feat(connection): update saved connections by ID through deep links

docs/content/docs/cli.cn.mdx

@@ -182,7 +182,7 @@ open 'dbx://open'
 <a href="dbx://open">使用 DBX 打开</a>
 ```
 
-使用 `dbx://connection/new` 可以打开新建连接窗口并预填连接信息。
+使用不带 `id` 的 `dbx://connection/new` 可以打开新建连接窗口并预填连接信息。
 
 DSN 模式：
 
@@ -228,6 +228,36 @@ open 'dbx://connection/new?type=r-nacos&url=http%3A%2F%2F127.0.0.1%3A8848%2Fnaco
 
 `nacos` 是 `nacos-v2` 的别名，`rnacos` 是 `r-nacos` 的别名。URL 模式会保留服务端点路径，顶层 `host`、`port`、`user`、`password`、`ssl` 会覆盖 `url` 中的对应值。Consul 的 `password` 表示 ACL token；Nacos 传入 `password` 时必须同时传入 `user`。省略 `v` 或使用 `v=1` 表示当前深链协议，其他版本会被拒绝。
 
+### 按 ID 更新已保存连接
+
+在同一个 `dbx://connection/new` 路由上增加 `id`，即可打开指定的已保存连接进行编辑。例如，堡垒机可以为已有连接传入新的登录凭据：
+
+```bash
+open 'dbx://connection/new?id=saved-connection-id&user=fresh-sso-token&password=fresh-sso-token'
+```
+
+将 `saved-connection-id` 替换为 MCP 工具 `dbx_list_connections` 返回的连接 ID。更新按 ID 精确匹配，不按显示名称查找。CLI 命令 `dbx connections list --json` 目前只列出名称和端点等信息，不返回连接 ID。
+
+收到更新链接后，DBX 只打开预填好的编辑窗口。检查修改内容并点击**保存**后，才会以原连接 ID 和原侧栏分组持久化修改。链接不会自动保存、测试或连接数据库；取消编辑不会修改已保存配置。ID 为空或不存在、目标是一次性连接、已有其他连接窗口打开时，更新会被拒绝，不会退回新建连接。
+
+更新支持使用内置 MySQL、PostgreSQL、SQL Server 配置的已保存字段式连接；存在非空 `connection_string` 的连接不支持此更新流程。只有链接中明确提供的字段才会修改：
+
+| 参数 | 更新行为 |
+| --- | --- |
+| `name`、`host` | 替换当前值，不接受空值 |
+| `port` | 替换为 1 到 65535 之间的整数端口 |
+| `user`、`password` | 预填凭据并保留首尾空白字符；传空值表示清空 |
+| `database`、`url_params` | 替换当前值；传空值表示清空 |
+| `ssl` | 更新 SSL 开关；最终 TLS 行为遵循驱动和 URL 参数规则 |
+
+省略的字段保留原值，包括端口和 SSL 设置。需要清空字段时，保留参数名并传空值，例如 `database=&url_params=`。参数值应进行 URL 编码，例如密码中的字面量 `+` 应编码为 `%2B`。
+
+保存时仍遵循现有的凭据清理规则和该连接的“保存密码”设置。
+
+除 `id` 和上述字段外，只接受可选的协议版本 `v=1`。更新链接不接受 `type`、`url`、`one_time`（包括 `one_time=false`）、未知参数或重复参数名，也不能更改驱动配置或要求自动操作。
+
+保存新的 SSO 凭据不会延长其有效期。MCP 可以读取保存后的连接配置，但仍会独立建立数据库会话，需要凭据仍然有效；更新不会把桌面端正在使用的会话转交给 MCP。
+
 <Callout type="info">测试系统级 `dbx://` 唤起前，请先安装并启动一次 DBX 桌面端，让系统注册 URL 协议。macOS 可使用 `open 'dbx://open'` 或 `open 'dbx://connection/new?...'` 测试。</Callout>
 
 <Callout type="warning">深链可能在浏览器或终端历史中暴露数据库密码或 Consul ACL token。不要将携带凭据的链接写入共享日志、Shell 历史、工单或聊天消息。</Callout>

docs/content/docs/cli.mdx

@@ -184,7 +184,7 @@ A web button can link to the protocol directly:
 <a href="dbx://open">Open in DBX</a>
 ```
 
-Use `dbx://connection/new` to open the new connection dialog with connection fields prefilled.
+Use `dbx://connection/new` without an `id` to open the new connection dialog with connection fields prefilled.
 
