chore: refresh SUGGESTED_MODELS for all providers

Updates the SUGGESTED_MODELS quick-add list in lib/types/model-config.ts against each provider's official model docs as of 2026-06-09. - openai: GPT-5.5 / 5.4 frontier; drop deprecated 5.0-5.2 family - anthropic: add Opus 4.8/4.7/4.6, Sonnet 4.6, Haiku 4.5 (new dateless pinned IDs); fix wrong date suffixes on Opus/Sonnet 4.5 - google / vertexai: adopt Gemini 3 family; drop Gemini 2.0 (shut down) and 1.5 - azure: GPT-5.x line + o3 / o4-mini; drop gpt-4-turbo / gpt-35-turbo - bedrock: Opus 4.8/4.7/4.6, Sonnet 4.6, Haiku 4.5, Nova Premier / Nova 2 Lite, Llama 4 Maverick / Scout, Mistral Large 3, Pixtral - openrouter: refreshed against live /api/v1/models - deepseek: V4 Pro / Flash - siliconflow / modelscope: DeepSeek V4, Qwen 3.x, drop bogus qwen3.5-plus - gateway: verified against live Vercel AI Gateway endpoint - doubao: Seed 2.0 / 1.8 / 1.6 in official dash-form IDs - minimax: + M2.5 - novita: M3, GLM-5.1, Kimi-K2.6, DeepSeek V4
fix: block private IPv6 URLs (#858 )
2026-09-02 01:20:23 +08:00 · 2026-06-09 21:08:02 +09:00 · 2026-06-06 00:30:20 +09:00 · 2026-06-06 00:15:45 +09:00 · 2026-06-02 19:38:49 +09:00 · 2026-06-02 19:26:27 +09:00
32 changed files with 2146 additions and 1441 deletions
--- a/app/[lang]/page.tsx
+++ b/app/[lang]/page.tsx
@@ -10,8 +10,8 @@ import {
    ResizablePanelGroup,
 } from "@/components/ui/resizable"
 import { useDiagram } from "@/contexts/diagram-context"
+import { type DrawioTheme, isDrawioTheme } from "@/lib/drawio-themes"
 import { i18n, type Locale } from "@/lib/i18n/config"
-import { isIndexedDBUsable } from "@/lib/session-storage"

 export default function Home() {
    const {
@@ -27,13 +27,11 @@ export default function Home() {
    const currentLang = (pathname.split("/")[1] || i18n.defaultLocale) as Locale
    const [isMobile, setIsMobile] = useState(false)
    const [isChatVisible, setIsChatVisible] = useState(true)
-    const [drawioUi, setDrawioUi] = useState<"min" | "sketch">("min")
+    const [drawioUi, setDrawioUi] = useState<DrawioTheme>("kennedy")
    const [darkMode, setDarkMode] = useState(false)
    const [isLoaded, setIsLoaded] = useState(false)
    const [isDrawioReady, setIsDrawioReady] = useState(false)
    const [isElectron, setIsElectron] = useState(false)
-    const [canPersist, setCanPersist] = useState(false)
-    const [canPersistChecked, setCanPersistChecked] = useState(false)
    const [drawioBaseUrl, setDrawioBaseUrl] = useState(
        process.env.NEXT_PUBLIC_DRAWIO_BASE_URL || "https://embed.diagrams.net",
    )
@@ -56,7 +54,7 @@ export default function Home() {
        }

        const savedUi = localStorage.getItem("drawio-theme")
-        if (savedUi === "min" || savedUi === "sketch") {
+        if (isDrawioTheme(savedUi)) {
            setDrawioUi(savedUi)
        }

@@ -84,11 +82,6 @@ export default function Home() {
            setDrawioBaseUrl(`${window.location.origin}/drawio/index.html`)
        }

-        void (async () => {
-            const usable = await isIndexedDBUsable()
-            setCanPersist(usable)
-            setCanPersistChecked(true)
-        })()
        setIsLoaded(true)
    }, [pathname, router])

@@ -97,13 +90,6 @@ export default function Home() {
        onDrawioLoad()
    }, [onDrawioLoad])

-    const handleDrawioAutoSave = useCallback(
-        (data: { xml?: string }) => {
-            handleDiagramAutoSave(data)
-        },
-        [handleDiagramAutoSave],
-    )
-
    const handleDarkModeChange = () => {
        const newValue = !darkMode
        setDarkMode(newValue)
@@ -113,10 +99,9 @@ export default function Home() {
        resetDrawioReady()
    }

-    const handleDrawioUiChange = () => {
-        const newUi = drawioUi === "min" ? "sketch" : "min"
-        localStorage.setItem("drawio-theme", newUi)
-        setDrawioUi(newUi)
+    const handleDrawioUiChange = (theme: DrawioTheme) => {
+        localStorage.setItem("drawio-theme", theme)
+        setDrawioUi(theme)
        setIsDrawioReady(false)
        resetDrawioReady()
    }
@@ -187,7 +172,7 @@ export default function Home() {
                        }`}
                    >
                        <div className="h-full rounded-xl overflow-hidden shadow-soft-lg border border-border/30 relative">
-                            {isLoaded && canPersistChecked && (
+                            {isLoaded && (
                                <div
                                    className={`h-full w-full ${isDrawioReady ? "" : "invisible absolute inset-0"}`}
                                >
@@ -195,28 +180,19 @@ export default function Home() {
                                        key={`${drawioUi}-${darkMode}-${currentLang}-${isElectron}`}
                                        ref={drawioRef}
                                        autosave
-                                        onAutoSave={handleDrawioAutoSave}
+                                        onAutoSave={handleDiagramAutoSave}
                                        onExport={handleDiagramExport}
                                        onLoad={handleDrawioLoad}
                                        baseUrl={drawioBaseUrl}
-                                        configuration={
-                                            canPersist
-                                                ? { confirmExit: false }
-                                                : undefined
-                                        }
                                        urlParameters={{
                                            ui: drawioUi,
                                            spin: false,
                                            libraries: false,
-                                            // Disable modified tracking only when persistence is available
-                                            ...(canPersist && {
-                                                modified: false,
-                                                keepmodified: false,
-                                            }),
                                            saveAndExit: false,
                                            noSaveBtn: true,
                                            noExitBtn: true,
-                                            dark: darkMode,
+                                            dark:
+                                                darkMode || drawioUi === "dark",
                                            lang: currentLang,
                                            // Enable offline mode in Electron to disable external service calls
                                            ...(isElectron && {
@@ -264,7 +240,7 @@ export default function Home() {
                                isVisible={isChatVisible}
                                onToggleVisibility={toggleChatPanel}
                                drawioUi={drawioUi}
-                                onToggleDrawioUi={handleDrawioUiChange}
+                                onDrawioUiChange={handleDrawioUiChange}
                                darkMode={darkMode}
                                onToggleDarkMode={handleDarkModeChange}
                                isMobile={isMobile}
--- a/app/api/parse-url/route.ts
+++ b/app/api/parse-url/route.ts
@@ -1,7 +1,7 @@
 import { extract } from "@extractus/article-extractor"
 import { NextResponse } from "next/server"
 import TurndownService from "turndown"
-import { allowPrivateUrls, isPrivateUrl } from "@/lib/ssrf-protection"
+import { isPrivateUrl } from "@/lib/ssrf-protection"

 const MAX_CONTENT_LENGTH = 150000 // Match PDF limit
 const EXTRACT_TIMEOUT_MS = 15000
@@ -28,8 +28,10 @@ export async function POST(req: Request) {
            )
        }

-        // SSRF protection
-        if (!allowPrivateUrls && isPrivateUrl(url)) {
+        // SSRF protection: parse-url has no use case for fetching internal
+        // hosts, so private URLs are always rejected. ALLOW_PRIVATE_URLS only
+        // governs LLM provider baseUrl overrides (validate-model, chat).
+        if (isPrivateUrl(url)) {
            return NextResponse.json(
                { error: "Cannot access private/internal URLs" },
                { status: 400 },
--- a/biome.json
+++ b/biome.json
@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.4.4/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.4.14/schema.json",
    "vcs": {
        "enabled": true,
        "clientKind": "git",
--- a/components/chat-panel.tsx
+++ b/components/chat-panel.tsx
@@ -32,6 +32,7 @@ import { useSessionManager } from "@/hooks/use-session-manager"
 import { useValidateDiagram } from "@/hooks/use-validate-diagram"
 import { getApiEndpoint } from "@/lib/base-path"
 import { findCachedResponse } from "@/lib/cached-responses"
+import type { DrawioTheme } from "@/lib/drawio-themes"
 import { formatMessage } from "@/lib/i18n/utils"
 import { isPdfFile, isTextFile } from "@/lib/pdf-utils"
 import { sanitizeMessages } from "@/lib/session-storage"
@@ -68,8 +69,8 @@ interface ChatMessage {
 interface ChatPanelProps {
    isVisible: boolean
    onToggleVisibility: () => void
-    drawioUi: "min" | "sketch"
-    onToggleDrawioUi: () => void
+    drawioUi: DrawioTheme
+    onDrawioUiChange: (theme: DrawioTheme) => void
    darkMode: boolean
    onToggleDarkMode: () => void
    isMobile?: boolean
@@ -110,7 +111,7 @@ export default function ChatPanel({
    isVisible,
    onToggleVisibility,
    drawioUi,
-    onToggleDrawioUi,
+    onDrawioUiChange,
    darkMode,
    onToggleDarkMode,
    isMobile = false,
@@ -1442,7 +1443,7 @@ export default function ChatPanel({
                open={showSettingsDialog}
                onOpenChange={setShowSettingsDialog}
                drawioUi={drawioUi}
-                onToggleDrawioUi={onToggleDrawioUi}
+                onDrawioUiChange={onDrawioUiChange}
                darkMode={darkMode}
                onToggleDarkMode={onToggleDarkMode}
                minimalStyle={minimalStyle}
--- a/components/model-config-dialog.tsx
+++ b/components/model-config-dialog.tsx
@@ -405,7 +405,7 @@ export function ModelConfigDialog({
                            </span>
                        </div>

-                        <ScrollArea className="flex-1 px-2">
+                        <ScrollArea className="flex-1 px-2 min-h-0">
                            <div className="space-y-1 pb-2">
                                {config.providers.length === 0 ? (
                                    <div className="px-3 py-8 text-center">
--- a/components/settings-dialog.tsx
+++ b/components/settings-dialog.tsx
@@ -25,6 +25,7 @@ import { Switch } from "@/components/ui/switch"
 import { Textarea } from "@/components/ui/textarea"
 import { useDictionary } from "@/hooks/use-dictionary"
 import { getApiEndpoint } from "@/lib/base-path"
+import type { DrawioTheme } from "@/lib/drawio-themes"
 import { i18n, type Locale } from "@/lib/i18n/config"
 import { STORAGE_KEYS } from "@/lib/storage"

