYSTEM、
  agent.ts VALIDATION 事件 severity 类型谓词收窄、ContextMenu.tsx 导出 attachments 类型
- 补装 v0.4.1 声明但未安装的 node-html-parser 依赖

P1 逻辑缺陷修复（跨模块边界）:
- ConfirmationHook 会话隔离：rememberedDecisions 与 pendingConfirmations 按 sessionId 隔离，
  abortSession 只清本会话 pending（修复 A 会话中断误杀 B 会话确认、拒绝记忆跨会话污染）
- SubAgent 可观测性：orchestrator 六个事件此前全项目零消费者，现接入
  ① subagent:event 生命周期广播（AgentMonitor 新增 SubAgent 状态区）
  ② SubEngine 流事件独立 TRACE 录制（sessionId=taskId 的 JSONL 文件）
- main.ts 启动链路异常兜底：初始化失败时记录日志 + 系统错误对话框 + 退出（原为白屏挂起）

P2 工程强化:
- CI：typecheck 双工程真检查；electron-test 从 experimental（continue-on-error）转正为阻塞门禁；
  GITEA_NPM_AUTH secret 注入说明
- 渲染 bundle 代码分割：单 2630KB chunk 拆为 main 557KB + vendor-react/mui/markdown/icons
  （业务代码变更不再使 vendor 缓存失效）
- database 建表 mcp_servers CHECK 直接含 streamable-http（新库不再依赖迁移 6 立即重建）

P3 功能补全:
- DeepSeek 余额显示：新增 llm:getBalance IPC + LLMSettings 余额卡片（复用适配器原死代码 getBalance）
- FTS5 会话内容搜索：messages_fts 虚表 + INSERT/UPDATE/DELETE 触发器实时同步 +
  存量库 rebuild 迁移 + sessions:searchContent IPC + Sidebar 搜索框标题∪内容联合搜索
  （短语转义防 FTS 运算符注入，按会话聚合展示 snippet）
- 审计日志导出：audit:export IPC（JSONL / CSV RFC 4180 转义）+ LogsSettings 导出按钮

文档一致性大扫除:
- README：工具数统一为 28（原 26/27/30 三口径）、handlers.ts→ipc/、录制事件名更正、
  删除虚构的审计导出/归档宣称与 Schema 虚构字段、MCP 三种传输、配置 key 更正、
  项目结构树对齐实际（settings 10 文件/lib 6 文件/react-virtuoso）、clone 地址改为 Gitea、
  新增 GITEA_NPM_AUTH 配置说明、测试数 207
- 架构/构建指南/UI UX/IR 标准 4 份 HTML 设计文档同步修正（工具数、表数 10、
  磁盘文件 2 个现状注记、ipc/*.ts 路径）
- eslint.config.js 与开发规范.md 注释对齐零容忍基线与 better-sqlite3 选型

测试: 199→207 用例（新增 ConfirmationHook 跨会话隔离 5 用例 + FTS5 搜索/审计导出 8 用例）
验证: lint 0 problems / typecheck 双工程 0 errors / test:electron 207 全过 / build 成功

electron/services/session.service.ts

@@ -86,11 +86,15 @@ export class SessionService {
     const db = this.getDBFn();
     const archived = options?.archived ?? false;
 
-    const rows = db.prepare(`
+    const rows = db
+      .prepare(
+        `
       SELECT * FROM sessions
       WHERE archived = ?
       ORDER BY pinned DESC, updated_at DESC
-    `).all(archived ? 1 : 0) as SessionRow[];
+    `,
+      )
+      .all(archived ? 1 : 0) as SessionRow[];
 
     return rows.map((row) => this.toSessionInfo(row));
   }
@@ -104,10 +108,12 @@ export class SessionService {
     const now = Date.now();
     const sessionTitle = title ?? '新会话';
 
-    db.prepare(`
+    db.prepare(
+      `
       INSERT INTO sessions (id, title, created_at, updated_at)
       VALUES (?, ?, ?, ?)
-    `).run(id, sessionTitle, now, now);
+    `,
+    ).run(id, sessionTitle, now, now);
 
     log.info(`Session created: ${id} (${sessionTitle})`);
 
