Data Maskit: baixar versions anteriors

更新摘要 / Summary
- 数据库密码、API 密钥这类配置项现在能正确识别带前缀的写法，以前只认裸关键词。
- 日志页现在能分清「模型没提到敏感值」和「真的没还原」，不再把两种情况都显示成同一个状态。
- 新增「只提醒」「拦截」两种处理方式和值级白名单，误报可以只放行那一个值，不必关掉整条规则。
- Credentials written the way .env files actually look are now detected; previously only the bare keyword was.
- The log page now tells "the model never mentioned the value" apart from "the value was not restored", instead of showing one status for both.
- Added "warn only" and "block" per-rule handling plus a per-value allowlist, so a false positive can be released without disabling the whole rule.
修复
- 凭据识别覆盖 .env 真实写法：DB_PASSWORD / MYSQL_ROOT_PASSWORD / OPENAI_API_KEY / db.password 等带前缀或点号的键名以前全部漏检，现在正常脱敏。
- 工具定义区不再被改写：工具名、命名空间、参数结构、语法约束以前会被打码，导致上游拒绝请求；现在只扫描其中的说明文字。
- 视觉等价写法不再绕过：零宽字符插入、全角数字与符号（１３８…、alice＠example.com）以前整条漏检，现在能识别，且发出去的内容与用户输入逐字节一致。
- 已知敏感值不再重复出网：某个值一旦被确认敏感，之后在任何位置出现都会被替换，不必再靠 password= 这类锚点。
- 新增出口前复检：脱敏后仍能匹配到原文的请求会被拦下，不再上行。
- 新增中文姓名补漏与剔误：客户陈建国 这类句式不再漏检，张开的括号 这类普通词不再被当成人名。
- 还原状态细分：no_placeholder_in_response 拆成「模型没提」「模型提了但形态坏了」「响应没走完」，日志页可区分。
- 「只提醒」「拦截」两种处理方式现在对所有规则都生效（此前只对部分规则有效），且放行记录会显示在日志里。
新增
- 每条规则可选「脱敏 / 只提醒 / 拦截」三种处理方式。
- 值级白名单：可放行单个具体值，大小写不敏感，最多 200 条。
- 脱敏取证：可在日志页查看最近 50 条「实际发出去的内容」，仅内存、不落盘。
- 高熵凭据检测（默认关闭）：覆盖没有厂商前缀、也没有赋值标签的内部服务令牌。
Fixed
- Credential detection now covers real .env key names (DB_PASSWORD, MYSQL_ROOT_PASSWORD, OPENAI_API_KEY, db.password), which were previously missed entirely.
- Tool definitions are no longer rewritten: tool names, namespaces, parameter schemas and grammar constraints used to be masked, causing upstream rejections; only their descriptions are scanned now.
- Visually equivalent spellings no longer bypass masking: zero-width insertions and full-width digits/symbols (１３８…, alice＠example.com) were missed entirely; they are now detected, and what leaves the machine stays byte-identical to what the user typed.
- A value once confirmed sensitive is now masked wherever it appears, without needing a password=-style anchor.
- New pre-egress re-check: a request that still matches an original value after masking is rejected instead of being sent upstream.
- Chinese name completion and rejection: "role word + name" phrases (customer, contact, author …) are no longer missed, and ordinary words that merely start with a surname are no longer treated as names.
- Restore status is now split: no_placeholder_in_response becomes "the model never mentioned it", "the model rewrote the placeholder", or "the response did not finish".
- "Warn only" and "block" now apply to every rule (previously only some), and what was let through is shown in the log.
Added
- Each rule can be set to mask, warn only, or block.
- Per-value allowlist: release a single concrete value (case-insensitive, up to 200 entries).
- Masking forensics: the log page can show the last 50 bodies actually sent upstream (memory only, never written to disk).
- High-entropy credential detection (off by default) for internal service tokens with neither a vendor prefix nor an assignment label.

