@techysy/10router 1.0.7 → 1.1.0

package/app/public/i18n/changelog/en.md

@@ -2,7 +2,53 @@
 
 User-facing highlights per release. See [CHANGELOG.md](https://github.com/techysy/10router/blob/main/CHANGELOG.md) for the full developer log.
 
-## v1.0.7 (2026-09-06)
+## v1.1.0 (2026-09-11)
+
+### ✨ New
+
+- **Xiaomi MiMo Desktop support (one provider, two ways to sign in)**: `xiaomi-mimo` now accepts both an sk- API key (cloud API) and a Xiaomi MiMo desktop-app account — the desktop-exclusive `mimo-x-pro-preview` / `mimo-x-flash-preview` only accept the account cookie, so an API key alone cannot reach them. Both credentials share one provider card; enable whichever you need.
+- **Xiaomi MiMo authorization-code sign-in**: after the official authorize page opens in your browser, you can **paste the code shown on that page** straight into the dialog to finish signing in — even if the local callback never connected, or already timed out. The credential is decrypted server-side only and never passes through the browser.
+- **CodeBuddy international catalog completed**: every entry was re-checked against the live gateway with real requests, adding five models that were served but missing (GLM-5.1 / GLM-5v-Turbo / MiniMax-M3 / Kimi-K2.7 / DeepSeek-V4.1-Flash) plus `GPT 6.0 Astra`.
+- **opencode-go catalog aligned with the official public list (18 models), with a declared endpoint per model**: some models used to fail outright because a missing endpoint declaration sent them down the wrong path; each one now declares its endpoint from the official table.
+- **New `gpt-image-2.5` image-model family for Codex / OpenAI**: `gpt-image-2.5` (incl. `-flare` / `-sunburst`), `gpt-image-2`, `gpt-image-1.5` — text-to-image, editing, and multi-image references.
+- **Credit-multiplier badge supports limited-time free promos**: the badge shows green `free` during the promo and **automatically** returns to the real multiplier when it ends — no one has to remember to change it back.
+
+### 🐛 Fixed
+
+- **Windows desktop upgrades no longer silently discard old data**: the desktop data directory is also Electron's own config directory, so Chromium fills it with files first and makes it look "non-empty", permanently skipping the old-data migration. The check is now "does the directory already contain our own database".
+- **Several real Xiaomi MiMo authorization-code bugs**: the decrypted payload layout was reversed (the actual cause of `decrypt_failed`), the platform requires `app=MiMo`, the callback path is now a random string, and the result is handed back with a 302; pasting a code also keeps working after the callback listener times out.
+- **Kiro requests no longer carry a top-level `systemPrompt`** (kiro.dev answers it with an immediate 400 and no retry); endpoint order now prefers the Amazon surface.
+- **Claude tool `type` is now decided per provider**: this fixes MiniMax's Claude endpoint (rejected tools without `type`) without breaking DeepSeek's Claude endpoint (which only accepts its own `type` values).
+- **Codex strips `\p{...}` regexes it cannot parse from tool schemas**: previously a single property escape in a tool parameter `pattern` failed the whole request with a 400, identically for every account.
+- **`better-sqlite3` is skipped on Node 24**: its native addon crashes the process on load there, which used to take the whole server down.
+- **AMD Token Factory catalog and capabilities rebuilt from live measurements**: missing chat models were added and a "text-only" misclassification was fixed (images were being silently dropped).
+- **CodeBuddy CN's DeepSeek-V4.1-Flash output ceiling lowered to the server-published 128K**: asking for more never errors, it just makes over-limit requests more likely to hit a 400.
+- **One provider no longer stores two contradictory disabled-model records**: this fixes models that appeared not to be disabled.
+
+## v1.0.8 (2026-09-09)
+
+### ✨ New
+- **AMD Token Factory provider**: free shared OpenAI-compatible endpoints from AMD Radeon Cloud (`DeepSeek-V4-Flash` 1M context + `Qwen3.8-Flash-Next` 262K context); thinking via reasoning_effort with per-model level pickers; same shape as NVIDIA NIM
+- **Antigravity quota host fix**: quota summary now queries the correct daily host (matching the native IDE), fixing systematically stale numbers; percentage reads from the backend value instead of re-deriving in the frontend
+- **CodeBuddy catalogs aligned to the server (CN + intl)**: the international catalog is re-aligned (adds the Hy4-Preview / Hy3 free tier, GPT-5.6 Sol/Terra/Luna, GLM-5.3, Kimi-K3; drops retired models); the CN catalog now matches too — `DeepSeek-V4.1-Flash` supersedes `DeepSeek-V4-Flash` and the duplicate `Kimi-K3 (1)` slot is gone; every model on both gateways now carries the published credit multiplier
+- **Credit-multiplier badges on the model list**: free-quota models show a green `free` chip, the rest show their modifier as `0.79x` (hover for an explanation); providers with no credit system show nothing
+
+### 🔒 Security
+- **API key HMAC secret hardening**: built-in fallback secret now triggers a production startup warning; experimental **Key secret rotation** (off by default) auto-generates a per-install secret; `generateKeyId` switched from `Math.random` to `crypto.randomBytes`
+- **Dangerous-action confirm dialogs**: "Require API key" off, key-rotation enable/disable, and "Rotate all" now require explicit confirmation; rotation is double-submit protected (server 409 + client guard)
+
+### 🐛 Fixed
+- **Non-streaming requests defaulted to SSE (issue #4)**: omitting `stream` now correctly defaults to JSON (OpenAI/Anthropic spec); previously returned `text/event-stream` with trailing `data: [DONE]` that broke strict JSON clients (OpenAI SDK, WorkBuddy, curl)
+- **Key rotation confirm dialog stuck open / repeated rotation**: confirm modal now auto-closes before executing; repeated rotations no longer stack "(rotated)" suffixes
+- **MCP SSE idle disconnect**: long-lived MCP SSE connections now send a 25s comment heartbeat, preventing NAT/firewall silent drops
+- **CodeBuddy CN whitelist false-positive (PR #5)**: Claude Code's own system prompt no longer matches the agent-identity whitelist (was triggering 11128)
+- **GLM-4.6V-Flash missing vision (PR #5)**: free vision model now registered with correct capabilities
+- **DeepSeek effort "max" rejected by SenseNova (PR #5)**: clamped to "xhigh" for cross-provider compatibility
+- **Fetched/imported models now default to disabled (enable on demand)**: bulk imports via "Import from /models" and "Fetch Qoder Models" no longer switch everything on at once — they land in the "Disabled models" area for you to enable as needed, and `/v1/models` now only serves enabled models (a disabled model was previously still listed). Single manual adds stay enabled
+- **CodeBuddy CN listing intl-only models (fixed)**: the CN catalog had picked up the GPT/Gemini family that only the international gateway serves, which failed with "model service info not found" when selected; removed from CN (kept in intl) with a test guard
+- **DeepSeek-V4.1-Flash output ceiling under-reported (fixed)**: its capabilities capped output at 50K (a leftover from the pre-rename id), which truncated client requests; corrected to the model card's 1M context / 384K output / image input / switchable thinking, and the model's two alias ids now carry the same caps
+
+## v1.0.7 (2026-09-07)
 
