[Blankll]

AI requests resolve an explicit connection decision first, then the system default, then denial. Conversation restrictions can only narrow that access. SQLKit owns policy storage, migration, payload classification, and authorization for both external MCP and built-in agents.

• Use one application AI invocation gate for MCP and agent dispatch, with fresh checks after connection/SSH resolution and on every retry.
• Bind agent execution to the conversation and source identities; reload current attachment restrictions and confirmation rules so detachment, deletion, and permission changes affect queued calls.
• Keep preflight before the existing confirmation flow. Reject forbidden calls without prompting, renew approval when requirements become stricter, and report execution-time denial without transport retries.
• Gate AI schema/context gathering and omit cached schema or editor context when associated connections cannot be read. Remove SQLKit's unused generic WebView capability command and frontend wrapper; manual database UI commands keep their existing behavior.
• Replace the separate MCP allowlist UI with connection permissions and system defaults, preserving effective-access summaries, keyboard support, English/Chinese copy, and draft recovery. Synchronize Chinese inheritance copy and remove obsolete allowlist/mode translations.
• Treat permission-record cleanup after a successful connection deletion as best effort, so cleanup failure does not report that deletion failed.
• Remove the redundant schema precheck while retaining fresh authorization around awaited connection setup and before returning schema or cached context.

Merge prerequisite: Merge data-studio-agent #35 before this PR. Existing released tags lack the required host hooks. Keep the exact compatible commit until that implementation is merged and released; then update the manifest and lockfile to a release containing it.

Dependency: host-controlled preparation and execution outcomes. Both manifest and lockfile pin the shared runtime by exact Git revision. The shared runtime coordinates confirmation, queues, and retries; it does not implement the application's permission chain. Re-preparation always receives the original resolved input, and each tool call allows at most three confirmation renewals independently of transport retries.

Validation:

• cargo test --lib --locked --quiet: 584 passed, one existing ignored test
• cargo check --lib and locked library tests against the pinned runtime
• Frontend build and all 780 tests pass
• Lint passes with one pre-existing UnoCSS ordering warning
• Formatting checked for changed permission, executor, adapter, and bridge files
• Regressions cover revocation, current source restrictions, detachment/deletion/rebinding, confirmation changes, denied result events, confirmation card reuse, and connection-deletion cleanup failures

Authorization is checked at dispatch; it does not cancel operations already dispatched or erase context already sent to a model. Repository-wide formatting checks retain pre-existing differences outside the changed modules.