From c1bcbfd632f401ec1c081e0f4c5700c69ea998f6 Mon Sep 17 00:00:00 2001
From: lostiv <30612717+lostiv@users.noreply.github.com>
Date: Fri, 8 May 2026 12:46:14 +0800
Subject: [PATCH 01/47] Add configuration for auto review in coderabbit

---
 .coderabbit.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 .coderabbit.yaml

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 0000000..27177a8
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,10 @@
+language: zh-CN  # 中文评论
+reviews:
+  auto_review:
+    enabled: true   # 新建PR自动审核
+    drafts: false   # 不审核草稿PR
+  min_lines: 1      # 至少1行改动才触发
+path_filters:       # 忽略的文件/目录
+  - "!**/*.md"
+  - "!node_modules/**"
+  - "!dist/**"

From 919b0f9794c138817c85b7dcec9fd6679eabf511 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Fri, 8 May 2026 12:52:39 +0800
Subject: [PATCH 02/47] =?UTF-8?q?feat:=20=E6=B7=BB=E5=8A=A0=20Docker=20Bui?=
 =?UTF-8?q?ld=20&=20Push=20GitHub=20Actions=20=E5=B7=A5=E4=BD=9C=E6=B5=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

支持 release 发布和手动触发，前后端镜像分开构建并推送到 Docker Hub。
---
 .github/workflows/docker-build.yml | 84 ++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 .github/workflows/docker-build.yml

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
new file mode 100644
index 0000000..fff1685
--- /dev/null
+++ b/.github/workflows/docker-build.yml
@@ -0,0 +1,84 @@
+name: Docker Build & Push
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+env:
+  FRONTEND_IMAGE: lost4/gitstars
+  BACKEND_IMAGE: lost4/gitstars
+
+jobs:
+  generate-tags:
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.tags.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Generate tags
+        id: tags
+        run: |
+          VER=$(node -p "require('./package.json').version")
+          echo "version=$VER" >> $GITHUB_OUTPUT
+
+  build-frontend:
+    needs: generate-tags
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push frontend
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
+          push: true
+          provenance: false
+          tags: |
+            ${{ env.FRONTEND_IMAGE }}:${{ needs.generate-tags.outputs.version }}
+            ${{ env.FRONTEND_IMAGE }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  build-backend:
+    needs: generate-tags
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push backend
+        uses: docker/build-push-action@v6
+        with:
+          context: ./server
+          file: ./server/Dockerfile
+          platforms: linux/amd64
+          push: true
+          provenance: false
+          tags: |
+            ${{ env.BACKEND_IMAGE }}:${{ needs.generate-tags.outputs.version }}-backend
+            ${{ env.BACKEND_IMAGE }}:backend
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

From 2be06ec0e18ed1825cfeec98272669e21f52fd29 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Fri, 8 May 2026 13:12:03 +0800
Subject: [PATCH 03/47] =?UTF-8?q?fix:=20=E5=89=8D=E7=AB=AF=20Dockerfile=20?=
 =?UTF-8?q?=E5=8D=87=E7=BA=A7=20Node=2018=20=E2=86=92=2022=EF=BC=8C?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20Actions=20=E6=9E=84=E5=BB=BA=E5=A4=B1?=
 =?UTF-8?q?=E8=B4=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index db3976f..1fb17cc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build stage
-FROM node:18-alpine AS build
+FROM node:22-alpine AS build
 
 WORKDIR /app
 

From 96ce87d302d037f6a90e8ad9c98c5d8f4a16bd32 Mon Sep 17 00:00:00 2001
From: lostiv <30612717+lostiv@users.noreply.github.com>
Date: Fri, 8 May 2026 13:20:31 +0800
Subject: [PATCH 04/47] Refactor CodeRabbit configuration in .coderabbit.yaml

Updated CodeRabbit configuration with new review settings and ignore patterns.
---
 .coderabbit.yaml | 42 +++++++++++++++++++++++++++++++++---------
 1 file changed, 33 insertions(+), 9 deletions(-)

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index 27177a8..ba74855 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -1,10 +1,34 @@
-language: zh-CN  # 中文评论
+# CodeRabbit 全局配置
+language: Chinese
 reviews:
-  auto_review:
-    enabled: true   # 新建PR自动审核
-    drafts: false   # 不审核草稿PR
-  min_lines: 1      # 至少1行改动才触发
-path_filters:       # 忽略的文件/目录
-  - "!**/*.md"
-  - "!node_modules/**"
-  - "!dist/**"
+  auto_review: true
+  profile: balanced
+  high_level_summary: true
+  review_status: true
+  poem: false
+  walkthrough: true
+
+# 自动总结 PR、代码解释
+knowledge_base:
+  enabled: true
+
+# 忽略不需要审查的文件
+ignore:
+  - "*.md"
+  - "docs/**"
+  - "static/**"
+  - "assets/**"
+  - "node_modules/**"
+  - "dist/**"
+  - "build/**"
+
+# 审查规则：风格、安全、性能
+rules:
+  style:
+    enabled: true
+  security:
+    enabled: true
+  performance:
+    enabled: true
+  best_practices:
+    enabled: true

From 81054ddd2fd7fd3f30b81b99d42fcbd05dd9424f Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Fri, 8 May 2026 13:22:35 +0800
Subject: [PATCH 05/47] =?UTF-8?q?chore:=20build-desktop=20=E6=94=B9?=
 =?UTF-8?q?=E4=B8=BA=E4=BB=85=E6=89=8B=E5=8A=A8=E8=A7=A6=E5=8F=91?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build-desktop.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build-desktop.yml b/.github/workflows/build-desktop.yml
index f26a193..8feb429 100644
--- a/.github/workflows/build-desktop.yml
+++ b/.github/workflows/build-desktop.yml
@@ -1,11 +1,11 @@
 name: Build Desktop App
 
 on:
-  push:
-    branches: [ main, master ]
-    tags: [ 'v*' ]
-  pull_request:
-    branches: [ main, master ]
+  # push:
+  #   branches: [ main, master ]
+  #   tags: [ 'v*' ]
+  # pull_request:
+  #   branches: [ main, master ]
   workflow_dispatch:
 
 jobs:

From 43b8fcad94718916f95b7f10e39cce0efadb5d4f Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Fri, 8 May 2026 16:14:33 +0800
Subject: [PATCH 06/47] =?UTF-8?q?fix:=20WebDAV=20=E4=BC=98=E5=85=88?=
 =?UTF-8?q?=E8=B5=B0=E5=90=8E=E7=AB=AF=E4=BB=A3=E7=90=86=EF=BC=8C=E8=A7=A3?=
 =?UTF-8?q?=E5=86=B3=E6=B5=8F=E8=A7=88=E5=99=A8=20CORS=20=E8=B7=A8?=
 =?UTF-8?q?=E5=9F=9F=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

当后端可用时，WebDAVService 通过 POST /api/proxy/webdav 代理请求，
避免浏览器直接跨域访问 WebDAV 服务器。后端不可用时回退到浏览器直连。
---
 src/services/webdavService.ts | 355 ++++++++++++++++++++++------------
 1 file changed, 229 insertions(+), 126 deletions(-)

diff --git a/src/services/webdavService.ts b/src/services/webdavService.ts
index 2d9e631..64a9603 100644
--- a/src/services/webdavService.ts
+++ b/src/services/webdavService.ts
@@ -1,4 +1,5 @@
 import { WebDAVConfig } from '../types';
+import { backend } from './backendAdapter';
 
 export class WebDAVService {
   private config: WebDAVConfig;
@@ -7,6 +8,24 @@ export class WebDAVService {
     this.config = config;
   }
 
+  private get useProxy(): boolean {
+    return backend.isAvailable;
+  }
+
+  private get basePath(): string {
+    return this.config.path.endsWith('/') ? this.config.path : `${this.config.path}/`;
+  }
+
+  // 通过后端代理发送请求，避免浏览器 CORS 限制
+  private async proxyFetch(
+    method: string,
+    fullPath: string,
+    body?: string,
+    headers?: Record<string, string>,
+  ): Promise<Response> {
+    return backend.proxyWebDAV(this.config.id, method, fullPath, body, headers);
+  }
+
   // 压缩JSON数据，减少传输大小
   private compressData(content: string): string {
     try {
@@ -78,13 +97,16 @@ export class WebDAVService {
   }
 
   private getFullPath(filename: string): string {
-    const basePath = this.config.path.endsWith('/') ? this.config.path : `${this.config.path}/`;
-    return `${this.config.url}${basePath}${filename}`;
+    return `${this.config.url}${this.basePath}${filename}`;
+  }
+
+  private getRelativePath(filename: string): string {
+    return `${this.basePath}${filename}`;
   }
 
   private handleNetworkError(error: unknown, operation: string): never {
     console.error(`WebDAV ${operation} failed:`, error);
-    
+
     const err = error as Error;
     const isCorsError = (
       (err.name === 'TypeError' && err.message.includes('Failed to fetch')) ||
@@ -122,7 +144,7 @@ export class WebDAVService {
 
 技术详情: ${err.message}`);
     }
-    
+
     throw new Error(`WebDAV ${operation} 失败: ${err.message || '未知错误'}`);
   }
 
@@ -133,12 +155,27 @@ export class WebDAVService {
         throw new Error('WebDAV URL必须以 http:// 或 https:// 开头');
       }
 
-      // 构建用于测试的目录URL（优先测试配置中的 path）
+      // 优先走后端代理，避免 CORS
+      if (this.useProxy) {
+        try {
+          // HEAD 请求检测可达性
+          const headResponse = await this.proxyFetch('HEAD', this.config.path);
+          if (headResponse.ok) return true;
+
+          // 回退 PROPFIND
+          const propfindResponse = await this.proxyFetch('PROPFIND', this.config.path, undefined, { Depth: '0' });
+          return propfindResponse.ok || propfindResponse.status === 207;
+        } catch (proxyErr) {
+          console.warn('代理连接测试失败，回退到直连:', proxyErr);
+          // 回退到浏览器直连
+        }
+      }
+
+      // 浏览器直连（回退方案）
       const dirUrl = `${this.config.url}${this.config.path}`;
 
-      // 先尝试 HEAD 请求检测基本可达性（某些服务器对 PROPFIND/OPTIONS 支持较差）
       const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), 10000); // 10秒超时
+      const timeoutId = setTimeout(() => controller.abort(), 10000);
 
       try {
         const headResponse = await fetch(dirUrl, {
@@ -153,7 +190,6 @@ export class WebDAVService {
 
         if (headResponse.ok) return true;
 
-        // HEAD 不可用时，尝试 PROPFIND（不少服务器返回 207 Multi-Status 表示成功）
         const propfindResponse = await fetch(dirUrl, {
           method: 'PROPFIND',
           headers: {
@@ -165,11 +201,11 @@ export class WebDAVService {
         return propfindResponse.ok || propfindResponse.status === 207;
       } catch (fetchError: unknown) {
         clearTimeout(timeoutId);
-        
+
         if ((fetchError as Error).name === 'AbortError') {
           throw new Error('连接超时。请检查WebDAV服务器是否可访问。');
         }
-        
+
         throw fetchError;
       }
     } catch (error: unknown) {
@@ -197,12 +233,30 @@ export class WebDAVService {
       // 确保目录存在
       await this.ensureDirectoryExists();
 
-      // 动态计算超时时间：基于压缩后文件大小，最小60秒，最大300秒
-      const finalSizeKB = Math.round(compressedContent.length / 1024);
-      const dynamicTimeout = Math.max(60000, Math.min(300000, finalSizeKB * 100)); // 每KB 100ms
-      console.log(`设置超时时间: ${dynamicTimeout}ms`);
-
       const uploadOperation = async (): Promise<boolean> => {
+        if (this.useProxy) {
+          const response = await this.proxyFetch(
+            'PUT',
+            this.getRelativePath(filename),
+            compressedContent,
+            { 'Content-Type': 'application/json' },
+          );
+
+          if (!response.ok) {
+            if (response.status === 401) throw new Error('身份验证失败。请检查用户名和密码。');
+            if (response.status === 403) throw new Error('访问被拒绝。请检查指定路径的权限。');
+            if (response.status === 404) throw new Error('路径未找到。请验证WebDAV URL和路径是否正确。');
+            if (response.status === 507) throw new Error('服务器存储空间不足。');
+            throw new Error(`上传失败，HTTP状态码 ${response.status}`);
+          }
+
+          return true;
+        }
+
+        // 浏览器直连（回退方案）
+        const finalSizeKB = Math.round(compressedContent.length / 1024);
+        const dynamicTimeout = Math.max(60000, Math.min(300000, finalSizeKB * 100));
+
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), dynamicTimeout);
 
@@ -220,18 +274,10 @@ export class WebDAVService {
           clearTimeout(timeoutId);
 
           if (!response.ok) {
-            if (response.status === 401) {
-              throw new Error('身份验证失败。请检查用户名和密码。');
-            }
-            if (response.status === 403) {
-              throw new Error('访问被拒绝。请检查指定路径的权限。');
-            }
-            if (response.status === 404) {
-              throw new Error('路径未找到。请验证WebDAV URL和路径是否正确。');
-            }
-            if (response.status === 507) {
-              throw new Error('服务器存储空间不足。');
-            }
+            if (response.status === 401) throw new Error('身份验证失败。请检查用户名和密码。');
+            if (response.status === 403) throw new Error('访问被拒绝。请检查指定路径的权限。');
+            if (response.status === 404) throw new Error('路径未找到。请验证WebDAV URL和路径是否正确。');
+            if (response.status === 507) throw new Error('服务器存储空间不足。');
             throw new Error(`上传失败，HTTP状态码 ${response.status}: ${response.statusText}`);
           }
 
@@ -250,8 +296,8 @@ export class WebDAVService {
       return await this.retryUpload(uploadOperation);
     } catch (error: unknown) {
       const err = error as Error;
-      if (err.message.includes('身份验证失败') || 
-          err.message.includes('访问被拒绝') || 
+      if (err.message.includes('身份验证失败') ||
+          err.message.includes('访问被拒绝') ||
           err.message.includes('路径未找到') ||
           err.message.includes('存储空间不足') ||
           err.message.includes('上传失败，HTTP状态码') ||
@@ -266,46 +312,72 @@ export class WebDAVService {
   private async ensureDirectoryExists(): Promise<void> {
     try {
       if (!this.config.path || this.config.path === '/') {
-        return; // 根目录总是存在
+        return;
       }
 
-      // 逐级创建目录，避免服务器因中间目录不存在而返回 409/403
-      const cleanedPath = this.config.path.replace(/\/+$/, ''); // 去掉末尾斜杠
-      const segments = cleanedPath.split('/').filter(Boolean); // 去掉空段
+      const cleanedPath = this.config.path.replace(/\/+$/, '');
+      const segments = cleanedPath.split('/').filter(Boolean);
       let currentPath = '';
 
       for (const seg of segments) {
         currentPath += `/${seg}`;
-        const full = `${this.config.url}${currentPath}`;
-        try {
-          const res = await fetch(full, {
-            method: 'MKCOL',
-            headers: { 'Authorization': this.getAuthHeader() },
-          });
 
-          // 201 Created（新建）或 405 Method Not Allowed（已存在）都视为成功
-          if (!res.ok && res.status !== 405) {
-            // 某些服务器对已存在目录返回 409 Conflict
-            if (res.status !== 409) {
+        if (this.useProxy) {
+          try {
+            const res = await this.proxyFetch('MKCOL', currentPath);
+            if (!res.ok && res.status !== 405 && res.status !== 409) {
               console.warn(`无法创建目录 ${currentPath}，状态码: ${res.status}`);
-              break; // 不再继续往下建
+              break;
+            }
+          } catch (e) {
+            console.warn(`创建目录 ${currentPath} 发生异常:`, e);
+            break;
+          }
+        } else {
+          const full = `${this.config.url}${currentPath}`;
+          try {
+            const res = await fetch(full, {
+              method: 'MKCOL',
+              headers: { 'Authorization': this.getAuthHeader() },
+            });
+
+            if (!res.ok && res.status !== 405) {
+              if (res.status !== 409) {
+                console.warn(`无法创建目录 ${currentPath}，状态码: ${res.status}`);
+                break;
+              }
             }
+          } catch (e) {
+            console.warn(`创建目录 ${currentPath} 发生异常:`, e);
+            break;
           }
-        } catch (e) {
-          console.warn(`创建目录 ${currentPath} 发生异常:`, e);
-          break;
         }
       }
     } catch (error) {
       console.warn('目录创建检查失败:', error);
-      // 不在这里抛出错误，因为目录可能已经存在
     }
   }
 
   async downloadFile(filename: string): Promise<string | null> {
     try {
+      if (this.useProxy) {
+        const response = await this.proxyFetch('GET', this.getRelativePath(filename));
+
+        if (response.ok) {
+          const data: unknown = await response.json();
+          // 后端代理返回的是 JSON 包装的数据，可能是已解析的对象或字符串
+          if (typeof data === 'string') return data;
+          return JSON.stringify(data);
+        }
+
+        if (response.status === 404) return null;
+        if (response.status === 401) throw new Error('身份验证失败。请检查用户名和密码。');
+        throw new Error(`下载失败，HTTP状态码 ${response.status}`);
+      }
+
+      // 浏览器直连（回退方案）
       const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), 30000); // 30秒超时
+      const timeoutId = setTimeout(() => controller.abort(), 30000);
 
       try {
         const response = await fetch(this.getFullPath(filename), {
@@ -315,34 +387,34 @@ export class WebDAVService {
           },
           signal: controller.signal,
         });
-        
+
         clearTimeout(timeoutId);
 
         if (response.ok) {
           return await response.text();
         }
-        
+
         if (response.status === 404) {
-          return null; // 文件未找到是预期行为
+          return null;
         }
-        
+
         if (response.status === 401) {
           throw new Error('身份验证失败。请检查用户名和密码。');
         }
-        
+
         throw new Error(`下载失败，HTTP状态码 ${response.status}: ${response.statusText}`);
       } catch (fetchError: unknown) {
         clearTimeout(timeoutId);
-        
+
         if ((fetchError as Error).name === 'AbortError') {
           throw new Error('下载超时。请检查网络连接。');
         }
-        
+
         throw fetchError;
       }
     } catch (error: unknown) {
       const err = error as Error;
-      if (err.message.includes('身份验证失败') || 
+      if (err.message.includes('身份验证失败') ||
           err.message.includes('下载超时')) {
         throw error;
       }
@@ -355,8 +427,13 @@ export class WebDAVService {
 
   async fileExists(filename: string): Promise<boolean> {
     try {
+      if (this.useProxy) {
+        const response = await this.proxyFetch('HEAD', this.getRelativePath(filename));
+        return response.ok;
+      }
+
       const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), 10000); // 10秒超时
+      const timeoutId = setTimeout(() => controller.abort(), 10000);
 
       const response = await fetch(this.getFullPath(filename), {
         method: 'HEAD',
@@ -376,13 +453,36 @@ export class WebDAVService {
 
   async listFiles(): Promise<string[]> {
     try {
+      if (this.useProxy) {
+        const response = await this.proxyFetch(
+          'PROPFIND',
+          this.config.path,
+          `<?xml version="1.0" encoding="utf-8" ?>
+            <D:propfind xmlns:D="DAV:">
+              <D:prop>
+                <D:displayname/>
+                <D:getlastmodified/>
+                <D:getcontentlength/>
+              </D:prop>
+            </D:propfind>`,
+          { Depth: '1', 'Content-Type': 'application/xml' },
+        );
+
+        if (response.ok || response.status === 207) {
+          const data: unknown = await response.json();
+          const xmlText = typeof data === 'string' ? data : JSON.stringify(data);
+          return this.parsePropfindXml(xmlText);
+        }
+        if (response.status === 401) throw new Error('身份验证失败。请检查用户名和密码。');
+        throw new Error(`列出文件失败，HTTP状态码 ${response.status}`);
+      }
+
+      // 浏览器直连（回退方案）
       const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), 15000); // 15秒超时
+      const timeoutId = setTimeout(() => controller.abort(), 15000);
 
       try {
-        // 确保目录URL以斜杠结尾，避免部分服务器对集合路径的歧义
-        const basePath = this.config.path.endsWith('/') ? this.config.path : `${this.config.path}/`;
-        const collectionUrl = `${this.config.url}${basePath}`;
+        const collectionUrl = `${this.config.url}${this.basePath}`;
 
         const response = await fetch(collectionUrl, {
           method: 'PROPFIND',
@@ -406,78 +506,24 @@ export class WebDAVService {
 
         if (response.ok || response.status === 207) {
           const xmlText = await response.text();
-
-          // 优先用 DOMParser 解析（更可靠，兼容 displayname 缺失的服务端）
-          try {
-            const parser = new DOMParser();
-            const xml = parser.parseFromString(xmlText, 'application/xml');
-            const responses = Array.from(xml.getElementsByTagNameNS('DAV:', 'response'));
-
-            const results: string[] = [];
-
-            for (const res of responses) {
-              const hrefEl = res.getElementsByTagNameNS('DAV:', 'href')[0];
-              if (!hrefEl || !hrefEl.textContent) continue;
-              let href = hrefEl.textContent;
-
-              // 过滤掉集合自身（目录本身）
-              // 有的服务返回绝对URL，有的返回相对路径，统一去比较末尾路径
-              const normalizedCollection = collectionUrl.replace(/^https?:\/\//, '').replace(/\/+$/, '/');
-              const normalizedHref = href.replace(/^https?:\/\//, '');
-              if (normalizedHref.endsWith(normalizedCollection)) continue;
-
-              // 提取文件名
-              try {
-                // 去掉末尾斜杠（目录）
-                href = href.replace(/\/+$/, '');
-                const parts = href.split('/').filter(Boolean);
-                if (parts.length === 0) continue;
-                const last = decodeURIComponent(parts[parts.length - 1]);
-                if (last.toLowerCase().endsWith('.json')) {
-                  results.push(last.trim());
-                }
-              } catch {
-                // 忽略单个条目解析失败
-              }
-            }
-
-            if (results.length > 0) return results;
-          } catch {
-            // DOMParser 失败时降级为正则提取 href/displayname
-            const namesFromDisplay = (xmlText.match(/<D:displayname>([^<]+)<\/D:displayname>/gi) || [])
-              .map(m => m.replace(/<\/?D:displayname>/gi, ''))
-              .map(s => s.trim())
-              .filter(name => name.toLowerCase().endsWith('.json'));
-
-            if (namesFromDisplay.length > 0) return namesFromDisplay;
-
-            const namesFromHref = (xmlText.match(/<D:href>([^<]+)<\/D:href>/gi) || [])
-              .map(m => m.replace(/<\/?D:href>/gi, ''))
-              .map(s => s.replace(/\/+$/, ''))
-              .map(s => decodeURIComponent(s.split('/').filter(Boolean).pop() || ''))
-              .map(s => s.trim())
-              .filter(name => name.toLowerCase().endsWith('.json'));
-
-            if (namesFromHref.length > 0) return namesFromHref;
-          }
-        } else if (response.status === 401) {
+          return this.parsePropfindXml(xmlText);
+        }
+        if (response.status === 401) {
           throw new Error('身份验证失败。请检查用户名和密码。');
-        } else {
-          throw new Error(`列出文件失败，HTTP状态码 ${response.status}: ${response.statusText}`);
         }
-        return [];
+        throw new Error(`列出文件失败，HTTP状态码 ${response.status}: ${response.statusText}`);
       } catch (fetchError: unknown) {
         clearTimeout(timeoutId);
-        
+
         if ((fetchError as Error).name === 'AbortError') {
           throw new Error('列出文件超时。请检查网络连接。');
         }
-        
+
         throw fetchError;
       }
     } catch (error: unknown) {
       const err = error as Error;
-      if (err.message.includes('身份验证失败') || 
+      if (err.message.includes('身份验证失败') ||
           err.message.includes('列出文件超时')) {
         throw error;
       }
@@ -485,7 +531,64 @@ export class WebDAVService {
     }
   }
 
-  // 新增：验证配置的静态方法
+  private parsePropfindXml(xmlText: string): string[] {
+    const collectionUrl = `${this.config.url}${this.basePath}`;
+
+    // 优先用 DOMParser 解析
+    try {
+      const parser = new DOMParser();
+      const xml = parser.parseFromString(xmlText, 'application/xml');
+      const responses = Array.from(xml.getElementsByTagNameNS('DAV:', 'response'));
+
+      const results: string[] = [];
+
+      for (const res of responses) {
+        const hrefEl = res.getElementsByTagNameNS('DAV:', 'href')[0];
+        if (!hrefEl || !hrefEl.textContent) continue;
+        let href = hrefEl.textContent;
+
+        const normalizedCollection = collectionUrl.replace(/^https?:\/\//, '').replace(/\/+$/, '/');
+        const normalizedHref = href.replace(/^https?:\/\//, '');
+        if (normalizedHref.endsWith(normalizedCollection)) continue;
+
+        try {
+          href = href.replace(/\/+$/, '');
+          const parts = href.split('/').filter(Boolean);
+          if (parts.length === 0) continue;
+          const last = decodeURIComponent(parts[parts.length - 1]);
+          if (last.toLowerCase().endsWith('.json')) {
+            results.push(last.trim());
+          }
+        } catch {
+          // 忽略单个条目解析失败
+        }
+      }
+
+      if (results.length > 0) return results;
+    } catch {
+      // DOMParser 失败时降级为正则提取
+    }
+
+    const namesFromDisplay = (xmlText.match(/<D:displayname>([^<]+)<\/D:displayname>/gi) || [])
+      .map(m => m.replace(/<\/?D:displayname>/gi, ''))
+      .map(s => s.trim())
+      .filter(name => name.toLowerCase().endsWith('.json'));
+
+    if (namesFromDisplay.length > 0) return namesFromDisplay;
+
+    const namesFromHref = (xmlText.match(/<D:href>([^<]+)<\/D:href>/gi) || [])
+      .map(m => m.replace(/<\/?D:href>/gi, ''))
+      .map(s => s.replace(/\/+$/, ''))
+      .map(s => decodeURIComponent(s.split('/').filter(Boolean).pop() || ''))
+      .map(s => s.trim())
+      .filter(name => name.toLowerCase().endsWith('.json'));
+
+    if (namesFromHref.length > 0) return namesFromHref;
+
+    return [];
+  }
+
+  // 验证配置的静态方法
   static validateConfig(config: Partial<WebDAVConfig>): string[] {
     const errors: string[] = [];
 
@@ -512,7 +615,7 @@ export class WebDAVService {
     return errors;
   }
 
-  // 新增：获取服务器信息
+  // 获取服务器信息
   async getServerInfo(): Promise<{ server?: string; davLevel?: string }> {
     try {
       const response = await fetch(this.config.url, {
@@ -531,7 +634,7 @@ export class WebDAVService {
     } catch (error) {
       console.warn('无法获取服务器信息:', error);
     }
-    
+
     return {};
   }
 }

From b0ed119d3e81faf6c8738d6881fff063ce0045e0 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 10:42:08 +0800
Subject: [PATCH 07/47] =?UTF-8?q?@=20chore:=20=E4=BD=BF=E7=94=A8=E9=A2=84?=
 =?UTF-8?q?=E6=9E=84=E5=BB=BA=E9=95=9C=E5=83=8F=E6=9B=BF=E4=BB=A3=E6=9C=AC?=
 =?UTF-8?q?=E5=9C=B0=E6=9E=84=E5=BB=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

前端使用 lost4/gitstars:latest，后端使用 lost4/gitstars:backend
@
---
 docker-compose.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 85c99be..87b4c18 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,7 +2,7 @@ version: '3.8'
 
 services:
   frontend:
-    build: .
+    image: lost4/gitstars:latest
     ports:
       - "8080:80"
     depends_on:
@@ -10,7 +10,7 @@ services:
     restart: unless-stopped
 
   backend:
-    build: ./server
+    image: lost4/gitstars:backend
     expose:
       - "3000"
     environment:

From 839af40caabc64178d4357ef38e09a0156d0a424 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 11:29:00 +0800
Subject: [PATCH 08/47] =?UTF-8?q?@=20fix:=20=E4=BF=AE=E5=A4=8D=20PUT=20/ap?=
 =?UTF-8?q?i/releases=20=E7=BC=BA=E5=B0=91=E4=B8=80=E4=B8=AA=E5=8D=A0?=
 =?UTF-8?q?=E4=BD=8D=E7=AC=A6=E5=AF=BC=E8=87=B4=E6=8F=92=E5=85=A5=E5=A4=B1?=
 =?UTF-8?q?=E8=B4=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VALUES 子句只有 14 个 ?，但表有 15 列，补全为 15 个
@
---
 server/src/routes/releases.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/routes/releases.ts b/server/src/routes/releases.ts
index 840c1bd..1aedd09 100644
--- a/server/src/routes/releases.ts
+++ b/server/src/routes/releases.ts
@@ -100,7 +100,7 @@ router.put('/api/releases', (req, res) => {
         prerelease, draft, is_read, assets,
         repo_id, repo_full_name, repo_name,
         zipball_url, tarball_url
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
 
     const upsert = db.transaction(() => {

From fb9ec53d496d6636af7379c4da2c2c1411937284 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 11:44:18 +0800
Subject: [PATCH 09/47] =?UTF-8?q?@=20fix:=20=E4=BF=AE=E5=A4=8D=20PUT=20/ap?=
 =?UTF-8?q?i/settings=20=E5=AD=98=E5=82=A8=E9=9D=9E=E5=AD=97=E7=AC=A6?=
 =?UTF-8?q?=E4=B8=B2=E5=80=BC=E6=97=B6=E6=8A=A5=E5=8F=82=E6=95=B0=E9=94=99?=
 =?UTF-8?q?=E8=AF=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

自动将数组/对象序列化为 JSON 字符串存储，读取时自动解析回原始类型
@
---
 server/src/routes/configs.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/server/src/routes/configs.ts b/server/src/routes/configs.ts
index f3838a5..2185595 100644
--- a/server/src/routes/configs.ts
+++ b/server/src/routes/configs.ts
@@ -426,7 +426,12 @@ router.get('/api/settings', (_req, res) => {
         settings.github_token_status = status;
       }
 
-      settings[key] = value;
+      // Try to parse JSON values back to objects/arrays
+      if (typeof value === 'string' && (value.startsWith('[') || value.startsWith('{'))) {
+        try { settings[key] = JSON.parse(value); } catch { settings[key] = value; }
+      } else {
+        settings[key] = value;
+      }
     }
 
     res.json(settings);
@@ -456,7 +461,7 @@ router.put('/api/settings', (req, res) => {
           value = encrypt(value, config.encryptionKey);
         }
 
-        stmt.run(key, value ?? null);
+        stmt.run(key, typeof value === 'string' ? value : value != null ? JSON.stringify(value) : null);
       }
     });
 

From 82a0927ee55d4448c96f23b6fd253f285cea3196 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 11:57:13 +0800
Subject: [PATCH 10/47] =?UTF-8?q?@=20chore:=20=E9=80=82=E9=85=8D=20CodeRab?=
 =?UTF-8?q?bit=20=E9=85=8D=E7=BD=AE=E5=88=B0=20GithubStarsManager=20?=
 =?UTF-8?q?=E9=A1=B9=E7=9B=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

技术栈：React 18 + Express + better-sqlite3 + Tailwind CSS
@
---
 .coderabbit.yaml | 366 +++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 339 insertions(+), 27 deletions(-)

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index ba74855..a37f28e 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -1,34 +1,346 @@
-# CodeRabbit 全局配置
-language: Chinese
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+
+# ──────────────────────────────────────────────
+# CodeRabbit 配置 — GithubStarsManager
+# 文档：https://docs.coderabbit.ai/guides/configure-coderabbit
+# ──────────────────────────────────────────────
+
+language: "zh-CN"
+
+tone_instructions: >
+  请用简洁专业的中文回复，重点关注代码质量、安全性和性能优化。
+  前端 React 18 + TypeScript + Vite + Tailwind CSS + Zustand。
+  后端 Express + better-sqlite3 (Node.js + TypeScript)。
+  注意暗色/亮色双主题兼容（dark: 前缀），以及移动端响应式布局。
+
+early_access: true
+enable_free_tier: true
+
+# ──────────────────────────────────────────────
+# 审查设置
+# ──────────────────────────────────────────────
 reviews:
-  auto_review: true
-  profile: balanced
+  profile: "chill"
+  request_changes_workflow: false
+
   high_level_summary: true
+  high_level_summary_placeholder: "@coderabbitai summary"
+  high_level_summary_in_walkthrough: true
+  changed_files_summary: true
+
+  sequence_diagrams: true
+  estimate_code_review_effort: true
+  assess_linked_issues: true
+  related_prs: true
+
+  suggested_labels: true
+  auto_apply_labels: true
+  suggested_reviewers: false
+  auto_assign_reviewers: false
+
   review_status: true
+  commit_status: true
+  fail_commit_status: false
+
+  collapse_walkthrough: true
+  review_details: true
+
   poem: false
-  walkthrough: true
+  in_progress_fortune: false
 