扩展更新提示 / Extension update notice
✅ 本次发版扩展无改动：已安装的扩展无需重新加载。
✅ The browser extension did not change: no need to reload it.
Full Changelog: https://github.com/xiaYuTian11/maskit/compare/v0.11.4...v0.12.0

更新摘要 / Summary
- 客户端名称现在支持空格，不再出现输入空格导致配置重置为默认客户端的问题。
- 敏感词库支持一键导出备份与导入，方便跨设备迁移与词条管理。
- 敏感词库增加大小写自动覆盖与中文整词匹配指引，词条匹配更清晰。
- Client names now support spaces without resetting your configured clients to defaults.
- Sensitive words can now be exported and imported for easier backups and multi-device setup.
- Word lists now include case-insensitive matching tips and clearer guidance for Chinese words.
修复
- 客户端名称支持空格：输入包含空格的客户端名称时不再被忽略，更不会因所有客户端失效而误把配置重置为默认客户端。
- 客户端修改校验：保存客户端时对名称与目标地址进行前置检查，非法输入即时提示，避免配置损坏。
新增
- 词库导入导出：设置页敏感词库新增一键导出备份，支持通过文件或粘贴导入，提供增量合并与完全覆盖两种模式。
- 词条变体提示：同分类下录入大小写变体时主动提醒已自动覆盖，并补充中文独立词正则用法说明。
Fixed
- Client names with spaces are now accepted and no longer trigger an accidental reset to default clients.
- Added preflight checks for client name and target URL to catch invalid input before saving.
Added
- Word list export and import: backup custom sensitive words as a JSON file, or import via file or paste with merge and overwrite options.
- Case-variant duplicate hints and clearer guidance on regex patterns for isolated Chinese words.

扩展更新提示 / Extension update notice
✅ 本次发版扩展无改动：已安装的扩展无需重新加载。
✅ The browser extension did not change: no need to reload it.
Full Changelog: https://github.com/xiaYuTian11/maskit/compare/v0.11.3...v0.11.4

更新摘要 / Summary
- 流式回复不会再中途断掉：模型最后那段回答以前可能整段丢失，客户端还会误报成网络异常。
- Windows 安装装得更干净：不再弹一段红色报错，桌面上也不会多出一个重复图标。
- 同一局域网的其它设备现在也能打开控制台，需要先在设置里手动开启。
- Streaming replies no longer break near the end — the model's final chunk used to vanish and clients reported a network error.
- The Windows installer is cleaner: no red error output, and no duplicate desktop icon.
- Other devices on your network can now open the console, after you turn it on in settings.
修复
- 流式回复不再整段丢失：响应里出现对象或数组形态的字段时还原会中断，客户端只收到后半截数据。
- Windows 安装与卸载不再弹 PowerShell 报错；那条终止旧进程的命令此前每次都语法失败，进程实际没被杀掉。
- 安装不再多出一个桌面快捷方式：改由安装程序按「创建桌面快捷方式」勾选与升级模式决定。
- 反馈模板里的诊断包入口改回真实路径。
新增
- 局域网访问开关：设置 → 高级选项，开启后同一局域网的其它设备可访问控制台与代理端口（重启引擎生效）。
Fixed
- Streaming replies are no longer truncated when a response field holds an object or array instead of a string.
- The Windows installer and uninstaller no longer throw a PowerShell syntax error; that command had never actually terminated the old processes.
- The installer no longer creates a duplicate desktop shortcut — creation follows the checkbox and the update mode.
- The diagnostics-bundle entry in the bug report template now points at the real path.
Added
- LAN access toggle under Settings → Advanced; other devices on the same network can reach the console and proxy ports (engine restart required).

扩展更新提示 / Extension update notice
✅ 本次发版扩展无改动：已安装的扩展无需重新加载。
✅ The browser extension did not change: no need to reload it.
Full Changelog: https://github.com/xiaYuTian11/maskit/compare/v0.11.2...v0.11.3

