Repository navigation
v0.8.0
Warning
GitHub Lists sync: list names now follow the app language. If you use the two-way GitHub Lists sync, switching the app language will automatically rename the matched lists on GitHub to the current language's category names on the next sync (for example, 开发工具 → Development Tools). Renaming is best-effort and only touches lists whose names match known category name variants — custom-named lists are left alone — but if you want to keep the current names on GitHub, don't switch the app language.
Warning
GitHub Lists 同步：列表名称现在跟随应用语言。 如果你正在使用 GitHub Lists 双向同步，切换应用语言后，下一次同步会把 GitHub 上名称匹配的列表自动重命名为当前语言的分类名（例如 开发工具 → Development Tools）。重命名是尽力而为的，并且只会触碰名称与已知分类名变体匹配的列表——手动自定义名称的列表不会受影响——但如果你希望保留 GitHub 上现有的名称，请不要切换应用语言。
Note
AI search without a vector index costs a little more now. When Vectorize / vector search is not configured, the new fallback chain makes 2 LLM calls per search (about 7.6k input tokens, roughly +1–2.5 seconds) in exchange for far more relevant results. Measured numbers are in the PR #331 row below.
Note
未配置向量搜索时，AI 搜索的成本略有增加。 没有配置 Vectorize / 向量搜索时，新的降级链每次搜索会发起 2 次 LLM 调用（约 7.6k 输入 token，延迟增加约 1–2.5 秒），换来的是显著更相关的搜索结果。实测数据见下方 PR #331 一行。
What's New in v0.8.0
Version 0.8.0 makes the AI features genuinely useful and closes out a big architecture effort: AI search now works dramatically well even without a vector index (lexical recall + LLM selection, measured P@5 0.21 → 0.67), the MCP tool surface gains discovery tools and trustworthy status metadata, you can restore your workspace by logging in against an existing backend, and the frontend layering migration is complete — the component allowlist is deleted for good. On top of that: security dependency upgrades clearing all 31 scanner findings, a set of release-page fixes, accessibility & visual polish, and more reliable Docker builds.
Changes
| Pull request | Summary |
|---|---|
| #331 | AI search rebuilt for the no-vector case: when vector search is unavailable, the fallback is now a three-stage "lexical recall + LLM selection" chain — one call expands the query (EN+CN keywords, synonyms, an intent restatement), local weighted lexical scoring recalls ~100 candidates (full scan for small libraries), then a second call reads the candidates and returns only genuinely relevant repositories. Measured on a real 951-repo library across 22 bilingual queries: P@5 improved from 0.21 to 0.67, and noise queries that used to return hundreds of irrelevant hits (e.g. "AI code review tools" → 510) now return about 1. Result parsing is fault-tolerant (real repository IDs first, row numbers as fallback — the vector path got the same hardening), AI relevance ordering is preserved instead of being re-sorted by stars, an explicit "no relevant results" from the AI is shown as empty instead of noise, and a lexical top-100 is used as fallback if the LLM call fails. |
| #330 | New MCP discovery tools for agents: bounded read-only gsm_get_repos (batch repository lookup that preserves input order), deterministic local gsm_get_repo_evidence (uses only the local repository database and release cache — no GitHub fan-out, unavailable fields are reported as null), and gsm_find_similar_repos (reuses the existing vector query path and excludes the source repository). gsm_vector_search gains metadata filters (at most 50 candidates retrieved, filtered locally, with candidate/filter statistics). Backend and Electron MCP tool contracts stay aligned: 10 tools with vector search enabled, 8 without. |