-# 自动总结 PR、代码解释
-knowledge_base:
-  enabled: true
-
-# 忽略不需要审查的文件
-ignore:
-  - "*.md"
-  - "docs/**"
-  - "static/**"
-  - "assets/**"
-  - "node_modules/**"
-  - "dist/**"
-  - "build/**"
-
-# 审查规则：风格、安全、性能
-rules:
-  style:
-    enabled: true
-  security:
-    enabled: true
-  performance:
+  enable_prompt_for_ai_agents: true
+
+  # ── 标签规则 ──
+  labeling_instructions:
+    - label: "frontend"
+      instructions: "当 PR 包含 src/ 目录下的文件变更时应用此标签"
+    - label: "backend"
+      instructions: "当 PR 包含 server/ 目录下的文件变更时应用此标签"
+    - label: "docs"
+      instructions: "当 PR 仅包含 *.md 文件变更时应用此标签"
+    - label: "styles"
+      instructions: "当 PR 主要修改 CSS 文件或 Tailwind 样式时应用此标签"
+    - label: "bug"
+      instructions: "当 PR 标题或描述包含 fix/bugfix/修复 关键词时应用此标签"
+    - label: "feature"
+      instructions: "当 PR 标题或描述包含 feat/feature/新增 关键词时应用此标签"
+    - label: "docker"
+      instructions: "当 PR 包含 Dockerfile 或 docker-compose.yml 变更时应用此标签"
+    - label: "ci"
+      instructions: "当 PR 包含 .github/workflows/ 目录下的文件变更时应用此标签"
+
+  # ── 文件过滤 ──
+  path_filters:
+    - "!**/node_modules/**"
+    - "!**/dist/**"
+    - "!**/build/**"
+    - "!**/data/**"
+    - "!**/package-lock.json"
+    - "!**/*.log"
+    - "!upload/**"
+    - "!templates/**"
+    - "!versions/**"
+
+  # ── 路径级审查指令 ──
+  path_instructions:
+    - path: "src/components/**"
+      instructions: >
+        React 组件目录（TypeScript + Tailwind CSS）。审查时请关注：
+        1. 是否同时兼容暗色（dark: 前缀）和亮色主题
+        2. 响应式布局是否完整（Tailwind 断点系统：sm/md/lg/xl）
+        3. Props 类型定义是否完整（TypeScript interface）
+        4. 组件是否保持单一职责
+        5. 无障碍访问（aria-label、role、键盘导航）
+        6. React.memo / useMemo / useCallback 的使用是否合理
+
+    - path: "src/components/settings/**"
+      instructions: >
+        设置面板组件。审查时请关注：
+        1. 表单状态管理和输入校验
+        2. 多语言文本处理（t(zh, en) 函数）
+        3. API 密钥/密码等敏感信息的输入框类型（type="password"）
+        4. 异步操作的状态反馈（loading/error/success）
+
+    - path: "src/components/ui/**"
+      instructions: >
+        通用 UI 组件。审查时请关注：
+        1. 组件的可复用性和可组合性
+        2. Props 接口的通用性
+        3. 暗色/亮色主题兼容
+
+    - path: "src/store/**"
+      instructions: >
+        Zustand 状态管理。审查时请关注：
+        1. 持久化存储（IndexedDB）的数据结构和版本迁移
+        2. Selector 的细粒度订阅（避免不必要的重渲染）
+        3. 敏感数据是否被持久化到客户端
+        4. 状态更新的原子性和一致性
+
+    - path: "src/services/**"
+      instructions: >
+        API 服务层。审查时请关注：
+        1. fetch 请求的超时处理（AbortController）
+        2. 错误处理和用户友好的错误信息翻译
+        3. API 密钥/Token 的传输安全性
+        4. 请求重试和降级策略
+        5. WebDAV/后端代理的 CORS 处理
+
+    - path: "src/hooks/**"
+      instructions: >
+        自定义 React Hooks。审查时请关注：
+        1. 依赖数组的正确性（useEffect/useCallback/useMemo）
+        2. 清理函数是否正确（避免内存泄漏）
+        3. 闭包陷阱（stale closure）
+
+    - path: "src/types/**"
+      instructions: >
+        TypeScript 类型定义。审查时请关注：
+        1. 类型定义的准确性和完整性
+        2. 是否合理使用 interface vs type
+        3. 泛型约束是否恰当
+
+    - path: "server/src/routes/**"
+      instructions: >
+        Express 路由层。审查时请关注：
+        1. 输入验证（req.body/req.params/req.query 的类型和范围检查）
+        2. SQL 注入防护（全部使用 ? 参数化查询，禁止字符串拼接）
+        3. 事务使用是否正确（批量操作应使用 db.transaction()）
+        4. 错误处理是否完善（try-catch + 统一错误响应格式）
+        5. 认证中间件是否正确应用（authMiddleware）
+        6. JSON 响应格式统一：{ data/error, code }
+
+    - path: "server/src/db/**"
+      instructions: >
+        better-sqlite3 数据访问层。审查时请关注：
+        1. 全部使用 ? 参数化查询，禁止字符串拼接
+        2. 数据库迁移的兼容性（addColumnIfMissing 模式）
+        3. WAL 模式和外键约束是否正确
+        4. 事务边界是否合理
+        5. 批量 INSERT 是否使用 db.transaction() 包裹
+
+    - path: "server/src/middleware/**"
+      instructions: >
+        Express 中间件。审查时请关注：
+        1. 认证逻辑的安全性（timingSafeEqual 防时序攻击）
+        2. 错误处理中间件的完整性
+        3. 中间件执行顺序是否正确
+
+    - path: "server/src/services/**"
+      instructions: >
+        后端服务层。审查时请关注：
+        1. 加密解密逻辑的正确性（AES-256-GCM）
+        2. 密钥管理和随机性
+        3. 错误处理不泄露敏感信息
+
+    - path: "nginx.conf"
+      instructions: >
+        Nginx 配置文件。审查时请关注：
+        1. 反向代理配置的正确性（/api/ → backend:3000）
+        2. CORS 头是否安全（避免反射任意 Origin）
+        3. 安全头（X-Frame-Options/X-XSS-Protection/X-Content-Type-Options）
+        4. 上传大小限制（client_max_body_size）
+        5. 代理超时设置
+
+    - path: "Dockerfile"
+      instructions: >
+        前端 Docker 构建（多阶段：node:18-alpine → nginx:alpine）。审查时请关注：
+        1. 构建阶段是否缓存了依赖层（npm ci）
+        2. 最终镜像体积
+        3. 非 root 用户运行（如适用）
+
+    - path: "server/Dockerfile"
+      instructions: >
+        后端 Docker 构建（多阶段：node:22-alpine → node:22-alpine）。审查时请关注：
+        1. npm prune --omit=dev 是否正确剥离开发依赖
+        2. 数据卷挂载是否正确（/app/data）
+        3. 非 root 用户运行（USER node）
+        4. 端口暴露（EXPOSE 3000）
+
+    - path: "docker-compose.yml"
+      instructions: >
+        Docker Compose 配置。审查时请关注：
+        1. 环境变量安全性（API_SECRET/ENCRYPTION_KEY 不应硬编码）
+        2. 卷挂载是否正确（数据持久化）
+        3. 服务依赖关系（depends_on）
+
+    - path: ".github/workflows/**"
+      instructions: >
+        GitHub Actions 工作流。审查时请关注：
+        1. 密钥/expose安全性（不应在日志中外泄）
+        2. 构建步骤的幂等性
+        3. 缓存策略是否合理
+
+  # ── 自动审查 ──
+  auto_review:
     enabled: true
-  best_practices:
+    auto_incremental_review: true
+    auto_pause_after_reviewed_commits: 5
+    drafts: false
+    ignore_title_keywords:
+      - "WIP"
+      - "DO NOT MERGE"
+      - "wip"
+    base_branches:
+      - "main"
+
+  # ── Anti-Slop 检测 ──
+  slop_detection:
     enabled: true
+
+  # ── Finishing Touches ──
+  finishing_touches:
+    docstrings:
+      enabled: true
+    unit_tests:
+      enabled: true
+    simplify:
+      enabled: true
+
+  # ── Pre-merge 检查 ──
+  pre_merge_checks:
+    title:
+      mode: "warning"
+      requirements: >
+        PR 标题应遵循 Conventional Commits 格式：
+        type(scope): description
+        类型包括：feat, fix, docs, style, refactor, perf, test, chore
+    description:
+      mode: "warning"
+    docstrings:
+      mode: "off"
+
+  # ── 工具配置 ──
+  tools:
+    # Node.js / TypeScript
+    eslint:
+      enabled: true
+
+    # Shell 脚本
+    shellcheck:
+      enabled: true
+
+    # Dockerfile
+    hadolint:
+      enabled: true
+
+    # Markdown 文档
+    markdownlint:
+      enabled: true
+
+    # YAML 配置
+    yamllint:
+      enabled: true
+
+    # GitHub Actions
+    actionlint:
+      enabled: true
+
+    # AST 语义分析
+    ast-grep:
+      essential_rules: true
+
+    # 安全扫描
+    gitleaks:
+      enabled: true
+    trufflehog:
+      enabled: true
+
+    # GitHub 集成
+    github-checks:
+      enabled: true
+      timeout_ms: 120000
+
+    # 关闭不相关的语言/框架工具
+    biome:
+      enabled: false
+    ruff:
+      enabled: false
+    flake8:
+      enabled: false
+    phpstan:
+      enabled: false
+    phpmd:
+      enabled: false
+    phpcs:
+      enabled: false
+    golangci-lint:
+      enabled: false
+    swiftlint:
+      enabled: false
+    checkov:
+      enabled: false
+    tflint:
+      enabled: false
+    detekt:
+      enabled: false
+    rubocop:
+      enabled: false
+    buf:
+      enabled: false
+    regal:
+      enabled: false
+    pmd:
+      enabled: false
+    clang:
+      enabled: false
+    cppcheck:
+      enabled: false
+    fortitudeLint:
+      enabled: false
+
+# ──────────────────────────────────────────────
+# 聊天设置
+# ──────────────────────────────────────────────
+chat:
+  auto_reply: true
+
+# ──────────────────────────────────────────────
+# 知识库
+# ──────────────────────────────────────────────
+knowledge_base:
+  learnings:
+    scope: "auto"
+  issues:
+    scope: "auto"
+  pull_requests:
+    scope: "auto"

From d240aba3ced52f79e57b7b1cb482dec3f721d7c5 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 13:42:25 +0800
Subject: [PATCH 11/47] =?UTF-8?q?@=20feat:=20=E5=B0=86=20AI=20=E5=88=86?=
 =?UTF-8?q?=E6=9E=90=E7=A7=BB=E5=88=B0=E5=90=8E=E7=AB=AF=E6=89=A7=E8=A1=8C?=
 =?UTF-8?q?=EF=BC=8C=E5=89=8D=E7=AB=AF=E4=BB=85=E5=8F=91=E8=B5=B7=E5=92=8C?=
 =?UTF-8?q?=E8=BD=AE=E8=AF=A2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

后端新增 analysisService（README 获取 → AI 调用 → 解析入库）和 analysis 路由。
前端新增 backendAnalysisService 轮询服务，RepositoryList/RepositoryCard/
DiscoveryView/SubscriptionRepoCard 均采用后端优先、前端降级策略。
修复了 openai-responses 响应解析缺失、DiscoveryView 停止按钮无效、
批量分析 toast 不区分停止/完成 三个 bug。
---
 server/src/index.ts                     |   3 +
 server/src/routes/analysis.ts           |  89 ++++
 server/src/services/analysisService.ts  | 549 ++++++++++++++++++++++++
 src/components/DiscoveryView.tsx        | 103 +++++
 src/components/RepositoryCard.tsx       |  30 ++
 src/components/RepositoryList.tsx       | 104 ++++-
 src/components/SubscriptionRepoCard.tsx |  64 ++-
 src/services/backendAdapter.ts          |  29 ++
 src/services/backendAnalysisService.ts  | 148 +++++++
 9 files changed, 1114 insertions(+), 5 deletions(-)
 create mode 100644 server/src/routes/analysis.ts
 create mode 100644 server/src/services/analysisService.ts
 create mode 100644 src/services/backendAnalysisService.ts

diff --git a/server/src/index.ts b/server/src/index.ts
index 42ba420..c609aba 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -14,6 +14,7 @@ import categoriesRouter from './routes/categories.js';
 import configsRouter from './routes/configs.js';
 import syncRouter from './routes/sync.js';
 import proxyRouter from './routes/proxy.js';
+import analysisRouter from './routes/analysis.js';
 
 export function createApp(): express.Express {
   const app = express();
@@ -40,6 +41,8 @@ export function createApp(): express.Express {
   // Wave 3: Proxy routes
   app.use(proxyRouter);
 
+  app.use(analysisRouter);
+
   // Global error handler
   app.use(errorHandler);
 
diff --git a/server/src/routes/analysis.ts b/server/src/routes/analysis.ts
new file mode 100644
index 0000000..820f60a
--- /dev/null
+++ b/server/src/routes/analysis.ts
@@ -0,0 +1,89 @@
+import { Router } from 'express';
+import { getDb } from '../db/connection.js';
+import * as analysisService from '../services/analysisService.js';
+
+const router = Router();
+
+// POST /api/analysis/batch — start analysis
+router.post('/api/analysis/batch', (req, res) => {
+  try {
+    const { repositoryIds, configId, language, categoryNames } = req.body as {
+      repositoryIds?: unknown;
+      configId?: unknown;
+      language?: unknown;
+      categoryNames?: unknown;
+    };
+
+    if (!Array.isArray(repositoryIds) || repositoryIds.length === 0) {
+      res.status(400).json({ error: 'repositoryIds must be a non-empty array', code: 'ANALYSIS_INVALID_REQUEST' });
+      return;
+    }
+    if (!repositoryIds.every((id) => typeof id === 'number' && id > 0)) {
+      res.status(400).json({ error: 'repositoryIds must be positive integers', code: 'ANALYSIS_INVALID_REQUEST' });
+      return;
+    }
+    if (!configId || typeof configId !== 'string') {
+      res.status(400).json({ error: 'configId is required', code: 'ANALYSIS_INVALID_REQUEST' });
+      return;
+    }
+
+    // Verify config exists
+    const db = getDb();
+    const aiConfig = db.prepare('SELECT id FROM ai_configs WHERE id = ?').get(configId);
+    if (!aiConfig) {
+      res.status(404).json({ error: 'AI config not found', code: 'AI_CONFIG_NOT_FOUND' });
+      return;
+    }
+
+    const lang = typeof language === 'string' && language === 'en' ? 'en' : 'zh';
+    const cats = Array.isArray(categoryNames) ? categoryNames.filter((c) => typeof c === 'string') : [];
+
+    const batch = analysisService.createBatch(
+      repositoryIds as number[],
+      configId,
+      lang,
+      cats,
+    );
+
+    res.status(202).json({
+      batchId: batch.batchId,
+      status: batch.status,
+      total: batch.total,
+    });
+  } catch (err) {
+    console.error('POST /api/analysis/batch error:', err);
+    res.status(500).json({ error: 'Failed to start analysis', code: 'ANALYSIS_START_FAILED' });
+  }
+});
+
+// GET /api/analysis/batch/:batchId — check progress
+router.get('/api/analysis/batch/:batchId', (req, res) => {
+  try {
+    const batch = analysisService.getBatchStatus(req.params.batchId);
+    if (!batch) {
+      res.status(404).json({ error: 'Batch not found', code: 'ANALYSIS_BATCH_NOT_FOUND' });
+      return;
+    }
+    res.json(batch);
+  } catch (err) {
+    console.error('GET /api/analysis/batch error:', err);
+    res.status(500).json({ error: 'Failed to get analysis progress', code: 'ANALYSIS_PROGRESS_FAILED' });
+  }
+});
+
+// POST /api/analysis/batch/:batchId/cancel — cancel analysis
+router.post('/api/analysis/batch/:batchId/cancel', (_req, res) => {
+  try {
+    const cancelled = analysisService.cancelBatch(_req.params.batchId);
+    if (!cancelled) {
+      res.status(404).json({ error: 'Batch not found or already completed', code: 'ANALYSIS_BATCH_NOT_FOUND' });
+      return;
+    }
+    res.json({ batchId: _req.params.batchId, status: 'cancelled' });
+  } catch (err) {
+    console.error('POST /api/analysis/batch/cancel error:', err);
+    res.status(500).json({ error: 'Failed to cancel analysis', code: 'ANALYSIS_CANCEL_FAILED' });
+  }
+});
+
+export default router;
diff --git a/server/src/services/analysisService.ts b/server/src/services/analysisService.ts
new file mode 100644
index 0000000..840ad66
--- /dev/null
+++ b/server/src/services/analysisService.ts
@@ -0,0 +1,549 @@
+import { getDb } from '../db/connection.js';
+import { decrypt } from './crypto.js';
+import { config } from '../config.js';
+import { proxyRequest } from './proxyService.js';
+
+// ── Types ──
+
+interface AnalysisBatch {
+  batchId: string;
+  repositoryIds: number[];
+  configId: string;
+  language: string;
+  categoryNames: string[];
+  status: 'running' | 'completed' | 'cancelled' | 'failed';
+  total: number;
+  completed: number;
+  failed: number;
+  startedAt: string;
+  completedAt: string | null;
+  cancelRequested: boolean;
+}
+
+interface RepoInfo {
+  id: number;
+  full_name: string;
+  name: string;
+  description: string | null;
+  language: string | null;
+  stargazers_count: number;
+  topics: string | null;
+  owner_login: string;
+}
+
+// ── In-memory state ──
+
+const batches = new Map<string, AnalysisBatch>();
+
+function generateId(): string {
+  return `batch_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+}
+
+// ── Public API ──
+
+export function createBatch(
+  repositoryIds: number[],
+  configId: string,
+  language: string,
+  categoryNames: string[],
+): AnalysisBatch {
+  const batch: AnalysisBatch = {
+    batchId: generateId(),
+    repositoryIds,
+    configId,
+    language,
+    categoryNames,
+    status: 'running',
+    total: repositoryIds.length,
+    completed: 0,
+    failed: 0,
+    startedAt: new Date().toISOString(),
+    completedAt: null,
+    cancelRequested: false,
+  };
+  batches.set(batch.batchId, batch);
+
+  // Fire and forget — don't await
+  runBatch(batch.batchId).catch((err) => {
+    console.error(`[analysis] Batch ${batch.batchId} failed:`, err);
+    const b = batches.get(batch.batchId);
+    if (b && b.status === 'running') {
+      b.status = 'failed';
+      b.completedAt = new Date().toISOString();
+    }
+  });
+
+  return batch;
+}
+
+export function getBatchStatus(batchId: string): AnalysisBatch | undefined {
+  return batches.get(batchId);
+}
+
+export function cancelBatch(batchId: string): boolean {
+  const batch = batches.get(batchId);
+  if (!batch || batch.status !== 'running') return false;
+  batch.cancelRequested = true;
+  batch.status = 'cancelled';
+  batch.completedAt = new Date().toISOString();
+  return true;
+}
+
+// ── Core execution ──
+
+async function runBatch(batchId: string): Promise<void> {
+  const batch = batches.get(batchId);
+  if (!batch) return;
+
+  const db = getDb();
+  const aiConfig = db.prepare('SELECT * FROM ai_configs WHERE id = ?').get(batch.configId) as Record<string, unknown> | undefined;
+  if (!aiConfig) {
+    batch.status = 'failed';
+    batch.completedAt = new Date().toISOString();
+    return;
+  }
+
+  const concurrency = Math.max(1, Math.min((aiConfig.concurrency as number) || 1, 10));
+
+  const queue = [...batch.repositoryIds];
+  let activeWorkers = 0;
+
+  const processNext = async (): Promise<void> => {
+    while (true) {
+      if (batch.cancelRequested) return;
+
+      const repoId = queue.shift();
+      if (repoId === undefined) return;
+
+      activeWorkers++;
+      try {
+        await processRepository(batch, repoId, aiConfig);
+        batch.completed++;
+      } catch (err) {
+        console.error(`[analysis] Failed to analyze repo ${repoId}:`, err);
+        batch.failed++;
+      } finally {
+        activeWorkers--;
+      }
+    }
+  };
+
+  const workers = Array.from({ length: Math.min(concurrency, queue.length) }, () => processNext());
+  await Promise.all(workers);
+
+  if (!batch.cancelRequested) {
+    batch.status = 'completed';
+    batch.completedAt = new Date().toISOString();
+  }
+}
+
+async function processRepository(
+  batch: AnalysisBatch,
+  repoId: number,
+  aiConfig: Record<string, unknown>,
+): Promise<void> {
+  if (batch.cancelRequested) return;
+
+  const db = getDb();
+  const repo = db.prepare('SELECT id, full_name, name, description, language, stargazers_count, topics, owner_login FROM repositories WHERE id = ?').get(repoId) as RepoInfo | undefined;
+  if (!repo) {
+    markAnalysisFailed(repoId);
+    return;
+  }
+
+  // 1. Fetch README
+  let readmeContent = '';
+  try {
+    readmeContent = await fetchReadme(repo.owner_login, repo.name);
+  } catch {
+    // README fetch failure is not fatal — analyze without it
+  }
+
+  // 2. Build prompt
+  const customPrompt = aiConfig.custom_prompt as string | undefined;
+  const useCustomPrompt = !!(aiConfig.use_custom_prompt as number);
+  const language = batch.language;
+
+  const prompt = useCustomPrompt && customPrompt
+    ? buildCustomPrompt(customPrompt, repo, readmeContent, batch.categoryNames, language)
+    : buildAnalysisPrompt(repo, readmeContent, batch.categoryNames, language);
+
+  // 3. Call AI
+  const systemPrompt = language === 'zh'
+    ? '你是一个专业的GitHub仓库分析助手。请严格按照用户指定的语言进行分析，无论原始内容是什么语言。请用中文简洁地分析仓库，提供实用的概述、分类标签和支持的平台类型。'
+    : 'You are a professional GitHub repository analysis assistant. Please strictly analyze in the language specified by the user, regardless of the original content language. Please analyze repositories concisely in English, providing practical overviews, category tags, and supported platform types.';
+
+  try {
+    const content = await callAI(aiConfig, systemPrompt, prompt);
+    const result = parseAIResponse(content, language);
+
+    db.prepare(`
+      UPDATE repositories
+      SET ai_summary = ?, ai_tags = ?, ai_platforms = ?, analyzed_at = ?, analysis_failed = 0
+      WHERE id = ?
+    `).run(
+      result.summary,
+      JSON.stringify(result.tags),
+      JSON.stringify(result.platforms),
+      new Date().toISOString(),
+      repoId,
+    );
+  } catch (err) {
+    console.error(`[analysis] AI call failed for repo ${repoId}:`, err);
+    markAnalysisFailed(repoId);
+  }
+}
+
+function markAnalysisFailed(repoId: number): void {
+  const db = getDb();
+  db.prepare('UPDATE repositories SET analyzed_at = ?, analysis_failed = 1 WHERE id = ?').run(
+    new Date().toISOString(),
+    repoId,
+  );
+}
+
+// ── README fetching ──
+
+async function fetchReadme(owner: string, repo: string): Promise<string> {
+  const db = getDb();
+  const tokenRow = db.prepare('SELECT value FROM settings WHERE key = ?').get('github_token') as { value: string } | undefined;
+  let token = '';
+  if (tokenRow?.value) {
+    try {
+      token = decrypt(tokenRow.value, config.encryptionKey);
+    } catch {
+      // token decryption failed, proceed without auth
+    }
+  }
+
+  const headers: Record<string, string> = {
+    'Accept': 'application/vnd.github.v3+json',
+    'User-Agent': 'GithubStarsManager',
+  };
+  if (token) {
+    headers['Authorization'] = `Bearer ${token}`;
+  }
+
+  const result = await proxyRequest({
+    url: `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/readme`,
+    method: 'GET',
+    headers,
+    timeout: 15000,
+  });
+
+  if (result.status !== 200 || !result.data) {
+    throw new Error(`GitHub README fetch failed: ${result.status}`);
+  }
+
+  const data = result.data as { encoding?: string; content?: string };
+  if (data.encoding === 'base64' && data.content) {
+    return Buffer.from(data.content, 'base64').toString('utf-8');
+  }
+  return data.content || '';
+}
+
+// ── AI API call ──
+
+function buildApiUrl(baseUrl: string, pathWithVersion: string): string {
+  const baseUrlWithSlash = baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`;
+  try {
+    return new URL(pathWithVersion, baseUrlWithSlash).toString();
+  } catch {
+    return `${baseUrlWithSlash}${pathWithVersion}`;
+  }
+}
+
+async function callAI(
+  aiConfig: Record<string, unknown>,
+  systemPrompt: string,
+  userPrompt: string,
+): Promise<string> {
+  const apiKey = decrypt(aiConfig.api_key_encrypted as string, config.encryptionKey);
+  const apiType = (aiConfig.api_type as string) || 'openai';
+  const baseUrl = aiConfig.base_url as string;
+  const model = aiConfig.model as string;
+  const reasoningEffort = aiConfig.reasoning_effort === 'minimal'
+    ? 'low'
+    : aiConfig.reasoning_effort as string | null | undefined;
+
+  let targetUrl: string;
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+    'Accept': 'application/json',
+  };
+  let requestBody: Record<string, unknown>;
+
+  if (apiType === 'claude') {
+    targetUrl = buildApiUrl(baseUrl, 'v1/messages');
+    headers['x-api-key'] = apiKey;
+    headers['anthropic-version'] = '2023-06-01';
+    requestBody = {
+      model,
+      max_tokens: 700,
+      temperature: 0.3,
+      system: systemPrompt,
+      messages: [{ role: 'user', content: userPrompt }],
+    };
+  } else if (apiType === 'gemini') {
+    const rawModel = model.trim();
+    const modelName = rawModel.startsWith('models/') ? rawModel.slice('models/'.length) : rawModel;
+    const path = `v1beta/models/${encodeURIComponent(modelName)}:generateContent`;
+    targetUrl = buildApiUrl(baseUrl, path);
+    const urlObj = new URL(targetUrl);
+    urlObj.searchParams.set('key', apiKey);
+    targetUrl = urlObj.toString();
+    requestBody = {
+      contents: [{ role: 'user', parts: [{ text: userPrompt }] }],
+      generationConfig: { temperature: 0.3, maxOutputTokens: 700 },
+      systemInstruction: { parts: [{ text: systemPrompt }] },
+    };
+  } else {
+    // openai / openai-responses / openai-compatible
+    targetUrl = apiType === 'openai-compatible'
+      ? baseUrl.replace(/\/$/, '')
+      : buildApiUrl(baseUrl, apiType === 'openai-responses' ? 'v1/responses' : 'v1/chat/completions');
+    headers['Authorization'] = `Bearer ${apiKey}`;
+    requestBody = {
+      model,
+      temperature: 0.3,
+      max_tokens: 700,
+      messages: [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt },
+      ],
+    };
+    if (reasoningEffort && (apiType === 'openai' || apiType === 'openai-responses' || apiType === 'openai-compatible')) {
+      (requestBody as Record<string, unknown>).reasoning = { effort: reasoningEffort };
+    }
+  }
+
+  const timeout = apiType === 'openai-responses' || !!reasoningEffort ? 600000 : 120000;
+
+  const result = await proxyRequest({
+    url: targetUrl,
+    method: 'POST',
+    headers,
+    body: requestBody,
+    timeout,
+  });
+
+  if (result.status !== 200) {
+    const errData = result.data as Record<string, unknown> | undefined;
+    throw new Error(`AI API returned ${result.status}: ${JSON.stringify(errData)}`);
+  }
+
+  return extractTextContent(apiType, result.data as Record<string, unknown>);
+}
+
+function extractTextContent(apiType: string, data: Record<string, unknown>): string {
+  if (apiType === 'claude') {
+    const content = (data as { content?: Array<{ type: string; text: string }> }).content;
+    if (content && content.length > 0) return content[0].text || '';
+  } else if (apiType === 'gemini') {
+    const candidates = (data as { candidates?: Array<{ content?: { parts?: Array<{ text?: string }> } }> }).candidates;
+    if (candidates?.[0]?.content?.parts?.[0]?.text) return candidates[0].content.parts[0].text;
+  } else if (apiType === 'openai-responses') {
+    const outputText = (data as { output_text?: string }).output_text;
+    if (outputText) return outputText;
+    const output = (data as { output?: Array<{ content?: Array<{ text?: string }> }> }).output;
+    if (Array.isArray(output)) {
+      return output
+        .flatMap((item) => (Array.isArray(item?.content) ? item.content : []))
+        .map((part) => part?.text || '')
+        .join('');
+    }
+  } else {
+    // openai / openai-compatible
+    const choices = (data as { choices?: Array<{ message?: { content?: string } }> }).choices;
+    if (choices?.[0]?.message?.content) return choices[0].message.content;
+  }
+  return '';
+}
+
+// ── Prompt building (ported from aiService.ts) ──
+
+function repoInfoString(repo: RepoInfo, readmeContent: string, language: string): string {
+  const isZh = language === 'zh';
+  return [
+    `${isZh ? '仓库名称' : 'Repository Name'}: ${repo.full_name}`,
+    `${isZh ? '描述' : 'Description'}: ${repo.description || (isZh ? '无描述' : 'No description')}`,
+    `${isZh ? '编程语言' : 'Programming Language'}: ${repo.language || (isZh ? '未知' : 'Unknown')}`,
+    `${isZh ? 'Star数' : 'Stars'}: ${repo.stargazers_count}`,
+    `${isZh ? '主题标签' : 'Topics'}: ${(repo.topics ? JSON.parse(repo.topics).join(', ') : '') || (isZh ? '无' : 'None')}`,
+    '',
+    `${isZh ? 'README内容 (前2000字符)' : 'README Content (first 2000 characters)'}:`,
+    readmeContent.substring(0, 2000),
+  ].join('\n');
+}
+
+function categoriesInfoString(categoryNames: string[], language: string): string {
+  if (categoryNames.length === 0) return '';
+  const label = language === 'zh' ? '可用的应用分类' : 'Available Application Categories';
+  return `\n\n${label}: ${categoryNames.join(', ')}`;
+}
+
+function buildCustomPrompt(
+  customPrompt: string,
+  repo: RepoInfo,
+  readmeContent: string,
+  categoryNames: string[],
+  language: string,
+): string {
+  const repoInfo = repoInfoString(repo, readmeContent, language);
+  const catsInfo = categoriesInfoString(categoryNames, language);
+  return customPrompt
+    .replace(/\{REPO_INFO\}/g, repoInfo)
+    .replace(/\{CATEGORIES_INFO\}/g, catsInfo)
+    .replace(/\{LANGUAGE\}/g, language);
+}
+
+function buildAnalysisPrompt(
+  repo: RepoInfo,
+  readmeContent: string,
+  categoryNames: string[],
+  language: string,
+): string {
+  const repoInfo = repoInfoString(repo, readmeContent, language);
+  const catsInfo = categoriesInfoString(categoryNames, language);
+  const catsHint = categoryNames.length > 0
+    ? (language === 'zh' ? '，请优先从提供的分类中选择' : ', please prioritize from the provided categories')
+    : '';
+
+  if (language === 'zh') {
+    return `
+请分析这个GitHub仓库并提供：
+
+1. 一个简洁的中文概述（不超过50字），说明这个仓库的主要功能和用途
+2. 3-5个相关的应用类型标签（用中文，类似应用商店的分类，如：开发工具、Web应用、移动应用、数据库、AI工具等${catsHint}）
+3. 支持的平台类型（从以下选择：mac、windows、linux、ios、android、docker、web、cli）
+
+重要：请严格使用中文进行分析和回复，无论原始README是什么语言。
+
+请以JSON格式回复：
+{
+  "summary": "你的中文概述",
+  "tags": ["标签1", "标签2", "标签3", "标签4", "标签5"],
+  "platforms": ["platform1", "platform2", "platform3"]
+}
+
+仓库信息：
+${repoInfo}${catsInfo}
+
+重点关注实用性和准确的分类，帮助用户快速理解仓库的用途和支持的平台。
+    `.trim();
+  }
+
+  return `
+Please analyze this GitHub repository and provide:
+
+1. A concise English overview (no more than 50 words) explaining the main functionality and purpose of this repository
+2. 3-5 relevant application type tags (in English, similar to app store categories, such as: development tools, web apps, mobile apps, database, AI tools, etc.${catsHint})
+3. Supported platform types (choose from: mac, windows, linux, ios, android, docker, web, cli)
+
+Important: Please strictly use English for analysis and response, regardless of the original README language.
+
+Please reply in JSON format:
+{
+  "summary": "Your English overview",
+  "tags": ["tag1", "tag2", "tag3", "tag4", "tag5"],
+  "platforms": ["platform1", "platform2", "platform3"]
+}
+
+Repository information:
+${repoInfo}${catsInfo}
+
+Focus on practicality and accurate categorization to help users quickly understand the repository's purpose and supported platforms.
+  `.trim();
+}
+
+// ── Response parsing (ported from aiService.ts) ──
+
+function parseAIResponse(content: string, language: string): { summary: string; tags: string[]; platforms: string[] } {
+  try {
+    const cleaned = content
+      .trim()
+      .replace(/^```(?:json)?\s*/i, '')
+      .replace(/\s*```$/i, '')
+      .trim();
+
+    const parsed = extractAndParseAIJson(cleaned);
+    if (parsed) {
+      return {
+        summary: typeof parsed.summary === 'string' && parsed.summary.trim()
+          ? parsed.summary.trim()
+          : (language === 'zh' ? '无法生成概述' : 'Unable to generate summary'),
+        tags: Array.isArray(parsed.tags) ? parsed.tags.filter((v) => typeof v === 'string').slice(0, 5) : [],
+        platforms: Array.isArray(parsed.platforms) ? parsed.platforms.filter((v) => typeof v === 'string').slice(0, 8) : [],
+      };
+    }
+
+    return {
+      summary: cleaned.substring(0, 50) + (cleaned.length > 50 ? '...' : ''),
+      tags: [],
+      platforms: [],
+    };
+  } catch {
+    return {
+      summary: language === 'zh' ? '分析失败' : 'Analysis failed',
+      tags: [],
+      platforms: [],
+    };
+  }
+}
+
+function extractAndParseAIJson(content: string): Record<string, unknown> | null {
+  const direct = tryParseJsonObject(content);
+  if (direct) return direct;
+
+  const start = content.indexOf('{');
+  if (start === -1) return null;
+
+  let inString = false;
+  let escaped = false;
+  let depth = 0;
+
+  for (let i = start; i < content.length; i++) {
+    const char = content[i];
+
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+
+    if (char === '\\') {
+      escaped = true;
+      continue;
+    }
+
+    if (char === '"') {
+      inString = !inString;
+      continue;
+    }
+
+    if (inString) continue;
+
+    if (char === '{') depth++;
+    if (char === '}') {
+      depth--;
+      if (depth === 0) {
+        return tryParseJsonObject(content.slice(start, i + 1));
+      }
+    }
+  }
+
+  return null;
+}
+
+function tryParseJsonObject(text: string): Record<string, unknown> | null {
+  const trimmed = text.trim();
+  if (!trimmed.startsWith('{') || !trimmed.endsWith('}')) return null;
+
+  try {
+    const parsed = JSON.parse(trimmed);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : null;
+  } catch {
+    return null;
+  }
+}
diff --git a/src/components/DiscoveryView.tsx b/src/components/DiscoveryView.tsx
index dc3d1b6..5df89d5 100644
--- a/src/components/DiscoveryView.tsx
+++ b/src/components/DiscoveryView.tsx
@@ -19,9 +19,12 @@ import {
   Calendar
 } from 'lucide-react';
 import { useAppStore } from '../store/useAppStore';
+import type { Repository } from '../types';
 import { GitHubApiService } from '../services/githubApi';
 import { AIService } from '../services/aiService';
 import { AIAnalysisOptimizer } from '../services/aiAnalysisOptimizer';
+import { backend } from '../services/backendAdapter';
+import { backendAnalysis } from '../services/backendAnalysisService';
 import { resolveCategoryAssignment } from '../utils/categoryUtils';
 import { discoveryAnalysisStorage } from '../services/discoveryAnalysisStorage';
 import { DiscoverySidebar } from './DiscoverySidebar';
@@ -494,6 +497,7 @@ export const DiscoveryView: React.FC = React.memo(() => {
   const [analysisOptimizer, setAnalysisOptimizer] = useState<AIAnalysisOptimizer | null>(null);
   const [, setAnalysisState] = useState<{ paused: boolean; aborted: boolean }>({ paused: false, aborted: false });
   const [searchInput, setSearchInput] = useState(discoverySearchQuery);
+  const shouldStopRef = useRef(false);
   
   const scrollContainerRef = useRef<HTMLDivElement>(null);
   const sidebarRef = useRef<HTMLDivElement>(null);
@@ -770,6 +774,100 @@ export const DiscoveryView: React.FC = React.memo(() => {
 
     setIsAnalyzing(true);
     setAnalysisState({ paused: false, aborted: false });
+
+    // Backend-first: use server-side analysis if available
+    if (backend.isAvailable) {
+      shouldStopRef.current = false;
+      const storeState = useAppStore.getState();
+      const allCategoryNames = storeState.customCategories.map(c => c.name);
+      const categoryNames = [
+        ...allCategoryNames,
+        ...(language === 'zh'
+          ? ['全部分类', 'Web应用', '移动应用', '桌面应用', '数据库', 'AI/机器学习', '开发工具', '安全工具', '游戏', '设计工具', '效率工具', '教育学习', '社交网络', '数据分析']
+          : ['All', 'Web Apps', 'Mobile Apps', 'Desktop Apps', 'Database', 'AI/ML', 'Dev Tools', 'Security Tools', 'Games', 'Design Tools', 'Productivity', 'Education', 'Social Networks', 'Data Analysis']),
+      ];
+
+      setAnalysisProgress({ current: 0, total: unanalyzed.length });
+
+      try {
+        await backend.syncRepositories(unanalyzed as Repository[]);
+      } catch {
+        // Non-fatal: backend may already have these repos
+      }
+
+      try {
+        await backendAnalysis.startBatchAnalysis({
+          repositoryIds: unanalyzed.map(r => r.id),
+          configId: activeConfig.id,
+          language,
+          categoryNames,
+          onProgress: (current, total) => {
+            setAnalysisProgress({ current, total });
+          },
+          onComplete: async (completed, failed) => {
+            // Refresh discovery repos from backend to get AI results
+            try {
+              const { repositories: backendRepos } = await backend.fetchRepositories();
+              const repoMap = new Map(backendRepos.map(r => [r.id, r]));
+              for (const dRepo of unanalyzed) {
+                const updated = repoMap.get(dRepo.id);
+                if (updated) {
+                  const storeState = useAppStore.getState();
+                  const allCategoriesForResolution = [...storeState.customCategories];
+                  const resolvedCategory = resolveCategoryAssignment(
+                    updated,
+                    updated.ai_tags || [],
+                    allCategoriesForResolution
+                  );
+                  const wasCategoryLocked = !!dRepo.category_locked;
+                  updateDiscoveryRepo({
+                    ...dRepo,
+                    ai_summary: updated.ai_summary,
+                    ai_tags: updated.ai_tags,
+                    ai_platforms: updated.ai_platforms,
+                    custom_category: resolvedCategory,
+                    category_locked: wasCategoryLocked,
+                    analyzed_at: updated.analyzed_at,
+                    analysis_failed: updated.analysis_failed || false,
+                  });
+                  discoveryAnalysisStorage.saveAnalysis(dRepo.id, {
+                    ai_summary: updated.ai_summary,
+                    ai_tags: updated.ai_tags,
+                    ai_platforms: updated.ai_platforms,
+                    analyzed_at: updated.analyzed_at,
+                    analysis_failed: updated.analysis_failed || false,
+                  });
+                }
+              }
+            } catch {
+              // Non-fatal
+            }
+            toast(
+              shouldStopRef.current
+                ? t(
+                  `AI分析已停止！成功 ${completed} 个${failed > 0 ? `，失败 ${failed} 个` : ''}`,
+                  `AI analysis stopped! ${completed} succeeded${failed > 0 ? `, ${failed} failed` : ''}`
+                )
+                : t(
+                  `AI分析完成！成功 ${completed} 个${failed > 0 ? `，失败 ${failed} 个` : ''}`,
+                  `AI analysis complete! ${completed} succeeded${failed > 0 ? `, ${failed} failed` : ''}`
+                ),
+              completed === 0 ? 'error' : failed > 0 ? 'info' : 'success'
+            );
+          },
+        });
+      } catch (err) {
+        console.error('Backend AI analysis error:', err);
+        toast(t('AI分析启动失败，请检查后端连接和AI配置。', 'AI analysis failed to start. Please check backend connection and AI configuration.'), 'error');
+      } finally {
+        setIsAnalyzing(false);
+        setAnalysisOptimizer(null);
+        setAnalysisProgress({ current: 0, total: 0 });
+      }
+      return;
+    }
+
+    // Frontend fallback
     const storeState = useAppStore.getState();
     const allCategoriesForResolution = [
       ...storeState.customCategories,
@@ -875,6 +973,11 @@ export const DiscoveryView: React.FC = React.memo(() => {
 
 
   const handleAbortAnalysis = useCallback(() => {
+    if (backendAnalysis.isRunning) {
+      shouldStopRef.current = true;
+      backendAnalysis.cancelBatchAnalysis();
+      return;
+    }
     analysisOptimizer?.abort();
     setAnalysisState(prev => ({ ...prev, aborted: true }));
   }, [analysisOptimizer]);
diff --git a/src/components/RepositoryCard.tsx b/src/components/RepositoryCard.tsx
index f02243c..78495c3 100644
--- a/src/components/RepositoryCard.tsx
+++ b/src/components/RepositoryCard.tsx
@@ -6,6 +6,8 @@ import { useAppStore } from '../store/useAppStore';
 import { getAICategory, getDefaultCategory } from '../utils/categoryUtils';
 import { analyzeRepository, createFailedAnalysisResult } from '../services/aiAnalysisHelper';
 import { forceSyncToBackend } from '../services/autoSync';
+import { backend } from '../services/backendAdapter';
+import { backendAnalysis } from '../services/backendAnalysisService';
 import { GitHubApiService } from '../services/githubApi';
 import { formatDistanceToNow } from 'date-fns';
 import { RepositoryEditModal } from './RepositoryEditModal';
@@ -302,6 +304,34 @@ const RepositoryCardComponent: React.FC<RepositoryCardProps> = ({
       }
     }
 
