v5.0.0
中文
这是一个大版本：新增了网页界面和第三个入站协议，Rust / 前端依赖全部跨大版本升级。升级后功能默认行为不变，网页界面默认关闭。
新功能
- 网页界面（默认关闭）：同一份前端现在也能在浏览器里用。设置页「安全与访问」打开「网页界面」后，代理同端口的 /ui 即可访问，管理功能与桌面端完全一致（订阅、虚拟模型、日志、统计、小票、设置）。默认要求用 cc-router 的 token 登录，登录开关与代理鉴权相互独立；会话走 cookie + CSRF 头，登录接口有限流，实时事件走 SSE，页面 CSP 只放行带 hash 的内联脚本。两个开关即时生效，不需重启。开启 0.0.0.0 监听时设置页会红色提示局域网风险。导出 CSV 和 CA 证书在网页端改为浏览器下载。
- 新增 POST /v1/chat/completions 入站端点：Open WebUI、Cherry Studio、Cline、LobeChat 等只支持 OpenAI Chat Completions 的工具可以直接接入。请求在 cc-router 内部翻译为 Anthropic Messages，走同一套调度，订阅、虚拟模型、限额、会话亲和全部生效，请求日志「入口接口」显示 /v1/chat/completions。上游 thinking 以 reasoning_content 返回（历史里回传的会被丢弃）；图片支持 data: 与 http(s) 两种 image_url；工具调用双向支持；流式末尾总带一帧 usage；含工具调用时 finish_reason 恒为 tool_calls。会话亲和按 user 字段 → x-session-id 头 → 首条用户消息识别。旧版 functions / function_call 直接 400，请改用 tools / tool_choice。
- 标题栏内嵌：窗口不再有独立顶栏，内容从窗口顶边铺开。macOS 用系统红绿灯 + 透明拖窗带；Windows / Linux 自绘最小化 / 最大化 / 关闭三键，关闭仍收进托盘。
- 接入指南新增「通用接入方式」tab 并置顶为默认页：三个入口各一张卡，Base URL 用真实端口、Token 直接展示当前真实值可复制，「虚拟模型名」列出四个虚拟模型的全部别名并给模糊匹配写法举例（如 claude-opus* / gpt-*-terra），下方附行为说明。OpenAI Responses 卡附 ~/.codex/config.toml 与已填入 token 的 ~/.codex/auth.json，与 Codex 编辑器写出的文件逐字一致。新增「模型列表 GET /v1/models」卡（免鉴权、双格式返回、curl 示例）。「其他 AI Agent」tab 暂时隐藏。
- 设置页改为四个分组 tab：通用 / 代理 / 安全与访问 / 高级，当前 tab 记在 URL 的 ?tab= 上，引导页与实时路由页的「去设置」直接深链到对应分组。鉴权 token 输入框右侧加复制按钮。
- 检查更新页与关于页统一为「页头 + 卡片」布局，与其他页面一致；更新日志改为卡内滚动。实时路由页 API 入口补上 /v1/chat/completions，标注改为「三协议并行」。
- 代码块与信息框跟随主题：接入指南等处的代码片段、设置页的网页界面访问地址不再是固定黑底，浅色 / 暗色主题下自动切换。
修复
- Chat Completions 入站：thinking 预算、temperature、强制工具选择三项兼容处理；null 字段容错；tool_call id 校验；上游只发 data 行的 SSE 回退解析。
- 响应含 tool_use 时 finish_reason 报 tool_calls，兼容经翻译层返回 end_turn 的上游，客户端可据此判断是否执行工具。
- 网页界面终审修复：401 后重建 SSE 连接并清理查询缓存；CSP connect-src 放行更新源域名；代理未运行时的 fallback；登录门在桌面端不再闪过检查态，网络失败回落到登录页。
其他
- 依赖全量升级：前端 TypeScript 7 / Vite 8 / react-router 8 / lucide 1 / Tailwind CSS 4；Rust axum 0.8 / sqlx 0.9 / reqwest 0.13（改用系统证书库校验）/ rcgen 0.14 / jsonschema 0.53 等；删除 4 个零引用依赖；Dependabot #43 / #44 / #45 与 CodeQL #3 告警清零。新增 THIRD-PARTY-NOTICES.md。
- README 三语重写为「入口与出口」结构，按协议家族说明接入方式，删除 provider 表格（完整清单以 app 内添加订阅页为准）；安装章节加全球 / 中国双地址下载表；界面文案 en / ja 补齐 39 个历史缺失键并与本次新增全部同步。
English
This is a major release: it adds a web UI and a third inbound protocol, and upgrades every Rust and front-end dependency across major versions. Existing behaviour is unchanged by default, and the web UI ships disabled.
