### 变更内容
- **模型**：支持 Anthropic Opus 4.6 和 OpenAI Codex gpt-5.3-codex（向前兼容回退）。(#9853, #10720, #9995) 感谢 @TinyTb, @calvin-hpnet, @tyler6204。
- **提供商**：新增 xAI (Grok) 支持。(#9885) 感谢 @grp06。
- **Web 界面**：新增令牌使用情况仪表板。(#10072) 感谢 @Takhoffman。
- **记忆**：原生支持 Voyage AI。(#7078) 感谢 @mcinteerj。
- **会话**：限制会话历史记录负载大小，以减少上下文溢出。(#10000) 感谢 @gut-puncture。
- **命令行界面**：在帮助输出中按字母顺序排列命令。(#8068) 感谢 @deepsoumya617。
- **代理**：将 pi-mono 升级至 0.52.7；为 Opus 4.6 模型 ID 添加嵌入式向前兼容回退。
### 修复内容
- **Telegram**：在消息工具和子代理通知中自动注入私信主题线程 ID。(#7235) 感谢 @Lukavyi。
- **安全**：要求对网关画布主机和 A2UI 资源进行身份验证。(#9518) 感谢 @coygeek。
- **定时任务**：修复调度和提醒发送的回归问题；强化下次运行时间重新计算、定时器重新启动及旧版调度字段处理。(#9733, #9823, #9948, #9932) 感谢 @tyler6204, @pycckuu, @j2h4u, @fujiwara-tofu-shop。
- **更新**：在更新流程中强化控制界面资源处理。(#10146) 感谢 @gumadeiras。
- **安全**：新增技能/插件代码安全扫描器；从 config.get 网关响应中剔除凭据信息。(#9806, #9858) 感谢 @abdelsfane。
- **执行审批**：将纯字符串允许列表条目强制转换为对象。(#9903) 感谢 @mcaxtr。
- **Slack**：为 /new 和 /reset 命令添加提及信息剥离模式。(#9971) 感谢 @ironbyte-rgb。
- **Chrome 扩展**：修复捆绑包路径解析问题。(#8914) 感谢 @kelvinCB。
- **压缩/错误**：允许在上下文溢出时进行多次压缩重试；显示清晰的计费错误信息。(#8928, #8391) 感谢 @Glucksberg。
### Changes
- Models: support Anthropic Opus 4.6 and OpenAI Codex gpt-5.3-codex (forward-compat fallbacks). (#9853, #10720, #9995) Thanks @TinyTb, @calvin-hpnet, @tyler6204.
- Providers: add xAI (Grok) support. (#9885) Thanks @grp06.
- Web UI: add token usage dashboard. (#10072) Thanks @Takhoffman.
- Memory: native Voyage AI support. (#7078) Thanks @mcinteerj.
- Sessions: cap sessions_history payloads to reduce context overflow. (#10000) Thanks @gut-puncture.
- CLI: sort commands alphabetically in help output. (#8068) Thanks @deepsoumya617.
- Agents: bump pi-mono to 0.52.7; add embedded forward-compat fallback for Opus 4.6 model ids.
### Fixes
- Telegram: auto-inject DM topic threadId in message tool + subagent announce. (#7235) Thanks @Lukavyi.
- Security: require auth for Gateway canvas host and A2UI assets. (#9518) Thanks @coygeek.
- Cron: fix scheduling and reminder delivery regressions; harden next-run recompute + timer re-arming + legacy schedule fields. (#9733, #9823, #9948, #9932) Thanks @tyler6204, @pycckuu, @j2h4u, @fujiwara-tofu-shop.
- Update: harden Control UI asset handling in update flow. (#10146) Thanks @gumadeiras.
- Security: add skill/plugin code safety scanner; redact credentials from config.get gateway responses. (#9806, #9858) Thanks @abdelsfane.
- Exec approvals: coerce bare string allowlist entries to objects. (#9903) Thanks @mcaxtr.
- Slack: add mention stripPatterns for /new and /reset. (#9971) Thanks @ironbyte-rgb.
- Chrome extension: fix bundled path resolution. (#8914) Thanks @kelvinCB.
- Compaction/errors: allow multiple compaction retries on context overflow; show clear billing errors. (#8928, #8391) Thanks @Glucksberg.