@@ -128,9 +134,13 @@ export class SessionService {
    */
   rename(sessionId: string, title: string): boolean {
     const db = this.getDBFn();
-    const result = db.prepare(`
+    const result = db
+      .prepare(
+        `
       UPDATE sessions SET title = ?, updated_at = ? WHERE id = ?
-    `).run(title, Date.now(), sessionId);
+    `,
+      )
+      .run(title, Date.now(), sessionId);
 
     if (result.changes > 0) {
       log.info(`Session renamed: ${sessionId} → ${title}`);
@@ -158,9 +168,13 @@ export class SessionService {
    */
   pin(sessionId: string, pinned: boolean): boolean {
     const db = this.getDBFn();
-    const result = db.prepare(`
+    const result = db
+      .prepare(
+        `
       UPDATE sessions SET pinned = ?, updated_at = ? WHERE id = ?
-    `).run(pinned ? 1 : 0, Date.now(), sessionId);
+    `,
+      )
+      .run(pinned ? 1 : 0, Date.now(), sessionId);
 
     return result.changes > 0;
   }
@@ -170,9 +184,13 @@ export class SessionService {
    */
   archive(sessionId: string, archived: boolean): boolean {
     const db = this.getDBFn();
-    const result = db.prepare(`
+    const result = db
+      .prepare(
+        `
       UPDATE sessions SET archived = ?, updated_at = ? WHERE id = ?
-    `).run(archived ? 1 : 0, Date.now(), sessionId);
+    `,
+      )
+      .run(archived ? 1 : 0, Date.now(), sessionId);
 
     return result.changes > 0;
   }
@@ -252,7 +270,9 @@ export class SessionService {
         'DELETE FROM session_summaries WHERE session_id = ? AND summarized_until_rowid >= ?',
       ).run(sessionId, anchor.rid + (inclusive ? 0 : 1));
 
-      log.info(`Session truncated: ${sessionId} (${result.changes} messages removed after ${messageId})`);
+      log.info(
+        `Session truncated: ${sessionId} (${result.changes} messages removed after ${messageId})`,
+      );
     }
     return result.changes > 0;
   }
@@ -279,10 +299,12 @@ export class SessionService {
     //   message_count = message_count + 1 已是原子 SQL 表达式（避免读-改-写竞态）
     //   事务进一步保证消息插入和计数更新要么全部成功，要么全部回滚
     const saveMessageTxn = db.transaction(() => {
-      db.prepare(`
+      db.prepare(
+        `
         INSERT INTO messages (id, session_id, role, content, reasoning_content, tool_calls, tool_result, attachments, iteration, created_at)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(
+      `,
+      ).run(
         id,
         params.sessionId,
         params.role,
@@ -296,11 +318,13 @@ export class SessionService {
       );
 
       // 更新会话的 updated_at 和 message_count
-      db.prepare(`
+      db.prepare(
+        `
         UPDATE sessions
         SET updated_at = ?, message_count = message_count + 1
         WHERE id = ?
-      `).run(now, params.sessionId);
+      `,
+      ).run(now, params.sessionId);
     });
     saveMessageTxn();
 
@@ -322,9 +346,11 @@ export class SessionService {
    */
   updateTokenUsage(sessionId: string, tokens: number): void {
     const db = this.getDBFn();
-    db.prepare(`
+    db.prepare(
+      `
       UPDATE sessions SET total_tokens = total_tokens + ? WHERE id = ?
-    `).run(tokens, sessionId);
+    `,
+    ).run(tokens, sessionId);
   }
 
   /**
@@ -342,19 +368,126 @@ export class SessionService {
   clearMessages(sessionId: string): boolean {
     const db = this.getDBFn();
     const result = db.prepare('DELETE FROM messages WHERE session_id = ?').run(sessionId);
-    db.prepare('UPDATE sessions SET message_count = 0, updated_at = ? WHERE id = ?').run(Date.now(), sessionId);
+    db.prepare('UPDATE sessions SET message_count = 0, updated_at = ? WHERE id = ?').run(
+      Date.now(),
+      sessionId,
+    );
     return result.changes > 0;
   }
 