+    if (isAnalyzing) return;
+
+    // Backend-first: use server-side analysis if available
+    if (backend.isAvailable) {
+      const categoryNames = allCategories.filter(cat => cat.id !== 'all').map(cat => cat.name);
+
+      try {
+        await backendAnalysis.startBatchAnalysis({
+          repositoryIds: [repoId],
+          configId: activeConfig.id,
+          language,
+          categoryNames,
+          onComplete: (completed, failed) => {
+            const reanalysis = !!repository.analyzed_at;
+            const message = reanalysis
+              ? t('AI重新分析完成！', 'AI re-analysis completed!')
+              : t('AI分析完成！', 'AI analysis completed!');
+            toast(message, 'success');
+          },
+        });
+      } catch (error) {
+        console.error('Backend AI analysis failed:', error);
+        toast(t('AI分析启动失败，请检查后端连接和AI配置。', 'AI analysis failed to start. Please check backend connection and AI configuration.'), 'error');
+      }
+      return;
+    }
+
+    // Frontend fallback
     abortControllerRef.current?.abort();
     const controller = new AbortController();
     abortControllerRef.current = controller;
diff --git a/src/components/RepositoryList.tsx b/src/components/RepositoryList.tsx
index d474ffc..af474fd 100644
--- a/src/components/RepositoryList.tsx
+++ b/src/components/RepositoryList.tsx
@@ -10,6 +10,8 @@ import { useAppStore, getAllCategories } from '../store/useAppStore';
 import { GitHubApiService } from '../services/githubApi';
 import { AIService } from '../services/aiService';
 import { AIAnalysisOptimizer, AnalysisResult } from '../services/aiAnalysisOptimizer';
+import { backend } from '../services/backendAdapter';
+import { backendAnalysis } from '../services/backendAnalysisService';
 import { resolveCategoryAssignment, getAICategory, getDefaultCategory, computeCustomCategory } from '../utils/categoryUtils';
 import { forceSyncToBackend } from '../services/autoSync';
 import { useDialog } from '../hooks/useDialog';
@@ -323,6 +325,48 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
     );
     if (!confirmed) return;
 
+    // Backend-first: use server-side analysis if available
+    if (backend.isAvailable) {
+      shouldStopRef.current = false;
+      isAnalyzingRef.current = true;
+      setLoading(true);
+      setAnalysisProgress({ current: 0, total: targetRepos.length });
+      setShowDropdown(false);
+      setIsPaused(false);
+
+      const categoryNames = allCategories.filter(cat => cat.id !== 'all').map(cat => cat.name);
+      const repoIds = targetRepos.map(r => r.id);
+
+      try {
+        await backendAnalysis.startBatchAnalysis({
+          repositoryIds: repoIds,
+          configId: activeConfig.id,
+          language,
+          categoryNames,
+          onProgress: (current, total) => {
+            setAnalysisProgress({ current, total });
+          },
+          onComplete: (completed, failed) => {
+            const message = shouldStopRef.current
+              ? t(`AI分析已停止！成功: ${completed}, 失败: ${failed}`, `AI analysis stopped! Success: ${completed}, Failed: ${failed}`)
+              : t(`AI分析完成！成功: ${completed}, 失败: ${failed}`, `AI analysis completed! Success: ${completed}, Failed: ${failed}`);
+            toast(message, 'success');
+          },
+        });
+      } catch (error) {
+        console.error('Backend AI analysis failed:', error);
+        toast(t('AI分析启动失败，请检查后端连接和AI配置。', 'AI analysis failed to start. Please check backend connection and AI configuration.'), 'error');
+      } finally {
+        isAnalyzingRef.current = false;
+        shouldStopRef.current = false;
+        setLoading(false);
+        setAnalysisProgress({ current: 0, total: 0 });
+        setIsPaused(false);
+      }
+      return;
+    }
+
+    // Frontend fallback
     // 重置状态
     shouldStopRef.current = false;
     isAnalyzingRef.current = true;
@@ -427,6 +471,15 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
 
   const handlePauseResume = () => {
     if (!isAnalyzingRef.current) return;
+
+    // Backend analysis: pause = cancel
+    if (backendAnalysis.isRunning) {
+      shouldStopRef.current = true;
+      backendAnalysis.cancelBatchAnalysis();
+      setIsPaused(false);
+      return;
+    }
+
     const newPausedState = !isPaused;
     setIsPaused(newPausedState);
 
@@ -455,6 +508,13 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
       { type: 'warning' }
     );
     if (confirmed) {
+      if (backendAnalysis.isRunning) {
+        shouldStopRef.current = true;
+        backendAnalysis.cancelBatchAnalysis();
+        setIsPaused(false);
+        return;
+      }
+
       shouldStopRef.current = true;
       // 中止优化器
       if (optimizerRef.current) {
@@ -672,12 +732,51 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
             return;
           }
 
-          // 设置加载状态
+          // Backend-first: use server-side analysis if available
+          if (backend.isAvailable) {
+            shouldStopRef.current = false;
+            isAnalyzingRef.current = true;
+            setLoading(true);
+            setAnalysisProgress({ current: 0, total: repos.length });
+
+            const categoryNames = allCategories.filter(cat => cat.id !== 'all').map(cat => cat.name);
+            const repoIds = repos.map(r => r.id);
+
+            try {
+              await backendAnalysis.startBatchAnalysis({
+                repositoryIds: repoIds,
+                configId: activeConfig.id,
+                language,
+                categoryNames,
+                onProgress: (current, total) => {
+                  setAnalysisProgress({ current, total });
+                },
+                onComplete: (completed, failed) => {
+                  toast(
+                    shouldStopRef.current
+                      ? t(`AI分析已停止！成功: ${completed}, 失败: ${failed}`, `AI analysis stopped! Success: ${completed}, Failed: ${failed}`)
+                      : t(`AI分析完成！成功: ${completed}, 失败: ${failed}`, `AI analysis completed! Success: ${completed}, Failed: ${failed}`),
+                    'success'
+                  );
+                },
+              });
+            } catch (error) {
+              console.error('Backend AI analysis failed:', error);
+              toast(t('AI分析启动失败，请检查后端连接和AI配置。', 'AI analysis failed to start. Please check backend connection and AI configuration.'), 'error');
+            } finally {
+              isAnalyzingRef.current = false;
+              shouldStopRef.current = false;
+              setLoading(false);
+              setAnalysisProgress({ current: 0, total: 0 });
+            }
+            break;
+          }
+
+          // Frontend fallback
           setLoading(true);
           isAnalyzingRef.current = true;
           setAnalysisProgress({ current: 0, total: repos.length });
 
-          // 创建优化器实例并保存到 ref
           optimizerRef.current = new AIAnalysisOptimizer({
             initialConcurrency: activeConfig.concurrency || 3,
             maxConcurrency: 10,
@@ -756,7 +855,6 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
             console.error('Bulk AI analysis failed:', error);
             toast(language === 'zh' ? '批量AI分析失败' : 'Bulk AI analysis failed', 'error');
           } finally {
-            // 确保状态重置
             optimizerRef.current = null;
             isAnalyzingRef.current = false;
             shouldStopRef.current = false;
diff --git a/src/components/SubscriptionRepoCard.tsx b/src/components/SubscriptionRepoCard.tsx
index aee5f74..0c51f0b 100644
--- a/src/components/SubscriptionRepoCard.tsx
+++ b/src/components/SubscriptionRepoCard.tsx
@@ -1,9 +1,11 @@
 import React, { useState, useMemo, useCallback, useRef, useEffect } from 'react';
 import { Star, StarOff, ExternalLink, Bot, GitFork, Monitor, Smartphone, Globe, Terminal, Package, Sparkles, BookOpen, AlertTriangle } from 'lucide-react';
-import type { DiscoveryRepo } from '../types';
+import type { DiscoveryRepo, Repository } from '../types';
 import { useAppStore, getAllCategories } from '../store/useAppStore';
 import { analyzeRepository, createFailedAnalysisResult } from '../services/aiAnalysisHelper';
 import { forceSyncToBackend } from '../services/autoSync';
+import { backend } from '../services/backendAdapter';
+import { backendAnalysis } from '../services/backendAnalysisService';
 import { GitHubApiService } from '../services/githubApi';
 import { ReadmeModal } from './ReadmeModal';
 import { Modal } from './Modal';
@@ -224,6 +226,64 @@ export const SubscriptionRepoCard: React.FC<SubscriptionRepoCardProps> = ({ repo
 
     if (isAnalyzing) return;
 
+    // Backend-first: use server-side analysis if available
+    if (backend.isAvailable) {
+      setIsAnalyzing(true);
+
+      const allCategories = getAllCategories(customCategories, language);
+      const categoryNames = allCategories.map(c => c.name);
+
+      try {
+        await backend.syncRepositories([repo as Repository]);
+      } catch {
+        // Non-fatal
+      }
+
+      try {
+        await backendAnalysis.startBatchAnalysis({
+          repositoryIds: [repo.id],
+          configId: activeConfig.id,
+          language,
+          categoryNames,
+          onComplete: async () => {
+            try {
+              const { repositories: backendRepos } = await backend.fetchRepositories();
+              const updated = backendRepos.find(r => r.id === repo.id);
+              if (updated) {
+                const updatedRepo: DiscoveryRepo = {
+                  ...repo,
+                  ai_summary: updated.ai_summary,
+                  ai_tags: updated.ai_tags,
+                  ai_platforms: updated.ai_platforms,
+                  analyzed_at: updated.analyzed_at,
+                  analysis_failed: updated.analysis_failed || false,
+                };
+                updateDiscoveryRepo(updatedRepo);
+                if (onAnalyze) {
+                  onAnalyze(updatedRepo);
+                }
+              }
+            } catch {
+              // Non-fatal
+            }
+          },
+        });
+      } catch (err) {
+        console.error('Backend AI analysis error:', err);
+        const failedRepo: DiscoveryRepo = {
+          ...repo,
+          analyzed_at: new Date().toISOString(),
+          analysis_failed: true,
+        };
+        updateDiscoveryRepo(failedRepo);
+        toast(t('AI分析启动失败，请检查后端连接和AI配置。', 'AI analysis failed to start. Please check backend connection and AI configuration.'), 'error');
+      } finally {
+        setIsAnalyzing(false);
+      }
+      return;
+    }
+
+    // Frontend fallback
     abortControllerRef.current?.abort();
     const controller = new AbortController();
     abortControllerRef.current = controller;
@@ -253,7 +313,7 @@ export const SubscriptionRepoCard: React.FC<SubscriptionRepoCardProps> = ({ repo
         analysis_failed: result.analysis_failed,
       };
       updateDiscoveryRepo(updatedRepo);
-      
+
       if (onAnalyze) {
         onAnalyze(updatedRepo);
       }
diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index dba2406..608a332 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -356,6 +356,35 @@ class BackendAdapter {
     }
   }
 
+  // === AI Analysis ===
+
+  async startAnalysis(repositoryIds: number[], configId: string, language: string, categoryNames: string[]): Promise<{ batchId: string; status: string; total: number }> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/analysis/batch`, {
+      method: 'POST',
+      headers: this.getAuthHeaders(),
+      body: JSON.stringify({ repositoryIds, configId, language, categoryNames }),
+    });
+    if (!res.ok) await this.throwTranslatedError(res, 'Start analysis error');
+    return res.json() as Promise<{ batchId: string; status: string; total: number }>;
+  }
+
+  async getAnalysisProgress(batchId: string): Promise<{ batchId: string; status: string; total: number; completed: number; failed: number }> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/analysis/batch/${batchId}`);
+    if (!res.ok) await this.throwTranslatedError(res, 'Analysis progress error');
+    return res.json() as Promise<{ batchId: string; status: string; total: number; completed: number; failed: number }>;
+  }
+
+  async cancelAnalysis(batchId: string): Promise<void> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/analysis/batch/${batchId}/cancel`, { method: 'POST', headers: this.getAuthHeaders() });
+    if (!res.ok) await this.throwTranslatedError(res, 'Cancel analysis error');
+  }
+
   // === GitHub Search Proxy ===
 
   async searchRepositories(queryParams: Record<string, string>): Promise<{ items: Repository[] }> {
diff --git a/src/services/backendAnalysisService.ts b/src/services/backendAnalysisService.ts
new file mode 100644
index 0000000..497c990
--- /dev/null
+++ b/src/services/backendAnalysisService.ts
@@ -0,0 +1,148 @@
+import { backend } from './backendAdapter';
+import { useAppStore } from '../store/useAppStore';
+
+interface BatchAnalysisOptions {
+  repositoryIds: number[];
+  configId: string;
+  language: string;
+  categoryNames: string[];
+  onProgress?: (current: number, total: number) => void;
+  onComplete?: (completed: number, failed: number) => void;
+  onRepoResult?: (repoId: number) => void;
+}
+
+class BackendAnalysisService {
+  private pollingTimeout: ReturnType<typeof setTimeout> | null = null;
+  private currentBatchId: string | null = null;
+  private _isRunning = false;
+
+  async startBatchAnalysis(options: BatchAnalysisOptions): Promise<void> {
+    if (this._isRunning) {
+      throw new Error('Analysis already in progress');
+    }
+
+    const { repositoryIds, configId, language, categoryNames, onProgress, onComplete, onRepoResult } = options;
+
+    const store = useAppStore.getState();
+
+    this._isRunning = true;
+
+    // Mark all repos as analyzing
+    for (const id of repositoryIds) {
+      store.setAnalyzingRepository(id, true);
+    }
+    store.setAnalysisProgress({ current: 0, total: repositoryIds.length });
+
+    try {
+      const { batchId } = await backend.startAnalysis(repositoryIds, configId, language, categoryNames);
+      this.currentBatchId = batchId;
+
+      return new Promise<void>((resolve) => {
+        let lastReportedCount = 0;
+
+        const poll = async (): Promise<void> => {
+          // Guard: if a newer batch has replaced this one, silently exit
+          if (this.currentBatchId !== batchId) return;
+
+          try {
+            const progress = await backend.getAnalysisProgress(batchId);
+
+            // Re-check after await — another batch may have been started
+            if (this.currentBatchId !== batchId) return;
+
+            store.setAnalysisProgress({ current: progress.completed + progress.failed, total: progress.total });
+            onProgress?.(progress.completed + progress.failed, progress.total);
+
+            if (progress.completed + progress.failed > lastReportedCount) {
+              lastReportedCount = progress.completed + progress.failed;
+              onRepoResult?.(lastReportedCount);
+            }
+
+            if (progress.status === 'completed' || progress.status === 'cancelled' || progress.status === 'failed') {
+              this.finishBatch(batchId, repositoryIds);
+
+              if (progress.status === 'completed') {
+                try {
+                  const repoData = await backend.fetchRepositories();
+                  const repoMap = new Map(repoData.repositories.map((r) => [r.id, r]));
+
+                  const currentRepos = useAppStore.getState().repositories;
+                  const updatedRepos = currentRepos.map((r) => {
+                    const updated = repoMap.get(r.id);
+                    if (updated) {
+                      return {
+                        ...r,
+                        ai_summary: updated.ai_summary,
+                        ai_tags: updated.ai_tags,
+                        ai_platforms: updated.ai_platforms,
+                        analyzed_at: updated.analyzed_at,
+                        analysis_failed: updated.analysis_failed,
+                      };
+                    }
+                    return r;
+                  });
+                  useAppStore.getState().setRepositories(updatedRepos);
+                } catch {
+                  // Refresh failed — UI can resync manually
+                }
+              }
+
+              onComplete?.(progress.completed, progress.failed);
+              resolve();
+              return;
+            }
+          } catch {
+            // Poll errors are non-fatal — keep polling
+          }
+
+          // Schedule next poll only if still the current batch
+          if (this.currentBatchId === batchId) {
+            this.pollingTimeout = setTimeout(poll, 2000);
+          }
+        };
+
+        poll();
+      });
+    } catch (err) {
+      // Start failed — clear all states
+      this.finishBatch(null, repositoryIds);
+      store.setAnalysisProgress({ current: 0, total: 0 });
+      throw err;
+    }
+  }
+
+  async cancelBatchAnalysis(): Promise<void> {
+    if (this.currentBatchId) {
+      try {
+        await backend.cancelAnalysis(this.currentBatchId);
+      } catch {
+        // Non-fatal
+      }
+      // Don't call finishBatch — the poll will detect 'cancelled' and clean up
+    }
+  }
+
+  get isRunning(): boolean {
+    return this._isRunning;
+  }
+
+  private finishBatch(batchId: string | null, repositoryIds: number[]): void {
+    // Only clean up instance state if this batch is still current
+    if (batchId === null || this.currentBatchId === batchId) {
+      this._isRunning = false;
+      if (this.pollingTimeout !== null) {
+        clearTimeout(this.pollingTimeout);
+        this.pollingTimeout = null;
+      }
+      this.currentBatchId = null;
+    }
+
+    // Always clear analyzing states for this batch's repos
+    const store = useAppStore.getState();
+    for (const id of repositoryIds) {
+      store.setAnalyzingRepository(id, false);
+    }
+  }
+}
+
+export const backendAnalysis = new BackendAnalysisService();

From f4eb3344775002515f74532be5805e0273d747fa Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 13:50:38 +0800
Subject: [PATCH 12/47] =?UTF-8?q?@=20fix:=20=E4=BF=AE=E5=A4=8D=20CodeRabbi?=
 =?UTF-8?q?t=20=E6=8C=87=E5=87=BA=E7=9A=84=204=20=E4=B8=AA=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- getAnalysisProgress 缺少认证头导致轮询失败 (Critical)
- batches Map 无 TTL 清理导致内存泄漏 (Major)
- JSON.parse(repo.topics) 无异常处理 (Minor)
- 后端分析时暂停按钮行为误导，改为禁用 (Minor)
---
 server/src/services/analysisService.ts | 16 +++++++++++++++-
 src/components/RepositoryList.tsx      | 14 +++++---------
 src/services/backendAdapter.ts         |  4 +++-
 3 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/server/src/services/analysisService.ts b/server/src/services/analysisService.ts
index 840ad66..710769b 100644
--- a/server/src/services/analysisService.ts
+++ b/server/src/services/analysisService.ts
@@ -34,6 +34,20 @@ interface RepoInfo {
 // ── In-memory state ──
 
 const batches = new Map<string, AnalysisBatch>();
+const BATCH_TTL_MS = 60 * 60 * 1000; // 1 hour
+
+function cleanupBatches(): void {
+  const now = Date.now();
+  for (const [id, batch] of batches) {
+    if (batch.status !== 'running' && batch.completedAt) {
+      if (now - new Date(batch.completedAt).getTime() > BATCH_TTL_MS) {
+        batches.delete(id);
+      }
+    }
+  }
+}
+
+setInterval(cleanupBatches, 10 * 60 * 1000); // every 10 minutes
 
 function generateId(): string {
   return `batch_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
@@ -369,7 +383,7 @@ function repoInfoString(repo: RepoInfo, readmeContent: string, language: string)
     `${isZh ? '描述' : 'Description'}: ${repo.description || (isZh ? '无描述' : 'No description')}`,
     `${isZh ? '编程语言' : 'Programming Language'}: ${repo.language || (isZh ? '未知' : 'Unknown')}`,
     `${isZh ? 'Star数' : 'Stars'}: ${repo.stargazers_count}`,
-    `${isZh ? '主题标签' : 'Topics'}: ${(repo.topics ? JSON.parse(repo.topics).join(', ') : '') || (isZh ? '无' : 'None')}`,
+    `${isZh ? '主题标签' : 'Topics'}: ${(() => { try { return repo.topics ? JSON.parse(repo.topics).join(', ') : ''; } catch { return ''; } })() || (isZh ? '无' : 'None')}`,
     '',
     `${isZh ? 'README内容 (前2000字符)' : 'README Content (first 2000 characters)'}:`,
     readmeContent.substring(0, 2000),
diff --git a/src/components/RepositoryList.tsx b/src/components/RepositoryList.tsx
index af474fd..dbe80be 100644
--- a/src/components/RepositoryList.tsx
+++ b/src/components/RepositoryList.tsx
@@ -472,13 +472,8 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
   const handlePauseResume = () => {
     if (!isAnalyzingRef.current) return;
 
-    // Backend analysis: pause = cancel
-    if (backendAnalysis.isRunning) {
-      shouldStopRef.current = true;
-      backendAnalysis.cancelBatchAnalysis();
-      setIsPaused(false);
-      return;
-    }
+    // Backend analysis doesn't support pause — use Stop instead
+    if (backendAnalysis.isRunning) return;
 
     const newPausedState = !isPaused;
     setIsPaused(newPausedState);
@@ -1196,8 +1191,9 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
               </span>
               <button
                 onClick={handlePauseResume}
-                className="p-1 sm:p-1.5 rounded-lg bg-gray-100 dark:bg-white/[0.04] text-gray-700 dark:text-text-secondary dark:bg-status-amber/20 dark:text-status-amber hover:bg-gray-100 dark:bg-white/[0.04] dark:hover:bg-status-amber/30 transition-colors"
-                title={isPaused ? t('继续', 'Resume') : t('暂停', 'Pause')}
+                disabled={backendAnalysis.isRunning}
+                className="p-1 sm:p-1.5 rounded-lg bg-gray-100 dark:bg-white/[0.04] text-gray-700 dark:text-text-secondary dark:bg-status-amber/20 dark:text-status-amber hover:bg-gray-100 dark:bg-white/[0.04] dark:hover:bg-status-amber/30 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+                title={backendAnalysis.isRunning ? t('后端分析不支持暂停', 'Backend analysis does not support pause') : (isPaused ? t('继续', 'Resume') : t('暂停', 'Pause'))}
               >
                 {isPaused ? <Play className="w-3.5 h-3.5 sm:w-4 sm:h-4" /> : <Pause className="w-3.5 h-3.5 sm:w-4 sm:h-4" />}
               </button>
diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index 608a332..a03674c 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -373,7 +373,9 @@ class BackendAdapter {
   async getAnalysisProgress(batchId: string): Promise<{ batchId: string; status: string; total: number; completed: number; failed: number }> {
     if (!this._backendUrl) throw new Error('Backend not available');
 
-    const res = await this.fetchWithTimeout(`${this._backendUrl}/analysis/batch/${batchId}`);
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/analysis/batch/${batchId}`, {
+      headers: this.getAuthHeaders(),
+    });
     if (!res.ok) await this.throwTranslatedError(res, 'Analysis progress error');
     return res.json() as Promise<{ batchId: string; status: string; total: number; completed: number; failed: number }>;
   }

From de6617a5bc3bd011edc0e29f613b44cb87efa81b Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 13:57:51 +0800
Subject: [PATCH 13/47] =?UTF-8?q?@=20fix:=20=E4=BF=AE=E5=A4=8D=20CodeRabbi?=
 =?UTF-8?q?t=20=E7=AC=AC=E4=BA=8C=E8=BD=AE=E6=84=8F=E8=A7=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- AI API 错误消息不再暴露完整响应体，仅提取安全字段 (Minor)
- 暂停按钮添加 aria-label 无障碍属性 (Minor)
---
 server/src/services/analysisService.ts | 4 +++-
 src/components/RepositoryList.tsx      | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/server/src/services/analysisService.ts b/server/src/services/analysisService.ts
index 710769b..7259880 100644
--- a/server/src/services/analysisService.ts
+++ b/server/src/services/analysisService.ts
@@ -343,7 +343,9 @@ async function callAI(
 
   if (result.status !== 200) {
     const errData = result.data as Record<string, unknown> | undefined;
-    throw new Error(`AI API returned ${result.status}: ${JSON.stringify(errData)}`);
+    console.error(`[analysis] AI API error details:`, errData);
+    const errorMsg = errData?.error?.message || errData?.message || 'Unknown error';
+    throw new Error(`AI API returned ${result.status}: ${typeof errorMsg === 'string' ? errorMsg : 'Request failed'}`);
   }
 
   return extractTextContent(apiType, result.data as Record<string, unknown>);
diff --git a/src/components/RepositoryList.tsx b/src/components/RepositoryList.tsx
index dbe80be..a56a0a3 100644
--- a/src/components/RepositoryList.tsx
+++ b/src/components/RepositoryList.tsx
@@ -1194,6 +1194,7 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
                 disabled={backendAnalysis.isRunning}
                 className="p-1 sm:p-1.5 rounded-lg bg-gray-100 dark:bg-white/[0.04] text-gray-700 dark:text-text-secondary dark:bg-status-amber/20 dark:text-status-amber hover:bg-gray-100 dark:bg-white/[0.04] dark:hover:bg-status-amber/30 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
                 title={backendAnalysis.isRunning ? t('后端分析不支持暂停', 'Backend analysis does not support pause') : (isPaused ? t('继续', 'Resume') : t('暂停', 'Pause'))}
+                aria-label={backendAnalysis.isRunning ? t('后端分析不支持暂停', 'Backend analysis does not support pause') : (isPaused ? t('继续', 'Resume') : t('暂停', 'Pause'))}
               >
                 {isPaused ? <Play className="w-3.5 h-3.5 sm:w-4 sm:h-4" /> : <Pause className="w-3.5 h-3.5 sm:w-4 sm:h-4" />}
               </button>

From 1fc67224e1d05ecd12f055acbca85327cd5b4680 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 14:17:29 +0800
Subject: [PATCH 14/47] =?UTF-8?q?@=20@=20fix:=20=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=E7=89=88=E6=9C=AC=E5=8F=B7=E7=AE=A1=E7=90=86=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- health.ts 改为运行时读取 server/package.json 版本号，不再硬编码
- update-version.cjs 同步更新前后端两个 package.json，移除无效的 updateServiceVersion
- docker-build.yml 前后端镜像使用各自独立的版本号 tag
@
---
 .github/workflows/docker-build.yml | 13 ++++++----
 scripts/update-version.cjs         | 39 +++++++++++-------------------
 server/src/routes/health.ts        |  8 +++++-
 3 files changed, 29 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index fff1685..589b661 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -13,15 +13,18 @@ jobs:
   generate-tags:
     runs-on: ubuntu-24.04
     outputs:
-      version: ${{ steps.tags.outputs.version }}
+      frontend_version: ${{ steps.tags.outputs.frontend_version }}
+      backend_version: ${{ steps.tags.outputs.backend_version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Generate tags
         id: tags
         run: |
-          VER=$(node -p "require('./package.json').version")
-          echo "version=$VER" >> $GITHUB_OUTPUT
+          FRONTEND_VER=$(node -p "require('./package.json').version")
+          BACKEND_VER=$(node -p "require('./server/package.json').version")
+          echo "frontend_version=$FRONTEND_VER" >> $GITHUB_OUTPUT
+          echo "backend_version=$BACKEND_VER" >> $GITHUB_OUTPUT
 
   build-frontend:
     needs: generate-tags
@@ -48,7 +51,7 @@ jobs:
           push: true
           provenance: false
           tags: |
-            ${{ env.FRONTEND_IMAGE }}:${{ needs.generate-tags.outputs.version }}
+            ${{ env.FRONTEND_IMAGE }}:${{ needs.generate-tags.outputs.frontend_version }}
             ${{ env.FRONTEND_IMAGE }}:latest
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -78,7 +81,7 @@ jobs:
           push: true
           provenance: false
           tags: |
-            ${{ env.BACKEND_IMAGE }}:${{ needs.generate-tags.outputs.version }}-backend
+            ${{ env.BACKEND_IMAGE }}:${{ needs.generate-tags.outputs.backend_version }}-backend
             ${{ env.BACKEND_IMAGE }}:backend
           cache-from: type=gha
           cache-to: type=gha,mode=max
diff --git a/scripts/update-version.cjs b/scripts/update-version.cjs
index 5bf2938..e059995 100644
--- a/scripts/update-version.cjs
+++ b/scripts/update-version.cjs
@@ -68,15 +68,12 @@ function updateVersionInfo() {
   }
 
   try {
-    // 更新 package.json
+    // 更新 package.json（前端）
     updatePackageJson(newVersion);
 
     // 更新 version-info.xml
     updateVersionXML(newVersion, changelog, customDownloadUrl);
 
-    // 更新 UpdateService 中的版本号
-    updateServiceVersion(newVersion);
-
     console.log(`✅ 版本已更新到 ${newVersion}`);
     console.log('📝 更新内容:');
     changelog.forEach((item, index) => {
@@ -94,13 +91,19 @@ function updateVersionInfo() {
 }
 
 function updatePackageJson(version) {
-  const packagePath = path.join(__dirname, '../package.json');
-  const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
-
-  packageJson.version = version;
-
-  fs.writeFileSync(packagePath, JSON.stringify(packageJson, null, 2) + '\n');
-  console.log(`📦 已更新 package.json 版本到 ${version}`);
+  // 前端 package.json
+  const frontPath = path.join(__dirname, '../package.json');
+  const frontPkg = JSON.parse(fs.readFileSync(frontPath, 'utf8'));
+  frontPkg.version = version;
+  fs.writeFileSync(frontPath, JSON.stringify(frontPkg, null, 2) + '\n');
+
+  // 后端 package.json（Docker 镜像 tag 和 /api/health 的版本来源）
+  const serverPath = path.join(__dirname, '../server/package.json');
+  const serverPkg = JSON.parse(fs.readFileSync(serverPath, 'utf8'));
+  serverPkg.version = version;
+  fs.writeFileSync(serverPath, JSON.stringify(serverPkg, null, 2) + '\n');
+
+  console.log(`📦 已更新 package.json 和 server/package.json 版本到 ${version}`);
 }
 
 function updateVersionXML(version, changelog, customDownloadUrl) {
@@ -136,20 +139,6 @@ ${changelog.map(item => `      <item>${escapeXml(item)}</item>`).join('\n')}
   console.log(`📄 已更新 version-info.xml`);
 }
 
-function updateServiceVersion(version) {
-  const servicePath = path.join(__dirname, '../src/services/updateService.ts');
-  let serviceContent = fs.readFileSync(servicePath, 'utf8');
-
-  // 更新版本号
-  serviceContent = serviceContent.replace(
-    /return '\d+\.\d+\.\d+';/,
-    `return '${version}';`
-  );
-
-  fs.writeFileSync(servicePath, serviceContent);
-  console.log(`🔧 已更新 UpdateService 版本到 ${version}`);
-}
-
 function escapeXml(text) {
   return text
     .replace(/&/g, '&amp;')
diff --git a/server/src/routes/health.ts b/server/src/routes/health.ts
index 8f5f8d5..1a0fb87 100644
--- a/server/src/routes/health.ts
+++ b/server/src/routes/health.ts
@@ -1,11 +1,17 @@
 import { Router } from 'express';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const { version } = JSON.parse(readFileSync(join(__dirname, '../../package.json'), 'utf8'));
 
 const router = Router();
 
 router.get('/api/health', (_req, res) => {
   res.json({
     status: 'ok',
-    version: '0.1.0',
+    version,
     timestamp: new Date().toISOString(),
   });
 });

