Webdav (#923)

* feat: WebDAV backup/restore

- Add WebDAV test/backup/restore commands and settings\n- Fix ja i18n missing keys; decode PROPFIND href as UTF-8\n- Stabilize Windows prompt auto-import tests via CC_SWITCH_TEST_HOME

* chore: format and minor cleanups

* fix: update build config

* feat(webdav): unify sync UX and hardening fixes

* fix(webdav): harden sync flow and stabilize sync UX/tests

* fix(webdav): add resource limits to skills.zip extraction

Prevent zip bomb / resource exhaustion by enforcing:
- MAX_EXTRACT_ENTRIES (10,000 files)
- MAX_EXTRACT_BYTES (512 MB cumulative)

* refactor(webdav): drop deviceId and display deviceName only

---------

Co-authored-by: small-lovely-cat <77799160+small-lovely-cat@users.noreply.github.com>
Co-authored-by: saladday <1203511142@qq.com>

src-tauri/Cargo.lock

@@ -727,6 +727,7 @@ dependencies = [
  "serde_json",
  "serde_yaml",
  "serial_test",
+ "sha2",
  "tauri",
  "tauri-build",
  "tauri-plugin-deep-link",

src-tauri/Cargo.toml

@@ -61,6 +61,7 @@ rusqlite = { version = "0.31", features = ["bundled", "backup"] }
 indexmap = { version = "2", features = ["serde"] }
 rust_decimal = "1.33"
 uuid = { version = "1.11", features = ["v4"] }
+sha2 = "0.10"
 
 [target.'cfg(any(target_os = "macos", target_os = "windows", target_os = "linux"))'.dependencies]
 tauri-plugin-single-instance = "2"

src-tauri/src/commands/import_export.rs

@@ -5,10 +5,15 @@ use std::path::PathBuf;
 use tauri::State;
 use tauri_plugin_dialog::DialogExt;
 
+use crate::commands::sync_support::{
+    post_sync_warning_from_result, run_post_import_sync, success_payload_with_warning,
+};
 use crate::error::AppError;
 use crate::services::provider::ProviderService;
 use crate::store::AppState;
 
+// ─── File import/export ──────────────────────────────────────
+
 /// 导出数据库为 SQL 备份
 #[tauri::command]
 pub async fn export_config_to_file(
@@ -37,27 +42,15 @@ pub async fn import_config_from_file(
     state: State<'_, AppState>,
 ) -> Result<Value, String> {
     let db = state.db.clone();
-    let db_for_state = db.clone();
+    let db_for_sync = db.clone();
     tauri::async_runtime::spawn_blocking(move || {
         let path_buf = PathBuf::from(&filePath);
         let backup_id = db.import_sql(&path_buf)?;
-
-        // 导入后同步当前供应商到各自的 live 配置
-        let app_state = AppState::new(db_for_state);
-        if let Err(err) = ProviderService::sync_current_to_live(&app_state) {
-            log::warn!("导入后同步 live 配置失败: {err}");
+        let warning = post_sync_warning_from_result(Ok(run_post_import_sync(db_for_sync)));
+        if let Some(msg) = warning.as_ref() {
+            log::warn!("[Import] post-import sync warning: {msg}");
         }
-
-        // 重新加载设置到内存缓存，确保导入的设置生效
-        if let Err(err) = crate::settings::reload_settings() {
-            log::warn!("导入后重载设置失败: {err}");
-        }
-
-        Ok::<_, AppError>(json!({
-            "success": true,
-            "message": "SQL imported successfully",
-            "backupId": backup_id
-        }))
+        Ok::<_, AppError>(success_payload_with_warning(backup_id, warning))
     })
     .await
     .map_err(|e| format!("导入配置失败: {e}"))?
@@ -80,6 +73,8 @@ pub async fn sync_current_providers_live(state: State<'_, AppState>) -> Result<V
     .map_err(|e: AppError| e.to_string())
 }
 
+// ─── File dialogs ────────────────────────────────────────────
+
 /// 保存文件对话框
 #[tauri::command]
 pub async fn save_file_dialog<R: tauri::Runtime>(

src-tauri/src/commands/mod.rs

@@ -17,7 +17,9 @@ mod session_manager;
 mod settings;
 pub mod skill;
 mod stream_check;
+mod sync_support;
 mod usage;
+mod webdav_sync;
 
 pub use config::*;
 pub use deeplink::*;
@@ -37,3 +39,4 @@ pub use settings::*;
 pub use skill::*;
 pub use stream_check::*;
 pub use usage::*;
+pub use webdav_sync::*;

src-tauri/src/commands/settings.rs

@@ -2,16 +2,28 @@
 
 use tauri::AppHandle;
 
+fn merge_settings_for_save(
+    mut incoming: crate::settings::AppSettings,
+    existing: &crate::settings::AppSettings,
+) -> crate::settings::AppSettings {
+    if incoming.webdav_sync.is_none() {
+        incoming.webdav_sync = existing.webdav_sync.clone();
+    }
+    incoming
+}
+
 /// 获取设置
 #[tauri::command]
 pub async fn get_settings() -> Result<crate::settings::AppSettings, String> {
-    Ok(crate::settings::get_settings())
+    Ok(crate::settings::get_settings_for_frontend())
 }
 
 /// 保存设置
 #[tauri::command]
 pub async fn save_settings(settings: crate::settings::AppSettings) -> Result<bool, String> {
-    crate::settings::update_settings(settings).map_err(|e| e.to_string())?;
+    let existing = crate::settings::get_settings();
+    let merged = merge_settings_for_save(settings, &existing);
+    crate::settings::update_settings(merged).map_err(|e| e.to_string())?;
     Ok(true)
 }
 
@@ -54,6 +66,58 @@ pub async fn set_auto_launch(enabled: bool) -> Result<bool, String> {
     Ok(true)
 }
 
+#[cfg(test)]
+mod tests {
+    use super::merge_settings_for_save;
+    use crate::settings::{AppSettings, WebDavSyncSettings};
+
+    #[test]
+    fn save_settings_should_preserve_existing_webdav_when_payload_omits_it() {
+        let mut existing = AppSettings::default();
+        existing.webdav_sync = Some(WebDavSyncSettings {
+            base_url: "https://dav.example.com".to_string(),
+            username: "alice".to_string(),
+            password: "secret".to_string(),
+            ..WebDavSyncSettings::default()
+        });
+
+        let incoming = AppSettings::default();
+        let merged = merge_settings_for_save(incoming, &existing);
+
+        assert!(merged.webdav_sync.is_some());
+        assert_eq!(
+            merged.webdav_sync.as_ref().map(|v| v.base_url.as_str()),
+            Some("https://dav.example.com")
+        );
+    }
+
+    #[test]
+    fn save_settings_should_keep_incoming_webdav_when_present() {
+        let mut existing = AppSettings::default();
+        existing.webdav_sync = Some(WebDavSyncSettings {
+            base_url: "https://dav.old.example.com".to_string(),
+            username: "old".to_string(),
+            password: "old-pass".to_string(),
+            ..WebDavSyncSettings::default()
+        });
+
+        let mut incoming = AppSettings::default();
+        incoming.webdav_sync = Some(WebDavSyncSettings {
+            base_url: "https://dav.new.example.com".to_string(),
+            username: "new".to_string(),
+            password: "new-pass".to_string(),
+            ..WebDavSyncSettings::default()
+        });
+
+        let merged = merge_settings_for_save(incoming, &existing);
+
+        assert_eq!(
+            merged.webdav_sync.as_ref().map(|v| v.base_url.as_str()),
+            Some("https://dav.new.example.com")
+        );
+    }
+}
+
 /// 获取开机自启状态
 #[tauri::command]
 pub async fn get_auto_launch_status() -> Result<bool, String> {

src-tauri/src/commands/sync_support.rs

@@ -0,0 +1,97 @@
+use serde_json::{json, Value};
+use std::sync::Arc;
+
+use crate::database::Database;
+use crate::error::AppError;
+use crate::services::provider::ProviderService;
+use crate::settings;
+use crate::store::AppState;
+
+pub(crate) fn run_post_import_sync(db: Arc<Database>) -> Result<(), AppError> {
+    let app_state = AppState::new(db);
+    ProviderService::sync_current_to_live(&app_state)?;
+    settings::reload_settings()?;
+    Ok(())
+}
+
+fn post_sync_warning<E: std::fmt::Display>(err: E) -> String {
+    AppError::localized(
+        "sync.post_operation_sync_failed",
+        format!("后置同步状态失败: {err}"),
+        format!("Post-operation synchronization failed: {err}"),
+    )
+    .to_string()
+}
+
+pub(crate) fn post_sync_warning_from_result(
+    result: Result<Result<(), AppError>, String>,
+) -> Option<String> {
+    match result {
+        Ok(Ok(())) => None,
+        Ok(Err(err)) => Some(post_sync_warning(err)),
+        Err(err) => Some(post_sync_warning(err)),
+    }
+}
+
+pub(crate) fn attach_warning(mut value: Value, warning: Option<String>) -> Value {
+    if let Some(message) = warning {
+        if let Some(obj) = value.as_object_mut() {
+            obj.insert("warning".to_string(), Value::String(message));
+        }
+    }
+    value
+}
+
+pub(crate) fn success_payload_with_warning(backup_id: String, warning: Option<String>) -> Value {
+    attach_warning(
+        json!({
+            "success": true,
+            "message": "SQL imported successfully",
+            "backupId": backup_id
+        }),
+        warning,
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{attach_warning, post_sync_warning_from_result};
+    use serde_json::json;
+
+    #[test]
+    fn post_sync_warning_from_result_returns_none_on_success() {
+        let warning = post_sync_warning_from_result(Ok(Ok(())));
+        assert!(warning.is_none());
+    }
+
+    #[test]
+    fn post_sync_warning_from_result_returns_some_on_sync_error() {
+        let warning =
+            post_sync_warning_from_result(Ok(Err(crate::error::AppError::Config("boom".into()))));
+        assert!(warning.is_some());
+    }
+
+    #[tokio::test]
+    async fn post_sync_warning_from_result_returns_some_on_join_error() {
+        let handle = tokio::spawn(async move {
+            panic!("forced join error");
+        });
+        let join_err = handle.await.expect_err("task should panic");
+        let warning = post_sync_warning_from_result(Err(join_err.to_string()));
+        assert!(warning.is_some());
+    }
+
+    #[test]
+    fn attach_warning_adds_warning_without_dropping_existing_fields() {
+        let payload = json!({ "status": "downloaded" });
+        let updated = attach_warning(payload, Some("post sync warning".to_string()));
+        assert_eq!(
+            updated.get("status").and_then(|v| v.as_str()),
+            Some("downloaded")
+        );
+        assert_eq!(
+            updated.get("warning").and_then(|v| v.as_str()),
+            Some("post sync warning")
+        );
+    }
+}