@@ -63,8 +64,8 @@ const LANGUAGE_LABELS: Record<Locale, string> = {
 interface SettingsDialogProps {
    open: boolean
    onOpenChange: (open: boolean) => void
-    drawioUi: "min" | "sketch"
-    onToggleDrawioUi: () => void
+    drawioUi: DrawioTheme
+    onDrawioUiChange: (theme: DrawioTheme) => void
    darkMode: boolean
    onToggleDarkMode: () => void
    minimalStyle?: boolean
@@ -90,7 +91,7 @@ function SettingsContent({
    open,
    onOpenChange,
    drawioUi,
-    onToggleDrawioUi,
+    onDrawioUiChange,
    darkMode,
    onToggleDarkMode,
    minimalStyle = false,
@@ -134,8 +135,11 @@ function SettingsContent({
    const [isApplyingProxy, setIsApplyingProxy] = useState(false)

    useEffect(() => {
-        // Only fetch if not cached in localStorage
-        if (getStoredAccessCodeRequired() !== null) return
+        // Re-fetch config whenever the dialog opens to ensure we always show
+        // the access code input if the server requires it. This fixes the case
+        // where a stale localStorage cache (from before ACCESS_CODE_LIST was
+        // configured) would hide the access code input.
+        if (!open) return

        fetch(getApiEndpoint("/api/config"))
            .then((res) => {
@@ -151,10 +155,9 @@ function SettingsContent({
                setAccessCodeRequired(required)
            })
            .catch(() => {
-                // Don't cache on error - allow retry on next mount
-                setAccessCodeRequired(false)
+                // Keep existing cached value on error
            })
-    }, [])
+    }, [open])

    // Detect current language from pathname
    useEffect(() => {
@@ -430,23 +433,40 @@ function SettingsContent({
                    {/* Draw.io Style */}
                    <SettingItem
                        label={dict.settings.drawioStyle}
-                        description={`${dict.settings.drawioStyleDescription} ${
-                            drawioUi === "min"
-                                ? dict.settings.minimal
-                                : dict.settings.sketch
-                        }`}
+                        description={dict.settings.drawioStyleDescription}
                    >
-                        <Button
-                            id="drawio-ui"
-                            variant="outline"
-                            onClick={onToggleDrawioUi}
-                            className="h-9 w-[120px] rounded-xl border-border-subtle hover:bg-interactive-hover font-normal"
+                        <Select
+                            value={drawioUi}
+                            onValueChange={(v) =>
+                                onDrawioUiChange(v as DrawioTheme)
+                            }
                        >
-                            {dict.settings.switchTo}{" "}
-                            {drawioUi === "min"
-                                ? dict.settings.sketch
-                                : dict.settings.minimal}
-                        </Button>
+                            <SelectTrigger
+                                id="drawio-ui-select"
+                                aria-label={dict.settings.drawioStyle}
+                                className="w-[120px] h-9 rounded-xl"
+                            >
+                                <SelectValue />
+                            </SelectTrigger>
+                            <SelectContent>
+                                <SelectItem value="kennedy">
+                                    {dict.settings.themeDefault}
+                                </SelectItem>
+                                <SelectItem value="atlas">Atlas</SelectItem>
+                                <SelectItem value="dark">
+                                    {dict.settings.themeDark}
+                                </SelectItem>
+                                <SelectItem value="min">
+                                    {dict.settings.themeMinimal}
+                                </SelectItem>
+                                <SelectItem value="sketch">
+                                    {dict.settings.themeSketch}
+                                </SelectItem>
+                                <SelectItem value="simple">
+                                    {dict.settings.themeSimple}
+                                </SelectItem>
+                            </SelectContent>
+                        </Select>
                    </SettingItem>

                    {/* Diagram Style */}
--- a/docs/cn/ai-providers.md
+++ b/docs/cn/ai-providers.md
@@ -53,6 +53,13 @@ ANTHROPIC_API_KEY=your_api_key
 AI_MODEL=claude-sonnet-4-5-20250514
 ```

+或者使用 Bearer 认证令牌（例如通过会下发 OAuth 风格 token 的网关时）。`ANTHROPIC_AUTH_TOKEN` 会作为 `Authorization: Bearer <token>` 头发送，而 `ANTHROPIC_API_KEY` 会作为 `x-api-key` 头发送。两者互斥，只能设置其中之一：
+
+```bash
+ANTHROPIC_AUTH_TOKEN=your_auth_token
+AI_MODEL=claude-sonnet-4-5-20250514
+```
+
 可选的自定义端点：

 ```bash
@@ -215,7 +222,7 @@ MiniMax 支持两种 API 格式：

 ```bash
 MINIMAX_API_KEY=your_api_key
-AI_MODEL=MiniMax-M2.7
+AI_MODEL=MiniMax-M3
 ```

 可选配置：
--- a/docs/en/ai-providers.md
+++ b/docs/en/ai-providers.md
@@ -68,6 +68,13 @@ ANTHROPIC_API_KEY=your_api_key
 AI_MODEL=claude-sonnet-4-5-20250514
 ```

+Or use a Bearer auth token instead of an API key (e.g. when going through a gateway that issues OAuth-style tokens). `ANTHROPIC_AUTH_TOKEN` is sent as `Authorization: Bearer <token>`, while `ANTHROPIC_API_KEY` is sent as `x-api-key`. The two are mutually exclusive — set only one:
+
+```bash
+ANTHROPIC_AUTH_TOKEN=your_auth_token
+AI_MODEL=claude-sonnet-4-5-20250514
+```
+
 Optional custom endpoint:

 ```bash
@@ -230,7 +237,7 @@ MiniMax supports two API formats:

 ```bash
 MINIMAX_API_KEY=your_api_key
-AI_MODEL=MiniMax-M2.7
+AI_MODEL=MiniMax-M3
 ```

 Optional configuration:
--- a/docs/ja/ai-providers.md
+++ b/docs/ja/ai-providers.md
@@ -53,6 +53,13 @@ ANTHROPIC_API_KEY=your_api_key
 AI_MODEL=claude-sonnet-4-5-20250514
 ```

+または、Bearer 認証トークンを使用することもできます（OAuth スタイルのトークンを発行するゲートウェイ経由で利用する場合など）。`ANTHROPIC_AUTH_TOKEN` は `Authorization: Bearer <token>` ヘッダーで送信され、`ANTHROPIC_API_KEY` は `x-api-key` ヘッダーで送信されます。両者は排他的なので、いずれか一方のみを設定してください:
+
+```bash
+ANTHROPIC_AUTH_TOKEN=your_auth_token
+AI_MODEL=claude-sonnet-4-5-20250514
+```
+
 任意のカスタムエンドポイント:

 ```bash
@@ -215,7 +222,7 @@ MiniMax は 2 つの API 形式をサポートしています：

 ```bash
 MINIMAX_API_KEY=your_api_key
-AI_MODEL=MiniMax-M2.7
+AI_MODEL=MiniMax-M3
 ```

 オプション設定：
--- a/electron/electron-builder.yml
+++ b/electron/electron-builder.yml
@@ -95,6 +95,10 @@ linux:
      arch:
        - x64
        - arm64
+    - target: rpm
+      arch:
+        - x64
+        - arm64

 # Publish configuration (optional)
 publish:
--- a/electron/electron.d.ts
+++ b/electron/electron.d.ts
@@ -101,8 +101,8 @@ declare global {
 }

 export type {
-    ConfigPreset,
    ApplyPresetResult,
+    ConfigPreset,
    ProxyConfig,
    SetProxyResult,
    SetUserLocaleResult,
--- a/electron/main/window-manager.ts
+++ b/electron/main/window-manager.ts
@@ -60,6 +60,13 @@ export function createWindow(serverUrl: string): BrowserWindow {
        mainWindow.webContents.openDevTools()
    }

+    // Override the draw.io iframe's beforeunload handler so the window can
+    // close after the user edits text in a shape (fixes #815). Diagrams are
+    // already persisted via autosave, so the prompt is unnecessary.
+    mainWindow.webContents.on("will-prevent-unload", (event) => {
+        event.preventDefault()
+    })
+
    mainWindow.on("closed", () => {
        mainWindow = null
    })
--- a/env.example
+++ b/env.example
@@ -25,7 +25,8 @@ AI_MODEL=global.anthropic.claude-sonnet-4-5-20250929-v1:0
 # OPENAI_REASONING_SUMMARY=detailed  # Optional: Override reasoning summary (none/brief/detailed)

 # Anthropic (Direct) Configuration
-# ANTHROPIC_API_KEY=sk-ant-...
+# ANTHROPIC_API_KEY=sk-ant-...                 # Sent as `x-api-key` header
+# ANTHROPIC_AUTH_TOKEN=                        # Alternative to ANTHROPIC_API_KEY; sent as `Authorization: Bearer` header (mutually exclusive)
 # ANTHROPIC_BASE_URL=https://your-custom-anthropic/v1
 # ANTHROPIC_THINKING_TYPE=enabled            # Optional: Anthropic extended thinking (enabled)
 # ANTHROPIC_THINKING_BUDGET_TOKENS=12000     # Optional: Budget for extended thinking in tokens
--- a/lib/ai-providers.ts
+++ b/lib/ai-providers.ts
@@ -573,7 +573,15 @@ function detectProvider(): ProviderName | null {
            // Skip ollama - it doesn't require credentials
            continue
        }
-        if (process.env[envVar]) {
+        // Anthropic accepts ANTHROPIC_AUTH_TOKEN (Bearer auth) as alternative to ANTHROPIC_API_KEY
+        const hasCredential =
+            provider === "anthropic"
+                ? !!(
+                      process.env.ANTHROPIC_API_KEY ||
+                      process.env.ANTHROPIC_AUTH_TOKEN
+                  )
+                : !!process.env[envVar]
+        if (hasCredential) {
            // Azure requires additional config (baseURL or resourceName)
            if (provider === "azure") {
                const hasBaseUrl = !!process.env.AZURE_BASE_URL
@@ -615,13 +623,26 @@ function validateProviderCredentials(
        return
    }