 ### ✨ New
 - **CodeBuddy CN built-in "Total Points" quota row**: the CodeBuddy CN card now leads with a Total Points row summing the live balance of every pack (monthly refills + bonus packs) — no more adding them up yourself; it auto-hides under the "Only with balance" filter once drained; "Bonus Pack" row names are now localized

package/app/public/i18n/changelog/zh-CN.md

@@ -2,7 +2,53 @@
 
 这里展示面向用户的关键更新；完整开发明细见 [CHANGELOG.md](https://github.com/techysy/10router/blob/main/CHANGELOG.md)。
 
-## v1.0.7 (2026-09-06)
+## v1.1.0 (2026-09-11)
+
+### ✨ 新增
+
+- **小米 MiMo 桌面版支持（一个供应商、两种登录）**：`xiaomi-mimo` 现在既支持 sk- API 键（云 API），也支持小米 MiMo 桌面客户端账号 —— 桌面独占的 `mimo-x-pro-preview` / `mimo-x-flash-preview` 只认账号 Cookie，光有 API 键用不了。两种凭据共用一个供应商卡片，按需启用即可。
+- **小米 MiMo 授权码登录**：浏览器打开官方授权页后，即使本地回调没接上（或已超时），也可以把页面上显示的授权码**直接粘贴**到对话框完成登录。凭据全程只在服务端解密，不经过浏览器。
+- **CodeBuddy 国际版模型目录补齐**：逐个用真实请求核对线上服务范围，补进 5 个真实存在却缺失的模型（GLM-5.1 / GLM-5v-Turbo / MiniMax-M3 / Kimi-K2.7 / DeepSeek-V4.1-Flash）与 `GPT 6.0 Astra`。
+- **opencode-go 目录对齐官方公开列表（18 个模型），并为每个模型声明端点**：以前部分模型因为「端点声明缺失」被送到错误路径而直接失败，现在按官方端点表逐条声明。
+- **新增 Codex / OpenAI 的 `gpt-image-2.5` 图像模型家族**：`gpt-image-2.5`（含 `-flare` / `-sunburst`）、`gpt-image-2`、`gpt-image-1.5`，支持文生图、图片编辑与多图参考。
+- **积分徽章支持限时免费促销**：促销期显示绿色 `free`，到期**自动**恢复显示真实倍率 —— 不再需要有人记得回来改。
+
+### 🐛 修复
+
+- **Windows 桌面版升级不再静默丢弃旧数据**：桌面版的数据目录同时也是 Electron 自己的配置目录，Chromium 会先生成一堆文件把它撑成「非空」，导致旧数据迁移被永久跳过。现在判据改为「目录里是否已经有我们自己的数据库」。
+- **小米 MiMo 授权码登录的多个真问题**：载荷解密布局前后颠倒（这才是 `decrypt_failed` 的真因）、平台要求携带 `app=MiMo`、回调路径改为随机串、结果以 302 交回平台；另外回调监听器超时后粘贴不再失效。
+- **Kiro 请求不再携带顶层 `systemPrompt`**（kiro.dev 对它直接回 400 且不重试），端点顺序改为 Amazon 面优先。
+- **Claude 工具 `type` 改为按供应商开关**：修好 MiniMax 的 Claude 端点（缺 `type` 被拒），同时避免把 DeepSeek 的 Claude 端点打挂（它只认自家 `type`）。
+- **Codex 工具 schema 里它不认的 `\p{...}` 正则会被剥离**：此前只要某个工具的参数 `pattern` 用了属性转义，整个请求就 400，且每个账号都一样失败。
+- **Node 24 上跳过 `better-sqlite3`**：它的原生插件在 Node ≥ 24 上加载即崩溃（进程级），此前会让整个服务直接死掉。
+- **AMD Token Factory 目录与能力按实测重建**：补上漏登的聊天模型，并修掉「纯文本」误判（图片会被静默丢弃）。
+- **CodeBuddy CN 的 DeepSeek-V4.1-Flash 输出上限回落到服务端公布的 128K**：取大不会报错，只会让超过服务端上限的请求更容易撞 400。
+- **同一个供应商不再在禁用列表里存两份互相矛盾的记录**：修掉「有些模型看起来没被禁用」的问题。
+
+## v1.0.8 (2026-09-09)
+
+### ✨ 新增
+- **新增 AMD Token Factory 供应商**：AMD Radeon Cloud 免费共享 OpenAI 兼容端点（`DeepSeek-V4-Flash` 1M 上下文 + `Qwen3.8-Flash-Next` 262K 上下文）；thinking 通过 reasoning_effort 控制，每个模型有独立的档位选择器；形态与 NVIDIA NIM 相同
+- **Antigravity 配额主机修复**：配额 summary 改查正确的 daily host（与原生 IDE 一致），修复数字系统性偏差；百分比直读后端值而非前端重算
+- **CodeBuddy 模型目录对齐服务端（CN + 国际版）**：国际版按服务端目录重排（新增 Hy4-Preview / Hy3 免费档、GPT-5.6 Sol/Terra/Luna、GLM-5.3、Kimi-K3 等，移除已下线的旧模型）；CN 站同步对齐——`DeepSeek-V4.1-Flash` 取代 `DeepSeek-V4-Flash`，清掉重复的 `Kimi-K3 (1)`；两站各模型都标上服务端公布的积分倍率
+- **模型列表显示积分倍率徽章**：走免费额度的模型显示绿色 `free` 标签，其余显示 `0.79x` 形式的倍率小标签（hover 有说明）；供应商没有积分体系时不显示
+
+### 🔒 安全加固
+- **API key HMAC secret 硬化**：内置兜底密文未设置时 production 启动告警；新增实验功能「密钥签名轮换」（默认关），自动生成每实例独立密文；keyId 生成改用 `crypto.randomBytes`
+- **危险操作确认弹窗**：关闭 API 密钥校验、启用/停用签名轮换、全部重签均需确认；重签防重复提交（服务端 409 + 前端防护）
+
+### 🐛 修复
+- **非流式请求被误判为流式（issue #4）**：省略 `stream` 字段现在正确默认为 JSON（OpenAI/Anthropic 规范）；此前会返回 `text/event-stream` + `data: [DONE]` 尾随，严格解析的客户端全部报错（OpenAI SDK、WorkBuddy、curl）
+- **密钥轮换确认弹窗卡死 / 反复重签**：确认弹窗自动关闭后再执行操作；重复重签不再堆叠 "(rotated)" 后缀
+- **MCP SSE 空闲断连**：MCP 长连接补 25 秒注释心跳，防止 NAT/防火墙静默掐断
+- **CodeBuddy CN 白名单误放行（PR #5）**：Claude Code 自身系统提示不再匹配 agent 身份白名单（此前触发 11128）
+- **GLM-4.6V-Flash 缺视觉能力（PR #5）**：免费视觉模型补注册正确的 capabilities
+- **DeepSeek effort "max" 被 SenseNova 拒绝（PR #5）**：钳位到 "xhigh" 兼容两家
+- **拉取/导入的模型默认停用（按需启用）**：「Import from /models」与「Fetch Qoder Models」批量拉回的模型不再一次全部启用刷屏——先落入「Disabled models」区，用到哪个点哪个；`/v1/models` 同步只下发已启用的模型（此前标了停用仍会下发）。手动单个添加仍立即启用
+- **CodeBuddy CN 误挂国际版模型（修正）**：此前 CN 目录混入了只属于国际版的 GPT/Gemini 家族，选中会报 model service info not found；现已移除（保留在国际版）并加测试守卫
+- **DeepSeek-V4.1-Flash 输出上限被低估（修正）**：能力表把它的最大输出写成 50K（从改名前的旧 id 带过来的值），客户端请求会被按此截断；已按模型卡更正为 1M 上下文 / 384K 输出 / 支持图像输入 / 思考默认开且可关，并给该模型的两个别名 id 补上同一套能力
+
+## v1.0.7 (2026-09-07)
 