更新摘要 / Summary
- 更新弹窗和「关于」页现在直接告诉你这次改了什么，不再只有一句「修复 2 项」或一整段技术日志。
- Windows 桌面版不会再出现「点了启动却起不来」：端口探测多了一条兜底，不再单靠系统命令。
- 启动失败时不再只有一句「未就绪」：端口被占用、旧引擎残留、令牌没写出来会分开说明，日志也不会再因为进程被杀而整片丢失。
- The update card and About page now tell you what actually changed, instead of a bare count or a wall of technical text.
- Windows desktop no longer fails to start: port detection has a fallback when the system command reports nothing.
- A failed start now says why — port taken, stuck engine, or missing token — and engine logs survive a force-kill.
修复
- Windows 启动：端口探测不再只依赖系统命令，命令被拦截或超时返空时改用连接探测兜底。此前该命令一旦失灵，就绪判定永远认为端口未监听，点启动会等满 60 秒后报失败，常驻守护还会反复重启正常工作的代理。
- 引擎日志：壳层强杀引擎时，engine-stdout.log 的块缓冲来不及 flush，内存里的诊断行随进程一起消失（引擎存活期间该文件恒为空）。现由壳层注入 PYTHONUNBUFFERED，并把 [panel] / [engine] / [proxy] 诊断行落盘到数据目录 engine.log（2MB 轮转）；SHIELD 事件行携带原文预览，仍然只进内存。
- 引擎启动：守护线程的假死判定（6 轮 × 2s ≈ 12s）比就绪预算（20s）更早，会把正在初始化的引擎强杀重拉，慢机上表现为「永远起不来 / 反复重启」；现加与就绪预算同值的启动宽限。就绪超时也不再只报一句「未就绪」：区分端口被第三方进程 / 本产品残留引擎占用、系统查不到占用 PID、令牌未写出，并把启动失败现场补写进 crash-dumps。
优化
- 版本说明：更新弹窗与「关于」页只展示「更新摘要」，不再把整章 CHANGELOG（含 ### 标记与双语技术条目）原样渲染给用户；桌面端 latest.json 的 notes 也从「修复 N 项」改为摘要正文。
- 版本说明：新增 scripts/check-changelog.py 门禁（已进 scripts/verify-all.py 的 version 组与 ci.yml），强制每个版本章节开头有中英双语「更新摘要」，并拦截反引号、源码文件名、文件：行号、4xx/5xx 状态码与硬技术术语。历史版本（0.10.1 之前）不回溯。
Fixed
- Windows start: port detection no longer relies solely on the system command; when it is blocked or returns nothing, a connection probe takes over. A failing command previously made the readiness check see no listeners forever — start waited the full 60 s and reported failure, and the resident watchdog kept restarting a healthy proxy.
- Engine log: a force-killed engine never got to flush its block-buffered stdout, so engine-stdout.log stayed empty for the engine's whole lifetime and every diagnostic line died with the process. The shell now injects PYTHONUNBUFFERED and persists [panel] / [engine] / [proxy] lines to engine.log in the data directory (2 MB rotation); SHIELD event lines carry plaintext previews and stay in memory only.
- Engine start: the watchdog's hang detection (6 rounds × 2 s ≈ 12 s) fired before the 20 s readiness budget and killed engines that were still initialising, which on slow machines looked like "never starts / restarts forever"; a start grace period now matches the readiness budget. A readiness timeout also reports why (port held by a third-party process, a stuck engine of ours, an unidentifiable listener, or a token that was never written) and dumps the failure scene into crash-dumps.
Improvements
- Update notes: the update card and About page now render only the user-facing summary instead of the whole CHANGELOG section (raw ### markers and bilingual technical entries); the desktop latest.json notes carry the summary body instead of an "N fixed" count.
- Update notes: new scripts/check-changelog.py gate (added to scripts/verify-all.py's version group and ci.yml) requires a bilingual summary section at the top of every version section and rejects backticks, source filenames, file:line refs, 4xx/5xx status codes and hard jargon. Versions before 0.10.1 are exempt.

扩展更新提示 / Extension update notice
✅ 本次发版扩展无改动：已安装的扩展无需重新加载。
✅ The browser extension did not change: no need to reload it.
Full Changelog: https://github.com/xiaYuTian11/maskit/compare/v0.11.1...v0.11.2

修复
- 引擎：还原失败不再把「本机从未签发过」的占位符算进去（客户端历史携带的外部 token / 对话里的文档示例 / 模型自造），新增「外部占位符」独立计数，面板与详情页分开显示。
- 引擎：语义识别不再把代码标识符（JSON.parse、FSPAGE_9105 这类）判成人名/机构名掩码，模型看到的代码不再被改写（真机当日 NAME 命中里六成是变量名/方法名）。
Fixed
- Engine: restore failures no longer include placeholder-shaped strings this instance never issued (foreign tokens from client history / doc examples / model-invented); a separate "foreign tokens" counter is shown apart from restore failures on the dashboard and in the detail dialog.
- Engine: NER no longer masks code identifiers (JSON.parse, FSPAGE_9105, …) as person/organization names, so the code a model sees is no longer rewritten (six in ten of the day's NAME hits were variable or method names).