-    // Use custom env var name if provided, otherwise use default
-    const requiredVar = customApiKeyEnv || PROVIDER_ENV_VARS[provider]
-    if (requiredVar && !process.env[requiredVar]) {
-        throw new Error(
-            `${requiredVar} environment variable is required for ${provider} provider. ` +
-                `Please set it in your .env.local file.`,
+    // Anthropic accepts ANTHROPIC_AUTH_TOKEN (Bearer auth) as alternative to ANTHROPIC_API_KEY
+    if (provider === "anthropic" && !customApiKeyEnv) {
+        const hasCredential = !!(
+            process.env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_AUTH_TOKEN
        )
+        if (!hasCredential) {
+            throw new Error(
+                `Either ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN environment variable is required for anthropic provider. ` +
+                    `Please set one in your .env.local file.`,
+            )
+        }
+    } else {
+        // Use custom env var name if provided, otherwise use default
+        const requiredVar = customApiKeyEnv || PROVIDER_ENV_VARS[provider]
+        if (requiredVar && !process.env[requiredVar]) {
+            throw new Error(
+                `${requiredVar} environment variable is required for ${provider} provider. ` +
+                    `Please set it in your .env.local file.`,
+            )
+        }
    }

    // Azure requires either AZURE_BASE_URL or AZURE_RESOURCE_NAME in addition to API key
@@ -845,8 +866,16 @@ export function getAIModel(overrides?: ClientOverrides): ModelConfig {
                serverBaseUrl,
                "https://api.anthropic.com/v1",
            )
+            // Anthropic supports two auth methods (mutually exclusive):
+            // - apiKey: sends as `x-api-key` header
+            // - authToken: sends as `Authorization: Bearer <token>` header
+            // Prefer apiKey if present (including client overrides); fall back
+            // to ANTHROPIC_AUTH_TOKEN env var only when no apiKey is available.
+            const authToken = !apiKey
+                ? process.env.ANTHROPIC_AUTH_TOKEN
+                : undefined
            const customProvider = createAnthropic({
-                apiKey,
+                ...(authToken ? { authToken } : { apiKey }),
                baseURL,
                headers: ANTHROPIC_BETA_HEADERS,
            })
@@ -1262,7 +1291,6 @@ export function getAIModel(overrides?: ClientOverrides): ModelConfig {
        case "glm":
        case "qwen":
        case "qiniu":
-        case "kimi":
        case "novita": {
            const envVar = PROVIDER_ENV_VARS[provider]
            if (!envVar) {
@@ -1288,6 +1316,23 @@ export function getAIModel(overrides?: ClientOverrides): ModelConfig {
            break
        }

+        case "kimi": {
+            const apiKey = resolveApiKey(overrides, "KIMI_API_KEY")
+            const baseURL = resolveBaseURL(
+                overrides?.apiKey,
+                overrides?.baseUrl,
+                resolveBaseUrlEnv(overrides, "KIMI_BASE_URL"),
+                PROVIDER_INFO["kimi"]?.defaultBaseUrl,
+            )
+            // Use createDeepSeek to properly handle reasoning_content for Kimi
+            // thinking models (e.g., kimi-k2.6). Kimi's API uses the same
+            // reasoning_content field as DeepSeek, so this provider correctly
+            // captures and replays reasoning in multi-turn conversations.
+            const customProvider = createDeepSeek({ apiKey, baseURL })
+            model = customProvider(modelId)
+            break
+        }
+
        default:
            throw new Error(
                `Unknown AI provider: ${provider}. Supported providers: bedrock, openai, anthropic, google, azure, ollama, openrouter, deepseek, siliconflow, sglang, gateway, edgeone, doubao, modelscope, glm, qwen, qiniu, kimi, minimax, novita`,
@@ -1345,8 +1390,12 @@ export function supportsImageInput(modelId: string): boolean {
        return false
    }

-    // MiniMax text models (MiniMax-M2.x series are text-only)
-    if (lowerModelId.includes("minimax") && !hasVisionIndicator) {
+    // MiniMax text models (MiniMax-M2.x series are text-only; M3 supports image input)
+    if (
+        lowerModelId.includes("minimax") &&
+        !hasVisionIndicator &&
+        !lowerModelId.includes("m3")
+    ) {
        return false
    }

@@ -1357,10 +1406,12 @@ export function supportsImageInput(modelId: string): boolean {

    // Qwen text models (not vision variants like qwen-vl)
    // Qwen3.5 series (qwen3.5, qwen3.5-plus, qwen3.5-flash) natively support image input
+    // QvQ (Qwen Visual QA) models are vision models — exclude them even when prefixed with "qwen/"
    if (
        lowerModelId.includes("qwen") &&
        !hasVisionIndicator &&
-        !lowerModelId.includes("qwen3.5")
+        !lowerModelId.includes("qwen3.5") &&
+        !lowerModelId.includes("qvq")
    ) {
        return false
    }
--- a/lib/drawio-themes.ts
+++ b/lib/drawio-themes.ts
@@ -0,0 +1,17 @@
+export const DRAWIO_THEMES = [
+    "kennedy",
+    "atlas",
+    "dark",
+    "min",
+    "sketch",
+    "simple",
+] as const
+
+export type DrawioTheme = (typeof DRAWIO_THEMES)[number]
+
+export function isDrawioTheme(value: unknown): value is DrawioTheme {
+    return (
+        typeof value === "string" &&
+        (DRAWIO_THEMES as readonly string[]).includes(value)
+    )
+}
--- a/lib/i18n/dictionaries/en.json
+++ b/lib/i18n/dictionaries/en.json
@@ -102,10 +102,12 @@
        "theme": "Theme",
        "themeDescription": "Dark/Light mode for interface and DrawIO canvas.",
        "drawioStyle": "DrawIO Style",
-        "drawioStyleDescription": "Canvas style:",
-        "switchTo": "Switch to",
-        "minimal": "Minimal",
-        "sketch": "Sketch",
+        "drawioStyleDescription": "Canvas style",
+        "themeDefault": "Default",
+        "themeDark": "Dark",
+        "themeMinimal": "Minimal",
+        "themeSketch": "Sketch",
+        "themeSimple": "Simple",
        "diagramStyle": "Diagram Style",
        "diagramStyleDescription": "Toggle between minimal and styled diagram output.",
        "sendShortcut": "Send Shortcut",
--- a/lib/i18n/dictionaries/ja.json
+++ b/lib/i18n/dictionaries/ja.json
@@ -102,10 +102,12 @@
        "theme": "テーマ",
        "themeDescription": "インターフェースと DrawIO キャンバスのダーク/ライトモード。",
        "drawioStyle": "DrawIO スタイル",
-        "drawioStyleDescription": "キャンバススタイル：",
-        "switchTo": "切り替え",
-        "minimal": "ミニマル",
-        "sketch": "スケッチ",
+        "drawioStyleDescription": "キャンバススタイル",
+        "themeDefault": "デフォルト",
+        "themeDark": "ダーク",
+        "themeMinimal": "ミニマル",
+        "themeSketch": "スケッチ",
+        "themeSimple": "シンプル",
        "diagramStyle": "ダイアグラムスタイル",
        "diagramStyleDescription": "ミニマルとスタイル付きの出力を切り替えます。",
        "sendShortcut": "送信ショートカット",
--- a/lib/i18n/dictionaries/zh-Hant.json
+++ b/lib/i18n/dictionaries/zh-Hant.json
@@ -102,10 +102,12 @@
        "theme": "主題",
        "themeDescription": "介面和 DrawIO 畫布的深色/淺色模式。",
        "drawioStyle": "DrawIO 樣式",
-        "drawioStyleDescription": "畫布樣式：",
-        "switchTo": "切換到",
-        "minimal": "簡約",
-        "sketch": "草圖",
+        "drawioStyleDescription": "畫布樣式",
+        "themeDefault": "預設",
+        "themeDark": "深色",
+        "themeMinimal": "簡約",
+        "themeSketch": "草圖",
+        "themeSimple": "簡單",
        "diagramStyle": "圖表樣式",
        "diagramStyleDescription": "切換簡約與精緻圖表輸出模式。",
        "sendShortcut": "傳送快捷鍵",
--- a/lib/i18n/dictionaries/zh.json
+++ b/lib/i18n/dictionaries/zh.json
@@ -102,10 +102,12 @@
        "theme": "主题",
        "themeDescription": "界面和 DrawIO 画布的深色/浅色模式。",
        "drawioStyle": "DrawIO 样式",
-        "drawioStyleDescription": "画布样式：",
-        "switchTo": "切换到",
-        "minimal": "简约",
-        "sketch": "草图",
+        "drawioStyleDescription": "画布样式",
+        "themeDefault": "默认",
+        "themeDark": "深色",
+        "themeMinimal": "简约",
+        "themeSketch": "草图",
+        "themeSimple": "简单",
        "diagramStyle": "图表样式",
        "diagramStyleDescription": "切换简约与精致图表输出模式。",
        "sendShortcut": "发送快捷键",
--- a/lib/session-storage.ts
+++ b/lib/session-storage.ts
@@ -58,33 +58,6 @@ interface ChatSessionDB extends DBSchema {

 // Database singleton
 let dbPromise: Promise<IDBPDatabase<ChatSessionDB>> | null = null
-const resetDBPromise = () => {
-    dbPromise = null
-}
-
-const isClosingError = (error: unknown): boolean => {
-    return (
-        error instanceof DOMException &&
-        error.name === "InvalidStateError" &&
-        /closing/i.test(error.message)
-    )
-}
-
-const withDB = async <T>(
-    action: (db: IDBPDatabase<ChatSessionDB>) => Promise<T>,
-): Promise<T> => {
-    try {
-        const db = await getDB()
-        return await action(db)
-    } catch (error) {
-        if (isClosingError(error)) {
-            resetDBPromise()
-            const db = await getDB()
-            return await action(db)
-        }
-        throw error
-    }
-}

 async function getDB(): Promise<IDBPDatabase<ChatSessionDB>> {
    if (!dbPromise) {
@@ -115,23 +88,7 @@ async function getDB(): Promise<IDBPDatabase<ChatSessionDB>> {
                    }
                }
            },
-            terminated() {
-                resetDBPromise()
-            },
        })
-        dbPromise
-            .then((db) => {
-                db.onversionchange = () => {
-                    db.close()
-                    resetDBPromise()
-                }
-                db.onclose = () => {
-                    resetDBPromise()
-                }
-            })
-            .catch(() => {
-                resetDBPromise()
-            })
    }
    return dbPromise
 }
@@ -146,46 +103,31 @@ export function isIndexedDBAvailable(): boolean {
    }
 }

-// Check if IndexedDB is actually usable (not just present).
-// Note: Do NOT close the db here - getDB() returns a shared singleton connection
-// that other code depends on.
-export async function isIndexedDBUsable(): Promise<boolean> {
-    if (!isIndexedDBAvailable()) return false
-    try {
-        await getDB()
-        return true
-    } catch {
-        return false
-    }
-}
-
 // CRUD Operations
 export async function getAllSessionMetadata(): Promise<SessionMetadata[]> {
    if (!isIndexedDBAvailable()) return []
    try {
-        return await withDB(async (db) => {
-            const tx = db.transaction(STORE_NAME, "readonly")
-            const index = tx.store.index("by-updated")
-            const metadata: SessionMetadata[] = []
+        const db = await getDB()
+        const tx = db.transaction(STORE_NAME, "readonly")
+        const index = tx.store.index("by-updated")
+        const metadata: SessionMetadata[] = []