 ### ✨ 新增
 - **CodeBuddy CN 内置「总积分」配额行**：用量页 CodeBuddy CN 第一行新增总积分汇总（全部包实时余额合计，含每月/赠送包），不用再自己加总；总余额耗尽时随「只看有余额」自动隐藏；「赠送包」行名已翻译

package/app/public/i18n/changelog/zh-TW.md

@@ -2,7 +2,53 @@
 
 這裡展示面向用戶的關鍵更新；完整開發明細見 [CHANGELOG.md](https://github.com/techysy/10router/blob/main/CHANGELOG.md)。
 
-## v1.0.7 (2026-09-06)
+## v1.1.0 (2026-09-11)
+
+### ✨ 新增
+
+- **小米 MiMo 桌面版支援（一個供應商、兩種登入）**：`xiaomi-mimo` 現在既支援 sk- API 金鑰（雲 API），也支援小米 MiMo 桌面客戶端帳號 —— 桌面獨佔的 `mimo-x-pro-preview` / `mimo-x-flash-preview` 只認帳號 Cookie，光有 API 金鑰用不了。兩種憑證共用一個供應商卡片，按需啟用即可。
+- **小米 MiMo 授權碼登入**：瀏覽器開啟官方授權頁後，即使本機回呼沒接上（或已逾時），也可以把頁面上顯示的授權碼**直接貼上**到對話框完成登入。憑證全程只在伺服器端解密，不經過瀏覽器。
+- **CodeBuddy 國際版模型目錄補齊**：逐個用真實請求核對線上服務範圍，補進 5 個真實存在卻缺漏的模型（GLM-5.1 / GLM-5v-Turbo / MiniMax-M3 / Kimi-K2.7 / DeepSeek-V4.1-Flash）與 `GPT 6.0 Astra`。
+- **opencode-go 目錄對齊官方公開清單（18 個模型），並為每個模型宣告端點**：以前部分模型因為「端點宣告缺失」被送到錯誤路徑而直接失敗，現在按官方端點表逐條宣告。
+- **新增 Codex / OpenAI 的 `gpt-image-2.5` 圖像模型家族**：`gpt-image-2.5`（含 `-flare` / `-sunburst`）、`gpt-image-2`、`gpt-image-1.5`，支援文生圖、圖片編輯與多圖參考。
+- **積分徽章支援限時免費促銷**：促銷期顯示綠色 `free`，到期**自動**恢復顯示真實倍率 —— 不再需要有人記得回來改。
+
+### 🐛 修復
+
+- **Windows 桌面版升級不再靜默丟棄舊資料**：桌面版的資料目錄同時也是 Electron 自己的設定目錄，Chromium 會先生成一堆檔案把它撐成「非空」，導致舊資料遷移被永久跳過。現在判據改為「目錄裡是否已經有我們自己的資料庫」。
+- **小米 MiMo 授權碼登入的多個真問題**：載荷解密佈局前後顛倒（這才是 `decrypt_failed` 的真因）、平台要求攜帶 `app=MiMo`、回呼路徑改為隨機字串、結果以 302 交回平台；另外回呼監聽器逾時後貼上不再失效。
+- **Kiro 請求不再攜帶頂層 `systemPrompt`**（kiro.dev 對它直接回 400 且不重試），端點順序改為 Amazon 面優先。
+- **Claude 工具 `type` 改為按供應商開關**：修好 MiniMax 的 Claude 端點（缺 `type` 被拒），同時避免把 DeepSeek 的 Claude 端點打掛（它只認自家 `type`）。
+- **Codex 工具 schema 裡它不認的 `\p{...}` 正則會被剝離**：此前只要某個工具的參數 `pattern` 用了屬性跳脫，整個請求就 400，且每個帳號都一樣失敗。
+- **Node 24 上跳過 `better-sqlite3`**：它的原生外掛在 Node ≥ 24 上載入即崩潰（行程級），此前會讓整個服務直接死掉。
+- **AMD Token Factory 目錄與能力按實測重建**：補上漏登的聊天模型，並修掉「純文字」誤判（圖片會被靜默丟棄）。
+- **CodeBuddy CN 的 DeepSeek-V4.1-Flash 輸出上限回落到伺服器公布的 128K**：取大不會報錯，只會讓超過伺服器上限的請求更容易撞 400。