| #333 | MCP status metadata now tells the truth: gsm_status reports the real application version (read from synchronized package metadata instead of a hard-coded 0.7.0), the exact availableTools / conditionalTools lists, and gsm_get_repo_evidence adds explicit evidence freshness metadata (repository update time, analysis time, latest release info; clearly null when unknown). Also hardened the release version script: server package metadata is now synchronized from the root package.json with a journal + backup transaction, rollback on failure, and recovery of interrupted runs. |
| #327 | Restore login from an existing backend: the login screen gains an "Already have backend data" path — enter your backend URL and API Key, and the GitHub token plus synchronized data are restored from that backend, so you no longer need to keep and re-enter the token on every device. First-time backend users are guided through GitHub token setup when the backend holds no token yet. The backend URL is normalized and remembered for future logins, insecure remote HTTP addresses are rejected (HTTPS or local addresses only), and backend credential errors are clearly distinguished from GitHub token errors. |
| #323 | New Network Request Routing option (Settings → Backend → "Network Request Routing"): choose auto / backend / browser for where GitHub-facing data requests are sent. Built for self-hosted backends that cannot reach GitHub (for example a domestic VPS) while your own device can: in browser mode, repository/list/gist/Q&A reads, README fetches, AI analysis and release loading go out from your current device instead of the backend. aria2 download routing is unchanged — downloads always originate from the machine running the aria2 daemon — and this setting is stored locally per device, not synced across devices. |
| #332 | GitHub Lists now follow the app language. New lists are created with the current language's category names, and when you switch the app language, matched existing lists on GitHub are automatically renamed on the next sync (best-effort; a failed rename never blocks the sync and is retried next time). No more Mandarin list names surviving a switch to English — reported and fixed against v0.7.9. |
| #324 | Three release-page fixes: RPC (aria2) downloads can be retried — the send button no longer stays disabled forever after a successful send, and per-asset success checkmarks are keyed to the asset's version so a stale ✓ disappears when the asset updates; releases with an empty changelog are backfilled automatically on refresh (change detection now compares body/name/tag, not just assets, and the refresh toast says "updated" accordingly); the time and action columns in release cards stay aligned instead of drifting when action buttons are absent. |
| #329 | The "Assets updated" badge no longer squeezes the timestamp into wrapping (like "大约 2 小时/前" or "资产已更/新"): the metadata column now expands leftward to make room and the timestamp stays on one line, consistent with repository group headers and fork cards. |
