feat(keyboard): ship AI hint carousel, home library cards, and clipboard polish

Rotate AI idle suggestions with optional remote packs, move history/dictionary onto self-sizing Home preview cards, harden clipboard capture/prompting, and simplify keyboard chrome by dropping most liquid-glass shadows.

docs/privacy.html

@@ -25,7 +25,7 @@
   <p class="top-nav"><a href="./">← OSGKeyboard</a> · <a href="https://apps.apple.com/app/osgkeyboard/id6781553267">App Store</a></p>
   <p class="lang"><a href="#zh">中文</a></p>
   <h1>OSGKeyboard Privacy Policy</h1>
-  <p><strong>Last updated:</strong> August 10, 2026 · <em>v1.1</em></p>
+  <p><strong>Last updated:</strong> August 11, 2026 · <em>v1.2</em></p>
   <p>OSGKeyboard is a custom iOS keyboard that turns your voice into text. It runs as a Custom Keyboard Extension on iOS 26 and later, and uses Apple's on-device <code>SpeechAnalyzer</code> + <code>DictationTranscriber</code> for transcription by default. An optional cloud ASR engine (explicit opt-in) uploads recordings to the provider you configure. After transcription, text may be polished or translated via a cloud LLM. This policy explains what data the app processes and how it is used.</p>
 
   <h2>What we collect</h2>
@@ -34,12 +34,14 @@
     <li><strong>Transcribed text and cursor context</strong> — after ASR, the transcript (not audio) may be sent for polish when you have configured an LLM API key. To continue naturally at the insertion point, a small amount of text immediately before and after the cursor may be included. Secure fields are never captured; cursor context is not written to logs or voice history. Without an API key, raw ASR text is inserted and no polish request is sent. Polish and optional translation use the OpenAI-compatible (or Anthropic) API you configure (e.g. OpenAI, DeepSeek, Qwen DashScope, Moonshot, Zhipu, Xiaomi MiMo, or your own server).</li>
     <li><strong>AI mode questions</strong> — in AI keyboard mode, your spoken question text is sent to the same configured LLM provider. When that provider supports server-side web search, it may retrieve public web results for time-sensitive answers. Search queries and snippets are handled by that provider under its privacy policy; OSGKeyboard does not operate a search index or proxy search traffic.</li>
     <li><strong>API credentials</strong> — your cloud-engine LLM API key is stored in the iOS Keychain on your device and is read only when an LLM request is made. It is shared with the main app through a shared Keychain group, never through UserDefaults. When you enable <strong>iCloud settings sync</strong>, API keys replicate through Apple's <strong>iCloud Keychain</strong> to your other signed-in devices — not through iCloud Key-Value Store JSON.</li>
-    <li><strong>App preferences</strong> — engine mode, recognition language, polish intensity, translation target, handedness, cursor-navigation toggle, and keyboard settings are stored in App Group <code>UserDefaults</code> on your device so the main app and keyboard extension stay in sync. When iCloud settings sync is enabled, these preferences (excluding API keys) may also be mirrored in your private iCloud Key-Value Store account.</li>
+    <li><strong>App preferences</strong> — engine mode, recognition language, polish intensity, translation target, handedness, cursor-navigation toggle, and keyboard settings are stored in App Group <code>UserDefaults</code> on your device so the main app and keyboard extension stay in sync. When iCloud settings sync is enabled, eligible preferences (excluding API keys and the device-local clipboard consent switches) may also be mirrored in your private iCloud Key-Value Store account.</li>
+    <li><strong>Optional clipboard history</strong> — off by default. When enabled, the keyboard may read text copied on this device or received through Universal Clipboard; iOS cannot reliably identify which source supplied an item. Up to 15 accepted items are stored only in this device’s App Group for the host app and keyboard extension. Turning history off stops capture, disables the suggestion strip, and keeps existing items. Reset Settings also keeps them; deletion requires the separate confirmed “Clear clipboard history” action. There is no fixed expiry. Secure fields immediately clear the current suggestion, close the history panel, and hide the clipboard entry point. Conservative filters reject common OTP shapes, PEM private-key headers, long three-part JWTs, Bearer tokens, recognizable provider-key prefixes of safe lengths, and common Luhn-valid 16-digit card numbers; they do not claim to detect every password. Normal order numbers, years, and short labeled account numbers remain eligible. Rejected text can still be pasted once through iOS; it is simply not recorded. Clipboard text is never sent to AI on its own. It leaves the device only when you deliberately ask for it — tapping a clipboard suggestion in AI mode, saying “clipboard” in an AI question, or invoking polish after inserting an item — and it is then sent to your configured provider as separate quoted data, never as instructions.</li>
     <li><strong>Personal dictionary</strong> — terms and aliases you add in the Dictionary tab are stored locally on your device. They are included in LLM polish prompts so your vocabulary is preserved. Optional <strong>iCloud dictionary sync</strong> mirrors your dictionary through your private iCloud Key-Value Store; OSGKeyboard does not operate a separate dictionary server.</li>
     <li><strong>On-device typing learning</strong> — the Chinese keyboard stores selected words and candidate frequencies in the App Group on your device so future candidates improve. This user dictionary is not uploaded by OSGKeyboard.</li>
     <li><strong>Voice history</strong> — the host app may keep a list of recent successful transcripts in its History tab. History is capped at 300 entries. When iCloud settings sync is enabled, history may also sync through your private iCloud Key-Value Store.</li>
     <li><strong>Usage statistics</strong> — cumulative dictation time, dictation characters, and translation characters are computed for the home screen stats card. When iCloud settings sync is enabled, per-device totals may merge through your private iCloud Key-Value Store.</li>
   </ul>
+  <p>Clipboard sensitive-content filtering is applied to newly captured items. Existing history is retained until you use the confirmed clear action.</p>
 