+- **同一個供應商不再在停用清單裡存兩份互相矛盾的記錄**：修掉「有些模型看起來沒被停用」的問題。
+
+## v1.0.8 (2026-09-09)
+
+### ✨ 新增
+- **新增 AMD Token Factory 供應商**：AMD Radeon Cloud 免費共享 OpenAI 相容端點（`DeepSeek-V4-Flash` 1M 上下文 + `Qwen3.8-Flash-Next` 262K 上下文）；thinking 透過 reasoning_effort 控制，每個模型有獨立的檔位選擇器；形態與 NVIDIA NIM 相同
+- **Antigravity 配額主機修復**：配額 summary 改查正確的 daily host（與原生 IDE 一致），修復數字系統性偏差；百分比直讀後端值而非前端重算
+- **CodeBuddy 模型目錄對齊服務端（CN + 國際版）**：國際版按服務端目錄重排（新增 Hy4-Preview / Hy3 免費檔、GPT-5.6 Sol/Terra/Luna、GLM-5.3、Kimi-K3 等，移除已下線的舊模型）；CN 站同步對齊——`DeepSeek-V4.1-Flash` 取代 `DeepSeek-V4-Flash`，清掉重複的 `Kimi-K3 (1)`；兩站各模型都標上服務端公布的積分倍率
+- **模型列表顯示積分倍率徽章**：走免費額度的模型顯示綠色 `free` 標籤，其餘顯示 `0.79x` 形式的倍率小標籤（hover 有說明）；供應商沒有積分體系時不顯示
+
+### 🔒 安全加固
+- **API key HMAC secret 硬化**：內建兜底密文未設定時 production 啟動告警；新增實驗功能「金鑰簽署輪換」（預設關閉），自動產生每實例獨立密文；keyId 生成改用 `crypto.randomBytes`
+- **危險操作確認彈窗**：關閉 API 金鑰校驗、啟用/停用簽署輪換、全部重簽均需確認；重簽防重複提交（伺服器 409 + 前端防護）
+
+### 🐛 修復
+- **非串流請求被誤判為串流（issue #4）**：省略 `stream` 欄位現在正確預設為 JSON（OpenAI/Anthropic 規範）；此前會傳回 `text/event-stream` + `data: [DONE]` 尾隨，嚴格解析的用戶端全部報錯（OpenAI SDK、WorkBuddy、curl）
+- **金鑰輪換確認彈窗卡死 / 反覆重簽**：確認彈窗自動關閉後再執行操作；重複重簽不再堆疊 "(rotated)" 後綴
+- **MCP SSE 閒置斷線**：MCP 長連線補 25 秒註解心跳，防止 NAT/防火牆靜默掐斷
+- **CodeBuddy CN 白名單誤放行（PR #5）**：Claude Code 自身系統提示不再匹配 agent 身分白名單（此前觸發 11128）
+- **GLM-4.6V-Flash 缺視覺能力（PR #5）**：免費視覺模型補註冊正確的 capabilities
+- **DeepSeek effort "max" 被 SenseNova 拒絕（PR #5）**：鉗位到 "xhigh" 相容兩家
+- **拉取/匯入的模型預設停用（按需啟用）**：「Import from /models」與「Fetch Qoder Models」批次拉回的模型不再一次全部啟用洗版——先落入「Disabled models」區，用到哪個點哪個；`/v1/models` 同步只下發已啟用的模型（此前標了停用仍會下發）。手動單個新增仍立即啟用
+- **CodeBuddy CN 誤掛國際版模型（修正）**：此前 CN 目錄混入了只屬於國際版的 GPT/Gemini 家族，選中會報 model service info not found；現已移除（保留在國際版）並加測試守衛
+- **DeepSeek-V4.1-Flash 輸出上限被低估（修正）**：能力表把最大輸出寫成 50K（從改名前的舊 id 帶過來），客戶端請求會被據此截斷；已依模型卡更正為 1M 上下文 / 384K 輸出 / 支援圖像輸入 / 思考預設開且可關，並給該模型的兩個別名 id 補上同一套能力
+
+## v1.0.7 (2026-09-07)
 
