fix: improve create_new_diagram tool description to prevent misuse and bump to v0.2.0

2026-09-01 17:10:24 +08:00 · 2026-04-10 17:11:10 +09:00
29 changed files with 1428 additions and 2129 deletions
--- a/app/[lang]/page.tsx
+++ b/app/[lang]/page.tsx
@@ -10,8 +10,8 @@ import {
    ResizablePanelGroup,
 } from "@/components/ui/resizable"
 import { useDiagram } from "@/contexts/diagram-context"
-import { type DrawioTheme, isDrawioTheme } from "@/lib/drawio-themes"
 import { i18n, type Locale } from "@/lib/i18n/config"
+import { isIndexedDBUsable } from "@/lib/session-storage"

 export default function Home() {
    const {
@@ -27,11 +27,13 @@ export default function Home() {
    const currentLang = (pathname.split("/")[1] || i18n.defaultLocale) as Locale
    const [isMobile, setIsMobile] = useState(false)
    const [isChatVisible, setIsChatVisible] = useState(true)
-    const [drawioUi, setDrawioUi] = useState<DrawioTheme>("kennedy")
+    const [drawioUi, setDrawioUi] = useState<"min" | "sketch">("min")
    const [darkMode, setDarkMode] = useState(false)
    const [isLoaded, setIsLoaded] = useState(false)
    const [isDrawioReady, setIsDrawioReady] = useState(false)
    const [isElectron, setIsElectron] = useState(false)
+    const [canPersist, setCanPersist] = useState(false)
+    const [canPersistChecked, setCanPersistChecked] = useState(false)
    const [drawioBaseUrl, setDrawioBaseUrl] = useState(
        process.env.NEXT_PUBLIC_DRAWIO_BASE_URL || "https://embed.diagrams.net",
    )
@@ -54,7 +56,7 @@ export default function Home() {
        }

        const savedUi = localStorage.getItem("drawio-theme")
-        if (isDrawioTheme(savedUi)) {
+        if (savedUi === "min" || savedUi === "sketch") {
            setDrawioUi(savedUi)
        }

@@ -82,6 +84,11 @@ export default function Home() {
            setDrawioBaseUrl(`${window.location.origin}/drawio/index.html`)
        }

+        void (async () => {
+            const usable = await isIndexedDBUsable()
+            setCanPersist(usable)
+            setCanPersistChecked(true)
+        })()
        setIsLoaded(true)
    }, [pathname, router])

@@ -90,6 +97,13 @@ export default function Home() {
        onDrawioLoad()
    }, [onDrawioLoad])

+    const handleDrawioAutoSave = useCallback(
+        (data: { xml?: string }) => {
+            handleDiagramAutoSave(data)
+        },
+        [handleDiagramAutoSave],
+    )
+
    const handleDarkModeChange = () => {
        const newValue = !darkMode
        setDarkMode(newValue)
@@ -99,9 +113,10 @@ export default function Home() {
        resetDrawioReady()
    }

-    const handleDrawioUiChange = (theme: DrawioTheme) => {
-        localStorage.setItem("drawio-theme", theme)
-        setDrawioUi(theme)
+    const handleDrawioUiChange = () => {
+        const newUi = drawioUi === "min" ? "sketch" : "min"
+        localStorage.setItem("drawio-theme", newUi)
+        setDrawioUi(newUi)
        setIsDrawioReady(false)
        resetDrawioReady()
    }
@@ -172,7 +187,7 @@ export default function Home() {
                        }`}
                    >
                        <div className="h-full rounded-xl overflow-hidden shadow-soft-lg border border-border/30 relative">
-                            {isLoaded && (
+                            {isLoaded && canPersistChecked && (
                                <div
                                    className={`h-full w-full ${isDrawioReady ? "" : "invisible absolute inset-0"}`}
                                >
@@ -180,19 +195,28 @@ export default function Home() {
                                        key={`${drawioUi}-${darkMode}-${currentLang}-${isElectron}`}
                                        ref={drawioRef}
                                        autosave
-                                        onAutoSave={handleDiagramAutoSave}
+                                        onAutoSave={handleDrawioAutoSave}
                                        onExport={handleDiagramExport}
                                        onLoad={handleDrawioLoad}
                                        baseUrl={drawioBaseUrl}
+                                        configuration={
+                                            canPersist
+                                                ? { confirmExit: false }
+                                                : undefined
+                                        }
                                        urlParameters={{
                                            ui: drawioUi,
                                            spin: false,
                                            libraries: false,
+                                            // Disable modified tracking only when persistence is available
+                                            ...(canPersist && {
+                                                modified: false,
+                                                keepmodified: false,
+                                            }),
                                            saveAndExit: false,
                                            noSaveBtn: true,
                                            noExitBtn: true,
-                                            dark:
-                                                darkMode || drawioUi === "dark",
+                                            dark: darkMode,
                                            lang: currentLang,
                                            // Enable offline mode in Electron to disable external service calls
                                            ...(isElectron && {
@@ -240,7 +264,7 @@ export default function Home() {
                                isVisible={isChatVisible}
                                onToggleVisibility={toggleChatPanel}
                                drawioUi={drawioUi}
-                                onDrawioUiChange={handleDrawioUiChange}
+                                onToggleDrawioUi={handleDrawioUiChange}
                                darkMode={darkMode}
                                onToggleDarkMode={handleDarkModeChange}
                                isMobile={isMobile}
--- a/app/api/parse-url/route.ts
+++ b/app/api/parse-url/route.ts
@@ -1,7 +1,7 @@
 import { extract } from "@extractus/article-extractor"
 import { NextResponse } from "next/server"
 import TurndownService from "turndown"
-import { isPrivateUrl } from "@/lib/ssrf-protection"
+import { allowPrivateUrls, isPrivateUrl } from "@/lib/ssrf-protection"

 const MAX_CONTENT_LENGTH = 150000 // Match PDF limit
 const EXTRACT_TIMEOUT_MS = 15000
@@ -28,10 +28,8 @@ export async function POST(req: Request) {
            )
        }

-        // SSRF protection: parse-url has no use case for fetching internal
-        // hosts, so private URLs are always rejected. ALLOW_PRIVATE_URLS only
-        // governs LLM provider baseUrl overrides (validate-model, chat).
-        if (isPrivateUrl(url)) {
+        // SSRF protection
+        if (!allowPrivateUrls && isPrivateUrl(url)) {
            return NextResponse.json(
                { error: "Cannot access private/internal URLs" },
                { status: 400 },
--- a/biome.json
+++ b/biome.json
@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.4.14/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.4.4/schema.json",
    "vcs": {
        "enabled": true,
        "clientKind": "git",
--- a/components/chat-panel.tsx
+++ b/components/chat-panel.tsx
@@ -32,7 +32,6 @@ import { useSessionManager } from "@/hooks/use-session-manager"
 import { useValidateDiagram } from "@/hooks/use-validate-diagram"
 import { getApiEndpoint } from "@/lib/base-path"
 import { findCachedResponse } from "@/lib/cached-responses"
-import type { DrawioTheme } from "@/lib/drawio-themes"
 import { formatMessage } from "@/lib/i18n/utils"
 import { isPdfFile, isTextFile } from "@/lib/pdf-utils"
 import { sanitizeMessages } from "@/lib/session-storage"
@@ -69,8 +68,8 @@ interface ChatMessage {
 interface ChatPanelProps {
    isVisible: boolean
    onToggleVisibility: () => void
-    drawioUi: DrawioTheme
-    onDrawioUiChange: (theme: DrawioTheme) => void
+    drawioUi: "min" | "sketch"
+    onToggleDrawioUi: () => void
    darkMode: boolean
    onToggleDarkMode: () => void
    isMobile?: boolean
@@ -111,7 +110,7 @@ export default function ChatPanel({
    isVisible,
    onToggleVisibility,
    drawioUi,
-    onDrawioUiChange,
+    onToggleDrawioUi,
    darkMode,
    onToggleDarkMode,
    isMobile = false,
@@ -1443,7 +1442,7 @@ export default function ChatPanel({
                open={showSettingsDialog}
                onOpenChange={setShowSettingsDialog}
                drawioUi={drawioUi}
-                onDrawioUiChange={onDrawioUiChange}
+                onToggleDrawioUi={onToggleDrawioUi}
                darkMode={darkMode}
                onToggleDarkMode={onToggleDarkMode}
                minimalStyle={minimalStyle}
--- a/components/model-config-dialog.tsx
+++ b/components/model-config-dialog.tsx
@@ -405,7 +405,7 @@ export function ModelConfigDialog({
                            </span>
                        </div>