src-tauri/src/commands/webdav_sync.rs

@@ -0,0 +1,357 @@
+#![allow(non_snake_case)]
+
+use serde_json::{Value, json};
+use std::future::Future;
+use std::sync::OnceLock;
+use tauri::State;
+
+use crate::commands::sync_support::{
+    attach_warning, post_sync_warning_from_result, run_post_import_sync,
+};
+use crate::error::AppError;
+use crate::services::webdav_sync as webdav_sync_service;
+use crate::settings::{self, WebDavSyncSettings};
+use crate::store::AppState;
+
+fn persist_sync_error(settings: &mut WebDavSyncSettings, error: &AppError) {
+    settings.status.last_error = Some(error.to_string());
+    let _ = settings::update_webdav_sync_status(settings.status.clone());
+}
+
+fn webdav_not_configured_error() -> String {
+    AppError::localized(
+        "webdav.sync.not_configured",
+        "未配置 WebDAV 同步",
+        "WebDAV sync is not configured.",
+    )
+    .to_string()
+}
+
+fn webdav_sync_disabled_error() -> String {
+    AppError::localized(
+        "webdav.sync.disabled",
+        "WebDAV 同步未启用",
+        "WebDAV sync is disabled.",
+    )
+    .to_string()
+}
+
+fn require_enabled_webdav_settings() -> Result<WebDavSyncSettings, String> {
+    let settings = settings::get_webdav_sync_settings().ok_or_else(webdav_not_configured_error)?;
+    if !settings.enabled {
+        return Err(webdav_sync_disabled_error());
+    }
+    Ok(settings)
+}
+
+fn resolve_password_for_request(
+    mut incoming: WebDavSyncSettings,
+    existing: Option<WebDavSyncSettings>,
+    preserve_empty_password: bool,
+) -> WebDavSyncSettings {
+    if let Some(existing_settings) = existing {
+        if preserve_empty_password && incoming.password.is_empty() {
+            incoming.password = existing_settings.password;
+        }
+    }
+    incoming
+}
+
+fn webdav_sync_mutex() -> &'static tokio::sync::Mutex<()> {
+    static LOCK: OnceLock<tokio::sync::Mutex<()>> = OnceLock::new();
+    LOCK.get_or_init(|| tokio::sync::Mutex::new(()))
+}
+
+async fn run_with_webdav_lock<T, Fut>(operation: Fut) -> Result<T, AppError>
+where
+    Fut: Future<Output = Result<T, AppError>>,
+{
+    let result = {
+        let _guard = webdav_sync_mutex().lock().await;
+        operation.await
+    };
+    result
+}
+
+fn map_sync_result<T, F>(result: Result<T, AppError>, on_error: F) -> Result<T, String>
+where
+    F: FnOnce(&AppError),
+{
+    match result {
+        Ok(value) => Ok(value),
+        Err(err) => {
+            on_error(&err);
+            Err(err.to_string())
+        }
+    }
+}
+
+#[tauri::command]
+pub async fn webdav_test_connection(
+    settings: WebDavSyncSettings,
+    #[allow(non_snake_case)] preserveEmptyPassword: Option<bool>,
+) -> Result<Value, String> {
+    let preserve_empty = preserveEmptyPassword.unwrap_or(true);
+    let resolved = resolve_password_for_request(
+        settings,
+        settings::get_webdav_sync_settings(),
+        preserve_empty,
+    );
+    webdav_sync_service::check_connection(&resolved)
+        .await
+        .map_err(|e| e.to_string())?;
+    Ok(json!({
+        "success": true,
+        "message": "WebDAV connection ok"
+    }))
+}
+
+#[tauri::command]
+pub async fn webdav_sync_upload(state: State<'_, AppState>) -> Result<Value, String> {
+    let db = state.db.clone();
+    let mut settings = require_enabled_webdav_settings()?;
+
+    let result = run_with_webdav_lock(webdav_sync_service::upload(&db, &mut settings)).await;
+    map_sync_result(result, |error| persist_sync_error(&mut settings, error))
+}
+
+#[tauri::command]
+pub async fn webdav_sync_download(state: State<'_, AppState>) -> Result<Value, String> {
+    let db = state.db.clone();
+    let db_for_sync = db.clone();
+    let mut settings = require_enabled_webdav_settings()?;
+
+    let sync_result = run_with_webdav_lock(webdav_sync_service::download(&db, &mut settings)).await;
+    let mut result = map_sync_result(sync_result, |error| {
+        persist_sync_error(&mut settings, error)
+    })?;
+
+    // Post-download sync is best-effort: snapshot restore has already succeeded.
+    let warning = post_sync_warning_from_result(
+        tauri::async_runtime::spawn_blocking(move || run_post_import_sync(db_for_sync))
+            .await
+            .map_err(|e| e.to_string()),
+    );
+    if let Some(msg) = warning.as_ref() {
+        log::warn!("[WebDAV] post-download sync warning: {msg}");
+    }
+    result = attach_warning(result, warning);
+
+    Ok(result)
+}
+
+#[tauri::command]
+pub async fn webdav_sync_save_settings(
+    settings: WebDavSyncSettings,
+    #[allow(non_snake_case)] passwordTouched: Option<bool>,
+) -> Result<Value, String> {
+    let password_touched = passwordTouched.unwrap_or(false);
+    let existing = settings::get_webdav_sync_settings();
+    let mut sync_settings =
+        resolve_password_for_request(settings, existing.clone(), !password_touched);
+
+    // Preserve server-owned fields that the frontend does not manage
+    if let Some(existing_settings) = existing {
+        sync_settings.status = existing_settings.status;
+    }
+
+    sync_settings.normalize();
+    sync_settings.validate().map_err(|e| e.to_string())?;
+    settings::set_webdav_sync_settings(Some(sync_settings)).map_err(|e| e.to_string())?;
+    Ok(json!({ "success": true }))
+}
+
+#[tauri::command]
+pub async fn webdav_sync_fetch_remote_info() -> Result<Value, String> {
+    let settings = require_enabled_webdav_settings()?;
+    let info = webdav_sync_service::fetch_remote_info(&settings)
+        .await
+        .map_err(|e| e.to_string())?;
+    Ok(info.unwrap_or(json!({ "empty": true })))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        map_sync_result, persist_sync_error, require_enabled_webdav_settings,
+        resolve_password_for_request, run_with_webdav_lock, webdav_sync_mutex,
+    };
+    use crate::error::AppError;
+    use crate::settings::{AppSettings, WebDavSyncSettings};
+    use serial_test::serial;
+    use std::sync::Arc;
+    use std::sync::atomic::{AtomicBool, Ordering};
+    use std::time::Duration;
+
+    #[tokio::test]
+    async fn webdav_sync_mutex_is_singleton() {
+        let a = webdav_sync_mutex() as *const _;
+        let b = webdav_sync_mutex() as *const _;
+        assert_eq!(a, b);
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn webdav_sync_mutex_serializes_concurrent_access() {
+        let guard = webdav_sync_mutex().lock().await;
+        let acquired = Arc::new(AtomicBool::new(false));
+        let acquired_bg = Arc::clone(&acquired);
+
+        let waiter = tokio::spawn(async move {
+            let _inner_guard = webdav_sync_mutex().lock().await;
+            acquired_bg.store(true, Ordering::SeqCst);
+        });
+
+        tokio::time::sleep(Duration::from_millis(40)).await;
+        assert!(!acquired.load(Ordering::SeqCst));
+
+        drop(guard);
+        tokio::time::timeout(Duration::from_secs(1), waiter)
+            .await
+            .expect("background task should complete after lock release")
+            .expect("background task should not panic");
+
+        assert!(acquired.load(Ordering::SeqCst));
+    }
+
+    #[tokio::test]
+    #[serial]
+    async fn map_sync_result_runs_error_handler_after_lock_release() {
+        let result = run_with_webdav_lock(async {
+            Err::<(), AppError>(AppError::Config("boom".to_string()))
+        })
+        .await;
+
+        let mut lock_released = false;
+        let mapped = map_sync_result(result, |_| {
+            lock_released = webdav_sync_mutex().try_lock().is_ok();
+        });
+
+        assert!(mapped.is_err());
+        assert!(lock_released);
+    }
+
+    #[test]
+    fn resolve_password_for_request_preserves_existing_when_requested() {
+        let incoming = WebDavSyncSettings {
+            base_url: "https://dav.example.com".to_string(),
+            username: "alice".to_string(),
+            password: String::new(),
+            ..WebDavSyncSettings::default()
+        };
+        let existing = Some(WebDavSyncSettings {
+            password: "secret".to_string(),
+            ..WebDavSyncSettings::default()
+        });
+        let resolved = resolve_password_for_request(incoming, existing, true);
+        assert_eq!(resolved.password, "secret");
+    }
+
+    #[test]
+    fn resolve_password_for_request_allows_explicit_empty_password() {
+        let incoming = WebDavSyncSettings {
+            base_url: "https://dav.example.com".to_string(),
+            username: "alice".to_string(),
+            password: String::new(),
+            ..WebDavSyncSettings::default()
+        };
+        let existing = Some(WebDavSyncSettings {
+            password: "secret".to_string(),
+            ..WebDavSyncSettings::default()
+        });
+        let resolved = resolve_password_for_request(incoming, existing, false);
+        assert!(resolved.password.is_empty());
+    }
+
+    #[test]
+    #[serial]
+    fn persist_sync_error_updates_status_without_overwriting_credentials() {
+        let test_home = std::env::temp_dir().join("cc-switch-sync-error-status-test");
+        let _ = std::fs::remove_dir_all(&test_home);
+        std::fs::create_dir_all(&test_home).expect("create test home");
+        std::env::set_var("CC_SWITCH_TEST_HOME", &test_home);
+
+        crate::settings::update_settings(AppSettings::default()).expect("reset settings");
+        let mut current = WebDavSyncSettings {
+            enabled: true,
+            base_url: "https://dav.example.com/dav/".to_string(),
+            username: "alice".to_string(),
+            password: "secret".to_string(),
+            remote_root: "cc-switch-sync".to_string(),
+            profile: "default".to_string(),
+            ..WebDavSyncSettings::default()
+        };
+        crate::settings::set_webdav_sync_settings(Some(current.clone()))
+            .expect("seed webdav settings");
+
+        persist_sync_error(
+            &mut current,
+            &crate::error::AppError::Config("boom".to_string()),
+        );
+
+        let after = crate::settings::get_webdav_sync_settings().expect("read webdav settings");
+        assert_eq!(after.base_url, "https://dav.example.com/dav/");
+        assert_eq!(after.username, "alice");
+        assert_eq!(after.password, "secret");
+        assert_eq!(after.remote_root, "cc-switch-sync");
+        assert_eq!(after.profile, "default");
+        assert!(
+            after
+                .status
+                .last_error
+                .as_deref()
+                .unwrap_or_default()
+                .contains("boom"),
+            "status error should be updated"
+        );
+    }
+
+    #[test]
+    #[serial]
+    fn require_enabled_webdav_settings_rejects_disabled_config() {
+        let test_home = std::env::temp_dir().join("cc-switch-sync-enabled-disabled-test");
+        let _ = std::fs::remove_dir_all(&test_home);
+        std::fs::create_dir_all(&test_home).expect("create test home");
+        std::env::set_var("CC_SWITCH_TEST_HOME", &test_home);
+
+        crate::settings::update_settings(AppSettings::default()).expect("reset settings");
+        crate::settings::set_webdav_sync_settings(Some(WebDavSyncSettings {
+            enabled: false,
+            base_url: "https://dav.example.com/dav/".to_string(),
+            username: "alice".to_string(),
+            password: "secret".to_string(),
+            ..WebDavSyncSettings::default()
+        }))
+        .expect("seed disabled webdav settings");
+
+        let err = require_enabled_webdav_settings().expect_err("disabled settings should fail");
+        assert!(
+            err.contains("disabled") || err.contains("未启用"),
+            "unexpected error: {err}"
+        );
+    }
+
+    #[test]
+    #[serial]
+    fn require_enabled_webdav_settings_returns_settings_when_enabled() {
+        let test_home = std::env::temp_dir().join("cc-switch-sync-enabled-ok-test");
+        let _ = std::fs::remove_dir_all(&test_home);
+        std::fs::create_dir_all(&test_home).expect("create test home");
+        std::env::set_var("CC_SWITCH_TEST_HOME", &test_home);
+
+        crate::settings::update_settings(AppSettings::default()).expect("reset settings");
+        crate::settings::set_webdav_sync_settings(Some(WebDavSyncSettings {
+            enabled: true,
+            base_url: "https://dav.example.com/dav/".to_string(),
+            username: "alice".to_string(),
+            password: "secret".to_string(),
+            ..WebDavSyncSettings::default()
+        }))
+        .expect("seed enabled webdav settings");
+
+        let settings =
+            require_enabled_webdav_settings().expect("enabled settings should be accepted");
+        assert!(settings.enabled);
+        assert_eq!(settings.base_url, "https://dav.example.com/dav/");
+    }
+}