From d75a28c328f1e99ac4de809e0118408b353204c9 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 14:18:43 +0800
Subject: [PATCH 15/47] =?UTF-8?q?@=20@=20chore:=20=E6=9B=B4=E6=96=B0=20ver?=
 =?UTF-8?q?sions/README.md=20=E5=8F=8D=E6=98=A0=E5=BD=93=E5=89=8D=E7=89=88?=
 =?UTF-8?q?=E6=9C=AC=E7=AE=A1=E7=90=86=E6=B5=81=E7=A8=8B=20@?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 versions/README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/versions/README.md b/versions/README.md
index fd8f99c..bf2ada7 100644
--- a/versions/README.md
+++ b/versions/README.md
@@ -16,9 +16,9 @@ npm run update-version 0.1.3 "修复搜索功能bug" "添加新的过滤选项"
 ```
 
 这个命令会：
-- 更新 `package.json` 中的版本号
+- 更新 `package.json`（前端）和 `server/package.json`（后端）中的版本号
 - 在 `version-info.xml` 中添加新版本记录
-- 更新 `src/services/updateService.ts` 中的当前版本号
+- 后端 `/api/health` 接口会从 `server/package.json` 动态读取版本号
 
 ### 2. 手动更新（不推荐）
 
@@ -45,7 +45,7 @@ npm run update-version 0.1.3 "修复搜索功能bug" "添加新的过滤选项"
 1. 使用 `npm run update-version` 更新版本信息
 2. 提交更改到 Git 仓库：
    ```bash
-   git add .
+   git add package.json server/package.json versions/version-info.xml
    git commit -m "chore: bump version to v0.1.3"
    git push origin main
    ```

From 523c54b3062d273304364d02c3edc7c151c1a59a Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 14:24:12 +0800
Subject: [PATCH 16/47] =?UTF-8?q?@=20@=20fix:=20=E6=B7=BB=E5=8A=A0=20@type?=
 =?UTF-8?q?s/node=20=E8=A7=A3=E5=86=B3=20server=20TypeScript=2063=20?=
 =?UTF-8?q?=E4=B8=AA=E7=B1=BB=E5=9E=8B=E9=94=99=E8=AF=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- server/package.json devDependencies 新增 @types/node
- 修复 analysisService.ts 唯一的类型错误 (errData?.error?.message)
- tsc --noEmit 现在零错误通过
@
---
 package-lock.json                      | 89 ++++++--------------------
 package.json                           |  1 +
 server/package-lock.json               | 19 +++---
 server/package.json                    |  1 +
 server/src/services/analysisService.ts |  2 +-
 5 files changed, 30 insertions(+), 82 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 4620d13..357c212 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "github-stars-manager",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "github-stars-manager",
-      "version": "0.5.6",
+      "version": "0.5.7",
       "dependencies": {
         "@types/query-string": "^6.2.0",
         "date-fns": "^3.3.1",
@@ -28,6 +28,7 @@
         "@tailwindcss/typography": "^0.5.19",
         "@testing-library/jest-dom": "^6.4.2",
         "@testing-library/react": "^14.2.1",
+        "@types/node": "^25.6.2",
         "@types/react": "^18.3.5",
         "@types/react-dom": "^18.3.0",
         "@vitejs/plugin-legacy": "^8.0.1",
@@ -1205,9 +1206,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1225,9 +1223,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1245,9 +1240,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1265,9 +1257,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1285,9 +1274,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1305,9 +1291,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1462,9 +1445,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1479,9 +1459,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1496,9 +1473,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1513,9 +1487,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1530,9 +1501,6 @@
         "loong64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1547,9 +1515,6 @@
         "loong64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1564,9 +1529,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1581,9 +1543,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1598,9 +1557,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1615,9 +1571,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1632,9 +1585,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1649,9 +1599,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1666,9 +1613,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1942,6 +1886,15 @@
       "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
       "license": "MIT"
     },
+    "node_modules/@types/node": {
+      "version": "25.6.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.6.2.tgz",
+      "integrity": "sha512-sokuT28dxf9JT5Kady1fsXOvI4HVpjZa95NKT5y9PNTIrs2AsobR4GFAA90ZG8M+nxVRLysCXsVj6eGC7Vbrlw==",
+      "dev": true,
+      "dependencies": {
+        "undici-types": "~7.19.0"
+      }
+    },
     "node_modules/@types/prop-types": {
       "version": "15.7.15",
       "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz",
@@ -6671,9 +6624,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -6695,9 +6645,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -6719,9 +6666,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -6743,9 +6687,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -10238,6 +10179,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/undici-types": {
+      "version": "7.19.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.19.2.tgz",
+      "integrity": "sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==",
+      "dev": true
+    },
     "node_modules/unicode-canonical-property-names-ecmascript": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.1.tgz",
diff --git a/package.json b/package.json
index 6a640e2..54565f8 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,7 @@
     "@tailwindcss/typography": "^0.5.19",
     "@testing-library/jest-dom": "^6.4.2",
     "@testing-library/react": "^14.2.1",
+    "@types/node": "^25.6.2",
     "@types/react": "^18.3.5",
     "@types/react-dom": "^18.3.0",
     "@vitejs/plugin-legacy": "^8.0.1",
diff --git a/server/package-lock.json b/server/package-lock.json
index 32a2bd5..e86b8af 100644
--- a/server/package-lock.json
+++ b/server/package-lock.json
@@ -19,6 +19,7 @@
         "@types/cors": "^2.8.17",
         "@types/express": "^4.17.21",
         "@types/morgan": "^1.9.9",
+        "@types/node": "^22.0.0",
         "@types/supertest": "^6.0.2",
         "supertest": "^6.3.4",
         "tsx": "^4.7.0",
@@ -981,13 +982,12 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "25.3.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.3.0.tgz",
-      "integrity": "sha512-4K3bqJpXpqfg2XKGK9bpDTc6xO/xoUP/RBWS7AtRMug6zZFaRekiLzjVtAoZMquxoAbzBvy5nxQ7veS5eYzf8A==",
+      "version": "22.19.18",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.18.tgz",
+      "integrity": "sha512-9v00a+dn2yWVsYDEunWC4g/TcRKVq3r8N5FuZp7u0SGrPvdN9c2yXI9bBuf5Fl0hNCb+QTIePTn5pJs2pwBOQQ==",
       "dev": true,
-      "license": "MIT",
       "dependencies": {
-        "undici-types": "~7.18.0"
+        "undici-types": "~6.21.0"
       }
     },
     "node_modules/@types/qs": {
@@ -3422,11 +3422,10 @@
       "license": "MIT"
     },
     "node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
-      "dev": true,
-      "license": "MIT"
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true
     },
     "node_modules/unpipe": {
       "version": "1.0.0",
diff --git a/server/package.json b/server/package.json
index eb19c2e..fce8562 100644
--- a/server/package.json
+++ b/server/package.json
@@ -18,6 +18,7 @@
     "morgan": "^1.10.0"
   },
   "devDependencies": {
+    "@types/node": "^22.0.0",
     "@types/express": "^4.17.21",
     "@types/better-sqlite3": "^7.6.8",
     "@types/cors": "^2.8.17",
diff --git a/server/src/services/analysisService.ts b/server/src/services/analysisService.ts
index 7259880..8d69cf6 100644
--- a/server/src/services/analysisService.ts
+++ b/server/src/services/analysisService.ts
@@ -344,7 +344,7 @@ async function callAI(
   if (result.status !== 200) {
     const errData = result.data as Record<string, unknown> | undefined;
     console.error(`[analysis] AI API error details:`, errData);
-    const errorMsg = errData?.error?.message || errData?.message || 'Unknown error';
+    const errorMsg = (errData?.error as Record<string, unknown>)?.message || errData?.message || 'Unknown error';
     throw new Error(`AI API returned ${result.status}: ${typeof errorMsg === 'string' ? errorMsg : 'Request failed'}`);
   }
 

From 15ae3053788c64fb31c765ab77342f74da06fde2 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 14:32:08 +0800
Subject: [PATCH 17/47] =?UTF-8?q?@=20@=20fix:=20=E4=BF=AE=E5=A4=8D=20CodeR?=
 =?UTF-8?q?abbit=20=E6=8C=87=E5=87=BA=E7=9A=84=202=20=E4=B8=AA=E5=AE=B9?=
 =?UTF-8?q?=E9=94=99=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- health.ts: readFileSync 添加 try-catch，文件缺失时回退 unknown
- analysisService.ts: decrypt 添加 try-catch，防止敏感信息泄露
@
---
 server/src/routes/health.ts            | 8 +++++++-
 server/src/services/analysisService.ts | 8 +++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/server/src/routes/health.ts b/server/src/routes/health.ts
index 1a0fb87..16f41f3 100644
--- a/server/src/routes/health.ts
+++ b/server/src/routes/health.ts
@@ -4,7 +4,13 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
-const { version } = JSON.parse(readFileSync(join(__dirname, '../../package.json'), 'utf8'));
+let version = 'unknown';
+try {
+  const pkg = JSON.parse(readFileSync(join(__dirname, '../../package.json'), 'utf8'));
+  version = pkg.version ?? 'unknown';
+} catch {
+  version = 'unknown';
+}
 
 const router = Router();
 
diff --git a/server/src/services/analysisService.ts b/server/src/services/analysisService.ts
index 8d69cf6..ea4153d 100644
--- a/server/src/services/analysisService.ts
+++ b/server/src/services/analysisService.ts
@@ -272,7 +272,13 @@ async function callAI(
   systemPrompt: string,
   userPrompt: string,
 ): Promise<string> {
-  const apiKey = decrypt(aiConfig.api_key_encrypted as string, config.encryptionKey);
+  let apiKey: string;
+  try {
+    apiKey = decrypt(aiConfig.api_key_encrypted as string, config.encryptionKey);
+  } catch {
+    console.error('[analysis] Failed to decrypt AI API key');
+    throw new Error('Failed to decrypt AI API key');
+  }
   const apiType = (aiConfig.api_type as string) || 'openai';
   const baseUrl = aiConfig.base_url as string;
   const model = aiConfig.model as string;

From 9bcf2de1ee10ff67e47d8a9d37b681478774488f Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 14:34:56 +0800
Subject: [PATCH 18/47] =?UTF-8?q?@=20@=20fix:=20=E5=90=8C=E6=AD=A5=20serve?=
 =?UTF-8?q?r/package.json=20=E7=89=88=E6=9C=AC=E5=8F=B7=E4=B8=BA=200.5.7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

之前 server/package.json 停留在 0.1.0，导致 Docker 后端镜像 tag 和
/api/health 返回的版本号与前端不一致
@
---
 server/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/package.json b/server/package.json
index fce8562..2a55b22 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "github-stars-manager-server",
-  "version": "0.1.0",
+  "version": "0.5.7",
   "private": true,
   "type": "module",
   "scripts": {

From 8a7b744bdac53c01902d5b215e9594cb61e6f707 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 14:37:14 +0800
Subject: [PATCH 19/47] @ @ chore: bump version to 0.6.0 @

---
 package.json              |  2 +-
 server/package.json       |  2 +-
 versions/version-info.xml | 11 +++++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 54565f8..64a9ae5 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "github-stars-manager",
   "private": true,
-  "version": "0.5.7",
+  "version": "0.6.0",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/server/package.json b/server/package.json
index 2a55b22..c29ac9e 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "github-stars-manager-server",
-  "version": "0.5.7",
+  "version": "0.6.0",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/versions/version-info.xml b/versions/version-info.xml
index f3cd078..57c0bbc 100644
--- a/versions/version-info.xml
+++ b/versions/version-info.xml
@@ -318,4 +318,15 @@
     </changelog>
     <downloadUrl>https://github.com/AmintaCCCP/GithubStarsManager/releases/tag/v0.5.7</downloadUrl>
   </version>
+  <version>
+    <number>0.6.0</number>
+    <releaseDate>2026-05-11</releaseDate>
+    <changelog>
+      <item>AI 分析改为后端执行，刷新页面不中断，进度不丢失</item>
+      <item>前后端 Docker 镜像使用独立版本号 tag</item>
+      <item>修复 /api/health 硬编码版本号，改为动态读取</item>
+      <item>修复版本管理脚本，同步更新前后端版本</item>
+    </changelog>
+    <downloadUrl>https://github.com/AmintaCCCP/GithubStarsManager/releases/download/v0.6.0/github-stars-manager-0.6.0.dmg</downloadUrl>
+  </version>
 </versions>

From 8fb14b2725d47f41fe97f73a432d841cbcac3360 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 14:42:55 +0800
Subject: [PATCH 20/47] =?UTF-8?q?@=20@=20fix:=20AI=20API=20=E9=94=99?=
 =?UTF-8?q?=E8=AF=AF=E6=97=A5=E5=BF=97=E5=8F=AA=E8=AE=B0=E5=BD=95=E5=AE=89?=
 =?UTF-8?q?=E5=85=A8=E5=AD=97=E6=AE=B5=EF=BC=8C=E9=81=BF=E5=85=8D=E6=B3=84?=
 =?UTF-8?q?=E9=9C=B2=E6=95=8F=E6=84=9F=E4=BF=A1=E6=81=AF=20@?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/src/services/analysisService.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/server/src/services/analysisService.ts b/server/src/services/analysisService.ts
index ea4153d..80a3f6d 100644
--- a/server/src/services/analysisService.ts
+++ b/server/src/services/analysisService.ts
@@ -349,8 +349,13 @@ async function callAI(
 
   if (result.status !== 200) {
     const errData = result.data as Record<string, unknown> | undefined;
-    console.error(`[analysis] AI API error details:`, errData);
-    const errorMsg = (errData?.error as Record<string, unknown>)?.message || errData?.message || 'Unknown error';
+    const errObj = errData?.error && typeof errData.error === 'object'
+      ? (errData.error as Record<string, unknown>)
+      : undefined;
+    const errorMsg = errObj?.message || errData?.message || 'Unknown error';
+    const requestId = typeof errData?.request_id === 'string' ? errData.request_id : undefined;
+    const errorCode = typeof errObj?.code === 'string' ? errObj.code : undefined;
+    console.error('[analysis] AI API error', { status: result.status, requestId, errorCode });
     throw new Error(`AI API returned ${result.status}: ${typeof errorMsg === 'string' ? errorMsg : 'Request failed'}`);
   }
 

From adf5bb2fbced3b7b1d8d2d2624d14e7e572afdb5 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 15:03:53 +0800
Subject: [PATCH 21/47] =?UTF-8?q?@=20@=20fix:=20=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=E5=90=8E=E7=AB=AF=20AI=20=E5=88=86=E6=9E=90=E4=B8=A4=E4=B8=AA?=
 =?UTF-8?q?=20bug?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- buildApiUrl 改为从 origin 拼接路径，避免 base URL 已有 /v1 时叠加成 /v1/v1
- syncSettings 添加 github_token，确保后端分析能获取 GitHub Token 避免 429 限流
@
---
 server/src/services/analysisService.ts | 5 ++---
 src/services/autoSync.ts               | 1 +
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/src/services/analysisService.ts b/server/src/services/analysisService.ts
index 80a3f6d..aeb4ae2 100644
--- a/server/src/services/analysisService.ts
+++ b/server/src/services/analysisService.ts
@@ -259,11 +259,10 @@ async function fetchReadme(owner: string, repo: string): Promise<string> {
 // ── AI API call ──
 
 function buildApiUrl(baseUrl: string, pathWithVersion: string): string {
-  const baseUrlWithSlash = baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`;
   try {
-    return new URL(pathWithVersion, baseUrlWithSlash).toString();
+    return new URL(pathWithVersion, new URL(baseUrl).origin).toString();
   } catch {
-    return `${baseUrlWithSlash}${pathWithVersion}`;
+    return `${baseUrl.replace(/\/$/, '')}/${pathWithVersion}`;
   }
 }
 
diff --git a/src/services/autoSync.ts b/src/services/autoSync.ts
index cb10f5e..3cc271e 100644
--- a/src/services/autoSync.ts
+++ b/src/services/autoSync.ts
@@ -229,6 +229,7 @@ export async function syncToBackend(): Promise<void> {
         customCategories: state.customCategories,
         assetFilters: state.assetFilters,
         collapsedSidebarCategoryCount: state.collapsedSidebarCategoryCount,
+        github_token: state.githubToken,
       }),
     ]);
     const [reposSync, releasesSync, aiSync, webdavSync, settingsSync] = results;

From b6f54b472ca3e71cca5115d4746ba705fe39c8b4 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 15:16:43 +0800
Subject: [PATCH 22/47] =?UTF-8?q?@=20@=20fix:=20=E4=BF=AE=E5=A4=8D=20CodeR?=
 =?UTF-8?q?abbit=20=E6=8C=87=E5=87=BA=E7=9A=84=20syncSettings=20=E4=B8=A4?=
 =?UTF-8?q?=E4=B8=AA=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 失败日志改为只输出分片名称，避免泄露敏感信息
- githubToken 变更检测和 hash 中加入 github_token，确保 Token 变更会触发同步
@
---
 src/services/autoSync.ts | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/services/autoSync.ts b/src/services/autoSync.ts
index 3cc271e..29521c3 100644
--- a/src/services/autoSync.ts
+++ b/src/services/autoSync.ts
@@ -236,7 +236,14 @@ export async function syncToBackend(): Promise<void> {
 
     const failures = results.filter(r => r.status === 'rejected');
     if (failures.length > 0) {
-      console.warn(`⚠️ Synced to backend with ${failures.length} error(s):`, failures.map(f => (f as PromiseRejectedResult).reason));
+      const failedSlices = [
+        reposSync.status === 'rejected' ? 'repositories' : null,
+        releasesSync.status === 'rejected' ? 'releases' : null,
+        aiSync.status === 'rejected' ? 'aiConfigs' : null,
+        webdavSync.status === 'rejected' ? 'webdavConfigs' : null,
+        settingsSync.status === 'rejected' ? 'settings' : null,
+      ].filter(Boolean);
+      console.warn(`⚠️ Synced to backend with ${failures.length} error(s):`, failedSlices);
       _hasPendingLocalChanges = true;
     } else {
       console.log('✅ Synced to backend');
@@ -257,6 +264,7 @@ export async function syncToBackend(): Promise<void> {
         customCategories: state.customCategories,
         assetFilters: state.assetFilters,
         collapsedSidebarCategoryCount: state.collapsedSidebarCategoryCount,
+        github_token: state.githubToken,
       });
     }
   } catch (err) {
@@ -319,7 +327,8 @@ export function startAutoSync(): () => void {
       state.categoryOrder !== prevState.categoryOrder ||
       state.customCategories !== prevState.customCategories ||
       state.assetFilters !== prevState.assetFilters ||
-      state.collapsedSidebarCategoryCount !== prevState.collapsedSidebarCategoryCount;
+      state.collapsedSidebarCategoryCount !== prevState.collapsedSidebarCategoryCount ||
+      state.githubToken !== prevState.githubToken;
 
     if (!changed) return;
 

From daa72d50fde83f1ed1fbc7ebd6eece1e7b8db14c Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 15:44:49 +0800
Subject: [PATCH 23/47] =?UTF-8?q?@=20fix:=20=E5=88=B7=E6=96=B0=E9=A1=B5?=
 =?UTF-8?q?=E9=9D=A2=E5=90=8E=E6=81=A2=E5=A4=8D=20AI=20=E5=88=86=E6=9E=90?=
 =?UTF-8?q?=E8=BF=9B=E5=BA=A6=E6=9D=A1=E5=92=8C=E5=81=9C=E6=AD=A2=E6=8C=89?=
 =?UTF-8?q?=E9=92=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 后端新增 GET /api/analysis/batches/active 返回运行中的批次
- 前端将 batchId 持久化到 localStorage，刷新后通过 resumeBatchAnalysis 恢复轮询
- App 启动时自动重连运行中的分析批次，恢复进度条和仓库分析状态
@
---
 server/src/routes/analysis.ts          |  11 ++
 server/src/services/analysisService.ts |  10 ++
 src/App.tsx                            |   5 +
 src/services/backendAdapter.ts         |  10 ++
 src/services/backendAnalysisService.ts | 152 +++++++++++++++++++++++++
 5 files changed, 188 insertions(+)

diff --git a/server/src/routes/analysis.ts b/server/src/routes/analysis.ts
index 820f60a..25e6fbe 100644
--- a/server/src/routes/analysis.ts
+++ b/server/src/routes/analysis.ts
@@ -56,6 +56,17 @@ router.post('/api/analysis/batch', (req, res) => {
   }
 });
 
+// GET /api/analysis/batches/active — list running batches (for page-refresh recovery)
+router.get('/api/analysis/batches/active', (_req, res) => {
+  try {
+    const active = analysisService.getRunningBatches();
+    res.json(active);
+  } catch (err) {
+    console.error('GET /api/analysis/batches/active error:', err);
+    res.status(500).json({ error: 'Failed to get active batches', code: 'ANALYSIS_ACTIVE_FAILED' });
+  }
+});
+
 // GET /api/analysis/batch/:batchId — check progress
 router.get('/api/analysis/batch/:batchId', (req, res) => {
   try {
diff --git a/server/src/services/analysisService.ts b/server/src/services/analysisService.ts
index aeb4ae2..ad2b77d 100644
--- a/server/src/services/analysisService.ts
+++ b/server/src/services/analysisService.ts
@@ -94,6 +94,16 @@ export function getBatchStatus(batchId: string): AnalysisBatch | undefined {
   return batches.get(batchId);
 }
 
+export function getRunningBatches(): AnalysisBatch[] {
+  const result: AnalysisBatch[] = [];
+  for (const batch of batches.values()) {
+    if (batch.status === 'running') {
+      result.push(batch);
+    }
+  }
+  return result;
+}
+
 export function cancelBatch(batchId: string): boolean {
   const batch = batches.get(batchId);
   if (!batch || batch.status !== 'running') return false;
diff --git a/src/App.tsx b/src/App.tsx
index 6e7ac4a..4526fa8 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -15,6 +15,7 @@ import { useAutoUpdateCheck } from './components/UpdateChecker';
 import { UpdateNotificationBanner } from './components/UpdateNotificationBanner';
 import { backend } from './services/backendAdapter';
 import { syncFromBackend, startAutoSync, stopAutoSync } from './services/autoSync';
+import { backendAnalysis } from './services/backendAnalysisService';
 import type { AppState } from './types';
 
 const RepositoriesView = React.memo(({ 
@@ -88,6 +89,10 @@ function App() {
           if (!cancelled) {
             unsubscribe = startAutoSync();
           }
+          // Reconnect to any analysis batch that was running before page refresh
+          if (!cancelled) {
+            void backendAnalysis.resumeBatchAnalysis();
+          }
         }
       } catch (err) {
         console.error('Failed to initialize backend:', err);
diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index a03674c..869a761 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -387,6 +387,16 @@ class BackendAdapter {
     if (!res.ok) await this.throwTranslatedError(res, 'Cancel analysis error');
   }
 
+  async getActiveBatches(): Promise<Array<{ batchId: string; status: string; total: number; completed: number; failed: number; repositoryIds: number[] }>> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/analysis/batches/active`, {
+      headers: this.getAuthHeaders(),
+    });
+    if (!res.ok) await this.throwTranslatedError(res, 'Active batches error');
+    return res.json() as Promise<Array<{ batchId: string; status: string; total: number; completed: number; failed: number; repositoryIds: number[] }>>;
+  }
+
   // === GitHub Search Proxy ===
 
   async searchRepositories(queryParams: Record<string, string>): Promise<{ items: Repository[] }> {
diff --git a/src/services/backendAnalysisService.ts b/src/services/backendAnalysisService.ts
index 497c990..beea3e6 100644
--- a/src/services/backendAnalysisService.ts
+++ b/src/services/backendAnalysisService.ts
@@ -1,6 +1,13 @@
 import { backend } from './backendAdapter';
 import { useAppStore } from '../store/useAppStore';
 
+const STORAGE_KEY = 'gsm:analysis:batches';
+
+interface SavedBatch {
+  batchId: string;
+  repositoryIds: number[];
+}
+
 interface BatchAnalysisOptions {
   repositoryIds: number[];
   configId: string;
@@ -11,6 +18,32 @@ interface BatchAnalysisOptions {
   onRepoResult?: (repoId: number) => void;
 }
 
+function loadSavedBatches(): SavedBatch[] {
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    if (raw) {
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed)) return parsed;
+    }
+  } catch { /* corrupted */ }
+  return [];
+}
+
+function saveBatch(batchId: string, repositoryIds: number[]): void {
+  const batches = loadSavedBatches();
+  batches.push({ batchId, repositoryIds });
+  localStorage.setItem(STORAGE_KEY, JSON.stringify(batches));
+}
+
+function removeBatch(batchId: string): void {
+  const batches = loadSavedBatches().filter(b => b.batchId !== batchId);
+  if (batches.length === 0) {
+    localStorage.removeItem(STORAGE_KEY);
+  } else {
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(batches));
+  }
+}
+
 class BackendAnalysisService {
   private pollingTimeout: ReturnType<typeof setTimeout> | null = null;
   private currentBatchId: string | null = null;
@@ -37,6 +70,9 @@ class BackendAnalysisService {
       const { batchId } = await backend.startAnalysis(repositoryIds, configId, language, categoryNames);
       this.currentBatchId = batchId;
 
+      // Persist to localStorage for page-refresh recovery
+      saveBatch(batchId, repositoryIds);
+
       return new Promise<void>((resolve) => {
         let lastReportedCount = 0;
 
@@ -60,6 +96,7 @@ class BackendAnalysisService {
 
             if (progress.status === 'completed' || progress.status === 'cancelled' || progress.status === 'failed') {
               this.finishBatch(batchId, repositoryIds);
+              removeBatch(batchId);
 
               if (progress.status === 'completed') {
                 try {
@@ -126,6 +163,121 @@ class BackendAnalysisService {
     return this._isRunning;
   }
 
+  /**
+   * Called on app startup to reconnect to any batch that was running
+   * when the user last refreshed the page.
+   */
+  async resumeBatchAnalysis(
+    onProgress?: (current: number, total: number) => void,
+    onComplete?: () => void,
+  ): Promise<void> {
+    if (this._isRunning) return;
+    if (!backend.isAvailable) return;
+
+    const savedBatches = loadSavedBatches();
+    if (savedBatches.length === 0) return;
+
+    // Fetch active batches from backend to see what's still running
+    let activeBatches: Array<{ batchId: string; status: string; total: number; completed: number; failed: number; repositoryIds: number[] }> = [];
+    try {
+      activeBatches = await backend.getActiveBatches();
+    } catch {
+      // Backend unreachable — keep saved batches for next attempt
+      return;
+    }
+
+    const activeIds = new Set(activeBatches.map(b => b.batchId));
+
+    // Clean up completed batches from localStorage
+    let cleaned = false;
+    for (const saved of savedBatches) {
+      if (!activeIds.has(saved.batchId)) {
+        removeBatch(saved.batchId);
+        cleaned = true;
+      }
+    }
+    if (cleaned) {
+      // Reload after cleaning
+      const remaining = loadSavedBatches();
+      if (remaining.length === 0) return;
+    }
+
+    // If no active batches on backend, nothing to resume
+    if (activeBatches.length === 0) return;
+
+    // Resume the first active batch that we have in localStorage
+    // (normally there's only one batch running at a time)
+    const remainingSaved = loadSavedBatches();
+    for (const active of activeBatches) {
+      const saved = remainingSaved.find(s => s.batchId === active.batchId);
+      if (!saved) continue;
+
+      // Restore analyzing state for all repositories in this batch
+      const store = useAppStore.getState();
+      for (const id of saved.repositoryIds) {
+        store.setAnalyzingRepository(id, true);
+      }
+      store.setAnalysisProgress({ current: active.completed + active.failed, total: active.total });
+
+      this._isRunning = true;
+      this.currentBatchId = active.batchId;
+
+      const poll = async (): Promise<void> => {
+        if (this.currentBatchId !== active.batchId) return;
+
+        try {
+          const progress = await backend.getAnalysisProgress(active.batchId);
+          if (this.currentBatchId !== active.batchId) return;
+
+          store.setAnalysisProgress({ current: progress.completed + progress.failed, total: progress.total });
+          onProgress?.(progress.completed + progress.failed, progress.total);
+
+          if (progress.status === 'completed' || progress.status === 'cancelled' || progress.status === 'failed') {
+            this.finishBatch(active.batchId, saved.repositoryIds);
+            removeBatch(active.batchId);
+
+            if (progress.status === 'completed') {
+              try {
+                const repoData = await backend.fetchRepositories();
+                const repoMap = new Map(repoData.repositories.map((r) => [r.id, r]));
+                const currentRepos = useAppStore.getState().repositories;
+                const updatedRepos = currentRepos.map((r) => {
+                  const updated = repoMap.get(r.id);
+                  if (updated) {
+                    return {
+                      ...r,
+                      ai_summary: updated.ai_summary,
+                      ai_tags: updated.ai_tags,
+                      ai_platforms: updated.ai_platforms,
+                      analyzed_at: updated.analyzed_at,
+                      analysis_failed: updated.analysis_failed,
+                    };
+                  }
+                  return r;
+                });
+                useAppStore.getState().setRepositories(updatedRepos);
+              } catch {
+                // Refresh failed — UI can resync manually
+              }
+            }
+
+            onComplete?.();
+            return;
+          }
+        } catch {
+          // Poll errors are non-fatal
+        }
+
+        if (this.currentBatchId === active.batchId) {
+          this.pollingTimeout = setTimeout(poll, 2000);
+        }
+      };
+
+      poll();
+      return; // Only resume one batch
+    }
+  }
+
   private finishBatch(batchId: string | null, repositoryIds: number[]): void {
     // Only clean up instance state if this batch is still current
     if (batchId === null || this.currentBatchId === batchId) {

From b16a06c895ea8a219dc309f46b6ba166dc1cefa5 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 17:15:38 +0800
Subject: [PATCH 24/47] =?UTF-8?q?@=20refactor:=20=E4=BB=A5=E5=90=8E?=
 =?UTF-8?q?=E7=AB=AF=E4=B8=BA=E5=8D=95=E4=B8=80=E6=95=B0=E6=8D=AE=E6=BA=90?=
 =?UTF-8?q?=EF=BC=8C=E7=A7=BB=E9=99=A4=E5=8F=8C=E5=90=91=E8=87=AA=E5=8A=A8?=
 =?UTF-8?q?=E5=90=8C=E6=AD=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 移除 autoSync.ts 中所有 push-to-backend 逻辑，仅保留 5s 轮询拉取
- backendAdapter 新增 updateRepository(PATCH) 和 deleteRepository(DELETE) 方法
- 18 处 forceSyncToBackend() 替换为精确的 API 调用
- 后端 upsert 时按字段保留已有 AI 数据，防止覆盖分析结果
- 修复 SubscriptionRepoCard 中 existingRepo 可能 undefined 的崩溃隐患
- 清理 autoSync.ts 中死变量和过时注释
---
 server/src/routes/repositories.ts       |  81 +++++++++-
 src/App.tsx                             |   4 +-
 src/components/CategorySidebar.tsx      |  12 +-
 src/components/ReleaseTimeline.tsx      |   5 +-
 src/components/RepositoryCard.tsx       |   5 +-
 src/components/RepositoryEditModal.tsx  |  10 +-
 src/components/RepositoryList.tsx       |  14 +-
 src/components/SubscriptionRepoCard.tsx |  14 +-
 src/services/autoSync.ts                | 197 +-----------------------
 src/services/backendAdapter.ts          |  27 +++-
 10 files changed, 138 insertions(+), 231 deletions(-)

diff --git a/server/src/routes/repositories.ts b/server/src/routes/repositories.ts
index 66b7833..aed6d58 100644
--- a/server/src/routes/repositories.ts
+++ b/server/src/routes/repositories.ts
@@ -90,7 +90,7 @@ router.put('/api/repositories', (req, res) => {
       return;
     }
 
-    // 验证每个仓库的ID
+    // Validate each repository
     for (const repo of repositories) {
       if (!repo.id || typeof repo.id !== 'number' || repo.id <= 0) {
         res.status(400).json({ error: 'Each repository must have a valid positive integer id', code: 'INVALID_REPOSITORY_ID' });
@@ -156,9 +156,74 @@ router.put('/api/repositories', (req, res) => {
         deleteRepositoriesNotIn(placeholders).run(...repoIds);
       }
 
+      // Pre-fetch existing AI data to preserve it when incoming repo has no AI data
+      const existingAI = new Map<number, {
+        ai_summary: string | null;
+        ai_tags: string;
+        ai_platforms: string;
+        analyzed_at: string | null;
+        analysis_failed: number;
+      }>();
+      const ids = repositories.map(r => r.id).filter((id): id is number => typeof id === 'number');
+      if (ids.length > 0) {
+        const phs = ids.map(() => '?').join(', ');
+        const rows = db.prepare(
+          `SELECT id, ai_summary, ai_tags, ai_platforms, analyzed_at, analysis_failed
+           FROM repositories WHERE id IN (${phs})`
+        ).all(...ids) as Array<{
+          id: number;
+          ai_summary: string | null;
+          ai_tags: string | null;
+          ai_platforms: string | null;
+          analyzed_at: string | null;
+          analysis_failed: number | null;
+        }>;
+        for (const row of rows) {
+          existingAI.set(row.id, {
+            ai_summary: row.ai_summary,
+            ai_tags: row.ai_tags ?? '[]',
+            ai_platforms: row.ai_platforms ?? '[]',
+            analyzed_at: row.analyzed_at,
+            analysis_failed: row.analysis_failed ?? 0,
+          });
+        }
+      }
+
       let count = 0;
       for (const repo of repositories) {
         const owner = repo.owner as { login?: string; avatar_url?: string } | undefined;
+        const existing = existingAI.get(repo.id as number);
+
+        // Preserve existing AI data field-by-field when incoming value is empty
+        const hasAnyIncomingAI =
+          (repo.ai_summary != null && repo.ai_summary !== '') ||
+          (Array.isArray(repo.ai_tags) && repo.ai_tags.length > 0) ||
+          (Array.isArray(repo.ai_platforms) && repo.ai_platforms.length > 0) ||
+          repo.analyzed_at != null ||
+          repo.analysis_failed === true ||
+          repo.analysis_failed === 1;
+
+        const hasIncomingSummary = repo.ai_summary != null && repo.ai_summary !== '';
+        const hasIncomingTags = Array.isArray(repo.ai_tags) && repo.ai_tags.length > 0;
+        const hasIncomingPlatforms = Array.isArray(repo.ai_platforms) && repo.ai_platforms.length > 0;
+        const hasIncomingAnalyzedAt = repo.analyzed_at != null;
+
+        const aiSummary = hasIncomingSummary
+          ? repo.ai_summary
+          : (existing?.ai_summary ?? null);
+        const aiTagsJson = hasIncomingTags
+          ? JSON.stringify(repo.ai_tags)
+          : (existing?.ai_tags ?? '[]');
+        const aiPlatformsJson = hasIncomingPlatforms
+          ? JSON.stringify(repo.ai_platforms)
+          : (existing?.ai_platforms ?? '[]');
+        const analyzedAt = hasIncomingAnalyzedAt
+          ? repo.analyzed_at
+          : (existing?.analyzed_at ?? null);
+        const analysisFailed = hasAnyIncomingAI
+          ? ((repo.analysis_failed === true || repo.analysis_failed === 1) ? 1 : 0)
+          : (existing?.analysis_failed ?? 0);
+
         stmt.run(
           repo.id, repo.name, repo.full_name, repo.description ?? null,
           repo.html_url, repo.stargazers_count ?? 0, repo.language ?? null,
@@ -166,10 +231,10 @@ router.put('/api/repositories', (req, res) => {
           repo.starred_at ?? null,
           owner?.login ?? '', owner?.avatar_url ?? null,
           JSON.stringify(Array.isArray(repo.topics) ? repo.topics : []),
-          repo.ai_summary ?? null,
-          JSON.stringify(Array.isArray(repo.ai_tags) ? repo.ai_tags : []),
-          JSON.stringify(Array.isArray(repo.ai_platforms) ? repo.ai_platforms : []),
-          repo.analyzed_at ?? null, (repo.analysis_failed === true || repo.analysis_failed === 1) ? 1 : 0,
+          aiSummary,
+          aiTagsJson,
+          aiPlatformsJson,
+          analyzedAt, analysisFailed,
           repo.custom_description ?? null,
           JSON.stringify(Array.isArray(repo.custom_tags) ? repo.custom_tags : []),
           repo.custom_category ?? null, (repo.category_locked === true || repo.category_locked === 1) ? 1 : 0, repo.last_edited ?? null,
@@ -263,7 +328,7 @@ router.delete('/api/repositories/:id', (req, res) => {
     const deleteAll = db.transaction(() => {
       const releaseResult = deleteReleases.run(id);
       const repoResult = deleteRepo.run(id);
-      
+
       return {
         releasesDeleted: releaseResult.changes,
         repoDeleted: repoResult.changes
@@ -277,8 +342,8 @@ router.delete('/api/repositories/:id', (req, res) => {
       return;
     }
 
-    res.json({ 
-      deleted: true, 
+    res.json({
+      deleted: true,
       id,
       releasesDeleted: result.releasesDeleted
     });
diff --git a/src/App.tsx b/src/App.tsx
index 4526fa8..11cb348 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -14,7 +14,7 @@ import { useAppStore } from './store/useAppStore';
 import { useAutoUpdateCheck } from './components/UpdateChecker';
 import { UpdateNotificationBanner } from './components/UpdateNotificationBanner';
 import { backend } from './services/backendAdapter';
-import { syncFromBackend, startAutoSync, stopAutoSync } from './services/autoSync';
+import { syncFromBackend, startAutoSync } from './services/autoSync';
 import { backendAnalysis } from './services/backendAnalysisService';
 import type { AppState } from './types';
 
@@ -104,7 +104,7 @@ function App() {
     return () => {
       cancelled = true;
       if (unsubscribe) {
-        stopAutoSync(unsubscribe);
+        unsubscribe();
       }
     };
   }, []);
diff --git a/src/components/CategorySidebar.tsx b/src/components/CategorySidebar.tsx
index 9a972fd..89909e3 100644
--- a/src/components/CategorySidebar.tsx
+++ b/src/components/CategorySidebar.tsx
@@ -10,7 +10,7 @@ import {
 import { Category, Repository } from '../types';
 import { useAppStore, getAllCategories, sortCategoriesByOrder } from '../store/useAppStore';
 import { CategoryEditModal } from './CategoryEditModal';
-import { forceSyncToBackend } from '../services/autoSync';