| #334 | Accessibility & visual polish pass (no business logic changes): the system "reduce motion" setting is respected (non-essential animation becomes instant), input placeholder contrast raised from 1.89:1 to 4.76:1 light / 8.2:1 dark, Chinese relative dates in the Chinese UI (no more "最近提交 about 1 year ago"), card descriptions and topics are copyable again, search suggestions support keyboard navigation (ArrowUp/ArrowDown to move, Escape to close without clearing the query), the no-results state offers a "Clear all filters" exit, dialogs/sheets/toasts use the unified elevation system, tiny badges meet a 12px floor, default confirm-dialog buttons are localized (确认/取消), and transitions were tightened (exact properties instead of transition-all). |
| #328 | Security dependency upgrades clearing all 31 findings from an external vulnerability scan (each verified against the lockfiles): axios → 1.20.0 (10 CVEs, including prototype pollution, proxy bypass and a recursive DoS), morgan → 1.12.0 (2 log-injection CVEs), express → 4.22.2, plus transitive overrides (qs, fast-uri, ip-address, hono, form-data on the server; decode-uri-component in the root). No behavior changes. Self-hosted / Docker users should pull the new images and redeploy. |
| #326 | Frontend layering migration completed (ADR 0001). The last 10 components that still called services or wrote to the store directly were moved into dedicated action hooks, and the temporary allowlist mechanism itself was deleted — view components can no longer import business services at all. Behavior is unchanged (a handful of documented micro-differences are unreachable or equivalent), with 8 new hook test suites and 724+ tests green. |
| #325 | Continued the same layering migration: updateService / translateService are now banned in view components (enforced by ESLint and the boundary checker), five new action hooks were added (update, translation, debug, login, category-sync), six components were migrated, and login now re-checks backend availability freshly at call time. |
| #315 | CI and release-appearance consistency: all three Docker publishing workflows were upgraded to the Node 24-based versions of the official Docker actions, eliminating the Node 20 deprecation warnings on every run; release asset platform badges (Apple/Windows/Linux…) are now rendered by a shared component so the repository release sheet matches the Release page, and source archives use a consistent code icon. |
| #335 | Fixed the frontend Docker build that had been failing on main since #333: the frontend build context intentionally excludes server/, so the new prebuild version-sync hook crashed with ENOENT inside the container. The frontend image now builds with --ignore-scripts, restoring the previous, reliable build behavior. |
v0.8.0 更新内容
0.8.0 让 AI 功能真正好用，并为一个大版本周期收尾：AI 搜索在没有向量索引的情况下也大幅变准（「词法召回 + LLM 精选」，实测 P@5 从 0.21 提升到 0.67）；MCP 工具面新增发现类工具与可信的状态元数据；登录界面支持从已有后端恢复数据；前端分层迁移宣告完成，组件白名单机制彻底删除。此外还包括：一次性清零 31 项安全扫描漏洞的依赖升级、一批 Release 页面修复、无障碍与视觉打磨，以及更稳定的 Docker 构建。
变更列表
| Pull request | 摘要 |
|---|---|
| #331 | 无向量场景的 AI 搜索重做：向量搜索不可用时，降级链改为三段式**「词法召回 + LLM 精选」**——第一次调用做查询扩展（中英文关键词、同义词、一句话意图复述），本地加权词法打分召回约 100 个候选（小库全量直送），第二次调用由 LLM 阅读候选摘要、只返回真正相关的仓库。在作者真实的 951 个星标仓库、22 条中英文查询上实测：P@5 从 0.21 提升到 0.67；过去返回几百条噪声的查询（如"AI 代码审查工具"返回 510 条）现在只返回约 1 条。结果解析容错（优先真实仓库 ID、行号兜底，向量路径同步加固）；保留 AI 相关性排序、不再被星标排序覆盖；AI 明确返回"无相关"时呈现空结果而不是噪声；LLM 调用失败时按词法得分 top-100 兜底。 |
