The i18n hint said "默认关闭" while runtime-config.js has defaulted to
true since 2.0 — superkura opened #52 ("关闭了对话还在使用 cascade")
because the dashboard told him the toggle was off. Flip both locales to
"默认开启" and spell out what the toggle actually controls: cascade_id
reuse across requests only, not whether Cascade is used (all premium
models always go through Cascade; tool-emulated requests auto-skip reuse
regardless of this setting).

Credits panel: add S+/S/A+/A/B+ weight badge with tooltip describing why
each contributor earned their tier; append PR #51 (aict666, Opus
injection-guard rewrite) and PR #45 (baily-zhang, trajectory offset)
that were missing from the list; expand summaries for S+/S contributors
to name the specific regression each fix eliminated.

Merge baily-zhang's third major contribution. Two-pronged Opus 4.7 fix:

The blast radius. Claude Code routes through the proxy with tools[] +
images. The proxy was packing the entire Claude Code system prompt
(billing header included), tool fallback preamble, image base64 blobs
and reuse fingerprint inputs onto the user-message channel. Successive
image turns inflated history geometrically and tripped Opus 4.7's
prompt-injection heuristics, resulting in tool refusal cascades.

The fix.
- Image / binary content blocks become text-history placeholders
  instead of base64 dumps.
- Big Claude Code system prompts get compressed (billing header
  dropped, only proxy-relevant context kept).
- Opus 4.7 multimodal tool calls bypass the user-message tool fallback
  entirely (the proto-level section override carries the schema).
- Opus 4.7 tool turns get strict-account-bound narrow cascade reuse
  so retries don't replay full history into a different account.
- Conversation reuse fingerprint stops hashing image base64.
- Regression coverage on every angle (tool fallback, image
  desensitization, system-prompt compression, Opus 4.7 reuse policy).

CI green, npm test 105/105.

baily-zhang's prior surgical work on cascade reuse (PR #36, PR #45)
is what made this diagnosis possible — they own the fingerprint /
trajectory-offset machinery this PR extends.

…ly-zhang to S+

- baily-zhang PR #61 (Opus 4.7 multimodal context bloat) — third major
  contribution after #36 and #45, now de-facto maintainer of the
  reuse-fingerprint / trajectory-offset machinery
- abwuge PR #58 (docker/nginx deploy fix) — first-time contributor,
  +3/-2 surgical, unblocked the docker-compose Restart loop
- aict666 PR #54 (tool preamble slimming + redact marker 6th-gen U+2026
  ellipsis + identity coverage extension) — fourth major contribution
- aict666 PR #53 (redact marker shell-safety regression) — second
  contribution, was missing from the prior credits update
- baily-zhang upgraded from S to S+ (parity with aict666)

The Pages site at dwgx.github.io/WindsurfAPI/ had only 4 names listed
in the footer (dd373156, colin1112a, motto1, youfak). 8 contributors
were missing from the public site even though most of them landed
S+/S level fixes (aict666 #44/#51/#53/#54, baily-zhang #36/#45/#61,
smeinecke #43, abwuge #58).

Adds a dedicated `#contributors` section before the footer with one
card per contributor: avatar, GitHub link, weight badge (S+/S/A+/A/B+),
PR list, and a one-paragraph 繁體中文 description of what each fix
actually solved. Cards reuse the existing panel-card warm/coral
palette to fit the site's aesthetic.

Footer one-liner is also expanded to all 8 names ordered by weight,
with a "完整名單 ↑" anchor back to the new section.

CSS additions: contrib-grid, contrib-card, contrib-avatar,
contrib-weight + 5 weight-tier classes (-S-plus, -S, -A-plus, -A,
-B-plus). All gradient/hover behaviour matches the existing
panel-card styling.