-                        <ScrollArea className="flex-1 px-2 min-h-0">
+                        <ScrollArea className="flex-1 px-2">
                            <div className="space-y-1 pb-2">
                                {config.providers.length === 0 ? (
                                    <div className="px-3 py-8 text-center">
--- a/components/settings-dialog.tsx
+++ b/components/settings-dialog.tsx
@@ -25,7 +25,6 @@ import { Switch } from "@/components/ui/switch"
 import { Textarea } from "@/components/ui/textarea"
 import { useDictionary } from "@/hooks/use-dictionary"
 import { getApiEndpoint } from "@/lib/base-path"
-import type { DrawioTheme } from "@/lib/drawio-themes"
 import { i18n, type Locale } from "@/lib/i18n/config"
 import { STORAGE_KEYS } from "@/lib/storage"

@@ -64,8 +63,8 @@ const LANGUAGE_LABELS: Record<Locale, string> = {
 interface SettingsDialogProps {
    open: boolean
    onOpenChange: (open: boolean) => void
-    drawioUi: DrawioTheme
-    onDrawioUiChange: (theme: DrawioTheme) => void
+    drawioUi: "min" | "sketch"
+    onToggleDrawioUi: () => void
    darkMode: boolean
    onToggleDarkMode: () => void
    minimalStyle?: boolean
@@ -91,7 +90,7 @@ function SettingsContent({
    open,
    onOpenChange,
    drawioUi,
-    onDrawioUiChange,
+    onToggleDrawioUi,
    darkMode,
    onToggleDarkMode,
    minimalStyle = false,
@@ -135,11 +134,8 @@ function SettingsContent({
    const [isApplyingProxy, setIsApplyingProxy] = useState(false)

    useEffect(() => {
-        // Re-fetch config whenever the dialog opens to ensure we always show
-        // the access code input if the server requires it. This fixes the case
-        // where a stale localStorage cache (from before ACCESS_CODE_LIST was
-        // configured) would hide the access code input.
-        if (!open) return
+        // Only fetch if not cached in localStorage
+        if (getStoredAccessCodeRequired() !== null) return

        fetch(getApiEndpoint("/api/config"))
            .then((res) => {
@@ -155,9 +151,10 @@ function SettingsContent({
                setAccessCodeRequired(required)
            })
            .catch(() => {
-                // Keep existing cached value on error
+                // Don't cache on error - allow retry on next mount
+                setAccessCodeRequired(false)
            })
-    }, [open])
+    }, [])

    // Detect current language from pathname
    useEffect(() => {
@@ -433,40 +430,23 @@ function SettingsContent({
                    {/* Draw.io Style */}
                    <SettingItem
                        label={dict.settings.drawioStyle}
-                        description={dict.settings.drawioStyleDescription}
+                        description={`${dict.settings.drawioStyleDescription} ${
+                            drawioUi === "min"
+                                ? dict.settings.minimal
+                                : dict.settings.sketch
+                        }`}
                    >
-                        <Select
-                            value={drawioUi}
-                            onValueChange={(v) =>
-                                onDrawioUiChange(v as DrawioTheme)
-                            }
+                        <Button
+                            id="drawio-ui"
+                            variant="outline"
+                            onClick={onToggleDrawioUi}
+                            className="h-9 w-[120px] rounded-xl border-border-subtle hover:bg-interactive-hover font-normal"
                        >
-                            <SelectTrigger
-                                id="drawio-ui-select"
-                                aria-label={dict.settings.drawioStyle}
-                                className="w-[120px] h-9 rounded-xl"
-                            >
-                                <SelectValue />
-                            </SelectTrigger>
-                            <SelectContent>
-                                <SelectItem value="kennedy">
-                                    {dict.settings.themeDefault}
-                                </SelectItem>
-                                <SelectItem value="atlas">Atlas</SelectItem>
-                                <SelectItem value="dark">
-                                    {dict.settings.themeDark}
-                                </SelectItem>
-                                <SelectItem value="min">
-                                    {dict.settings.themeMinimal}
-                                </SelectItem>
-                                <SelectItem value="sketch">
-                                    {dict.settings.themeSketch}
-                                </SelectItem>
-                                <SelectItem value="simple">
-                                    {dict.settings.themeSimple}
-                                </SelectItem>
-                            </SelectContent>
-                        </Select>
+                            {dict.settings.switchTo}{" "}
+                            {drawioUi === "min"
+                                ? dict.settings.sketch
+                                : dict.settings.minimal}
+                        </Button>
                    </SettingItem>

                    {/* Diagram Style */}
--- a/docs/cn/ai-providers.md
+++ b/docs/cn/ai-providers.md
@@ -53,13 +53,6 @@ ANTHROPIC_API_KEY=your_api_key
 AI_MODEL=claude-sonnet-4-5-20250514
 ```

-或者使用 Bearer 认证令牌（例如通过会下发 OAuth 风格 token 的网关时）。`ANTHROPIC_AUTH_TOKEN` 会作为 `Authorization: Bearer <token>` 头发送，而 `ANTHROPIC_API_KEY` 会作为 `x-api-key` 头发送。两者互斥，只能设置其中之一：
-
-```bash
-ANTHROPIC_AUTH_TOKEN=your_auth_token
-AI_MODEL=claude-sonnet-4-5-20250514
-```
-
 可选的自定义端点：

 ```bash
@@ -222,7 +215,7 @@ MiniMax 支持两种 API 格式：

 ```bash
 MINIMAX_API_KEY=your_api_key
-AI_MODEL=MiniMax-M3
+AI_MODEL=MiniMax-M2.7
 ```

 可选配置：
--- a/docs/en/ai-providers.md
+++ b/docs/en/ai-providers.md
@@ -68,13 +68,6 @@ ANTHROPIC_API_KEY=your_api_key
 AI_MODEL=claude-sonnet-4-5-20250514
 ```

-Or use a Bearer auth token instead of an API key (e.g. when going through a gateway that issues OAuth-style tokens). `ANTHROPIC_AUTH_TOKEN` is sent as `Authorization: Bearer <token>`, while `ANTHROPIC_API_KEY` is sent as `x-api-key`. The two are mutually exclusive — set only one:
-
-```bash
-ANTHROPIC_AUTH_TOKEN=your_auth_token
-AI_MODEL=claude-sonnet-4-5-20250514
-```
-
 Optional custom endpoint:

 ```bash
@@ -237,7 +230,7 @@ MiniMax supports two API formats:

 ```bash
 MINIMAX_API_KEY=your_api_key
-AI_MODEL=MiniMax-M3
+AI_MODEL=MiniMax-M2.7
 ```

 Optional configuration:
--- a/docs/ja/ai-providers.md
+++ b/docs/ja/ai-providers.md
@@ -53,13 +53,6 @@ ANTHROPIC_API_KEY=your_api_key
 AI_MODEL=claude-sonnet-4-5-20250514
 ```

-または、Bearer 認証トークンを使用することもできます（OAuth スタイルのトークンを発行するゲートウェイ経由で利用する場合など）。`ANTHROPIC_AUTH_TOKEN` は `Authorization: Bearer <token>` ヘッダーで送信され、`ANTHROPIC_API_KEY` は `x-api-key` ヘッダーで送信されます。両者は排他的なので、いずれか一方のみを設定してください:
-
-```bash
-ANTHROPIC_AUTH_TOKEN=your_auth_token
-AI_MODEL=claude-sonnet-4-5-20250514
-```
-
 任意のカスタムエンドポイント:

 ```bash
@@ -222,7 +215,7 @@ MiniMax は 2 つの API 形式をサポートしています：

 ```bash
 MINIMAX_API_KEY=your_api_key
-AI_MODEL=MiniMax-M3
+AI_MODEL=MiniMax-M2.7
 ```

 オプション設定：
--- a/electron/electron-builder.yml
+++ b/electron/electron-builder.yml
@@ -95,10 +95,6 @@ linux:
      arch:
        - x64
        - arm64
-    - target: rpm
-      arch:
-        - x64
-        - arm64