   <h2>What we do not collect</h2>
   <ul>
@@ -56,14 +58,14 @@
   <ul>
     <li><strong>Microphone</strong> (<code>NSMicrophoneUsageDescription</code>) — required for voice input and the long-lived voice session.</li>
     <li><strong>Speech recognition</strong> (<code>NSSpeechRecognitionUsageDescription</code>) — required for on-device transcription via Apple's APIs.</li>
-    <li><strong>Full Access</strong> — required so the keyboard can reach the microphone, read your API key from the shared Keychain, and request the polished transcript from the host app. Full Access does <em>not</em> grant us access to everything you type; we do not exfiltrate keystrokes.</li>
+    <li><strong>Full Access</strong> — required so the keyboard can reach the microphone, read your API key from the shared Keychain, request the polished transcript from the host app, and—only when clipboard history is enabled—read clipboard text. Full Access does <em>not</em> grant us access to everything you type; we do not exfiltrate keystrokes.</li>
   </ul>
 
   <h2>Third parties</h2>
   <p>After ASR, transcribed text may be sent for polish and optional translation when you configure an LLM API key. AI-mode questions may also be sent to that provider, which may perform server-side web search. That provider's privacy policy applies. OSGKeyboard does not proxy, log, or aggregate your requests.</p>
 
   <h2>Data retention</h2>
-  <p>Settings remain on your device until you delete the app or reset settings. When iCloud settings sync is enabled, API keys replicate through iCloud Keychain and preferences, statistics, and history may sync through your private iCloud account. Transcription results are passed to the host app you are typing in and are not stored long-term by OSGKeyboard. Voice history is capped at 300 entries; you can clear it from the History tab or by resetting settings.</p>
+  <p>Settings remain on your device until you delete the app or reset settings. When iCloud settings sync is enabled, API keys replicate through iCloud Keychain and eligible preferences, statistics, and voice history may sync through your private iCloud account. Transcription results are passed to the host app you are typing in and are not stored long-term by OSGKeyboard. Voice history is capped at 300 entries; you can clear it from the History tab or by resetting settings. Clipboard history remains device-local, is capped at 15 entries, has no fixed expiry, and is retained when capture is turned off or settings are reset; use the separate confirmed clear action to delete it.</p>
 
