feat(backup): add pre-migration backup, periodic backup, backfill warning, and backup management UI

Four improvements to the database backup mechanism:

1. Auto backup before schema migration - creates a snapshot when
   upgrading from an older database version, providing a safety net
   beyond the existing SAVEPOINT rollback mechanism.

2. Periodic startup backup - checks on app launch whether the latest
   backup is older than 24 hours and creates a new one if needed,
   ensuring all users have recent backups regardless of usage patterns.

3. Backfill failure notification - switch now returns SwitchResult with
   warnings instead of silently ignoring backfill errors, so users are
   informed when their manual config changes may not have been saved.

4. Backup management UI - new BackupListSection in Settings > Data
   Management showing all backup snapshots with restore capability,
   including a confirmation dialog and automatic safety backup before
   restore.

src-tauri/src/commands/import_export.rs

@@ -8,6 +8,8 @@ use tauri_plugin_dialog::DialogExt;
 use crate::commands::sync_support::{
     post_sync_warning_from_result, run_post_import_sync, success_payload_with_warning,
 };
+use crate::database::backup::BackupEntry;
+use crate::database::Database;
 use crate::error::AppError;
 use crate::services::provider::ProviderService;
 use crate::store::AppState;
@@ -118,3 +120,24 @@ pub async fn open_zip_file_dialog<R: tauri::Runtime>(
 
     Ok(result.map(|p| p.to_string()))
 }
+
+// ─── Database backup management ─────────────────────────────
+
+/// List all database backup files
+#[tauri::command]
+pub fn list_db_backups() -> Result<Vec<BackupEntry>, String> {
+    Database::list_backups().map_err(|e| e.to_string())
+}
+
+/// Restore database from a backup file
+#[tauri::command]
+pub async fn restore_db_backup(
+    state: State<'_, AppState>,
+    filename: String,
+) -> Result<String, String> {
+    let db = state.db.clone();
+    tauri::async_runtime::spawn_blocking(move || db.restore_from_backup(&filename))
+        .await
+        .map_err(|e| format!("Restore failed: {e}"))?
+        .map_err(|e: AppError| e.to_string())
+}

src-tauri/src/commands/provider.rs

@@ -4,7 +4,9 @@ use tauri::State;
 use crate::app_config::AppType;
 use crate::error::AppError;
 use crate::provider::Provider;
-use crate::services::{EndpointLatency, ProviderService, ProviderSortUpdate, SpeedtestService};
+use crate::services::{
+    EndpointLatency, ProviderService, ProviderSortUpdate, SpeedtestService, SwitchResult,
+};
 use crate::store::AppState;
 use std::str::FromStr;
 
@@ -67,7 +69,11 @@ pub fn remove_provider_from_live_config(
         .map_err(|e| e.to_string())
 }
 
-fn switch_provider_internal(state: &AppState, app_type: AppType, id: &str) -> Result<(), AppError> {
+fn switch_provider_internal(
+    state: &AppState,
+    app_type: AppType,
+    id: &str,
+) -> Result<SwitchResult, AppError> {
     ProviderService::switch(state, app_type, id)
 }
 
@@ -76,7 +82,7 @@ pub fn switch_provider_test_hook(
     state: &AppState,
     app_type: AppType,
     id: &str,
-) -> Result<(), AppError> {
+) -> Result<SwitchResult, AppError> {
     switch_provider_internal(state, app_type, id)
 }
 
@@ -85,11 +91,9 @@ pub fn switch_provider(
     state: State<'_, AppState>,
     app: String,
     id: String,
-) -> Result<bool, String> {
+) -> Result<SwitchResult, String> {
     let app_type = AppType::from_str(&app).map_err(|e| e.to_string())?;
-    switch_provider_internal(&state, app_type, &id)
-        .map(|_| true)
-        .map_err(|e| e.to_string())
+    switch_provider_internal(&state, app_type, &id).map_err(|e| e.to_string())
 }
 
 fn import_default_config_internal(state: &AppState, app_type: AppType) -> Result<bool, AppError> {

src-tauri/src/database/backup.rs

@@ -15,6 +15,15 @@ use tempfile::NamedTempFile;
 
 const CC_SWITCH_SQL_EXPORT_HEADER: &str = "-- CC Switch SQLite 导出";
 
+/// A database backup entry for the UI
+#[derive(Debug, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct BackupEntry {
+    pub filename: String,
+    pub size_bytes: u64,
+    pub created_at: String, // ISO 8601
+}
+
 impl Database {
     /// 导出为 SQLite 兼容的 SQL 文本（内存字符串）
     pub fn export_sql_string(&self) -> Result<String, AppError> {
@@ -120,8 +129,41 @@ impl Database {
         ))
     }
 