 # Publish configuration (optional)
 publish:
--- a/electron/electron.d.ts
+++ b/electron/electron.d.ts
@@ -101,8 +101,8 @@ declare global {
 }

 export type {
-    ApplyPresetResult,
    ConfigPreset,
+    ApplyPresetResult,
    ProxyConfig,
    SetProxyResult,
    SetUserLocaleResult,
--- a/electron/main/window-manager.ts
+++ b/electron/main/window-manager.ts
@@ -60,13 +60,6 @@ export function createWindow(serverUrl: string): BrowserWindow {
        mainWindow.webContents.openDevTools()
    }

-    // Override the draw.io iframe's beforeunload handler so the window can
-    // close after the user edits text in a shape (fixes #815). Diagrams are
-    // already persisted via autosave, so the prompt is unnecessary.
-    mainWindow.webContents.on("will-prevent-unload", (event) => {
-        event.preventDefault()
-    })
-
    mainWindow.on("closed", () => {
        mainWindow = null
    })
--- a/env.example
+++ b/env.example
@@ -25,8 +25,7 @@ AI_MODEL=global.anthropic.claude-sonnet-4-5-20250929-v1:0
 # OPENAI_REASONING_SUMMARY=detailed  # Optional: Override reasoning summary (none/brief/detailed)

 # Anthropic (Direct) Configuration
-# ANTHROPIC_API_KEY=sk-ant-...                 # Sent as `x-api-key` header
-# ANTHROPIC_AUTH_TOKEN=                        # Alternative to ANTHROPIC_API_KEY; sent as `Authorization: Bearer` header (mutually exclusive)
+# ANTHROPIC_API_KEY=sk-ant-...
 # ANTHROPIC_BASE_URL=https://your-custom-anthropic/v1
 # ANTHROPIC_THINKING_TYPE=enabled            # Optional: Anthropic extended thinking (enabled)
 # ANTHROPIC_THINKING_BUDGET_TOKENS=12000     # Optional: Budget for extended thinking in tokens
--- a/lib/ai-providers.ts
+++ b/lib/ai-providers.ts
@@ -573,15 +573,7 @@ function detectProvider(): ProviderName | null {
            // Skip ollama - it doesn't require credentials
            continue
        }
-        // Anthropic accepts ANTHROPIC_AUTH_TOKEN (Bearer auth) as alternative to ANTHROPIC_API_KEY
-        const hasCredential =
-            provider === "anthropic"
-                ? !!(
-                      process.env.ANTHROPIC_API_KEY ||
-                      process.env.ANTHROPIC_AUTH_TOKEN
-                  )
-                : !!process.env[envVar]
-        if (hasCredential) {
+        if (process.env[envVar]) {
            // Azure requires additional config (baseURL or resourceName)
            if (provider === "azure") {
                const hasBaseUrl = !!process.env.AZURE_BASE_URL
@@ -623,26 +615,13 @@ function validateProviderCredentials(
        return
    }

-    // Anthropic accepts ANTHROPIC_AUTH_TOKEN (Bearer auth) as alternative to ANTHROPIC_API_KEY
-    if (provider === "anthropic" && !customApiKeyEnv) {
-        const hasCredential = !!(
-            process.env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_AUTH_TOKEN
+    // Use custom env var name if provided, otherwise use default
+    const requiredVar = customApiKeyEnv || PROVIDER_ENV_VARS[provider]
+    if (requiredVar && !process.env[requiredVar]) {
+        throw new Error(
+            `${requiredVar} environment variable is required for ${provider} provider. ` +
+                `Please set it in your .env.local file.`,
        )
-        if (!hasCredential) {
-            throw new Error(
-                `Either ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN environment variable is required for anthropic provider. ` +
-                    `Please set one in your .env.local file.`,
-            )
-        }
-    } else {
-        // Use custom env var name if provided, otherwise use default
-        const requiredVar = customApiKeyEnv || PROVIDER_ENV_VARS[provider]
-        if (requiredVar && !process.env[requiredVar]) {
-            throw new Error(
-                `${requiredVar} environment variable is required for ${provider} provider. ` +
-                    `Please set it in your .env.local file.`,
-            )
-        }
    }

    // Azure requires either AZURE_BASE_URL or AZURE_RESOURCE_NAME in addition to API key
@@ -866,16 +845,8 @@ export function getAIModel(overrides?: ClientOverrides): ModelConfig {
                serverBaseUrl,
                "https://api.anthropic.com/v1",
            )
-            // Anthropic supports two auth methods (mutually exclusive):
-            // - apiKey: sends as `x-api-key` header
-            // - authToken: sends as `Authorization: Bearer <token>` header
-            // Prefer apiKey if present (including client overrides); fall back
-            // to ANTHROPIC_AUTH_TOKEN env var only when no apiKey is available.
-            const authToken = !apiKey
-                ? process.env.ANTHROPIC_AUTH_TOKEN
-                : undefined
            const customProvider = createAnthropic({
-                ...(authToken ? { authToken } : { apiKey }),
+                apiKey,
                baseURL,
                headers: ANTHROPIC_BETA_HEADERS,
            })
@@ -1291,6 +1262,7 @@ export function getAIModel(overrides?: ClientOverrides): ModelConfig {
        case "glm":
        case "qwen":
        case "qiniu":
+        case "kimi":
        case "novita": {
            const envVar = PROVIDER_ENV_VARS[provider]
            if (!envVar) {
@@ -1316,23 +1288,6 @@ export function getAIModel(overrides?: ClientOverrides): ModelConfig {
            break
        }

-        case "kimi": {
-            const apiKey = resolveApiKey(overrides, "KIMI_API_KEY")
-            const baseURL = resolveBaseURL(
-                overrides?.apiKey,
-                overrides?.baseUrl,
-                resolveBaseUrlEnv(overrides, "KIMI_BASE_URL"),
-                PROVIDER_INFO["kimi"]?.defaultBaseUrl,
-            )
-            // Use createDeepSeek to properly handle reasoning_content for Kimi
-            // thinking models (e.g., kimi-k2.6). Kimi's API uses the same
-            // reasoning_content field as DeepSeek, so this provider correctly
-            // captures and replays reasoning in multi-turn conversations.
-            const customProvider = createDeepSeek({ apiKey, baseURL })
-            model = customProvider(modelId)
-            break
-        }
-
        default:
            throw new Error(
                `Unknown AI provider: ${provider}. Supported providers: bedrock, openai, anthropic, google, azure, ollama, openrouter, deepseek, siliconflow, sglang, gateway, edgeone, doubao, modelscope, glm, qwen, qiniu, kimi, minimax, novita`,
@@ -1390,12 +1345,8 @@ export function supportsImageInput(modelId: string): boolean {
        return false
    }

-    // MiniMax text models (MiniMax-M2.x series are text-only; M3 supports image input)
-    if (
-        lowerModelId.includes("minimax") &&
-        !hasVisionIndicator &&
-        !lowerModelId.includes("m3")
-    ) {
+    // MiniMax text models (MiniMax-M2.x series are text-only)
+    if (lowerModelId.includes("minimax") && !hasVisionIndicator) {
        return false
    }

@@ -1406,12 +1357,10 @@ export function supportsImageInput(modelId: string): boolean {

