v2.11.10

English

Summary

• Closes an access-password bypass affecting lookalike /api/auth* paths and restores a clean high-severity dependency audit.
• Restores model configuration access across workspaces, including the first-use empty-state action and visible Text, Image, and Function tabs.
• Refreshes built-in text and image model catalogs and moves development, desktop packaging, and CI to a verified Node.js 24 toolchain.
• Preserves history order when restoring backups and strengthens regression coverage for rendered UI and packaged desktop behavior.

Highlights

• First-time users with no enabled model can now open Model Manager directly from the empty model selector and switch reliably among Text, Image, and Function models.
• Built-in catalogs now track current generations such as GPT-6 Astra, GLM-5.3 and GLM-5.3-Flash, Qwen3.8, Gemini 3.8 Flash, Grok 4.6, GPT Image 2.5 Flare, Qwen Image 3.0, Grok Imagine Image 2.0, and Gemini 3.1 Flash Image.
• Desktop packages now include runtime window icons and have been validated with a clean profile, while Node 24-safe runners and actions keep local and CI workflows compatible with the new runtime.

Product Updates

Desktop

• Include Windows, macOS, and Linux runtime window icons inside app.asar so packaged applications no longer fall back after an icon lookup failure.
• Refresh Electron, electron-builder, electron-updater, AWS S3, and networking dependencies, and validate a complete Windows installer/ZIP build plus clean-profile startup.
• Keep model configuration and all three model-category tabs available in the packaged renderer.

Web

• Apply access-password middleware to every API-like path while allowing only the exact /api/auth path, preventing lookalike paths and SPA fallback URLs from bypassing authentication.
• Restore Configure Model actions for text and image selectors across Basic, Context, and Image workspaces.
• Preserve restored history ordering so newest/oldest behavior remains consistent after backup round trips.

Extension

• Synchronize the extension version, shared model catalog, Node 24-compatible build configuration, and refreshed direct dependencies; no extension-specific workflow changes are required.

Core/Infra

• Refresh built-in text and image model metadata and compatible legacy-default migration rules while preserving user customizations.
• Upgrade direct SDK, build, test, sanitization, archive, Markdown, and desktop dependencies; retain only the required esbuild override for the vulnerable transitive dependency.
• Move repository engines, Docker builds, tests, and release jobs to Node.js 24, including Node 24-native pnpm and Docker GitHub Actions.
• Replace Windows shell-based pnpm spawning with an explicit cross-platform runner and add a real-rendered Playwright gate for first-use model setup and tab switching.
• Disable unsupported image attestations in the current multi-registry Docker publish path.

Fixes

• Require an exact /api/auth match for the access-password exception instead of treating similarly prefixed paths as authentication endpoints.
• Restore the Configure Model action when no model is enabled and restore the Text, Image, and Function tabs in Model Manager.
• Use stable prompt-panel action keys to prevent component reuse from mixing action state.
• Preserve the original newest-to-oldest record order when importing history backups, including correct oldest-record eviction.
• Package desktop runtime icons and remove the missing-icon warning from clean packaged-app startup.
• Define a path-safe desktop executable name so newer electron-builder versions can produce Linux AppImage packages from the scoped desktop package.
• Avoid Node.js 24 Windows shell-spawn deprecation warnings in repository and end-to-end runners.
• Update Vite and esbuild to audited versions with no known high-severity findings in the current dependency graph.

Breaking Changes / Upgrade Notes

• Node.js 24 is now required for local development and repository scripts.
• No user-data migration is required. Existing custom model configurations and parameter overrides remain unchanged; eligible built-in configurations migrate only from recognized legacy defaults.

Developer Notes

• The release range is v2.11.9..HEAD.
• The release contains 14 commits before the version update: 12 content commits and 2 merge commits.
• Verification covers the release-note gate, unit and repository gates, lint and type checks, a real-rendered Playwright model-management smoke test, dependency audit, Windows desktop packaging, archive icon inspection, and clean-profile packaged-app startup.
• Docker publishing uses Node 24-compatible actions and the artifact types supported by the configured registries.