src-tauri/src/database/backup.rs

@@ -16,10 +16,15 @@ use tempfile::NamedTempFile;
 const CC_SWITCH_SQL_EXPORT_HEADER: &str = "-- CC Switch SQLite 导出";
 
 impl Database {
+    /// 导出为 SQLite 兼容的 SQL 文本（内存字符串）
+    pub fn export_sql_string(&self) -> Result<String, AppError> {
+        let snapshot = self.snapshot_to_memory()?;
+        Self::dump_sql(&snapshot)
+    }
+
     /// 导出为 SQLite 兼容的 SQL 文本
     pub fn export_sql(&self, target_path: &Path) -> Result<(), AppError> {
-        let snapshot = self.snapshot_to_memory()?;
-        let dump = Self::dump_sql(&snapshot)?;
+        let dump = self.export_sql_string()?;
 
         if let Some(parent) = target_path.parent() {
             fs::create_dir_all(parent).map_err(|e| AppError::io(parent, e))?;
@@ -38,6 +43,12 @@ impl Database {
         }
 
         let sql_raw = fs::read_to_string(source_path).map_err(|e| AppError::io(source_path, e))?;
+        let sql_content = sql_raw.trim_start_matches('\u{feff}');
+        self.import_sql_string(sql_content)
+    }
+
+    /// 从 SQL 字符串导入，返回生成的备份 ID（若无备份则为空字符串）
+    pub fn import_sql_string(&self, sql_raw: &str) -> Result<String, AppError> {
         let sql_content = sql_raw.trim_start_matches('\u{feff}');
         Self::validate_cc_switch_sql_export(sql_content)?;
 

src-tauri/src/lib.rs

@@ -886,6 +886,11 @@ pub fn run() {
             // theirs: config import/export and dialogs
             commands::export_config_to_file,
             commands::import_config_from_file,
+            commands::webdav_test_connection,
+            commands::webdav_sync_upload,
+            commands::webdav_sync_download,
+            commands::webdav_sync_save_settings,
+            commands::webdav_sync_fetch_remote_info,
             commands::save_file_dialog,
             commands::open_file_dialog,
             commands::open_zip_file_dialog,

src-tauri/src/services/mod.rs

@@ -10,6 +10,8 @@ pub mod skill;
 pub mod speedtest;
 pub mod stream_check;
 pub mod usage_stats;
+pub mod webdav;
+pub mod webdav_sync;
 
 pub use config::ConfigService;
 pub use mcp::McpService;