+  /**
+   * v0.5.0: 全文搜索会话内容（FTS5）
+   *
+   * 跨会话搜索消息内容，按会话聚合返回（每个会话取最新一条匹配 + 匹配总数）。
+   * 查询词按 FTS5 短语语法转义（内部双引号翻倍 + 整体加引号），防止用户输入的
+   * FTS 运算符（AND/OR/NOT/*）导致语法错误或语义偏移。
+   *
+   * @param query 搜索关键词
+   * @param options.maxSessions 返回的会话数上限（默认 20）
+   * @param options.scanLimit 匹配行扫描上限（默认 200，避免超大结果集拖慢聚合）
+   */
+  searchMessages(
+    query: string,
+    options: { maxSessions?: number; scanLimit?: number } = {},
+  ): Array<{
+    sessionId: string;
+    sessionTitle: string;
+    matchCount: number;
+    lastMessageId: string;
+    lastRole: string;
+    snippet: string;
+    timestamp: number;
+  }> {
+    const db = this.getDBFn();
+    const { maxSessions = 20, scanLimit = 200 } = options;
+    const trimmed = query.trim();
+    if (!trimmed) return [];
+
+    // FTS5 短语转义：内部双引号翻倍，整体作为带引号短语匹配
+    const phrase = `"${trimmed.replace(/"/g, '""')}"`;
+
+    interface MatchRow {
+      id: string;
+      session_id: string;
+      role: string;
+      created_at: number;
+      snip: string;
+    }
+    let rows: MatchRow[];
+    try {
+      rows = db
+        .prepare(
+          `
+          SELECT m.id, m.session_id, m.role, m.created_at,
+                 snippet(messages_fts, 0, '[', '] ', ' … ', 12) AS snip
+          FROM messages_fts f
+          JOIN messages m ON m.rowid = f.rowid
+          WHERE messages_fts MATCH ?
+          ORDER BY m.created_at DESC
+          LIMIT ?
+        `,
+        )
+        .all(phrase, scanLimit) as MatchRow[];
+    } catch (err) {
+      log.warn('[SessionService] FTS search failed:', (err as Error).message);
+      return [];
+    }
+
+    // 按会话聚合：取每个会话的最新匹配（rows 已按时间倒序，首次出现即最新）
+    const aggregated = new Map<
+      string,
+      {
+        matchCount: number;
+        lastMessageId: string;
+        lastRole: string;
+        snippet: string;
+        timestamp: number;
+      }
+    >();
+    for (const row of rows) {
+      const existing = aggregated.get(row.session_id);
+      if (existing) {
+        existing.matchCount++;
+      } else {
+        aggregated.set(row.session_id, {
+          matchCount: 1,
+          lastMessageId: row.id,
+          lastRole: row.role,
+          snippet: row.snip,
+          timestamp: row.created_at,
+        });
+      }
+    }
+    if (aggregated.size === 0) return [];
+
+    // 补全会话标题（archived 一起搜——搜索不应因归档而缺结果）
+    const sessionIds = Array.from(aggregated.keys());
+    const placeholders = sessionIds.map(() => '?').join(',');
+    const titleRows = db
+      .prepare(`SELECT id, title FROM sessions WHERE id IN (${placeholders})`)
+      .all(...sessionIds) as Array<{ id: string; title: string }>;
+    const titleMap = new Map(titleRows.map((r) => [r.id, r.title]));
+
+    return Array.from(aggregated.entries())
+      .map(([sessionId, info]) => ({
+        sessionId,
+        sessionTitle: titleMap.get(sessionId) ?? '（已删除会话）',
+        ...info,
+      }))
+      .slice(0, maxSessions);
+  }
+
   /**
    * 保存会话的 trace 步骤和 token 用量（存入 metadata JSON）
    */
   saveTraceData(sessionId: string, data: { traceSteps: unknown[]; tokenUsage: unknown }): void {
     const db = this.getDBFn();
     const metadata = JSON.stringify({ traceSteps: data.traceSteps, tokenUsage: data.tokenUsage });
-    db.prepare(`
+    db.prepare(
+      `
       UPDATE sessions SET metadata = ?, updated_at = ? WHERE id = ?
-    `).run(metadata, Date.now(), sessionId);
+    `,
+    ).run(metadata, Date.now(), sessionId);
   }
 
   /**
@@ -362,7 +495,9 @@ export class SessionService {
    */
   getTraceData(sessionId: string): { traceSteps: unknown[]; tokenUsage: unknown } | null {
     const db = this.getDBFn();
-    const row = db.prepare('SELECT metadata FROM sessions WHERE id = ?').get(sessionId) as { metadata: string } | undefined;
+    const row = db.prepare('SELECT metadata FROM sessions WHERE id = ?').get(sessionId) as
+      | { metadata: string }
+      | undefined;
     if (!row?.metadata) return null;
     try {
       const data = JSON.parse(row.metadata);