@techysy/10router 1.6.2 → 1.6.4-test.1

package/app/public/i18n/literals/zh-CN.json

@@ -290,6 +290,16 @@
   "Connection Details": "连接详情",
   "Connection Failed": "连接失败",
   "Connections": "连接",
+  "Loomy SMS Login": "Loomy 手机验证码登录",
+  "Log in with your iFlytek phone number — no Loomy client needed. The session lasts about 14 days and is added as a connection automatically.": "使用讯飞手机号验证码直接登录——无需安装 Loomy 客户端。会话约 14 天有效，登录后自动添加为连接。",
+  "Phone Number": "手机号",
+  "Send Code": "发送验证码",
+  "Sending…": "发送中…",
+  "SMS Code": "短信验证码",
+  "6-digit code": "6 位验证码",
+  "Logging in…": "登录中…",
+  "Verify & Add Connection": "验证并添加连接",
+  "SMS Login": "验证码登录",
   "Console Log": "控制台日志",
   "Contact": "联系",
   "Content": "内容",

package/app/public/i18n/literals/zh-TW.json

@@ -1,4 +1,14 @@
 {
+  "Loomy SMS Login": "Loomy 手機簡訊登入",
+  "Log in with your iFlytek phone number — no Loomy client needed. The session lasts about 14 days and is added as a connection automatically.": "使用訊飛手機號碼驗證碼直接登入——無需安裝 Loomy 用戶端。工作階段約 14 天有效，登入後自動新增為連線。",
+  "Phone Number": "手機號碼",
+  "Send Code": "發送驗證碼",
+  "Sending…": "發送中…",
+  "SMS Code": "簡訊驗證碼",
+  "6-digit code": "6 位驗證碼",
+  "Logging in…": "登入中…",
+  "Verify & Add Connection": "驗證並新增連線",
+  "SMS Login": "驗證碼登入",
   "Manage your System One providers": "管理您的 System One 提供者",
   "Models refreshed": "模型已重新整理",
   "Off-peak discount": "離峰折扣",

package/app/public/providers/doubao.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128" height="128">
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#3B82F6"/>
+      <stop offset="1" stop-color="#175CFF"/>
+    </linearGradient>
+  </defs>
+  <rect width="128" height="128" rx="28" fill="url(#bg)"/>
+  <circle cx="64" cy="46" r="22" fill="#ffffff" opacity="0.95"/>
+  <ellipse cx="64" cy="92" rx="30" ry="18" fill="#ffffff" opacity="0.75"/>
+  <circle cx="57" cy="42" r="4.5" fill="#175CFF"/>
+  <circle cx="71" cy="42" r="4.5" fill="#175CFF"/>
+  <path d="M56 54 Q64 60 72 54" stroke="#175CFF" stroke-width="3.5" fill="none" stroke-linecap="round"/>
+</svg>

package/app/src/shared/utils/apiKey.js

@@ -37,8 +37,16 @@ function ensureGeneratedSecret() {
   return _generatedSecretCache;
 }
 
+let legacyKeyWarned = false;
+
 // Resolved per call (cheap after first rotation): env secret → generated
 // secret (rotation on) → legacy fallback (rotation off, production warns).
+//
+// Deprecation schedule for LEGACY_FALLBACK_SECRET (Issue #43, Item 3):
+// - v1.2.0: Introduced per-machine random secret with opt-in rotation ($DATA_DIR/api-key-secret).
+// - v1.6.5: Formal deprecation logging for legacy keys and fallback secret.
+// - v2.0.0: Target version to remove LEGACY_FALLBACK_SECRET; generated machine secret
+//   will become the default on fresh installs and migrations.
 async function resolveApiKeySecret() {
   const fromEnv = process.env.API_KEY_SECRET;
   if (fromEnv) return fromEnv;
@@ -49,6 +57,7 @@ async function resolveApiKeySecret() {
       resolveApiKeySecret._warned = true;
       console.warn(
         "[auth] API_KEY_SECRET is unset — falling back to a well-known built-in secret. " +
+          "This fallback is deprecated and scheduled for removal in v2.0.0. " +
           "Set API_KEY_SECRET, or enable key rotation in Endpoint settings (experimental; " +
           "existing API keys will need to be re-issued after enabling).",
       );
@@ -120,8 +129,15 @@ export async function parseApiKey(apiKey) {
     return { machineId, keyId, isNewFormat: true };
   }
 
