feat(plugins): expose connection enumeration to plugins

docs/content/docs/plugin-development.cn.mdx

@@ -125,6 +125,7 @@ Manifest 中的路径相对于包根目录，不能以 `/` 开头、不能包含
     "host.storage",
     "host.clipboard:read",
     "host.data:read",
+    "host.connections:read",
     "host.network:https://s3.example.com:443"
   ],
   "entrypoints": {
@@ -146,6 +147,7 @@ Manifest 中的路径相对于包根目录，不能以 `/` 开头、不能包含
 - `host.ai` 允许插件接入 DBX 全局 AI 面板：可以打开 Ask 快照对话、选择性打开使用实时插件工具的 Agent 对话，以及注册当前工作台的推荐问题。旧版 DBX 会在安装时因未知权限而失败，需要兼容旧宿主的插件应把 `host.ai` 作为可选能力，并通过 `capabilities.ai` / `capabilities.aiRecommendations` 判断运行时支持。
 - `host.clipboard:read` 允许工作台 UI 读取系统剪贴板（见 [系统剪贴板](#系统剪贴板)）。写剪贴板不需要权限；读取会把用户数据（密码、令牌）交给插件代码，因此需要门控。
 - `host.data:read` 允许 `window.dbxPlugin.queryData` 在用户授权给插件的连接上执行一条只读 SQL（见 [只读数据查询](#只读数据查询)）。每个连接都需要用户同意；它不会授予写入、DDL 或重连。
+- `host.connections:read` 允许通过 `window.dbxPlugin.getConnections()` 或 `window.dbxPlugin.connections.list()` 获取当前所有已配置连接的只读脱敏信息（见 [连接信息读取](#连接信息读取)）。
 - `host.network:https://host[:port]` 声明浏览器可访问的 HTTPS origin，DBX 将它加入 CSP 的 `connect-src`；最多 8 个，不允许路径、通配符或 Token。仍受目标服务 CORS 规则约束。该权限不是原生 Sidecar 的网络防火墙。
 - `backend.transport` 默认是 `stdio-jsonl`；需要二进制帧时使用 `stdio-framed`，并同时声明 `host.binary`。
 - `backend.executable`、`ui.root` 和 `ui.entry` 必须指向包内文件；带原生后端的包必须为每个目标平台提供对应可执行文件。
@@ -524,6 +526,37 @@ if (window.dbxPlugin.capabilities.dataApi) {
 
 该 API 属于 Host API 1.4。请同时保留 `engines.host_api` 下限和 `capabilities.dataApi` 运行时检查；无法弹出确认框的 Web 宿主会拒绝请求，而不会静默授权。
 
+### 连接信息读取
+
+需要展示连接下拉框或根据连接执行特定任务（例如通过 `host.data:read` 查询数据）的插件，可以通过 `host.connections:read` 权限枚举当前配置的所有连接列表：
+
+```json
+{
+  "permissions": ["host.connections:read"]
+}
+```
+
+```js
+await window.dbxPlugin.ready;
+if (window.dbxPlugin.capabilities.connectionsApi) {
+  const connections = await window.dbxPlugin.getConnections();
+  // 也可通过 window.dbxPlugin.connections.list();
+  for (const conn of connections) {
+    console.log(conn.id, conn.name, conn.dialect, conn.connected);
+  }
+}
+```
+
+返回的每个连接对象包含：
+- `id`: 连接唯一标识，可直接传给 `queryData`、`getPlanCapabilities` 等；
+- `name`: 连接名称；
+- `dialect` / `dbType`: 数据库方言/类型（如 `mysql`, `postgres`, `sqlite` 等）；
+- `connected` / `isConnected`: 当前是否已建立物理连接；
+- `readOnly`: 是否为只读连接；
+- `database` / `schema`: 默认数据库或模式（如有）。
+
+> **安全边界**：返回列表完全脱敏，不包含密码、用户名、主机、端口或连接串等敏感凭据。
+
 ### 系统剪贴板
 