-            // Use cursor to read only metadata fields (avoids loading full messages/XML)
-            let cursor = await index.openCursor(null, "prev") // newest first
-            while (cursor) {
-                const s = cursor.value
-                metadata.push({
-                    id: s.id,
-                    title: s.title,
-                    createdAt: s.createdAt,
-                    updatedAt: s.updatedAt,
-                    messageCount: s.messages.length,
-                    hasDiagram:
-                        !!s.diagramXml && s.diagramXml.trim().length > 0,
-                    thumbnailDataUrl: s.thumbnailDataUrl,
-                })
-                cursor = await cursor.continue()
-            }
-            return metadata
-        })
+        // Use cursor to read only metadata fields (avoids loading full messages/XML)
+        let cursor = await index.openCursor(null, "prev") // newest first
+        while (cursor) {
+            const s = cursor.value
+            metadata.push({
+                id: s.id,
+                title: s.title,
+                createdAt: s.createdAt,
+                updatedAt: s.updatedAt,
+                messageCount: s.messages.length,
+                hasDiagram: !!s.diagramXml && s.diagramXml.trim().length > 0,
+                thumbnailDataUrl: s.thumbnailDataUrl,
+            })
+            cursor = await cursor.continue()
+        }
+        return metadata
    } catch (error) {
        console.error("Failed to get session metadata:", error)
        return []
@@ -195,9 +137,8 @@ export async function getAllSessionMetadata(): Promise<SessionMetadata[]> {
 export async function getSession(id: string): Promise<ChatSession | null> {
    if (!isIndexedDBAvailable()) return null
    try {
-        return await withDB(async (db) => {
-            return (await db.get(STORE_NAME, id)) || null
-        })
+        const db = await getDB()
+        return (await db.get(STORE_NAME, id)) || null
    } catch (error) {
        console.error("Failed to get session:", error)
        return null
@@ -207,9 +148,8 @@ export async function getSession(id: string): Promise<ChatSession | null> {
 export async function saveSession(session: ChatSession): Promise<boolean> {
    if (!isIndexedDBAvailable()) return false
    try {
-        await withDB(async (db) => {
-            await db.put(STORE_NAME, session)
-        })
+        const db = await getDB()
+        await db.put(STORE_NAME, session)
        return true
    } catch (error) {
        // Handle quota exceeded
@@ -221,9 +161,8 @@ export async function saveSession(session: ChatSession): Promise<boolean> {
            await deleteOldestSession()
            // Retry once
            try {
-                await withDB(async (db) => {
-                    await db.put(STORE_NAME, session)
-                })
+                const db = await getDB()
+                await db.put(STORE_NAME, session)
                return true
            } catch (retryError) {
                console.error(
@@ -242,9 +181,8 @@ export async function saveSession(session: ChatSession): Promise<boolean> {
 export async function deleteSession(id: string): Promise<void> {
    if (!isIndexedDBAvailable()) return
    try {
-        await withDB(async (db) => {
-            await db.delete(STORE_NAME, id)
-        })
+        const db = await getDB()
+        await db.delete(STORE_NAME, id)
    } catch (error) {
        console.error("Failed to delete session:", error)
    }
@@ -253,9 +191,8 @@ export async function deleteSession(id: string): Promise<void> {
 export async function getSessionCount(): Promise<number> {
    if (!isIndexedDBAvailable()) return 0
    try {
-        return await withDB(async (db) => {
-            return await db.count(STORE_NAME)
-        })
+        const db = await getDB()
+        return await db.count(STORE_NAME)
    } catch (error) {
        console.error("Failed to get session count:", error)
        return 0
@@ -265,15 +202,14 @@ export async function getSessionCount(): Promise<number> {
 export async function deleteOldestSession(): Promise<void> {
    if (!isIndexedDBAvailable()) return
    try {
-        await withDB(async (db) => {
-            const tx = db.transaction(STORE_NAME, "readwrite")
-            const index = tx.store.index("by-updated")
-            const cursor = await index.openCursor()
-            if (cursor) {
-                await cursor.delete()
-            }
-            await tx.done
-        })
+        const db = await getDB()
+        const tx = db.transaction(STORE_NAME, "readwrite")
+        const index = tx.store.index("by-updated")
+        const cursor = await index.openCursor()
+        if (cursor) {
+            await cursor.delete()
+        }
+        await tx.done
    } catch (error) {
        console.error("Failed to delete oldest session:", error)
    }
--- a/lib/ssrf-protection.ts
+++ b/lib/ssrf-protection.ts
@@ -9,17 +9,40 @@
 export function isPrivateUrl(urlString: string): boolean {
    try {
        const url = new URL(urlString)
-        const hostname = url.hostname.toLowerCase()
+        // Strip a trailing dot so FQDN forms like "localhost." (which still
+        // resolve to 127.0.0.1) cannot bypass the equality checks below.
+        const hostname = url.hostname
+            .toLowerCase()
+            .replace(/^\[|\]$/g, "")
+            .replace(/\.$/, "")

        // Block localhost
        if (
            hostname === "localhost" ||
            hostname === "127.0.0.1" ||
-            hostname === "::1"
+            hostname === "::1" ||
+            hostname === "::"
        ) {
            return true
        }

+        // Block IPv6 unique-local (fc00::/7), link-local (fe80::/10),
+        // and IPv4-mapped (::ffff:0:0/96) hosts.
+        if (hostname.includes(":")) {
+            if (
+                hostname.startsWith("fc") ||
+                hostname.startsWith("fd") ||
+                hostname.startsWith("::ffff:")
+            ) {
+                return true
+            }
+            const linkLocal = hostname.match(/^fe([0-9a-f]{2}):/)
+            if (linkLocal) {
+                const high = parseInt(linkLocal[1], 16)
+                if (high >= 0x80 && high <= 0xbf) return true
+            }
+        }
+
        // Block AWS/cloud metadata endpoints
        if (
            hostname === "169.254.169.254" ||
--- a/lib/template-storage.ts
+++ b/lib/template-storage.ts
@@ -57,33 +57,6 @@ export function generateDefaultTitle(prompt: string): string {

 // Database singleton
 let dbPromise: Promise<IDBPDatabase<TemplateDB>> | null = null
-const resetDBPromise = () => {
-    dbPromise = null
-}
-
-const isClosingError = (error: unknown): boolean => {
-    return (
-        error instanceof DOMException &&
-        error.name === "InvalidStateError" &&
-        /closing/i.test(error.message)
-    )
-}
-
-const withDB = async <T>(
-    action: (db: IDBPDatabase<TemplateDB>) => Promise<T>,
-): Promise<T> => {
-    try {
-        const db = await getDB()
-        return await action(db)
-    } catch (error) {
-        if (isClosingError(error)) {
-            resetDBPromise()
-            const db = await getDB()
-            return await action(db)
-        }
-        throw error
-    }
-}

 async function getDB(): Promise<IDBPDatabase<TemplateDB>> {
    if (!dbPromise) {
@@ -101,23 +74,7 @@ async function getDB(): Promise<IDBPDatabase<TemplateDB>> {
                    }
                }
            },
-            terminated() {
-                resetDBPromise()
-            },
        })
-        dbPromise
-            .then((db) => {
-                db.onversionchange = () => {
-                    db.close()
-                    resetDBPromise()
-                }
-                db.onclose = () => {
-                    resetDBPromise()
-                }
-            })
-            .catch(() => {
-                resetDBPromise()
-            })
    }
    return dbPromise
 }
@@ -137,10 +94,9 @@ export function isIndexedDBAvailable(): boolean {
 export async function getAllTemplates(): Promise<Template[]> {
    if (!isIndexedDBAvailable()) return []
    try {
-        return await withDB(async (db) => {
-            const templates = await db.getAll(STORE_NAME)
-            return sortTemplates(templates)
-        })
+        const db = await getDB()
+        const templates = await db.getAll(STORE_NAME)
+        return sortTemplates(templates)
    } catch (error) {
        console.error("Failed to get templates:", error)
        return []
@@ -150,9 +106,8 @@ export async function getAllTemplates(): Promise<Template[]> {
 export async function getTemplate(id: string): Promise<Template | null> {
    if (!isIndexedDBAvailable()) return null
    try {
-        return await withDB(async (db) => {
-            return (await db.get(STORE_NAME, id)) || null
-        })
+        const db = await getDB()
+        return (await db.get(STORE_NAME, id)) || null
    } catch (error) {
        console.error("Failed to get template:", error)
        return null
@@ -182,9 +137,8 @@ export async function createTemplate(
    }

    try {
-        await withDB(async (db) => {
-            await db.put(STORE_NAME, template)
-        })
+        const db = await getDB()
+        await db.put(STORE_NAME, template)
        return template
    } catch (error) {
        console.error("Failed to create template:", error)
@@ -198,20 +152,19 @@ export async function updateTemplate(
 ): Promise<Template | null> {
    if (!isIndexedDBAvailable()) return null
    try {
-        return await withDB(async (db) => {
-            const existing = await db.get(STORE_NAME, id)
-            if (!existing) return null
+        const db = await getDB()
+        const existing = await db.get(STORE_NAME, id)
+        if (!existing) return null

-            const updated: Template = {
-                ...existing,
-                ...updates,
-                id: existing.id,
-                createdAt: existing.createdAt,
-                updatedAt: Date.now(),
-            }
-            await db.put(STORE_NAME, updated)
-            return updated
-        })
+        const updated: Template = {
+            ...existing,
+            ...updates,
+            id: existing.id,
+            createdAt: existing.createdAt,
+            updatedAt: Date.now(),
+        }
+        await db.put(STORE_NAME, updated)
+        return updated
    } catch (error) {
        console.error("Failed to update template:", error)
        return null
@@ -221,9 +174,8 @@ export async function updateTemplate(
 export async function deleteTemplate(id: string): Promise<boolean> {
    if (!isIndexedDBAvailable()) return false
    try {
-        await withDB(async (db) => {
-            await db.delete(STORE_NAME, id)
-        })
+        const db = await getDB()
+        await db.delete(STORE_NAME, id)
        return true
    } catch (error) {
        console.error("Failed to delete template:", error)
@@ -237,25 +189,24 @@ export async function duplicateTemplate(
 ): Promise<Template | null> {
    if (!isIndexedDBAvailable()) return null
    try {
-        return await withDB(async (db) => {
-            const existing = await db.get(STORE_NAME, id)
-            if (!existing) return null
+        const db = await getDB()
+        const existing = await db.get(STORE_NAME, id)
+        if (!existing) return null