    // Qwen text models (not vision variants like qwen-vl)
    // Qwen3.5 series (qwen3.5, qwen3.5-plus, qwen3.5-flash) natively support image input
-    // QvQ (Qwen Visual QA) models are vision models — exclude them even when prefixed with "qwen/"
    if (
        lowerModelId.includes("qwen") &&
        !hasVisionIndicator &&
-        !lowerModelId.includes("qwen3.5") &&
-        !lowerModelId.includes("qvq")
+        !lowerModelId.includes("qwen3.5")
    ) {
        return false
    }
--- a/lib/drawio-themes.ts
+++ b/lib/drawio-themes.ts
@@ -1,17 +0,0 @@
-export const DRAWIO_THEMES = [
-    "kennedy",
-    "atlas",
-    "dark",
-    "min",
-    "sketch",
-    "simple",
-] as const
-
-export type DrawioTheme = (typeof DRAWIO_THEMES)[number]
-
-export function isDrawioTheme(value: unknown): value is DrawioTheme {
-    return (
-        typeof value === "string" &&
-        (DRAWIO_THEMES as readonly string[]).includes(value)
-    )
-}
--- a/lib/i18n/dictionaries/en.json
+++ b/lib/i18n/dictionaries/en.json
@@ -102,12 +102,10 @@
        "theme": "Theme",
        "themeDescription": "Dark/Light mode for interface and DrawIO canvas.",
        "drawioStyle": "DrawIO Style",
-        "drawioStyleDescription": "Canvas style",
-        "themeDefault": "Default",
-        "themeDark": "Dark",
-        "themeMinimal": "Minimal",
-        "themeSketch": "Sketch",
-        "themeSimple": "Simple",
+        "drawioStyleDescription": "Canvas style:",
+        "switchTo": "Switch to",
+        "minimal": "Minimal",
+        "sketch": "Sketch",
        "diagramStyle": "Diagram Style",
        "diagramStyleDescription": "Toggle between minimal and styled diagram output.",
        "sendShortcut": "Send Shortcut",
--- a/lib/i18n/dictionaries/ja.json
+++ b/lib/i18n/dictionaries/ja.json
@@ -102,12 +102,10 @@
        "theme": "テーマ",
        "themeDescription": "インターフェースと DrawIO キャンバスのダーク/ライトモード。",
        "drawioStyle": "DrawIO スタイル",
-        "drawioStyleDescription": "キャンバススタイル",
-        "themeDefault": "デフォルト",
-        "themeDark": "ダーク",
-        "themeMinimal": "ミニマル",
-        "themeSketch": "スケッチ",
-        "themeSimple": "シンプル",
+        "drawioStyleDescription": "キャンバススタイル：",
+        "switchTo": "切り替え",
+        "minimal": "ミニマル",
+        "sketch": "スケッチ",
        "diagramStyle": "ダイアグラムスタイル",
        "diagramStyleDescription": "ミニマルとスタイル付きの出力を切り替えます。",
        "sendShortcut": "送信ショートカット",
--- a/lib/i18n/dictionaries/zh-Hant.json
+++ b/lib/i18n/dictionaries/zh-Hant.json
@@ -102,12 +102,10 @@
        "theme": "主題",
        "themeDescription": "介面和 DrawIO 畫布的深色/淺色模式。",
        "drawioStyle": "DrawIO 樣式",
-        "drawioStyleDescription": "畫布樣式",
-        "themeDefault": "預設",
-        "themeDark": "深色",
-        "themeMinimal": "簡約",
-        "themeSketch": "草圖",
-        "themeSimple": "簡單",
+        "drawioStyleDescription": "畫布樣式：",
+        "switchTo": "切換到",
+        "minimal": "簡約",
+        "sketch": "草圖",
        "diagramStyle": "圖表樣式",
        "diagramStyleDescription": "切換簡約與精緻圖表輸出模式。",
        "sendShortcut": "傳送快捷鍵",
--- a/lib/i18n/dictionaries/zh.json
+++ b/lib/i18n/dictionaries/zh.json
@@ -102,12 +102,10 @@
        "theme": "主题",
        "themeDescription": "界面和 DrawIO 画布的深色/浅色模式。",
        "drawioStyle": "DrawIO 样式",
-        "drawioStyleDescription": "画布样式",
-        "themeDefault": "默认",
-        "themeDark": "深色",
-        "themeMinimal": "简约",
-        "themeSketch": "草图",
-        "themeSimple": "简单",
+        "drawioStyleDescription": "画布样式：",
+        "switchTo": "切换到",
+        "minimal": "简约",
+        "sketch": "草图",
        "diagramStyle": "图表样式",
        "diagramStyleDescription": "切换简约与精致图表输出模式。",
        "sendShortcut": "发送快捷键",
--- a/lib/session-storage.ts
+++ b/lib/session-storage.ts
@@ -58,6 +58,33 @@ interface ChatSessionDB extends DBSchema {

 // Database singleton
 let dbPromise: Promise<IDBPDatabase<ChatSessionDB>> | null = null
+const resetDBPromise = () => {
+    dbPromise = null
+}
+
+const isClosingError = (error: unknown): boolean => {
+    return (
+        error instanceof DOMException &&
+        error.name === "InvalidStateError" &&
+        /closing/i.test(error.message)
+    )
+}
+
+const withDB = async <T>(
+    action: (db: IDBPDatabase<ChatSessionDB>) => Promise<T>,
+): Promise<T> => {
+    try {
+        const db = await getDB()
+        return await action(db)
+    } catch (error) {
+        if (isClosingError(error)) {
+            resetDBPromise()
+            const db = await getDB()
+            return await action(db)
+        }
+        throw error
+    }
+}

 async function getDB(): Promise<IDBPDatabase<ChatSessionDB>> {
    if (!dbPromise) {
@@ -88,7 +115,23 @@ async function getDB(): Promise<IDBPDatabase<ChatSessionDB>> {
                    }
                }
            },
+            terminated() {
+                resetDBPromise()
+            },
        })
+        dbPromise
+            .then((db) => {
+                db.onversionchange = () => {
+                    db.close()
+                    resetDBPromise()
+                }
+                db.onclose = () => {
+                    resetDBPromise()
+                }
+            })
+            .catch(() => {
+                resetDBPromise()
+            })
    }
    return dbPromise
 }
@@ -103,31 +146,46 @@ export function isIndexedDBAvailable(): boolean {
    }
 }

+// Check if IndexedDB is actually usable (not just present).
+// Note: Do NOT close the db here - getDB() returns a shared singleton connection
+// that other code depends on.
+export async function isIndexedDBUsable(): Promise<boolean> {
+    if (!isIndexedDBAvailable()) return false
+    try {
+        await getDB()
+        return true
+    } catch {
+        return false
+    }
+}
+
 // CRUD Operations
 export async function getAllSessionMetadata(): Promise<SessionMetadata[]> {
    if (!isIndexedDBAvailable()) return []
    try {
-        const db = await getDB()
-        const tx = db.transaction(STORE_NAME, "readonly")
-        const index = tx.store.index("by-updated")
-        const metadata: SessionMetadata[] = []
+        return await withDB(async (db) => {
+            const tx = db.transaction(STORE_NAME, "readonly")
+            const index = tx.store.index("by-updated")
+            const metadata: SessionMetadata[] = []

-        // Use cursor to read only metadata fields (avoids loading full messages/XML)
-        let cursor = await index.openCursor(null, "prev") // newest first
-        while (cursor) {
-            const s = cursor.value
-            metadata.push({
-                id: s.id,
-                title: s.title,
-                createdAt: s.createdAt,
-                updatedAt: s.updatedAt,
-                messageCount: s.messages.length,
-                hasDiagram: !!s.diagramXml && s.diagramXml.trim().length > 0,
-                thumbnailDataUrl: s.thumbnailDataUrl,
-            })
-            cursor = await cursor.continue()
-        }
-        return metadata
+            // Use cursor to read only metadata fields (avoids loading full messages/XML)
+            let cursor = await index.openCursor(null, "prev") // newest first
+            while (cursor) {
+                const s = cursor.value
+                metadata.push({
+                    id: s.id,
+                    title: s.title,
+                    createdAt: s.createdAt,
+                    updatedAt: s.updatedAt,
+                    messageCount: s.messages.length,
+                    hasDiagram:
+                        !!s.diagramXml && s.diagramXml.trim().length > 0,
+                    thumbnailDataUrl: s.thumbnailDataUrl,
+                })
+                cursor = await cursor.continue()
+            }
+            return metadata
+        })
    } catch (error) {
        console.error("Failed to get session metadata:", error)
        return []
@@ -137,8 +195,9 @@ export async function getAllSessionMetadata(): Promise<SessionMetadata[]> {
 export async function getSession(id: string): Promise<ChatSession | null> {
    if (!isIndexedDBAvailable()) return null
    try {
-        const db = await getDB()
-        return (await db.get(STORE_NAME, id)) || null
+        return await withDB(async (db) => {
+            return (await db.get(STORE_NAME, id)) || null
+        })
    } catch (error) {
        console.error("Failed to get session:", error)
        return null
@@ -148,8 +207,9 @@ export async function getSession(id: string): Promise<ChatSession | null> {
 export async function saveSession(session: ChatSession): Promise<boolean> {
    if (!isIndexedDBAvailable()) return false
    try {
-        const db = await getDB()
-        await db.put(STORE_NAME, session)
+        await withDB(async (db) => {
+            await db.put(STORE_NAME, session)
+        })
        return true
    } catch (error) {
        // Handle quota exceeded
@@ -161,8 +221,9 @@ export async function saveSession(session: ChatSession): Promise<boolean> {
            await deleteOldestSession()
            // Retry once
            try {
-                const db = await getDB()
-                await db.put(STORE_NAME, session)
+                await withDB(async (db) => {
+                    await db.put(STORE_NAME, session)
+                })
                return true
            } catch (retryError) {
                console.error(
@@ -181,8 +242,9 @@ export async function saveSession(session: ChatSession): Promise<boolean> {
 export async function deleteSession(id: string): Promise<void> {
    if (!isIndexedDBAvailable()) return
    try {
-        const db = await getDB()
-        await db.delete(STORE_NAME, id)
+        await withDB(async (db) => {
+            await db.delete(STORE_NAME, id)
+        })
    } catch (error) {
        console.error("Failed to delete session:", error)
    }
@@ -191,8 +253,9 @@ export async function deleteSession(id: string): Promise<void> {
 export async function getSessionCount(): Promise<number> {
    if (!isIndexedDBAvailable()) return 0
    try {
-        const db = await getDB()
-        return await db.count(STORE_NAME)
+        return await withDB(async (db) => {
+            return await db.count(STORE_NAME)
+        })
    } catch (error) {
        console.error("Failed to get session count:", error)
        return 0
@@ -202,14 +265,15 @@ export async function getSessionCount(): Promise<number> {
 export async function deleteOldestSession(): Promise<void> {
    if (!isIndexedDBAvailable()) return
    try {
-        const db = await getDB()
-        const tx = db.transaction(STORE_NAME, "readwrite")
-        const index = tx.store.index("by-updated")
-        const cursor = await index.openCursor()
-        if (cursor) {
-            await cursor.delete()
-        }
-        await tx.done
+        await withDB(async (db) => {
+            const tx = db.transaction(STORE_NAME, "readwrite")
+            const index = tx.store.index("by-updated")
+            const cursor = await index.openCursor()
+            if (cursor) {
+                await cursor.delete()
+            }
+            await tx.done
+        })
    } catch (error) {
        console.error("Failed to delete oldest session:", error)
    }
--- a/lib/ssrf-protection.ts
+++ b/lib/ssrf-protection.ts
@@ -9,40 +9,17 @@
 export function isPrivateUrl(urlString: string): boolean {
    try {
        const url = new URL(urlString)
-        // Strip a trailing dot so FQDN forms like "localhost." (which still
-        // resolve to 127.0.0.1) cannot bypass the equality checks below.
-        const hostname = url.hostname
-            .toLowerCase()
-            .replace(/^\[|\]$/g, "")
-            .replace(/\.$/, "")
+        const hostname = url.hostname.toLowerCase()