Critical hotfix: my own credits commit (60fcd5a) shipped over-escaped
single quotes (`Codeium\'s Cascade`) inside the inline single-quoted
JS strings of dashboard CONTRIBUTORS, breaking the entire main script
parse. Result: dashboard pages opened but every panel rendered empty
because App.init() never ran.

baily-zhang spotted it within hours, fixed the literal, and added
test/dashboard-syntax.test.js — a regression that statically parses
the inline `<script>` blocks of src/dashboard/index.html with the V8
parser. Future copy/escape regressions in dashboard inline JS will
now break `npm test` instead of silently bricking the live UI.

baily-zhang's fourth landed PR (#36 / #45 / #61 / #62), entirely on
issues created by other people / by me. Adding to the dashboard credits
in a follow-up commit.

baily-zhang's fourth landed PR (#36 / #45 / #61 / #62) — adding the
PR #62 entry to the dashboard credits panel as a separate card so
the inline-script regression-test win is visible alongside the
cascade-reuse machinery work.

v2.0.5 covers everything since 2.0.4:
- aict666 #54 tool preamble slim + redact U+2026
- abwuge #58 docker/nginx deploy fix
- baily #61 Opus 4.7 multimodal context bloat
- baily #62 dashboard escape regression
- own commits: empty-message validator, internal_error backoff,
  upstream_transient_error category, Opus 4.6 reuse widening,
  /v1/responses endpoint for Codex CLI compatibility (#56, #63)

fix: prevent cascade reuse from replaying old context

…s panel

The i18n hint said "默认关闭" while runtime-config.js has defaulted to
true since 2.0 — superkura opened dwgx#52 ("关闭了对话还在使用 cascade")
because the dashboard told him the toggle was off. Flip both locales to
"默认开启" and spell out what the toggle actually controls: cascade_id
reuse across requests only, not whether Cascade is used (all premium
models always go through Cascade; tool-emulated requests auto-skip reuse
regardless of this setting).

Credits panel: add S+/S/A+/A/B+ weight badge with tooltip describing why
each contributor earned their tier; append PR dwgx#51 (aict666, Opus
injection-guard rewrite) and PR dwgx#45 (baily-zhang, trajectory offset)
that were missing from the list; expand summaries for S+/S contributors
to name the specific regression each fix eliminated.

Merge baily-zhang's third major contribution. Two-pronged Opus 4.7 fix:

The blast radius. Claude Code routes through the proxy with tools[] +
images. The proxy was packing the entire Claude Code system prompt
(billing header included), tool fallback preamble, image base64 blobs
and reuse fingerprint inputs onto the user-message channel. Successive
image turns inflated history geometrically and tripped Opus 4.7's
prompt-injection heuristics, resulting in tool refusal cascades.

The fix.
- Image / binary content blocks become text-history placeholders
  instead of base64 dumps.
- Big Claude Code system prompts get compressed (billing header
  dropped, only proxy-relevant context kept).
- Opus 4.7 multimodal tool calls bypass the user-message tool fallback
  entirely (the proto-level section override carries the schema).
- Opus 4.7 tool turns get strict-account-bound narrow cascade reuse
  so retries don't replay full history into a different account.
- Conversation reuse fingerprint stops hashing image base64.
- Regression coverage on every angle (tool fallback, image
  desensitization, system-prompt compression, Opus 4.7 reuse policy).

CI green, npm test 105/105.

baily-zhang's prior surgical work on cascade reuse (PR dwgx#36, PR dwgx#45)
is what made this diagnosis possible — they own the fingerprint /
trajectory-offset machinery this PR extends.

…nel; promote baily-zhang to S+

- baily-zhang PR dwgx#61 (Opus 4.7 multimodal context bloat) — third major
  contribution after dwgx#36 and dwgx#45, now de-facto maintainer of the
  reuse-fingerprint / trajectory-offset machinery
- abwuge PR dwgx#58 (docker/nginx deploy fix) — first-time contributor,
  +3/-2 surgical, unblocked the docker-compose Restart loop
- aict666 PR dwgx#54 (tool preamble slimming + redact marker 6th-gen U+2026
  ellipsis + identity coverage extension) — fourth major contribution
- aict666 PR dwgx#53 (redact marker shell-safety regression) — second
  contribution, was missing from the prior credits update
- baily-zhang upgraded from S to S+ (parity with aict666)

The Pages site at dwgx.github.io/WindsurfAPI/ had only 4 names listed
in the footer (dd373156, colin1112a, motto1, youfak). 8 contributors
were missing from the public site even though most of them landed
S+/S level fixes (aict666 dwgx#44/dwgx#51/dwgx#53/dwgx#54, baily-zhang dwgx#36/dwgx#45/dwgx#61,
smeinecke dwgx#43, abwuge dwgx#58).

Adds a dedicated `#contributors` section before the footer with one
card per contributor: avatar, GitHub link, weight badge (S+/S/A+/A/B+),
PR list, and a one-paragraph 繁體中文 description of what each fix
actually solved. Cards reuse the existing panel-card warm/coral
palette to fit the site's aesthetic.

