feat: OpsxDB 桌面数据库客户端首版入库

含工作台/连库多引擎字段与 SSH·SSL、结果编辑、Redis 键浏览、
Tauri 桌面与 docs/落地页；排除本地构建产物与 sidecar 二进制。

apps/desktop/src-tauri/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "opsxdb-desktop"
+version = "0.1.0"
+description = "OpsxDB Tauri desktop shell"
+authors = ["OpsxDB"]
+edition = "2021"
+
+[lib]
+name = "opsxdb_desktop_lib"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+tauri = { version = "2", features = [] }  # path via Manager
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "blocking"] }
+tokio = { version = "1", features = ["time"] }
+url = "2"

apps/desktop/src-tauri/binaries/README.md

@@ -0,0 +1,8 @@
+# Sidecar binaries
+
+`./run.sh package` 会把 `opsxdb-server` 复制为带目标三元组后缀的文件，例如：
+
+- `opsxdb-server-aarch64-apple-darwin`
+- `opsxdb-server-x86_64-apple-darwin`
+
+Tauri `externalBin` 在构建时按当前 triple 解析。

apps/desktop/src-tauri/build.rs

@@ -0,0 +1,3 @@
+fn main() {
+    tauri_build::build()
+}

apps/desktop/src-tauri/capabilities/default.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "Default capabilities for the OpsxDB main window",
+  "windows": [
+    "main"
+  ],
+  "permissions": [
+    "core:default"
+  ]
+}

apps/desktop/src-tauri/icons/android/mipmap-anydpi-v26/ic_launcher.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+  <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
+  <background android:drawable="@color/ic_launcher_background"/>
+</adaptive-icon>

apps/desktop/src-tauri/icons/android/values/ic_launcher_background.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+  <color name="ic_launcher_background">#fff</color>
+</resources>

apps/desktop/src-tauri/icons/icon.svg

@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 512 512">
+  <rect width="512" height="512" rx="112" fill="#E11D2E"/>
+  <g transform="rotate(-20 256 256)">
+    <path d="M256 108 L290 216 L404 216 L312 286 L344 398 L256 332 L168 398 L200 286 L108 216 L222 216 Z"
+          fill="none" stroke="#FFFFFF" stroke-width="30" stroke-linejoin="round" stroke-linecap="round"/>
+  </g>
+</svg>