        // Block localhost
        if (
            hostname === "localhost" ||
            hostname === "127.0.0.1" ||
-            hostname === "::1" ||
-            hostname === "::"
+            hostname === "::1"
        ) {
            return true
        }

-        // Block IPv6 unique-local (fc00::/7), link-local (fe80::/10),
-        // and IPv4-mapped (::ffff:0:0/96) hosts.
-        if (hostname.includes(":")) {
-            if (
-                hostname.startsWith("fc") ||
-                hostname.startsWith("fd") ||
-                hostname.startsWith("::ffff:")
-            ) {
-                return true
-            }
-            const linkLocal = hostname.match(/^fe([0-9a-f]{2}):/)
-            if (linkLocal) {
-                const high = parseInt(linkLocal[1], 16)
-                if (high >= 0x80 && high <= 0xbf) return true
-            }
-        }
-
        // Block AWS/cloud metadata endpoints
        if (
            hostname === "169.254.169.254" ||
--- a/lib/template-storage.ts
+++ b/lib/template-storage.ts
@@ -57,6 +57,33 @@ export function generateDefaultTitle(prompt: string): string {

 // Database singleton
 let dbPromise: Promise<IDBPDatabase<TemplateDB>> | null = null
+const resetDBPromise = () => {
+    dbPromise = null
+}
+
+const isClosingError = (error: unknown): boolean => {
+    return (
+        error instanceof DOMException &&
+        error.name === "InvalidStateError" &&
+        /closing/i.test(error.message)
+    )
+}
+
+const withDB = async <T>(
+    action: (db: IDBPDatabase<TemplateDB>) => Promise<T>,
+): Promise<T> => {
+    try {
+        const db = await getDB()
+        return await action(db)
+    } catch (error) {
+        if (isClosingError(error)) {
+            resetDBPromise()
+            const db = await getDB()
+            return await action(db)
+        }
+        throw error
+    }
+}

 async function getDB(): Promise<IDBPDatabase<TemplateDB>> {
    if (!dbPromise) {
@@ -74,7 +101,23 @@ async function getDB(): Promise<IDBPDatabase<TemplateDB>> {
                    }
                }
            },
+            terminated() {
+                resetDBPromise()
+            },
        })
+        dbPromise
+            .then((db) => {
+                db.onversionchange = () => {
+                    db.close()
+                    resetDBPromise()
+                }
+                db.onclose = () => {
+                    resetDBPromise()
+                }
+            })
+            .catch(() => {
+                resetDBPromise()
+            })
    }
    return dbPromise
 }
@@ -94,9 +137,10 @@ export function isIndexedDBAvailable(): boolean {
 export async function getAllTemplates(): Promise<Template[]> {
    if (!isIndexedDBAvailable()) return []
    try {
-        const db = await getDB()
-        const templates = await db.getAll(STORE_NAME)
-        return sortTemplates(templates)
+        return await withDB(async (db) => {
+            const templates = await db.getAll(STORE_NAME)
+            return sortTemplates(templates)
+        })
    } catch (error) {
        console.error("Failed to get templates:", error)
        return []
@@ -106,8 +150,9 @@ export async function getAllTemplates(): Promise<Template[]> {
 export async function getTemplate(id: string): Promise<Template | null> {
    if (!isIndexedDBAvailable()) return null
    try {
-        const db = await getDB()
-        return (await db.get(STORE_NAME, id)) || null
+        return await withDB(async (db) => {
+            return (await db.get(STORE_NAME, id)) || null
+        })
    } catch (error) {
        console.error("Failed to get template:", error)
        return null
@@ -137,8 +182,9 @@ export async function createTemplate(
    }

    try {
-        const db = await getDB()
-        await db.put(STORE_NAME, template)
+        await withDB(async (db) => {
+            await db.put(STORE_NAME, template)
+        })
        return template
    } catch (error) {
        console.error("Failed to create template:", error)
@@ -152,19 +198,20 @@ export async function updateTemplate(
 ): Promise<Template | null> {
    if (!isIndexedDBAvailable()) return null
    try {
-        const db = await getDB()
-        const existing = await db.get(STORE_NAME, id)
-        if (!existing) return null
+        return await withDB(async (db) => {
+            const existing = await db.get(STORE_NAME, id)
+            if (!existing) return null

-        const updated: Template = {
-            ...existing,
-            ...updates,
-            id: existing.id,
-            createdAt: existing.createdAt,
-            updatedAt: Date.now(),
-        }
-        await db.put(STORE_NAME, updated)
-        return updated
+            const updated: Template = {
+                ...existing,
+                ...updates,
+                id: existing.id,
+                createdAt: existing.createdAt,
+                updatedAt: Date.now(),
+            }
+            await db.put(STORE_NAME, updated)
+            return updated
+        })
    } catch (error) {
        console.error("Failed to update template:", error)
        return null
@@ -174,8 +221,9 @@ export async function updateTemplate(
 export async function deleteTemplate(id: string): Promise<boolean> {
    if (!isIndexedDBAvailable()) return false
    try {
-        const db = await getDB()
-        await db.delete(STORE_NAME, id)
+        await withDB(async (db) => {
+            await db.delete(STORE_NAME, id)
+        })
        return true
    } catch (error) {
        console.error("Failed to delete template:", error)
@@ -189,24 +237,25 @@ export async function duplicateTemplate(
 ): Promise<Template | null> {
    if (!isIndexedDBAvailable()) return null
    try {
-        const db = await getDB()
-        const existing = await db.get(STORE_NAME, id)
-        if (!existing) return null
+        return await withDB(async (db) => {
+            const existing = await db.get(STORE_NAME, id)
+            if (!existing) return null