Footer one-liner is also expanded to all 8 names ordered by weight,
with a "完整名單 ↑" anchor back to the new section.

CSS additions: contrib-grid, contrib-card, contrib-avatar,
contrib-weight + 5 weight-tier classes (-S-plus, -S, -A-plus, -A,
-B-plus). All gradient/hover behaviour matches the existing
panel-card styling.

Critical hotfix: my own credits commit (0376901) shipped over-escaped
single quotes (`Codeium\'s Cascade`) inside the inline single-quoted
JS strings of dashboard CONTRIBUTORS, breaking the entire main script
parse. Result: dashboard pages opened but every panel rendered empty
because App.init() never ran.

baily-zhang spotted it within hours, fixed the literal, and added
test/dashboard-syntax.test.js — a regression that statically parses
the inline `<script>` blocks of src/dashboard/index.html with the V8
parser. Future copy/escape regressions in dashboard inline JS will
now break `npm test` instead of silently bricking the live UI.

baily-zhang's fourth landed PR (dwgx#36 / dwgx#45 / dwgx#61 / dwgx#62), entirely on
issues created by other people / by me. Adding to the dashboard credits
in a follow-up commit.

baily-zhang's fourth landed PR (dwgx#36 / dwgx#45 / dwgx#61 / dwgx#62) — adding the
PR dwgx#62 entry to the dashboard credits panel as a separate card so
the inline-script regression-test win is visible alongside the
cascade-reuse machinery work.

v2.0.5 covers everything since 2.0.4:
- aict666 dwgx#54 tool preamble slim + redact U+2026
- abwuge dwgx#58 docker/nginx deploy fix
- baily dwgx#61 Opus 4.7 multimodal context bloat
- baily dwgx#62 dashboard escape regression
- own commits: empty-message validator, internal_error backoff,
  upstream_transient_error category, Opus 4.6 reuse widening,
  /v1/responses endpoint for Codex CLI compatibility (dwgx#56, dwgx#63)

The i18n hint said "默认关闭" while runtime-config.js has defaulted to
true since 2.0 — superkura opened #52 ("关闭了对话还在使用 cascade")
because the dashboard told him the toggle was off. Flip both locales to
"默认开启" and spell out what the toggle actually controls: cascade_id
reuse across requests only, not whether Cascade is used (all premium
models always go through Cascade; tool-emulated requests auto-skip reuse
regardless of this setting).

Credits panel: add S+/S/A+/A/B+ weight badge with tooltip describing why
each contributor earned their tier; append PR #51 (aict666, Opus
injection-guard rewrite) and PR #45 (baily-zhang, trajectory offset)
that were missing from the list; expand summaries for S+/S contributors
to name the specific regression each fix eliminated.

Merge baily-zhang's third major contribution. Two-pronged Opus 4.7 fix:

The blast radius. Claude Code routes through the proxy with tools[] +
images. The proxy was packing the entire Claude Code system prompt
(billing header included), tool fallback preamble, image base64 blobs
and reuse fingerprint inputs onto the user-message channel. Successive
image turns inflated history geometrically and tripped Opus 4.7's
prompt-injection heuristics, resulting in tool refusal cascades.

The fix.
- Image / binary content blocks become text-history placeholders
  instead of base64 dumps.
- Big Claude Code system prompts get compressed (billing header
  dropped, only proxy-relevant context kept).
- Opus 4.7 multimodal tool calls bypass the user-message tool fallback
  entirely (the proto-level section override carries the schema).
- Opus 4.7 tool turns get strict-account-bound narrow cascade reuse
  so retries don't replay full history into a different account.
- Conversation reuse fingerprint stops hashing image base64.
- Regression coverage on every angle (tool fallback, image
  desensitization, system-prompt compression, Opus 4.7 reuse policy).

CI green, npm test 105/105.

baily-zhang's prior surgical work on cascade reuse (PR #36, PR #45)
is what made this diagnosis possible — they own the fingerprint /
trajectory-offset machinery this PR extends.