src-tauri/src/services/webdav.rs

@@ -0,0 +1,507 @@
+//! WebDAV HTTP transport layer.
+//!
+//! Low-level HTTP primitives for WebDAV operations (PUT, GET, HEAD, MKCOL, PROPFIND).
+//! The sync protocol logic lives in [`super::webdav_sync`].
+
+use reqwest::{Method, RequestBuilder, StatusCode, Url};
+use std::time::Duration;
+
+use crate::error::AppError;
+use crate::proxy::http_client;
+
+const DEFAULT_TIMEOUT_SECS: u64 = 30;
+/// Timeout for large file transfers (PUT/GET of db.sql, skills.zip).
+const TRANSFER_TIMEOUT_SECS: u64 = 300;
+
+/// Auth pair: `(username, Some(password))`.
+pub type WebDavAuth = Option<(String, Option<String>)>;
+
+// ─── WebDAV extension methods ────────────────────────────────
+
+fn method_propfind() -> Method {
+    Method::from_bytes(b"PROPFIND").expect("PROPFIND is a valid HTTP method")
+}
+
+fn method_mkcol() -> Method {
+    Method::from_bytes(b"MKCOL").expect("MKCOL is a valid HTTP method")
+}
+
+// ─── URL utilities ───────────────────────────────────────────
+
+/// Parse and validate a WebDAV base URL (must be http or https).
+pub fn parse_base_url(raw: &str) -> Result<Url, AppError> {
+    let trimmed = raw.trim();
+    if trimmed.is_empty() {
+        return Err(AppError::localized(
+            "webdav.base_url.required",
+            "WebDAV 地址不能为空",
+            "WebDAV URL is required.",
+        ));
+    }
+    let url = Url::parse(trimmed).map_err(|e| {
+        AppError::localized(
+            "webdav.base_url.invalid",
+            format!("WebDAV 地址无效: {e}"),
+            format!("Invalid WebDAV URL: {e}"),
+        )
+    })?;
+    match url.scheme() {
+        "http" | "https" => Ok(url),
+        _ => Err(AppError::localized(
+            "webdav.base_url.scheme_invalid",
+            "WebDAV 仅支持 http/https 地址",
+            "WebDAV URL must use http or https.",
+        )),
+    }
+}
+
+/// Build a full URL from a base URL string and path segments.
+///
+/// Each segment is individually percent-encoded by the `url` crate.
+pub fn build_remote_url(base_url: &str, segments: &[String]) -> Result<String, AppError> {
+    let mut url = parse_base_url(base_url)?;
+    {
+        let mut path = url.path_segments_mut().map_err(|_| {
+            AppError::localized(
+                "webdav.base_url.unusable",
+                "WebDAV 地址格式不支持追加路径",
+                "WebDAV URL format does not support appending path segments.",
+            )
+        })?;
+        path.pop_if_empty();
+        for seg in segments {
+            path.push(seg);
+        }
+    }
+    Ok(url.to_string())
+}
+
+/// Split a slash-delimited path into non-empty segments.
+pub fn path_segments(raw: &str) -> impl Iterator<Item = &str> {
+    raw.trim_matches('/').split('/').filter(|s| !s.is_empty())
+}
+
+// ─── Auth ────────────────────────────────────────────────────
+
+/// Build auth from username/password. Returns `None` if username is blank.
+pub fn auth_from_credentials(username: &str, password: &str) -> WebDavAuth {
+    let user = username.trim();
+    if user.is_empty() {
+        return None;
+    }
+    Some((user.to_string(), Some(password.to_string())))
+}
+
+/// Apply Basic-Auth to a request builder if auth is present.
+fn apply_auth(builder: RequestBuilder, auth: &WebDavAuth) -> RequestBuilder {
+    match auth {
+        Some((user, pass)) => builder.basic_auth(user, pass.as_deref()),
+        None => builder,
+    }
+}
+
+fn webdav_transport_error(
+    key: &'static str,
+    op_zh: &str,
+    op_en: &str,
+    target_url: &str,
+    err: &reqwest::Error,
+) -> AppError {
+    let (zh_reason, en_reason) = if err.is_timeout() {
+        ("请求超时", "request timed out")
+    } else if err.is_connect() {
+        ("连接失败", "connection failed")
+    } else if err.is_request() {
+        ("请求构造失败", "request build failed")
+    } else {
+        ("网络请求失败", "network request failed")
+    };
+
+    let safe_url = redact_url(target_url);
+    AppError::localized(
+        key,
+        format!("WebDAV {op_zh}失败（{zh_reason}）: {safe_url}"),
+        format!("WebDAV {op_en} failed ({en_reason}): {safe_url}"),
+    )
+}
+
+// ─── HTTP operations ─────────────────────────────────────────
+
+/// Test WebDAV connectivity via PROPFIND Depth=0 on the base URL.
+pub async fn test_connection(base_url: &str, auth: &WebDavAuth) -> Result<(), AppError> {
+    let url = parse_base_url(base_url)?;
+    let client = http_client::get();
+
+    let resp = apply_auth(
+        client
+            .request(method_propfind(), url)
+            .header("Depth", "0")
+            .timeout(Duration::from_secs(DEFAULT_TIMEOUT_SECS)),
+        auth,
+    )
+    .send()
+    .await
+    .map_err(|e| {
+        webdav_transport_error(
+            "webdav.connection_failed",
+            "连接",
+            "connection",
+            base_url,
+            &e,
+        )
+    })?;
+
+    if resp.status().is_success() || resp.status() == StatusCode::MULTI_STATUS {
+        return Ok(());
+    }
+    Err(webdav_status_error("PROPFIND", resp.status(), base_url))
+}
+
+/// Ensure a chain of remote directories exists.
+///
+/// Uses optimistic MKCOL: try creating first, fall back to PROPFIND verification
+/// on ambiguous responses. This halves the round-trips vs PROPFIND-first approach.
+pub async fn ensure_remote_directories(
+    base_url: &str,
+    segments: &[String],
+    auth: &WebDavAuth,
+) -> Result<(), AppError> {
+    if segments.is_empty() {
+        return Ok(());
+    }
+    let client = http_client::get();
+
+    for depth in 1..=segments.len() {
+        let prefix = &segments[..depth];
+        let url = build_remote_url(base_url, prefix)?;
+        let dir_url = if url.ends_with('/') {
+            url
+        } else {
+            format!("{url}/")
+        };
+
+        let resp = apply_auth(
+            client
+                .request(method_mkcol(), &dir_url)
+                .timeout(Duration::from_secs(DEFAULT_TIMEOUT_SECS)),
+            auth,
+        )
+        .send()
+        .await
+        .map_err(|e| {
+            webdav_transport_error(
+                "webdav.mkcol_failed",
+                "MKCOL 请求",
+                "MKCOL request",
+                &dir_url,
+                &e,
+            )
+        })?;
+
+        let status = resp.status();
+        match status {
+            s if s == StatusCode::CREATED || s.is_success() => {
+                log::info!("[WebDAV] MKCOL ok: {}", redact_url(&dir_url));
+            }
+            // 405 commonly means "already exists" on many WebDAV servers
+            StatusCode::METHOD_NOT_ALLOWED => {}
+            // Ambiguous — verify directory actually exists via PROPFIND
+            s if s == StatusCode::CONFLICT || s.is_redirection() => {
+                if !propfind_exists(&client, &dir_url, auth).await? {
+                    return Err(webdav_status_error("MKCOL", status, &dir_url));
+                }
+            }
+            _ => {
+                return Err(webdav_status_error("MKCOL", status, &dir_url));
+            }
+        }
+    }
+    Ok(())
+}
+
+/// PUT bytes to a remote WebDAV URL.
+pub async fn put_bytes(
+    url: &str,
+    auth: &WebDavAuth,
+    bytes: Vec<u8>,
+    content_type: &str,
+) -> Result<(), AppError> {
+    let client = http_client::get();
+    let resp = apply_auth(
+        client
+            .put(url)
+            .header("Content-Type", content_type)
+            .body(bytes)
+            .timeout(Duration::from_secs(TRANSFER_TIMEOUT_SECS)),
+        auth,
+    )
+    .send()
+    .await
+    .map_err(|e| {
+        webdav_transport_error(
+            "webdav.put_failed",
+            "PUT 请求",
+            "PUT request",
+            url,
+            &e,
+        )
+    })?;
+
+    if resp.status().is_success() {
+        return Ok(());
+    }
+    Err(webdav_status_error("PUT", resp.status(), url))
+}
+
+/// GET bytes from a remote WebDAV URL. Returns `None` on 404.
+///
+/// On success returns `(body_bytes, optional_etag)`.
+pub async fn get_bytes(
+    url: &str,
+    auth: &WebDavAuth,
+) -> Result<Option<(Vec<u8>, Option<String>)>, AppError> {
+    let client = http_client::get();
+    let resp = apply_auth(
+        client
+            .get(url)
+            .timeout(Duration::from_secs(TRANSFER_TIMEOUT_SECS)),
+        auth,
+    )
+    .send()
+    .await
+    .map_err(|e| {
+        webdav_transport_error(
+            "webdav.get_failed",
+            "GET 请求",
+            "GET request",
+            url,
+            &e,
+        )
+    })?;
+
+    if resp.status() == StatusCode::NOT_FOUND {
+        return Ok(None);
+    }
+    if !resp.status().is_success() {
+        return Err(webdav_status_error("GET", resp.status(), url));
+    }
+    let etag = resp
+        .headers()
+        .get("etag")
+        .and_then(|v| v.to_str().ok())
+        .map(|s| s.to_string());
+    let bytes = resp
+        .bytes()
+        .await
+        .map_err(|e| {
+            AppError::localized(
+                "webdav.response_read_failed",
+                format!("读取 WebDAV 响应失败: {e}"),
+                format!("Failed to read WebDAV response: {e}"),
+            )
+        })?;
+    Ok(Some((bytes.to_vec(), etag)))
+}
+
+/// HEAD request to retrieve the ETag. Returns `None` on 404.
+pub async fn head_etag(url: &str, auth: &WebDavAuth) -> Result<Option<String>, AppError> {
+    let client = http_client::get();
+    let resp = apply_auth(
+        client
+            .head(url)
+            .timeout(Duration::from_secs(DEFAULT_TIMEOUT_SECS)),
+        auth,
+    )
+    .send()
+    .await
+    .map_err(|e| {
+        webdav_transport_error(
+            "webdav.head_failed",
+            "HEAD 请求",
+            "HEAD request",
+            url,
+            &e,
+        )
+    })?;
+
+    if resp.status() == StatusCode::NOT_FOUND {
+        return Ok(None);
+    }
+    if !resp.status().is_success() {
+        return Err(webdav_status_error("HEAD", resp.status(), url));
+    }
+    Ok(resp
+        .headers()
+        .get("etag")
+        .and_then(|v| v.to_str().ok())
+        .map(|s| s.to_string()))
+}
+
+// ─── Internal helpers ────────────────────────────────────────
+
+/// PROPFIND Depth=0 to check if a remote resource exists.
+async fn propfind_exists(
+    client: &reqwest::Client,
+    url: &str,
+    auth: &WebDavAuth,
+) -> Result<bool, AppError> {
+    let resp = apply_auth(
+        client
+            .request(method_propfind(), url)
+            .header("Depth", "0")
+            .timeout(Duration::from_secs(DEFAULT_TIMEOUT_SECS)),
+        auth,
+    )
+    .send()
+    .await;
+    match resp {
+        Ok(r) => Ok(r.status().is_success() || r.status() == StatusCode::MULTI_STATUS),
+        Err(e) => {
+            log::warn!(
+                "[WebDAV] PROPFIND check failed for {}: {e}",
+                redact_url(url)
+            );
+            Ok(false)
+        }
+    }
+}
+
+// ─── Service detection & error helpers ───────────────────────
+
+/// Check if a URL points to Jianguoyun (坚果云).
+pub fn is_jianguoyun(url: &str) -> bool {
+    Url::parse(url)
+        .ok()
+        .and_then(|u| u.host_str().map(|h| h.to_lowercase()))
+        .map(|host| host.contains("jianguoyun.com") || host.contains("nutstore"))
+        .unwrap_or(false)
+}
+
+/// Build an `AppError` with service-specific hints for WebDAV failures.
+pub fn webdav_status_error(op: &str, status: StatusCode, url: &str) -> AppError {
+    let safe_url = redact_url(url);
+    let mut zh = format!("WebDAV {op} 失败: {status} ({safe_url})");
+    let mut en = format!("WebDAV {op} failed: {status} ({safe_url})");
+    let jgy = is_jianguoyun(url);
+
+    if matches!(status, StatusCode::UNAUTHORIZED | StatusCode::FORBIDDEN) {
+        if jgy {
+            zh.push_str(
+                "。坚果云请使用「第三方应用密码」，并确认地址指向 /dav/ 下的目录。",
+            );
+            en.push_str(
+                ". For Jianguoyun, use an app-specific password and ensure the URL points under /dav/.",
+            );
+        } else {
+            zh.push_str("。请检查 WebDAV 用户名、密码及目录读写权限。");
+            en.push_str(". Please check WebDAV username/password and directory permissions.");
+        }
+    } else if jgy && (status == StatusCode::NOT_FOUND || status.is_redirection()) {
+        zh.push_str("。坚果云常见原因：地址不在 /dav/ 可写目录下。");
+        en.push_str(". Common Jianguoyun cause: URL is outside a writable /dav/ directory.");
+    } else if op == "MKCOL" && status == StatusCode::CONFLICT {
+        if jgy {
+            zh.push_str(
+                "。坚果云不允许自动创建顶层文件夹，请先在网页端手动创建后重试。",
+            );
+            en.push_str(
+                ". Jianguoyun does not allow creating top-level folders automatically; create it manually first.",
+            );
+        } else {
+            zh.push_str("。请确认上级目录存在。");
+            en.push_str(". Please ensure the parent directory exists.");
+        }
+    }
+
+    AppError::localized("webdav.http.status", zh, en)
+}
+
+fn redact_url(raw: &str) -> String {
+    match Url::parse(raw) {
+        Ok(mut parsed) => {
+            let _ = parsed.set_username("");
+            let _ = parsed.set_password(None);
+
+            let mut out = format!("{}://", parsed.scheme());
+            if let Some(host) = parsed.host_str() {
+                out.push_str(host);
+            }
+            if let Some(port) = parsed.port() {
+                out.push(':');
+                out.push_str(&port.to_string());
+            }
+            out.push_str(parsed.path());
+
+            let mut keys: Vec<String> = parsed.query_pairs().map(|(k, _)| k.into_owned()).collect();
+            keys.sort();
+            keys.dedup();
+            if !keys.is_empty() {
+                out.push_str("?[keys:");
+                out.push_str(&keys.join(","));
+                out.push(']');
+            }
+            out
+        }
+        Err(_) => raw.split('?').next().unwrap_or(raw).to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn build_remote_url_encodes_path_segments() {
+        let url = build_remote_url(
+            "https://dav.example.com/remote.php/dav/files/demo/",
+            &[
+                "cc switch-sync".to_string(),
+                "v2".to_string(),
+                "default profile".to_string(),
+                "manifest.json".to_string(),
+            ],
+        )
+        .unwrap();
+        assert_eq!(
+            url,
+            "https://dav.example.com/remote.php/dav/files/demo/cc%20switch-sync/v2/default%20profile/manifest.json"
+        );
+        assert!(!url.contains("//cc"), "should not have double-slash");
+    }
+
+    #[test]
+    fn is_jianguoyun_detects_correctly() {
+        assert!(is_jianguoyun("https://dav.jianguoyun.com/dav"));
+        assert!(is_jianguoyun("https://dav.jianguoyun.com/dav/folder"));
+        assert!(!is_jianguoyun("https://nextcloud.example.com/dav"));
+    }
+
+    #[test]
+    fn path_segments_splits_correctly() {
+        let segs: Vec<_> = path_segments("/a/b/c/").collect();
+        assert_eq!(segs, vec!["a", "b", "c"]);
+
+        let segs: Vec<_> = path_segments("single").collect();
+        assert_eq!(segs, vec!["single"]);
+
+        let segs: Vec<_> = path_segments("").collect();
+        assert!(segs.is_empty());
+    }
+
+    #[test]
+    fn auth_from_credentials_trims_and_rejects_blank() {
+        assert!(auth_from_credentials("  ", "pass").is_none());
+        let auth = auth_from_credentials(" user ", "pass");
+        assert_eq!(auth, Some(("user".to_string(), Some("pass".to_string()))));
+    }
+
+    #[test]
+    fn redact_url_hides_credentials_and_query_values() {
+        let redacted = redact_url("https://alice:secret@example.com:8443/dav?token=abc&foo=1");
+        assert_eq!(
+            redacted,
+            "https://example.com:8443/dav?[keys:foo,token]"
+        );
+        assert!(!redacted.contains("secret"));
+    }
+}