-            const now = Date.now()
-            const duplicate: Template = {
-                ...existing,
-                id: nanoid(),
-                title: `${existing.title} ${copySuffix}`,
-                createdAt: now,
-                updatedAt: now,
-                clickCount: 0,
-                runCount: 0,
-                lastUsedAt: 0,
-                pinned: false,
-            }
-            await db.put(STORE_NAME, duplicate)
-            return duplicate
-        })
+        const now = Date.now()
+        const duplicate: Template = {
+            ...existing,
+            id: nanoid(),
+            title: `${existing.title} ${copySuffix}`,
+            createdAt: now,
+            updatedAt: now,
+            clickCount: 0,
+            runCount: 0,
+            lastUsedAt: 0,
+            pinned: false,
+        }
+        await db.put(STORE_NAME, duplicate)
+        return duplicate
    } catch (error) {
        console.error("Failed to duplicate template:", error)
        return null
@@ -267,13 +218,12 @@ export async function duplicateTemplate(
 export async function incrementClickCount(id: string): Promise<void> {
    if (!isIndexedDBAvailable()) return
    try {
-        await withDB(async (db) => {
-            const template = await db.get(STORE_NAME, id)
-            if (!template) return
-            template.clickCount += 1
-            template.updatedAt = Date.now()
-            await db.put(STORE_NAME, template)
-        })
+        const db = await getDB()
+        const template = await db.get(STORE_NAME, id)
+        if (!template) return
+        template.clickCount += 1
+        template.updatedAt = Date.now()
+        await db.put(STORE_NAME, template)
    } catch (error) {
        console.error("Failed to increment click count:", error)
    }
@@ -282,15 +232,14 @@ export async function incrementClickCount(id: string): Promise<void> {
 export async function incrementRunCount(id: string): Promise<void> {
    if (!isIndexedDBAvailable()) return
    try {
-        await withDB(async (db) => {
-            const template = await db.get(STORE_NAME, id)
-            if (!template) return
-            const now = Date.now()
-            template.runCount += 1
-            template.lastUsedAt = now
-            template.updatedAt = now
-            await db.put(STORE_NAME, template)
-        })
+        const db = await getDB()
+        const template = await db.get(STORE_NAME, id)
+        if (!template) return
+        const now = Date.now()
+        template.runCount += 1
+        template.lastUsedAt = now
+        template.updatedAt = now
+        await db.put(STORE_NAME, template)
    } catch (error) {
        console.error("Failed to increment run count:", error)
    }
@@ -423,9 +372,8 @@ export async function importTemplates(
            pinned: typeof t.pinned === "boolean" ? t.pinned : false,
        }
        try {
-            await withDB(async (db) => {
-                await db.put(STORE_NAME, newTemplate)
-            })
+            const db = await getDB()
+            await db.put(STORE_NAME, newTemplate)
            existingKeys.add(key)
            imported++
        } catch (error) {
--- a/lib/types/model-config.ts
+++ b/lib/types/model-config.ts
@@ -190,177 +190,202 @@ export const PROVIDER_INFO: Record<
 // Suggested models per provider for quick add
 export const SUGGESTED_MODELS: Partial<Record<ProviderName, string[]>> = {
    openai: [
-        "gpt-5.2-pro",
-        "gpt-5.2-chat-latest",
-        "gpt-5.2",
-        "gpt-5.1-codex-mini",
-        "gpt-5.1-codex",
-        "gpt-5.1-chat-latest",
-        "gpt-5.1",
-        "gpt-5-pro",
-        "gpt-5",
-        "gpt-5-mini",
-        "gpt-5-nano",
-        "gpt-5-codex",
-        "gpt-5-chat-latest",
+        "gpt-5.5-pro",
+        "gpt-5.5",
+        "gpt-5.4-pro",
+        "gpt-5.4",
+        "gpt-5.4-mini",
+        "gpt-5.4-nano",
+        "gpt-5-codex-mini",
        "gpt-4.1",
        "gpt-4.1-mini",
-        "gpt-4.1-nano",
        "gpt-4o",
        "gpt-4o-mini",
    ],
    anthropic: [
-        // Claude 4.5 series (latest)
-        "claude-opus-4-5-20250514",
-        "claude-sonnet-4-5-20250514",
-        // Claude 4 series
-        "claude-opus-4-20250514",
-        "claude-sonnet-4-20250514",
+        // Claude 4.8 / 4.7 / 4.6 series (latest, dateless pinned IDs)
+        "claude-opus-4-8",
+        "claude-sonnet-4-6",
+        "claude-haiku-4-5",
+        "claude-opus-4-7",
+        "claude-opus-4-6",
+        // Claude 4.5 series
+        "claude-sonnet-4-5-20250929",
+        "claude-opus-4-5-20251101",
        // Claude 3.7 series
        "claude-3-7-sonnet-20250219",
        // Claude 3.5 series
        "claude-3-5-sonnet-20241022",
        "claude-3-5-haiku-20241022",
-        // Claude 3 series
-        "claude-3-opus-20240229",
-        "claude-3-sonnet-20240229",
-        "claude-3-haiku-20240307",
    ],
    google: [
+        // Gemini 3 series
+        "gemini-3.1-pro",
+        "gemini-3.5-flash",
+        "gemini-3-flash",
+        "gemini-3.1-flash-lite",
        // Gemini 2.5 series
        "gemini-2.5-pro",
        "gemini-2.5-flash",
-        "gemini-2.5-flash-preview-05-20",
-        // Gemini 2.0 series
-        "gemini-2.0-flash",
-        "gemini-2.0-flash-exp",
-        "gemini-2.0-flash-lite",
-        // Gemini 1.5 series
-        "gemini-1.5-pro",
-        "gemini-1.5-flash",
-        // Legacy
-        "gemini-pro",
+        "gemini-2.5-flash-lite",
    ],
    vertexai: [
+        // Gemini 3 series
+        "gemini-3.1-pro-preview",
+        "gemini-3.5-flash",
+        "gemini-3-flash-preview",
+        "gemini-3.1-flash-lite",
        // Gemini 2.5 series
        "gemini-2.5-pro",
        "gemini-2.5-flash",
-        // Gemini 2.0 series
-        "gemini-2.0-flash",
-        "gemini-2.0-flash-exp",
-        // Gemini 1.5 series
-        "gemini-1.5-pro",
-        "gemini-1.5-flash",
+        "gemini-2.5-flash-lite",
+    ],
+    azure: [
+        "gpt-5.5",
+        "gpt-5.4",
+        "gpt-5.1",
+        "gpt-5",
+        "gpt-5-mini",
+        "gpt-4.1",
+        "gpt-4o",
+        "gpt-4o-mini",
+        "o3",
+        "o4-mini",
    ],
-    azure: ["gpt-4o", "gpt-4o-mini", "gpt-4-turbo", "gpt-4", "gpt-35-turbo"],
    bedrock: [
        // Anthropic Claude
-        "anthropic.claude-opus-4-5-20250514-v1:0",
-        "anthropic.claude-sonnet-4-5-20250514-v1:0",
+        "anthropic.claude-opus-4-8",
+        "anthropic.claude-opus-4-7",
+        "anthropic.claude-sonnet-4-6",
+        "anthropic.claude-opus-4-6-v1",
+        "anthropic.claude-opus-4-5-20251101-v1:0",
+        "anthropic.claude-sonnet-4-5-20250929-v1:0",
+        "anthropic.claude-haiku-4-5-20251001-v1:0",
+        "anthropic.claude-opus-4-1-20250805-v1:0",
        "anthropic.claude-opus-4-20250514-v1:0",
        "anthropic.claude-sonnet-4-20250514-v1:0",
-        "anthropic.claude-3-7-sonnet-20250219-v1:0",
-        "anthropic.claude-3-5-sonnet-20241022-v2:0",
        "anthropic.claude-3-5-haiku-20241022-v1:0",
-        "anthropic.claude-3-opus-20240229-v1:0",
-        "anthropic.claude-3-sonnet-20240229-v1:0",
-        "anthropic.claude-3-haiku-20240307-v1:0",
        // Amazon Nova
+        "amazon.nova-2-lite-v1:0",
+        "amazon.nova-premier-v1:0",
        "amazon.nova-pro-v1:0",
        "amazon.nova-lite-v1:0",
        "amazon.nova-micro-v1:0",
        // Meta Llama
+        "meta.llama4-maverick-17b-instruct-v1:0",
+        "meta.llama4-scout-17b-instruct-v1:0",
        "meta.llama3-3-70b-instruct-v1:0",
-        "meta.llama3-1-405b-instruct-v1:0",
-        "meta.llama3-1-70b-instruct-v1:0",
        // Mistral
-        "mistral.mistral-large-2411-v1:0",
-        "mistral.mistral-small-2503-v1:0",
+        "mistral.mistral-large-3-675b-instruct",
+        "mistral.pixtral-large-2502-v1:0",
    ],
    openrouter: [
        // Anthropic
-        "anthropic/claude-sonnet-4",
-        "anthropic/claude-opus-4",
-        "anthropic/claude-3.5-sonnet",
-        "anthropic/claude-3.5-haiku",
+        "anthropic/claude-opus-4.8",
+        "anthropic/claude-sonnet-4.6",
+        "anthropic/claude-haiku-4.5",
        // OpenAI
-        "openai/gpt-4o",
+        "openai/gpt-5.5",
+        "openai/gpt-5.4",
+        "openai/gpt-5.4-mini",
        "openai/gpt-4o-mini",
-        "openai/o1",
-        "openai/o3-mini",
        // Google
-        "google/gemini-2.5-pro",
-        "google/gemini-2.5-flash",
-        "google/gemini-2.0-flash-exp:free",
+        "google/gemini-3.1-pro-preview",
+        "google/gemini-3.5-flash",
+        "google/gemini-2.5-flash-lite",
+        // xAI
+        "x-ai/grok-4.3",
        // Meta Llama
+        "meta-llama/llama-4-maverick",
+        "meta-llama/llama-4-scout",
        "meta-llama/llama-3.3-70b-instruct",
-        "meta-llama/llama-3.1-405b-instruct",
-        "meta-llama/llama-3.1-70b-instruct",
        // DeepSeek
-        "deepseek/deepseek-chat",
-        "deepseek/deepseek-r1",
+        "deepseek/deepseek-v4-pro",
+        "deepseek/deepseek-v3.2",
        // Qwen
-        "qwen/qwen-2.5-72b-instruct",
+        "qwen/qwen3.7-max",
+        "qwen/qwen3-coder",
+        // MiniMax
+        "minimax/minimax-m3",
+    ],
+    deepseek: [
+        "deepseek-v4-pro",
+        "deepseek-v4-flash",
+        "deepseek-chat",
+        "deepseek-reasoner",
    ],
-    deepseek: ["deepseek-chat", "deepseek-reasoner", "deepseek-coder"],
    siliconflow: [
        // DeepSeek
-        "deepseek-ai/DeepSeek-V3",
-        "deepseek-ai/DeepSeek-R1",
-        "deepseek-ai/DeepSeek-V2.5",
+        "deepseek-ai/DeepSeek-V4-Pro",
+        "deepseek-ai/DeepSeek-V4-Flash",
+        "deepseek-ai/DeepSeek-V3.2",
+        // MiniMax
+        "MiniMaxAI/MiniMax-M3",
+        // Moonshot
+        "moonshotai/Kimi-K2.6",
+        // Z.ai
+        "zai-org/GLM-5",
        // Qwen
-        "Qwen/Qwen2.5-72B-Instruct",
-        "Qwen/Qwen2.5-32B-Instruct",
-        "Qwen/Qwen2.5-Coder-32B-Instruct",
-        "Qwen/Qwen2.5-7B-Instruct",
-        "Qwen/Qwen2-VL-72B-Instruct",
-        "qwen3.5-plus",
+        "Qwen/Qwen3.6-35B-A3B",
+        "Qwen/Qwen3-Coder-480B-A35B-Instruct",
+        "Qwen/Qwen3-30B-A3B-Instruct-2507",
+        "Qwen/Qwen3-VL-32B-Instruct",
+        // OpenAI open-weights
+        "openai/gpt-oss-120b",
    ],
    sglang: [
        // SGLang is OpenAI-compatible, models depend on deployment
        "default",
    ],
    gateway: [
-        "openai/gpt-4o",
-        "openai/gpt-4o-mini",
-        "anthropic/claude-sonnet-4-5",
-        "anthropic/claude-3-5-sonnet",
-        "google/gemini-2.0-flash",
+        "openai/gpt-5.5",
+        "anthropic/claude-opus-4.7",
+        "google/gemini-3.1-pro-preview",
+        "xai/grok-4.3",
+        "anthropic/claude-sonnet-4.6",
+        "anthropic/claude-haiku-4.5",
+        "openai/gpt-5.4-mini",
    ],
    edgeone: ["@tx/deepseek-ai/deepseek-v32"],
    doubao: [
-        // ByteDance Doubao models
-        "doubao-1.5-thinking-pro-250415",
-        "doubao-1.5-thinking-pro-m-250428",
-        "doubao-1.5-pro-32k-250115",
-        "doubao-1.5-pro-256k-250115",
-        "doubao-pro-32k-241215",
-        "doubao-pro-256k-241215",
+        // ByteDance Doubao models (Volcengine Ark IDs use dash form)
+        "doubao-seed-2-0-pro-260215",
+        "doubao-seed-2-0-lite-260428",
+        "doubao-seed-2-0-mini-260428",
+        "doubao-seed-1-8-251228",
+        "doubao-seed-1-6-251015",
+        "doubao-seed-1-6-flash-250828",
+        "doubao-seed-1-6-vision-250815",
+        "doubao-1-5-pro-32k-250115",
+        "doubao-1-5-lite-32k-250115",
    ],
    modelscope: [
+        // DeepSeek
+        "deepseek-ai/DeepSeek-V4-Pro",
+        "deepseek-ai/DeepSeek-V3.2",
+        "deepseek-ai/DeepSeek-R1-0528",
+        "deepseek-ai/DeepSeek-R1",
        // Qwen
-        "Qwen/Qwen2.5-72B-Instruct",
-        "Qwen/Qwen2.5-32B-Instruct",
        "Qwen/Qwen3-235B-A22B-Instruct-2507",
        "Qwen/Qwen3-VL-235B-A22B-Instruct",
+        "Qwen/Qwen3-Coder-30B-A3B-Instruct",
        "Qwen/Qwen3-32B",
-        "qwen3.5-plus",
-        // DeepSeek
-        "deepseek-ai/DeepSeek-R1-0528",
-        "deepseek-ai/DeepSeek-V3.2",
+        "Qwen/Qwen2.5-72B-Instruct",
    ],
    minimax: [
        // MiniMax models (Anthropic-compatible API)
+        "MiniMax-M3",
        "MiniMax-M2.7",
        "MiniMax-M2.7-highspeed",
        "MiniMax-M2.5",
-        "MiniMax-M2.5-highspeed",
    ],
    novita: [
        // Novita AI models (OpenAI-compatible API)
-        "moonshotai/kimi-k2.5",
-        "zai-org/glm-5",
-        "minimax/minimax-m2.5",
+        "minimax/minimax-m3",
+        "deepseek/deepseek-v4-pro",
+        "zai-org/glm-5.1",
+        "moonshotai/kimi-k2.6",
+        "deepseek/deepseek-v4-flash",
    ],
 }

