chore: 2026.10.34

package.json

@@ -2,7 +2,7 @@
   "name": "thinkwatch-lite",
   "private": true,
   "description": "Desktop app for a local AI API gateway on macOS, Windows and Linux",
-  "version": "2026.10.33",
+  "version": "2026.10.34",
   "type": "module",
   "packageManager": "pnpm@11.13.0",
   "scripts": {

release-notes/2026.10.34.md

@@ -0,0 +1,22 @@
+**Upgrade notes:**
+- The bundled core is now 0.86.0 and the control-plane protocol goes from 55 to 57. A remote server must run core 0.86.0 to stay connected.
+- The request history and the security log are cleared on first start (the request store's format changed). The usage history behind the overview's past-year view, settings and upstreams carry over.
+- Many more redaction rules are on by default. In the default Monitor mode they only record; with the protection On they replace what they find.
+
+**Secrets & privacy:**
+- Built-in redaction rules grow from 30 to 120. The keys saved in ThinkWatch (upstream keys, gateway keys, proxy passwords, sync credentials) are recognised by value, whatever their format, so keys without a recognisable shape are covered too.
+- About 60 more kinds of API keys and tokens, including xAI, Groq, OpenRouter, Hugging Face, DeepSeek-style `sk-` keys, Zhipu, Baidu Qianfan, Alibaba Cloud and Tencent Cloud.
+- Credentials are also found by where they appear: `Authorization` and API-key headers, `curl -u` style passwords, token parameters in URLs, bot webhooks (Feishu, DingTalk, WeCom, Slack, Discord, Teams) and assignments like `DB_PASSWORD=...` in pasted config files. Only the value is replaced.
+- Wallet seed phrases and private keys, passport machine-readable zones and IBANs are recognised by their checksums. Foreign IDs, phone numbers in more forms, addresses, coordinates, licence plates, device identifiers and field-name rules (name, address, birth date, account, health) are available and off by default.
+- Rule names and descriptions come from the core in Chinese and English. Rules are grouped by what they protect; groups start collapsed and their heads show how many rules are on and how many matches the last 7 days had.
+- A value that is wrongly matched can be listed as an exception, from the security log or by pasting it, without turning its rule off. Exceptions are listed under the rule table and can be removed; only a hash of the value is kept.
+- A hit on a saved key shows where the key is saved (for example the upstream's name), never the value.
+
+**Traffic:**
+- A session's duration rounds before it picks its unit: 59.6 seconds reads "1 min" instead of "60 s". Thanks to @RaphaelFakhri (#382).
+
+**Overview:**
+- A cost that is both a lower bound and partly estimated is marked only as a lower bound, with one sign instead of two; how much was estimated is still in the hover.
+
+**Speed:**
+- Redaction scans with a two-phase engine and no longer rescans conversation history that has not changed, so the added rules cost little.

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "thinkwatch-lite"
-version = "2026.10.33"
+version = "2026.10.34"
 edition = "2024"
 # **这个数决定依赖能升到哪一版。**edition 2024 的解析器只挑声明的 Rust
 # 版本编得动的依赖：写 1.85 的时候，`cargo update` 一直停在旧的 time 和

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ThinkWatch Lite",
-  "version": "2026.10.33",
+  "version": "2026.10.34",
   "identifier": "app.thinkwatch.lite",
   "build": {
     "beforeDevCommand": "pnpm dev",