 DSN mode:
 
@@ -230,6 +230,36 @@ open 'dbx://connection/new?type=r-nacos&url=http%3A%2F%2F127.0.0.1%3A8848%2Fnaco
 
 `nacos` is an alias for `nacos-v2`, and `rnacos` is an alias for `r-nacos`. In URL mode, service endpoint paths are preserved; top-level `host`, `port`, `user`, `password`, and `ssl` fields override values from `url`. For Consul, `password` is the ACL token. Nacos requires `user` when `password` is present. Omitting `v` or using `v=1` selects the current deep-link protocol; other versions are rejected.
 
+### Update a saved connection by ID
+
+Add `id` to the same `dbx://connection/new` route to open an existing saved connection for editing. For example, a bastion host can provide fresh credentials for a saved connection:
+
+```bash
+open 'dbx://connection/new?id=saved-connection-id&user=fresh-sso-token&password=fresh-sso-token'
+```
+
+Replace `saved-connection-id` with the connection ID returned by the MCP `dbx_list_connections` tool. Matching uses the ID, never the display name. The CLI command `dbx connections list --json` currently lists names and endpoints but does not return connection IDs.
+
+Receiving an update link only opens a prefilled edit dialog. Review the changes and click **Save** to persist them under the same connection ID and sidebar group. The link does not automatically save, test, or connect to the database. Canceling leaves the saved connection unchanged. An update is rejected if the ID is empty or unknown, the target is a one-time connection, or another connection dialog is already open; it never falls back to creating a connection.
+
+Updates support saved, field-based connections using the built-in MySQL, PostgreSQL, or SQL Server profile. Connections with a nonempty `connection_string` are not supported by this update flow. Only explicitly supplied fields change:
+
+| Parameter | Update behavior |
+| --- | --- |
+| `name`, `host` | Replace the current value; empty values are rejected |
+| `port` | Replace the port with an integer from 1 to 65535 |
+| `user`, `password` | Prefill credentials without trimming whitespace; an empty value clears the field |
+| `database`, `url_params` | Replace the current value; an empty value clears the field |
+| `ssl` | Update the SSL switch; effective TLS behavior follows the driver and URL parameters |
+
+Omitted fields retain their saved values, including port and SSL settings. To clear a field, include the parameter with an empty value, such as `database=&url_params=`. URL-encode parameter values; for example, use `%2B` for a literal `+` in a password.
+
+The usual Save behavior still applies, including credential sanitization and the connection’s Save password setting.
+
+Besides `id` and the fields above, only the optional protocol version `v=1` is accepted. Update links reject `type`, `url`, `one_time` (including `one_time=false`), unknown parameters, and duplicate parameter keys. They cannot change the driver profile or request automatic actions.
+
+Saving a refreshed SSO credential does not extend its lifetime. MCP can discover the saved profile, but it establishes its own database session and still needs a valid credential; the update does not transfer the desktop's active session to MCP.
+
 <Callout type="info">Before testing system-level `dbx://` launches, install and open DBX Desktop once so the operating system can register the URL scheme. On macOS, use `open 'dbx://open'` or `open 'dbx://connection/new?...'` to test it.</Callout>
 
 <Callout type="warning">A deep link may expose a database password or Consul ACL token in browser and terminal history. Do not put credential-bearing links in shared logs, shell history, tickets, or chat messages.</Callout>