apps/desktop/src-tauri/src/lib.rs

@@ -0,0 +1,150 @@
+mod sidecar;
+
+use tauri::Manager;
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::time::{Duration, Instant};
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct BodySpec {
+    mode: String,
+    raw: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct HttpSpec {
+    method: String,
+    url: String,
+    #[serde(default)]
+    headers: HashMap<String, String>,
+    query: Option<HashMap<String, String>>,
+    body: Option<BodySpec>,
+    timeout_ms: Option<u64>,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct HttpResult {
+    status: u16,
+    headers: HashMap<String, String>,
+    body: String,
+    time_ms: u128,
+    size: usize,
+}
+
+#[derive(Debug, Deserialize)]
+struct WsSpec {
+    url: String,
+    protocols: Option<Vec<String>>,
+    headers: Option<HashMap<String, String>>,
+}
+
+fn validate_http_url(raw: &str) -> Result<url::Url, String> {
+    let parsed = url::Url::parse(raw).map_err(|e| format!("invalid URL: {e}"))?;
+    match parsed.scheme() {
+        "http" | "https" => {}
+        _ => return Err("only http/https schemes are allowed".into()),
+    }
+    match parsed.host_str().unwrap_or("").to_ascii_lowercase().as_str() {
+        "169.254.169.254" | "metadata.google.internal" => {
+            return Err("blocked metadata host".into())
+        }
+        _ => {}
+    }
+    Ok(parsed)
+}
+
+#[tauri::command]
+async fn http_send(spec: HttpSpec) -> Result<HttpResult, String> {
+    let mut url = validate_http_url(&spec.url)?;
+    if let Some(query) = &spec.query {
+        let mut pairs = url.query_pairs_mut();
+        for (key, value) in query {
+            pairs.append_pair(key, value);
+        }
+    }
+
+    let method = reqwest::Method::from_bytes(spec.method.as_bytes())
+        .map_err(|e| format!("invalid method: {e}"))?;
+    let timeout = Duration::from_millis(spec.timeout_ms.unwrap_or(30_000));
+    let client = reqwest::Client::builder()
+        .timeout(timeout)
+        .build()
+        .map_err(|e| e.to_string())?;
+    let mut request = client.request(method, url);
+    for (key, value) in spec.headers {
+        request = request.header(&key, &value);
+    }
+    if let Some(body) = spec.body {
+        if body.mode != "none" {
+            request = request.body(body.raw.unwrap_or_default());
+        }
+    }
+
+    let started = Instant::now();
+    let response = request.send().await.map_err(|e| e.to_string())?;
+    let status = response.status().as_u16();
+    let headers = response
+        .headers()
+        .iter()
+        .map(|(k, v)| (k.to_string(), v.to_str().unwrap_or("").to_string()))
+        .collect();
+    let bytes = response.bytes().await.map_err(|e| e.to_string())?;
+    let size = bytes.len();
+    let body = String::from_utf8_lossy(&bytes).into_owned();
+    Ok(HttpResult {
+        status,
+        headers,
+        body,
+        time_ms: started.elapsed().as_millis(),
+        size,
+    })
+}
+
+#[tauri::command]
+async fn ws_connect(spec: WsSpec) -> Result<String, String> {
+    let _ = (&spec.protocols, &spec.headers);
+    // TODO(week2): hold WebSocket sessions in managed state and emit messages.
+    Err(format!(
+        "WebSocket native tunnel is not implemented yet for {} (use browser WS in MVP)",
+        spec.url
+    ))
+}
+
+#[tauri::command]
+async fn ws_send(session_id: String, data: String) -> Result<(), String> {
+    let _ = (session_id, data);
+    Err("WebSocket native send is a Week 2 stub".into())
+}
+
+#[tauri::command]
+async fn ws_close(session_id: String) -> Result<(), String> {
+    let _ = session_id;
+    Ok(())
+}
+
+#[cfg_attr(mobile, tauri::mobile_entry_point)]
+pub fn run() {
+    tauri::Builder::default()
+        .manage(sidecar::SidecarState::default())
+        .setup(|app| {
+            let state = app.state::<sidecar::SidecarState>();
+            sidecar::ensure_backend(app.handle(), &state);
+            Ok(())
+        })
+        .invoke_handler(tauri::generate_handler![
+            http_send,
+            ws_connect,
+            ws_send,
+            ws_close
+        ])
+        .build(tauri::generate_context!())
+        .expect("error while building OpsxDB desktop")
+        .run(|app, event| {
+            let state = app.state::<sidecar::SidecarState>();
+            sidecar::on_run_event(app, &event, &state);
+        });
+}