src-tauri/src/services/webdav_sync.rs

@@ -0,0 +1,649 @@
+//! WebDAV v2 sync protocol layer.
+//!
+//! Implements manifest-based synchronization on top of the HTTP transport
+//! primitives in [`super::webdav`]. Artifact set: `db.sql` + `skills.zip`.
+
+use std::collections::BTreeMap;
+use std::fs;
+use std::process::Command;
+
+use chrono::Utc;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+use tempfile::tempdir;
+
+use crate::error::AppError;
+use crate::services::webdav::{
+    auth_from_credentials, build_remote_url, ensure_remote_directories, get_bytes, head_etag,
+    path_segments, put_bytes, test_connection, WebDavAuth,
+};
+use crate::settings::{update_webdav_sync_status, WebDavSyncSettings, WebDavSyncStatus};
+
+mod archive;
+use archive::{
+    backup_current_skills, restore_skills_from_backup, restore_skills_zip, zip_skills_ssot,
+};
+
+// ─── Protocol constants ──────────────────────────────────────
+
+const PROTOCOL_FORMAT: &str = "cc-switch-webdav-sync";
+const PROTOCOL_VERSION: u32 = 2;
+const REMOTE_DB_SQL: &str = "db.sql";
+const REMOTE_SKILLS_ZIP: &str = "skills.zip";
+const REMOTE_MANIFEST: &str = "manifest.json";
+const MAX_DEVICE_NAME_LEN: usize = 64;
+
+fn localized(key: &'static str, zh: impl Into<String>, en: impl Into<String>) -> AppError {
+    AppError::localized(key, zh, en)
+}
+
+fn io_context_localized(
+    _key: &'static str,
+    zh: impl Into<String>,
+    en: impl Into<String>,
+    source: std::io::Error,
+) -> AppError {
+    let zh_msg = zh.into();
+    let en_msg = en.into();
+    AppError::IoContext {
+        context: format!("{zh_msg} ({en_msg})"),
+        source,
+    }
+}
+
+// ─── Types ───────────────────────────────────────────────────
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SyncManifest {
+    format: String,
+    version: u32,
+    device_name: String,
+    created_at: String,
+    artifacts: BTreeMap<String, ArtifactMeta>,
+    snapshot_id: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct ArtifactMeta {
+    sha256: String,
+    size: u64,
+}
+
+struct LocalSnapshot {
+    db_sql: Vec<u8>,
+    skills_zip: Vec<u8>,
+    manifest_bytes: Vec<u8>,
+    manifest_hash: String,
+}
+
+// ─── Public API ──────────────────────────────────────────────
+
+/// Check WebDAV connectivity and ensure remote directory structure.
+pub async fn check_connection(settings: &WebDavSyncSettings) -> Result<(), AppError> {
+    settings.validate()?;
+    let auth = auth_for(settings);
+    test_connection(&settings.base_url, &auth).await?;
+    let dir_segs = remote_dir_segments(settings);
+    ensure_remote_directories(&settings.base_url, &dir_segs, &auth).await?;
+    Ok(())
+}
+
+/// Upload local snapshot (db + skills) to remote.
+pub async fn upload(
+    db: &crate::database::Database,
+    settings: &mut WebDavSyncSettings,
+) -> Result<Value, AppError> {
+    settings.validate()?;
+    let auth = auth_for(settings);
+    let dir_segs = remote_dir_segments(settings);
+    ensure_remote_directories(&settings.base_url, &dir_segs, &auth).await?;
+
+    let snapshot = build_local_snapshot(db, settings)?;
+
+    // Upload order: artifacts first, manifest last (best-effort consistency)
+    let db_url = remote_file_url(settings, REMOTE_DB_SQL)?;
+    put_bytes(&db_url, &auth, snapshot.db_sql, "application/sql").await?;
+
+    let skills_url = remote_file_url(settings, REMOTE_SKILLS_ZIP)?;
+    put_bytes(&skills_url, &auth, snapshot.skills_zip, "application/zip").await?;
+
+    let manifest_url = remote_file_url(settings, REMOTE_MANIFEST)?;
+    put_bytes(
+        &manifest_url,
+        &auth,
+        snapshot.manifest_bytes,
+        "application/json",
+    )
+    .await?;
+
+    // Fetch etag (best-effort, don't fail the upload)
+    let etag = match head_etag(&manifest_url, &auth).await {
+        Ok(e) => e,
+        Err(e) => {
+            log::debug!("[WebDAV] Failed to fetch ETag after upload: {e}");
+            None
+        }
+    };
+
+    let _persisted = persist_sync_success_best_effort(
+        settings,
+        snapshot.manifest_hash,
+        etag,
+        persist_sync_success,
+    );
+    Ok(serde_json::json!({ "status": "uploaded" }))
+}
+
+/// Download remote snapshot and apply to local database + skills.
+pub async fn download(
+    db: &crate::database::Database,
+    settings: &mut WebDavSyncSettings,
+) -> Result<Value, AppError> {
+    settings.validate()?;
+    let auth = auth_for(settings);
+
+    let manifest_url = remote_file_url(settings, REMOTE_MANIFEST)?;
+    let (manifest_bytes, etag) = get_bytes(&manifest_url, &auth).await?.ok_or_else(|| {
+        localized(
+            "webdav.sync.remote_empty",
+            "远端没有可下载的同步数据",
+            "No downloadable sync data found on the remote.",
+        )
+    })?;
+
+    let manifest: SyncManifest =
+        serde_json::from_slice(&manifest_bytes).map_err(|e| AppError::Json {
+            path: REMOTE_MANIFEST.to_string(),
+            source: e,
+        })?;
+
+    validate_manifest_compat(&manifest)?;
+
+    // Download and verify artifacts
+    let db_sql = download_and_verify(settings, &auth, REMOTE_DB_SQL, &manifest.artifacts).await?;
+    let skills_zip =
+        download_and_verify(settings, &auth, REMOTE_SKILLS_ZIP, &manifest.artifacts).await?;
+
+    // Apply snapshot
+    apply_snapshot(db, &db_sql, &skills_zip)?;
+
+    let manifest_hash = sha256_hex(&manifest_bytes);
+    let _persisted =
+        persist_sync_success_best_effort(settings, manifest_hash, etag, persist_sync_success);
+    Ok(serde_json::json!({ "status": "downloaded" }))
+}
+
+/// Fetch remote manifest info without downloading artifacts.
+pub async fn fetch_remote_info(settings: &WebDavSyncSettings) -> Result<Option<Value>, AppError> {
+    settings.validate()?;
+    let auth = auth_for(settings);
+    let manifest_url = remote_file_url(settings, REMOTE_MANIFEST)?;
+
+    let Some((bytes, _)) = get_bytes(&manifest_url, &auth).await? else {
+        return Ok(None);
+    };
+
+    let manifest: SyncManifest = serde_json::from_slice(&bytes).map_err(|e| AppError::Json {
+        path: REMOTE_MANIFEST.to_string(),
+        source: e,
+    })?;
+
+    let compatible = validate_manifest_compat(&manifest).is_ok();
+
+    let payload = serde_json::json!({
+        "deviceName": manifest.device_name,
+        "createdAt": manifest.created_at,
+        "snapshotId": manifest.snapshot_id,
+        "version": manifest.version,
+        "compatible": compatible,
+        "artifacts": manifest.artifacts.keys().collect::<Vec<_>>(),
+    });
+
+    Ok(Some(payload))
+}
+
+// ─── Sync status persistence (I3: deduplicated) ─────────────
+
+fn persist_sync_success(
+    settings: &mut WebDavSyncSettings,
+    manifest_hash: String,
+    etag: Option<String>,
+) -> Result<(), AppError> {
+    let status = WebDavSyncStatus {
+        last_sync_at: Some(Utc::now().timestamp()),
+        last_error: None,
+        last_local_manifest_hash: Some(manifest_hash.clone()),
+        last_remote_manifest_hash: Some(manifest_hash),
+        last_remote_etag: etag,
+    };
+    settings.status = status.clone();
+    update_webdav_sync_status(status)
+}
+
+fn persist_sync_success_best_effort<F>(
+    settings: &mut WebDavSyncSettings,
+    manifest_hash: String,
+    etag: Option<String>,
+    persist_fn: F,
+) -> bool
+where
+    F: FnOnce(&mut WebDavSyncSettings, String, Option<String>) -> Result<(), AppError>,
+{
+    match persist_fn(settings, manifest_hash, etag) {
+        Ok(()) => true,
+        Err(err) => {
+            log::warn!("[WebDAV] Persist sync status failed, keep operation success: {err}");
+            false
+        }
+    }
+}
+
+// ─── Snapshot building ───────────────────────────────────────
+
+fn build_local_snapshot(
+    db: &crate::database::Database,
+    _settings: &WebDavSyncSettings,
+) -> Result<LocalSnapshot, AppError> {
+    // Export database to SQL string
+    let sql_string = db.export_sql_string()?;
+    let db_sql = sql_string.into_bytes();
+
+    // Pack skills into deterministic ZIP
+    let tmp = tempdir().map_err(|e| {
+        io_context_localized(
+            "webdav.sync.snapshot_tmpdir_failed",
+            "创建 WebDAV 快照临时目录失败",
+            "Failed to create temporary directory for WebDAV snapshot",
+            e,
+        )
+    })?;
+    let skills_zip_path = tmp.path().join(REMOTE_SKILLS_ZIP);
+    zip_skills_ssot(&skills_zip_path)?;
+    let skills_zip = fs::read(&skills_zip_path).map_err(|e| AppError::io(&skills_zip_path, e))?;
+
+    // Build artifact map and compute hashes
+    let mut artifacts = BTreeMap::new();
+    artifacts.insert(
+        REMOTE_DB_SQL.to_string(),
+        ArtifactMeta {
+            sha256: sha256_hex(&db_sql),
+            size: db_sql.len() as u64,
+        },
+    );
+    artifacts.insert(
+        REMOTE_SKILLS_ZIP.to_string(),
+        ArtifactMeta {
+            sha256: sha256_hex(&skills_zip),
+            size: skills_zip.len() as u64,
+        },
+    );
+
+    let snapshot_id = compute_snapshot_id(&artifacts);
+    let manifest = SyncManifest {
+        format: PROTOCOL_FORMAT.to_string(),
+        version: PROTOCOL_VERSION,
+        device_name: detect_system_device_name().unwrap_or_else(|| "Unknown Device".to_string()),
+        created_at: Utc::now().to_rfc3339(),
+        artifacts,
+        snapshot_id,
+    };
+    let manifest_bytes =
+        serde_json::to_vec_pretty(&manifest).map_err(|e| AppError::JsonSerialize { source: e })?;
+    let manifest_hash = sha256_hex(&manifest_bytes);
+
+    Ok(LocalSnapshot {
+        db_sql,
+        skills_zip,
+        manifest_bytes,
+        manifest_hash,
+    })
+}
+
+/// Compute a deterministic snapshot identity from artifact hashes.
+///
+/// BTreeMap iteration order is sorted by key, ensuring stability.
+fn compute_snapshot_id(artifacts: &BTreeMap<String, ArtifactMeta>) -> String {
+    let parts: Vec<String> = artifacts
+        .iter()
+        .map(|(name, meta)| format!("{}:{}", name, meta.sha256))
+        .collect();
+    sha256_hex(parts.join("|").as_bytes())
+}
+
+fn sha256_hex(bytes: &[u8]) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(bytes);
+    format!("{:x}", hasher.finalize())
+}
+
+fn detect_system_device_name() -> Option<String> {
+    let env_name = [
+        "CC_SWITCH_DEVICE_NAME",
+        "COMPUTERNAME",
+        "HOSTNAME",
+    ]
+    .iter()
+    .filter_map(|key| std::env::var(key).ok())
+    .find_map(|value| normalize_device_name(&value));
+