Features
- Web UI (off by default): the same front end now runs in a browser. Enable "Web UI" under Settings → Security & Access and open /ui on the proxy port; every management feature from the desktop app is there (subscriptions, virtual models, logs, stats, receipts, settings). It requires signing in with the cc-router token by default; that switch is independent of proxy auth. Sessions use a cookie plus a CSRF header, the login endpoint is rate-limited, live events stream over SSE, and the page CSP only allows hashed inline scripts. Both switches take effect immediately, no restart needed. When the proxy listens on 0.0.0.0 the settings page shows a red LAN warning. CSV export and the CA certificate download go through the browser in web mode.
- New POST /v1/chat/completions inbound endpoint: tools that only speak OpenAI Chat Completions — Open WebUI, Cherry Studio, Cline, LobeChat and friends — can point at cc-router directly. Requests are translated to Anthropic Messages internally and go through the same scheduler, so subscriptions, virtual models, quotas and session affinity all apply; Request Logs show /v1/chat/completions as the entry. Upstream thinking comes back as reasoning_content (echoed history is dropped); images accept both data: and http(s) image_url; tool calls work in both directions; streaming always ends with a usage frame; finish_reason is tool_calls whenever the response contains tool calls. Session affinity is keyed by the user field, then the x-session-id header, then the first user message. Legacy functions / function_call return 400 — use tools / tool_choice.
- Title bar merged into the window: there is no separate top bar any more and content runs to the top edge. macOS uses the native traffic lights plus a transparent drag strip; Windows / Linux draw their own minimise / maximise / close buttons, and close still hides to the tray.
- Integration guide gains a "Generic Integration" tab, now first and selected by default: one card per entry point, with the Base URL built from the real port, the real token shown inline with a copy button, a "Virtual model names" table listing every alias for the four virtual models with examples of the fuzzy forms (e.g. claude-opus* / gpt-*-terra), and behaviour notes underneath. The OpenAI Responses card includes ~/.codex/config.toml and a ~/.codex/auth.json with the token already filled in — byte-for-byte what the Codex editor writes. A new "Model list GET /v1/models" card covers the unauthenticated endpoint, its dual-format response and a curl example. The "Other AI Agents" tab is hidden for now.
- Settings page split into four tabs: General / Proxy / Security & Access / Advanced. The active tab lives in the URL as ?tab=, so "Go to Settings" links from the guide and Live Routing land on the right group. The auth token field has a copy button.
- Check for Updates and About pages now use the same "header + cards" layout as every other page; release notes scroll inside the card. Live Routing's API entry list includes /v1/chat/completions and the badge reads "All three protocols live".
- Code blocks and info boxes follow the theme: code snippets in the guide and the web UI address box in Settings are no longer fixed black; they switch with the light / dark theme.
Fixes
- Chat Completions inbound: compatibility handling for thinking budget, temperature and forced tool choice; tolerates null fields; validates tool_call ids; falls back to data-only SSE parsing for upstreams that omit event lines.
- finish_reason is reported as tool_calls when the response contains tool_use, including upstreams that come back as end_turn through a translation layer, so clients can rely on it to decide whether to run tools.
- Web UI final-review fixes: rebuild the SSE connection and clear query caches after a 401; allow update-source domains in CSP connect-src; proper fallback when the proxy is not running; the login gate no longer flashes the checking state on desktop and falls back to the login page on network failure.
Other
- Full dependency upgrade: TypeScript 7 / Vite 8 / react-router 8 / lucide 1 / Tailwind CSS 4 on the front end; axum 0.8 / sqlx 0.9 / reqwest 0.13 (now verifying against the system certificate store) / rcgen 0.14 / jsonschema 0.53 and others in Rust; 4 unused dependencies removed; Dependabot #43 / #44 / #45 and CodeQL #3 cleared. Added THIRD-PARTY-NOTICES.md.
- README rewritten in all three languages around an "entry and exit" structure, explaining integration per protocol family; the provider table is gone (the in-app "add subscription" page is the canonical list). The install section has a global / China download table. en / ja UI strings gained 39 previously missing keys and are fully in sync with everything added in this release.