--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
    "name": "next-ai-draw-io",
-    "version": "0.4.14",
+    "version": "0.4.16",
    "license": "Apache-2.0",
    "private": true,
    "main": "dist-electron/main/index.js",
@@ -49,9 +49,9 @@
        "@langfuse/tracing": "^4.4.9",
        "@next/third-parties": "^16.0.6",
        "@opennextjs/cloudflare": "^1.17.1",
-        "@openrouter/ai-sdk-provider": "^1.5.4",
+        "@openrouter/ai-sdk-provider": "^2.0.0",
        "@opentelemetry/api": "^1.9.0",
-        "@opentelemetry/exporter-trace-otlp-http": "^0.214.0",
+        "@opentelemetry/exporter-trace-otlp-http": "^0.216.0",
        "@opentelemetry/sdk-trace-node": "^2.2.0",
        "@radix-ui/react-alert-dialog": "^1.1.15",
        "@radix-ui/react-collapsible": "^1.1.12",
@@ -77,7 +77,7 @@
        "nanoid": "^5.0.0",
        "negotiator": "^1.0.0",
        "next": "^16.0.7",
-        "ollama-ai-provider-v2": "^2.0.0",
+        "ollama-ai-provider-v2": "^3.0.0",
        "pako": "^2.1.0",
        "prism-react-renderer": "^2.4.1",
        "react": "^19.1.2",
@@ -108,7 +108,7 @@
    },
    "devDependencies": {
        "@anthropic-ai/tokenizer": "^0.0.4",
-        "@biomejs/biome": "2.4.10",
+        "@biomejs/biome": "2.4.13",
        "@playwright/test": "^1.57.0",
        "@tailwindcss/postcss": "^4",
        "@tailwindcss/typography": "^0.5.19",
@@ -127,7 +127,7 @@
        "cross-env": "^10.1.0",
        "electron": "^39.2.7",
        "electron-builder": "^26.0.12",
-        "esbuild": "^0.27.2",
+        "esbuild": "^0.28.0",
        "eslint": "9.39.4",
        "eslint-config-next": "16.1.6",
        "husky": "^9.1.7",
--- a/packages/mcp-server/package-lock.json
+++ b/packages/mcp-server/package-lock.json
@@ -1,12 +1,12 @@
 {
    "name": "@next-ai-drawio/mcp-server",
-    "version": "0.1.17",
+    "version": "0.2.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
        "": {
            "name": "@next-ai-drawio/mcp-server",
-            "version": "0.1.17",
+            "version": "0.2.0",
            "license": "Apache-2.0",
            "dependencies": {
                "@modelcontextprotocol/sdk": "^1.0.4",
@@ -521,9 +521,9 @@
            }
        },
        "node_modules/@types/node": {
-            "version": "24.12.0",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.0.tgz",
-            "integrity": "sha512-GYDxsZi3ChgmckRT9HPU0WEhKLP08ev/Yfcq2AstjrDASOYCSXeyjDsHg4v5t4jOj7cyDX3vmprafKlWIG9MXQ==",
+            "version": "24.12.2",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.2.tgz",
+            "integrity": "sha512-A1sre26ke7HDIuY/M23nd9gfB+nrmhtYyMINbjI1zHJxYteKR6qSMX56FsmjMcDb3SMcjJg5BiRRgOCC/yBD0g==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -2062,9 +2062,9 @@
            }
        },
        "node_modules/zod": {
-            "version": "4.3.6",
-            "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
-            "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
+            "version": "4.4.1",
+            "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.1.tgz",
+            "integrity": "sha512-a6ENMBBGZBsnlSebQ/eKCguSBeGKSf4O7BPnqVPmYGtpBYI7VSqoVqw+QcB7kPRjbqPwhYTpFbVj/RqNz/CT0Q==",
            "license": "MIT",
            "funding": {
                "url": "https://github.com/sponsors/colinhacks"
--- a/packages/mcp-server/package.json
+++ b/packages/mcp-server/package.json
@@ -1,6 +1,6 @@
 {
    "name": "@next-ai-drawio/mcp-server",
-    "version": "0.1.19",
+    "version": "0.2.0",
    "description": "MCP server for Next AI Draw.io - AI-powered diagram generation with real-time browser preview",
    "type": "module",
    "main": "dist/index.js",
--- a/packages/mcp-server/src/index.ts
+++ b/packages/mcp-server/src/index.ts
@@ -155,19 +155,22 @@ server.registerTool(
 server.registerTool(
    "create_new_diagram",
    {
-        description: `Create a NEW diagram from mxGraphModel XML. Use this when creating a diagram from scratch or replacing the current diagram entirely.
+        description: `Create a NEW diagram from mxGraphModel XML. ONLY use this when creating a diagram from scratch.
+
+⚠️ DO NOT use this tool to modify an existing diagram — it will DESTROY all existing content and user changes. Use edit_diagram instead for ANY modifications to an existing diagram.

 CRITICAL: You MUST provide the 'xml' argument in EVERY call. Do NOT call this tool without xml.