Installation guide: English | 中文
Source release notes (EN)

---

中文

概括

• 修复与 /api/auth 前缀相似路径上的访问密码绕过问题，并使高危依赖审计恢复为无已知风险。
• 恢复各工作区的模型配置入口，包括首次使用且未启用模型时的空状态操作，以及可见的文本、图像、函数模型标签。
• 更新内置文本与图像模型目录，并将开发、桌面打包和 CI 迁移到已验证的 Node.js 24 工具链。
• 恢复备份时保持历史记录顺序，并加强真实渲染界面和桌面安装包行为的回归验证。

亮点

• 首次使用且没有已启用模型时，可以直接从空模型下拉框进入模型管理，并可靠切换文本、图像和函数模型。
• 内置目录同步当前模型代际，包括 GPT-6 Astra、GLM-5.3 与 GLM-5.3-Flash、Qwen3.8、Gemini 3.8 Flash、Grok 4.6、GPT Image 2.5 Flare、Qwen Image 3.0、Grok Imagine Image 2.0 和 Gemini 3.1 Flash Image。
• 桌面安装包现在包含运行时窗口图标，并已使用全新用户目录验证；Node 24 兼容的运行器与 Actions 也保证本地和 CI 流程适配新运行时。

产品更新

Desktop

• 将 Windows、macOS 和 Linux 的运行时窗口图标打入 app.asar，避免安装包因查找不到图标而回退。
• 更新 Electron、electron-builder、electron-updater、AWS S3 和网络相关依赖，并验证完整的 Windows 安装包 / ZIP 构建及全新用户目录启动。
• 确保桌面安装包的渲染界面中始终可用模型配置入口和三个模型分类标签。

Web

• 让访问密码中间件覆盖所有 API 形态路径，只对精确的 /api/auth 放行，阻止相似前缀和 SPA 回退路径绕过认证。
• 恢复基础、上下文和图像工作区中文本 / 图像选择器的“配置模型”操作。
• 还原历史备份后保持原有顺序，使最新 / 最旧记录的行为在导出导入后保持一致。

Extension

• 同步扩展版本、共享模型目录、Node 24 兼容构建配置和更新后的直接依赖；本次没有扩展端专属工作流变化。

Core/Infra

• 更新内置文本 / 图像模型元数据及兼容的旧默认值迁移规则，同时保留用户自定义设置。
• 升级 SDK、构建、测试、净化、压缩、Markdown 和桌面端等直接依赖；仅为存在风险的间接依赖保留必要的 esbuild override。
• 将仓库 engines、Docker 构建、测试和发布任务迁移到 Node.js 24，并升级为原生支持 Node 24 的 pnpm 与 Docker GitHub Actions。
• 使用明确的跨平台运行器替代 Windows shell 方式启动 pnpm，并新增真实渲染的 Playwright 门禁，覆盖首次模型配置和标签切换。
• 在当前多镜像仓库 Docker 发布链路中关闭目标仓库不支持的镜像证明产物。

修复

• 访问密码豁免改为精确匹配 /api/auth，不再将相似前缀路径视作认证端点。
• 修复未启用模型时“配置模型”入口缺失，以及模型管理中文本、图像、函数标签不可见的问题。
• 为提示词面板操作使用稳定 key，避免组件复用导致操作状态串位。
• 导入历史备份时保持原始的由新到旧顺序，并确保容量限制仍淘汰最旧记录。
• 将桌面运行时图标打入安装包，消除全新用户目录启动时的图标缺失警告。
• 显式配置路径安全的桌面可执行文件名，使新版 electron-builder 能够从 scoped 桌面包生成 Linux AppImage。
• 避免 Node.js 24 下 Windows 仓库脚本和端到端运行器出现 shell 启动弃用警告。
• 将 Vite 与 esbuild 更新到已审计版本，当前依赖图中无已知高危问题。

破坏性变更 / 升级说明

• 本地开发和仓库脚本现在要求 Node.js 24。
• 无需迁移用户数据。现有自定义模型配置和参数覆盖保持不变；只有仍匹配已知旧版默认值的内置配置才会自动迁移。

开发者说明

• 本次发布范围是 v2.11.9..HEAD。
• 更新版本号前共包含 14 个提交：12 个内容提交和 2 个合并提交。
• 验证覆盖 Release Notes 门禁、单元与仓库门禁、lint / 类型检查、真实渲染的模型管理 Playwright 冒烟测试、依赖审计、Windows 桌面打包、归档图标检查和全新用户目录安装包启动。
• Docker 发布已使用兼容 Node 24 的 Actions，并仅生成目标镜像仓库支持的产物类型。

安装文档：English | 中文
仓库版本说明（中文）

---

macOS note: if macOS reports the app as damaged or cannot verify the developer, this is usually caused by the quarantine attribute on downloaded apps. See the installation guide, or remove it after installing with xattr -rd com.apple.quarantine /Applications/PromptOptimizer.app; for a downloaded DMG, you can run the same command on ~/Downloads/PromptOptimizer-*.dmg before installing.
macOS 备注：如果 macOS 提示“已损坏”或“无法验证开发者”，通常是下载文件的隔离属性导致。请参考安装文档；也可以在安装后执行 xattr -rd com.apple.quarantine /Applications/PromptOptimizer.app，或在安装前对 ~/Downloads/PromptOptimizer-*.dmg 执行同类命令。