扩展更新提示 / Extension update notice
✅ 本次发版扩展无改动：已安装的扩展无需重新加载。
✅ The browser extension did not change: no need to reload it.
Full Changelog: https://github.com/xiaYuTian11/maskit/compare/v0.11.0...v0.11.1

新增
- 面板日志：新增「结论」列（成功 / 有告警 / 失败 / 已取消 / 进行中 / 未完成 / 未处理 / 安全告警），一眼能看出请求成败；事件类型降为小图标。
- 面板日志：取消与错误事件按会话折进对应的脱敏行，一次请求只占一行，不再只看到半条链路。
优化
- 面板日志：列表由 9 列收到 8 列（入口并入上游列）；状态列显示 HTTP 码或失败归因（客户端断开 / 上游静默 / 域名解析失败），不再显示截断的英文状态码。
- 面板日志：耗时列区分端到端与仅脱敏耗时；类型筛选改为「按结论」优先，底层原语收进高级分组；图例改为结论颜色说明。
- 面板日志：显式选择筛选条件时不再被「隐藏噪声」吞掉（此前选「用户取消」只会得到空列表）。
Added
- Panel logs: new Outcome column (success / warnings / failed / canceled / in progress / incomplete / not processed / security alert) so request success is visible at a glance; the event type is now a small icon.
- Panel logs: cancel and error events are folded into their masking row per session, so one request is one row instead of half a chain.
Improvements
- Panel logs: 9 columns reduced to 8 (ingress merged into the upstream column); the status column now shows the HTTP code or the failure attribution (client disconnected / upstream silent / DNS failure) instead of a truncated English status.
- Panel logs: the duration column distinguishes end-to-end from masking-only time; the type filter is now outcome-first with raw primitives tucked into an advanced group; the legend explains outcome colours.
- Panel logs: an explicit filter selection is no longer swallowed by "hide noise" (previously picking "user canceled" returned an empty list).
修复
- 前端：复制回退失败时不再谎报「已复制」，设置页会正确提示复制失败。
- 前端：更新提示的版本号不再重复 v 前缀（Web / Docker 端 GitHub tag 自带 v，与模板叠加后实测显示成 vv0.11.0）。
- 引擎：还原详情区分「模型回显但未还原」与「模型未回显」，不再把后者渲染成「未还原」告警；未还原计数不再被日期串等正常文本误触发；签名/密文思考块的契约豁免在还原侧也计数可见。
Fixed
- Frontend: a failed clipboard fallback no longer reports "copied"; the settings page now shows a copy-failed toast.
- Frontend: the update prompt no longer doubles the v prefix on the version (on Web/Docker the GitHub tag already carries v, which stacked with the template and rendered vv0.11.0).
- Engine: restore details now distinguish "echoed but not restored" from "not echoed"; unresolved counting no longer fires on ordinary text such as date strings; restore-side contract skips of signed/encrypted thinking blocks are counted and visible.

扩展更新提示 / Extension update notice
✅ 本次发版扩展无改动：已安装的扩展无需重新加载。
✅ The browser extension did not change: no need to reload it.
Full Changelog: https://github.com/xiaYuTian11/maskit/compare/v0.10.1...v0.11.0

修复
- 引擎：上游发完 [DONE] 后未按规范收尾响应体时，流式请求不再丢失还原记录，正常结束也不会被误记为「客户端取消」。
- 引擎：上游 target 变更后，接管连接池按新目标白名单自动换代，不再对配置内的合法目标返回 403。
Fixed
- Engine: when an upstream omits the closing chunk after [DONE], streaming requests no longer lose their restore record or get misreported as a client cancel.
- Engine: after an upstream target change, the takeover pool now rebuilds against the new target allowlist instead of rejecting configured targets with 403.

扩展更新提示 / Extension update notice
✅ 本次发版扩展无改动：已安装的扩展无需重新加载。
✅ The browser extension did not change: no need to reload it.
Full Changelog: https://github.com/xiaYuTian11/maskit/compare/v0.10.0...v0.10.1

新增
- 统计：支持各大模型 Token 缓存采集与日摘要聚合，费用估算按厂商口径支持缓存折扣。
Added
- Stats: support token cache extraction and daily aggregation, with vendor-specific discount support in cost estimation.
优化
- 引擎：接管连接池空闲保留由 30 秒提到 120 秒，建连超时放宽至 20 秒并细化 502/504 错误归因，减少冷握手超时与假报错。
- 脱敏：默认凭据前缀安全扩充常见供应商识别（仅对未自行配置过的用户生效，已自定义保存过的请手动添加）。
Improvements
- Engine: takeover pool keepalive budget extended to 120s, connect timeout relaxed to 20s with refined 502/504 attribution to reduce false connect failures.
- Masking: expanded default credential prefixes for common providers (applies only when not customized; manual addition needed for existing custom configs).

扩展更新提示 / Extension update notice
✅ 本次发版扩展无改动：已安装的扩展无需重新加载。
✅ The browser extension did not change: no need to reload it.
Full Changelog: https://github.com/xiaYuTian11/maskit/compare/v0.9.0...v0.10.0