 When to use this tool:
- Creating a new diagram from scratch
- Replacing the current diagram with a completely different one
- Major structural changes that require regenerating the diagram
+- Creating a new diagram from scratch (no existing diagram)
+- The user explicitly asks to "start over" or "create a new diagram"

-When to use edit_diagram instead:
- Small modifications to existing diagram
- Adding/removing individual elements
- Changing labels, colors, or positions
+When to use edit_diagram instead (ALWAYS prefer edit_diagram if a diagram already exists):
+- ANY modifications to an existing diagram
+- Adding/removing/moving elements
+- Changing labels, colors, styles, or positions
+- Restructuring or reorganizing existing content
+- Adding new elements to an existing diagram

 XML FORMAT - Full mxGraphModel structure:
 <mxGraphModel>
--- a/packages/mcp-server/tsconfig.json
+++ b/packages/mcp-server/tsconfig.json
@@ -12,7 +12,8 @@
        "declaration": true,
        "declarationMap": true,
        "sourceMap": true,
-        "resolveJsonModule": true
+        "resolveJsonModule": true,
+        "types": ["node"]
    },
    "include": ["src/**/*"],
    "exclude": ["node_modules", "dist"]
--- a/tests/e2e/iframe-interaction.spec.ts
+++ b/tests/e2e/iframe-interaction.spec.ts
@@ -35,8 +35,10 @@ test.describe("Iframe Interaction", () => {
        await expect(
            frame
                .locator('text="Diagram"')
-                .or(frame.locator('[title*="Diagram"]')),
-        ).toBeVisible({ timeout: 10000 })
+                .or(frame.locator('[title*="Diagram"]'))
+                .filter({ visible: true })
+                .first(),
+        ).toBeVisible({ timeout: 30000 })
    })

    test("diagram XML is rendered in iframe after generation", async ({
--- a/tests/unit/ai-providers.test.ts
+++ b/tests/unit/ai-providers.test.ts
@@ -180,11 +180,14 @@ describe("supportsImageInput", () => {
        expect(supportsImageInput("moonshot-v1-128k")).toBe(false)
    })

-    it("returns false for MiniMax text models", () => {
+    it("returns false for MiniMax M2 text models", () => {
        expect(supportsImageInput("MiniMax-M2.7")).toBe(false)
-        expect(supportsImageInput("MiniMax-M2.5")).toBe(false)
+        expect(supportsImageInput("MiniMax-M2.7-highspeed")).toBe(false)
        expect(supportsImageInput("MiniMax-M2")).toBe(false)
-        expect(supportsImageInput("MiniMax-M2.5-highspeed")).toBe(false)
+    })
+
+    it("returns true for MiniMax M3 (supports image input)", () => {
+        expect(supportsImageInput("MiniMax-M3")).toBe(true)
    })

    it("returns false for DeepSeek text models", () => {
@@ -208,6 +211,13 @@ describe("supportsImageInput", () => {
        expect(supportsImageInput("qwen3-vl-flash")).toBe(true)
    })

+    it("returns true for QvQ (Qwen Visual QA) models including OpenRouter-prefixed names", () => {
+        expect(supportsImageInput("qvq-72b-preview")).toBe(true)
+        expect(supportsImageInput("qvq-max")).toBe(true)
+        expect(supportsImageInput("qwen/qvq-72b-preview")).toBe(true)
+        expect(supportsImageInput("qwen/qvq-max")).toBe(true)
+    })
+
    it("returns false for GLM text models", () => {
        expect(supportsImageInput("glm-4")).toBe(false)
        expect(supportsImageInput("glm-4-plus")).toBe(false)
@@ -238,6 +248,67 @@ vi.mock("ollama-ai-provider-v2", () => {
    return { createOllama: mockCreateOllama, ollama: mockOllama }
 })