-  // Old format: sk-{random8} = 2 parts
+  // Old format: sk-{random8} = 2 parts (deprecated in v1.6.5, removal targeted for v2.0.0)
   if (parts.length === 2) {
+    if (!legacyKeyWarned) {
+      legacyKeyWarned = true;
+      console.warn(
+        "[auth] Deprecation warning: Legacy API key format 'sk-<random8>' is deprecated and scheduled " +
+          "for removal in v2.0.0. Please re-issue your API keys in the dashboard to adopt the machine-bound format."
+      );
+    }
     return { machineId: null, keyId: parts[1], isNewFormat: false };
   }
 

package/package.json

@@ -1,61 +1,61 @@
-{
-  "name": "@techysy/10router",
-  "version": "1.6.2",
-  "description": "10Router CLI - Start and manage 10Router server",
-  "publishConfig": {
-    "access": "public"
-  },
-  "bin": {
-    "10router": "./cli.js"
-  },
-  "files": [
-    "cli.js",
-    "src",
-    "hooks",
-    "app",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",
-    "build": "node scripts/build-cli.js",
-    "pack:cli": "npm run build && npm pack --pack-destination ..",
-    "publish:cli": "npm run build && npm publish --registry https://registry.npmjs.org",
-    "postinstall": "node hooks/postinstall.js || exit 0",
-    "prepublishOnly": "npm run build"
-  },
-  "dependencies": {
-    "enquirer": "^2.4.1",
-    "node-forge": "^1.3.3",
-    "node-machine-id": "^1.1.12",
-    "react": "19.2.1",
-    "react-dom": "19.2.1"
-  },
-  "comment_postinstall": "`|| exit 0` is deliberate: this hook only warms ~/.10router/runtime, and cli.js re-runs the same ensureSqliteRuntime/ensureTrayRuntime on every start, so a failure here costs nothing. Without it npm aborts the whole install — e.g. running Windows npm against a WSL path, where cmd.exe cannot cd to a UNC directory, falls back to C:\\Windows and node then cannot find hooks/postinstall.js at all, so the script's own try/catch never gets to run.",
-  "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.10router/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir. Both runtime deps are installed WITH save (never --no-save): the runtime dir is a single shared npm project, so a package found in node_modules but missing from runtime/package.json is pruned as extraneous by the other hook's next install, and the two hooks would otherwise uninstall each other in a ping-pong.",
-  "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.10router/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "keywords": [
-    "10router",
-    "cli",
-    "proxy",
-    "ai",
-    "api"
-  ],
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/techysy/10router.git",
-    "directory": "cli"
-  },
-  "homepage": "https://github.com/techysy/10router#readme",
-  "bugs": {
-    "url": "https://github.com/techysy/10router/issues"
-  },
-  "devDependencies": {
-    "esbuild": "^0.25.12",
-    "nodemon": "^3.1.14"
-  }
-}
+{
+  "name": "@techysy/10router",
+  "version": "1.6.4-test.1",
+  "description": "10Router CLI - Start and manage 10Router server",
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "10router": "./cli.js"
+  },
+  "files": [
+    "cli.js",
+    "src",
+    "hooks",
+    "app",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",
+    "build": "node scripts/build-cli.js",
+    "pack:cli": "npm run build && npm pack --pack-destination ..",
+    "publish:cli": "npm run build && npm publish --registry https://registry.npmjs.org",
+    "postinstall": "node hooks/postinstall.js || exit 0",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "enquirer": "^2.4.1",
+    "node-forge": "^1.3.3",
+    "node-machine-id": "^1.1.12",
+    "react": "19.2.1",
+    "react-dom": "19.2.1"
+  },
+  "comment_postinstall": "`|| exit 0` is deliberate: this hook only warms ~/.10router/runtime, and cli.js re-runs the same ensureSqliteRuntime/ensureTrayRuntime on every start, so a failure here costs nothing. Without it npm aborts the whole install — e.g. running Windows npm against a WSL path, where cmd.exe cannot cd to a UNC directory, falls back to C:\\Windows and node then cannot find hooks/postinstall.js at all, so the script's own try/catch never gets to run.",
+  "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.10router/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir. Both runtime deps are installed WITH save (never --no-save): the runtime dir is a single shared npm project, so a package found in node_modules but missing from runtime/package.json is pruned as extraneous by the other hook's next install, and the two hooks would otherwise uninstall each other in a ping-pong.",
+  "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.10router/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "keywords": [
+    "10router",
+    "cli",
+    "proxy",
+    "ai",
+    "api"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/techysy/10router.git",
+    "directory": "cli"
+  },
+  "homepage": "https://github.com/techysy/10router#readme",
+  "bugs": {
+    "url": "https://github.com/techysy/10router/issues"
+  },
+  "devDependencies": {
+    "esbuild": "^0.25.12",
+    "nodemon": "^3.1.14"
+  }
+}