+    /// Periodic backup: create a new backup if the latest one is older than 24 hours (or none exists)
+    pub(crate) fn periodic_backup_if_needed(&self) -> Result<(), AppError> {
+        let backup_dir = get_app_config_dir().join("backups");
+        if !backup_dir.exists() {
+            self.backup_database_file()?;
+            return Ok(());
+        }
+
+        let latest = fs::read_dir(&backup_dir).ok().and_then(|entries| {
+            entries
+                .filter_map(|e| e.ok())
+                .filter(|e| e.path().extension().map(|ext| ext == "db").unwrap_or(false))
+                .filter_map(|e| e.metadata().ok().and_then(|m| m.modified().ok()))
+                .max()
+        });
+
+        let needs_backup = match latest {
+            None => true,
+            Some(last_modified) => {
+                last_modified.elapsed().unwrap_or_default()
+                    > std::time::Duration::from_secs(24 * 3600)
+            }
+        };
+
+        if needs_backup {
+            log::info!(
+                "Periodic backup: latest backup is older than 24 hours, creating new backup"
+            );
+            self.backup_database_file()?;
+        }
+        Ok(())
+    }
+
     /// 生成一致性快照备份，返回备份文件路径（不存在主库时返回 None）
-    fn backup_database_file(&self) -> Result<Option<PathBuf>, AppError> {
+    pub(crate) fn backup_database_file(&self) -> Result<Option<PathBuf>, AppError> {
         let db_path = get_app_config_dir().join("cc-switch.db");
         if !db_path.exists() {
             return Ok(None);
@@ -333,4 +375,91 @@ impl Database {
             }
         }
     }
+
+    /// List all database backup files, sorted by creation time (newest first)
+    pub fn list_backups() -> Result<Vec<BackupEntry>, AppError> {
+        let backup_dir = get_app_config_dir().join("backups");
+        if !backup_dir.exists() {
+            return Ok(vec![]);
+        }
+
+        let mut entries: Vec<BackupEntry> = fs::read_dir(&backup_dir)
+            .map_err(|e| AppError::io(&backup_dir, e))?
+            .filter_map(|e| e.ok())
+            .filter(|e| e.path().extension().map(|ext| ext == "db").unwrap_or(false))
+            .filter_map(|e| {
+                let metadata = e.metadata().ok()?;
+                let filename = e.file_name().to_string_lossy().to_string();
+                let size_bytes = metadata.len();
+                let created_at = metadata
+                    .modified()
+                    .ok()
+                    .map(|t| {
+                        let dt: chrono::DateTime<Utc> = t.into();
+                        dt.to_rfc3339()
+                    })
+                    .unwrap_or_default();
+                Some(BackupEntry {
+                    filename,
+                    size_bytes,
+                    created_at,
+                })
+            })
+            .collect();
+
+        // Sort by created_at descending (newest first)
+        entries.sort_by(|a, b| b.created_at.cmp(&a.created_at));
+        Ok(entries)
+    }
+
+    /// Restore database from a backup file. Returns the safety backup ID.
+    pub fn restore_from_backup(&self, filename: &str) -> Result<String, AppError> {
+        // Security: validate filename to prevent path traversal
+        if filename.contains("..")
+            || filename.contains('/')
+            || filename.contains('\\')
+            || !filename.starts_with("db_backup_")
+            || !filename.ends_with(".db")
+        {
+            return Err(AppError::InvalidInput(
+                "Invalid backup filename".to_string(),
+            ));
+        }
+
+        let backup_dir = get_app_config_dir().join("backups");
+        let backup_path = backup_dir.join(filename);
+
+        if !backup_path.exists() {
+            return Err(AppError::InvalidInput(format!(
+                "Backup file not found: {filename}"
+            )));
+        }
+
+        // Step 1: Create safety backup of current database
+        let safety_backup = self.backup_database_file()?;
+        let safety_id = safety_backup
+            .and_then(|p| p.file_stem().map(|s| s.to_string_lossy().to_string()))
+            .unwrap_or_default();
+
+        // Step 2: Open the backup file and restore it to the main database
+        let source_conn =
+            Connection::open(&backup_path).map_err(|e| AppError::Database(e.to_string()))?;
+
+        {
+            let mut main_conn = lock_conn!(self.conn);
+            let backup = Backup::new(&source_conn, &mut main_conn)
+                .map_err(|e| AppError::Database(e.to_string()))?;
+            backup
+                .step(-1)
+                .map_err(|e| AppError::Database(e.to_string()))?;
+        }
+
+        // Step 3: Run schema migrations (backup may be from an older version)
+        self.create_tables()?;
+        self.apply_schema_migrations()?;
+        self.ensure_model_pricing_seeded()?;
+
+        log::info!("Database restored from backup: {filename}, safety backup: {safety_id}");
+        Ok(safety_id)
+    }
 }

src-tauri/src/database/mod.rs

@@ -23,7 +23,7 @@
 //!     └── settings.rs
 //! ```
 
-mod backup;
+pub(crate) mod backup;
 mod dao;
 mod migration;
 mod schema;
@@ -110,6 +110,22 @@ impl Database {
             conn: Mutex::new(conn),
         };
         db.create_tables()?;
+
+        // Pre-migration backup: only when upgrading from an existing database
+        {
+            let conn = lock_conn!(db.conn);
+            let version = Self::get_user_version(&conn)?;
+            drop(conn);
+            if version > 0 && version < SCHEMA_VERSION {
+                log::info!(
+                    "Creating pre-migration database backup (v{version} → v{SCHEMA_VERSION})"
+                );
+                if let Err(e) = db.backup_database_file() {
+                    log::warn!("Pre-migration backup failed, continuing migration: {e}");
+                }
+            }
+        }
+
         db.apply_schema_migrations()?;
         db.ensure_model_pricing_seeded()?;
 

src-tauri/src/lib.rs

@@ -768,6 +768,11 @@ pub fn run() {
 
                 // 检查 settings 表中的代理状态，自动恢复代理服务
                 restore_proxy_state_on_startup(&state).await;
+
+                // Periodic backup check
+                if let Err(e) = state.db.periodic_backup_if_needed() {
+                    log::warn!("Periodic backup failed on startup: {e}");
+                }
             });
 