apps/desktop/src-tauri/src/main.rs

@@ -0,0 +1,3 @@
+fn main() {
+    opsxdb_desktop_lib::run();
+}

apps/desktop/src-tauri/src/sidecar.rs

@@ -0,0 +1,108 @@
+//! 桌面启动时拉起本机 OpsxDB Gin 后端（默认 127.0.0.1:8788）。
+use std::path::PathBuf;
+use std::process::{Child, Command, Stdio};
+use std::sync::Mutex;
+use std::thread;
+use std::time::Duration;
+use tauri::{AppHandle, Manager, RunEvent};
+
+const HEALTH: &str = "http://127.0.0.1:8788/health";
+const ADDR: &str = "127.0.0.1:8788";
+
+pub struct SidecarState {
+    child: Mutex<Option<Child>>,
+}
+
+impl Default for SidecarState {
+    fn default() -> Self {
+        Self {
+            child: Mutex::new(None),
+        }
+    }
+}
+
+fn health_ok() -> bool {
+    ureq_get(HEALTH).is_ok()
+}
+
+/// 轻量 GET，避免再引 reqwest 阻塞；用 std 即可。
+fn ureq_get(url: &str) -> Result<(), ()> {
+    let Ok(resp) = reqwest::blocking::Client::builder()
+        .timeout(Duration::from_secs(1))
+        .build()
+        .and_then(|c| c.get(url).send())
+    else {
+        return Err(());
+    };
+    if resp.status().is_success() {
+        Ok(())
+    } else {
+        Err(())
+    }
+}
+
+fn candidate_bins(app: &AppHandle) -> Vec<PathBuf> {
+    let mut out = Vec::new();
+    // 打包资源：externalBin → 与可执行文件同级的 binaries 或 resource
+    if let Ok(dir) = app.path().resource_dir() {
+        out.push(dir.join("opsxdb-server"));
+        out.push(dir.join("binaries").join("opsxdb-server"));
+    }
+    if let Ok(exe) = app.path().executable_dir() {
+        out.push(exe.join("opsxdb-server"));
+        out.push(exe.join("binaries").join("opsxdb-server"));
+    }
+    // 开发态：仓库 apps/server/bin
+    out.push(PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../server/bin/opsxdb-server"));
+    out.push(PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../../apps/server/bin/opsxdb-server"));
+    out
+}
+
+fn spawn_server(bin: &PathBuf) -> std::io::Result<Child> {
+    Command::new(bin)
+        .env("OPSXDB_ADDR", ADDR)
+        .env("GIN_MODE", "release")
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()
+}
+
+pub fn ensure_backend(app: &AppHandle, state: &SidecarState) {
+    if health_ok() {
+        return;
+    }
+    for bin in candidate_bins(app) {
+        if !bin.exists() {
+            continue;
+        }
+        match spawn_server(&bin) {
+            Ok(child) => {
+                *state.child.lock().unwrap() = Some(child);
+                for _ in 0..30 {
+                    if health_ok() {
+                        return;
+                    }
+                    thread::sleep(Duration::from_millis(100));
+                }
+                return;
+            }
+            Err(_) => continue,
+        }
+    }
+}
+
+pub fn stop_backend(state: &SidecarState) {
+    if let Ok(mut g) = state.child.lock() {
+        if let Some(mut child) = g.take() {
+            let _ = child.kill();
+            let _ = child.wait();
+        }
+    }
+}
+
+pub fn on_run_event(app: &AppHandle, event: &RunEvent, state: &SidecarState) {
+    if matches!(event, RunEvent::Exit | RunEvent::ExitRequested { .. }) {
+        stop_backend(state);
+        let _ = app;
+    }
+}

apps/desktop/src-tauri/tauri.conf.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "productName": "OpsxDB",
+  "version": "0.1.0",
+  "identifier": "com.opsx.db",
+  "build": {
+    "beforeDevCommand": "bash -lc 'curl -fsS http://127.0.0.1:5174 >/dev/null 2>&1 || npm --prefix ../.. run dev:web'",
+    "devUrl": "http://127.0.0.1:5174",
+    "beforeBuildCommand": "bash -lc 'cd ../.. && VITE_OPSXDB_API=http://127.0.0.1:8788 npm run build:web'",
+    "frontendDist": "../../web/dist"
+  },
+  "app": {
+    "windows": [
+      {
+        "title": "OpsxDB",
+        "width": 1280,
+        "height": 800,
+        "minWidth": 960,
+        "minHeight": 640,
+        "resizable": true,
+        "fullscreen": false,
+        "label": "main"
+      }
+    ],
+    "security": {
+      "csp": null
+    }
+  },
+  "bundle": {
+    "active": true,
+    "targets": "all",
+    "icon": [
+      "icons/32x32.png",
+      "icons/128x128.png",
+      "icons/128x128@2x.png",
+      "icons/icon.icns",
+      "icons/icon.ico"
+    ],
+    "externalBin": [
+      "binaries/opsxdb-server"
+    ]
+  }
+}