+    if env_name.is_some() {
+        return env_name;
+    }
+
+    let output = Command::new("hostname").output().ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    let hostname = String::from_utf8(output.stdout).ok()?;
+    normalize_device_name(&hostname)
+}
+
+fn normalize_device_name(raw: &str) -> Option<String> {
+    let compact = raw.chars().fold(String::with_capacity(raw.len()), |mut acc, ch| {
+        if ch.is_whitespace() {
+            acc.push(' ');
+        } else if !ch.is_control() {
+            acc.push(ch);
+        }
+        acc
+    });
+    let normalized = compact.split_whitespace().collect::<Vec<_>>().join(" ");
+    let trimmed = normalized.trim();
+    if trimmed.is_empty() {
+        return None;
+    }
+
+    let limited = trimmed.chars().take(MAX_DEVICE_NAME_LEN).collect::<String>();
+    if limited.is_empty() {
+        None
+    } else {
+        Some(limited)
+    }
+}
+
+fn validate_manifest_compat(manifest: &SyncManifest) -> Result<(), AppError> {
+    if manifest.format != PROTOCOL_FORMAT {
+        return Err(localized(
+            "webdav.sync.manifest_format_incompatible",
+            format!("远端 manifest 格式不兼容: {}", manifest.format),
+            format!(
+                "Remote manifest format is incompatible: {}",
+                manifest.format
+            ),
+        ));
+    }
+    if manifest.version != PROTOCOL_VERSION {
+        return Err(localized(
+            "webdav.sync.manifest_version_incompatible",
+            format!(
+                "远端 manifest 协议版本不兼容: v{} (本地 v{PROTOCOL_VERSION})",
+                manifest.version
+            ),
+            format!(
+                "Remote manifest protocol version is incompatible: v{} (local v{PROTOCOL_VERSION})",
+                manifest.version
+            ),
+        ));
+    }
+    Ok(())
+}
+
+// ─── Download & verify ───────────────────────────────────────
+
+async fn download_and_verify(
+    settings: &WebDavSyncSettings,
+    auth: &WebDavAuth,
+    artifact_name: &str,
+    artifacts: &BTreeMap<String, ArtifactMeta>,
+) -> Result<Vec<u8>, AppError> {
+    let meta = artifacts.get(artifact_name).ok_or_else(|| {
+        localized(
+            "webdav.sync.manifest_missing_artifact",
+            format!("manifest 中缺少 artifact: {artifact_name}"),
+            format!("Manifest missing artifact: {artifact_name}"),
+        )
+    })?;
+    let url = remote_file_url(settings, artifact_name)?;
+    let (bytes, _) = get_bytes(&url, auth).await?.ok_or_else(|| {
+        localized(
+            "webdav.sync.remote_missing_artifact",
+            format!("远端缺少 artifact 文件: {artifact_name}"),
+            format!("Remote artifact file missing: {artifact_name}"),
+        )
+    })?;
+
+    // Quick size check before expensive hash
+    if bytes.len() as u64 != meta.size {
+        return Err(localized(
+            "webdav.sync.artifact_size_mismatch",
+            format!(
+                "artifact {artifact_name} 大小不匹配 (expected: {}, got: {})",
+                meta.size,
+                bytes.len(),
+            ),
+            format!(
+                "Artifact {artifact_name} size mismatch (expected: {}, got: {})",
+                meta.size,
+                bytes.len(),
+            ),
+        ));
+    }
+
+    let actual_hash = sha256_hex(&bytes);
+    if actual_hash != meta.sha256 {
+        return Err(localized(
+            "webdav.sync.artifact_hash_mismatch",
+            format!(
+                "artifact {artifact_name} SHA256 校验失败 (expected: {}..., got: {}...)",
+                meta.sha256.get(..8).unwrap_or(&meta.sha256),
+                actual_hash.get(..8).unwrap_or(&actual_hash),
+            ),
+            format!(
+                "Artifact {artifact_name} SHA256 verification failed (expected: {}..., got: {}...)",
+                meta.sha256.get(..8).unwrap_or(&meta.sha256),
+                actual_hash.get(..8).unwrap_or(&actual_hash),
+            ),
+        ));
+    }
+    Ok(bytes)
+}
+
+fn apply_snapshot(
+    db: &crate::database::Database,
+    db_sql: &[u8],
+    skills_zip: &[u8],
+) -> Result<(), AppError> {
+    let sql_str = std::str::from_utf8(db_sql).map_err(|e| {
+        localized(
+            "webdav.sync.sql_not_utf8",
+            format!("SQL 非 UTF-8: {e}"),
+            format!("SQL is not valid UTF-8: {e}"),
+        )
+    })?;
+    let skills_backup = backup_current_skills()?;
+
+    // 先替换 skills，再导入数据库；若导入失败则回滚 skills，避免“半恢复”。
+    restore_skills_zip(skills_zip)?;
+
+    if let Err(db_err) = db.import_sql_string(sql_str) {
+        if let Err(rollback_err) = restore_skills_from_backup(&skills_backup) {
+            return Err(localized(
+                "webdav.sync.db_import_and_rollback_failed",
+                format!("导入数据库失败: {db_err}; 同时回滚 Skills 失败: {rollback_err}"),
+                format!(
+                    "Database import failed: {db_err}; skills rollback also failed: {rollback_err}"
+                ),
+            ));
+        }
+        return Err(db_err);
+    }
+
+    Ok(())
+}
+
+// ─── Remote path helpers ─────────────────────────────────────
+
+fn remote_dir_segments(settings: &WebDavSyncSettings) -> Vec<String> {
+    let mut segs = Vec::new();
+    segs.extend(path_segments(&settings.remote_root).map(str::to_string));
+    segs.push(format!("v{PROTOCOL_VERSION}"));
+    segs.extend(path_segments(&settings.profile).map(str::to_string));
+    segs
+}
+
+fn remote_file_url(settings: &WebDavSyncSettings, file_name: &str) -> Result<String, AppError> {
+    let mut segs = remote_dir_segments(settings);
+    segs.extend(path_segments(file_name).map(str::to_string));
+    build_remote_url(&settings.base_url, &segs)
+}
+
+fn auth_for(settings: &WebDavSyncSettings) -> WebDavAuth {
+    auth_from_credentials(&settings.username, &settings.password)
+}
+
+// ─── Tests ───────────────────────────────────────────────────
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn artifact(sha256: &str, size: u64) -> ArtifactMeta {
+        ArtifactMeta {
+            sha256: sha256.to_string(),
+            size,
+        }
+    }
+
+    #[test]
+    fn snapshot_id_is_stable() {
+        let mut artifacts = BTreeMap::new();
+        artifacts.insert("db.sql".to_string(), artifact("abc123", 100));
+        artifacts.insert("skills.zip".to_string(), artifact("def456", 200));
+
+        let id1 = compute_snapshot_id(&artifacts);
+        let id2 = compute_snapshot_id(&artifacts);
+        assert_eq!(id1, id2);
+    }
+
+    #[test]
+    fn snapshot_id_changes_with_artifacts() {
+        let mut a1 = BTreeMap::new();
+        a1.insert("db.sql".to_string(), artifact("hash-a", 1));
+
+        let mut a2 = BTreeMap::new();
+        a2.insert("db.sql".to_string(), artifact("hash-b", 1));
+
+        assert_ne!(compute_snapshot_id(&a1), compute_snapshot_id(&a2));
+    }
+
+    #[test]
+    fn remote_dir_segments_uses_v2() {
+        let settings = WebDavSyncSettings {
+            remote_root: "cc-switch-sync".to_string(),
+            profile: "default".to_string(),
+            ..WebDavSyncSettings::default()
+        };
+        let segs = remote_dir_segments(&settings);
+        assert_eq!(segs, vec!["cc-switch-sync", "v2", "default"]);
+    }
+
+    #[test]
+    fn sha256_hex_is_correct() {
+        let hash = sha256_hex(b"hello");
+        assert_eq!(
+            hash,
+            "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+        );
+    }
+
+    #[test]
+    fn persist_best_effort_returns_true_on_success() {
+        let mut settings = WebDavSyncSettings::default();
+        let ok = persist_sync_success_best_effort(
+            &mut settings,
+            "hash".to_string(),
+            Some("etag".to_string()),
+            |_settings, _hash, _etag| Ok(()),
+        );
+        assert!(ok);
+    }
+
+    #[test]
+    fn persist_best_effort_returns_false_on_error() {
+        let mut settings = WebDavSyncSettings::default();
+        let ok = persist_sync_success_best_effort(
+            &mut settings,
+            "hash".to_string(),
+            None,
+            |_settings, _hash, _etag| Err(AppError::Config("boom".to_string())),
+        );
+        assert!(!ok);
+    }
+
+    fn manifest_with(format: &str, version: u32) -> SyncManifest {
+        let mut artifacts = BTreeMap::new();
+        artifacts.insert("db.sql".to_string(), artifact("abc", 1));
+        artifacts.insert("skills.zip".to_string(), artifact("def", 2));
+        SyncManifest {
+            format: format.to_string(),
+            version,
+            device_name: "My MacBook".to_string(),
+            created_at: "2026-02-12T00:00:00Z".to_string(),
+            artifacts,
+            snapshot_id: "snap-1".to_string(),
+        }
+    }
+
+    #[test]
+    fn validate_manifest_compat_accepts_supported_manifest() {
+        let manifest = manifest_with(PROTOCOL_FORMAT, PROTOCOL_VERSION);
+        assert!(validate_manifest_compat(&manifest).is_ok());
+    }
+
+    #[test]
+    fn validate_manifest_compat_rejects_wrong_format() {
+        let manifest = manifest_with("other-format", PROTOCOL_VERSION);
+        assert!(validate_manifest_compat(&manifest).is_err());
+    }
+
+    #[test]
+    fn validate_manifest_compat_rejects_wrong_version() {
+        let manifest = manifest_with(PROTOCOL_FORMAT, PROTOCOL_VERSION + 1);
+        assert!(validate_manifest_compat(&manifest).is_err());
+    }
+
+    #[test]
+    fn normalize_device_name_returns_none_for_blank_input() {
+        assert_eq!(normalize_device_name("   \n\t  "), None);
+    }
+
+    #[test]
+    fn normalize_device_name_collapses_whitespace_and_drops_control_chars() {
+        assert_eq!(
+            normalize_device_name("  Mac\tBook \n Pro\u{0007} "),
+            Some("Mac Book Pro".to_string())
+        );
+    }
+
+    #[test]
+    fn normalize_device_name_truncates_to_max_len() {
+        let long = "a".repeat(80);
+        assert_eq!(normalize_device_name(&long).map(|s| s.len()), Some(64));
+    }
+
+    #[test]
+    fn manifest_serialization_uses_device_name_only() {
+        let manifest = manifest_with(PROTOCOL_FORMAT, PROTOCOL_VERSION);
+        let value = serde_json::to_value(&manifest).expect("serialize manifest");
+        assert!(
+            value.get("deviceName").is_some(),
+            "manifest should contain deviceName"
+        );
+        assert!(
+            value.get("deviceId").is_none(),
+            "manifest should not contain deviceId"
+        );
+    }
+}