   <h2>Children's privacy</h2>
   <p>OSGKeyboard is not directed to children under 13 and does not knowingly collect personal data from children.</p>
@@ -79,7 +81,7 @@
 
   <hr id="zh">
   <h1>OSGKeyboard 隐私政策</h1>
-  <p><strong>更新日期：</strong>2026 年 8 月 10 日 · <em>v1.1</em></p>
+  <p><strong>更新日期：</strong>2026 年 8 月 11 日 · <em>v1.2</em></p>
   <p>OSGKeyboard 是一款 iOS 自定义键盘，可将语音转为文字。它以自定义键盘扩展的形式运行，需要 iOS 26 及以上系统，默认使用 Apple 端侧的 <code>SpeechAnalyzer</code> + <code>DictationTranscriber</code> 转写；可选的云端识别引擎（需显式二次确认开启）会把录音上传到你配置的服务商。转写完成后，文字可能经云端 LLM 润色或翻译。本政策说明应用处理哪些数据及用途。</p>
 
   <h2>我们处理的数据</h2>
@@ -88,11 +90,13 @@
     <li><strong>转写文字与光标上下文</strong> — ASR 完成后，若你已配置 LLM API Key，转写文字（非音频）可能发送润色。为了在插入点自然衔接，请求可能同时包含光标前后的少量文字。密码框绝不采集，光标上下文不会写入日志或语音历史。未填写 API Key 时直接插入原始识别结果。润色与可选翻译使用你配置的 OpenAI 兼容（或 Anthropic）API（OpenAI / DeepSeek / 通义 DashScope / Moonshot / 智谱 / 小米 MiMo / 自建服务等）。</li>
     <li><strong>AI 模式问题</strong> — 在 AI 键盘模式下，语音转写后的问题文字会发送到同一套已配置的 LLM 服务商。若该服务商支持服务端联网搜索，可能为时效性问题检索公开网页结果。搜索词与检索片段由该服务商按其隐私政策处理；OSGKeyboard 不运营搜索索引，也不中转搜索流量。</li>
     <li><strong>API 凭证</strong> — 云端引擎的 LLM API Key 保存在设备 Keychain，仅在发起 LLM 请求时读取；通过共享 Keychain 组与主 App 共享，<strong>不会</strong>写入 <code>UserDefaults</code>。开启<strong>iCloud 设置同步</strong>后，API 密钥经 Apple <strong>iCloud 钥匙串</strong>同步到你其他已登录设备，<strong>不会</strong>写入 iCloud 键值存储 JSON。</li>
-    <li><strong>应用偏好</strong> — 引擎模式、识别语言、润色档位、翻译目标、握持偏好、光标导航开关、键盘设置等保存在 App Group <code>UserDefaults</code>，用于主 App 与键盘扩展之间的状态同步。开启 iCloud 设置同步后，这些偏好（不含 API 密钥）也可能镜像到你私有的 iCloud 键值存储账户。</li>
+    <li><strong>应用偏好</strong> — 引擎模式、识别语言、润色档位、翻译目标、握持偏好、光标导航开关、键盘设置等保存在 App Group <code>UserDefaults</code>，用于主 App 与键盘扩展之间的状态同步。开启 iCloud 设置同步后，可同步的偏好（不含 API 密钥与本机剪贴板许可开关）也可能镜像到你私有的 iCloud 键值存储账户。</li>
+    <li><strong>可选剪贴板历史</strong> — 默认关闭。开启后，键盘可能读取本机复制或经通用剪贴板收到的文字；iOS 无法可靠判断具体来源。最多 15 条通过规则的文本仅保存在本机主 App 与键盘扩展共享的 App Group。关闭历史只会停止采集、关闭建议条并保留已有记录；重置设置也会保留，只有单独确认的「清空剪贴板历史」操作会删除。历史没有固定过期时间。进入安全输入框会立即清除当前建议、关闭历史面板并隐藏剪贴板入口。保守过滤会拒绝常见 OTP 形态、PEM 私钥头、三段较长的 JWT、Bearer Token、达到安全长度的明确服务商密钥前缀，以及常见的通过 Luhn 校验的 16 位卡号；不宣称识别所有密码。普通订单号、年份与带标签的短账号仍可进入历史。被拒绝的文本仍可经 iOS 一次性粘贴，只是不被记录。剪贴板正文不会自行发送给 AI。只有你主动要求时它才会离开设备——在 AI 模式点选剪贴板建议、在 AI 提问中明确说出「剪贴板」，或插入后主动使用润色——此时会作为单独引用的数据发送给你配置的服务商，绝不作为指令。</li>
     <li><strong>个性词库</strong> — 你在「词库」Tab 添加的词条与别名保存在本机，润色时会写入 LLM 提示词。可选的<strong>iCloud 词库同步</strong>经私有 iCloud 键值存储在多设备间镜像；OSGKeyboard 不运营独立词库服务器。</li>
     <li><strong>语音历史</strong> — 主 App 可在「历史」页保留近期成功转写，上限 300 条。开启 iCloud 设置同步后，历史也可能经私有 iCloud 键值存储同步。</li>
     <li><strong>用量统计</strong> — 首页统计卡片的累计听写时长、听写字数、翻译字数在本地计算。开启 iCloud 设置同步后，各设备分量可能经私有 iCloud 键值存储合并。</li>
   </ul>
+  <p>剪贴板敏感内容过滤仅在新内容采集时执行；已有历史会继续保留，直到你使用带确认的清空操作。</p>
 