-        const now = Date.now()
-        const duplicate: Template = {
-            ...existing,
-            id: nanoid(),
-            title: `${existing.title} ${copySuffix}`,
-            createdAt: now,
-            updatedAt: now,
-            clickCount: 0,
-            runCount: 0,
-            lastUsedAt: 0,
-            pinned: false,
-        }
-        await db.put(STORE_NAME, duplicate)
-        return duplicate
+            const now = Date.now()
+            const duplicate: Template = {
+                ...existing,
+                id: nanoid(),
+                title: `${existing.title} ${copySuffix}`,
+                createdAt: now,
+                updatedAt: now,
+                clickCount: 0,
+                runCount: 0,
+                lastUsedAt: 0,
+                pinned: false,
+            }
+            await db.put(STORE_NAME, duplicate)
+            return duplicate
+        })
    } catch (error) {
        console.error("Failed to duplicate template:", error)
        return null
@@ -218,12 +267,13 @@ export async function duplicateTemplate(
 export async function incrementClickCount(id: string): Promise<void> {
    if (!isIndexedDBAvailable()) return
    try {
-        const db = await getDB()
-        const template = await db.get(STORE_NAME, id)
-        if (!template) return
-        template.clickCount += 1
-        template.updatedAt = Date.now()
-        await db.put(STORE_NAME, template)
+        await withDB(async (db) => {
+            const template = await db.get(STORE_NAME, id)
+            if (!template) return
+            template.clickCount += 1
+            template.updatedAt = Date.now()
+            await db.put(STORE_NAME, template)
+        })
    } catch (error) {
        console.error("Failed to increment click count:", error)
    }
@@ -232,14 +282,15 @@ export async function incrementClickCount(id: string): Promise<void> {
 export async function incrementRunCount(id: string): Promise<void> {
    if (!isIndexedDBAvailable()) return
    try {
-        const db = await getDB()
-        const template = await db.get(STORE_NAME, id)
-        if (!template) return
-        const now = Date.now()
-        template.runCount += 1
-        template.lastUsedAt = now
-        template.updatedAt = now
-        await db.put(STORE_NAME, template)
+        await withDB(async (db) => {
+            const template = await db.get(STORE_NAME, id)
+            if (!template) return
+            const now = Date.now()
+            template.runCount += 1
+            template.lastUsedAt = now
+            template.updatedAt = now
+            await db.put(STORE_NAME, template)
+        })
    } catch (error) {
        console.error("Failed to increment run count:", error)
    }
@@ -372,8 +423,9 @@ export async function importTemplates(
            pinned: typeof t.pinned === "boolean" ? t.pinned : false,
        }
        try {
-            const db = await getDB()
-            await db.put(STORE_NAME, newTemplate)
+            await withDB(async (db) => {
+                await db.put(STORE_NAME, newTemplate)
+            })
            existingKeys.add(key)
            imported++
        } catch (error) {
--- a/lib/types/model-config.ts
+++ b/lib/types/model-config.ts
@@ -190,202 +190,177 @@ export const PROVIDER_INFO: Record<
 // Suggested models per provider for quick add
 export const SUGGESTED_MODELS: Partial<Record<ProviderName, string[]>> = {
    openai: [
-        "gpt-5.5-pro",
-        "gpt-5.5",
-        "gpt-5.4-pro",
-        "gpt-5.4",
-        "gpt-5.4-mini",
-        "gpt-5.4-nano",
-        "gpt-5-codex-mini",
+        "gpt-5.2-pro",
+        "gpt-5.2-chat-latest",
+        "gpt-5.2",
+        "gpt-5.1-codex-mini",
+        "gpt-5.1-codex",
+        "gpt-5.1-chat-latest",
+        "gpt-5.1",
+        "gpt-5-pro",
+        "gpt-5",
+        "gpt-5-mini",
+        "gpt-5-nano",
+        "gpt-5-codex",
+        "gpt-5-chat-latest",
        "gpt-4.1",
        "gpt-4.1-mini",
+        "gpt-4.1-nano",
        "gpt-4o",
        "gpt-4o-mini",
    ],
    anthropic: [
-        // Claude 4.8 / 4.7 / 4.6 series (latest, dateless pinned IDs)
-        "claude-opus-4-8",
-        "claude-sonnet-4-6",
-        "claude-haiku-4-5",
-        "claude-opus-4-7",
-        "claude-opus-4-6",
-        // Claude 4.5 series
-        "claude-sonnet-4-5-20250929",
-        "claude-opus-4-5-20251101",
+        // Claude 4.5 series (latest)
+        "claude-opus-4-5-20250514",
+        "claude-sonnet-4-5-20250514",
+        // Claude 4 series
+        "claude-opus-4-20250514",
+        "claude-sonnet-4-20250514",
        // Claude 3.7 series
        "claude-3-7-sonnet-20250219",
        // Claude 3.5 series
        "claude-3-5-sonnet-20241022",
        "claude-3-5-haiku-20241022",
+        // Claude 3 series
+        "claude-3-opus-20240229",
+        "claude-3-sonnet-20240229",
+        "claude-3-haiku-20240307",
    ],
    google: [
-        // Gemini 3 series
-        "gemini-3.1-pro",
-        "gemini-3.5-flash",
-        "gemini-3-flash",
-        "gemini-3.1-flash-lite",
        // Gemini 2.5 series
        "gemini-2.5-pro",
        "gemini-2.5-flash",
-        "gemini-2.5-flash-lite",
+        "gemini-2.5-flash-preview-05-20",
+        // Gemini 2.0 series
+        "gemini-2.0-flash",
+        "gemini-2.0-flash-exp",
+        "gemini-2.0-flash-lite",
+        // Gemini 1.5 series
+        "gemini-1.5-pro",
+        "gemini-1.5-flash",
+        // Legacy
+        "gemini-pro",
    ],
    vertexai: [
-        // Gemini 3 series
-        "gemini-3.1-pro-preview",
-        "gemini-3.5-flash",
-        "gemini-3-flash-preview",
-        "gemini-3.1-flash-lite",
        // Gemini 2.5 series
        "gemini-2.5-pro",
        "gemini-2.5-flash",
-        "gemini-2.5-flash-lite",
-    ],
-    azure: [
-        "gpt-5.5",
-        "gpt-5.4",
-        "gpt-5.1",
-        "gpt-5",
-        "gpt-5-mini",
-        "gpt-4.1",
-        "gpt-4o",
-        "gpt-4o-mini",
-        "o3",
-        "o4-mini",
+        // Gemini 2.0 series
+        "gemini-2.0-flash",
+        "gemini-2.0-flash-exp",
+        // Gemini 1.5 series
+        "gemini-1.5-pro",
+        "gemini-1.5-flash",
    ],
+    azure: ["gpt-4o", "gpt-4o-mini", "gpt-4-turbo", "gpt-4", "gpt-35-turbo"],
    bedrock: [
        // Anthropic Claude
-        "anthropic.claude-opus-4-8",
-        "anthropic.claude-opus-4-7",
-        "anthropic.claude-sonnet-4-6",
-        "anthropic.claude-opus-4-6-v1",
-        "anthropic.claude-opus-4-5-20251101-v1:0",
-        "anthropic.claude-sonnet-4-5-20250929-v1:0",
-        "anthropic.claude-haiku-4-5-20251001-v1:0",
-        "anthropic.claude-opus-4-1-20250805-v1:0",
+        "anthropic.claude-opus-4-5-20250514-v1:0",
+        "anthropic.claude-sonnet-4-5-20250514-v1:0",
        "anthropic.claude-opus-4-20250514-v1:0",
        "anthropic.claude-sonnet-4-20250514-v1:0",
+        "anthropic.claude-3-7-sonnet-20250219-v1:0",
+        "anthropic.claude-3-5-sonnet-20241022-v2:0",
        "anthropic.claude-3-5-haiku-20241022-v1:0",
+        "anthropic.claude-3-opus-20240229-v1:0",
+        "anthropic.claude-3-sonnet-20240229-v1:0",
+        "anthropic.claude-3-haiku-20240307-v1:0",
        // Amazon Nova
-        "amazon.nova-2-lite-v1:0",
-        "amazon.nova-premier-v1:0",
        "amazon.nova-pro-v1:0",
        "amazon.nova-lite-v1:0",
        "amazon.nova-micro-v1:0",
        // Meta Llama
-        "meta.llama4-maverick-17b-instruct-v1:0",
-        "meta.llama4-scout-17b-instruct-v1:0",
        "meta.llama3-3-70b-instruct-v1:0",
+        "meta.llama3-1-405b-instruct-v1:0",
+        "meta.llama3-1-70b-instruct-v1:0",
        // Mistral
-        "mistral.mistral-large-3-675b-instruct",
-        "mistral.pixtral-large-2502-v1:0",
+        "mistral.mistral-large-2411-v1:0",
+        "mistral.mistral-small-2503-v1:0",
    ],
    openrouter: [
        // Anthropic
-        "anthropic/claude-opus-4.8",
-        "anthropic/claude-sonnet-4.6",
-        "anthropic/claude-haiku-4.5",
+        "anthropic/claude-sonnet-4",
+        "anthropic/claude-opus-4",
+        "anthropic/claude-3.5-sonnet",
+        "anthropic/claude-3.5-haiku",
        // OpenAI
-        "openai/gpt-5.5",
-        "openai/gpt-5.4",
-        "openai/gpt-5.4-mini",
+        "openai/gpt-4o",
        "openai/gpt-4o-mini",
+        "openai/o1",
+        "openai/o3-mini",
        // Google
-        "google/gemini-3.1-pro-preview",
-        "google/gemini-3.5-flash",
-        "google/gemini-2.5-flash-lite",
-        // xAI
-        "x-ai/grok-4.3",
+        "google/gemini-2.5-pro",
+        "google/gemini-2.5-flash",
+        "google/gemini-2.0-flash-exp:free",
        // Meta Llama
-        "meta-llama/llama-4-maverick",
-        "meta-llama/llama-4-scout",
        "meta-llama/llama-3.3-70b-instruct",
+        "meta-llama/llama-3.1-405b-instruct",
+        "meta-llama/llama-3.1-70b-instruct",
        // DeepSeek
-        "deepseek/deepseek-v4-pro",
-        "deepseek/deepseek-v3.2",
+        "deepseek/deepseek-chat",
+        "deepseek/deepseek-r1",
        // Qwen
-        "qwen/qwen3.7-max",
-        "qwen/qwen3-coder",
-        // MiniMax
-        "minimax/minimax-m3",
-    ],
-    deepseek: [
-        "deepseek-v4-pro",
-        "deepseek-v4-flash",
-        "deepseek-chat",
-        "deepseek-reasoner",
+        "qwen/qwen-2.5-72b-instruct",
    ],
+    deepseek: ["deepseek-chat", "deepseek-reasoner", "deepseek-coder"],
    siliconflow: [
        // DeepSeek
-        "deepseek-ai/DeepSeek-V4-Pro",
-        "deepseek-ai/DeepSeek-V4-Flash",
-        "deepseek-ai/DeepSeek-V3.2",
-        // MiniMax
-        "MiniMaxAI/MiniMax-M3",
-        // Moonshot
-        "moonshotai/Kimi-K2.6",
-        // Z.ai
-        "zai-org/GLM-5",
+        "deepseek-ai/DeepSeek-V3",
+        "deepseek-ai/DeepSeek-R1",
+        "deepseek-ai/DeepSeek-V2.5",
        // Qwen
-        "Qwen/Qwen3.6-35B-A3B",
-        "Qwen/Qwen3-Coder-480B-A35B-Instruct",
-        "Qwen/Qwen3-30B-A3B-Instruct-2507",
-        "Qwen/Qwen3-VL-32B-Instruct",
-        // OpenAI open-weights
-        "openai/gpt-oss-120b",
+        "Qwen/Qwen2.5-72B-Instruct",
+        "Qwen/Qwen2.5-32B-Instruct",
+        "Qwen/Qwen2.5-Coder-32B-Instruct",
+        "Qwen/Qwen2.5-7B-Instruct",
+        "Qwen/Qwen2-VL-72B-Instruct",
+        "qwen3.5-plus",
    ],
    sglang: [
        // SGLang is OpenAI-compatible, models depend on deployment
        "default",
    ],
    gateway: [
-        "openai/gpt-5.5",
-        "anthropic/claude-opus-4.7",
-        "google/gemini-3.1-pro-preview",
-        "xai/grok-4.3",
-        "anthropic/claude-sonnet-4.6",
-        "anthropic/claude-haiku-4.5",
-        "openai/gpt-5.4-mini",
+        "openai/gpt-4o",
+        "openai/gpt-4o-mini",
+        "anthropic/claude-sonnet-4-5",
+        "anthropic/claude-3-5-sonnet",
+        "google/gemini-2.0-flash",
    ],
    edgeone: ["@tx/deepseek-ai/deepseek-v32"],
    doubao: [
-        // ByteDance Doubao models (Volcengine Ark IDs use dash form)
-        "doubao-seed-2-0-pro-260215",
-        "doubao-seed-2-0-lite-260428",
-        "doubao-seed-2-0-mini-260428",
-        "doubao-seed-1-8-251228",
-        "doubao-seed-1-6-251015",
-        "doubao-seed-1-6-flash-250828",
-        "doubao-seed-1-6-vision-250815",
-        "doubao-1-5-pro-32k-250115",
-        "doubao-1-5-lite-32k-250115",
+        // ByteDance Doubao models
+        "doubao-1.5-thinking-pro-250415",
+        "doubao-1.5-thinking-pro-m-250428",
+        "doubao-1.5-pro-32k-250115",
+        "doubao-1.5-pro-256k-250115",
+        "doubao-pro-32k-241215",
+        "doubao-pro-256k-241215",
    ],
    modelscope: [
-        // DeepSeek
-        "deepseek-ai/DeepSeek-V4-Pro",
-        "deepseek-ai/DeepSeek-V3.2",
-        "deepseek-ai/DeepSeek-R1-0528",
-        "deepseek-ai/DeepSeek-R1",
        // Qwen
+        "Qwen/Qwen2.5-72B-Instruct",
+        "Qwen/Qwen2.5-32B-Instruct",
        "Qwen/Qwen3-235B-A22B-Instruct-2507",
        "Qwen/Qwen3-VL-235B-A22B-Instruct",
-        "Qwen/Qwen3-Coder-30B-A3B-Instruct",
        "Qwen/Qwen3-32B",
-        "Qwen/Qwen2.5-72B-Instruct",
+        "qwen3.5-plus",
+        // DeepSeek
+        "deepseek-ai/DeepSeek-R1-0528",
+        "deepseek-ai/DeepSeek-V3.2",
    ],
    minimax: [
        // MiniMax models (Anthropic-compatible API)
-        "MiniMax-M3",
        "MiniMax-M2.7",
        "MiniMax-M2.7-highspeed",
        "MiniMax-M2.5",
+        "MiniMax-M2.5-highspeed",
    ],
    novita: [
        // Novita AI models (OpenAI-compatible API)
-        "minimax/minimax-m3",
-        "deepseek/deepseek-v4-pro",
-        "zai-org/glm-5.1",
-        "moonshotai/kimi-k2.6",
-        "deepseek/deepseek-v4-flash",
+        "moonshotai/kimi-k2.5",
+        "zai-org/glm-5",
+        "minimax/minimax-m2.5",
    ],
 }

