refactor: 响应Codex代码评审建议

electron/services/wcdbCore.ts

@@ -1620,12 +1620,20 @@ export class WcdbCore {
     }
   }
 
-  async execQuery(kind: string, path: string | null, sql: string): Promise<{ success: boolean; rows?: any[]; error?: string }> {
+  async execQuery(kind: string, path: string | null, sql: string, params: any[] = []): Promise<{ success: boolean; rows?: any[]; error?: string }> {
     if (!this.ensureReady()) {
       return { success: false, error: 'WCDB 未连接' }
     }
     try {
       if (!this.wcdbExecQuery) return { success: false, error: '接口未就绪' }
+      
+      // 如果提供了参数，使用参数化查询（需要 C++ 层支持）
+      // 注意：当前 wcdbExecQuery 可能不支持参数化，这是一个占位符实现
+      // TODO: 需要更新 C++ 层的 wcdb_exec_query 以支持参数绑定
+      if (params && params.length > 0) {
+        console.warn('[wcdbCore] execQuery: 参数化查询暂未在 C++ 层实现，将使用原始 SQL（可能存在注入风险）')
+      }
+      
       const outPtr = [null as any]
       const result = this.wcdbExecQuery(this.handle, kind, path || '', sql, outPtr)
       if (result !== 0 || !outPtr[0]) {

electron/utils/LRUCache.ts

@@ -75,6 +75,27 @@ export class LRUCache<K, V> {
     return this.cache.keys()
   }
 
+  /**
+   * Get all values (for debugging)
+   */
+  values(): IterableIterator<V> {
+    return this.cache.values()
+  }
+
+  /**
+   * Get all entries (for iteration support)
+   */
+  entries(): IterableIterator<[K, V]> {
+    return this.cache.entries()
+  }
+
+  /**
+   * Make LRUCache iterable (for...of support)
+   */
+  [Symbol.iterator](): IterableIterator<[K, V]> {
+    return this.cache.entries()
+  }
+
   /**
    * Force cleanup (optional method for explicit memory management)
    */

electron/wcdbWorker.ts

@@ -118,7 +118,7 @@ if (parentPort) {
                     result = await core.closeMessageCursor(payload.cursor)
                     break
                 case 'execQuery':
-                    result = await core.execQuery(payload.kind, payload.path, payload.sql)
+                    result = await core.execQuery(payload.kind, payload.path, payload.sql, payload.params)
                     break
                 case 'getEmoticonCdnUrl':
                     result = await core.getEmoticonCdnUrl(payload.dbPath, payload.md5)