+vi.mock("@ai-sdk/deepseek", () => {
+    const mockModel = { modelId: "test-model" }
+    const mockProviderFn = vi.fn(() => mockModel)
+    const mockCreateDeepSeek = vi.fn(() => mockProviderFn)
+    const mockDeepseek = vi.fn(() => mockModel)
+    return { createDeepSeek: mockCreateDeepSeek, deepseek: mockDeepseek }
+})
+
+describe("Kimi provider uses createDeepSeek for reasoning_content support", () => {
+    let createDeepSeekMock: ReturnType<typeof vi.fn>
+    const savedEnv: Record<string, string | undefined> = {}
+
+    beforeEach(async () => {
+        savedEnv.KIMI_API_KEY = process.env.KIMI_API_KEY
+        savedEnv.KIMI_BASE_URL = process.env.KIMI_BASE_URL
+        delete process.env.KIMI_BASE_URL
+
+        const mod = await import("@ai-sdk/deepseek")
+        createDeepSeekMock = mod.createDeepSeek as ReturnType<typeof vi.fn>
+        createDeepSeekMock.mockClear()
+    })
+
+    afterEach(() => {
+        process.env.KIMI_API_KEY = savedEnv.KIMI_API_KEY
+        process.env.KIMI_BASE_URL = savedEnv.KIMI_BASE_URL
+    })
+
+    it("uses createDeepSeek with Kimi default base URL for reasoning_content support", () => {
+        process.env.KIMI_API_KEY = "test-kimi-key"
+
+        getAIModel({
+            provider: "kimi",
+            apiKey: "test-kimi-key",
+            modelId: "moonshot-v1-8k",
+        })
+
+        expect(createDeepSeekMock).toHaveBeenCalledWith(
+            expect.objectContaining({
+                baseURL: "https://api.moonshot.cn/v1",
+            }),
+        )
+    })
+
+    it("uses custom base URL when provided for kimi provider", () => {
+        process.env.KIMI_API_KEY = "test-kimi-key"
+
+        getAIModel({
+            provider: "kimi",
+            apiKey: "test-kimi-key",
+            baseUrl: "https://custom-kimi-endpoint.com/v1",
+            modelId: "kimi-k2.6",
+        })
+
+        expect(createDeepSeekMock).toHaveBeenCalledWith(
+            expect.objectContaining({
+                baseURL: "https://custom-kimi-endpoint.com/v1",
+            }),
+        )
+    })
+})
+
 describe("Ollama API key security", () => {
    let createOllamaMock: ReturnType<typeof vi.fn>
    const savedEnv: Record<string, string | undefined> = {}
--- a/tests/unit/ssrf-protection.test.ts
+++ b/tests/unit/ssrf-protection.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest"
+import { isPrivateUrl } from "@/lib/ssrf-protection"
+
+describe("isPrivateUrl", () => {
+    it("blocks private IPv6 URLs", () => {
+        expect(isPrivateUrl("http://[::1]/")).toBe(true)
+        expect(isPrivateUrl("http://[0:0:0:0:0:0:0:1]/")).toBe(true)
+        expect(isPrivateUrl("http://[::]/")).toBe(true)
+        expect(isPrivateUrl("http://[::ffff:127.0.0.1]/")).toBe(true)
+        expect(isPrivateUrl("http://[fc00::1]/")).toBe(true)
+        expect(isPrivateUrl("http://[fd12:3456:789a::1]/")).toBe(true)
+        expect(isPrivateUrl("http://[fe80::1]/")).toBe(true)
+        expect(isPrivateUrl("http://[fe9f::1]/")).toBe(true)
+        expect(isPrivateUrl("http://[febf::1]/")).toBe(true)
+    })
+
+    it("allows public URLs", () => {
+        expect(isPrivateUrl("https://example.com/article")).toBe(false)
+        expect(isPrivateUrl("https://fc00.example.com/article")).toBe(false)
+    })
+})
Author	SHA1	Message	Date
dayuan.jiang	0956684b8e	chore: refresh SUGGESTED_MODELS for all providers Updates the SUGGESTED_MODELS quick-add list in lib/types/model-config.ts against each provider's official model docs as of 2026-06-09. - openai: GPT-5.5 / 5.4 frontier; drop deprecated 5.0-5.2 family - anthropic: add Opus 4.8/4.7/4.6, Sonnet 4.6, Haiku 4.5 (new dateless pinned IDs); fix wrong date suffixes on Opus/Sonnet 4.5 - google / vertexai: adopt Gemini 3 family; drop Gemini 2.0 (shut down) and 1.5 - azure: GPT-5.x line + o3 / o4-mini; drop gpt-4-turbo / gpt-35-turbo - bedrock: Opus 4.8/4.7/4.6, Sonnet 4.6, Haiku 4.5, Nova Premier / Nova 2 Lite, Llama 4 Maverick / Scout, Mistral Large 3, Pixtral - openrouter: refreshed against live /api/v1/models - deepseek: V4 Pro / Flash - siliconflow / modelscope: DeepSeek V4, Qwen 3.x, drop bogus qwen3.5-plus - gateway: verified against live Vercel AI Gateway endpoint - doubao: Seed 2.0 / 1.8 / 1.6 in official dash-form IDs - minimax: + M2.5 - novita: M3, GLM-5.1, Kimi-K2.6, DeepSeek V4	2026-06-09 21:08:02 +09:00
chaochaoweb3	410993a3bf	fix: block private IPv6 URLs (#858 ) * fix: block private IPv6 URLs * fix: cover full fe80::/10 link-local range and :: unspecified - Replace startsWith("fe80:") with a check covering the full fe80::/10 range (fe80 through febf) per RFC 4291. - Add :: (unspecified) to the localhost block. - Drop the dead 0:0:0:0:0:0:0:1 branch (URL parser normalizes it to ::1). - Add tests for fe9f::1, febf::1, and ::. --------- Co-authored-by: dayuan.jiang <jdy.toh@gmail.com>	2026-06-06 00:30:20 +09:00
Dayuan Jiang	77e7766f9a	fix(deps): bump @ai-sdk/amazon-bedrock to 4.0.113 to fix tool streaming under Zod v4 (#860 ) The installed 4.0.64 declared `input: z.unknown()` on BedrockToolUseSchema, which Zod v4 treats as non-optional. With the `fine-grained-tool-streaming-2025-05-14` beta enabled in lib/ai-providers.ts, Bedrock's contentBlockStart event arrives without an `input` field, causing type validation to fail with "expected nonoptional, received undefined". 4.0.101 fixed this upstream by marking input optional on the streaming tool-use schema. The semver range `^4.0.1` already permitted this; only the lockfile needed refreshing. Closes #859	2026-06-06 00:15:45 +09:00
Octopus	a9ffd6a1de	feat: upgrade MiniMax default model to M3 (#857 ) - Add MiniMax-M3 to the model selection list (set as new default at top) - Retain MiniMax-M2.7 and MiniMax-M2.7-highspeed - Remove deprecated MiniMax-M2.5 / M2.5-highspeed - Update supportsImageInput: M3 supports image input (M2.x stay text-only) - Update unit tests to reflect new model lineup - Update example AI_MODEL in CN/EN/JA docs to MiniMax-M3 Co-authored-by: octo-patch <octo-patch@github.com>	2026-06-02 19:38:49 +09:00
waterystone	277ad83552	fix(anthropic): support ANTHROPIC_AUTH_TOKEN as alternative to ANTHROPIC_API_KEY (#853 ) * fix(anthropic): support ANTHROPIC_AUTH_TOKEN as alternative to ANTHROPIC_API_KEY Anthropic SDK supports two mutually exclusive auth methods: apiKey (sent as x-api-key header) and authToken (sent as Authorization: Bearer header). Detect either env var during provider detection and credential validation, and pass authToken to createAnthropic when only ANTHROPIC_AUTH_TOKEN is set. * docs(anthropic): document ANTHROPIC_AUTH_TOKEN and refine error message - Add ANTHROPIC_AUTH_TOKEN to env.example and the en/cn/ja provider docs - Reword the missing-credential error to "Either ... or ..." for readability --------- Co-authored-by: duyunjie <duyunjie@zhuanzhuan.com> Co-authored-by: dayuan.jiang <jdy.toh@gmail.com>	2026-06-02 19:26:27 +09:00
Dayuan Jiang	7b6eb39fa5	fix(parse-url): block SSRF via private/internal URLs (#845 ) /api/parse-url accepted any URL the user submitted, fetched it via @extractus/article-extractor, and returned the body as Markdown. With ALLOW_PRIVATE_URLS unset (the default after #600) the SSRF guard short-circuited entirely, so an unauthenticated POST could probe container ports, read AWS IMDS / GCP metadata, and reach same-VPC internal services. - parse-url now always rejects private URLs regardless of ALLOW_PRIVATE_URLS. The flag's only legitimate use case is local LLM provider baseUrl overrides (validate-model, chat); article extraction has no business fetching internal hosts. Local LLM setups (Ollama, LM Studio, etc.) are unaffected. - Strip a trailing dot from the hostname before equality checks so the FQDN form "localhost." (which still resolves to 127.0.0.1) is caught by the existing string match. Known follow-ups (not addressed here): - DNS rebinding: hostnames are matched as strings; a public domain resolving to 127.0.0.1 (e.g. localtest.me) is not caught. - HTTP redirects: @extractus/article-extractor uses cross-fetch with default redirect: "follow" and exposes no hook, so a public URL 302-ing to an internal host still leaks.	2026-05-21 23:54:23 +09:00
Dayuan Jiang	1115b2d2cd	chore: bump version to 0.4.16 (#843 )	2026-05-21 09:28:55 +09:00
renovate[bot]	08afb6dd34	chore(deps): update dependency next to v16.2.6 [security] (#842 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-21 09:05:06 +09:00
renovate[bot]	c703159e00	fix(deps): update core framework packages (major) (#724 ) * fix(deps): update core framework packages * style: auto-format with Biome --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-05-21 09:01:42 +09:00
renovate[bot]	ee75408136	chore(deps): update dependency electron to v39.8.5 [security] (#789 ) * chore(deps): update dependency electron to v39.8.5 [security] * style: auto-format with Biome --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-05-21 09:01:03 +09:00
renovate[bot]	2ed1a64ae3	fix(deps): update minor and patch dependencies (#829 ) * fix(deps): update minor and patch dependencies * style: auto-format with Biome --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-05-21 08:59:18 +09:00
Dayuan Jiang	2f2d75961d	chore: remove dead code from previous #815 fix attempts (#841 ) PR #840 fixed issue #815 in the Electron main process via will-prevent-unload + preventDefault. The renderer-side workarounds introduced by previous fix attempts (#642, #648) are no longer needed and never had effect for their stated purpose. Removed: - configuration={ confirmExit: false } in DrawIoEmbed confirmExit is not a recognized draw.io config key (zero matches in jgraph/drawio source). This was always dead code. - modified=0 / keepmodified=0 URL parameters Per drawio source (app.min.js:14898), these only suppress the post-save modified-flag clearing — they do not prevent edits from setting editor.modified=true. They were ineffective for blocking beforeunload prompts and actually prevented draw.io from clearing its modified flag after save. - canPersist / canPersistChecked state and isIndexedDBUsable() probe Their only purpose was gating the dead config above. Removing them also removes a startup delay before the iframe renders. - handleDrawioAutoSave wrapper After PR #780 stripped its body, it was a pure passthrough useCallback. Now passes handleDiagramAutoSave directly to onAutoSave. - withDB / isClosingError / resetDBPromise / onversionchange / onclose / terminated handlers in lib/session-storage.ts and lib/template-storage.ts PR #648 added these to recover from 'IDBDatabase: connection is closing' errors that PR #642's first land caused via db.close() on the shared singleton. That bug was already fixed in `c5de1a1` (re-land of #642), three minutes before PR #648 commits started. The retry handlers defend against multi-tab / version-change scenarios that cannot occur in this single-instance Electron app (requestSingleInstanceLock). template-storage.ts copied the same pattern when introduced by #773. Verified: - npx tsc --noEmit passes - Manual test in dev mode: session save/load works, template create works, diagram-only persistence works.	2026-05-21 08:37:14 +09:00
Dayuan Jiang	5406778dd6	fix(electron): override draw.io iframe beforeunload to allow window close (fixes #815 ) (#840 ) The draw.io iframe registers a window.onbeforeunload handler that returns a non-empty string whenever its internal editor.modified flag is true. After the user edits text in a shape, that flag is set and never cleared. Per Electron BrowserWindow docs, returning a non-void value from any beforeunload handler in the page tree silently cancels the window close without showing a dialog. This is what caused the X button (and Cmd+Q) to do nothing for users who had typed in a shape. Calling event.preventDefault() in will-prevent-unload tells Electron to ignore the iframe's beforeunload return value and proceed with the close. The host app already persists diagrams via autosave + visibilitychange, so the prompt was unnecessary. Verified by reproducing the bug, applying the fix, and re-testing.	2026-05-20 23:33:05 +09:00
果子	bb65a8c07a	fix(e2e): resolve iframe toolbar strict mode violation (#837 ) * fix(e2e): resolve strict mode violation in iframe test Use .first() with [title="Diagram"] selector to avoid matching multiple elements. Fixes CI failure in E2E Tests job. fix(e2e): use .first() to resolve strict mode violation * style: fix biome formatting in iframe test * style: fix biome formatting in iframe test * fix(e2e): use .or().first() to handle both text and title selectors * fix(e2e): increase timeout for draw.io toolbar visibility check * fix(e2e): filter visible elements to avoid selecting hidden toolbar	2026-05-19 09:52:02 +09:00
果子	4e223b6237	feat: add all Draw.io themes to settings panel (#835 ) * feat: add all Draw.io themes to settings panel Add all available Draw.io themes (kennedy, atlas, dark, min, sketch, simple) to the settings panel dropdown. Previously only min and sketch were available as a toggle button. Changes: - Replace the Draw.io style toggle button with a dropdown selector - Expand theme type from "min" \| "sketch" to include all 6 themes - Update localStorage validation to accept all themes - Update handler from toggle to direct theme selection Closes #499 * fix: localize theme labels, tighten DrawioTheme typing, sync dark param - Move DRAWIO_THEMES + DrawioTheme to lib/drawio-themes.ts; reuse in page.tsx, chat-panel.tsx and settings-dialog.tsx instead of `string` - Localize theme dropdown labels (Dark/Minimal/Sketch/Simple) in en/zh/ja/zh-Hant; keep proper-noun themes (Kennedy/Atlas) as-is - Drop trailing colon from drawioStyleDescription and remove dead switchTo/minimal/sketch keys in all 4 dictionaries - Auto-sync drawio dark URL param when ui="dark" is selected - Add aria-label to drawio-style SelectTrigger * fix: use kennedy as default theme and label it "Default" --------- Co-authored-by: dayuan.jiang <jdy.toh@gmail.com>	2026-05-15 23:14:20 +09:00
Octopus	c60e3930a3	fix: use createDeepSeek for kimi provider to handle reasoning_content in multi-turn conversations (fixes #824 ) (#825 ) Kimi thinking models (e.g. kimi-k2.6) return reasoning_content in their responses. The previous createOpenAI-based implementation silently ignored this field, so reasoning was never captured or replayed in subsequent turns. Switching to createDeepSeek (which natively understands reasoning_content) ensures that reasoning context is preserved across conversation turns, resolving the "cannot interact a second time" error with Kimi k2.6. This mirrors the existing doubao provider pattern, which already uses createDeepSeek for kimi-based models routed through Doubao. Co-authored-by: octo-patch <octo-patch@github.com>	2026-05-15 14:02:26 +09:00
Octopus	5c8ae4d6d7	fix: always re-fetch access code config when settings dialog opens (#816 ) When ACCESS_CODE_LIST is configured on the server, the settings dialog was not showing the access code input field in two cases: 1. Stale localStorage cache: if a user had previously visited without ACCESS_CODE_LIST enabled, the cached value of accessCodeRequired=false would be used indefinitely, hiding the password input. 2. Race condition on first visit: the dialog could open triggered by an auth error before the async fetch to /api/config completed, showing a blank settings dialog with no access code field. Fix by re-fetching /api/config whenever the dialog opens (on open change) instead of only once on mount with a cache guard. The cached value in localStorage is still updated on success, keeping the fast initial render intact while ensuring the dialog always reflects the server configuration. Fixes #811 Co-authored-by: octo-patch <octo-patch@github.com>	2026-05-15 10:52:51 +09:00
Dayuan Jiang	f965f3fa2e	chore: align biome schema version with CLI latest (#832 ) Bumps biome.json $schema from 2.4.4 to 2.4.14 so the repo schema matches the version the 'Auto Format' workflow installs via @biomejs/biome@latest. Also applies the one auto-fix the newer version produces (export ordering in electron/electron.d.ts). Fixes the spurious 'This PR has formatting issues' CI failure that was blocking fork PRs unrelated to formatting.	2026-05-07 22:43:37 +09:00
LaaraibAhmed	73eefc7aa6	fix: CSS/UI issue in model-config-dialog (#818 ) Co-authored-by: Laaraib Ahmed <laaraibahmed@Laaraibs-MacBook-Pro.local>	2026-05-07 22:14:46 +09:00
renovate[bot]	a8d27088ef	chore(deps): update dependency @xmldom/xmldom to v0.9.10 [security] (#821 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-04-23 02:57:27 +00:00
Dayuan Jiang	d4454beb9a	chore: bump version to 0.4.15 (#810 )	2026-04-14 23:57:40 +09:00
Octopus	171174378c	fix: allow QvQ (Qwen Visual QA) models to use image input (#808 ) QvQ models (e.g. qvq-72b-preview, qvq-max) are visual reasoning models from the Qwen family that support image input. When accessed via providers that prefix model names with 'qwen/' (e.g., OpenRouter), these models contain 'qwen' in their ID but lack the 'vl' or 'vision' indicator. This caused supportsImageInput() to incorrectly return false for model IDs like 'qwen/qvq-72b-preview', blocking image uploads for vision-capable models. Add 'qvq' as an explicit exception in the Qwen text-model check so that QvQ models are correctly allowed to receive image input regardless of the provider prefix. Co-authored-by: octo-patch <octo-patch@github.com>	2026-04-13 20:05:57 +09:00
Zhichang Yu	eadc2c2629	feat: add rpm target to electron-builder for Linux distribution (#806 ) Added rpm target (x64 + arm64) alongside existing deb and AppImage targets. No CI changes required since electron-builder handles both deb and rpm generation under the --linux flag. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-13 12:18:50 +09:00
Dayuan Jiang	c77af86011	fix: improve create_new_diagram tool description to prevent misuse and bump to v0.2.0 (#803 )	2026-04-10 17:18:24 +09:00