+import { backend } from '../services/backendAdapter';
 import { getAICategory, getDefaultCategory, computeCustomCategory, matchesCategory } from '../utils/categoryUtils';
 import { useDialog } from '../hooks/useDialog';
 
@@ -211,7 +211,7 @@ export const CategorySidebar: React.FC<CategorySidebarProps> = ({
 
     deleteCustomCategory(category.id);
     try {
-      await forceSyncToBackend();
+      await backend.syncSettings({ customCategories: useAppStore.getState().customCategories });
     } catch {
       toast(t('删除分类失败，请检查后端连接。', 'Failed to delete category. Please check backend connection.'), 'error');
     }
@@ -231,7 +231,7 @@ export const CategorySidebar: React.FC<CategorySidebarProps> = ({
 
     hideDefaultCategory(category.id);
     try {
-      await forceSyncToBackend();
+      await backend.syncSettings({ hiddenDefaultCategoryIds: useAppStore.getState().hiddenDefaultCategoryIds });
     } catch {
       showDefaultCategory(category.id);
       toast(t('隐藏分类失败，请检查后端连接。', 'Failed to hide category. Please check backend connection.'), 'error');
@@ -295,7 +295,11 @@ export const CategorySidebar: React.FC<CategorySidebarProps> = ({
     updateRepository(nextRepo);
 
     try {
-      await forceSyncToBackend();
+      await backend.updateRepository(repository.id, {
+        custom_category: customCategoryValue,
+        category_locked: customCategoryValue !== undefined && customCategoryValue !== '',
+        last_edited: nextRepo.last_edited,
+      });
     } catch {
       handleSyncError(originalRepo);
     }
diff --git a/src/components/ReleaseTimeline.tsx b/src/components/ReleaseTimeline.tsx
index d36d979..eb55c46 100644
--- a/src/components/ReleaseTimeline.tsx
+++ b/src/components/ReleaseTimeline.tsx
@@ -3,7 +3,7 @@ import { Package, Bell, Search, X, RefreshCw, ChevronLeft, ChevronRight, Chevron
 import { Release } from '../types';
 import { useAppStore } from '../store/useAppStore';
 import { GitHubApiService } from '../services/githubApi';
-import { forceSyncToBackend } from '../services/autoSync';
+import { backend } from '../services/backendAdapter';
 import { formatDistanceToNow } from 'date-fns';
 import { AssetFilterManager } from './AssetFilterManager';
 import { PRESET_FILTERS } from '../constants/presetFilters';
@@ -501,7 +501,8 @@ export const ReleaseTimeline: React.FC = () => {
     removeReleasesByRepoId(repo.id);
 
     try {
-      await forceSyncToBackend();
+      await backend.updateRepository(repo.id, { subscribed_to_releases: false });
+      await backend.syncReleases(useAppStore.getState().releases);
     } catch (error) {
       console.error('Failed to unsubscribe release:', error);
       updateRepository({ ...repo, subscribed_to_releases: true });
diff --git a/src/components/RepositoryCard.tsx b/src/components/RepositoryCard.tsx
index 78495c3..490168b 100644
--- a/src/components/RepositoryCard.tsx
+++ b/src/components/RepositoryCard.tsx
@@ -5,7 +5,6 @@ import { Repository, Category } from '../types';
 import { useAppStore } from '../store/useAppStore';
 import { getAICategory, getDefaultCategory } from '../utils/categoryUtils';
 import { analyzeRepository, createFailedAnalysisResult } from '../services/aiAnalysisHelper';
-import { forceSyncToBackend } from '../services/autoSync';
 import { backend } from '../services/backendAdapter';
 import { backendAnalysis } from '../services/backendAnalysisService';
 import { GitHubApiService } from '../services/githubApi';
@@ -579,7 +578,9 @@ const RepositoryCardComponent: React.FC<RepositoryCardProps> = ({
       const [owner, repo] = repository.full_name.split('/');
       await githubApi.unstarRepository(owner, repo);
       deleteRepository(repository.id);
-      await forceSyncToBackend();
+      if (backend.isAvailable) {
+        backend.deleteRepository(repository.id).catch(() => { /* non-critical */ });
+      }
       const successMessage = language === 'zh'
         ? '已成功取消 Star'
         : 'Successfully unstarred';
diff --git a/src/components/RepositoryEditModal.tsx b/src/components/RepositoryEditModal.tsx
index cd6e56e..f8ca908 100644
--- a/src/components/RepositoryEditModal.tsx
+++ b/src/components/RepositoryEditModal.tsx
@@ -3,7 +3,7 @@ import { Save, X, Plus, Lock, Unlock, RotateCcw, Bot, Edit3, FileText, Tag, Fold
 import { Modal } from './Modal';
 import { Repository } from '../types';
 import { useAppStore, getAllCategories } from '../store/useAppStore';
-import { forceSyncToBackend } from '../services/autoSync';
+import { backend } from '../services/backendAdapter';
 import { computeCustomCategory, getAICategory, getDefaultCategory } from '../utils/categoryUtils';
 
 interface RepositoryEditModalProps {
@@ -377,7 +377,13 @@ export const RepositoryEditModal: React.FC<RepositoryEditModalProps> = ({
     updatedRepo.last_edited = new Date().toISOString();
 
     updateRepository(updatedRepo);
-    await forceSyncToBackend();
+    await backend.updateRepository(repository.id, {
+      custom_description: updatedRepo.custom_description,
+      custom_tags: updatedRepo.custom_tags,
+      custom_category: updatedRepo.custom_category,
+      category_locked: updatedRepo.category_locked,
+      last_edited: updatedRepo.last_edited,
+    });
     onClose();
   };
 
diff --git a/src/components/RepositoryList.tsx b/src/components/RepositoryList.tsx
index a56a0a3..7fa2e88 100644
--- a/src/components/RepositoryList.tsx
+++ b/src/components/RepositoryList.tsx
@@ -13,7 +13,6 @@ import { AIAnalysisOptimizer, AnalysisResult } from '../services/aiAnalysisOptim
 import { backend } from '../services/backendAdapter';
 import { backendAnalysis } from '../services/backendAnalysisService';
 import { resolveCategoryAssignment, getAICategory, getDefaultCategory, computeCustomCategory } from '../utils/categoryUtils';
-import { forceSyncToBackend } from '../services/autoSync';
 import { useDialog } from '../hooks/useDialog';
 
 interface RepositoryListProps {
@@ -620,8 +619,6 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
       }
     }
 
-    await forceSyncToBackend();
-
     const skipMsg = failedRepos.length > 0
       ? (language === 'zh'
         ? `\n\n失败 (${failedRepos.length} 个):\n${failedRepos.join('\n')}`
@@ -688,9 +685,8 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
           // 仅删除成功 unstar 的仓库
           for (const repoId of successIds) {
             deleteRepository(repoId);
+            backend.deleteRepository(repoId).catch(() => {});
           }
-
-          await forceSyncToBackend();
           toast(language === 'zh'
             ? `成功取消 ${successIds.length} 个仓库的 Star`
             : `Successfully unstarred ${successIds.length} repositories`,
@@ -840,7 +836,6 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
             const stats = optimizerRef.current!.getStats();
             console.log('Bulk AI Analysis Stats:', stats);
 
-            await forceSyncToBackend();
             toast(language === 'zh'
               ? `成功分析 ${successCount} 个仓库，失败 ${failedCount} 个 (平均响应: ${stats.averageResponseTime}ms)`
               : `Successfully analyzed ${successCount} repositories, ${failedCount} failed (avg: ${stats.averageResponseTime}ms)`,
@@ -877,7 +872,6 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
             }
           }
 
-          await forceSyncToBackend();
           toast(language === 'zh'
             ? `成功订阅 ${successCount} 个仓库的版本发布`
             : `Successfully subscribed to ${successCount} repositories releases`,
@@ -910,8 +904,6 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
             }
           }
 
-          await forceSyncToBackend();
-
           // 汇总结果显示
           const successCount = subscribedRepos.length - failedRepos.length;
           if (failedRepos.length > 0) {
@@ -954,7 +946,6 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
             }
           }
 
-          await forceSyncToBackend();
           const skipMsg = skippedCount > 0
             ? (language === 'zh' ? `\n\n跳过 ${skippedCount} 个没有自定义分类的仓库` : `\n\nSkipped ${skippedCount} repositories without custom category`)
             : '';
@@ -992,7 +983,6 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
             }
           }
 
-          await forceSyncToBackend();
           if (failedRepos.length > 0) {
             toast(language === 'zh'
               ? `成功解锁 ${successCount} 个仓库的分类\n\n失败 (${failedRepos.length} 个):\n${failedRepos.join('\n')}`
@@ -1051,8 +1041,6 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
       }
     }
 
-    await forceSyncToBackend();
-
     // 汇总结果显示
     const successCount = selectedRepos.length - failedRepos.length;
     if (failedRepos.length > 0) {
diff --git a/src/components/SubscriptionRepoCard.tsx b/src/components/SubscriptionRepoCard.tsx
index 0c51f0b..a8dee00 100644
--- a/src/components/SubscriptionRepoCard.tsx
+++ b/src/components/SubscriptionRepoCard.tsx
@@ -3,7 +3,6 @@ import { Star, StarOff, ExternalLink, Bot, GitFork, Monitor, Smartphone, Globe,
 import type { DiscoveryRepo, Repository } from '../types';
 import { useAppStore, getAllCategories } from '../store/useAppStore';
 import { analyzeRepository, createFailedAnalysisResult } from '../services/aiAnalysisHelper';
-import { forceSyncToBackend } from '../services/autoSync';
 import { backend } from '../services/backendAdapter';
 import { backendAnalysis } from '../services/backendAnalysisService';
 import { GitHubApiService } from '../services/githubApi';
@@ -116,10 +115,11 @@ export const SubscriptionRepoCard: React.FC<SubscriptionRepoCardProps> = ({ repo
       const existingRepo = repositories.find(r => r.full_name === repo.full_name);
       if (existingRepo) {
         deleteRepository(existingRepo.id);
+        if (backend.isAvailable) {
+          backend.deleteRepository(existingRepo.id).catch(() => {});
+        }
       }
-      
-      await forceSyncToBackend();
-      
+
       // 操作成功，清除乐观状态
       setOptimisticStarred(null);
     } catch (error) {
@@ -175,8 +175,10 @@ export const SubscriptionRepoCard: React.FC<SubscriptionRepoCardProps> = ({ repo
         onStar(repo);
       }
       
-      await forceSyncToBackend();
-      
+      if (backend.isAvailable) {
+        backend.syncRepositories([repositoryToAdd]).catch(() => {});
+      }
+
       // 操作成功，清除乐观状态
       setOptimisticStarred(null);
 
diff --git a/src/services/autoSync.ts b/src/services/autoSync.ts
index 29521c3..5cb43a3 100644
--- a/src/services/autoSync.ts
+++ b/src/services/autoSync.ts
@@ -1,24 +1,9 @@
 import { backend } from './backendAdapter';
 import { useAppStore } from '../store/useAppStore';
 
-// Prevent sync loops: when we pull data FROM backend and update store,
-// the store subscription would trigger a push TO backend. This flag blocks that.
-let _isSyncingFromBackend = false;
+// Prevent concurrent syncs: when we're pulling data FROM backend, don't start another pull.
 let _isSyncingFromBackendActive = false;
 
-// Track store subscription for cleanup on restart
-let _storeUnsubscribe: (() => void) | null = null;
-
-// Prevent overlapping pushes to backend
-let _isPushingToBackend = false;
-// Queue a push if one is requested while a pull is in-flight
-let _hasPendingPush = false;
-// Track unsynced local edits so backend polling does not overwrite them.
-let _hasPendingLocalChanges = false;
-
-// Debounce timer for push-to-backend
-let _debounceTimer: ReturnType<typeof setTimeout> | null = null;
-
 // Polling timer for pull-from-backend
 let _pollTimer: ReturnType<typeof setInterval> | null = null;
 
@@ -49,13 +34,7 @@ function setRepositorySyncVisualState(isSyncing: boolean): void {
  * Silent: errors logged to console only.
  */
 export async function syncFromBackend(): Promise<void> {
-  if (
-    !backend.isAvailable ||
-    _isSyncingFromBackendActive ||
-    _isPushingToBackend ||
-    _hasPendingLocalChanges ||
-    _debounceTimer
-  ) {
+  if (!backend.isAvailable || _isSyncingFromBackendActive) {
     return;
   }
 
@@ -120,7 +99,6 @@ export async function syncFromBackend(): Promise<void> {
       return;
     }
 
-    _isSyncingFromBackend = true;
     if (changed.repos || changed.releases) {
       setRepositorySyncVisualState(true);
     }
@@ -186,197 +164,38 @@ export async function syncFromBackend(): Promise<void> {
     console.error('Failed to sync from backend:', err);
   } finally {
     setRepositorySyncVisualState(false);
-    _isSyncingFromBackend = false;
     _isSyncingFromBackendActive = false;
-    // Drain pending push that was queued during pull
-    if (_hasPendingPush) {
-      _hasPendingPush = false;
-      void syncToBackend();
-    }
-  }
-}
-
-/**
- * Push current local state to backend.
- * Silent: errors logged to console only.
- */
-export async function syncToBackend(): Promise<void> {
-  if (!backend.isAvailable) return;
-  // If a pull is in-flight, queue this push for after pull completes
-  if (_isSyncingFromBackendActive) {
-    _hasPendingPush = true;
-    return;
-  }
-  if (_isSyncingFromBackend) return;
-  if (_isPushingToBackend) return;
-
-  _isPushingToBackend = true;
-  _hasPendingPush = false;
-  setRepositorySyncVisualState(true);
-  try {
-    const state = useAppStore.getState();
-
-    const results = await Promise.allSettled([
-      backend.syncRepositories(state.repositories),
-      backend.syncReleases(state.releases),
-      backend.syncAIConfigs(state.aiConfigs),
-      backend.syncWebDAVConfigs(state.webdavConfigs),
-      backend.syncSettings({
-        activeAIConfig: state.activeAIConfig,
-        activeWebDAVConfig: state.activeWebDAVConfig,
-        hiddenDefaultCategoryIds: state.hiddenDefaultCategoryIds,
-        categoryOrder: state.categoryOrder,
-        customCategories: state.customCategories,
-        assetFilters: state.assetFilters,
-        collapsedSidebarCategoryCount: state.collapsedSidebarCategoryCount,
-        github_token: state.githubToken,
-      }),
-    ]);
-    const [reposSync, releasesSync, aiSync, webdavSync, settingsSync] = results;
-
-    const failures = results.filter(r => r.status === 'rejected');
-    if (failures.length > 0) {
-      const failedSlices = [
-        reposSync.status === 'rejected' ? 'repositories' : null,
-        releasesSync.status === 'rejected' ? 'releases' : null,
-        aiSync.status === 'rejected' ? 'aiConfigs' : null,
-        webdavSync.status === 'rejected' ? 'webdavConfigs' : null,
-        settingsSync.status === 'rejected' ? 'settings' : null,
-      ].filter(Boolean);
-      console.warn(`⚠️ Synced to backend with ${failures.length} error(s):`, failedSlices);
-      _hasPendingLocalChanges = true;
-    } else {
-      console.log('✅ Synced to backend');
-      _hasPendingLocalChanges = false;
-    }
-
-    // Only update _lastHash for successfully synced slices
-    if (reposSync.status === 'fulfilled') _lastHash.repos = quickHash(state.repositories);
-    if (releasesSync.status === 'fulfilled') _lastHash.releases = quickHash(state.releases);
-    if (aiSync.status === 'fulfilled') _lastHash.ai = quickHash(state.aiConfigs);
-    if (webdavSync.status === 'fulfilled') _lastHash.webdav = quickHash(state.webdavConfigs);
-    if (settingsSync.status === 'fulfilled') {
-      _lastHash.settings = quickHash({
-        activeAIConfig: state.activeAIConfig,
-        activeWebDAVConfig: state.activeWebDAVConfig,
-        hiddenDefaultCategoryIds: state.hiddenDefaultCategoryIds,
-        categoryOrder: state.categoryOrder,
-        customCategories: state.customCategories,
-        assetFilters: state.assetFilters,
-        collapsedSidebarCategoryCount: state.collapsedSidebarCategoryCount,
-        github_token: state.githubToken,
-      });
-    }
-  } catch (err) {
-    console.error('Failed to sync to backend:', err);
-  } finally {
-    setRepositorySyncVisualState(false);
-    _isPushingToBackend = false;
-  }
-}
-
-/**
- * Immediately push current local state to backend.
- * Used for destructive/high-priority operations such as unstar/delete.
- */
-export async function forceSyncToBackend(): Promise<void> {
-  if (_debounceTimer) {
-    clearTimeout(_debounceTimer);
-    _debounceTimer = null;
   }
-  _hasPendingLocalChanges = true;
-  await syncToBackend();
 }
 
 /**
- * Subscribe to Zustand store changes and auto-push to backend with 2s debounce.
+ * Start polling backend for cross-device data sync.
  * Returns an unsubscribe function for cleanup.
  */
 export function startAutoSync(): () => void {
-  // Guard: if already running, stop previous instance first
-  if (_storeUnsubscribe) {
-    _storeUnsubscribe();
-    _storeUnsubscribe = null;
-  }
   if (_pollTimer) {
     clearInterval(_pollTimer);
     _pollTimer = null;
   }
-  if (_debounceTimer) {
-    clearTimeout(_debounceTimer);
-    _debounceTimer = null;
-  }
-  // Reset in-flight state flags to prevent permanent sync blocking
-  _isSyncingFromBackend = false;
-  _isPushingToBackend = false;
   _isSyncingFromBackendActive = false;
-  _hasPendingPush = false;
-  _hasPendingLocalChanges = false;
-  // 1. Subscribe to local changes → push to backend (2s debounce)
-  const unsubscribe = useAppStore.subscribe((state, prevState) => {
-    if (_isSyncingFromBackend) return;
-
-    const changed =
-      state.repositories !== prevState.repositories ||
-      state.releases !== prevState.releases ||
-      state.aiConfigs !== prevState.aiConfigs ||
-      state.webdavConfigs !== prevState.webdavConfigs ||
-      state.activeAIConfig !== prevState.activeAIConfig ||
-      state.activeWebDAVConfig !== prevState.activeWebDAVConfig ||
-      state.hiddenDefaultCategoryIds !== prevState.hiddenDefaultCategoryIds ||
-      state.categoryOrder !== prevState.categoryOrder ||
-      state.customCategories !== prevState.customCategories ||
-      state.assetFilters !== prevState.assetFilters ||
-      state.collapsedSidebarCategoryCount !== prevState.collapsedSidebarCategoryCount ||
-      state.githubToken !== prevState.githubToken;
-
-    if (!changed) return;
-
-    _hasPendingLocalChanges = true;
 
-    // Debounce: wait 2s after last change before pushing
-    if (_debounceTimer) {
-      clearTimeout(_debounceTimer);
-    }
-    _debounceTimer = setTimeout(() => {
-      _debounceTimer = null;
-      void syncToBackend();
-    }, 2000);
-  });
-  _storeUnsubscribe = unsubscribe;
-
-  // 2. Poll backend every 5s → pull fresh data for cross-device sync
+  // Poll backend every 5s for cross-device sync
   _pollTimer = setInterval(() => {
     syncFromBackend();
   }, POLL_INTERVAL);
 
-  console.log('🔄 Auto-sync started (push debounce: 2s, poll: 5s)');
-  return unsubscribe;
+  console.log('🔄 Auto-sync started (poll: 5s)');
+  return stopAutoSync;
 }
 
 /**
- * Stop auto-sync: clear debounce timer and unsubscribe from store.
+ * Stop auto-sync polling.
  */
-export function stopAutoSync(unsubscribe: () => void): void {
-  if (_debounceTimer) {
-    clearTimeout(_debounceTimer);
-    _debounceTimer = null;
-  }
+export function stopAutoSync(): void {
   if (_pollTimer) {
     clearInterval(_pollTimer);
     _pollTimer = null;
   }
-  if (_storeUnsubscribe) {
-    _storeUnsubscribe();
-    _storeUnsubscribe = null;
-  } else {
-    unsubscribe();
-  }
-  // Reset in-flight state flags
-  _isPushingToBackend = false;
   _isSyncingFromBackendActive = false;
-  _isSyncingFromBackend = false;
-  _hasPendingPush = false;
-  _hasPendingLocalChanges = false;
   console.log('🔄 Auto-sync stopped');
 }
diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index 869a761..9fc924c 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -198,17 +198,38 @@ class BackendAdapter {
 
   // === Data Sync ===
 
-  async syncRepositories(repos: Repository[]): Promise<void> {
+  async syncRepositories(repos: Repository[], isFullSync = false): Promise<void> {
     if (!this._backendUrl) return;
 
     const res = await this.fetchWithTimeout(`${this._backendUrl}/repositories`, {
       method: 'PUT',
       headers: this.getAuthHeaders(),
-      body: JSON.stringify({ repositories: repos, isFullSync: true })
+      body: JSON.stringify({ repositories: repos, isFullSync })
     });
     if (!res.ok) await this.throwTranslatedError(res, 'Sync repositories error');
   }
 
+  async updateRepository(id: number, fields: Record<string, unknown>): Promise<void> {
+    if (!this._backendUrl) return;
+
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/repositories/${id}`, {
+      method: 'PATCH',
+      headers: this.getAuthHeaders(),
+      body: JSON.stringify(fields),
+    });
+    if (!res.ok) await this.throwTranslatedError(res, 'Update repository error');
+  }
+
+  async deleteRepository(id: number): Promise<void> {
+    if (!this._backendUrl) return;
+
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/repositories/${id}`, {
+      method: 'DELETE',
+      headers: this.getAuthHeaders(),
+    });
+    if (!res.ok) await this.throwTranslatedError(res, 'Delete repository error');
+  }
+
   async fetchRepositories(): Promise<{ repositories: Repository[]; total: number }> {
     if (!this._backendUrl) throw new Error('Backend not available');
 
@@ -283,7 +304,7 @@ class BackendAdapter {
   }
 
 
-  // === Settings (active selections) ===
+  // === Settings ===
 
   async syncSettings(settings: Record<string, unknown>): Promise<void> {
     if (!this._backendUrl) return;

From 383ae4614780dbf2f84b16f29dcc9a93e156d473 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 17:31:02 +0800
Subject: [PATCH 25/47] =?UTF-8?q?@=20fix:=20CodeRabbit=20=E5=AE=A1?=
 =?UTF-8?q?=E6=9F=A5=20=E2=80=94=20=E6=B7=BB=E5=8A=A0=E6=93=8D=E4=BD=9C?=
 =?UTF-8?q?=E5=A4=B1=E8=B4=A5=E6=97=B6=E7=9A=84=E5=9B=9E=E6=BB=9A=E5=92=8C?=
 =?UTF-8?q?=E8=A1=A5=E5=81=BF=E9=80=BB=E8=BE=91?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- CategorySidebar: deleteCustomCategory 失败时回滚本地 state
- RepositoryEditModal: backend.updateRepository 失败时回滚 + toast 提示
- ReleaseTimeline: 取消订阅两步写入失败时补偿恢复后端 subscribed_to_releases
---
 src/components/CategorySidebar.tsx     |  2 ++
 src/components/ReleaseTimeline.tsx     |  3 +++
 src/components/RepositoryEditModal.tsx | 25 +++++++++++++++++--------
 3 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/src/components/CategorySidebar.tsx b/src/components/CategorySidebar.tsx
index 89909e3..9beef7b 100644
--- a/src/components/CategorySidebar.tsx
+++ b/src/components/CategorySidebar.tsx
@@ -209,10 +209,12 @@ export const CategorySidebar: React.FC<CategorySidebarProps> = ({
 
     if (!confirmed) return;
 
+    const prevCategories = useAppStore.getState().customCategories;
     deleteCustomCategory(category.id);
     try {
       await backend.syncSettings({ customCategories: useAppStore.getState().customCategories });
     } catch {
+      useAppStore.setState({ customCategories: prevCategories });
       toast(t('删除分类失败，请检查后端连接。', 'Failed to delete category. Please check backend connection.'), 'error');
     }
   };
diff --git a/src/components/ReleaseTimeline.tsx b/src/components/ReleaseTimeline.tsx
index eb55c46..246d974 100644
--- a/src/components/ReleaseTimeline.tsx
+++ b/src/components/ReleaseTimeline.tsx
@@ -505,6 +505,9 @@ export const ReleaseTimeline: React.FC = () => {
       await backend.syncReleases(useAppStore.getState().releases);
     } catch (error) {
       console.error('Failed to unsubscribe release:', error);
+      // Revert backend: if the first call succeeded before the second failed,
+      // restore subscribed_to_releases to keep backend consistent with local rollback.
+      backend.updateRepository(repo.id, { subscribed_to_releases: true }).catch(() => {});
       updateRepository({ ...repo, subscribed_to_releases: true });
       const state = useAppStore.getState();
       useAppStore.setState({
diff --git a/src/components/RepositoryEditModal.tsx b/src/components/RepositoryEditModal.tsx
index f8ca908..0868cde 100644
--- a/src/components/RepositoryEditModal.tsx
+++ b/src/components/RepositoryEditModal.tsx
@@ -5,6 +5,7 @@ import { Repository } from '../types';
 import { useAppStore, getAllCategories } from '../store/useAppStore';
 import { backend } from '../services/backendAdapter';
 import { computeCustomCategory, getAICategory, getDefaultCategory } from '../utils/categoryUtils';
+import { useDialog } from '../hooks/useDialog';
 
 interface RepositoryEditModalProps {
   isOpen: boolean;
@@ -55,6 +56,7 @@ export const RepositoryEditModal: React.FC<RepositoryEditModalProps> = ({
   repository
 }) => {
   const { updateRepository, language, customCategories, hiddenDefaultCategoryIds, defaultCategoryOverrides, theme } = useAppStore();
+  const { toast } = useDialog();
 
   const [formData, setFormData] = useState({
     description: '',
@@ -376,15 +378,22 @@ export const RepositoryEditModal: React.FC<RepositoryEditModalProps> = ({
     // 更新编辑时间
     updatedRepo.last_edited = new Date().toISOString();
 
+    const originalRepo = { ...repository };
     updateRepository(updatedRepo);
-    await backend.updateRepository(repository.id, {
-      custom_description: updatedRepo.custom_description,
-      custom_tags: updatedRepo.custom_tags,
-      custom_category: updatedRepo.custom_category,
-      category_locked: updatedRepo.category_locked,
-      last_edited: updatedRepo.last_edited,
-    });
-    onClose();
+    try {
+      await backend.updateRepository(repository.id, {
+        custom_description: updatedRepo.custom_description,
+        custom_tags: updatedRepo.custom_tags,
+        custom_category: updatedRepo.custom_category,
+        category_locked: updatedRepo.category_locked,
+        last_edited: updatedRepo.last_edited,
+      });
+      onClose();
+    } catch (err) {
+      updateRepository(originalRepo);
+      console.error('Failed to save repository:', err);
+      toast(t('保存失败，请检查后端连接。', 'Failed to save. Please check backend connection.'), 'error');
+    }
   };
 
   const handleClose = () => {

From ff6df11370990b80c65191da2e66e9a1f1139656 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 17:35:27 +0800
Subject: [PATCH 26/47] @ bump version to 0.6.1

---
 package.json              |  2 +-
 server/package.json       |  2 +-
 versions/version-info.xml | 11 +++++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 64a9ae5..1153563 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "github-stars-manager",
   "private": true,
-  "version": "0.6.0",
+  "version": "0.6.1",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/server/package.json b/server/package.json
index c29ac9e..fd71d3f 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "github-stars-manager-server",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/versions/version-info.xml b/versions/version-info.xml
index 57c0bbc..8680140 100644
--- a/versions/version-info.xml
+++ b/versions/version-info.xml
@@ -329,4 +329,15 @@
     </changelog>
     <downloadUrl>https://github.com/AmintaCCCP/GithubStarsManager/releases/download/v0.6.0/github-stars-manager-0.6.0.dmg</downloadUrl>
   </version>
+  <version>
+    <number>0.6.1</number>
+    <releaseDate>2026-05-11</releaseDate>
+    <changelog>
+      <item>架构重构: 以后端为单一数据源，移除双向自动同步，用户操作改为精确 API 调用</item>
+      <item>修复: 后端 upsert 时按字段保留已有 AI 数据，防止 INSERT OR REPLACE 覆盖分析结果</item>
+      <item>修复: CategorySidebar/RepositoryEditModal/ReleaseTimeline 操作失败时的回滚和补偿逻辑</item>
+      <item>修复: SubscriptionRepoCard 中 existingRepo 可能为 undefined 的崩溃隐患</item>
+    </changelog>
+    <downloadUrl>https://github.com/AmintaCCCP/GithubStarsManager/releases/download/v0.6.1/github-stars-manager-0.6.1.dmg</downloadUrl>
+  </version>
 </versions>

From 6320ec21e2c628291e7048effd236de509acf257 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Mon, 11 May 2026 17:58:59 +0800
Subject: [PATCH 27/47] =?UTF-8?q?@=20fix:=20AI=E5=88=86=E6=9E=90=E5=88=B7?=
 =?UTF-8?q?=E6=96=B0=E9=A1=B5=E9=9D=A2=E5=90=8E=E8=BF=9B=E5=BA=A6=E6=9D=A1?=
 =?UTF-8?q?=E6=B6=88=E5=A4=B1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

resumeBatchAnalysis 恢复状态时缺少 setLoading(true)，
导致进度条 UI 条件 isLoading && analysisProgress.total > 0 为 false。
同时将 resumeBatchAnalysis 提前到 syncFromBackend 之前调用，
避免同步期间批次完成而错过恢复窗口。
@
---
 src/App.tsx                            | 9 +++++----
 src/services/backendAnalysisService.ts | 3 +++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/App.tsx b/src/App.tsx
index 11cb348..aaab2ca 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -85,13 +85,14 @@ function App() {
       try {
         await backend.init();
         if (backend.isAvailable && !cancelled) {
-          await syncFromBackend();
+          // Resume any in-progress analysis before syncing data,
+          // so the batch doesn't have time to complete during the sync window.
           if (!cancelled) {
-            unsubscribe = startAutoSync();
+            void backendAnalysis.resumeBatchAnalysis();
           }
-          // Reconnect to any analysis batch that was running before page refresh
+          await syncFromBackend();
           if (!cancelled) {
-            void backendAnalysis.resumeBatchAnalysis();
+            unsubscribe = startAutoSync();
           }
         }
       } catch (err) {
diff --git a/src/services/backendAnalysisService.ts b/src/services/backendAnalysisService.ts
index beea3e6..8cac497 100644
--- a/src/services/backendAnalysisService.ts
+++ b/src/services/backendAnalysisService.ts
@@ -217,6 +217,7 @@ class BackendAnalysisService {
       for (const id of saved.repositoryIds) {
         store.setAnalyzingRepository(id, true);
       }
+      store.setLoading(true);
       store.setAnalysisProgress({ current: active.completed + active.failed, total: active.total });
 
       this._isRunning = true;
@@ -261,6 +262,8 @@ class BackendAnalysisService {
               }
             }
 
+            store.setLoading(false);
+            store.setAnalysisProgress({ current: 0, total: 0 });
             onComplete?.();
             return;
           }

From a2f11c5999b9fd39885b6f97718a99517a284de2 Mon Sep 17 00:00:00 2001
From: lostiv <30612717+lostiv@users.noreply.github.com>
Date: Mon, 11 May 2026 23:35:36 +0800
Subject: [PATCH 28/47] =?UTF-8?q?@=20@=20fix:=20=E4=BF=AE=E5=A4=8D=20AI=20?=
 =?UTF-8?q?=E5=88=86=E6=9E=90=E5=81=9C=E6=AD=A2=E6=8C=89=E9=92=AE=E6=97=A0?=
 =?UTF-8?q?=E6=95=88=E3=80=81=E5=88=86=E7=B1=BB=E6=97=A0=E6=B3=95=E5=8C=B9?=
 =?UTF-8?q?=E9=85=8D=E3=80=81=E8=BD=AE=E8=AF=A2=E6=97=A0=E8=B6=85=E6=97=B6?=
 =?UTF-8?q?=E4=BF=9D=E6=8A=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 停止按钮：页面刷新后 isAnalyzingRef 为 false 导致 handleStop 直接返回，
  改用 backendAnalysis.isRunning 作为额外判断条件
- cancelBatchAnalysis：立即清理本地状态而非等待轮询检测
- 轮询保护：增加 404 检测、连续失败 5 次、超时 10 分钟三层退出机制
  防止后端重启后前端永久转圈
- 分类匹配：custom_category 为 null 时 != null 判断为 false，
  正确穿透到 AI 标签匹配逻辑
@
---
 src/components/BulkRestoreModal.tsx    |  2 +-
 src/components/RepositoryList.tsx      |  8 ++-
 src/services/backendAnalysisService.ts | 89 ++++++++++++++++++++++----
 src/utils/categoryUtils.ts             |  2 +-
 4 files changed, 86 insertions(+), 15 deletions(-)

diff --git a/src/components/BulkRestoreModal.tsx b/src/components/BulkRestoreModal.tsx
index 691974c..e729589 100644
--- a/src/components/BulkRestoreModal.tsx
+++ b/src/components/BulkRestoreModal.tsx
@@ -70,7 +70,7 @@ export const BulkRestoreModal: React.FC<BulkRestoreModalProps> = ({
     for (const repo of repositories) {
       if (repo.custom_description !== undefined && repo.custom_description !== null) hasCustomDesc++;
       if (repo.custom_tags !== undefined) hasCustomTags++;
-      if (repo.custom_category !== undefined && repo.custom_category !== '') hasCustomCategory++;
+      if (repo.custom_category != null && repo.custom_category !== '') hasCustomCategory++;
       if (repo.ai_summary && repo.ai_summary.trim() !== '') hasAiSummary++;
       if (repo.ai_tags && repo.ai_tags.length > 0) hasAiTags++;
       if (getAICategory(repo, allCategories) !== '') hasAiCategory++;
diff --git a/src/components/RepositoryList.tsx b/src/components/RepositoryList.tsx
index 7fa2e88..fb96493 100644
--- a/src/components/RepositoryList.tsx
+++ b/src/components/RepositoryList.tsx
@@ -78,7 +78,7 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
     if (!selectedCategoryObj) return [];
 
     return repositories.filter(repo => {
-      if (repo.custom_category !== undefined) {
+      if (repo.custom_category != null) {
         if (repo.custom_category === '') {
           return false;
         }
@@ -490,7 +490,8 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
   };
 
   const handleStop = async () => {
-    if (!isAnalyzingRef.current) return;
+    // 页面刷新后 isAnalyzingRef 重置为 false, 但后端批次可能正在运行
+    if (!isAnalyzingRef.current && !backendAnalysis.isRunning) return;
 
     const confirmMessage = language === 'zh'
       ? '确定要停止 AI 分析吗？已分析的结果将会保存。'
@@ -506,6 +507,9 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
         shouldStopRef.current = true;
         backendAnalysis.cancelBatchAnalysis();
         setIsPaused(false);
+        // 立即清理 UI 状态，不等轮询检测到 cancelled
+        setLoading(false);
+        setAnalysisProgress({ current: 0, total: 0 });
         return;
       }
 
diff --git a/src/services/backendAnalysisService.ts b/src/services/backendAnalysisService.ts
index 8cac497..03a5b99 100644
--- a/src/services/backendAnalysisService.ts
+++ b/src/services/backendAnalysisService.ts
@@ -75,6 +75,10 @@ class BackendAnalysisService {
 
       return new Promise<void>((resolve) => {
         let lastReportedCount = 0;
+        let consecutiveFailures = 0;
+        const MAX_CONSECUTIVE_FAILURES = 5;
+        const MAX_POLL_TIME_MS = 10 * 60 * 1000; // 10分钟后强制退出
+        const startTime = Date.now();
 
         const poll = async (): Promise<void> => {
           // Guard: if a newer batch has replaced this one, silently exit
@@ -86,6 +90,8 @@ class BackendAnalysisService {
             // Re-check after await — another batch may have been started
             if (this.currentBatchId !== batchId) return;
 
+            consecutiveFailures = 0; // 成功后重置
+
             store.setAnalysisProgress({ current: progress.completed + progress.failed, total: progress.total });
             onProgress?.(progress.completed + progress.failed, progress.total);
 
@@ -128,8 +134,27 @@ class BackendAnalysisService {
               resolve();
               return;
             }
-          } catch {
-            // Poll errors are non-fatal — keep polling
+          } catch (err) {
+            consecutiveFailures++;
+
+            // 批次已被后端清理（如重启后丢失），视为已完成
+            const errMsg = err instanceof Error ? err.message : String(err);
+            if (errMsg.includes('404') || errMsg.includes('BATCH_NOT_FOUND') || errMsg.includes('Batch not found')) {
+              this.finishBatch(batchId, repositoryIds);
+              removeBatch(batchId);
+              store.setAnalysisProgress({ current: 0, total: 0 });
+              resolve(); // 调用方的 finally 块会处理 UI 清理
+              return;
+            }
+
+            // 连续失败或超时，强制退出防止永久转圈
+            if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES || Date.now() - startTime > MAX_POLL_TIME_MS) {
+              this.finishBatch(batchId, repositoryIds);
+              removeBatch(batchId);
+              store.setAnalysisProgress({ current: 0, total: 0 });
+              resolve(); // 调用方的 finally 块会处理 UI 清理
+              return;
+            }
           }
 
           // Schedule next poll only if still the current batch
@@ -149,14 +174,28 @@ class BackendAnalysisService {
   }
 
   async cancelBatchAnalysis(): Promise<void> {
-    if (this.currentBatchId) {
-      try {
-        await backend.cancelAnalysis(this.currentBatchId);
-      } catch {
-        // Non-fatal
-      }
-      // Don't call finishBatch — the poll will detect 'cancelled' and clean up
+    const batchId = this.currentBatchId;
+    if (!batchId) return;
+
+    // 从 localStorage 中获取该批次的仓库 ID 以清理 analyzing 状态
+    const savedBatches = loadSavedBatches();
+    const saved = savedBatches.find((b) => b.batchId === batchId);
+    const repositoryIds = saved?.repositoryIds ?? [];
+
+    // 先向服务端发送取消请求
+    try {
+      await backend.cancelAnalysis(batchId);
+    } catch {
+      // Non-fatal — 即使服务端请求失败也要清理本地状态
     }
+
+    // 立即清理本地状态
+    this.finishBatch(batchId, repositoryIds);
+    removeBatch(batchId);
+
+    const store = useAppStore.getState();
+    store.setLoading(false);
+    store.setAnalysisProgress({ current: 0, total: 0 });
   }
 
   get isRunning(): boolean {
@@ -223,6 +262,11 @@ class BackendAnalysisService {
       this._isRunning = true;
       this.currentBatchId = active.batchId;
 
+      let consecutiveFailures = 0;
+      const MAX_CONSECUTIVE_FAILURES = 5;
+      const MAX_POLL_TIME_MS = 10 * 60 * 1000; // 10分钟后强制退出
+      const startTime = Date.now();
+
       const poll = async (): Promise<void> => {
         if (this.currentBatchId !== active.batchId) return;
 
@@ -230,6 +274,8 @@ class BackendAnalysisService {
           const progress = await backend.getAnalysisProgress(active.batchId);
           if (this.currentBatchId !== active.batchId) return;
 
+          consecutiveFailures = 0; // 成功后重置
+
           store.setAnalysisProgress({ current: progress.completed + progress.failed, total: progress.total });
           onProgress?.(progress.completed + progress.failed, progress.total);
 
@@ -267,8 +313,29 @@ class BackendAnalysisService {
             onComplete?.();
             return;
           }
-        } catch {
-          // Poll errors are non-fatal
+        } catch (err) {