--- a/package-lock.json
+++ b/package-lock.json
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
    "name": "next-ai-draw-io",
-    "version": "0.4.16",
+    "version": "0.4.14",
    "license": "Apache-2.0",
    "private": true,
    "main": "dist-electron/main/index.js",
@@ -49,9 +49,9 @@
        "@langfuse/tracing": "^4.4.9",
        "@next/third-parties": "^16.0.6",
        "@opennextjs/cloudflare": "^1.17.1",
-        "@openrouter/ai-sdk-provider": "^2.0.0",
+        "@openrouter/ai-sdk-provider": "^1.5.4",
        "@opentelemetry/api": "^1.9.0",
-        "@opentelemetry/exporter-trace-otlp-http": "^0.216.0",
+        "@opentelemetry/exporter-trace-otlp-http": "^0.214.0",
        "@opentelemetry/sdk-trace-node": "^2.2.0",
        "@radix-ui/react-alert-dialog": "^1.1.15",
        "@radix-ui/react-collapsible": "^1.1.12",
@@ -77,7 +77,7 @@
        "nanoid": "^5.0.0",
        "negotiator": "^1.0.0",
        "next": "^16.0.7",
-        "ollama-ai-provider-v2": "^3.0.0",
+        "ollama-ai-provider-v2": "^2.0.0",
        "pako": "^2.1.0",
        "prism-react-renderer": "^2.4.1",
        "react": "^19.1.2",
@@ -108,7 +108,7 @@
    },
    "devDependencies": {
        "@anthropic-ai/tokenizer": "^0.0.4",
-        "@biomejs/biome": "2.4.13",
+        "@biomejs/biome": "2.4.10",
        "@playwright/test": "^1.57.0",
        "@tailwindcss/postcss": "^4",
        "@tailwindcss/typography": "^0.5.19",
@@ -127,7 +127,7 @@
        "cross-env": "^10.1.0",
        "electron": "^39.2.7",
        "electron-builder": "^26.0.12",
-        "esbuild": "^0.28.0",
+        "esbuild": "^0.27.2",
        "eslint": "9.39.4",
        "eslint-config-next": "16.1.6",
        "husky": "^9.1.7",
--- a/packages/mcp-server/package-lock.json
+++ b/packages/mcp-server/package-lock.json
@@ -521,9 +521,9 @@
            }
        },
        "node_modules/@types/node": {
-            "version": "24.12.2",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.2.tgz",
-            "integrity": "sha512-A1sre26ke7HDIuY/M23nd9gfB+nrmhtYyMINbjI1zHJxYteKR6qSMX56FsmjMcDb3SMcjJg5BiRRgOCC/yBD0g==",
+            "version": "24.12.0",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.0.tgz",
+            "integrity": "sha512-GYDxsZi3ChgmckRT9HPU0WEhKLP08ev/Yfcq2AstjrDASOYCSXeyjDsHg4v5t4jOj7cyDX3vmprafKlWIG9MXQ==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -2062,9 +2062,9 @@
            }
        },
        "node_modules/zod": {
-            "version": "4.4.1",
-            "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.1.tgz",
-            "integrity": "sha512-a6ENMBBGZBsnlSebQ/eKCguSBeGKSf4O7BPnqVPmYGtpBYI7VSqoVqw+QcB7kPRjbqPwhYTpFbVj/RqNz/CT0Q==",
+            "version": "4.3.6",
+            "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
+            "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
            "license": "MIT",
            "funding": {
                "url": "https://github.com/sponsors/colinhacks"
--- a/tests/e2e/iframe-interaction.spec.ts
+++ b/tests/e2e/iframe-interaction.spec.ts
@@ -35,10 +35,8 @@ test.describe("Iframe Interaction", () => {
        await expect(
            frame
                .locator('text="Diagram"')
-                .or(frame.locator('[title*="Diagram"]'))
-                .filter({ visible: true })
-                .first(),
-        ).toBeVisible({ timeout: 30000 })
+                .or(frame.locator('[title*="Diagram"]')),
+        ).toBeVisible({ timeout: 10000 })
    })