 ### ✨ 新增
 - **CodeBuddy CN 內建「總積分」配額行**：用量頁 CodeBuddy CN 第一行新增總積分彙總（全部包即時餘額合計，含每月/贈送包），不用再自己加總；總餘額耗盡時隨「只看有餘額」自動隱藏；「贈送包」行名已翻譯

package/app/public/i18n/literals/zh-CN.json

@@ -330,6 +330,7 @@
   "Create your first API key to get started": "创建您的第一个 API 密钥以开始使用",
   "Created": "已创建",
   "Creating...": "创建中...",
+  "Credit multiplier": "积分倍率",
   "Current": "当前",
   "Current Password": "当前密码",
   "Current Pricing Overview": "当前定价概述",
@@ -476,6 +477,9 @@
   "Failed to apply settings": "应用设置失败",
   "Failed to create combo": "创建组合失败",
   "Failed to fetch models": "获取模型失败",
+  "Models refreshed": "模型已刷新",
+  "Refresh Official Models": "刷新官方模型",
+  "Refreshing...": "刷新中...",
   "Failed to load changelog:": "加载更新日志失败：",
   "Failed to load usage statistics.": "无法加载使用情况统计信息。",
   "Failed to reset settings": "重置设置失败",
@@ -1009,6 +1013,8 @@
   "Restore model": "恢复模型",
   "Resume key": "恢复密钥",
   "Retry": "重试",
+  "rides the free quota": "走免费额度",
+  "promo free until": "限时免费至",
   "Risk Notice": "风险提示",
   "Roo AI Assistant": "Roo AI 助手",
   "Rotate providers across requests instead of strict fallback order.": "在请求间轮换提供商，而不是严格的回退顺序。",
@@ -1470,7 +1476,8 @@
   "usage records": "条使用记录",
   "skipped": "跳过",
   "total": "总计",
-  "Only SQLite database files (.sqlite/.db) can be imported": "只能导入 SQLite 数据库文件（.sqlite/.db）",
+  "Only SQLite (.sqlite/.db) or JSON (.json) usage files can be imported": "只能导入 SQLite（.sqlite/.db）或 JSON（.json）使用量文件",
+  "Invalid JSON usage file": "使用量 JSON 文件无效",
   "Account filter is active and persists across visits": "已启用账户筛选，该选择会在下次访问时保留",
   "Community": "公益站",
   "Show community welfare providers": "显示公益站供应商",
@@ -1518,5 +1525,96 @@
   "✓ Copied — shutting down...": "✓ 已复制 — 正在关闭…",
   "Shutting down in {s}s": "将在 {s} 秒后关闭",
   "Regional currency": "本地货币",
-  "Single Sign-On (SSO)": "单点登录 (SSO)"
-}
+  "Single Sign-On (SSO)": "单点登录 (SSO)",
+  "Key secret rotation": "密钥签名轮换",
+  "Re-issue all keys": "重签全部密钥",
+  "Rotate all": "全部重签",
+  "Rotating…": "重签中…",
+  "Pause API key": "暂停 API 密钥",
+  "This key will stop working immediately but can be resumed later.": "该密钥将立即停止工作，之后可以随时恢复。",
+  "Sign new keys with an auto-generated secret instead of the built-in one": "使用自动生成的密文签署新密钥，替代内置默认密文",
+  "Re-issue all keys under the current secret — clients must be updated": "按当前密文重签全部存量密钥——所有客户端需同步更新",
+  "Re-create every existing key under the current secret — clients must be updated": "按当前密文重新创建全部存量密钥——所有客户端需同步更新",
+  "Enable key secret rotation?": "启用密钥签名轮换？",
+  "Disable key secret rotation?": "停用密钥签名轮换？",
+  "Disable API key requirement?": "停用 API 密钥校验？",
+  "Re-issue all API keys?": "重签全部 API 密钥？",
+  "Keys Re-issued": "密钥已重签",
+  "Save these keys now — shown only once": "请立即保存这些密钥——仅显示这一次",
+  "Old keys no longer work. Update every client with the new values below.": "旧密钥已失效。请用下方新值更新所有客户端。",
+  "Requests without a valid key will be accepted while this is off. You can re-enable it at any time.": "关闭期间，无有效密钥的请求将被放行。你可随时重新开启。",
+  "New keys will be signed with an auto-generated secret. Keys issued BEFORE enabling will stop validating and cannot be restored — re-create them and update every client. This cannot be undone silently.": "新密钥将改用自动生成的密文签署。启用之前签发的密钥将全部失效且无法恢复——需重新创建并更新所有客户端。此操作无法静默撤销。",
+  "New keys will be signed with the built-in secret again. Keys issued while rotation was enabled will stop validating — re-create them and update every client.": "新密钥将改回内置密文签署。轮换启用期间签发的密钥将全部失效——需重新创建并更新所有客户端。",
+  "Every existing key will be replaced with a new one signed under the current secret. All clients using old keys will stop working until updated. This cannot be undone.": "全部存量密钥将按当前密文替换为新建密钥。使用旧密钥的客户端在更新前将无法工作。此操作无法撤销。",
+  "When enabled, the HMAC secret used for API key CRC is auto-generated to the data directory (api-key-secret, mode 0600) — or set API_KEY_SECRET to pin your own (env always wins). Existing keys keep working only if they were issued under the same secret; after enabling, previously issued keys fail validation and must be re-created.": "启用后，用于 API 密钥 CRC 的 HMAC 密文将自动生成并保存到数据目录（api-key-secret，权限 0600）——也可设置 API_KEY_SECRET 环境变量固定自选密文（env 永远优先）。仅在同一密文下签发的密钥可继续使用；启用后，先前签发的密钥将校验失败，需重新创建。",
+  "Change the default dashboard password before activating the tunnel.": "启用隧道前，请先更改仪表盘默认密码。",
+  "Enable \"Require login\" and set a custom password before activating the tunnel.": "启用隧道前，请先开启「需要登录」并设置自定义密码。",
+  "Open settings": "打开设置",
+  "Security required: Change the default dashboard password before activating the tunnel.": "安全要求：启用隧道前，请先更改仪表盘默认密码。",
+  "Security required: Enable \"Require login\" and set a custom password before activating the tunnel.": "安全要求：启用隧道前，请先开启「需要登录」并设置自定义密码。",