   <h2>我们不收集的内容</h2>
   <ul>
@@ -109,14 +113,14 @@
   <ul>
     <li><strong>麦克风</strong>（<code>NSMicrophoneUsageDescription</code>）— 语音输入与长生命周期语音会话所需。</li>
     <li><strong>语音识别</strong>（<code>NSSpeechRecognitionUsageDescription</code>）— 调用 Apple 端侧语音能力进行转写所需。</li>
-    <li><strong>完全访问</strong> — 使键盘能使用麦克风、从共享 Keychain 读取 API Key，并从主 App 获取润色结果。完全访问<strong>不</strong>代表我们会获取你输入的所有内容，绝不外传击键。</li>
+    <li><strong>完全访问</strong> — 使键盘能使用麦克风、从共享 Keychain 读取 API Key、从主 App 获取润色结果，并仅在你开启剪贴板历史后读取剪贴板文字。完全访问<strong>不</strong>代表我们会获取你输入的所有内容，绝不外传击键。</li>
   </ul>
 
   <h2>第三方</h2>
   <p>ASR 完成后，若你配置了 LLM API Key，转写文字可能用于润色与可选翻译；AI 模式问题也可能发送至同一服务商（含服务商侧可选联网搜索）。该服务商的隐私政策适用于相关请求。OSGKeyboard 不代理、不记录、不聚合这些请求。</p>
 
   <h2>数据保留</h2>
-  <p>设置保留在设备上，直至卸载或重置。开启 iCloud 设置同步后，API 密钥经 iCloud 钥匙串同步，偏好、统计与历史可能经私有 iCloud 账户同步。识别结果写入你正在使用的宿主 App，OSGKeyboard 不会长期存储。语音历史上限 300 条，可随时在「历史」页清空或通过重置设置清除。</p>
+  <p>设置保留在设备上，直至卸载或重置。开启 iCloud 设置同步后，API 密钥经 iCloud 钥匙串同步，可同步的偏好、统计与语音历史可能经私有 iCloud 账户同步。识别结果写入你正在使用的宿主 App，OSGKeyboard 不会长期存储。语音历史上限 300 条，可随时在「历史」页清空或通过重置设置清除。剪贴板历史仅保存在本机，上限 15 条，没有固定过期时间；关闭采集或重置设置均会保留，需使用单独确认的清空操作删除。</p>
 
   <h2>儿童隐私</h2>
   <p>OSGKeyboard 不面向 13 岁以下儿童，亦不会明知地从儿童处收集个人信息。</p>