    test("diagram XML is rendered in iframe after generation", async ({
--- a/tests/unit/ai-providers.test.ts
+++ b/tests/unit/ai-providers.test.ts
@@ -180,14 +180,11 @@ describe("supportsImageInput", () => {
        expect(supportsImageInput("moonshot-v1-128k")).toBe(false)
    })

-    it("returns false for MiniMax M2 text models", () => {
+    it("returns false for MiniMax text models", () => {
        expect(supportsImageInput("MiniMax-M2.7")).toBe(false)
-        expect(supportsImageInput("MiniMax-M2.7-highspeed")).toBe(false)
+        expect(supportsImageInput("MiniMax-M2.5")).toBe(false)
        expect(supportsImageInput("MiniMax-M2")).toBe(false)
-    })
-
-    it("returns true for MiniMax M3 (supports image input)", () => {
-        expect(supportsImageInput("MiniMax-M3")).toBe(true)
+        expect(supportsImageInput("MiniMax-M2.5-highspeed")).toBe(false)
    })

    it("returns false for DeepSeek text models", () => {
@@ -211,13 +208,6 @@ describe("supportsImageInput", () => {
        expect(supportsImageInput("qwen3-vl-flash")).toBe(true)
    })

-    it("returns true for QvQ (Qwen Visual QA) models including OpenRouter-prefixed names", () => {
-        expect(supportsImageInput("qvq-72b-preview")).toBe(true)
-        expect(supportsImageInput("qvq-max")).toBe(true)
-        expect(supportsImageInput("qwen/qvq-72b-preview")).toBe(true)
-        expect(supportsImageInput("qwen/qvq-max")).toBe(true)
-    })
-
    it("returns false for GLM text models", () => {
        expect(supportsImageInput("glm-4")).toBe(false)
        expect(supportsImageInput("glm-4-plus")).toBe(false)
@@ -248,67 +238,6 @@ vi.mock("ollama-ai-provider-v2", () => {
    return { createOllama: mockCreateOllama, ollama: mockOllama }
 })

-vi.mock("@ai-sdk/deepseek", () => {
-    const mockModel = { modelId: "test-model" }
-    const mockProviderFn = vi.fn(() => mockModel)
-    const mockCreateDeepSeek = vi.fn(() => mockProviderFn)
-    const mockDeepseek = vi.fn(() => mockModel)
-    return { createDeepSeek: mockCreateDeepSeek, deepseek: mockDeepseek }
-})
-
-describe("Kimi provider uses createDeepSeek for reasoning_content support", () => {
-    let createDeepSeekMock: ReturnType<typeof vi.fn>
-    const savedEnv: Record<string, string | undefined> = {}
-
-    beforeEach(async () => {
-        savedEnv.KIMI_API_KEY = process.env.KIMI_API_KEY
-        savedEnv.KIMI_BASE_URL = process.env.KIMI_BASE_URL
-        delete process.env.KIMI_BASE_URL
-
-        const mod = await import("@ai-sdk/deepseek")
-        createDeepSeekMock = mod.createDeepSeek as ReturnType<typeof vi.fn>
-        createDeepSeekMock.mockClear()
-    })
-
-    afterEach(() => {
-        process.env.KIMI_API_KEY = savedEnv.KIMI_API_KEY
-        process.env.KIMI_BASE_URL = savedEnv.KIMI_BASE_URL
-    })
-
-    it("uses createDeepSeek with Kimi default base URL for reasoning_content support", () => {
-        process.env.KIMI_API_KEY = "test-kimi-key"
-
-        getAIModel({
-            provider: "kimi",
-            apiKey: "test-kimi-key",
-            modelId: "moonshot-v1-8k",
-        })
-
-        expect(createDeepSeekMock).toHaveBeenCalledWith(
-            expect.objectContaining({
-                baseURL: "https://api.moonshot.cn/v1",
-            }),
-        )
-    })
-
-    it("uses custom base URL when provided for kimi provider", () => {
-        process.env.KIMI_API_KEY = "test-kimi-key"
-
-        getAIModel({
-            provider: "kimi",
-            apiKey: "test-kimi-key",
-            baseUrl: "https://custom-kimi-endpoint.com/v1",
-            modelId: "kimi-k2.6",
-        })
-
-        expect(createDeepSeekMock).toHaveBeenCalledWith(
-            expect.objectContaining({
-                baseURL: "https://custom-kimi-endpoint.com/v1",
-            }),
-        )
-    })
-})
-
 describe("Ollama API key security", () => {
    let createOllamaMock: ReturnType<typeof vi.fn>
    const savedEnv: Record<string, string | undefined> = {}
--- a/tests/unit/ssrf-protection.test.ts
+++ b/tests/unit/ssrf-protection.test.ts
@@ -1,21 +0,0 @@
-import { describe, expect, it } from "vitest"
-import { isPrivateUrl } from "@/lib/ssrf-protection"
-
-describe("isPrivateUrl", () => {
-    it("blocks private IPv6 URLs", () => {
-        expect(isPrivateUrl("http://[::1]/")).toBe(true)
-        expect(isPrivateUrl("http://[0:0:0:0:0:0:0:1]/")).toBe(true)
-        expect(isPrivateUrl("http://[::]/")).toBe(true)
-        expect(isPrivateUrl("http://[::ffff:127.0.0.1]/")).toBe(true)
-        expect(isPrivateUrl("http://[fc00::1]/")).toBe(true)
-        expect(isPrivateUrl("http://[fd12:3456:789a::1]/")).toBe(true)
-        expect(isPrivateUrl("http://[fe80::1]/")).toBe(true)
-        expect(isPrivateUrl("http://[fe9f::1]/")).toBe(true)
-        expect(isPrivateUrl("http://[febf::1]/")).toBe(true)
-    })
-
-    it("allows public URLs", () => {
-        expect(isPrivateUrl("https://example.com/article")).toBe(false)
-        expect(isPrivateUrl("https://fc00.example.com/article")).toBe(false)
-    })
-})