+  "Security required: Enable \"Require API key\" before activating the tunnel.": "安全要求：启用隧道前，请先开启「需要 API 密钥」。",
+  "Require API key is disabled — your endpoint is publicly accessible without authentication.": "「需要 API 密钥」已关闭——您的端点无需任何鉴权即可被公开访问。",
+  "Require login is disabled — anyone can access your dashboard via tunnel.": "「需要登录」已关闭——任何人都可通过隧道访问您的仪表盘。",
+  "Dashboard uses the default password — change it in Profile settings.": "仪表盘正在使用默认密码——请在个人资料设置中更改。",
+  "Change password": "更改密码",
+  "Connected but not reachable yet.": "已连接，但尚不可达。",
+  "Creating tunnel...": "正在创建隧道...",
+  "Waiting for tunnel ready...": "正在等待隧道就绪...",
+  "Tunnel checking...": "隧道检查中...",
+  "Tunnel reconnecting...": "隧道重连中...",
+  "Reconnecting...": "重连中...",
+  "Tunnel created but not reachable. Please try again.": "隧道已创建但不可达，请重试。",
+  "Tunnel process stopped unexpectedly.": "隧道进程意外停止。",
+  "No tunnel URL returned": "未返回隧道 URL",
+  "Failed to connect": "连接失败",
+  "Failed to enable tunnel": "启用隧道失败",
+  "Failed to disable tunnel": "禁用隧道失败",
+  "Waiting for Tailscale ready...": "正在等待 Tailscale 就绪...",
+  "Tailscale checking...": "Tailscale 检查中...",
+  "Tailscale reconnecting...": "Tailscale 重连中...",
+  "Tailscale disabled": "Tailscale 已禁用",
+  "Failed to disable Tailscale": "禁用 Tailscale 失败",
+  "Starting funnel...": "正在启动 Funnel...",
+  "Timed out waiting for Funnel to be enabled.": "等待 Funnel 启用超时。",
+  "Failed to start funnel": "启动 Funnel 失败",
+  "Install failed": "安装失败",
+  "Login timed out. Please try again.": "登录超时，请重试。",
+  "Login required — click \"Open Login Page\" to continue": "需要登录——请点击「打开登录页」继续",
+  "Click \"Open Funnel Settings\" to enable Funnel...": "点击「打开 Funnel 设置」以启用 Funnel...",
+  "Open Login Page": "打开登录页",
+  "Open Funnel Settings": "打开 Funnel 设置",
+  "Delete this API key?": "删除此 API 密钥？",
+  "Default Key": "默认密钥",
+  "Failed to read local Xiaomi MiMo Desktop credentials.": "读取本地小米 MiMo 桌面版凭据失败。",
+  "Paste the authorization code first.": "请先粘贴授权码。",
+  "Authorization not completed yet. Finish in the browser, then click Check Again.": "尚未完成授权。请在浏览器中完成后再点「再检查一次」。",
+  "Connect Xiaomi MiMo": "连接小米 MiMo",
+  "Reading local credentials...": "正在读取本地凭据……",
+  "Checking Xiaomi MiMo Desktop's local profile (auth.json + cookie store)": "正在检查小米 MiMo 桌面版的本地配置（auth.json 与 cookie 库）",
+  "Xiaomi MiMo Desktop credentials found!": "已找到小米 MiMo 桌面版凭据！",
+  "UID": "UID",
+  "Source": "来源",
+  "Desktop account session detected — Preview models will be available.": "已检测到桌面版账号会话 —— Preview 模型可用。",
+  "Desktop is running and is holding its credential store — quit it to unlock the Preview models (the API key alone covers the cloud models).": "桌面版正在运行并占用其凭据库 —— 退出后可解锁 Preview 模型（仅用 API Key 即可使用云端模型）。",
+  "No Desktop account session found — the API key alone is enough for the cloud models.": "未找到桌面版账号会话 —— 仅用 API Key 即可使用云端模型。",
+  "Connect with Local Credentials": "使用本地凭据连接",
+  "Quit Xiaomi MiMo Desktop and retry": "退出小米 MiMo 桌面版后重试",
+  "Local credentials not found": "未找到本地凭据",
+  "The desktop app keeps an exclusive lock on its credential store while it runs.": "桌面版运行时会独占其凭据库。",
+  "Make sure Xiaomi MiMo Desktop is installed and you are signed in, then retry.": "请确认已安装小米 MiMo 桌面版并已登录，然后重试。",
+  "Or sign in via browser below.": "或在下方通过浏览器登录。",
+  "Retry Local Detect": "重新检测本地凭据",
+  "Sign in via Browser": "通过浏览器登录",
+  "Browser opened. Complete the Xiaomi sign-in there.": "浏览器已打开，请在其中完成小米登录。",
+  "The page may show an authorization code — paste it below. If it came back automatically instead, click": "页面可能显示一串授权码 —— 请粘贴到下方。若已自动回调，请点击",
+  "Check Again": "再检查一次",
+  "Authorization Code": "授权码",
+  "Paste the authorization code shown in the browser": "粘贴浏览器中显示的授权码",
+  "Submit Code": "提交授权码",
+  "That is too short to be the whole code — it is usually a long string of 100+ characters. Use the Copy button on the sign-in page, then paste it here.": "这串内容太短，不像完整的授权码 —— 它通常是一长串（100 个字符以上）。请在授权页点「复制」按钮，再粘贴到这里。",
+  "This sign-in attempt is no longer active. Click Sign in via Browser to start again.": "本次登录已失效。请点「通过浏览器登录」重新开始。",
+  "That code does not match this sign-in. Copy the whole code from the sign-in page, or click Sign in via Browser for a fresh one.": "这串授权码与本次登录不匹配。请从授权页复制完整的授权码，或点「通过浏览器登录」重新获取一个。",
+  "That code did not contain an API key. Start the sign-in again.": "这串授权码里没有 API Key。请重新登录一次。",
+  "The code is a long string (100+ characters) — copy it whole, using the Copy button on the sign-in page.": "授权码是一长串字符（100 个以上）—— 请用授权页的「复制」按钮整串复制。",
+  "Open the code page": "打开授权码页面"
+}