+          consecutiveFailures++;
+
+          // 批次已被后端清理（如重启后丢失），视为已完成
+          const errMsg = err instanceof Error ? err.message : String(err);
+          if (errMsg.includes('404') || errMsg.includes('BATCH_NOT_FOUND') || errMsg.includes('Batch not found')) {
+            this.finishBatch(active.batchId, saved.repositoryIds);
+            removeBatch(active.batchId);
+            store.setLoading(false);
+            store.setAnalysisProgress({ current: 0, total: 0 });
+            onComplete?.();
+            return;
+          }
+
+          // 连续失败或超时，强制退出防止永久转圈
+          if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES || Date.now() - startTime > MAX_POLL_TIME_MS) {
+            this.finishBatch(active.batchId, saved.repositoryIds);
+            removeBatch(active.batchId);
+            store.setLoading(false);
+            store.setAnalysisProgress({ current: 0, total: 0 });
+            onComplete?.();
+            return;
+          }
         }
 
         if (this.currentBatchId === active.batchId) {
diff --git a/src/utils/categoryUtils.ts b/src/utils/categoryUtils.ts
index d36a909..9d35ca8 100644
--- a/src/utils/categoryUtils.ts
+++ b/src/utils/categoryUtils.ts
@@ -83,7 +83,7 @@ export const computeCustomCategory = (
 export const matchesCategory = (repo: Repository, category: Category): boolean => {
   if (category.id === 'all') return true;
 
-  if (repo.custom_category !== undefined) {
+  if (repo.custom_category != null) {
     if (repo.custom_category === '') {
       return false;
     }

From f63581d2f803185f95ed152ff39df4dc026b90d1 Mon Sep 17 00:00:00 2001
From: lostiv <30612717+lostiv@users.noreply.github.com>
Date: Tue, 12 May 2026 01:07:43 +0800
Subject: [PATCH 29/47] =?UTF-8?q?@=20refactor:=20Star/Unstar=E3=80=81Fork?=
 =?UTF-8?q?=E3=80=81=E7=BF=BB=E8=AF=91=E6=93=8D=E4=BD=9C=E7=BB=9F=E4=B8=80?=
 =?UTF-8?q?=E8=BF=81=E7=A7=BB=E5=88=B0=E5=90=8E=E7=AB=AF=E4=BB=A3=E7=90=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"后端为唯一数据源"架构整改：
- Star/Unstar: 4处调用点改用 backend 代理
- Fork: 6种操作 (getUserForks/checkForkSyncNeeded/getBranches/
  getRepositoryWorkflows/syncFork/triggerWorkflowRun) 迁移到后端
- 翻译: MS auth token 管理移到后端，前端仅保留 chunking/retry
- 同步按钮: 优先使用 backend.fetchStarredRepos 代理
- 后端通配符代理支持 body 转发
@
---
 package-lock.json                       |   4 +-
 server/src/routes/proxy.ts              |  98 ++++++++-
 src/components/ForkTimeline.tsx         |  42 ++--
 src/components/Header.tsx               |  70 +++++-
 src/components/RepositoryCard.tsx       |  13 +-
 src/components/RepositoryList.tsx       |   7 +-
 src/components/SubscriptionRepoCard.tsx |  32 ++-
 src/services/backendAdapter.ts          | 206 +++++++++++++++++-
 src/services/translateService.ts        | 278 +++---------------------
 src/types/index.ts                      |   5 +
 10 files changed, 439 insertions(+), 316 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 357c212..afda07a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "github-stars-manager",
-  "version": "0.5.7",
+  "version": "0.6.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "github-stars-manager",
-      "version": "0.5.7",
+      "version": "0.6.1",
       "dependencies": {
         "@types/query-string": "^6.2.0",
         "date-fns": "^3.3.1",
diff --git a/server/src/routes/proxy.ts b/server/src/routes/proxy.ts
index cb62bcf..5e71a29 100644
--- a/server/src/routes/proxy.ts
+++ b/server/src/routes/proxy.ts
@@ -67,17 +67,17 @@ router.post('/api/proxy/github/*', async (req, res) => {
     const queryString = new URL(req.url, 'http://localhost').search;
     const targetUrl = `https://api.github.com/${githubPath}${queryString}`;
 
-    const body = req.body as { method?: string; headers?: Record<string, string> };
-    const method = body.method || 'GET';
-    
+    const proxyBody = req.body as { method?: string; headers?: Record<string, string>; body?: unknown };
+    const method = proxyBody.method || 'GET';
+
     const headers: Record<string, string> = {
       'Authorization': `Bearer ${token}`,
-      'Accept': body.headers?.Accept || 'application/vnd.github.v3+json',
+      'Accept': proxyBody.headers?.Accept || 'application/vnd.github.v3+json',
       'X-GitHub-Api-Version': '2022-11-28',
       'User-Agent': 'GithubStarsManager-Backend',
     };
 
-    const result = await proxyRequest({ url: targetUrl, method, headers });
+    const result = await proxyRequest({ url: targetUrl, method, headers, body: proxyBody.body as string | object | undefined });
     res.status(result.status).json(result.data);
   } catch (err) {
     console.error('GitHub proxy error:', err);
@@ -297,4 +297,92 @@ router.post('/api/proxy/github/search/users', async (req, res) => {
   }
 });
 
+// === Microsoft Translator Proxy ===
+
+// MS auth token 在进程内存中缓存
+let msTranslateToken: string | null = null;
+let msTranslateTokenExpiresAt = 0;
+const MS_AUTH_URL = 'https://edge.microsoft.com/translate/auth';
+const MS_TRANSLATE_URL = 'https://api-edge.cognitive.microsofttranslator.com/translate';
+
+async function getMsTranslateToken(): Promise<string> {
+  const now = Date.now();
+  const TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+
+  if (msTranslateToken && now < msTranslateTokenExpiresAt - TOKEN_REFRESH_BUFFER_MS) {
+    return msTranslateToken;
+  }
+
+  const res = await fetch(MS_AUTH_URL, { method: 'GET' });
+  if (!res.ok) throw new Error(`MS auth failed: ${res.status}`);
+  const token = await res.text();
+
+  // 解析 JWT 获取过期时间
+  try {
+    const parts = token.split('.');
+    if (parts.length === 3) {
+      const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString('utf8'));
+      if (payload.exp) {
+        msTranslateTokenExpiresAt = payload.exp * 1000;
+      }
+    }
+  } catch { /* 解析失败则用默认 8 分钟 */ }
+
+  if (msTranslateTokenExpiresAt <= now) {
+    msTranslateTokenExpiresAt = now + 8 * 60 * 1000;
+  }
+
+  msTranslateToken = token;
+  return token;
+}
+
+router.post('/api/proxy/translate', async (req, res) => {
+  try {
+    const { texts, to, from, textType } = req.body as {
+      texts: string[];
+      to: string;
+      from?: string;
+      textType?: string;
+    };
+
+    if (!texts || !Array.isArray(texts) || texts.length === 0 || !to) {
+      res.status(400).json({ error: 'texts and to are required', code: 'TRANSLATE_PARAMS_REQUIRED' });
+      return;
+    }
+
+    const token = await getMsTranslateToken();
+
+    const params = new URLSearchParams({ 'api-version': '3.0', to });
+    if (from) params.set('from', from);
+    if (textType === 'html') params.set('textType', 'html');
+
+    const targetUrl = `${MS_TRANSLATE_URL}?${params.toString()}`;
+
+    const headers: Record<string, string> = {
+      'Authorization': `Bearer ${token}`,
+      'Content-Type': 'application/json',
+    };
+
+    const body = texts.map(t => ({ Text: t }));
+
+    const result = await proxyRequest({ url: targetUrl, method: 'POST', headers, body });
+
+    if (result.status === 401) {
+      // Token 过期，清除缓存后重试一次
+      msTranslateToken = null;
+      msTranslateTokenExpiresAt = 0;
+      const newToken = await getMsTranslateToken();
+      headers['Authorization'] = `Bearer ${newToken}`;
+      const retryResult = await proxyRequest({ url: targetUrl, method: 'POST', headers, body });
+      res.status(retryResult.status).json(retryResult.data);
+      return;
+    }
+
+    res.status(result.status).json(result.data);
+  } catch (err) {
+    console.error('Translation proxy error:', err);
+    res.status(500).json({ error: 'Translation proxy failed', code: 'TRANSLATION_PROXY_FAILED' });
+  }
+});
+
 export default router;
diff --git a/src/components/ForkTimeline.tsx b/src/components/ForkTimeline.tsx
index 622f654..e541f4f 100644
--- a/src/components/ForkTimeline.tsx
+++ b/src/components/ForkTimeline.tsx
@@ -2,7 +2,7 @@ import React, { useState, useMemo, useCallback, useEffect } from 'react';
 import { Package, Search, X, RefreshCw, ChevronLeft, ChevronRight, ChevronsLeft, ChevronsRight, Loader2, GitFork } from 'lucide-react';
 import { ForkRepo, WorkflowDefinition } from '../types';
 import { useAppStore } from '../store/useAppStore';
-import { GitHubApiService } from '../services/githubApi';
+import { backend } from '../services/backendAdapter';
 import { formatDistanceToNow } from 'date-fns';
 import ForkCard from './ForkCard';
 import { useDialog } from '../hooks/useDialog';
@@ -12,7 +12,6 @@ export const ForkTimeline: React.FC = () => {
   const {
     forks,
     readForks,
-    githubToken,
     language,
     setForks,
     addForks,
@@ -153,15 +152,14 @@ export const ForkTimeline: React.FC = () => {
   };
 
   const handleRefresh = async () => {
-    if (!githubToken) {
-      toast(language === 'zh' ? 'GitHub token 未找到，请重新登录。' : 'GitHub token not found. Please login again.', 'error');
+    if (!backend.isAvailable) {
+      toast(language === 'zh' ? '后端服务未连接，请检查后端状态。' : 'Backend service not connected. Please check the backend status.', 'error');
       return;
     }
 
     setForkIsRefreshing(true);
     try {
-      const githubApi = new GitHubApiService(githubToken);
-      const newForks = await githubApi.getUserForks();
+      const newForks = await backend.getUserForks();
 
       // Merge with existing forks, preserving read status
       const existingForkMap = new Map(forks.map(f => [f.id, f]));
@@ -223,7 +221,7 @@ export const ForkTimeline: React.FC = () => {
         const [owner, repo] = fork.full_name.split('/');
         const branch = fork.default_branch || 'main';
         try {
-          const result = await githubApi.checkForkSyncNeeded(
+          const result = await backend.checkForkSyncNeeded(
             owner, 
             repo, 
             branch, 
@@ -294,13 +292,12 @@ export const ForkTimeline: React.FC = () => {
 
   const loadWorkflows = async (forkId: number) => {
     const fork = forks.find(f => f.id === forkId);
-    if (!fork || !githubToken) return;
+    if (!fork || !backend.isAvailable) return;
 
     setLoadingWorkflows(prev => new Set(prev).add(forkId));
     try {
       const [owner, repo] = fork.full_name.split('/');
-      const githubApi = new GitHubApiService(githubToken);
-      const workflows = await githubApi.getRepositoryWorkflows(owner, repo);
+      const workflows = await backend.getRepositoryWorkflows(owner, repo);
       setWorkflowsMap(prev => ({ ...prev, [forkId]: workflows }));
     } catch (error) {
       console.error('Failed to load workflows:', error);
@@ -314,14 +311,14 @@ export const ForkTimeline: React.FC = () => {
   };
 
   const handleSyncUpstream = async (fork: ForkRepo) => {
-    if (!githubToken) {
-      toast(language === 'zh' ? 'GitHub token 未找到，请重新登录。' : 'GitHub token not found. Please login again.', 'error');
+    if (!backend.isAvailable) {
+      toast(language === 'zh' ? '后端服务未连接，请检查后端状态。' : 'Backend service not connected. Please check the backend status.', 'error');
       return;
     }
 
     const defaultBranch = fork.default_branch || 'main';
     const [owner, repo] = fork.full_name.split('/');
-    
+
     setSyncModal({
       isOpen: true,
       forkId: fork.id,
@@ -332,10 +329,9 @@ export const ForkTimeline: React.FC = () => {
     });
     setSyncModalBranches([]);
     setIsFetchingBranches(true);
-    
+
     try {
-      const githubApi = new GitHubApiService(githubToken);
-      const branches = await githubApi.getBranches(owner, repo);
+      const branches = await backend.getBranches(owner, repo);
       setSyncModalBranches(branches);
       if (branches.length > 0 && !branches.includes(defaultBranch)) {
         setSyncModal(prev => ({ ...prev, branch: branches[0] }));
@@ -346,7 +342,7 @@ export const ForkTimeline: React.FC = () => {
   };
 
   const confirmSyncUpstream = async () => {
-    if (!githubToken || !syncModal.forkId) return;
+    if (!backend.isAvailable || !syncModal.forkId) return;
 
     const fork = forks.find(f => f.id === syncModal.forkId);
     if (!fork) return;
@@ -355,10 +351,9 @@ export const ForkTimeline: React.FC = () => {
 
     setSyncModal(prev => ({ ...prev, isOpen: false }));
     setSyncingForks(prev => new Set(prev).add(fork.id));
-    
+
     try {
-      const githubApi = new GitHubApiService(githubToken);
-      const result = await githubApi.syncFork(owner, repo, branch);
+      const result = await backend.syncFork(owner, repo, branch);
 
       // Mark fork as up-to-date in UI
       setNeedsSyncMap(prev => ({ ...prev, [fork.id]: false }));
@@ -408,8 +403,8 @@ export const ForkTimeline: React.FC = () => {
   };
 
   const handleRunWorkflow = async (forkId: number, workflowPath: string, workflowName: string) => {
-    if (!githubToken) {
-      toast(language === 'zh' ? 'GitHub token 未找到，请重新登录。' : 'GitHub token not found. Please login again.', 'error');
+    if (!backend.isAvailable) {
+      toast(language === 'zh' ? '后端服务未连接，请检查后端状态。' : 'Backend service not connected. Please check the backend status.', 'error');
       return;
     }
 
@@ -420,8 +415,7 @@ export const ForkTimeline: React.FC = () => {
     setRunningWorkflows(prev => new Set(prev).add(forkId));
     try {
       const [owner, repo] = fork.full_name.split('/');
-      const githubApi = new GitHubApiService(githubToken);
-      await githubApi.triggerWorkflowRun(owner, repo, workflowPath, branch);
+      await backend.triggerWorkflowRun(owner, repo, workflowPath, branch);
 
       toast(language === 'zh'
         ? `已触发工作流 "${workflowName}" 在 ${branch} 分支。`
diff --git a/src/components/Header.tsx b/src/components/Header.tsx
index 852b40b..5dcb48e 100644
--- a/src/components/Header.tsx
+++ b/src/components/Header.tsx
@@ -1,7 +1,9 @@
 import React, { useState, useRef, useEffect } from 'react';
 import { Settings, Calendar, Search, Moon, Sun, LogOut, RefreshCw, TrendingUp, GitFork } from 'lucide-react';
 import { useAppStore } from '../store/useAppStore';
+import { Repository } from '../types';
 import { GitHubApiService } from '../services/githubApi';
+import { backend } from '../services/backendAdapter';
 import { useDialog } from '../hooks/useDialog';
 
 export const Header: React.FC = () => {
@@ -65,6 +67,67 @@ export const Header: React.FC = () => {
   }, []);
 
   const handleSync = async () => {
+    // 优先通过后端代理同步，确保后端为唯一数据源
+    if (backend.isAvailable) {
+      setLoading(true);
+      try {
+        // 分页拉取所有星标仓库（通过后端代理，Token 存储在后端）
+        const allStarred: Repository[] = [];
+        let page = 1;
+        const perPage = 100;
+        while (true) {
+          const repos = await backend.fetchStarredRepos(page, perPage);
+          allStarred.push(...repos);
+          if (repos.length < perPage) break;
+          page++;
+        }
+
+        // 合并已有数据，保留 AI 分析结果和自定义字段
+        const existingRepoMap = new Map(repositories.map(repo => [repo.id, repo]));
+        const merged = allStarred.map(newRepo => {
+          const existing = existingRepoMap.get(newRepo.id);
+          if (existing) {
+            return {
+              ...newRepo,
+              has_fetched_releases: existing.has_fetched_releases,
+              last_release_fetch_time: existing.last_release_fetch_time,
+              ai_summary: existing.ai_summary,
+              ai_tags: existing.ai_tags,
+              ai_platforms: existing.ai_platforms,
+              analyzed_at: existing.analyzed_at,
+              analysis_failed: existing.analysis_failed,
+              custom_description: existing.custom_description,
+              custom_tags: existing.custom_tags,
+              custom_category: existing.custom_category,
+              category_locked: existing.category_locked,
+              last_edited: existing.last_edited,
+            };
+          }
+          return newRepo;
+        });
+
+        // 全量同步到后端数据库
+        await backend.syncRepositories(merged, true);
+
+        setRepositories(merged);
+        setLastSync(new Date().toISOString());
+
+        const newRepoCount = allStarred.length - repositories.length;
+        if (newRepoCount > 0) {
+          toast(t(`同步完成！发现 ${newRepoCount} 个新仓库。`, `Sync completed! Found ${newRepoCount} new repositories.`), 'success');
+        } else {
+          toast(t('同步完成！所有仓库都是最新的。', 'Sync completed! All repositories are up to date.'), 'info');
+        }
+      } catch (error) {
+        console.error('Backend sync failed:', error);
+        toast(t('同步失败，请检查后端连接。', 'Sync failed. Please check backend connection.'), 'error');
+      } finally {
+        setLoading(false);
+      }
+      return;
+    }
+
+    // 后端不可用时走前端直接调用 GitHub API（降级方案）
     if (!githubToken) {
       toast(t('GitHub token 未找到，请重新登录。', 'GitHub token not found. Please login again.'), 'error');
       return;
@@ -73,7 +136,6 @@ export const Header: React.FC = () => {
     setLoading(true);
     try {
       const githubApi = new GitHubApiService(githubToken);
-
       const newRepositories = await githubApi.getAllStarredRepositories();
 
       const existingRepoMap = new Map(repositories.map(repo => [repo.id, repo]));
@@ -100,14 +162,8 @@ export const Header: React.FC = () => {
       });
 
       setRepositories(mergedRepositories);
-
-      // Note: Release fetching is now handled by the Refresh button in Release Timeline
-      // Header sync only syncs the starred repos list
-
       setLastSync(new Date().toISOString());
-      console.log('Sync completed successfully');
 
-      // 显示同步结果
       const newRepoCount = newRepositories.length - repositories.length;
       if (newRepoCount > 0) {
         toast(t(`同步完成！发现 ${newRepoCount} 个新仓库。`, `Sync completed! Found ${newRepoCount} new repositories.`), 'success');
diff --git a/src/components/RepositoryCard.tsx b/src/components/RepositoryCard.tsx
index 490168b..cdd0be0 100644
--- a/src/components/RepositoryCard.tsx
+++ b/src/components/RepositoryCard.tsx
@@ -7,7 +7,7 @@ import { getAICategory, getDefaultCategory } from '../utils/categoryUtils';
 import { analyzeRepository, createFailedAnalysisResult } from '../services/aiAnalysisHelper';
 import { backend } from '../services/backendAdapter';
 import { backendAnalysis } from '../services/backendAnalysisService';
-import { GitHubApiService } from '../services/githubApi';
+
 import { formatDistanceToNow } from 'date-fns';
 import { RepositoryEditModal } from './RepositoryEditModal';
 import { ReadmeModal } from './ReadmeModal';
@@ -559,8 +559,8 @@ const RepositoryCardComponent: React.FC<RepositoryCardProps> = ({
   const t = (zh: string, en: string) => language === 'zh' ? zh : en;
 
   const handleUnstar = async () => {
-    if (!githubToken) {
-      toast(t('未找到 GitHub Token，请重新登录。', 'GitHub token not found. Please login again.'), 'error');
+    if (!backend.isAvailable) {
+      toast(t('后端服务未连接，请检查后端状态。', 'Backend service not connected. Please check the backend status.'), 'error');
       return;
     }
 
@@ -574,9 +574,8 @@ const RepositoryCardComponent: React.FC<RepositoryCardProps> = ({
 
     setUnstarring(true);
     try {
-      const githubApi = new GitHubApiService(githubToken);
       const [owner, repo] = repository.full_name.split('/');
-      await githubApi.unstarRepository(owner, repo);
+      await backend.unstarRepository(owner, repo);
       deleteRepository(repository.id);
       if (backend.isAvailable) {
         backend.deleteRepository(repository.id).catch(() => { /* non-critical */ });
@@ -588,8 +587,8 @@ const RepositoryCardComponent: React.FC<RepositoryCardProps> = ({
     } catch (error) {
       console.error('Failed to unstar repository:', error);
       const errorMessage = language === 'zh'
-        ? '取消 Star 失败，请检查网络连接或重新登录。'
-        : 'Failed to unstar repository. Please check your network connection or login again.';
+        ? '取消 Star 失败，请检查后端服务或网络连接。'
+        : 'Failed to unstar repository. Please check the backend service or network connection.';
       toast(errorMessage, 'error');
     } finally {
       setUnstarring(false);
diff --git a/src/components/RepositoryList.tsx b/src/components/RepositoryList.tsx
index fb96493..203c84c 100644
--- a/src/components/RepositoryList.tsx
+++ b/src/components/RepositoryList.tsx
@@ -657,8 +657,8 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
     try {
       switch (action) {
         case 'unstar': {
-          if (!githubToken) {
-            toast(language === 'zh' ? 'GitHub token 未找到，请重新登录。' : 'GitHub token not found. Please login again.', 'error');
+          if (!backend.isAvailable) {
+            toast(language === 'zh' ? '后端服务未连接，请检查后端状态。' : 'Backend service not connected. Please check the backend status.', 'error');
             return;
           }
 
@@ -673,13 +673,12 @@ export const RepositoryList: React.FC<RepositoryListProps> = ({
           );
           if (!confirmed) return;
 
-          const githubApi = new GitHubApiService(githubToken);
           const successIds: number[] = [];
 
           for (const repo of repos) {
             try {
               const [owner, name] = repo.full_name.split('/');
-              await githubApi.unstarRepository(owner, name);
+              await backend.unstarRepository(owner, name);
               successIds.push(repo.id);
             } catch (error) {
               console.error(`Failed to unstar ${repo.full_name}:`, error);
diff --git a/src/components/SubscriptionRepoCard.tsx b/src/components/SubscriptionRepoCard.tsx
index a8dee00..995ceb6 100644
--- a/src/components/SubscriptionRepoCard.tsx
+++ b/src/components/SubscriptionRepoCard.tsx
@@ -98,18 +98,17 @@ export const SubscriptionRepoCard: React.FC<SubscriptionRepoCardProps> = ({ repo
 
   // 执行取消Star操作
   const executeUnstar = useCallback(async () => {
-    if (!githubToken) return;
-    
+    if (!backend.isAvailable) return;
+
     setIsStarring(true);
-    
+
     try {
-      const githubApi = new GitHubApiService(githubToken);
       const [owner, name] = repo.full_name.split('/');
-      
+
       // 乐观更新：立即更新UI状态
       setOptimisticStarred(false);
-      
-      await githubApi.unstarRepository(owner, name);
+
+      await backend.unstarRepository(owner, name);
       
       // 从本地删除
       const existingRepo = repositories.find(r => r.full_name === repo.full_name);
@@ -126,18 +125,18 @@ export const SubscriptionRepoCard: React.FC<SubscriptionRepoCardProps> = ({ repo
       // 操作失败，回滚乐观状态
       setOptimisticStarred(null);
       console.error('Failed to unstar repository:', error);
-      const errorMessage = t('取消 Star 失败，请检查网络连接或 GitHub Token 权限。', 'Failed to unstar repository. Please check your network connection or GitHub Token permissions.');
+      const errorMessage = t('取消 Star 失败，请检查后端服务或网络连接。', 'Failed to unstar repository. Please check the backend service or network connection.');
       toast(errorMessage, 'error');
     } finally {
       setIsStarring(false);
       setPendingUnstarAction(null);
     }
-  }, [githubToken, repo, repositories, deleteRepository, t]);
+  }, [repo, repositories, deleteRepository, t]);
 
   // 处理添加/取消Star
   const handleStar = useCallback(async (e: React.MouseEvent) => {
     e.stopPropagation();
-    if (!githubToken || isStarring) return;
+    if (!backend.isAvailable || isStarring) return;
 
     if (isStarred) {
       // 取消Star - 显示自定义确认对话框
@@ -150,13 +149,12 @@ export const SubscriptionRepoCard: React.FC<SubscriptionRepoCardProps> = ({ repo
     setIsStarring(true);
     
     try {
-      const githubApi = new GitHubApiService(githubToken);
       const [owner, name] = repo.full_name.split('/');
-      
+
       // 乐观更新：立即更新UI状态
       setOptimisticStarred(true);
-      
-      await githubApi.starRepository(owner, name);
+
+      await backend.starRepository(owner, name);
       
       // 将DiscoveryRepo转换为Repository并添加到本地，保留AI分析结果
       const repositoryToAdd = {
@@ -187,12 +185,12 @@ export const SubscriptionRepoCard: React.FC<SubscriptionRepoCardProps> = ({ repo
       // 操作失败，回滚乐观状态
       setOptimisticStarred(null);
       console.error('Failed to star repository:', error);
-      const errorMessage = t('Star 操作失败，请检查网络连接或 GitHub Token 权限。', 'Failed to star repository. Please check your network connection or GitHub Token permissions.');
+      const errorMessage = t('Star 操作失败，请检查后端服务或网络连接。', 'Failed to star repository. Please check the backend service or network connection.');
       toast(errorMessage, 'error');
     } finally {
       setIsStarring(false);
     }
-  }, [githubToken, isStarring, repo, onStar, t, isStarred, addRepository, executeUnstar]);
+  }, [isStarring, repo, onStar, t, isStarred, addRepository, executeUnstar]);
 
   // 处理在ZRead打开
   const handleOpenInZRead = useCallback((e: React.MouseEvent) => {
@@ -439,7 +437,7 @@ export const SubscriptionRepoCard: React.FC<SubscriptionRepoCardProps> = ({ repo
               {/* Star button */}
               <button
                 onClick={handleStar}
-                disabled={!githubToken || isStarring}
+                disabled={!backend.isAvailable || isStarring}
                 className={`flex items-center justify-center w-7 h-7 sm:w-8 sm:h-8 rounded-lg transition-colors disabled:opacity-50 disabled:cursor-not-allowed ${
                   isStarred
                     ? 'bg-brand-indigo text-white shadow-sm dark:bg-brand-indigo/80 dark:text-white'
diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index 9fc924c..9d16d32 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -1,6 +1,6 @@
 import { translateBackendError } from '../utils/backendErrors';
 
-import { Repository, Release, AIConfig, WebDAVConfig } from '../types';
+import { Repository, Release, AIConfig, WebDAVConfig, ForkRepo, WorkflowDefinition, TranslateResult } from '../types';
 import { useAppStore } from '../store/useAppStore';
 
 class BackendAdapter {
@@ -170,6 +170,210 @@ class BackendAdapter {
     return { remaining: data.rate.remaining, reset: data.rate.reset };
   }
 
+  async starRepository(owner: string, repo: string): Promise<void> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(
+      `${this._backendUrl}/proxy/github/user/starred/${owner}/${repo}`,
+      {
+        method: 'POST',
+        headers: this.getAuthHeaders(),
+        body: JSON.stringify({ method: 'PUT' })
+      }
+    );
+    if (!res.ok) await this.throwTranslatedError(res, 'Star repository proxy error');
+  }
+
+  async unstarRepository(owner: string, repo: string): Promise<void> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(
+      `${this._backendUrl}/proxy/github/user/starred/${owner}/${repo}`,
+      {
+        method: 'POST',
+        headers: this.getAuthHeaders(),
+        body: JSON.stringify({ method: 'DELETE' })
+      }
+    );
+    if (!res.ok) await this.throwTranslatedError(res, 'Unstar repository proxy error');
+  }
+
+  // === Fork Operations ===
+
+  async getUserForks(): Promise<ForkRepo[]> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+    const allForks: ForkRepo[] = [];
+    let page = 1;
+    const perPage = 100;
+    while (true) {
+      const res = await this.fetchWithTimeout(
+        `${this._backendUrl}/proxy/github/user/repos?type=forks&sort=updated&per_page=${perPage}&page=${page}`,
+        {
+          method: 'POST',
+          headers: this.getAuthHeaders(),
+          body: JSON.stringify({ method: 'GET' })
+        }
+      );
+      if (!res.ok) {
+        if (res.status === 404) break;
+        await this.throwTranslatedError(res, 'Get user forks proxy error');
+      }
+      const data = await res.json() as ForkRepo[];
+      allForks.push(...data);
+      if (data.length < perPage) break;
+      page++;
+    }
+    return allForks;
+  }
+
+  async checkForkSyncNeeded(
+    owner: string, repo: string, branch: string, parentFullName?: string
+  ): Promise<{ needsSync: boolean; parentFullName?: string; parentHtmlUrl?: string }> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    try {
+      let parentOwner = '';
+      let resultParentFullName = parentFullName;
+      let resultParentHtmlUrl: string | undefined;
+
+      if (parentFullName) {
+        parentOwner = parentFullName.split('/')[0];
+      } else {
+        const repoRes = await this.fetchWithTimeout(
+          `${this._backendUrl}/proxy/github/repos/${owner}/${repo}`,
+          {
+            method: 'POST',
+            headers: this.getAuthHeaders(),
+            body: JSON.stringify({ method: 'GET' })
+          }
+        );
+        if (!repoRes.ok) return { needsSync: false };
+        const repoData = await repoRes.json() as { parent?: { owner: { login: string }; full_name: string; html_url: string } };
+        if (!repoData.parent) return { needsSync: false };
+        parentOwner = repoData.parent.owner.login;
+        resultParentFullName = repoData.parent.full_name;
+        resultParentHtmlUrl = repoData.parent.html_url;
+      }
+
+      const compareRes = await this.fetchWithTimeout(
+        `${this._backendUrl}/proxy/github/repos/${owner}/${repo}/compare/${parentOwner}:${branch}...${owner}:${branch}`,
+        {
+          method: 'POST',
+          headers: this.getAuthHeaders(),
+          body: JSON.stringify({ method: 'GET' })
+        }
+      );
+      if (!compareRes.ok) return { needsSync: false };
+      const compareData = await compareRes.json() as { behind_by: number };
+
+      return {
+        needsSync: compareData.behind_by > 0,
+        parentFullName: resultParentFullName,
+        parentHtmlUrl: resultParentHtmlUrl
+      };
+    } catch {
+      return { needsSync: false };
+    }
+  }
+
+  async getBranches(owner: string, repo: string): Promise<string[]> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+    try {
+      const res = await this.fetchWithTimeout(
+        `${this._backendUrl}/proxy/github/repos/${owner}/${repo}/branches?per_page=100`,
+        {
+          method: 'POST',
+          headers: this.getAuthHeaders(),
+          body: JSON.stringify({ method: 'GET' })
+        }
+      );
+      if (!res.ok) return [];
+      const branches = await res.json() as { name: string }[];
+      return branches.map(b => b.name);
+    } catch {
+      return [];
+    }
+  }
+
+  async getRepositoryWorkflows(owner: string, repo: string): Promise<WorkflowDefinition[]> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+    try {
+      const res = await this.fetchWithTimeout(
+        `${this._backendUrl}/proxy/github/repos/${owner}/${repo}/actions/workflows?per_page=100`,
+        {
+          method: 'POST',
+          headers: this.getAuthHeaders(),
+          body: JSON.stringify({ method: 'GET' })
+        }
+      );
+      if (!res.ok) return [];
+      const data = await res.json() as { workflows: WorkflowDefinition[] };
+      return data.workflows || [];
+    } catch {
+      return [];
+    }
+  }
+
+  async syncFork(owner: string, repo: string, branch: string): Promise<{ hasUpdates: boolean; sourceUpdatedAt: string | null; mergeType?: string }> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(
+      `${this._backendUrl}/proxy/github/repos/${owner}/${repo}/merge-upstream`,
+      {
+        method: 'POST',
+        headers: this.getAuthHeaders(),
+        body: JSON.stringify({ method: 'POST', body: { branch } })
+      }
+    );
+
+    if (!res.ok) {
+      if (res.status === 404) throw new Error('NOT_A_FORK');
+      if (res.status === 409) throw new Error('MERGE_CONFLICT');
+      if (res.status === 422) return { hasUpdates: false, sourceUpdatedAt: null, mergeType: 'none' };
+      await this.throwTranslatedError(res, 'Sync fork proxy error');
+    }
+
+    const result = await res.json() as { merge_type: string; message?: string };
+    return {
+      hasUpdates: result.merge_type !== 'none',
+      sourceUpdatedAt: new Date().toISOString(),
+      mergeType: result.merge_type,
+    };
+  }
+
+  async triggerWorkflowRun(owner: string, repo: string, workflowPath: string, branch: string): Promise<void> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const encodedPath = encodeURIComponent(workflowPath);
+    const res = await this.fetchWithTimeout(
+      `${this._backendUrl}/proxy/github/repos/${owner}/${repo}/actions/workflows/${encodedPath}/dispatches`,
+      {
+        method: 'POST',
+        headers: this.getAuthHeaders(),
+        body: JSON.stringify({ method: 'POST', body: { ref: branch } })
+      }
+    );
+    if (!res.ok) await this.throwTranslatedError(res, 'Trigger workflow proxy error');
+  }
+
+  // === Translation Proxy ===
+
+  async translate(texts: string[], to: string, from?: string, textType?: string): Promise<TranslateResult[]> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(
+      `${this._backendUrl}/proxy/translate`,
+      {
+        method: 'POST',
+        headers: this.getAuthHeaders(),
+        body: JSON.stringify({ texts, to, from, textType })
+      },
+      60000
+    );
+    if (!res.ok) await this.throwTranslatedError(res, 'Translation proxy error');
+    return res.json() as Promise<TranslateResult[]>;
+  }
+
   // === AI Proxy ===
 
   async proxyAIRequest(configId: string, body: object): Promise<unknown> {
diff --git a/src/services/translateService.ts b/src/services/translateService.ts
index 749bbc4..db06ed3 100644
--- a/src/services/translateService.ts
+++ b/src/services/translateService.ts
@@ -1,81 +1,16 @@
-import queryString from 'query-string';
+import { backend } from './backendAdapter';
+import type { TranslateResult } from '../types';
 
-class AuthExpiredError extends Error {
-  readonly isAuthExpired = true;
-  constructor() {
-    super('Auth expired');
-    this.name = 'AuthExpiredError';
-  }
-}
-
-export interface TranslateResult {
-  translatedText: string;
-  detectedLanguage: string;
-}
+export type { TranslateResult };
 
-interface CachedToken {
-  token: string;
-  expiresAt: number;
+export interface TranslateOptions {
+  from?: string;
+  to: string;
+  text: string;
+  signal?: AbortSignal;
+  textType?: 'html' | 'plain';
 }
 
-let cachedToken: CachedToken | null = null;
-let tokenPromise: Promise<string> | null = null;
-
-const TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;
-const TRANSLATE_API_URL = 'https://api-edge.cognitive.microsofttranslator.com/translate';
-const AUTH_URL = 'https://edge.microsoft.com/translate/auth';
-const FALLBACK_TOKEN_TTL_MS = 8 * 60 * 1000;
-
-const parseJwtExpiration = (token: string): number => {
-  try {
-    const parts = token.split('.');
-    if (parts.length !== 3) return 0;
-    
-    const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
-    const payload = JSON.parse(atob(base64));
-    if (payload.exp) {
-      return payload.exp * 1000;
-    }
-    return 0;
-  } catch {
-    return 0;
-  }
-};
-
-const isTokenValid = (cached: CachedToken | null): cached is CachedToken => {
-  if (!cached) return false;
-  return Date.now() < cached.expiresAt - TOKEN_REFRESH_BUFFER_MS;
-};
-
-const getStoredToken = (): CachedToken | null => {
-  try {
-    const stored = localStorage.getItem('ms_translate_token');
-    if (!stored) return null;
-    
-    const parsed = JSON.parse(stored) as CachedToken;
-    if (isTokenValid(parsed)) {
-      return parsed;
-    }
-    localStorage.removeItem('ms_translate_token');
-    return null;
-  } catch {
-    return null;
-  }
-};
-
-const storeToken = (token: string): void => {
-  try {
-    let expiresAt = parseJwtExpiration(token);
-    if (expiresAt <= 0) {
-      expiresAt = Date.now() + FALLBACK_TOKEN_TTL_MS;
-    }
-    cachedToken = { token, expiresAt };
-    localStorage.setItem('ms_translate_token', JSON.stringify(cachedToken));
-  } catch {
-    // ignore storage errors
-  }
-};
-
 const sleep = (ms: number, signal?: AbortSignal): Promise<void> =>
   new Promise((resolve, reject) => {
     if (signal?.aborted) {
@@ -92,31 +27,8 @@ const sleep = (ms: number, signal?: AbortSignal): Promise<void> =>
     }
   });
 
-const extractHttpStatus = (err: unknown): number | null => {
-  const anyErr = err as Record<string, unknown>;
-  const response = anyErr?.response as Record<string, unknown> | undefined;
-  const status = response?.status ?? anyErr?.status;
-  if (typeof status === 'number') return status;
-
-  if (err instanceof Error) {
-    const match = err.message.match(/(?:status|failed)[:\s]*(\d{3})/i);
-    if (match) {
-      return parseInt(match[1], 10);
-    }
-  }
-
-  return null;
-};
-
-const isTransientError = (err: unknown): boolean => {
-  if ((err as { isAuthExpired?: boolean })?.isAuthExpired) return true;
-  const status = extractHttpStatus(err);
-  if (status === null) return true;
-  return status === 429 || status >= 500;
-};
-
-const withTranslateRetry = async <T>(
-  operation: (token: string) => Promise<T>,
+const withRetry = async <T>(
+  operation: () => Promise<T>,
   signal?: AbortSignal,
   maxRetries = 3,
   baseDelay = 1000
@@ -125,8 +37,7 @@ const withTranslateRetry = async <T>(
 
   for (let attempt = 1; attempt <= maxRetries; attempt++) {
     try {
-      const token = await apiMsAuth(signal);
-      return await operation(token);
+      return await operation();
     } catch (err) {
       lastError = err instanceof Error ? err : new Error(String(err));
 
@@ -137,7 +48,17 @@ const withTranslateRetry = async <T>(
 
       if (attempt >= maxRetries) break;
 
-      if (!isTransientError(err)) {
+      // 仅在网络错误或服务端错误时重试
+      const msg = lastError.message;
+      const isTransient =
+        msg.includes('Failed to fetch') ||
+        msg.includes('NetworkError') ||
+        msg.includes('AbortError') ||
+        msg.includes('Gateway Timeout') ||
+        msg.includes('Bad Gateway') ||
+        msg.includes('429');
+
+      if (!isTransient) {
         throw err;
       }
 
@@ -148,63 +69,6 @@ const withTranslateRetry = async <T>(
   throw lastError!;
 };
 
-export const apiMsAuth = async (signal?: AbortSignal): Promise<string> => {
-  const storedToken = getStoredToken();
-  if (storedToken) {
-    cachedToken = storedToken;
-    return storedToken.token;
-  }
-
-  if (isTokenValid(cachedToken)) {
-    return cachedToken.token;
-  }
-
-  if (!tokenPromise) {
-    tokenPromise = (async () => {
-      try {
-        const response = await fetch(AUTH_URL, {
-          method: 'GET',
-          credentials: 'omit',
-        });
-
-        if (!response.ok) {
-          throw new Error(`Auth failed: ${response.status}`);
-        }
-
-        const token = await response.text();
-        storeToken(token);
-        return token;
-      } finally {
-        tokenPromise = null;
-      }
-    })();
-  }
-
-  if (!signal) {
-    return tokenPromise;
-  }
-
-  return Promise.race([
-    tokenPromise,
-    new Promise<string>((_, reject) => {
-      if (signal.aborted) {
-        reject(new DOMException('Aborted', 'AbortError'));
-        return;
-      }
-      const onAbort = () => reject(new DOMException('Aborted', 'AbortError'));
-      signal.addEventListener('abort', onAbort, { once: true });
-    }),
-  ]);
-};
-
-export interface TranslateOptions {
-  from?: string;
-  to: string;
-  text: string;
-  signal?: AbortSignal;
-  textType?: 'html' | 'plain';
-}
-
 export const translateText = async (options: TranslateOptions): Promise<TranslateResult> => {
   const { from, to, text, signal, textType } = options;
 
@@ -212,49 +76,9 @@ export const translateText = async (options: TranslateOptions): Promise<Translat
     return { translatedText: text, detectedLanguage: '' };
   }
 
-  return withTranslateRetry(async (token) => {
-    const params = queryString.stringify({
-      ...(from && { from }),
-      to,
-      'api-version': '3.0',
-      ...(textType === 'html' && { textType: 'html' }),
-    });
-
-    const url = `${TRANSLATE_API_URL}?${params}`;
-
-    const response = await fetch(url, {
-      method: 'POST',
-      headers: {
-        'Content-type': 'application/json',
-        'Authorization': `Bearer ${token}`,
-      },
-      body: JSON.stringify([{ Text: text }]),
-      signal,
-    });
-
-    if (!response.ok) {
-      if (response.status === 401) {
-        cachedToken = null;
-        localStorage.removeItem('ms_translate_token');
-        throw new AuthExpiredError();
-      }
-      throw new Error(`Translation failed: ${response.status}`);
-    }
-
-    const data = await response.json();
-
-    if (!Array.isArray(data) || data.length === 0) {
-      throw new Error('Invalid translation response');
-    }
-
-    const result = data[0];
-    const translatedText = result.translations?.[0]?.text || text;
-    const detectedLanguage = result.detectedLanguage?.language || '';
-
-    return {
-      translatedText,
-      detectedLanguage,
-    };
+  return withRetry(async () => {
+    const results = await backend.translate([text], to, from, textType);
+    return results[0] || { translatedText: text, detectedLanguage: '' };
   }, signal, 3);
 };
 
@@ -299,7 +123,7 @@ export const translateBatch = async (
   textType?: 'html' | 'plain'
 ): Promise<TranslateResult[]> => {
   if (texts.length === 0) return [];
-  
+
   if (texts.length === 1) {
     const result = await translateText({ text: texts[0], to, from, signal, textType });
     return [result];
@@ -319,7 +143,6 @@ export const translateBatch = async (
     let currentLength = 0;
 
     for (const text of batch) {
-      // Always flush accumulated batch before handling an oversized item.
       if (text.length > maxChars) {
         if (currentBatch.length > 0) {
           const batchResults = await translateBatchInternal(currentBatch, to, from, signal, textType);
@@ -336,7 +159,6 @@ export const translateBatch = async (
       }
 
       if (currentLength + text.length > maxChars && currentBatch.length > 0) {
-        // (this branch is now only reached for non-oversized items)
         const batchResults = await translateBatchInternal(currentBatch, to, from, signal, textType);
         results.push(...batchResults);
         currentBatch = [];
@@ -362,49 +184,7 @@ const translateBatchInternal = async (
   signal?: AbortSignal,
   textType?: 'html' | 'plain'
 ): Promise<TranslateResult[]> => {
-  return withTranslateRetry(async (token) => {
-    const params = queryString.stringify({
-      ...(from && { from }),
-      to,
-      'api-version': '3.0',
-      ...(textType === 'html' && { textType: 'html' }),
-    });
-
-    const url = `${TRANSLATE_API_URL}?${params}`;
-
-    const response = await fetch(url, {
-      method: 'POST',
-      headers: {
-        'Content-type': 'application/json',
-        'Authorization': `Bearer ${token}`,
-      },
-      body: JSON.stringify(texts.map(t => ({ Text: t }))),
-      signal,
-    });
-
-    if (!response.ok) {
-      if (response.status === 401) {
-        cachedToken = null;
-        localStorage.removeItem('ms_translate_token');
-        throw new AuthExpiredError();
-      }
-      throw new Error(`Translation failed: ${response.status}`);
-    }
-
-    const data = await response.json();
-
-    if (!Array.isArray(data) || data.length !== texts.length) {
-      throw new Error('Invalid translation response');
-    }
-
-    return data.map((result, index) => ({
-      translatedText: result.translations?.[0]?.text || texts[index],
-      detectedLanguage: result.detectedLanguage?.language || '',
-    }));
+  return withRetry(async () => {
+    return backend.translate(texts, to, from, textType);
   }, signal, 3);
 };
-
-export const clearTranslateCache = (): void => {
-  cachedToken = null;
-  localStorage.removeItem('ms_translate_token');
-};
diff --git a/src/types/index.ts b/src/types/index.ts
index 6f27b90..13d79ca 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -421,6 +421,11 @@ export interface SubscriptionChannel {
   enabled: boolean;
 }
 
+export interface TranslateResult {
+  translatedText: string;
+  detectedLanguage: string;
+}
+
 export const defaultSubscriptionChannels: SubscriptionChannel[] = [
   {
     id: 'most-stars',

From 1044444939efdd49ec57876642ad5c45e8199355 Mon Sep 17 00:00:00 2001
From: lostiv <30612717+lostiv@users.noreply.github.com>
Date: Tue, 12 May 2026 01:53:33 +0800
Subject: [PATCH 30/47] =?UTF-8?q?@=20fix:=20=E4=BF=AE=E5=A4=8D=20CodeRabbi?=
 =?UTF-8?q?t=20=E5=AE=A1=E6=9F=A5=E5=8F=91=E7=8E=B0=E7=9A=84=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- MS auth fetch 添加 AbortController + 30s 超时控制
- newRepoCount 改用 Set-based ID 差集计算（修复取消星标时计数错误）
- isTransient 增加 instanceof TypeError 结构化检测
- loadWorkflows 失败时添加 toast 提示
- Trending 按钮添加 aria-label 和 title 属性
@
---
 server/src/routes/proxy.ts       | 9 ++++++++-
 src/components/ForkTimeline.tsx  | 1 +
 src/components/Header.tsx        | 8 ++++++--
 src/services/translateService.ts | 1 +
 4 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/server/src/routes/proxy.ts b/server/src/routes/proxy.ts
index 5e71a29..28a3bf5 100644
--- a/server/src/routes/proxy.ts
+++ b/server/src/routes/proxy.ts
@@ -313,7 +313,14 @@ async function getMsTranslateToken(): Promise<string> {
     return msTranslateToken;
   }
 
-  const res = await fetch(MS_AUTH_URL, { method: 'GET' });
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 30000);
+  let res: Response;
+  try {
+    res = await fetch(MS_AUTH_URL, { method: 'GET', signal: controller.signal });
+  } finally {
+    clearTimeout(timeoutId);
+  }
   if (!res.ok) throw new Error(`MS auth failed: ${res.status}`);
   const token = await res.text();
 
diff --git a/src/components/ForkTimeline.tsx b/src/components/ForkTimeline.tsx
index e541f4f..9e38123 100644
--- a/src/components/ForkTimeline.tsx
+++ b/src/components/ForkTimeline.tsx
@@ -301,6 +301,7 @@ export const ForkTimeline: React.FC = () => {
       setWorkflowsMap(prev => ({ ...prev, [forkId]: workflows }));
     } catch (error) {
       console.error('Failed to load workflows:', error);
+      toast(language === 'zh' ? '加载工作流失败。' : 'Failed to load workflows.', 'error');
     } finally {
       setLoadingWorkflows(prev => {
         const newSet = new Set(prev);
diff --git a/src/components/Header.tsx b/src/components/Header.tsx
index 5dcb48e..0317b97 100644
--- a/src/components/Header.tsx
+++ b/src/components/Header.tsx
@@ -112,7 +112,8 @@ export const Header: React.FC = () => {
         setRepositories(merged);
         setLastSync(new Date().toISOString());
 
-        const newRepoCount = allStarred.length - repositories.length;
+        const existingIds = new Set(repositories.map(r => r.id));
+        const newRepoCount = allStarred.filter(r => !existingIds.has(r.id)).length;
         if (newRepoCount > 0) {
           toast(t(`同步完成！发现 ${newRepoCount} 个新仓库。`, `Sync completed! Found ${newRepoCount} new repositories.`), 'success');
         } else {
@@ -164,7 +165,8 @@ export const Header: React.FC = () => {
       setRepositories(mergedRepositories);
       setLastSync(new Date().toISOString());
 
-      const newRepoCount = newRepositories.length - repositories.length;
+      const existingIds = new Set(repositories.map(r => r.id));
+      const newRepoCount = newRepositories.filter(r => !existingIds.has(r.id)).length;
       if (newRepoCount > 0) {
         toast(t(`同步完成！发现 ${newRepoCount} 个新仓库。`, `Sync completed! Found ${newRepoCount} new repositories.`), 'success');
       } else {
@@ -278,6 +280,8 @@ export const Header: React.FC = () => {
             </button>
             <button
               onClick={() => setCurrentView('subscription')}
+              aria-label={isTextWrapped ? t('趋势', 'Trending') : undefined}
+              title={isTextWrapped ? t('趋势', 'Trending') : undefined}
               className={`${isTextWrapped ? 'p-2.5' : 'px-4 py-2'} rounded-lg font-medium transition-colors ${
                 currentView === 'subscription'
                   ? 'bg-white dark:bg-white/[0.1] text-gray-900 dark:text-text-primary shadow-sm border border-black/[0.06] dark:border-white/[0.04]'
diff --git a/src/services/translateService.ts b/src/services/translateService.ts
index db06ed3..04eb039 100644
--- a/src/services/translateService.ts
+++ b/src/services/translateService.ts
@@ -51,6 +51,7 @@ const withRetry = async <T>(
       // 仅在网络错误或服务端错误时重试
       const msg = lastError.message;
       const isTransient =
+        err instanceof TypeError ||
         msg.includes('Failed to fetch') ||
         msg.includes('NetworkError') ||
         msg.includes('AbortError') ||

From 871dabf15bc8527dc7a01fb852fa9cd7d429f55b Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 09:59:40 +0800
Subject: [PATCH 31/47] =?UTF-8?q?refactor:=20Release=E8=BF=81=E7=A7=BB?=
 =?UTF-8?q?=E5=88=B0=E5=90=8E=E7=AB=AF=E4=BB=A3=E7=90=86,=20=E6=B7=BB?=
 =?UTF-8?q?=E5=8A=A0Fork=E5=92=8CRelease=E8=87=AA=E5=8A=A8=E5=8A=A0?=
 =?UTF-8?q?=E8=BD=BD,=20=E8=AE=A2=E9=98=85=E5=8F=91=E5=B8=83=E5=90=8C?=
 =?UTF-8?q?=E6=AD=A5=E5=90=8E=E7=AB=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- ReleaseTimeline: 移除GitHubApiService, 改用backend.getMultipleRepositoryReleases走后端代理
- BackendAdapter: 新增fetchAllReleasesForRepo和getMultipleRepositoryReleases, getRepositoryReleases返回Release[]
- ForkTimeline: 添加挂载时自动加载forks, 避免新开页面显示空状态
- ReleaseTimeline: 添加挂载时自动加载releases
- RepositoryCard: 订阅发布按钮同步调用backend.updateRepository持久化
- useAppStore: setRepositories时从subscribed_to_releases自动重建releaseSubscriptions
---
 src/components/ForkTimeline.tsx    |  36 ++++++++++
 src/components/ReleaseTimeline.tsx |  69 +++++++++++++++----
 src/components/RepositoryCard.tsx  |  10 ++-
 src/services/backendAdapter.ts     | 107 ++++++++++++++++++++++++++++-
 src/store/useAppStore.ts           |  10 ++-
 5 files changed, 213 insertions(+), 19 deletions(-)

diff --git a/src/components/ForkTimeline.tsx b/src/components/ForkTimeline.tsx
index 9e38123..4eadf5d 100644
--- a/src/components/ForkTimeline.tsx
+++ b/src/components/ForkTimeline.tsx
@@ -112,6 +112,42 @@ export const ForkTimeline: React.FC = () => {
   const startIndex = (clampedPage - 1) * itemsPerPage;
   const paginatedForks = filteredForks.slice(startIndex, startIndex + itemsPerPage);
 
+  // Auto-load forks on mount if empty
+  const [initialLoadDone, setInitialLoadDone] = useState(false);
+
+  useEffect(() => {
+    if (initialLoadDone) return;
+    if (!backend.isAvailable) return;
+    if (forks.length > 0) {
+      setInitialLoadDone(true);
+      return;
+    }
+
+    let cancelled = false;
+    const loadForks = async () => {
+      setForkIsRefreshing(true);
+      try {
+        const newForks = await backend.getUserForks();
+        if (cancelled) return;
+        if (newForks.length > 0) {
+          setForks(newForks);
+        }
+        setInitialLoadDone(true);
+      } catch {
+        // Silent fail on auto-load
+      } finally {
+        if (!cancelled) {
+          setForkIsRefreshing(false);
+        }
+      }
+    };
+    loadForks();
+
+    return () => { cancelled = true; };
+    // Only run on mount when backend becomes available
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [backend.isAvailable]);
+
   // Sync currentPage when data changes
   useEffect(() => {
     const maxPage = Math.max(totalPages, 1);
diff --git a/src/components/ReleaseTimeline.tsx b/src/components/ReleaseTimeline.tsx
index 246d974..1e47d12 100644
--- a/src/components/ReleaseTimeline.tsx
+++ b/src/components/ReleaseTimeline.tsx
@@ -2,7 +2,6 @@ import React, { useState, useMemo, useCallback, useEffect } from 'react';
 import { Package, Bell, Search, X, RefreshCw, ChevronLeft, ChevronRight, ChevronsLeft, ChevronsRight, LayoutGrid, CalendarDays, ChevronDown } from 'lucide-react';
 import { Release } from '../types';
 import { useAppStore } from '../store/useAppStore';
-import { GitHubApiService } from '../services/githubApi';
 import { backend } from '../services/backendAdapter';
 import { formatDistanceToNow } from 'date-fns';
 import { AssetFilterManager } from './AssetFilterManager';
@@ -16,7 +15,6 @@ export const ReleaseTimeline: React.FC = () => {
     repositories,
     releaseSubscriptions,
     readReleases,
-    githubToken,
     language,
     assetFilters,
     addReleases,
@@ -276,6 +274,50 @@ export const ReleaseTimeline: React.FC = () => {
   const paginatedReleases = filteredReleases.slice(startIndex, startIndex + itemsPerPage);
   const paginatedRepositoryGroups = repositoryGroups.slice(startIndex, startIndex + itemsPerPage);
 
+  // Auto-load releases on mount if empty
+  const [initialLoadDone, setInitialLoadDone] = useState(false);
+
+  useEffect(() => {
+    if (initialLoadDone) return;
+    if (!backend.isAvailable) return;
+    if (releases.length > 0) {
+      setInitialLoadDone(true);
+      return;
+    }
+
+    const subscribedRepos = repositories.filter(repo => releaseSubscriptions.has(repo.id));
+    if (subscribedRepos.length === 0) {
+      setInitialLoadDone(true);
+      return;
+    }
+
+    let cancelled = false;
+    const loadReleases = async () => {
+      setReleaseIsRefreshing(true);
+      try {
+        const { releases: newReleases } = await backend.getMultipleRepositoryReleases(
+          subscribedRepos,
+          { includePreRelease }
+        );
+        if (cancelled) return;
+        if (newReleases.length > 0) {
+          addReleases(newReleases);
+        }
+        setInitialLoadDone(true);
+      } catch {
+        // Silent fail on auto-load
+      } finally {
+        if (!cancelled) {
+          setReleaseIsRefreshing(false);
+        }
+      }
+    };
+    loadReleases();
+
+    return () => { cancelled = true; };
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [backend.isAvailable]);
+
   // 同步 currentPage 状态，确保始终在有效范围内
   useEffect(() => {
     const maxPage = Math.max(totalPages, 1);
@@ -298,24 +340,21 @@ export const ReleaseTimeline: React.FC = () => {
   };
 
   const handleRefresh = async () => {
-    if (!githubToken) {
-      toast(language === 'zh' ? 'GitHub token 未找到，请重新登录。' : 'GitHub token not found. Please login again.', 'error');
+    if (!backend.isAvailable) {
+      toast(language === 'zh' ? '后端服务未连接，请检查后端状态。' : 'Backend service not connected. Please check the backend status.', 'error');
       return;
     }
 
-    setReleaseIsRefreshing(true);
-    try {
-      const githubApi = new GitHubApiService(githubToken);
-      // Only fetch releases for repos that are subscribed to releases
-      const subscribedRepos = repositories.filter(repo => releaseSubscriptions.has(repo.id));
+    const subscribedRepos = repositories.filter(repo => releaseSubscriptions.has(repo.id));
 
-      if (subscribedRepos.length === 0) {
-        toast(language === 'zh' ? '没有订阅的仓库。' : 'No subscribed repositories.', 'error');
-        return;
-      }
+    if (subscribedRepos.length === 0) {
+      toast(language === 'zh' ? '没有订阅的仓库。' : 'No subscribed repositories.', 'error');
+      return;
+    }
 
-      // Use the new getMultipleRepositoryReleases with options
-      const { releases: newReleases, failedRepos } = await githubApi.getMultipleRepositoryReleases(
+    setReleaseIsRefreshing(true);
+    try {
+      const { releases: newReleases, failedRepos } = await backend.getMultipleRepositoryReleases(
         subscribedRepos,
         { includePreRelease }
       );
diff --git a/src/components/RepositoryCard.tsx b/src/components/RepositoryCard.tsx
index cdd0be0..ee16434 100644
--- a/src/components/RepositoryCard.tsx
+++ b/src/components/RepositoryCard.tsx
@@ -595,6 +595,14 @@ const RepositoryCardComponent: React.FC<RepositoryCardProps> = ({
     }
   };
 
+  const handleToggleSubscription = () => {
+    const newState = !isSubscribed;
+    toggleReleaseSubscription(repository.id);
+    if (backend.isAvailable) {
+      backend.updateRepository(repository.id, { subscribed_to_releases: newState }).catch(() => {});
+    }
+  };
+
   const dragStartPosRef = useRef<{ x: number; y: number } | null>(null);
   const isDraggingRef = useRef(false);
   const dragHandleRef = useRef<HTMLDivElement>(null);
@@ -849,7 +857,7 @@ const RepositoryCardComponent: React.FC<RepositoryCardProps> = ({
             {isAnalyzing ? <Loader2 className="w-4 h-4 animate-spin" /> : <Bot className="w-4 h-4" />}
           </SelectionAwareButton>
           <SelectionAwareButton
-            onClick={() => toggleReleaseSubscription(repository.id)}
+            onClick={handleToggleSubscription}
             selectionMode={selectionMode}
             className={`${isSubscribed
               ? 'bg-brand-indigo text-white shadow-sm dark:bg-brand-indigo/80 dark:text-white'
diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index 9d16d32..2b65004 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -141,7 +141,7 @@ class BackendAdapter {
     }
   }
 
-  async getRepositoryReleases(owner: string, repo: string, page = 1, perPage = 30): Promise<Record<string, unknown>[]> {
+  async getRepositoryReleases(owner: string, repo: string, page = 1, perPage = 30): Promise<Release[]> {
     if (!this._backendUrl) throw new Error('Backend not available');
 
     try {
@@ -151,12 +151,115 @@ class BackendAdapter {
         body: JSON.stringify({ method: 'GET' })
       });
       if (!res.ok) return [];
-      return res.json() as Promise<Record<string, unknown>[]>;
+      const data = await res.json() as Record<string, unknown>[];
+      return data.map((r) => ({
+        id: r.id as number,
+        tag_name: r.tag_name as string,
+        name: (r.name || r.tag_name) as string,
+        body: (r.body || '') as string,
+        published_at: r.published_at as string,
+        html_url: r.html_url as string,
+        assets: (r.assets || []) as Release['assets'],
+        zipball_url: r.zipball_url as string | undefined,
+        tarball_url: r.tarball_url as string | undefined,
+        prerelease: (r.prerelease ?? false) as boolean,
+        repository: { id: 0, full_name: `${owner}/${repo}`, name: repo },
+      }));
     } catch {
       return [];
     }
   }
 
+  async fetchAllReleasesForRepo(owner: string, repo: string): Promise<Release[]> {
+    const allReleases: Release[] = [];
+    let page = 1;
+
+    while (true) {
+      const batch = await this.getRepositoryReleases(owner, repo, page, 30);
+      if (batch.length === 0) break;
+      allReleases.push(...batch);
+      if (batch.length < 30) break;
+      page++;
+      await new Promise(resolve => setTimeout(resolve, 100));
+    }
+
+    return allReleases;
+  }
+
+  async getMultipleRepositoryReleases(
+    repositories: { id: number; full_name: string; has_fetched_releases?: boolean; last_release_fetch_time?: string }[],
+    options: { includePreRelease?: boolean } = {}
+  ): Promise<{ releases: Release[]; failedRepos: { repoId: number; full_name: string; error: string }[] }> {
+    const { includePreRelease = true } = options;
+    const allReleases: Release[] = [];
+    const failedRepos: { repoId: number; full_name: string; error: string }[] = [];
+
+    const concurrency = 3;
+    let index = 0;
+
+    const workers = Array.from({ length: Math.min(concurrency, repositories.length) }, async () => {
+      while (true) {
+        const currentIndex = index++;
+        if (currentIndex >= repositories.length) break;
+
+        const repo = repositories[currentIndex];
+        const [owner, name] = repo.full_name.split('/');
+
+        try {
+          let releases: Release[];
+
+          if (!repo.has_fetched_releases) {
+            releases = await this.fetchAllReleasesForRepo(owner, name);
+          } else {
+            const sinceTime = repo.last_release_fetch_time
+              ? new Date(repo.last_release_fetch_time)
+              : null;
+
+            let page = 1;
+            releases = [];
+            while (true) {
+              const batch = await this.getRepositoryReleases(owner, name, page, 10);
+              if (batch.length === 0) break;
+
+              const fresh = sinceTime
+                ? batch.filter(r => new Date(r.published_at) > sinceTime)
+                : batch;
+
+              releases.push(...fresh);
+
+              if (
+                batch.length < 10 ||
+                (sinceTime && batch.some(r => new Date(r.published_at) <= sinceTime))
+              ) {
+                break;
+              }
+              page++;
+            }
+          }
+
+          releases.forEach(release => {
+            release.repository.id = repo.id;
+          });
+
+          if (!includePreRelease) {
+            releases = releases.filter(r => !r.prerelease);
+          }
+
+          allReleases.push(...releases);
+        } catch (error) {
+          failedRepos.push({
+            repoId: repo.id,
+            full_name: repo.full_name,
+            error: error instanceof Error ? error.message : 'Unknown error'
+          });
+        }
+      }
+    });
+
+    await Promise.all(workers);
+    return { releases: allReleases, failedRepos };
+  }
+
   async checkRateLimit(): Promise<{ remaining: number; reset: number }> {
     if (!this._backendUrl) throw new Error('Backend not available');
 
diff --git a/src/store/useAppStore.ts b/src/store/useAppStore.ts
index 618c552..d4dd814 100644
--- a/src/store/useAppStore.ts
+++ b/src/store/useAppStore.ts
@@ -777,7 +777,15 @@ export const useAppStore = create<AppState & AppActions>()(
       }),
 
       // Repository actions
-      setRepositories: (repositories) => set({ repositories, searchResults: repositories }),
+      setRepositories: (repositories) => set((state) => {
+        const nextReleaseSubscriptions = new Set(state.releaseSubscriptions);
+        for (const repo of repositories) {
+          if (repo.subscribed_to_releases) {
+            nextReleaseSubscriptions.add(repo.id);
+          }
+        }
+        return { repositories, searchResults: repositories, releaseSubscriptions: nextReleaseSubscriptions };
+      }),
       updateRepository: (repo) => set((state) => {
         const updatedRepositories = state.repositories.map(r => r.id === repo.id ? repo : r);
         return {

From 94e648751def925ee176f2b47e58a069d500fc48 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 10:13:46 +0800
Subject: [PATCH 32/47] =?UTF-8?q?fix:=20CodeRabbit=20=E5=AE=A1=E6=9F=A5?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20=E2=80=94=20=E5=89=AF=E4=BD=9C=E7=94=A8?=
 =?UTF-8?q?=E3=80=81=E8=AE=A2=E9=98=85=E5=90=8C=E6=AD=A5=E3=80=81=E9=94=99?=
 =?UTF-8?q?=E8=AF=AF=E5=A4=84=E7=90=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- backendAdapter: releases.forEach 改 map 避免原地修改副作用
- backendAdapter: fetchAllReleasesForRepo 加 maxPages=50 上限和 try/catch
- useAppStore: setRepositories 同时处理取消订阅 (subscribed_to_releases=false)
- RepositoryCard: 订阅同步失败改为 console.warn 记录
---
 src/components/RepositoryCard.tsx |  3 ++-
 src/services/backendAdapter.ts    | 23 +++++++++++++++--------
 src/store/useAppStore.ts          |  2 ++
 3 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/src/components/RepositoryCard.tsx b/src/components/RepositoryCard.tsx
index ee16434..5ac1870 100644
--- a/src/components/RepositoryCard.tsx
+++ b/src/components/RepositoryCard.tsx
@@ -599,7 +599,8 @@ const RepositoryCardComponent: React.FC<RepositoryCardProps> = ({
     const newState = !isSubscribed;
     toggleReleaseSubscription(repository.id);
     if (backend.isAvailable) {
-      backend.updateRepository(repository.id, { subscribed_to_releases: newState }).catch(() => {});
+      backend.updateRepository(repository.id, { subscribed_to_releases: newState })
+        .catch((err) => console.warn('Failed to sync subscription state:', err));
     }
   };
 
diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index 2b65004..726fde2 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -172,13 +172,19 @@ class BackendAdapter {
 
   async fetchAllReleasesForRepo(owner: string, repo: string): Promise<Release[]> {
     const allReleases: Release[] = [];
+    const maxPages = 50;
     let page = 1;
 
-    while (true) {
-      const batch = await this.getRepositoryReleases(owner, repo, page, 30);
-      if (batch.length === 0) break;
-      allReleases.push(...batch);
-      if (batch.length < 30) break;
+    while (page <= maxPages) {
+      try {
+        const batch = await this.getRepositoryReleases(owner, repo, page, 30);
+        if (batch.length === 0) break;
+        allReleases.push(...batch);
+        if (batch.length < 30) break;
+      } catch (err) {
+        console.warn(`Release fetch failed for ${owner}/${repo} at page ${page}:`, err);
+        break;
+      }
       page++;
       await new Promise(resolve => setTimeout(resolve, 100));
     }
@@ -237,9 +243,10 @@ class BackendAdapter {
             }
           }
 
-          releases.forEach(release => {
-            release.repository.id = repo.id;
-          });
+          releases = releases.map(release => ({
+            ...release,
+            repository: { ...release.repository, id: repo.id },
+          }));
 
           if (!includePreRelease) {
             releases = releases.filter(r => !r.prerelease);
diff --git a/src/store/useAppStore.ts b/src/store/useAppStore.ts
index d4dd814..35b907b 100644
--- a/src/store/useAppStore.ts
+++ b/src/store/useAppStore.ts
@@ -782,6 +782,8 @@ export const useAppStore = create<AppState & AppActions>()(
         for (const repo of repositories) {
           if (repo.subscribed_to_releases) {
             nextReleaseSubscriptions.add(repo.id);
+          } else {
+            nextReleaseSubscriptions.delete(repo.id);
           }
         }
         return { repositories, searchResults: repositories, releaseSubscriptions: nextReleaseSubscriptions };

From b2329068a73ef8dbcc938acc386a94fc92a639bb Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 10:21:03 +0800
Subject: [PATCH 33/47] =?UTF-8?q?fix:=20=E5=A2=9E=E9=87=8F=E5=90=8C?=
 =?UTF-8?q?=E6=AD=A5=E5=BE=AA=E7=8E=AF=E4=B9=9F=E5=8A=A0=20maxPages=20?=
 =?UTF-8?q?=E4=B8=8A=E9=99=90=E5=92=8C=E5=88=86=E9=A1=B5=E5=BB=B6=E8=BF=9F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/services/backendAdapter.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index 726fde2..566ee99 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -222,8 +222,9 @@ class BackendAdapter {
               : null;
 
             let page = 1;
+            const maxPages = 50;
             releases = [];
-            while (true) {
+            while (page <= maxPages) {
               const batch = await this.getRepositoryReleases(owner, name, page, 10);
               if (batch.length === 0) break;
 
@@ -240,6 +241,7 @@ class BackendAdapter {
                 break;
               }
               page++;
+              await new Promise(resolve => setTimeout(resolve, 100));
             }
           }
 

From 710eb085f74dbe419360810a5a2e18acc8960ca8 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 11:18:18 +0800
Subject: [PATCH 34/47] =?UTF-8?q?feat:=20WebDAV=E8=87=AA=E5=8A=A8=E5=A4=87?=
 =?UTF-8?q?=E4=BB=BD=E5=92=8C=E8=87=AA=E5=AE=9A=E4=B9=89=E4=BF=9D=E7=95=99?=
 =?UTF-8?q?=E4=BB=BD=E6=95=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

后端新增备份调度服务，支持设置自动备份间隔和保留最近N份备份。
前端新增自动备份设置面板，可在设置中配置参数和手动触发。

- 新增 backupService.ts: 数据导出、自动备份、旧备份清理调度
- 新增 backup.ts 路由: settings CRUD / status / trigger 四个API
- 提取 exportAllData 函数供 sync 和 backup 服务共用
- webdavService 新增 deleteFile 方法
- 前端新增 AutoBackupPanel 配置面板
---
 .agents/skills/caveman/SKILL.md               |  49 +++
 .agents/skills/diagnose/SKILL.md              | 117 ++++++
 .../diagnose/scripts/hitl-loop.template.sh    |  41 ++
 .agents/skills/grill-me/SKILL.md              |  10 +
 .agents/skills/grill-with-docs/ADR-FORMAT.md  |  47 +++
 .../skills/grill-with-docs/CONTEXT-FORMAT.md  |  77 ++++
 .agents/skills/grill-with-docs/SKILL.md       |  88 ++++
 .agents/skills/handoff/SKILL.md               |  13 +
 .../DEEPENING.md                              |  37 ++
 .../INTERFACE-DESIGN.md                       |  44 ++
 .../improve-codebase-architecture/LANGUAGE.md |  53 +++
 .../improve-codebase-architecture/SKILL.md    |  71 ++++
 .agents/skills/prototype/LOGIC.md             |  79 ++++
 .agents/skills/prototype/SKILL.md             |  30 ++
 .agents/skills/prototype/UI.md                | 112 +++++
 .../skills/setup-matt-pocock-skills/SKILL.md  | 121 ++++++
 .../skills/setup-matt-pocock-skills/domain.md |  51 +++
 .../issue-tracker-github.md                   |  22 +
 .../issue-tracker-gitlab.md                   |  23 +
 .../issue-tracker-local.md                    |  19 +
 .../setup-matt-pocock-skills/triage-labels.md |  15 +
 .agents/skills/tdd/SKILL.md                   | 109 +++++
 .agents/skills/tdd/deep-modules.md            |  33 ++
 .agents/skills/tdd/interface-design.md        |  31 ++
 .agents/skills/tdd/mocking.md                 |  59 +++
 .agents/skills/tdd/refactoring.md             |  10 +
 .agents/skills/tdd/tests.md                   |  61 +++
 .agents/skills/to-issues/SKILL.md             |  83 ++++
 .agents/skills/to-prd/SKILL.md                |  76 ++++
 .agents/skills/triage/AGENT-BRIEF.md          | 168 ++++++++
 .agents/skills/triage/OUT-OF-SCOPE.md         | 101 +++++
 .agents/skills/triage/SKILL.md                | 103 +++++
 .agents/skills/write-a-skill/SKILL.md         | 117 ++++++
 .agents/skills/zoom-out/SKILL.md              |   7 +
 AGENTS.md                                     |  13 +
 docs/agents/domain.md                         |  34 ++
 docs/agents/issue-tracker.md                  |  22 +
 docs/agents/triage-labels.md                  |  13 +
 server/src/index.ts                           |   8 +
 server/src/routes/backup.ts                   | 116 +++++
 server/src/routes/sync.ts                     |  71 +---
 server/src/services/backupService.ts          | 395 ++++++++++++++++++
 skills-lock.json                              |  89 ++++
 src/components/SettingsPanel.tsx              |  11 +-
 src/components/settings/AutoBackupPanel.tsx   | 253 +++++++++++
 src/components/settings/index.ts              |   1 +
 src/services/backendAdapter.ts                |  84 ++++
 src/services/webdavService.ts                 |  47 +++
 48 files changed, 3164 insertions(+), 70 deletions(-)
 create mode 100644 .agents/skills/caveman/SKILL.md
 create mode 100644 .agents/skills/diagnose/SKILL.md
 create mode 100644 .agents/skills/diagnose/scripts/hitl-loop.template.sh
 create mode 100644 .agents/skills/grill-me/SKILL.md
 create mode 100644 .agents/skills/grill-with-docs/ADR-FORMAT.md
 create mode 100644 .agents/skills/grill-with-docs/CONTEXT-FORMAT.md
 create mode 100644 .agents/skills/grill-with-docs/SKILL.md
 create mode 100644 .agents/skills/handoff/SKILL.md
 create mode 100644 .agents/skills/improve-codebase-architecture/DEEPENING.md
 create mode 100644 .agents/skills/improve-codebase-architecture/INTERFACE-DESIGN.md
 create mode 100644 .agents/skills/improve-codebase-architecture/LANGUAGE.md
 create mode 100644 .agents/skills/improve-codebase-architecture/SKILL.md
 create mode 100644 .agents/skills/prototype/LOGIC.md
 create mode 100644 .agents/skills/prototype/SKILL.md
 create mode 100644 .agents/skills/prototype/UI.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/SKILL.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/domain.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/issue-tracker-github.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/issue-tracker-gitlab.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/issue-tracker-local.md
 create mode 100644 .agents/skills/setup-matt-pocock-skills/triage-labels.md
 create mode 100644 .agents/skills/tdd/SKILL.md
 create mode 100644 .agents/skills/tdd/deep-modules.md
 create mode 100644 .agents/skills/tdd/interface-design.md
 create mode 100644 .agents/skills/tdd/mocking.md
 create mode 100644 .agents/skills/tdd/refactoring.md
 create mode 100644 .agents/skills/tdd/tests.md
 create mode 100644 .agents/skills/to-issues/SKILL.md
 create mode 100644 .agents/skills/to-prd/SKILL.md
 create mode 100644 .agents/skills/triage/AGENT-BRIEF.md
 create mode 100644 .agents/skills/triage/OUT-OF-SCOPE.md
 create mode 100644 .agents/skills/triage/SKILL.md
 create mode 100644 .agents/skills/write-a-skill/SKILL.md
 create mode 100644 .agents/skills/zoom-out/SKILL.md
 create mode 100644 AGENTS.md
 create mode 100644 docs/agents/domain.md
 create mode 100644 docs/agents/issue-tracker.md
 create mode 100644 docs/agents/triage-labels.md
 create mode 100644 server/src/routes/backup.ts
 create mode 100644 server/src/services/backupService.ts
 create mode 100644 skills-lock.json
 create mode 100644 src/components/settings/AutoBackupPanel.tsx

diff --git a/.agents/skills/caveman/SKILL.md b/.agents/skills/caveman/SKILL.md
new file mode 100644
index 0000000..85770a3
--- /dev/null
+++ b/.agents/skills/caveman/SKILL.md
@@ -0,0 +1,49 @@
+---
+name: caveman
+description: >
+  Ultra-compressed communication mode. Cuts token usage ~75% by dropping
+  filler, articles, and pleasantries while keeping full technical accuracy.
+  Use when user says "caveman mode", "talk like caveman", "use caveman",
+  "less tokens", "be brief", or invokes /caveman.
+---
+
+Respond terse like smart caveman. All technical substance stay. Only fluff die.
+
+## Persistence
+
+ACTIVE EVERY RESPONSE once triggered. No revert after many turns. No filler drift. Still active if unsure. Off only when user says "stop caveman" or "normal mode".
+
+## Rules
+
+Drop: articles (a/an/the), filler (just/really/basically/actually/simply), pleasantries (sure/certainly/of course/happy to), hedging. Fragments OK. Short synonyms (big not extensive, fix not "implement a solution for"). Abbreviate common terms (DB/auth/config/req/res/fn/impl). Strip conjunctions. Use arrows for causality (X -> Y). One word when one word enough.
+
+Technical terms stay exact. Code blocks unchanged. Errors quoted exact.
+
+Pattern: `[thing] [action] [reason]. [next step].`
+
+Not: "Sure! I'd be happy to help you with that. The issue you're experiencing is likely caused by..."
+Yes: "Bug in auth middleware. Token expiry check use `<` not `<=`. Fix:"
+
+### Examples
+
+**"Why React component re-render?"**
+
+> Inline obj prop -> new ref -> re-render. `useMemo`.
+
+**"Explain database connection pooling."**
+
+> Pool = reuse DB conn. Skip handshake -> fast under load.
+
+## Auto-Clarity Exception
+
+Drop caveman temporarily for: security warnings, irreversible action confirmations, multi-step sequences where fragment order risks misread, user asks to clarify or repeats question. Resume caveman after clear part done.
+
+Example -- destructive op:
+
+> **Warning:** This will permanently delete all rows in the `users` table and cannot be undone.
+>
+> ```sql
+> DROP TABLE users;
+> ```
+>
+> Caveman resume. Verify backup exist first.
diff --git a/.agents/skills/diagnose/SKILL.md b/.agents/skills/diagnose/SKILL.md
new file mode 100644
index 0000000..ed55bda
--- /dev/null
+++ b/.agents/skills/diagnose/SKILL.md
@@ -0,0 +1,117 @@
+---
+name: diagnose
+description: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says "diagnose this" / "debug this", reports a bug, says something is broken/throwing/failing, or describes a performance regression.
+---
+
+# Diagnose
+
+A discipline for hard bugs. Skip phases only when explicitly justified.
+