src-tauri/src/services/webdav_sync/archive.rs

@@ -0,0 +1,346 @@
+use std::collections::HashSet;
+use std::fs;
+use std::io::{Read, Write};
+use std::path::{Path, PathBuf};
+
+use tempfile::{tempdir, TempDir};
+use zip::write::SimpleFileOptions;
+use zip::DateTime;
+
+use crate::error::AppError;
+use crate::services::skill::SkillService;
+
+use super::{io_context_localized, localized, REMOTE_SKILLS_ZIP};
+
+/// Maximum total bytes allowed during zip extraction (512 MB).
+const MAX_EXTRACT_BYTES: u64 = 512 * 1024 * 1024;
+/// Maximum number of entries allowed in a zip archive.
+const MAX_EXTRACT_ENTRIES: usize = 10_000;
+
+pub(super) struct SkillsBackup {
+    _tmp: TempDir,
+    backup_dir: PathBuf,
+    ssot_path: PathBuf,
+    existed: bool,
+}
+
+pub(super) fn zip_skills_ssot(dest_path: &Path) -> Result<(), AppError> {
+    let source = SkillService::get_ssot_dir().map_err(|e| {
+        localized(
+            "webdav.sync.skills_ssot_dir_failed",
+            format!("获取 Skills SSOT 目录失败: {e}"),
+            format!("Failed to resolve Skills SSOT directory: {e}"),
+        )
+    })?;
+    if let Some(parent) = dest_path.parent() {
+        fs::create_dir_all(parent).map_err(|e| AppError::io(parent, e))?;
+    }
+
+    let file = fs::File::create(dest_path).map_err(|e| AppError::io(dest_path, e))?;
+    let mut writer = zip::ZipWriter::new(file);
+    let options = SimpleFileOptions::default()
+        .compression_method(zip::CompressionMethod::Deflated)
+        .last_modified_time(DateTime::default());
+
+    if source.exists() {
+        let canonical_root = fs::canonicalize(&source).unwrap_or_else(|_| source.clone());
+        let mut visited = HashSet::new();
+        mark_visited_dir(&canonical_root, &mut visited)?;
+        zip_dir_recursive(
+            &canonical_root,
+            &canonical_root,
+            &mut writer,
+            options,
+            &mut visited,
+        )?;
+    }
+
+    writer.finish().map_err(|e| {
+        localized(
+            "webdav.sync.skills_zip_write_failed",
+            format!("写入 skills.zip 失败: {e}"),
+            format!("Failed to write skills.zip: {e}"),
+        )
+    })?;
+    Ok(())
+}
+
+pub(super) fn restore_skills_zip(raw: &[u8]) -> Result<(), AppError> {
+    let tmp = tempdir().map_err(|e| {
+        io_context_localized(
+            "webdav.sync.skills_extract_tmpdir_failed",
+            "创建 skills 解压临时目录失败",
+            "Failed to create temporary directory for skills extraction",
+            e,
+        )
+    })?;
+    let zip_path = tmp.path().join(REMOTE_SKILLS_ZIP);
+    fs::write(&zip_path, raw).map_err(|e| AppError::io(&zip_path, e))?;
+
+    let file = fs::File::open(&zip_path).map_err(|e| AppError::io(&zip_path, e))?;
+    let mut archive = zip::ZipArchive::new(file).map_err(|e| {
+        localized(
+            "webdav.sync.skills_zip_parse_failed",
+            format!("解析 skills.zip 失败: {e}"),
+            format!("Failed to parse skills.zip: {e}"),
+        )
+    })?;
+
+    let extracted = tmp.path().join("skills-extracted");
+    fs::create_dir_all(&extracted).map_err(|e| AppError::io(&extracted, e))?;
+
+    if archive.len() > MAX_EXTRACT_ENTRIES {
+        return Err(localized(
+            "webdav.sync.skills_zip_too_many_entries",
+            format!("skills.zip 条目数过多（{}），上限 {MAX_EXTRACT_ENTRIES}", archive.len()),
+            format!("skills.zip has too many entries ({}), limit is {MAX_EXTRACT_ENTRIES}", archive.len()),
+        ));
+    }
+
+    let mut total_bytes: u64 = 0;
+    for idx in 0..archive.len() {
+        let mut entry = archive.by_index(idx).map_err(|e| {
+            localized(
+                "webdav.sync.skills_zip_entry_read_failed",
+                format!("读取 ZIP 项失败: {e}"),
+                format!("Failed to read ZIP entry: {e}"),
+            )
+        })?;
+        let Some(safe_name) = entry.enclosed_name() else {
+            continue;
+        };
+        let out_path = extracted.join(safe_name);
+        if entry.is_dir() {
+            fs::create_dir_all(&out_path).map_err(|e| AppError::io(&out_path, e))?;
+            continue;
+        }
+        if let Some(parent) = out_path.parent() {
+            fs::create_dir_all(parent).map_err(|e| AppError::io(parent, e))?;
+        }
+        let mut out = fs::File::create(&out_path).map_err(|e| AppError::io(&out_path, e))?;
+        let written = std::io::copy(&mut entry, &mut out).map_err(|e| AppError::io(&out_path, e))?;
+        total_bytes += written;
+        if total_bytes > MAX_EXTRACT_BYTES {
+            return Err(localized(
+                "webdav.sync.skills_zip_too_large",
+                format!("skills.zip 解压后体积超过上限（{} MB）", MAX_EXTRACT_BYTES / 1024 / 1024),
+                format!("skills.zip extracted size exceeds limit ({} MB)", MAX_EXTRACT_BYTES / 1024 / 1024),
+            ));
+        }
+    }
+
+    let ssot = SkillService::get_ssot_dir().map_err(|e| {
+        localized(
+            "webdav.sync.skills_ssot_dir_failed",
+            format!("获取 Skills SSOT 目录失败: {e}"),
+            format!("Failed to resolve Skills SSOT directory: {e}"),
+        )
+    })?;
+    let bak = ssot.with_extension("bak");
+
+    if ssot.exists() {
+        if bak.exists() {
+            let _ = fs::remove_dir_all(&bak);
+        }
+        fs::rename(&ssot, &bak).map_err(|e| AppError::io(&ssot, e))?;
+    }
+
+    if let Err(e) = copy_dir_recursive(&extracted, &ssot) {
+        if bak.exists() {
+            let _ = fs::remove_dir_all(&ssot);
+            let _ = fs::rename(&bak, &ssot);
+        }
+        return Err(e);
+    }
+
+    let _ = fs::remove_dir_all(&bak);
+    Ok(())
+}
+
+pub(super) fn backup_current_skills() -> Result<SkillsBackup, AppError> {
+    let ssot = SkillService::get_ssot_dir().map_err(|e| {
+        localized(
+            "webdav.sync.skills_ssot_dir_failed",
+            format!("获取 Skills SSOT 目录失败: {e}"),
+            format!("Failed to resolve Skills SSOT directory: {e}"),
+        )
+    })?;
+    let tmp = tempdir().map_err(|e| {
+        io_context_localized(
+            "webdav.sync.skills_backup_tmpdir_failed",
+            "创建 skills 备份临时目录失败",
+            "Failed to create temporary directory for skills backup",
+            e,
+        )
+    })?;
+    let backup_dir = tmp.path().join("skills-backup");
+
+    let existed = ssot.exists();
+    if existed {
+        copy_dir_recursive(&ssot, &backup_dir)?;
+    }
+
+    Ok(SkillsBackup {
+        _tmp: tmp,
+        backup_dir,
+        ssot_path: ssot,
+        existed,
+    })
+}
+
+pub(super) fn restore_skills_from_backup(backup: &SkillsBackup) -> Result<(), AppError> {
+    if backup.ssot_path.exists() {
+        fs::remove_dir_all(&backup.ssot_path).map_err(|e| AppError::io(&backup.ssot_path, e))?;
+    }
+
+    if backup.existed {
+        copy_dir_recursive(&backup.backup_dir, &backup.ssot_path)?;
+    }
+
+    Ok(())
+}
+
+fn zip_dir_recursive(
+    root: &Path,
+    current: &Path,
+    writer: &mut zip::ZipWriter<fs::File>,
+    options: SimpleFileOptions,
+    visited: &mut HashSet<PathBuf>,
+) -> Result<(), AppError> {
+    let mut entries: Vec<_> = fs::read_dir(current)
+        .map_err(|e| AppError::io(current, e))?
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|e| AppError::io(current, e))?;
+    entries.sort_by_key(|e| e.file_name());
+
+    for entry in entries {
+        let path = entry.path();
+        let name = entry.file_name();
+        let name_str = name.to_string_lossy();
+
+        if name_str.starts_with('.') {
+            continue;
+        }
+
+        let real_path = match fs::canonicalize(&path) {
+            Ok(p) if p.starts_with(root) => p,
+            Ok(_) => {
+                log::warn!(
+                    "[WebDAV] Skipping symlink outside skills root: {}",
+                    path.display()
+                );
+                continue;
+            }
+            Err(_) => path.clone(),
+        };
+
+        let rel = real_path
+            .strip_prefix(root)
+            .or_else(|_| path.strip_prefix(root))
+            .map_err(|e| {
+                localized(
+                    "webdav.sync.zip_relative_path_failed",
+                    format!("生成 ZIP 相对路径失败: {e}"),
+                    format!("Failed to build relative ZIP path: {e}"),
+                )
+            })?;
+        let rel_str = rel.to_string_lossy().replace('\\', "/");
+
+        if real_path.is_dir() {
+            if !mark_visited_dir(&real_path, visited)? {
+                log::warn!(
+                    "[WebDAV] Skipping already visited directory: {}",
+                    real_path.display()
+                );
+                continue;
+            }
+            writer
+                .add_directory(format!("{rel_str}/"), options)
+                .map_err(|e| {
+                    localized(
+                        "webdav.sync.zip_add_directory_failed",
+                        format!("写入 ZIP 目录失败: {e}"),
+                        format!("Failed to write ZIP directory entry: {e}"),
+                    )
+                })?;
+            zip_dir_recursive(root, &real_path, writer, options, visited)?;
+        } else {
+            writer.start_file(&rel_str, options).map_err(|e| {
+                localized(
+                    "webdav.sync.zip_start_file_failed",
+                    format!("写入 ZIP 文件头失败: {e}"),
+                    format!("Failed to start ZIP file entry: {e}"),
+                )
+            })?;
+            let mut file = fs::File::open(&real_path).map_err(|e| AppError::io(&real_path, e))?;
+            let mut buf = Vec::new();
+            file.read_to_end(&mut buf)
+                .map_err(|e| AppError::io(&real_path, e))?;
+            writer.write_all(&buf).map_err(|e| {
+                localized(
+                    "webdav.sync.zip_write_file_failed",
+                    format!("写入 ZIP 文件内容失败: {e}"),
+                    format!("Failed to write ZIP file content: {e}"),
+                )
+            })?;
+        }
+    }
+    Ok(())
+}
+
+fn copy_dir_recursive(src: &Path, dest: &Path) -> Result<(), AppError> {
+    let mut visited = HashSet::new();
+    copy_dir_recursive_inner(src, dest, &mut visited)
+}
+
+fn copy_dir_recursive_inner(
+    src: &Path,
+    dest: &Path,
+    visited: &mut HashSet<PathBuf>,
+) -> Result<(), AppError> {
+    if !src.exists() {
+        return Ok(());
+    }
+    if !mark_visited_dir(src, visited)? {
+        log::warn!(
+            "[WebDAV] Skipping already visited copy path: {}",
+            src.display()
+        );
+        return Ok(());
+    }
+    fs::create_dir_all(dest).map_err(|e| AppError::io(dest, e))?;
+    for entry in fs::read_dir(src).map_err(|e| AppError::io(src, e))? {
+        let entry = entry.map_err(|e| AppError::io(src, e))?;
+        let path = entry.path();
+        let dest_path = dest.join(entry.file_name());
+        if path.is_dir() {
+            copy_dir_recursive_inner(&path, &dest_path, visited)?;
+        } else {
+            fs::copy(&path, &dest_path).map_err(|e| AppError::io(&dest_path, e))?;
+        }
+    }
+    Ok(())
+}
+
+fn mark_visited_dir(path: &Path, visited: &mut HashSet<PathBuf>) -> Result<bool, AppError> {
+    let canonical = fs::canonicalize(path).map_err(|e| AppError::io(path, e))?;
+    Ok(visited.insert(canonical))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::mark_visited_dir;
+    use std::collections::HashSet;
+    use tempfile::tempdir;
+
+    #[test]
+    fn mark_visited_dir_tracks_canonical_duplicates() {
+        let temp = tempdir().expect("tempdir");
+        let dir = temp.path().join("skills");
+        std::fs::create_dir_all(&dir).expect("create dir");
+
+        let mut visited = HashSet::new();
+        assert!(mark_visited_dir(&dir, &mut visited).expect("first visit"));
+        assert!(!mark_visited_dir(&dir, &mut visited).expect("second visit"));
+    }
+}