 插件沙箱是 opaque origin 且没有剪贴板权限，`navigator.clipboard` 在里面不可用。宿主代为桥接系统剪贴板：

docs/content/docs/plugin-development.mdx

@@ -125,6 +125,7 @@ Manifest paths are relative to the package root. They cannot start with `/`, con
     "host.storage",
     "host.clipboard:read",
     "host.data:read",
+    "host.connections:read",
     "host.network:https://s3.example.com:443"
   ],
   "entrypoints": {
@@ -146,6 +147,7 @@ Manifest paths are relative to the package root. They cannot start with `/`, con
 - `host.ai` lets a plugin use the global DBX AI panel for Ask snapshot conversations, optional Agent conversations backed by live plugin tools, and workbench-specific quick-question recommendations. Older DBX builds reject the unknown permission at install time, so plugins that must install everywhere should treat `host.ai` as optional and check `capabilities.ai` / `capabilities.aiRecommendations` at runtime.
 - `host.clipboard:read` allows reading the system clipboard from the workbench UI (see [System Clipboard](#system-clipboard)). Clipboard writes need no permission; reads hand user data (passwords, tokens) to plugin code, so they are gated.
 - `host.data:read` allows `window.dbxPlugin.queryData` to run one read-only SQL statement on a connection the user granted to the plugin (see [Read-only Data Queries](#read-only-data-queries)). Every connection needs the user's consent; it never grants writes, DDL, or reconnects.
+- `host.connections:read` allows `window.dbxPlugin.getConnections()` or `window.dbxPlugin.connections.list()` to read secret-free summary metadata for all configured connections (see [Connection Enumeration](#connection-enumeration)).
 - `host.network:https://host[:port]` declares a browser-accessible HTTPS origin added to CSP `connect-src`; at most eight origins are allowed, with no paths, wildcards, or tokens. The service's CORS rules still apply. This permission is not a native Sidecar network firewall.
 - `backend.transport` defaults to `stdio-jsonl`. Use `stdio-framed` for binary frames and declare `host.binary` as well.
 - `backend.executable`, `ui.root`, and `ui.entry` must point to package files. Native packages need a matching executable for every target.
@@ -524,6 +526,37 @@ if (window.dbxPlugin.capabilities.dataApi) {
 
 This API is Host API 1.4. Keep both the `engines.host_api` floor and the `capabilities.dataApi` runtime check; web hosts that cannot show a consent dialog deny the request instead of granting it.
 
+### Connection Enumeration
+
+Plugins that display connection pickers or perform connection-specific tasks (e.g. running queries through `host.data:read`) can enumerate all configured connections with the `host.connections:read` permission:
+
+```json
+{
+  "permissions": ["host.connections:read"]
+}
+```
+
+```js
+await window.dbxPlugin.ready;
+if (window.dbxPlugin.capabilities.connectionsApi) {
+  const connections = await window.dbxPlugin.getConnections();
+  // or await window.dbxPlugin.connections.list();
+  for (const conn of connections) {
+    console.log(conn.id, conn.name, conn.dialect, conn.connected);
+  }
+}
+```
+
+Each returned connection object includes:
+- `id`: unique connection identifier, accepted by `queryData`, `getPlanCapabilities`, etc.;
+- `name`: user-configured display name;
+- `dialect` / `dbType`: database dialect or type (e.g. `mysql`, `postgres`, `sqlite`);
+- `connected` / `isConnected`: whether the connection is currently open;
+- `readOnly`: whether the connection is marked read-only;
+- `database` / `schema`: default database or schema if configured.
+
+> **Security Boundary**: The returned list is completely sanitized and never contains passwords, usernames, hostnames, ports, or raw connection strings.
+
 ### System Clipboard
 
 The plugin sandbox has an opaque origin and no clipboard permission, so `navigator.clipboard` is unavailable there. The host bridges the system clipboard instead: