@techysy/10router 1.0.3 → 1.0.5

package/app/package.json

@@ -1,66 +1,66 @@
-{
-  "name": "10router-app",
-  "version": "1.0.3",
-  "description": "10Router web dashboard",
-  "private": true,
-  "scripts": {
-    "dev": "next dev --port 20127",
-    "dev:webpack": "next dev --webpack --port 20127",
-    "build": "next build --webpack",
-    "prebuild:fpk": "node scripts/sync-manifest-version.mjs",
-    "postbuild": "node scripts/copy-standalone-assets.mjs",
-    "postbuild:bun": "node scripts/copy-standalone-assets.mjs",
-    "start": "node custom-server.js --port 20127",
-    "dev:bun": "bun --bun next dev --webpack --port 20127",
-    "build:bun": "bun --bun next build --webpack",
-    "start:bun": "bun ./.next/standalone/custom-server.js",
-    "cli:pack": "npm --prefix cli run pack:cli",
-    "cli:publish": "npm --prefix cli run publish:cli"
-  },
-  "dependencies": {
-    "@dnd-kit/core": "^6.3.1",
-    "@dnd-kit/modifiers": "^9.0.0",
-    "@dnd-kit/sortable": "^10.0.0",
-    "@dnd-kit/utilities": "^3.2.2",
-    "@monaco-editor/react": "^4.7.0",
-    "@next/third-parties": "^16.2.9",
-    "@node-saml/node-saml": "^5.1.0",
-    "@xyflow/react": "^12.10.1",
-    "bcryptjs": "^3.0.3",
-    "chalk": "^5.6.2",
-    "confbox": "^0.2.4",
-    "express": "^5.2.1",
-    "http-proxy-middleware": "^3.0.5",
-    "jose": "^6.1.3",
-    "marked": "^18.0.1",
-    "material-symbols": "^0.44.6",
-    "monaco-editor": "^0.55.1",
-    "next": "^16.1.6",
-    "node-forge": "^1.3.3",
-    "node-machine-id": "^1.1.12",
-    "open": "^11.0.0",
-    "ora": "^9.1.0",
-    "prop-types": "^15.8.1",
-    "react": "19.2.4",
-    "react-dom": "19.2.4",
-    "react-is": "^16.13.1",
-    "recharts": "^3.7.0",
-    "selfsigned": "^5.5.0",
-    "socks-proxy-agent": "^8.0.5",
-    "sql.js": "^1.14.1",
-    "undici": "^7.19.2",
-    "uuid": "^13.0.0",
-    "zustand": "^5.0.10"
-  },
-  "optionalDependencies": {
-    "better-sqlite3": "^12.6.2"
-  },
-  "comment_better_sqlite3": "REQUIRED AT BUILD TIME even though almost nothing loads it at runtime — do not remove. adapters/betterSqliteAdapter.js imports it statically and api/oauth/cursor/auto-import/route.js requires it, so webpack must resolve the specifier; serverExternalPackages only stops it being bundled, it does not make it optional to the build. Removing it fails `next build` with 'Module not found'. At runtime it usually is absent: npm >= 11 skips optionalDependencies whose install script isn't allowlisted, and Next output tracing copies only its lib/*.js, never the .node binary — so the Docker image, the fpk and the standalone tarball all fall through to node:sqlite. The npm CLI is the exception: cli/hooks/sqliteRuntime.js installs a working copy into ~/.10router/runtime.",
-  "devDependencies": {
-    "@tailwindcss/postcss": "^4.1.18",
-    "eslint": "^9",
-    "eslint-config-next": "16.1.6",
-    "postcss": "^8.5.6",
-    "tailwindcss": "^4"
-  }
-}
+{
+  "name": "10router-app",
+  "version": "1.0.5",
+  "description": "10Router web dashboard",
+  "private": true,
+  "scripts": {
+    "dev": "next dev --port 20127",
+    "dev:webpack": "next dev --webpack --port 20127",
+    "build": "next build --webpack",
+    "prebuild:fpk": "node scripts/sync-manifest-version.mjs",
+    "postbuild": "node scripts/copy-standalone-assets.mjs",
+    "postbuild:bun": "node scripts/copy-standalone-assets.mjs",
+    "start": "node custom-server.js --port 20127",
+    "dev:bun": "bun --bun next dev --webpack --port 20127",
+    "build:bun": "bun --bun next build --webpack",
+    "start:bun": "bun ./.next/standalone/custom-server.js",
+    "cli:pack": "npm --prefix cli run pack:cli",
+    "cli:publish": "npm --prefix cli run publish:cli"
+  },
+  "dependencies": {
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/modifiers": "^9.0.0",
+    "@dnd-kit/sortable": "^10.0.0",
+    "@dnd-kit/utilities": "^3.2.2",
+    "@monaco-editor/react": "^4.7.0",
+    "@next/third-parties": "^16.2.9",
+    "@node-saml/node-saml": "^5.1.0",
+    "@xyflow/react": "^12.10.1",
+    "bcryptjs": "^3.0.3",
+    "chalk": "^5.6.2",
+    "confbox": "^0.2.4",
+    "express": "^5.2.1",
+    "http-proxy-middleware": "^3.0.5",
+    "jose": "^6.1.3",
+    "marked": "^18.0.1",
+    "material-symbols": "^0.44.6",
+    "monaco-editor": "^0.55.1",
+    "next": "^16.1.6",
+    "node-forge": "^1.3.3",
+    "node-machine-id": "^1.1.12",
+    "open": "^11.0.0",
+    "ora": "^9.1.0",
+    "prop-types": "^15.8.1",
+    "react": "19.2.4",
+    "react-dom": "19.2.4",
+    "react-is": "^16.13.1",
+    "recharts": "^3.7.0",
+    "selfsigned": "^5.5.0",
+    "socks-proxy-agent": "^8.0.5",
+    "sql.js": "^1.14.1",
+    "undici": "^7.19.2",
+    "uuid": "^13.0.0",
+    "zustand": "^5.0.10"
+  },
+  "optionalDependencies": {
+    "better-sqlite3": "^12.6.2"
+  },
+  "comment_better_sqlite3": "REQUIRED AT BUILD TIME even though almost nothing loads it at runtime — do not remove. adapters/betterSqliteAdapter.js imports it statically and api/oauth/cursor/auto-import/route.js requires it, so webpack must resolve the specifier; serverExternalPackages only stops it being bundled, it does not make it optional to the build. Removing it fails `next build` with 'Module not found'. At runtime it usually is absent: npm >= 11 skips optionalDependencies whose install script isn't allowlisted, and Next output tracing copies only its lib/*.js, never the .node binary — so the Docker image, the fpk and the standalone tarball all fall through to node:sqlite. The npm CLI is the exception: cli/hooks/sqliteRuntime.js installs a working copy into ~/.10router/runtime.",
+  "devDependencies": {
+    "@tailwindcss/postcss": "^4.1.18",
+    "eslint": "^9",
+    "eslint-config-next": "16.1.6",
+    "postcss": "^8.5.6",
+    "tailwindcss": "^4"
+  }
+}

package/app/public/i18n/changelog/en.md

@@ -0,0 +1,101 @@
+# Changelog
+
+User-facing highlights per release. See [CHANGELOG.md](https://github.com/techysy/10router/blob/main/CHANGELOG.md) for the full developer log.
+
+## v1.0.5 (2026-09-04)
+
+### ✨ New
+
+- **New provider APInex (apinex.bond)**: prepaid USD-credit third-party gateway (OpenAI-compatible) with 18 models — GPT-5.6 Sol / Terra / Luna, Claude Opus 5 / Sonnet 5, Gemini 3.1 Pro / 3.8 Flash, Grok 4.6, DeepSeek V4, GLM-5.3, Kimi K3, plus 5 `free/`-prefixed free models (GLM-5.3 Flash, DeepSeek V4 ×2, GPT-5.6 Luna, Qwen 3.8 MAX)
+- **Invite code one-click copy**: provider pages show a copyable invite-code chip next to Get API Key (APInex: `SLEWP68C`)
+- **Desktop tray app (Windows / macOS)**: an install-and-go desktop app — system tray menu (open console / start / restart / stop / launch at login) plus an embedded window; closing the window minimizes to the tray. Shares data, keys and port with the npm CLI (the two forms run exclusively). Windows ships an NSIS installer (silent `/S` supported) and a portable exe; macOS ships separate Intel + Apple Silicon dmgs
+- **CLI / desktop UI localization**: the npm CLI and the desktop tray now follow the system language (Simplified Chinese / Traditional Chinese / English); override with the `TENROUTER_LANG` env var (`zh-CN` / `zh-TW` / `en`)
+- **Self-serve custom providers + new Skills-page skill**: register a custom OpenAI/Anthropic-compatible endpoint (baseUrl + upstream key + models) at runtime with a dashboard LLM key — no source change, no repackage. The Dashboard **Skills** page gains a **10router-add-provider** card and now links to the `main` branch (previously `master`, which 404'd)
+- **CodeBuddy CN account JSON bulk import / export** (experimental, off by default): after enabling "CodeBuddy CN OAuth import / export" under Settings → Providers, the CodeBuddy CN detail page shows Import / Export buttons to bulk-import or export account credentials in the third-party (wb) JSON format (import dedupes by identity and skips non-CodeBuddy issuers). Import / export now require a dashboard-password confirmation (prevents anonymous token export in no-login mode)
+- **Community welfare providers show by default**: GoRouter / TaBiAI now appear by default (no need to toggle them on), consistent across the provider list / Profile toggle / usage topology
+- **Community welfare providers sort into one group**: in the Free Tier list, community providers (GoRouter / TaBiAI) now cluster into one adjacent block per rank group instead of interleaving with regular freeTier providers by priority/name
+- **New Agnes AI dual-site providers**: international **Agnes AI** (com) + **Agnes AI (CN)** — each with Agnes 2.5 Flash / 2.5 Pro text models (512K / 1M context, vision + reasoning), plus Agnes Image 2.x Flash image models (standard images/generations endpoint; image-to-image / editing)
+- **New "Experimental" settings group**: Profile gains a dedicated Experimental card gathering the developer-oriented default-off toggles (Fetch models from GitHub JSON + CodeBuddy CN import/export) for easy future expansion
+
+
+### 🐛 Fixes
+- **Usage table corruption after Cost/Token switch**: toggling the display mode and sorting no longer reverts some rows to currency values; Traditional Chinese usage-table headers are now fully translated
+- **Usage table sorting semantics**: token / cost columns now sort model groups by their totals, matching the header arrow direction
+## v1.0.4 (2026-09-01)
+
+### ✨ New
+- **3 new providers**: **TokenBom** (decentralized token marketplace — idle API keys earn credits, credits call many models; 79-model online catalog), **GoRouter** (free gateway, no recharge entry), **TaBiAI** (free gateway, no recharge entry)
+- **Usage history import**: import usage data from 9Router backups (SQLite files) — merged into stats without touching config
+- **Notification overhaul**: global toasts moved to top-center; browser-native alert() dialogs replaced with friendly notifications
+- **Community welfare providers**: GoRouter / TaBiAI are hidden by default with a "community" badge; toggle them on in **Settings → Providers → Show community welfare providers**
+
+### 🐛 Fixes
+- **Provider ordering fixed**: connected providers first, disabled sink to bottom — no longer scrambled by priority
+- **JSON catalog models invisible after enabling**: stale disable records are now cleared ("enabled but not listed" resolved)
+- **B.AI / CodeBuddy CN model catalogs completed**: missing models that caused "not found" when switching are added
+- **Friendly maintenance hints on connection tests**: endpoint down / Cloudflare-blocked shows a maintenance note instead of a misleading "Invalid API key"
+- **Account filter reminder**: quota-pack account filter persists; an amber reminder bar shows when a non-default filter is active
+- **CodeBuddy CN DeepSeek 11150**: DeepSeek-series calls no longer fail with 400 on the reasoning-effort param (auto/off); coding agents (dsh, etc.) work normally
+- **CodeBuddy empty tool name (11133 / unknown tool)**: empty `function.name` in streaming tool calls is normalized, so standard clients no longer mis-detect the tool name
+- **Topology still shows hidden community providers**: the usage topology now honors the "Show community providers" toggle — community welfare sites (GoRouter/TaBiAI) are hidden when it's off
+- **Skills page i18n + Chinese links**: Skills page text is now localized; in Chinese (zh-CN) the links point to the Chinese skill files
+
+## v1.0.3 (2026-08-30)
+
+### ✨ New
+- **4 new providers**: **LongCat** (Meituan), **SenseNova** (SenseTime, free beta), **Dots** (Xiaohongshu Dots Studio, free beta), **B.AI** (aggregator — one key for GPT / Claude / Gemini / DeepSeek / GLM / Kimi / Qwen and more)
+- **Model JSON catalogs for custom providers**: custom nodes can pull an online model list, toggle models on/off individually, and manage them in bulk
+- **fpk update check goes straight to Releases**: fnOS installs jump directly to the matching release download
+
+### 🔒 Security
+- **Progressive login rate-limit**: 5 failed password attempts → 30s / 2m / 10m / 30m lockout
+- **Reject placeholder JWT keys**: copying the public `.env.example` key is ignored; a random key is generated instead
+- **Fix npm package leaking build-machine secrets**: no more keys / machine IDs / data snapshots in the build artifact
+
+### ⚠️ Notes
+- npm package renamed to **`@techysy/10router`** (the old `10router` is an unrelated fork). If you installed `10router-cli`, switch to the new package; data directory unchanged.
+
+## v1.0.2 (2026-08-29)
+
+### 🐛 Fixes
+- **Update check no longer points at a third-party package** (affected 1.0.1): version check, update command, and sidebar install command all target the correct package
+- **postinstall no longer aborts install**: npm install no longer fails from the warm-up script on WSL paths
+
+### ⚙️ Engineering
+- **Test CI added**: tests + regression gate run automatically on push / PR
+
+> ⚠️ **1.0.1 users should upgrade**: its built-in "check for updates" points to an unrelated third-party package.
+
+## v1.0.1 (unreleased; delivered with v1.0.2)
+
+> 1.0.1 was never published as a release (only the npm `10router-cli@1.0.1` briefly existed). The following reached Docker / fpk / standalone users with **v1.0.2**.
+
+### 🔒 Security
+- **4 MITM security fixes**: upstream TLS cert validation restored, root CA private key locked to 0600, no longer blindly killing the process on port 443, auto-cleanup of leftover hosts entries (MITM is off by default)
+
+### ✨ New
+- **Disabled providers sink to the bottom** via a settings toggle
+- **Collapsible desktop sidebar**
+- **OpenCode Go quota usage**
+- **Gitee mirror fallback for model catalogs** (faster in CN)
+
+### 🐛 Fixes
+- **/v1/models no longer returns orphan custom models**
+- **Custom node prefix uniqueness check**
+- **Fix CodeBuddy executor dropping the Agent system prompt**
+
+### ⚙️ Engineering
+- **New npm distribution channel**: `npm i -g 10router-cli`
+- **Generic "fetch models from GitHub JSON" capability** (Fetch Models)
+
+## v1.0.0 (2026-08-26)
+
+### ⚠️ Notes
+1. **Data directory renamed**: `~/.9router/` → `~/.10router/` (Windows: `%APPDATA%\10router`), auto-migrated on first start
+2. **SAML entityID changed**: default issuer is now `urn:10router:sp`; re-register in your IdP
+3. **MITM CA renamed**: re-trust the new CA
+
+### ✨ New
+- **Rebrand**: 9Router → 10Router
+- **i18n multi-region currency**: en / pt-BR / pt-PT / es / de
+- **Multi-platform distribution**: Docker (amd64 / arm64), fnOS fpk (x86 / arm × url / iframe), Standalone

package/app/public/i18n/changelog/zh-CN.md

@@ -0,0 +1,100 @@
+# 更新日志
+
+这里展示面向用户的关键更新；完整开发明细见 [CHANGELOG.md](https://github.com/techysy/10router/blob/main/CHANGELOG.md)。
+
+## v1.0.5 (2026-09-04)
+
+### ✨ 新增
+- **新增供应商 APInex（apinex.bond）**：预付美元额度的第三方聚合网关（OpenAI 兼容），18 个模型——GPT-5.6 Sol / Terra / Luna、Claude Opus 5 / Sonnet 5、Gemini 3.1 Pro / 3.8 Flash、Grok 4.6、DeepSeek V4、GLM-5.3、Kimi K3，外加 5 个 `free/` 前缀免费模型（GLM-5.3 Flash、DeepSeek V4 双档、GPT-5.6 Luna、Qwen 3.8 MAX）
+- **邀请码一键复制**：供应商页「获取 API 密钥」旁显示邀请码 chip，点击即复制（APInex：`SLEWP68C`）
+- **桌面托盘版（Windows / macOS）**：装完即用的桌面应用——系统托盘菜单（打开控制台 / 启动 / 重启 / 停止 / 开机自启）+ 内嵌窗口，关闭窗口即缩到托盘；与 npm CLI 共享数据、密钥与端口，两种形态互斥运行。Windows 提供安装版（NSIS，支持 `/S` 静默安装）与便携版，macOS 提供 Intel + Apple Silicon 双 dmg
+- **CLI / 桌面版界面多语言**：npm CLI 与桌面托盘自动跟随系统语言显示简体中文、繁体中文或英文，可用环境变量 `TENROUTER_LANG`（`zh-CN` / `zh-TW` / `en`）强制指定
+- **Agent 可自助添加自定义供应商 + Skills 页新增技能**：运行时用 dashboard LLM key 即可两步注册 baseUrl + 上游 key + 模型的自定义 OpenAI/Anthropic 兼容节点（免改源码/免重打包）；Dashboard **Skills 页**新增「10router-add-provider」技能卡片并修复此前链接指向不存在的 `master` 分支（点击 404），现指向 `main`
+- **CodeBuddy CN 账号 JSON 批量导入 / 导出**（实验性，默认关）：`设置 → Providers` 打开 "CodeBuddy CN OAuth import / export" 后，CodeBuddy CN 详情页显示 Import / Export 按钮，可用三方(wb) JSON 格式批量导入或导出账号授权（导入自动去重、非 CodeBuddy 签发域跳过）。导入 / 导出均需二次输入 dashboard 密码确认（防免登录模式下匿名导出账号令牌）
+- **公益站供应商默认显示**：GoRouter / TaBiAI 等公益站供应商改为默认显示（无需再手动打开开关），列表 / Profile 开关 / 用量拓扑图三处一致
+- **公益站供应商排序归组**：Free Tier 列表中 GoRouter / TaBiAI 等公益站供应商在 rank 分组内聚成相邻一块，不再与普通 freeTier 按 priority/名字混排
+- **新增 Agnes AI 双站供应商**：国际站 Agnes AI（com）+ 中国站 Agnes AI (CN)，各含 Agnes 2.5 Flash / 2.5 Pro 文本模型（512K / 1M 上下文，视觉+推理）；另含 Agnes Image 2.x Flash 图像生成模型（标准 images/generations 端点，图生图/编辑）
+- **设置新增「实验性功能」分组**：Profile 独立 Experimental 卡片，收纳默认关的开发向开关（JSON 模型导入 + CodeBuddy CN 导入导出），方便后续扩展
+
+### 🐛 修复
+- **用量统计 成本/Token 切换后表格错乱**：修复切换显示模式并点击排序后，部分行的 token 数被回退显示成金额的问题；繁体中文用量表表头翻译补齐
+- **用量表排序语义**：按 Token / 成本列排序改为按模型合计值排序，与表头箭头方向一致
+
+## v1.0.4 (2026-09-01)
+
+### ✨ 新增
+- **新增 3 家供应商**：**TokenBom**（去中心化 token 交易市场——闲置 API Key 自动赚积分、积分可调用多种模型，含 79 模型在线目录）、**GoRouter**（免费网关，无充值入口）、**TaBiAI**（免费网关，无充值入口）
+- **历史用量导入**：支持从 9Router 备份导入历史用量数据（SQLite 文件），合并统计不覆盖配置
+- **通知体验优化**：全局通知改为顶部居中 Toast，供应商详情页浏览器原生弹窗全部替换为友好通知
+- **公益站供应商**：GoRouter / TaBiAI 默认不显示，带「公益站」标签；可在 **设置 → Providers → 显示公益站供应商** 打开后显示
+
+### 🐛 修复
+- **供应商排序修正**：有连接的供应商前置、已禁用沉底，不再被优先级打乱
+- **JSON 目录模型激活后不显示**：清理陈旧禁用记录，「激活了却不显示」问题解决
+- **B.AI / CodeBuddy CN 模型补全**：切换模型报 "not found" 的缺模型已补齐
+- **连接测试友好提示**：供应商端点维护中 / 被 Cloudflare 拦截时，显示维护提示而非误导性的 "Invalid API key"
+- **账户筛选提醒**：配额包账户筛选持久化后，非默认筛选时显示琥珀色提醒条
+- **CodeBuddy CN DeepSeek 模型 11150**：DeepSeek 系列调用不再因思考强度参数（auto/off）报 400，编码 agent（dsh 等）可正常使用
+- **CodeBuddy 工具调用空工具名（11133 / unknown tool）**：流式返回的空 function.name 已规范化，标准客户端不再误判工具名
+- **隐藏公益站后拓扑图仍显示**：用量页拓扑图同步「显示公益站供应商」开关，关闭后公益站不再显示
+- **Skills 页面 i18n + 中文版链接**：Skills 页面文案支持多语言，中文界面下链接指向中文版 skill
+
+## v1.0.3 (2026-08-30)
+
+### ✨ 新增
+- **新增 4 家供应商**：**LongCat**（美团）、**SenseNova**（商汤，免费公测）、**Dots**（小红书 Dots Studio，免费公测）、**B.AI**（聚合平台，一个 Key 通吃 GPT / Claude / Gemini / DeepSeek / GLM / Kimi / Qwen 等家族）
+- **自定义供应商支持模型 JSON 目录**：自定义节点可拉取在线模型清单，逐个禁用 / 激活、批量管理
+- **fpk 检查更新直达 Releases**：fnOS 安装的更新提示直达对应版本的下载附件
+
+### 🔒 安全加固
+- **登录接入渐进限流**：密码 5 次失败 → 30s / 2m / 10m / 30m 逐级锁定
+- **拒绝占位 JWT 密钥**：照抄 `.env.example` 的公开密钥会被忽略，改用自动生成的随机密钥
+- **修复 npm 包携带构建机敏感文件**：构建产物不再泄露密钥 / 机器 ID / 数据快照
+
+### ⚠️ 升级注意
+- npm 包名已改为 **`@techysy/10router`**（旧 `10router` 是本项目无关的 fork）。已装 `10router-cli` 请改装新包，数据目录不变。
+
+## v1.0.2 (2026-08-29)
+
+### 🐛 修复
+- **修复更新检查指向第三方包**（1.0.1 受影响）：版本检查、更新命令、侧边栏安装命令均指向正确的包
+- **postinstall 不再中断安装**：WSL 路径下 npm 安装不再因预热脚本失败而中断
+
+### ⚙️ 工程与打包
+- **新增测试 CI**：推送 / PR 时自动跑测试与回归门禁
+
+> ⚠️ **1.0.1 用户请升级**：其内置「检查更新」指向的是一个无关的第三方包。
+
+## v1.0.1 (未发布，内容随 v1.0.2 交付)
+
+> 1.0.1 从未作为正式版发布（仅 npm 的 `10router-cli@1.0.1` 短暂存在过）。以下内容对 Docker / fpk / standalone 用户随 **v1.0.2** 首次到达。
+
+### 🔒 安全加固
+- **MITM 安全修复 ×4**：上游转发恢复 TLS 证书校验、根证书私钥权限收紧至 0600、不再盲目杀掉占用 443 的进程、自动清理异常退出遗留的 hosts 条目（MITM 默认关闭，未启用用户不受影响）
+
+### ✨ 新增
+- **已禁用供应商沉底**：设置页开关开启后，已禁用供应商在列表中排到最后
+- **桌面侧边栏可折叠**
+- **OpenCode Go 配额用量接入**
+- **模型目录 Gitee 镜像回退**：国内拉取加速
+
+### 🐛 修复
+- **修复 /v1/models 返回孤儿自定义模型**：不再对客户端返回成百上千个无效模型
+- **自定义节点前缀唯一性检测**：避免路由歧义
+- **修复 CodeBuddy 执行器误删 Agent system prompt**
+
+### ⚙️ 工程与打包
+- **新增 npm 分发渠道**：`npm i -g 10router-cli`
+- **新增「从 GitHub JSON 获取模型」通用能力**（Fetch Models）
+
+## v1.0.0 (2026-08-26)
+
+### ⚠️ 升级注意
+1. **数据目录改名**：`~/.9router/` → `~/.10router/`（Windows: `%APPDATA%\10router`），启动时自动迁移
+2. **SAML entityID 变更**：默认 issuer 改为 `urn:10router:sp`，IdP 需重新注册
+3. **MITM CA 更名**：需重新信任新 CA
+
+### ✨ 新增
+- **品牌重塑**：9Router → 10Router
+- **i18n 多区域货币**：en / pt-BR / pt-PT / es / de
+- **多平台分发**：Docker（amd64 / arm64）、fnOS fpk（x86 / arm × url / iframe）、Standalone

package/app/public/i18n/changelog/zh-TW.md

@@ -0,0 +1,101 @@
+# 更新日誌
+
+這裡展示面向用戶的關鍵更新；完整開發明細見 [CHANGELOG.md](https://github.com/techysy/10router/blob/main/CHANGELOG.md)。
+
+## v1.0.5 (2026-09-04)
+
+### ✨ 新增
+
+- **新增供應商 APInex（apinex.bond）**：預付美元額度的第三方聚合網關（OpenAI 相容），18 個模型——GPT-5.6 Sol / Terra / Luna、Claude Opus 5 / Sonnet 5、Gemini 3.1 Pro / 3.8 Flash、Grok 4.6、DeepSeek V4、GLM-5.3、Kimi K3，外加 5 個 `free/` 前綴免費模型（GLM-5.3 Flash、DeepSeek V4 雙檔、GPT-5.6 Luna、Qwen 3.8 MAX）
+- **邀請碼一鍵複製**：供應商頁「獲取 API 金鑰」旁顯示邀請碼 chip，點擊即複製（APInex：`SLEWP68C`）
+- **桌面系統列版（Windows / macOS）**：裝完即用的桌面應用——系統列選單（開啟控制台 / 啟動 / 重新啟動 / 停止 / 開機自啟）+ 內嵌視窗，關閉視窗即縮到系統列；與 npm CLI 共享資料、金鑰與連接埠，兩種形態互斥執行。Windows 提供安裝版（NSIS，支援 `/S` 靜默安裝）與便攜版，macOS 提供 Intel + Apple Silicon 雙 dmg
+- **CLI / 桌面版介面多語言**：npm CLI 與桌面系統列自動跟隨系統語言顯示繁體中文、簡體中文或英文，可用環境變數 `TENROUTER_LANG`（`zh-CN` / `zh-TW` / `en`）強制指定
+- **Agent 可自助新增自訂供應商 + Skills 頁新增技能**：執行階段用 dashboard LLM key 即可兩步註冊 baseUrl + 上游 key + 模型的自訂 OpenAI/Anthropic 相容節點（免改原始碼/免重新打包）；Dashboard **Skills 頁**新增「10router-add-provider」技能卡片並修正此前連結指向不存在的 `master` 分支（點擊 404），現指向 `main`
+- **CodeBuddy CN 帳號 JSON 批次匯入 / 匯出**（實驗性，預設關閉）：`設定 → Providers` 開啟 "CodeBuddy CN OAuth import / export" 後，CodeBuddy CN 詳情頁顯示 Import / Export 按鈕，可用第三方(wb) JSON 格式批次匯入或匯出帳號授權（匯入自動去重、非 CodeBuddy 簽發網域略過）。匯入 / 匯出均需二次輸入 dashboard 密碼確認（防免登入模式下匿名匯出帳號令牌）
+- **公益站供應商預設顯示**：GoRouter / TaBiAI 等公益站供應商改為預設顯示（無需再手動開啟開關），列表 / Profile 開關 / 用量拓撲圖三處一致
+- **公益站供應商排序歸組**：Free Tier 列表中 GoRouter / TaBiAI 等公益站供應商在 rank 分組內聚成相鄰一塊，不再與一般 freeTier 依 priority/名稱混排
+- **新增 Agnes AI 雙站供應商**：國際站 Agnes AI（com）+ 中國站 Agnes AI (CN)，各含 Agnes 2.5 Flash / 2.5 Pro 文字模型（512K / 1M 上下文，視覺+推理）；另含 Agnes Image 2.x Flash 影像生成模型（標準 images/generations 端點，圖生圖/編輯）
+- **設定新增「實驗性功能」分組**：Profile 獨立 Experimental 卡片，收納預設關閉的開發向開關（JSON 模型匯入 + CodeBuddy CN 匯入匯出），方便日後擴充
+
+
+### 🐛 修復
+- **用量統計 成本/Token 切換後表格錯亂**：修復切換顯示模式並點擊排序後，部分行的 token 數被回退顯示成金額的問題；繁體中文用量表表頭翻譯補齊
+- **用量表排序語義**：按 Token / 成本列排序改為按模型合計值排序，與表頭箭頭方向一致
+## v1.0.4 (2026-09-01)
+
+### ✨ 新增
+- **新增 3 家供應商**：**TokenBom**（去中心化 token 交易市場——閒置 API Key 自動賺積分、積分可調用多種模型，含 79 模型線上目錄）、**GoRouter**（免費網關，無儲值入口）、**TaBiAI**（免費網關，無儲值入口）
+- **歷史用量導入**：支援從 9Router 備份導入歷史用量資料（SQLite 檔案），合併統計不覆蓋配置
+- **通知體驗優化**：全域通知改為頂部置中 Toast，供應商詳情頁瀏覽器原生彈窗全部替換為友好通知
+- **公益站供應商**：GoRouter / TaBiAI 預設不顯示，帶「公益站」標籤；可在 **設定 → Providers → 顯示公益站供應商** 開啟後顯示
+
+### 🐛 修復
+- **供應商排序修正**：有連接的供應商前置、已停用沉底，不再被優先級打亂
+- **JSON 目錄模型啟用後不顯示**：清理陳舊停用記錄，「啟用了卻不顯示」問題解決
+- **B.AI / CodeBuddy CN 模型補全**：切換模型報 "not found" 的缺模型已補齊
+- **連接測試友好提示**：供應商端點維護中 / 被 Cloudflare 攔截時，顯示維護提示而非誤導性的 "Invalid API key"
+- **帳戶篩選提醒**：配額包帳戶篩選持久化後，非預設篩選時顯示琥珀色提醒條
+- **CodeBuddy CN DeepSeek 模型 11150**：DeepSeek 系列呼叫不再因思考強度參數（auto/off）報 400，編碼 agent（dsh 等）可正常使用
+- **CodeBuddy 工具呼叫空工具名（11133 / unknown tool）**：串流回傳的空 function.name 已規範化，標準客戶端不再誤判工具名
+- **隱藏公益站後拓撲圖仍顯示**：用量頁拓撲圖同步「顯示公益站供應商」開關，關閉後公益站不再顯示
+- **Skills 頁面 i18n + 中文版連結**：Skills 頁面文案支援多語言，中文介面下連結指向中文版 skill
+
+## v1.0.3 (2026-08-30)
+
+### ✨ 新增
+- **新增 4 家供應商**：**LongCat**（美團）、**SenseNova**（商湯，免費公測）、**Dots**（小紅書 Dots Studio，免費公測）、**B.AI**（聚合平台，一個 Key 通吃 GPT / Claude / Gemini / DeepSeek / GLM / Kimi / Qwen 等家族）
+- **自定義供應商支援模型 JSON 目錄**：自定義節點可拉取線上模型清單，逐個停用 / 啟用、批次管理
+- **fpk 檢查更新直達 Releases**：fnOS 安裝的更新提示直達對應版本的下載附件
+
+### 🔒 安全加固
+- **登入漸進限流**：密碼 5 次失敗 → 30s / 2m / 10m / 30m 逐級鎖定
+- **拒絕佔位 JWT 金鑰**：照抄 `.env.example` 的公開金鑰會被忽略，改用自動產生的隨機金鑰
+- **修復 npm 包攜帶建置機敏感檔案**：建置產物不再洩漏金鑰 / 機器 ID / 資料快照
+
+### ⚠️ 升級注意
+- npm 套件名已改為 **`@techysy/10router`**（舊 `10router` 是本專案無關的 fork）。已裝 `10router-cli` 請改裝新套件，資料目錄不變。
+
+## v1.0.2 (2026-08-29)
+
+### 🐛 修復
+- **修復更新檢查指向第三方套件**（1.0.1 受影響）：版本檢查、更新指令、側邊欄安裝指令均指向正確的套件
+- **postinstall 不再中斷安裝**：WSL 路徑下 npm 安裝不再因預熱指令碼失敗而中斷
+
+### ⚙️ 工程與打包
+- **新增測試 CI**：推送 / PR 時自動跑測試與回歸門禁
+
+> ⚠️ **1.0.1 使用者請升級**：其內建「檢查更新」指向的是一個無關的第三方套件。
+
+## v1.0.1 (未發佈，內容隨 v1.0.2 交付)
+
+> 1.0.1 從未作為正式版發佈（僅 npm 的 `10router-cli@1.0.1` 短暫存在過）。以下內容對 Docker / fpk / standalone 使用者隨 **v1.0.2** 首次到達。
+
+### 🔒 安全加固
+- **MITM 安全修復 ×4**：上游轉發恢復 TLS 憑證校驗、根憑證私鑰權限收緊至 0600、不再盲目殺掉佔用 443 的處理程序、自動清理異常退出遺留的 hosts 條目（MITM 預設關閉，未啟用使用者不受影響）
+
+### ✨ 新增
+- **已停用供應商沉底**：設定頁開關開啟後，已停用供應商在清單中排到最後
+- **桌面側邊欄可摺疊**
+- **OpenCode Go 配額用量接入**
+- **模型目錄 Gitee 鏡像回退**：國內拉取加速
+
+### 🐛 修復
+- **修復 /v1/models 回傳孤兒自定義模型**：不再對客戶端回傳成百上千個無效模型
+- **自定義節點前綴唯一性檢測**：避免路由歧義
+- **修復 CodeBuddy 執行器誤刪 Agent system prompt**
+
+### ⚙️ 工程與打包
+- **新增 npm 分發管道**：`npm i -g 10router-cli`
+- **新增「從 GitHub JSON 取得模型」通用能力**（Fetch Models）
+
+## v1.0.0 (2026-08-26)
+
+### ⚠️ 升級注意
+1. **資料目錄改名**：`~/.9router/` → `~/.10router/`（Windows: `%APPDATA%\10router`），啟動時自動遷移
+2. **SAML entityID 變更**：預設 issuer 改為 `urn:10router:sp`，IdP 需重新註冊
+3. **MITM CA 更名**：需重新信任新 CA
+
+### ✨ 新增
+- **品牌重塑**：9Router → 10Router
+- **i18n 多區域貨幣**：en / pt-BR / pt-PT / es / de
+- **多平台分發**：Docker（amd64 / arm64）、fnOS fpk（x86 / arm × url / iframe）、Standalone

package/app/public/i18n/literals/zh-CN.json

@@ -1,4 +1,5 @@
 {
+  "10Router (Entry)": "10Router（入口）",
   "($/1M tokens). Example: An input rate of 2.50 means $2.50 per 1,000,000 input tokens.": "（$/100 万 Token）。示例：输入费率 2.50 表示每 1,000,000 个输入 Token 需 2.50 美元。",
   "($/1M tokens). Example: Input rate of 2.50 means $2.50 per 1,000,000 input tokens.": "（$/100 万 Token）。示例：输入费率 2.50 表示每 1,000,000 个输入 Token 需 2.50 美元。",
   "(Caveman)": "（Caveman）",
@@ -164,6 +165,7 @@
   "Bulk Add": "批量添加",
   "Bulk Add Codex Accounts": "批量添加 Codex 账户",
   "Bulk import codex accounts from JSON": "从 JSON 批量导入 Codex 账户",
+  "Cached Cost": "缓存成本",
   "CLI Support": "CLI 支持",
   "CLI Tools": "命令行工具",
   "CLI on the host →": "主机上的 CLI →",
@@ -302,6 +304,7 @@
   "Copied!": "已复制！",
   "Copy": "复制",
   "Copy & Shutdown": "复制并关闭",
+  "Copy link": "复制链接",
   "Copy This URL": "复制此 URL",
   "Copy a link and paste to your AI to use 9Router — no install needed": "复制链接并粘贴到您的 AI 以使用 9Router — 无需安装",
   "Copy combo name": "复制组合名称",
@@ -595,6 +598,7 @@
   "Invalid": "无效",
   "Invalid JSON": "无效 JSON",
   "Invalid password": "密码错误",
+  "Invite code": "邀请码",
   "Issuer URL": "发行者 URL",
   "JSON Response": "JSON 响应",
   "Join developers who are streamlining their AI integrations with 9Router. Open source and free to start.": "加入正在使用 9Router 简化 AI 集成的开发者行列。开源且免费。",
@@ -890,6 +894,7 @@
   "Port 443 is currently used by another process:": "端口 443 当前被另一个进程占用：",
   "Powerful Features": "强大功能",
   "Prefix": "前缀",
+  "Prepaid USD-credit gateway with gamified rewards (XP/airdrop). free/* models run on signup bonus credits; Anthropic models need a real top-up (402 otherwise). Third-party reseller — treat as untrusted for sensitive traffic.": "预付美元额度的聚合网关，带游戏化奖励（XP/空投）。free/* 免费模型走注册赠送额度；Anthropic 系模型需真实充值（否则 402）。第三方中转，请勿经手敏感流量。",
   "Preset": "预设",
   "Prev": "上一页",
   "Preview": "预览",
@@ -1432,5 +1437,54 @@
   "Monthly": "每月",
   "Only with balance": "只看有余额",
   "Disabled providers sort last": "已禁用供应商后置",
-  "Push providers with all connections disabled behind those with no connections": "连接全部停用的供应商排在无连接供应商之后"
+  "Push providers with all connections disabled behind those with no connections": "连接全部停用的供应商排在无连接供应商之后",
+  "Test request failed": "测试请求失败",
+  "OK": "正常",
+  "ERROR": "错误",
+  "tests passed": "个测试通过",
+  "Vision": "视觉",
+  "Audio": "音频",
+  "adapter": "适配器",
+  "Round-robin": "轮流",
+  "model": "模型",
+  "Add Vision model": "添加视觉模型",
+  "Add Audio model": "添加音频模型",
+  "Add Vision Model": "添加视觉模型",
+  "Add Audio Model": "添加音频模型",
+  "Test Connection One-by-One": "逐个测试连接",
+  "Testing Connection One-by-One...": "正在逐个测试连接...",
+  "Stopping...": "停止中...",
+  "Completed:": "已完成：",
+  "Passed:": "通过：",
+  "Failed:": "失败：",
+  "Running:": "运行中：",
+  "Test failed": "测试失败",
+  "Failed to save connection": "保存连接失败",
+  "success": "成功",
+  "testing": "测试中",
+  "queued": "排队中",
+  "Import Usage": "导入使用量",
+  "Imported": "已导入",
+  "usage records": "条使用记录",
+  "skipped": "跳过",
+  "total": "总计",
+  "Only SQLite database files (.sqlite/.db) can be imported": "只能导入 SQLite 数据库文件（.sqlite/.db）",
+  "Account filter is active and persists across visits": "已启用账户筛选，该选择会在下次访问时保留",
+  "Community": "公益站",
+  "Show community welfare providers": "显示公益站供应商",
+  "Show community welfare providers (公益站) with no recharge entry": "显示无充值入口的公益站供应商（GoRouter / TaBiAI）",
+  "Show free community gateways with no recharge entry (GoRouter / TaBiAI)": "显示无充值入口的免费公益站供应商（GoRouter / TaBiAI）",
+  "Add Custom Provider": "添加自定义供应商",
+  "Import CodeBuddy CN Accounts": "导入 CodeBuddy CN 账号",
+  "Import CodeBuddy CN accounts from JSON...": "从 JSON 导入 CodeBuddy CN 账号…",
+  "Choose JSON file...": "选择 JSON 文件…",
+  "Or paste JSON": "或粘贴 JSON",
+  "Failed to read file": "读取文件失败",
+  "Import CodeBuddy CN OAuth accounts from a JSON export. Accounts signed by a non-CodeBuddy realm (e.g. workbuddy.cn) are skipped. Existing accounts are updated, new ones are added.": "从 JSON 文件导入 CodeBuddy CN 的 OAuth 账号。非 CodeBuddy 域（如 workbuddy.cn）签发的账号会被跳过；已存在的账号更新，新账号则新增。",
+  "Export": "导出",
+  "No CodeBuddy CN connections to export": "没有可导出的 CodeBuddy CN 连接",
+  "accounts exported": "个账号已导出",
+  "Export failed": "导出失败",
+  "Enter your current password to export CodeBuddy CN accounts.": "输入当前密码以导出 CodeBuddy CN 账号。",
+  "Enter your current password to import CodeBuddy CN accounts.": "输入当前密码以导入 CodeBuddy CN 账号。"
 }