[fylorn]

What

Pins core v0.86.0 (control API 57) and builds two UI pieces on it.

Rule groups (all three rule tables)

• Groups start collapsed. Open groups are remembered per protection (localStorage).
• Group head: name · N rules · N on · N matches in the last 7 days (zh: N 条 · 已开 N 条 · 最近 7 天命中 N 次). Groups without matches show no count.
• Counts come from the new GET /security/counts (exact per-rule totals since the start of the 7-day window the log uses). They are read when the tab opens, not on every new request, so groups do not reorder while being read.
• Built-in groups with matches come first; both parts keep core's order; the custom group stays last.
• Search expands every matching group; collapsing one during a search lasts only for that search term.
• Keyboard: Enter / Space toggle a head (Right expands, Left collapses); Up / Down move between heads and rows of expanded groups.

Redaction exceptions

• Secrets & privacy tab: a section Exceptions · N values below the rule table shows the masked value, the rule that first found it (none for values added by hand), when it was added, and Remove. Removing asks for confirmation. Add exception opens a dialog with a hidden input and an eye toggle. At the limit the button is disabled and the limit is shown next to it. With no exceptions, the section shows one line and the button.
• Security log: an expanded hit shows List as exception when core marks it exceptable. The confirmation states that the value will no longer be replaced or recorded, and shows the masked value and the rule. If core refuses (entry too old, saved secret, limit reached), its message is shown in the dialog. Values that are exceptions now are tagged Exception in the log row and in the hit detail.
• Test: excepted values are not highlighted and read Exception, not handled.

Pin

• All core crates at v0.86.0, regenerated TS bindings, Chinese sentences for the new message codes, and the new endpoints on both webview allow-lists.
• Screenshot fixtures were regenerated against v0.86.0, and the screenshot mocks answer the new endpoints.

Notes

• There is no group bulk toggle to keep: it was removed in Security rules: drop the group checkboxes; inline selects stop clipping text #330, and this PR does not bring it back.
• The · 内置 / · Built-in label in group heads is dropped; the head follows the spec format.

Tests

• src/security/groups.test.tsx: counts, ordering, collapse state, search auto-expand, keyboard.
• src/security/exceptions.test.tsx: section states (empty, list, at limit, English), the hit-detail button and tag, and the calls sent to core.
• Typecheck, vitest, cargo fmt, clippy and the full Rust suite (including the control-plane handshake against twcore v0.86.0) pass locally.
• The UI was checked in the full-mock preview (WKWebView, light / dark).

🤖 Generated with Claude Code