| #330 | 新增 MCP 发现类工具：有界只读的 gsm_get_repos（批量查询仓库、保持输入顺序）、确定性的本地 gsm_get_repo_evidence（只读本地仓库数据库与 Release 缓存，不外联 GitHub，拿不到的字段明确返回 null）、以及 gsm_find_similar_repos（复用既有向量查询路径并排除源仓库）。gsm_vector_search 支持元数据过滤（最多取回 50 个候选、本地过滤，并报告候选/过滤统计）。后端与桌面端 MCP 工具契约保持一致：开启向量搜索时 10 个工具，未开启时 8 个。 |
| #333 | MCP 状态元数据对齐真实版本：gsm_status 现在报告真实的应用版本（从同步的包元数据读取，不再是硬编码的 0.7.0）、确切的 availableTools / conditionalTools 工具清单；gsm_get_repo_evidence 新增明确的证据新鲜度元数据（仓库更新时间、分析时间、最新 Release 信息；缺失时明确显示 null）。同时加固了版本发布脚本：server 包元数据现在由根 package.json 同步，带日志 + 备份事务、失败回滚与中断恢复。 |
| #327 | 支持从已有后端恢复登录：登录界面新增「已有后端数据」入口——填入后端地址和 API Key，即可从该后端恢复 GitHub Token 与已同步的数据，不再需要在每台设备上保存、重输 Token。后端还没有 Token 时，会引导新用户完成 GitHub Token 配置。后端地址会被规范化并记住供下次登录使用；拒绝不安全的远程 HTTP 地址（仅允许 HTTPS 或本地地址）；后端凭据失效与 GitHub Token 失效会明确区分，临时网络错误可重试。 |
| #323 | 新增网络请求路由选项（设置 → 后端配置 → 「网络请求路由」）：可选 auto / backend / browser，决定 GitHub 数据请求从哪里发出。为「自托管后端访问不了 GitHub（例如境内 VPS）、但本机可以」的场景设计：browser 档下，仓库/列表/Gist/问答读取、README 抓取、AI 分析、Release 加载都改从当前设备直连发出。aria2 下载路由不受影响——下载流量始终由 aria2 守护进程所在机器发出——且该设置只保存在本设备，不做多设备同步。 |
| #332 | GitHub Lists 现在跟随应用语言。 新建的列表使用当前语言的分类名；切换应用语言后，下一次同步会把 GitHub 上名称匹配的列表自动重命名（尽力而为；重命名失败不会阻塞同步，下次同步会重试）。切换到英文后 GitHub 上残留中文列表名的问题不复存在——该问题由用户在 v0.7.9 上报告并修复。 |
| #324 | Release 页三处修复：RPC（aria2）下载可以重试——发送成功后按钮不再永久禁用，且每个资产的成功 ✓ 与资产版本绑定，资产更新后旧 ✓ 自动消失；更新日志为空的 Release 会在刷新时自动回填（变更检测现在比对正文/名称/标签，而不只是资产，刷新提示也会正确显示"有更新"）；Release 卡片的时间列与操作按钮列保持对齐，按钮缺失时时间列不再漂移。 |
| #329 | 「资产已更新」徽标不再把时间戳挤得换行（例如"大约 2 小时/前""资产已更/新"）：元信息列现在会向左自然扩展腾出空间，时间戳保持单行显示，与仓库分组头部、Fork 卡片的行为一致。 |
| #334 | 无障碍与视觉打磨（无业务逻辑改动）：尊重系统**「减少动态效果」设置（非必要动画改为瞬时完成）；输入框占位符对比度从 1.89:1 提升到亮色 4.76:1 / 暗色 8.2:1**；中文界面显示中文相对时间（不再出现"最近提交 about 1 year ago"）；卡片简介与话题恢复可复制；搜索建议支持键盘导航（方向键移动焦点、Escape 关闭且不清空搜索词）；搜索无结果时提供**「清除全部筛选」**出口；弹窗/侧栏/Toast 使用统一的层级阴影体系；过小徽章不小于 12px；确认对话框默认按钮本地化为「确认/取消」；过渡动画收紧（用精确属性替代 transition-all）。 |
| #328 | 依赖升级，一次性清零外部漏扫报告的全部 31 项漏洞（逐条与锁文件核实）：axios → 1.20.0（10 项 CVE，含原型污染、代理绕过、递归 DoS）、morgan → 1.12.0（2 项日志注入 CVE）、express → 4.22.2，以及若干传递依赖 override（server 端 qs、fast-uri、ip-address、hono、form-data；根项目 decode-uri-component）。无行为变化。自托管 / Docker 用户请拉取新镜像并重新部署。 |
| #326 | 前端分层迁移完成（ADR 0001）。 最后 10 个仍在直接调用服务或写 Store 的组件全部迁入专用 action hook，临时的白名单机制本身也被整体删除——View 层组件从此完全禁止导入业务服务。行为无变化（少量有据可查的微差异均不可达或等价），新增 8 个 hook 测试套件，724+ 测试全绿。 |
| #325 | 同一轮分层迁移的推进：updateService / translateService 在 View 组件中被全面封禁（ESLint 与边界检查双重强制），新增 5 个 action hook（更新、翻译、调试、登录、分类同步），迁移 6 个组件，登录时的后端可用性改为调用时实时检查。 |
| #315 | CI 与 Release 外观一致性：三个 Docker 发布 workflow 全部升级到基于 Node 24 的官方 Docker Actions 版本，消除每次运行时的 Node 20 弃用告警；Release 资产的平台徽章（Apple/Windows/Linux…）改由共享组件渲染，仓库 Release 侧栏与 Release 页视觉一致，源码归档使用统一的代码图标。 |
| #335 | 修复自 #333 起在 main 上持续失败的前端 Docker 构建：前端构建上下文刻意排除 server/，新的 prebuild 版本同步钩子在容器内必然找不到文件而报错。前端镜像改用 --ignore-scripts 构建，恢复此前可靠的构建行为。 |
Community Contributions / 社区贡献
This release includes features and fixes contributed by community members — thank you! 🎉
本次发布包含来自社区贡献者的功能与修复，特别感谢以下贡献者 🎉：
-
@Swiftlyfisher — "Restore login from an existing backend" (#327)
-
@ke-1t — MCP discovery tools (#330) and MCP status metadata alignment (#333)
-
@amaruki — GitHub Lists auto-rename on language switch (#332)
-
@Swiftlyfisher — 从已有后端恢复登录（#327）
Desktop Downloads / 桌面端下载
Installers for Windows (.exe), macOS (.dmg), and Linux (.AppImage) are attached in the Assets section below.
Windows（.exe）、macOS（.dmg） 与 Linux（.AppImage） 安装包见下方 Assets。
Full Changelog: v0.7.9...v0.8.0