             // Linux: 禁用 WebKitGTK 硬件加速，防止 EGL 初始化失败导致白屏
@@ -896,6 +901,8 @@ pub fn run() {
             commands::save_file_dialog,
             commands::open_file_dialog,
             commands::open_zip_file_dialog,
+            commands::list_db_backups,
+            commands::restore_db_backup,
             commands::sync_current_providers_live,
             // Deep link import
             commands::parse_deeplink,

src-tauri/src/services/mod.rs

@@ -18,7 +18,7 @@ pub use config::ConfigService;
 pub use mcp::McpService;
 pub use omo::OmoService;
 pub use prompt::PromptService;
-pub use provider::{ProviderService, ProviderSortUpdate};
+pub use provider::{ProviderService, ProviderSortUpdate, SwitchResult};
 pub use proxy::ProxyService;
 #[allow(unused_imports)]
 pub use skill::{DiscoverableSkill, Skill, SkillRepo, SkillService};

src-tauri/src/services/provider/mod.rs

@@ -38,6 +38,13 @@ use usage::validate_usage_script;
 /// Provider business logic service
 pub struct ProviderService;
 
+/// Result of a provider switch operation, including any non-fatal warnings
+#[derive(Debug, serde::Serialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct SwitchResult {
+    pub warnings: Vec<String>,
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -447,7 +454,7 @@ impl ProviderService {
     ///    c. Update database is_current (as default for new devices)
     ///    d. Write target provider config to live files
     ///    e. Sync MCP configuration
-    pub fn switch(state: &AppState, app_type: AppType, id: &str) -> Result<(), AppError> {
+    pub fn switch(state: &AppState, app_type: AppType, id: &str) -> Result<SwitchResult, AppError> {
         // Check if provider exists
         let providers = state.db.get_all_providers(app_type.as_str())?;
         let _provider = providers
@@ -519,7 +526,7 @@ impl ProviderService {
 
             // Note: No Live config write, no MCP sync
             // The proxy server will route requests to the new provider via is_current
-            return Ok(());
+            return Ok(SwitchResult::default());
         }
 
         // Normal mode: full switch with Live config write
@@ -532,7 +539,7 @@ impl ProviderService {
         app_type: AppType,
         id: &str,
         providers: &indexmap::IndexMap<String, Provider>,
-    ) -> Result<(), AppError> {
+    ) -> Result<SwitchResult, AppError> {
         let provider = providers
             .get(id)
             .ok_or_else(|| AppError::Message(format!("供应商 {id} 不存在")))?;
@@ -545,7 +552,7 @@ impl ProviderService {
                 state,
                 &crate::services::omo::STANDARD,
             )?;
-            return Ok(());
+            return Ok(SwitchResult::default());
         }
 
         if matches!(app_type, AppType::OpenCode) && provider.category.as_deref() == Some("omo-slim")
@@ -554,9 +561,11 @@ impl ProviderService {
                 .db
                 .set_omo_provider_current(app_type.as_str(), id, "omo-slim")?;
             crate::services::OmoService::write_config_to_file(state, &crate::services::omo::SLIM)?;
-            return Ok(());
+            return Ok(SwitchResult::default());
         }
 
+        let mut result = SwitchResult::default();
+
         // Backfill: Backfill current live config to current provider
         // Use effective current provider (validated existence) to ensure backfill targets valid provider
         let current_id = crate::settings::get_effective_current_provider(&state.db, &app_type)?;
@@ -570,8 +579,14 @@ impl ProviderService {
                     if let Ok(live_config) = read_live_settings(app_type.clone()) {
                         if let Some(mut current_provider) = providers.get(&current_id).cloned() {
                             current_provider.settings_config = live_config;
-                            // Ignore backfill failure, don't affect switch flow
-                            let _ = state.db.save_provider(app_type.as_str(), &current_provider);
+                            if let Err(e) =
+                                state.db.save_provider(app_type.as_str(), &current_provider)
+                            {
+                                log::warn!("Backfill failed: {e}");
+                                result
+                                    .warnings
+                                    .push(format!("backfill_failed:{current_id}"));
+                            }
                         }
                     }
                 }
@@ -593,7 +608,7 @@ impl ProviderService {
         // Sync MCP
         McpService::sync_all_enabled(state)?;
 
-        Ok(())
+        Ok(result)
     }
 
     /// Sync current provider to live configuration (re-export)