src-tauri/src/settings.rs

@@ -1,5 +1,6 @@
 use serde::{Deserialize, Serialize};
 use std::fs;
+use std::io::Write;
 use std::path::PathBuf;
 use std::sync::{OnceLock, RwLock};
 
@@ -58,6 +59,101 @@ impl VisibleApps {
     }
 }
 
+/// WebDAV 同步状态（持久化同步进度信息）
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct WebDavSyncStatus {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_sync_at: Option<i64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_error: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_remote_etag: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_local_manifest_hash: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_remote_manifest_hash: Option<String>,
+}
+
+fn default_remote_root() -> String {
+    "cc-switch-sync".to_string()
+}
+fn default_profile() -> String {
+    "default".to_string()
+}
+
+/// WebDAV v2 同步设置
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct WebDavSyncSettings {
+    #[serde(default)]
+    pub enabled: bool,
+    #[serde(default)]
+    pub base_url: String,
+    #[serde(default)]
+    pub username: String,
+    #[serde(default)]
+    pub password: String,
+    #[serde(default = "default_remote_root")]
+    pub remote_root: String,
+    #[serde(default = "default_profile")]
+    pub profile: String,
+    #[serde(default)]
+    pub status: WebDavSyncStatus,
+}
+
+impl Default for WebDavSyncSettings {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            base_url: String::new(),
+            username: String::new(),
+            password: String::new(),
+            remote_root: default_remote_root(),
+            profile: default_profile(),
+            status: WebDavSyncStatus::default(),
+        }
+    }
+}
+
+impl WebDavSyncSettings {
+    pub fn validate(&self) -> Result<(), crate::error::AppError> {
+        if self.base_url.trim().is_empty() {
+            return Err(crate::error::AppError::localized(
+                "webdav.base_url.required",
+                "WebDAV 地址不能为空",
+                "WebDAV URL is required.",
+            ));
+        }
+        if self.username.trim().is_empty() {
+            return Err(crate::error::AppError::localized(
+                "webdav.username.required",
+                "WebDAV 用户名不能为空",
+                "WebDAV username is required.",
+            ));
+        }
+        Ok(())
+    }
+
+    pub fn normalize(&mut self) {
+        self.base_url = self.base_url.trim().to_string();
+        self.username = self.username.trim().to_string();
+        self.remote_root = self.remote_root.trim().to_string();
+        self.profile = self.profile.trim().to_string();
+        if self.remote_root.is_empty() {
+            self.remote_root = default_remote_root();
+        }
+        if self.profile.is_empty() {
+            self.profile = default_profile();
+        }
+    }
+
+    /// Returns true if all credential fields are blank (no config to persist).
+    fn is_empty(&self) -> bool {
+        self.base_url.is_empty() && self.username.is_empty() && self.password.is_empty()
+    }
+}
+
 /// 应用设置结构
 ///
 /// 存储设备级别设置，保存在本地 `~/.cc-switch/settings.json`，不随数据库同步。
@@ -118,6 +214,14 @@ pub struct AppSettings {
     #[serde(default)]
     pub skill_sync_method: SyncMethod,
 
+    // ===== WebDAV 同步设置 =====
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub webdav_sync: Option<WebDavSyncSettings>,
+
+    // ===== WebDAV 备份设置（旧版，保留向后兼容）=====
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub webdav_backup: Option<serde_json::Value>,
+
     // ===== 终端设置 =====
     /// 首选终端应用（可选，默认使用系统默认终端）
     /// - macOS: "terminal" | "iterm2" | "warp" | "alacritty" | "kitty" | "ghostty"
@@ -155,6 +259,8 @@ impl Default for AppSettings {
             current_provider_gemini: None,
             current_provider_opencode: None,
             skill_sync_method: SyncMethod::default(),
+            webdav_sync: None,
+            webdav_backup: None,
             preferred_terminal: None,
         }
     }
@@ -205,6 +311,13 @@ impl AppSettings {
             .map(|s| s.trim())
             .filter(|s| matches!(*s, "en" | "zh" | "ja"))
             .map(|s| s.to_string());
+
+        if let Some(sync) = &mut self.webdav_sync {
+            sync.normalize();
+            if sync.is_empty() {
+                self.webdav_sync = None;
+            }
+        }
     }
 
     fn load_from_file() -> Self {
@@ -245,7 +358,27 @@ fn save_settings_file(settings: &AppSettings) -> Result<(), AppError> {
 
     let json = serde_json::to_string_pretty(&normalized)
         .map_err(|e| AppError::JsonSerialize { source: e })?;
-    fs::write(&path, json).map_err(|e| AppError::io(&path, e))?;
+    #[cfg(unix)]
+    {
+        use std::fs::OpenOptions;
+        use std::os::unix::fs::OpenOptionsExt;
+
+        let mut file = OpenOptions::new()
+            .create(true)
+            .write(true)
+            .truncate(true)
+            .mode(0o600)
+            .open(&path)
+            .map_err(|e| AppError::io(&path, e))?;
+        file.write_all(json.as_bytes())
+            .map_err(|e| AppError::io(&path, e))?;
+    }
+
+    #[cfg(not(unix))]
+    {
+        fs::write(&path, json).map_err(|e| AppError::io(&path, e))?;
+    }
+
     Ok(())
 }
 
@@ -283,6 +416,15 @@ pub fn get_settings() -> AppSettings {
         .clone()
 }
 
+pub fn get_settings_for_frontend() -> AppSettings {
+    let mut settings = get_settings();
+    if let Some(sync) = &mut settings.webdav_sync {
+        sync.password.clear();
+    }
+    settings.webdav_backup = None;
+    settings
+}
+
 pub fn update_settings(mut new_settings: AppSettings) -> Result<(), AppError> {
     new_settings.normalize_paths();
     save_settings_file(&new_settings)?;
@@ -295,6 +437,22 @@ pub fn update_settings(mut new_settings: AppSettings) -> Result<(), AppError> {
     Ok(())
 }
 
+fn mutate_settings<F>(mutator: F) -> Result<(), AppError>
+where
+    F: FnOnce(&mut AppSettings),
+{
+    let mut guard = settings_store().write().unwrap_or_else(|e| {
+        log::warn!("设置锁已毒化，使用恢复值: {e}");
+        e.into_inner()
+    });
+    let mut next = guard.clone();
+    mutator(&mut next);
+    next.normalize_paths();
+    save_settings_file(&next)?;
+    *guard = next;
+    Ok(())
+}
+
 /// 从文件重新加载设置到内存缓存
 /// 用于导入配置等场景，确保内存缓存与文件同步
 pub fn reload_settings() -> Result<(), AppError> {
@@ -433,3 +591,26 @@ pub fn get_preferred_terminal() -> Option<String> {
         .preferred_terminal
         .clone()
 }
+
+// ===== WebDAV 同步设置管理函数 =====
+
+/// 获取 WebDAV 同步设置
+pub fn get_webdav_sync_settings() -> Option<WebDavSyncSettings> {
+    settings_store().read().ok()?.webdav_sync.clone()
+}
+
+/// 保存 WebDAV 同步设置
+pub fn set_webdav_sync_settings(settings: Option<WebDavSyncSettings>) -> Result<(), AppError> {
+    mutate_settings(|current| {
+        current.webdav_sync = settings;
+    })
+}
+
+/// 仅更新 WebDAV 同步状态，避免覆写 credentials/root/profile 等字段
+pub fn update_webdav_sync_status(status: WebDavSyncStatus) -> Result<(), AppError> {
+    mutate_settings(|current| {
+        if let Some(sync) = current.webdav_sync.as_mut() {
+            sync.status = status;
+        }
+    })
+}