…ly-zhang to S+

- baily-zhang PR #61 (Opus 4.7 multimodal context bloat) — third major
  contribution after #36 and #45, now de-facto maintainer of the
  reuse-fingerprint / trajectory-offset machinery
- abwuge PR #58 (docker/nginx deploy fix) — first-time contributor,
  +3/-2 surgical, unblocked the docker-compose Restart loop
- aict666 PR #54 (tool preamble slimming + redact marker 6th-gen U+2026
  ellipsis + identity coverage extension) — fourth major contribution
- aict666 PR #53 (redact marker shell-safety regression) — second
  contribution, was missing from the prior credits update
- baily-zhang upgraded from S to S+ (parity with aict666)

The Pages site at dwgx.github.io/WindsurfAPI/ had only 4 names listed
in the footer (dd373156, colin1112a, motto1, youfak). 8 contributors
were missing from the public site even though most of them landed
S+/S level fixes (aict666 #44/#51/#53/#54, baily-zhang #36/#45/#61,
smeinecke #43, abwuge #58).

Adds a dedicated `#contributors` section before the footer with one
card per contributor: avatar, GitHub link, weight badge (S+/S/A+/A/B+),
PR list, and a one-paragraph 繁體中文 description of what each fix
actually solved. Cards reuse the existing panel-card warm/coral
palette to fit the site's aesthetic.

Footer one-liner is also expanded to all 8 names ordered by weight,
with a "完整名單 ↑" anchor back to the new section.

CSS additions: contrib-grid, contrib-card, contrib-avatar,
contrib-weight + 5 weight-tier classes (-S-plus, -S, -A-plus, -A,
-B-plus). All gradient/hover behaviour matches the existing
panel-card styling.

Critical hotfix: my own credits commit (60fcd5a) shipped over-escaped
single quotes (`Codeium\'s Cascade`) inside the inline single-quoted
JS strings of dashboard CONTRIBUTORS, breaking the entire main script
parse. Result: dashboard pages opened but every panel rendered empty
because App.init() never ran.

baily-zhang spotted it within hours, fixed the literal, and added
test/dashboard-syntax.test.js — a regression that statically parses
the inline `<script>` blocks of src/dashboard/index.html with the V8
parser. Future copy/escape regressions in dashboard inline JS will
now break `npm test` instead of silently bricking the live UI.

baily-zhang's fourth landed PR (#36 / #45 / #61 / #62), entirely on
issues created by other people / by me. Adding to the dashboard credits
in a follow-up commit.

baily-zhang's fourth landed PR (#36 / #45 / #61 / #62) — adding the
PR #62 entry to the dashboard credits panel as a separate card so
the inline-script regression-test win is visible alongside the
cascade-reuse machinery work.

v2.0.5 covers everything since 2.0.4:
- aict666 #54 tool preamble slim + redact U+2026
- abwuge #58 docker/nginx deploy fix
- baily #61 Opus 4.7 multimodal context bloat
- baily #62 dashboard escape regression
- own commits: empty-message validator, internal_error backoff,
  upstream_transient_error category, Opus 4.6 reuse widening,
  /v1/responses endpoint for Codex CLI compatibility (#56, #63)

Operational/navigation links updated to MYMDO/WindsurfAPI:
- package.json: homepage, repository.url, bugs.url
- install-ls.sh: OUR_RELEASE
- update.sh: RELEASE_URL
- docker-compose.yml: ghcr.io/mymdo/windsurf-api:latest (lowercased per GHCR)
- SECURITY.md: 2x security advisory URLs
- .github/ISSUE_TEMPLATE/config.yml: security advisory URL
- .github/workflows/release.yml: comment
- README.{md,en,ua,zh}.md: clone URLs, GitHub Pages catalog, Issues/PR CTAs
- docs/index.html: nav GitHub, hero CTA, deploy clone, contributors CTA, footer (GitHub/Releases/Issues/Security/READMEs/CONTRIBUTING)
- src/dashboard/index.html + index-sketch.html: Issue/PR CTA buttons, RELEASE_NOTES blob link

KEPT at dwgx (intentional):
- Historical PR references (PR dwgx#1, dwgx#13, dwgx#36, dwgx#43, dwgx#44, dwgx#45) — they exist only in dwgx/WindsurfAPI
- @dwgx profile link in footer (attribution)
- (c) 2026 dwgx (copyright attribution per MIT)
- package.json author field (original creator)
- bydwgx1337 brand strings in dashboard UI / server provider / version BRAND
- contributors.json (login + historical narrative)
- test fixtures and code comments referencing dwgx
- docs/releases/RELEASE_NOTES_*.md (historical archives)