package/app/public/i18n/literals/zh-TW.json

@@ -1,4 +1,7 @@
 {
+  "Models refreshed": "模型已重新整理",
+  "Refresh Official Models": "重新整理官方模型",
+  "Refreshing...": "重新整理中...",
   "Cached": "快取",
   "Cached Cost": "快取成本",
   "Cancel": "取消",
@@ -74,6 +77,9 @@
   "Date": "日期",
   "Time": "時間",
   "Created": "已建立",
+  "Credit multiplier": "積分倍率",
+  "rides the free quota": "走免費額度",
+  "promo free until": "限時免費至",
   "Updated": "已更新",
   "Actions": "操作",
   "Details": "詳細信息",
@@ -289,7 +295,8 @@
   "usage records": "筆使用記錄",
   "skipped": "跳過",
   "total": "總計",
-  "Only SQLite database files (.sqlite/.db) can be imported": "只能匯入 SQLite 資料庫檔案（.sqlite/.db）",
+  "Only SQLite (.sqlite/.db) or JSON (.json) usage files can be imported": "只能匯入 SQLite（.sqlite/.db）或 JSON（.json）使用量檔案",
+  "Invalid JSON usage file": "使用量 JSON 檔案無效",
   "Account filter is active and persists across visits": "已啟用帳戶篩選，該選擇會在下次造訪時保留",
   "Community": "公益站",
   "Show community welfare providers": "顯示公益站供應商",
@@ -306,5 +313,103 @@
   "accounts exported": "個帳號已匯出",
   "Export failed": "匯出失敗",
   "Enter your current password to export CodeBuddy CN accounts.": "輸入目前密碼以匯出 CodeBuddy CN 帳號。",
-  "Enter your current password to import CodeBuddy CN accounts.": "輸入目前密碼以匯入 CodeBuddy CN 帳號。"
+  "Enter your current password to import CodeBuddy CN accounts.": "輸入目前密碼以匯入 CodeBuddy CN 帳號。",
+  "Key secret rotation": "金鑰簽署輪換",
+  "Re-issue all keys": "重簽全部金鑰",
+  "Rotate all": "全部重簽",
+  "Rotating…": "重簽中…",
+  "Pause API Key": "暫停 API 金鑰",
+  "Pause API key": "暫停 API 金鑰",
+  "Pause key": "暫停金鑰",
+  "Resume key": "恢復金鑰",
+  "Paused": "已暫停",
+  "This key will stop working immediately but can be resumed later.": "該金鑰將立即停止運作，之後可以隨時恢復。",
+  "Sign new keys with an auto-generated secret instead of the built-in one": "使用自動產生的密文簽署新金鑰，取代內建預設密文",
+  "Re-issue all keys under the current secret — clients must be updated": "按目前密文重簽全部存量金鑰——所有用戶端需同步更新",
+  "Re-create every existing key under the current secret — clients must be updated": "按目前密文重新建立全部存量金鑰——所有用戶端需同步更新",
+  "Enable key secret rotation?": "啟用金鑰簽署輪換？",
+  "Disable key secret rotation?": "停用金鑰簽署輪換？",
+  "Disable API key requirement?": "停用 API 金鑰校驗？",
+  "Re-issue all API keys?": "重簽全部 API 金鑰？",
+  "Keys Re-issued": "金鑰已重簽",
+  "Save these keys now — shown only once": "請立即儲存這些金鑰——僅顯示這一次",
+  "Old keys no longer work. Update every client with the new values below.": "舊金鑰已失效。請用下方新值更新所有用戶端。",
+  "Requests without a valid key will be accepted while this is off. You can re-enable it at any time.": "關閉期間，無有效金鑰的請求將被放行。你可隨時重新開啟。",
+  "New keys will be signed with an auto-generated secret. Keys issued BEFORE enabling will stop validating and cannot be restored — re-create them and update every client. This cannot be undone silently.": "新金鑰將改用自動產生的密文簽署。啟用之前簽發的金鑰將全部失效且無法恢復——需重新建立並更新所有用戶端。此操作無法靜默撤銷。",
+  "New keys will be signed with the built-in secret again. Keys issued while rotation was enabled will stop validating — re-create them and update every client.": "新金鑰將改回內建密文簽署。輪換啟用期間簽發的金鑰將全部失效——需重新建立並更新所有用戶端。",
+  "Every existing key will be replaced with a new one signed under the current secret. All clients using old keys will stop working until updated. This cannot be undone.": "全部存量金鑰將按目前密文替換為新建金鑰。使用舊金鑰的用戶端在更新前將無法工作。此操作無法撤銷。",
+  "When enabled, the HMAC secret used for API key CRC is auto-generated to the data directory (api-key-secret, mode 0600) — or set API_KEY_SECRET to pin your own (env always wins). Existing keys keep working only if they were issued under the same secret; after enabling, previously issued keys fail validation and must be re-created.": "啟用後，用於 API 金鑰 CRC 的 HMAC 密文將自動產生並儲存到資料目錄（api-key-secret，權限 0600）——也可設定 API_KEY_SECRET 環境變數固定自選密文（env 永遠優先）。僅在同一密文下簽發的金鑰可繼續使用；啟用後，先前簽發的金鑰將校驗失敗，需重新建立。",
+  "Change the default dashboard password before activating the tunnel.": "啟用隧道前，請先變更儀表板預設密碼。",
+  "Enable \"Require login\" and set a custom password before activating the tunnel.": "啟用隧道前，請先開啟「需要登錄」並設定自訂密碼。",
+  "Open settings": "開啟設置",
+  "Security required: Change the default dashboard password before activating the tunnel.": "安全要求：啟用隧道前，請先變更儀表板預設密碼。",
+  "Security required: Enable \"Require login\" and set a custom password before activating the tunnel.": "安全要求：啟用隧道前，請先開啟「需要登錄」並設定自訂密碼。",
+  "Security required: Enable \"Require API key\" before activating the tunnel.": "安全要求：啟用隧道前，請先開啟「需要 API 金鑰」。",
+  "Require API key is disabled — your endpoint is publicly accessible without authentication.": "「需要 API 金鑰」已關閉——您的端點無需任何驗證即可被公開存取。",
+  "Require login is disabled — anyone can access your dashboard via tunnel.": "「需要登錄」已關閉——任何人都可透過隧道存取您的儀表板。",
+  "Dashboard uses the default password — change it in Profile settings.": "儀表板正在使用預設密碼——請在個人資料設置中變更。",
+  "Change password": "變更密碼",
+  "Connected but not reachable yet.": "已連線，但尚不可達。",
+  "Creating tunnel...": "正在建立隧道...",
+  "Waiting for tunnel ready...": "正在等待隧道就緒...",
+  "Tunnel checking...": "隧道檢查中...",
+  "Tunnel reconnecting...": "隧道重連中...",
+  "Reconnecting...": "重連中...",
+  "Tunnel created but not reachable. Please try again.": "隧道已建立但不可達，請重試。",
+  "Tunnel process stopped unexpectedly.": "隧道程式意外停止。",
+  "No tunnel URL returned": "未返回隧道 URL",
+  "Failed to connect": "連線失敗",
+  "Failed to enable tunnel": "啟用隧道失敗",
+  "Failed to disable tunnel": "停用隧道失敗",
+  "Waiting for Tailscale ready...": "正在等待 Tailscale 就緒...",
+  "Tailscale checking...": "Tailscale 檢查中...",
+  "Tailscale reconnecting...": "Tailscale 重連中...",
+  "Tailscale disabled": "Tailscale 已停用",
+  "Failed to disable Tailscale": "停用 Tailscale 失敗",
+  "Starting funnel...": "正在啟動 Funnel...",
+  "Timed out waiting for Funnel to be enabled.": "等待 Funnel 啟用逾時。",
+  "Failed to start funnel": "啟動 Funnel 失敗",
+  "Install failed": "安裝失敗",
+  "Login timed out. Please try again.": "登錄逾時，請重試。",
+  "Login required — click \"Open Login Page\" to continue": "需要登錄——請點擊「開啟登錄頁」繼續",
+  "Click \"Open Funnel Settings\" to enable Funnel...": "點擊「開啟 Funnel 設置」以啟用 Funnel...",
+  "Open Login Page": "開啟登錄頁",
+  "Open Funnel Settings": "開啟 Funnel 設置",
+  "Delete this API key?": "刪除此 API 金鑰？",
+  "Default Key": "預設金鑰",
+  "Security required: ": "安全要求：",
+  "Failed to read local Xiaomi MiMo Desktop credentials.": "讀取本機小米 MiMo 桌面版憑證失敗。",
+  "Paste the authorization code first.": "請先貼上授權碼。",
+  "Authorization not completed yet. Finish in the browser, then click Check Again.": "尚未完成授權。請在瀏覽器中完成後再點「再檢查一次」。",
+  "Connect Xiaomi MiMo": "連接小米 MiMo",
+  "Reading local credentials...": "正在讀取本機憑證……",
+  "Checking Xiaomi MiMo Desktop's local profile (auth.json + cookie store)": "正在檢查小米 MiMo 桌面版的本機設定（auth.json 與 cookie 資料庫）",
+  "Xiaomi MiMo Desktop credentials found!": "已找到小米 MiMo 桌面版憑證！",
+  "UID": "UID",
+  "Source": "來源",
+  "Desktop account session detected — Preview models will be available.": "已偵測到桌面版帳號工作階段 —— Preview 模型可使用。",
+  "Desktop is running and is holding its credential store — quit it to unlock the Preview models (the API key alone covers the cloud models).": "桌面版正在執行並佔用其憑證資料庫 —— 結束後可解鎖 Preview 模型（僅用 API Key 即可使用雲端模型）。",
+  "No Desktop account session found — the API key alone is enough for the cloud models.": "找不到桌面版帳號工作階段 —— 僅用 API Key 即可使用雲端模型。",
+  "Connect with Local Credentials": "使用本機憑證連接",
+  "Connecting...": "連接中……",
+  "Quit Xiaomi MiMo Desktop and retry": "結束小米 MiMo 桌面版後重試",
+  "Local credentials not found": "找不到本機憑證",
+  "The desktop app keeps an exclusive lock on its credential store while it runs.": "桌面版執行時會獨佔其憑證資料庫。",
+  "Make sure Xiaomi MiMo Desktop is installed and you are signed in, then retry.": "請確認已安裝小米 MiMo 桌面版並已登入，然後重試。",
+  "Or sign in via browser below.": "或在下方透過瀏覽器登入。",
+  "Retry Local Detect": "重新偵測本機憑證",
+  "Sign in via Browser": "透過瀏覽器登入",
+  "Browser opened. Complete the Xiaomi sign-in there.": "瀏覽器已開啟，請在其中完成小米登入。",
+  "The page may show an authorization code — paste it below. If it came back automatically instead, click": "頁面可能顯示一串授權碼 —— 請貼到下方。若已自動回呼，請點擊",
+  "Check Again": "再檢查一次",
+  "Authorization Code": "授權碼",
+  "Paste the authorization code shown in the browser": "貼上瀏覽器中顯示的授權碼",
+  "Checking...": "檢查中……",
+  "Submit Code": "提交授權碼",
+  "That is too short to be the whole code — it is usually a long string of 100+ characters. Use the Copy button on the sign-in page, then paste it here.": "這串內容太短，不像完整的授權碼 —— 它通常是一長串（100 個字元以上）。請在授權頁點「複製」按鈕，再貼到這裡。",
+  "This sign-in attempt is no longer active. Click Sign in via Browser to start again.": "本次登入已失效。請點「透過瀏覽器登入」重新開始。",
+  "That code does not match this sign-in. Copy the whole code from the sign-in page, or click Sign in via Browser for a fresh one.": "這串授權碼與本次登入不符。請從授權頁複製完整的授權碼，或點「透過瀏覽器登入」重新取得一個。",
+  "That code did not contain an API key. Start the sign-in again.": "這串授權碼裡沒有 API Key。請重新登入一次。",
+  "The code is a long string (100+ characters) — copy it whole, using the Copy button on the sign-in page.": "授權碼是一長串字元（100 個以上）—— 請用授權頁的「複製」按鈕整串複製。",
+  "Open the code page": "開啟授權碼頁面"
 }