+When exploring the codebase, use the project's domain glossary to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.
+
+## Phase 1 — Build a feedback loop
+
+**This is the skill.** Everything else is mechanical. If you have a fast, deterministic, agent-runnable pass/fail signal for the bug, you will find the cause — bisection, hypothesis-testing, and instrumentation all just consume that signal. If you don't have one, no amount of staring at code will save you.
+
+Spend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**
+
+### Ways to construct one — try them in roughly this order
+
+1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.
+2. **Curl / HTTP script** against a running dev server.
+3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.
+4. **Headless browser script** (Playwright / Puppeteer) — drives the UI, asserts on DOM/console/network.
+5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.
+6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.
+7. **Property / fuzz loop.** If the bug is "sometimes wrong output", run 1000 random inputs and look for the failure mode.
+8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate "boot at state X, check, repeat" so you can `git bisect run` it.
+9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.
+10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.
+
+Build the right feedback loop, and the bug is 90% fixed.
+
+### Iterate on the loop itself
+
+Treat the loop as a product. Once you have _a_ loop, ask:
+
+- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)
+- Can I make the signal sharper? (Assert on the specific symptom, not "didn't crash".)
+- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)
+
+A 30-second flaky loop is barely better than no loop. A 2-second deterministic loop is a debugging superpower.
+
+### Non-deterministic bugs
+
+The goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.
+
+### When you genuinely cannot build a loop
+
+Stop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.
+
+Do not proceed to Phase 2 until you have a loop you believe in.
+
+## Phase 2 — Reproduce
+
+Run the loop. Watch the bug appear.
+
+Confirm:
+
+- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.
+- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).
+- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.
+
+Do not proceed until you reproduce the bug.
+
+## Phase 3 — Hypothesise
+
+Generate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.
+
+Each hypothesis must be **falsifiable**: state the prediction it makes.
+
+> Format: "If <X> is the cause, then <changing Y> will make the bug disappear / <changing Z> will make it worse."
+
+If you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.
+
+**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly ("we just deployed a change to #3"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.
+
+## Phase 4 — Instrument
+
+Each probe must map to a specific prediction from Phase 3. **Change one variable at a time.**
+
+Tool preference:
+
+1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.
+2. **Targeted logs** at the boundaries that distinguish hypotheses.
+3. Never "log everything and grep".
+
+**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.
+
+**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.
+
+## Phase 5 — Fix + regression test
+
+Write the regression test **before the fix** — but only if there is a **correct seam** for it.
+
+A correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.
+
+**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.
+
+If a correct seam exists:
+
+1. Turn the minimised repro into a failing test at that seam.
+2. Watch it fail.
+3. Apply the fix.
+4. Watch it pass.
+5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.
+
+## Phase 6 — Cleanup + post-mortem
+
+Required before declaring done:
+
+- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)
+- [ ] Regression test passes (or absence of seam is documented)
+- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)
+- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)
+- [ ] The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns
+
+**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `/improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started.
diff --git a/.agents/skills/diagnose/scripts/hitl-loop.template.sh b/.agents/skills/diagnose/scripts/hitl-loop.template.sh
new file mode 100644
index 0000000..40afc46
--- /dev/null
+++ b/.agents/skills/diagnose/scripts/hitl-loop.template.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Human-in-the-loop reproduction loop.
+# Copy this file, edit the steps below, and run it.
+# The agent runs the script; the user follows prompts in their terminal.
+#
+# Usage:
+#   bash hitl-loop.template.sh
+#
+# Two helpers:
+#   step "<instruction>"          → show instruction, wait for Enter
+#   capture VAR "<question>"      → show question, read response into VAR
+#
+# At the end, captured values are printed as KEY=VALUE for the agent to parse.
+
+set -euo pipefail
+
+step() {
+  printf '\n>>> %s\n' "$1"
+  read -r -p "    [Enter when done] " _
+}
+
+capture() {
+  local var="$1" question="$2" answer
+  printf '\n>>> %s\n' "$question"
+  read -r -p "    > " answer
+  printf -v "$var" '%s' "$answer"
+}
+
+# --- edit below ---------------------------------------------------------
+
+step "Open the app at http://localhost:3000 and sign in."
+
+capture ERRORED "Click the 'Export' button. Did it throw an error? (y/n)"
+
+capture ERROR_MSG "Paste the error message (or 'none'):"
+
+# --- edit above ---------------------------------------------------------
+
+printf '\n--- Captured ---\n'
+printf 'ERRORED=%s\n' "$ERRORED"
+printf 'ERROR_MSG=%s\n' "$ERROR_MSG"
diff --git a/.agents/skills/grill-me/SKILL.md b/.agents/skills/grill-me/SKILL.md
new file mode 100644
index 0000000..bd04394
--- /dev/null
+++ b/.agents/skills/grill-me/SKILL.md
@@ -0,0 +1,10 @@
+---
+name: grill-me
+description: Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".
+---
+
+Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
+
+Ask the questions one at a time.
+
+If a question can be answered by exploring the codebase, explore the codebase instead.
diff --git a/.agents/skills/grill-with-docs/ADR-FORMAT.md b/.agents/skills/grill-with-docs/ADR-FORMAT.md
new file mode 100644
index 0000000..da7e78e
--- /dev/null
+++ b/.agents/skills/grill-with-docs/ADR-FORMAT.md
@@ -0,0 +1,47 @@
+# ADR Format
+
+ADRs live in `docs/adr/` and use sequential numbering: `0001-slug.md`, `0002-slug.md`, etc.
+
+Create the `docs/adr/` directory lazily — only when the first ADR is needed.
+
+## Template
+
+```md
+# {Short title of the decision}
+
+{1-3 sentences: what's the context, what did we decide, and why.}
+```
+
+That's it. An ADR can be a single paragraph. The value is in recording *that* a decision was made and *why* — not in filling out sections.
+
+## Optional sections
+
+Only include these when they add genuine value. Most ADRs won't need them.
+
+- **Status** frontmatter (`proposed | accepted | deprecated | superseded by ADR-NNNN`) — useful when decisions are revisited
+- **Considered Options** — only when the rejected alternatives are worth remembering
+- **Consequences** — only when non-obvious downstream effects need to be called out
+
+## Numbering
+
+Scan `docs/adr/` for the highest existing number and increment by one.
+
+## When to offer an ADR
+
+All three of these must be true:
+
+1. **Hard to reverse** — the cost of changing your mind later is meaningful
+2. **Surprising without context** — a future reader will look at the code and wonder "why on earth did they do it this way?"
+3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons
+
+If a decision is easy to reverse, skip it — you'll just reverse it. If it's not surprising, nobody will wonder why. If there was no real alternative, there's nothing to record beyond "we did the obvious thing."
+
+### What qualifies
+
+- **Architectural shape.** "We're using a monorepo." "The write model is event-sourced, the read model is projected into Postgres."
+- **Integration patterns between contexts.** "Ordering and Billing communicate via domain events, not synchronous HTTP."
+- **Technology choices that carry lock-in.** Database, message bus, auth provider, deployment target. Not every library — just the ones that would take a quarter to swap out.
+- **Boundary and scope decisions.** "Customer data is owned by the Customer context; other contexts reference it by ID only." The explicit no-s are as valuable as the yes-s.
+- **Deliberate deviations from the obvious path.** "We're using manual SQL instead of an ORM because X." Anything where a reasonable reader would assume the opposite. These stop the next engineer from "fixing" something that was deliberate.
+- **Constraints not visible in the code.** "We can't use AWS because of compliance requirements." "Response times must be under 200ms because of the partner API contract."
+- **Rejected alternatives when the rejection is non-obvious.** If you considered GraphQL and picked REST for subtle reasons, record it — otherwise someone will suggest GraphQL again in six months.
diff --git a/.agents/skills/grill-with-docs/CONTEXT-FORMAT.md b/.agents/skills/grill-with-docs/CONTEXT-FORMAT.md
new file mode 100644
index 0000000..ddfa247
--- /dev/null
+++ b/.agents/skills/grill-with-docs/CONTEXT-FORMAT.md
@@ -0,0 +1,77 @@
+# CONTEXT.md Format
+
+## Structure
+
+```md
+# {Context Name}
+
+{One or two sentence description of what this context is and why it exists.}
+
+## Language
+
+**Order**:
+{A concise description of the term}
+_Avoid_: Purchase, transaction
+
+**Invoice**:
+A request for payment sent to a customer after delivery.
+_Avoid_: Bill, payment request
+
+**Customer**:
+A person or organization that places orders.
+_Avoid_: Client, buyer, account
+
+## Relationships
+
+- An **Order** produces one or more **Invoices**
+- An **Invoice** belongs to exactly one **Customer**
+
+## Example dialogue
+
+> **Dev:** "When a **Customer** places an **Order**, do we create the **Invoice** immediately?"
+> **Domain expert:** "No — an **Invoice** is only generated once a **Fulfillment** is confirmed."
+
+## Flagged ambiguities
+
+- "account" was used to mean both **Customer** and **User** — resolved: these are distinct concepts.
+```
+
+## Rules
+
+- **Be opinionated.** When multiple words exist for the same concept, pick the best one and list the others as aliases to avoid.
+- **Flag conflicts explicitly.** If a term is used ambiguously, call it out in "Flagged ambiguities" with a clear resolution.
+- **Keep definitions tight.** One sentence max. Define what it IS, not what it does.
+- **Show relationships.** Use bold term names and express cardinality where obvious.
+- **Only include terms specific to this project's context.** General programming concepts (timeouts, error types, utility patterns) don't belong even if the project uses them extensively. Before adding a term, ask: is this a concept unique to this context, or a general programming concept? Only the former belongs.
+- **Group terms under subheadings** when natural clusters emerge. If all terms belong to a single cohesive area, a flat list is fine.
+- **Write an example dialogue.** A conversation between a dev and a domain expert that demonstrates how the terms interact naturally and clarifies boundaries between related concepts.
+
+## Single vs multi-context repos
+
+**Single context (most repos):** One `CONTEXT.md` at the repo root.
+
+**Multiple contexts:** A `CONTEXT-MAP.md` at the repo root lists the contexts, where they live, and how they relate to each other:
+
+```md
+# Context Map
+
+## Contexts
+
+- [Ordering](./src/ordering/CONTEXT.md) — receives and tracks customer orders
+- [Billing](./src/billing/CONTEXT.md) — generates invoices and processes payments
+- [Fulfillment](./src/fulfillment/CONTEXT.md) — manages warehouse picking and shipping
+
+## Relationships
+
+- **Ordering → Fulfillment**: Ordering emits `OrderPlaced` events; Fulfillment consumes them to start picking
+- **Fulfillment → Billing**: Fulfillment emits `ShipmentDispatched` events; Billing consumes them to generate invoices
+- **Ordering ↔ Billing**: Shared types for `CustomerId` and `Money`
+```
+
+The skill infers which structure applies:
+
+- If `CONTEXT-MAP.md` exists, read it to find contexts
+- If only a root `CONTEXT.md` exists, single context
+- If neither exists, create a root `CONTEXT.md` lazily when the first term is resolved
+
+When multiple contexts exist, infer which one the current topic relates to. If unclear, ask.
diff --git a/.agents/skills/grill-with-docs/SKILL.md b/.agents/skills/grill-with-docs/SKILL.md
new file mode 100644
index 0000000..6dad6ad
--- /dev/null
+++ b/.agents/skills/grill-with-docs/SKILL.md
@@ -0,0 +1,88 @@
+---
+name: grill-with-docs
+description: Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.
+---
+
+<what-to-do>
+
+Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
+
+Ask the questions one at a time, waiting for feedback on each question before continuing.
+
+If a question can be answered by exploring the codebase, explore the codebase instead.
+
+</what-to-do>
+
+<supporting-info>
+
+## Domain awareness
+
+During codebase exploration, also look for existing documentation:
+
+### File structure
+
+Most repos have a single context:
+
+```
+/
+├── CONTEXT.md
+├── docs/
+│   └── adr/
+│       ├── 0001-event-sourced-orders.md
+│       └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+If a `CONTEXT-MAP.md` exists at the root, the repo has multiple contexts. The map points to where each one lives:
+
+```
+/
+├── CONTEXT-MAP.md
+├── docs/
+│   └── adr/                          ← system-wide decisions
+├── src/
+│   ├── ordering/
+│   │   ├── CONTEXT.md
+│   │   └── docs/adr/                 ← context-specific decisions
+│   └── billing/
+│       ├── CONTEXT.md
+│       └── docs/adr/
+```
+
+Create files lazily — only when you have something to write. If no `CONTEXT.md` exists, create one when the first term is resolved. If no `docs/adr/` exists, create it when the first ADR is needed.
+
+## During the session
+
+### Challenge against the glossary
+
+When the user uses a term that conflicts with the existing language in `CONTEXT.md`, call it out immediately. "Your glossary defines 'cancellation' as X, but you seem to mean Y — which is it?"
+
+### Sharpen fuzzy language
+
+When the user uses vague or overloaded terms, propose a precise canonical term. "You're saying 'account' — do you mean the Customer or the User? Those are different things."
+
+### Discuss concrete scenarios
+
+When domain relationships are being discussed, stress-test them with specific scenarios. Invent scenarios that probe edge cases and force the user to be precise about the boundaries between concepts.
+
+### Cross-reference with code
+
+When the user states how something works, check whether the code agrees. If you find a contradiction, surface it: "Your code cancels entire Orders, but you just said partial cancellation is possible — which is right?"
+
+### Update CONTEXT.md inline
+
+When a term is resolved, update `CONTEXT.md` right there. Don't batch these up — capture them as they happen. Use the format in [CONTEXT-FORMAT.md](./CONTEXT-FORMAT.md).
+
+Don't couple `CONTEXT.md` to implementation details. Only include terms that are meaningful to domain experts.
+
+### Offer ADRs sparingly
+
+Only offer to create an ADR when all three are true:
+
+1. **Hard to reverse** — the cost of changing your mind later is meaningful
+2. **Surprising without context** — a future reader will wonder "why did they do it this way?"
+3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons
+
+If any of the three is missing, skip the ADR. Use the format in [ADR-FORMAT.md](./ADR-FORMAT.md).
+
+</supporting-info>
diff --git a/.agents/skills/handoff/SKILL.md b/.agents/skills/handoff/SKILL.md
new file mode 100644
index 0000000..28bfb3a
--- /dev/null
+++ b/.agents/skills/handoff/SKILL.md
@@ -0,0 +1,13 @@
+---
+name: handoff
+description: Compact the current conversation into a handoff document for another agent to pick up.
+argument-hint: "What will the next session be used for?"
+---
+
+Write a handoff document summarising the current conversation so a fresh agent can continue the work. Save it to a path produced by `mktemp -t handoff-XXXXXX.md` (read the file before you write to it).
+
+Suggest the skills to be used, if any, by the next session.
+
+Do not duplicate content already captured in other artifacts (PRDs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead.
+
+If the user passed arguments, treat them as a description of what the next session will focus on and tailor the doc accordingly.
diff --git a/.agents/skills/improve-codebase-architecture/DEEPENING.md b/.agents/skills/improve-codebase-architecture/DEEPENING.md
new file mode 100644
index 0000000..ecaf5d7
--- /dev/null
+++ b/.agents/skills/improve-codebase-architecture/DEEPENING.md
@@ -0,0 +1,37 @@
+# Deepening
+
+How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**, **seam**, **adapter**.
+
+## Dependency categories
+
+When assessing a candidate for deepening, classify its dependencies. The category determines how the deepened module is tested across its seam.
+
+### 1. In-process
+
+Pure computation, in-memory state, no I/O. Always deepenable — merge the modules and test through the new interface directly. No adapter needed.
+
+### 2. Local-substitutable
+
+Dependencies that have local test stand-ins (PGLite for Postgres, in-memory filesystem). Deepenable if the stand-in exists. The deepened module is tested with the stand-in running in the test suite. The seam is internal; no port at the module's external interface.
+
+### 3. Remote but owned (Ports & Adapters)
+
+Your own services across a network boundary (microservices, internal APIs). Define a **port** (interface) at the seam. The deep module owns the logic; the transport is injected as an **adapter**. Tests use an in-memory adapter. Production uses an HTTP/gRPC/queue adapter.
+
+Recommendation shape: *"Define a port at the seam, implement an HTTP adapter for production and an in-memory adapter for testing, so the logic sits in one deep module even though it's deployed across a network."*
+
+### 4. True external (Mock)
+
+Third-party services (Stripe, Twilio, etc.) you don't control. The deepened module takes the external dependency as an injected port; tests provide a mock adapter.
+
+## Seam discipline
+
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a port unless at least two adapters are justified (typically production + test). A single-adapter seam is just indirection.
+- **Internal seams vs external seams.** A deep module can have internal seams (private to its implementation, used by its own tests) as well as the external seam at its interface. Don't expose internal seams through the interface just because tests use them.
+
+## Testing strategy: replace, don't layer
+
+- Old unit tests on shallow modules become waste once tests at the deepened module's interface exist — delete them.
+- Write new tests at the deepened module's interface. The **interface is the test surface**.
+- Tests assert on observable outcomes through the interface, not internal state.
+- Tests should survive internal refactors — they describe behaviour, not implementation. If a test has to change when the implementation changes, it's testing past the interface.
diff --git a/.agents/skills/improve-codebase-architecture/INTERFACE-DESIGN.md b/.agents/skills/improve-codebase-architecture/INTERFACE-DESIGN.md
new file mode 100644
index 0000000..3197723
--- /dev/null
+++ b/.agents/skills/improve-codebase-architecture/INTERFACE-DESIGN.md
@@ -0,0 +1,44 @@
+# Interface Design
+
+When the user wants to explore alternative interfaces for a chosen deepening candidate, use this parallel sub-agent pattern. Based on "Design It Twice" (Ousterhout) — your first idea is unlikely to be the best.
+
+Uses the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**, **seam**, **adapter**, **leverage**.
+
+## Process
+
+### 1. Frame the problem space
+
+Before spawning sub-agents, write a user-facing explanation of the problem space for the chosen candidate:
+
+- The constraints any new interface would need to satisfy
+- The dependencies it would rely on, and which category they fall into (see [DEEPENING.md](DEEPENING.md))
+- A rough illustrative code sketch to ground the constraints — not a proposal, just a way to make the constraints concrete
+
+Show this to the user, then immediately proceed to Step 2. The user reads and thinks while the sub-agents work in parallel.
+
+### 2. Spawn sub-agents
+
+Spawn 3+ sub-agents in parallel using the Agent tool. Each must produce a **radically different** interface for the deepened module.
+
+Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [DEEPENING.md](DEEPENING.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint:
+
+- Agent 1: "Minimize the interface — aim for 1–3 entry points max. Maximise leverage per entry point."
+- Agent 2: "Maximise flexibility — support many use cases and extension."
+- Agent 3: "Optimise for the most common caller — make the default case trivial."
+- Agent 4 (if applicable): "Design around ports & adapters for cross-seam dependencies."
+
+Include both [LANGUAGE.md](LANGUAGE.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language.
+
+Each sub-agent outputs:
+
+1. Interface (types, methods, params — plus invariants, ordering, error modes)
+2. Usage example showing how callers use it
+3. What the implementation hides behind the seam
+4. Dependency strategy and adapters (see [DEEPENING.md](DEEPENING.md))
+5. Trade-offs — where leverage is high, where it's thin
+
+### 3. Present and compare
+
+Present designs sequentially so the user can absorb each one, then compare them in prose. Contrast by **depth** (leverage at the interface), **locality** (where change concentrates), and **seam placement**.
+
+After comparing, give your own recommendation: which design you think is strongest and why. If elements from different designs would combine well, propose a hybrid. Be opinionated — the user wants a strong read, not a menu.
diff --git a/.agents/skills/improve-codebase-architecture/LANGUAGE.md b/.agents/skills/improve-codebase-architecture/LANGUAGE.md
new file mode 100644
index 0000000..530c276
--- /dev/null
+++ b/.agents/skills/improve-codebase-architecture/LANGUAGE.md
@@ -0,0 +1,53 @@
+# Language
+
+Shared vocabulary for every suggestion this skill makes. Use these terms exactly — don't substitute "component," "service," "API," or "boundary." Consistent language is the whole point.
+
+## Terms
+
+**Module**
+Anything with an interface and an implementation. Deliberately scale-agnostic — applies equally to a function, class, package, or tier-spanning slice.
+_Avoid_: unit, component, service.
+
+**Interface**
+Everything a caller must know to use the module correctly. Includes the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics.
+_Avoid_: API, signature (too narrow — those refer only to the type-level surface).
+
+**Implementation**
+What's inside a module — its body of code. Distinct from **Adapter**: a thing can be a small adapter with a large implementation (a Postgres repo) or a large adapter with a small implementation (an in-memory fake). Reach for "adapter" when the seam is the topic; "implementation" otherwise.
+
+**Depth**
+Leverage at the interface — the amount of behaviour a caller (or test) can exercise per unit of interface they have to learn. A module is **deep** when a large amount of behaviour sits behind a small interface. A module is **shallow** when the interface is nearly as complex as the implementation.
+
+**Seam** _(from Michael Feathers)_
+A place where you can alter behaviour without editing in that place. The *location* at which a module's interface lives. Choosing where to put the seam is its own design decision, distinct from what goes behind it.
+_Avoid_: boundary (overloaded with DDD's bounded context).
+
+**Adapter**
+A concrete thing that satisfies an interface at a seam. Describes *role* (what slot it fills), not substance (what's inside).
+
+**Leverage**
+What callers get from depth. More capability per unit of interface they have to learn. One implementation pays back across N call sites and M tests.
+
+**Locality**
+What maintainers get from depth. Change, bugs, knowledge, and verification concentrate at one place rather than spreading across callers. Fix once, fixed everywhere.
+
+## Principles
+
+- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable, swappable parts — they just aren't part of the interface. A module can have **internal seams** (private to its implementation, used by its own tests) as well as the **external seam** at its interface.
+- **The deletion test.** Imagine deleting the module. If complexity vanishes, the module wasn't hiding anything (it was a pass-through). If complexity reappears across N callers, the module was earning its keep.
+- **The interface is the test surface.** Callers and tests cross the same seam. If you want to test *past* the interface, the module is probably the wrong shape.
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a seam unless something actually varies across it.
+
+## Relationships
+
+- A **Module** has exactly one **Interface** (the surface it presents to callers and tests).
+- **Depth** is a property of a **Module**, measured against its **Interface**.
+- A **Seam** is where a **Module**'s **Interface** lives.
+- An **Adapter** sits at a **Seam** and satisfies the **Interface**.
+- **Depth** produces **Leverage** for callers and **Locality** for maintainers.
+
+## Rejected framings
+
+- **Depth as ratio of implementation-lines to interface-lines** (Ousterhout): rewards padding the implementation. We use depth-as-leverage instead.
+- **"Interface" as the TypeScript `interface` keyword or a class's public methods**: too narrow — interface here includes every fact a caller must know.
+- **"Boundary"**: overloaded with DDD's bounded context. Say **seam** or **interface**.
diff --git a/.agents/skills/improve-codebase-architecture/SKILL.md b/.agents/skills/improve-codebase-architecture/SKILL.md
new file mode 100644
index 0000000..05984a6
--- /dev/null
+++ b/.agents/skills/improve-codebase-architecture/SKILL.md
@@ -0,0 +1,71 @@
+---
+name: improve-codebase-architecture
+description: Find deepening opportunities in a codebase, informed by the domain language in CONTEXT.md and the decisions in docs/adr/. Use when the user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more testable and AI-navigable.
+---
+
+# Improve Codebase Architecture
+
+Surface architectural friction and propose **deepening opportunities** — refactors that turn shallow modules into deep ones. The aim is testability and AI-navigability.
+
+## Glossary
+
+Use these terms exactly in every suggestion. Consistent language is the point — don't drift into "component," "service," "API," or "boundary." Full definitions in [LANGUAGE.md](LANGUAGE.md).
+
+- **Module** — anything with an interface and an implementation (function, class, package, slice).
+- **Interface** — everything a caller must know to use the module: types, invariants, error modes, ordering, config. Not just the type signature.
+- **Implementation** — the code inside.
+- **Depth** — leverage at the interface: a lot of behaviour behind a small interface. **Deep** = high leverage. **Shallow** = interface nearly as complex as the implementation.
+- **Seam** — where an interface lives; a place behaviour can be altered without editing in place. (Use this, not "boundary.")
+- **Adapter** — a concrete thing satisfying an interface at a seam.
+- **Leverage** — what callers get from depth.
+- **Locality** — what maintainers get from depth: change, bugs, knowledge concentrated in one place.
+
+Key principles (see [LANGUAGE.md](LANGUAGE.md) for the full list):
+
+- **Deletion test**: imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep.
+- **The interface is the test surface.**
+- **One adapter = hypothetical seam. Two adapters = real seam.**
+
+This skill is _informed_ by the project's domain model. The domain language gives names to good seams; ADRs record decisions the skill should not re-litigate.
+
+## Process
+
+### 1. Explore
+
+Read the project's domain glossary and any ADRs in the area you're touching first.
+
+Then use the Agent tool with `subagent_type=Explore` to walk the codebase. Don't follow rigid heuristics — explore organically and note where you experience friction:
+
+- Where does understanding one concept require bouncing between many small modules?
+- Where are modules **shallow** — interface nearly as complex as the implementation?
+- Where have pure functions been extracted just for testability, but the real bugs hide in how they're called (no **locality**)?
+- Where do tightly-coupled modules leak across their seams?
+- Which parts of the codebase are untested, or hard to test through their current interface?
+
+Apply the **deletion test** to anything you suspect is shallow: would deleting it concentrate complexity, or just move it? A "yes, concentrates" is the signal you want.
+
+### 2. Present candidates
+
+Present a numbered list of deepening opportunities. For each candidate:
+
+- **Files** — which files/modules are involved
+- **Problem** — why the current architecture is causing friction
+- **Solution** — plain English description of what would change
+- **Benefits** — explained in terms of locality and leverage, and also in how tests would improve
+
+**Use CONTEXT.md vocabulary for the domain, and [LANGUAGE.md](LANGUAGE.md) vocabulary for the architecture.** If `CONTEXT.md` defines "Order," talk about "the Order intake module" — not "the FooBarHandler," and not "the Order service."
+
+**ADR conflicts**: if a candidate contradicts an existing ADR, only surface it when the friction is real enough to warrant revisiting the ADR. Mark it clearly (e.g. _"contradicts ADR-0007 — but worth reopening because…"_). Don't list every theoretical refactor an ADR forbids.
+
+Do NOT propose interfaces yet. Ask the user: "Which of these would you like to explore?"
+
+### 3. Grilling loop
+
+Once the user picks a candidate, drop into a grilling conversation. Walk the design tree with them — constraints, dependencies, the shape of the deepened module, what sits behind the seam, what tests survive.
+
+Side effects happen inline as decisions crystallize:
+
+- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md` — same discipline as `/grill-with-docs` (see [CONTEXT-FORMAT.md](../grill-with-docs/CONTEXT-FORMAT.md)). Create the file lazily if it doesn't exist.
+- **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.
+- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing — skip ephemeral reasons ("not worth it right now") and self-evident ones. See [ADR-FORMAT.md](../grill-with-docs/ADR-FORMAT.md).
+- **Want to explore alternative interfaces for the deepened module?** See [INTERFACE-DESIGN.md](INTERFACE-DESIGN.md).
diff --git a/.agents/skills/prototype/LOGIC.md b/.agents/skills/prototype/LOGIC.md
new file mode 100644
index 0000000..526ecb1
--- /dev/null
+++ b/.agents/skills/prototype/LOGIC.md
@@ -0,0 +1,79 @@
+# Logic Prototype
+
+A tiny interactive terminal app that lets the user drive a state model by hand. Use this when the question is about **business logic, state transitions, or data shape** — the kind of thing that looks reasonable on paper but only feels wrong once you push it through real cases.
+
+## When this is the right shape
+
+- "I'm not sure if this state machine handles the edge case where X then Y."
+- "Does this data model actually let me represent the case where..."
+- "I want to feel out what the API should look like before writing it."
+- Anything where the user wants to **press buttons and watch state change**.
+
+If the question is "what should this look like" — wrong branch. Use [UI.md](UI.md).
+
+## Process
+
+### 1. State the question
+
+Before writing code, write down what state model and what question you're prototyping. One paragraph, in the prototype's README or a comment at the top of the file. A logic prototype that answers the wrong question is pure waste — make the question explicit so it can be checked later, whether the user is watching now or returning to it AFK.
+
+### 2. Pick the language
+
+Use whatever the host project uses. If the project has no obvious runtime (e.g. a docs repo), ask.
+
+Match the project's existing conventions for tooling — don't add a new package manager or runtime just for the prototype.
+
+### 3. Isolate the logic in a portable module
+
+Put the actual logic — the bit that's answering the question — behind a small, pure interface that could be lifted out and dropped into the real codebase later. The TUI around it is throwaway; the logic module shouldn't be.
+
+The right shape depends on the question:
+
+- **A pure reducer** — `(state, action) => state`. Good when actions are discrete events and state is a single value.
+- **A state machine** — explicit states and transitions. Good when "which actions are even legal right now" is part of the question.
+- **A small set of pure functions** over a plain data type. Good when there's no implicit current state — just transformations.
+- **A class or module with a clear method surface** when the logic genuinely owns ongoing internal state.
+
+Pick whichever shape best fits the question being asked, *not* whichever is easiest to wire to a TUI. Keep it pure: no I/O, no terminal code, no `console.log` for control flow. The TUI imports it and calls into it; nothing flows the other direction.
+
+This is what makes the prototype useful past its own lifetime. When the question's been answered, the validated reducer / machine / function set can be lifted into the real module — the TUI shell gets deleted.
+
+### 4. Build the smallest TUI that exposes the state
+
+Build it as a **lightweight TUI** — on every tick, clear the screen (`console.clear()` / `print("\033[2J\033[H")` / equivalent) and re-render the whole frame. The user should always see one stable view, not an ever-growing scrollback.
+
+Each frame has two parts, in this order:
+
+1. **Current state**, pretty-printed and diff-friendly (one field per line, or formatted JSON). Use **bold** for field names or section headers and **dim** for less important context (timestamps, IDs, derived values). Native ANSI escape codes are fine — `\x1b[1m` bold, `\x1b[2m` dim, `\x1b[0m` reset. No need to pull in a styling library unless one is already in the project.
+2. **Keyboard shortcuts**, listed at the bottom: `[a] add user  [d] delete user  [t] tick clock  [q] quit`. Bold the key, dim the description, or vice-versa — whatever reads cleanly.
+
+Behaviour:
+
+1. **Initialise state** — a single in-memory object/struct. Render the first frame on start.
+2. **Read one keystroke (or one line)** at a time, dispatch to a handler that mutates state.
+3. **Re-render** the full frame after every action — don't append, replace.
+4. **Loop until quit.**
+
+The whole frame should fit on one screen.
+
+### 5. Make it runnable in one command
+
+Add a script to the project's existing task runner (`package.json` scripts, `Makefile`, `justfile`, `pyproject.toml`). The user should run `pnpm run <prototype-name>` or equivalent — never need to remember a path.
+
+If the host project has no task runner, just put the command at the top of the prototype's README.
+
+### 6. Hand it over
+
+Give the user the run command. They'll drive it themselves; the interesting moments are when they say "wait, that shouldn't be possible" or "huh, I assumed X would be different" — those are the bugs in the _idea_, which is the whole point. If they want new actions added, add them. Prototypes evolve.
+
+### 7. Capture the answer
+
+When the prototype has done its job, the answer to the question is the only thing worth keeping. If the user is around, ask what it taught them. If not, leave a `NOTES.md` next to the prototype so the answer can be filled in (or filled in by you, if you've watched the session) before the prototype gets deleted.
+
+## Anti-patterns
+
+- **Don't add tests.** A prototype that needs tests is no longer a prototype.
+- **Don't wire it to the real database.** Use an in-memory store unless the question is specifically about persistence.
+- **Don't generalise.** No "what if we wanted to support X later." The prototype answers one question.
+- **Don't blur the logic and the TUI together.** If the reducer / state machine references `console.log`, prompts, or terminal escape codes, it's no longer portable. Keep the TUI as a thin shell over a pure module.
+- **Don't ship the TUI shell into production.** The shell is optimised for being driven by hand from a terminal. The logic module behind it is the bit worth keeping.
diff --git a/.agents/skills/prototype/SKILL.md b/.agents/skills/prototype/SKILL.md
new file mode 100644
index 0000000..8bd99d8
--- /dev/null
+++ b/.agents/skills/prototype/SKILL.md
@@ -0,0 +1,30 @@
+---
+name: prototype
+description: Build a throwaway prototype to flush out a design before committing to it. Routes between two branches — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route. Use when the user wants to prototype, sanity-check a data model or state machine, mock up a UI, explore design options, or says "prototype this", "let me play with it", "try a few designs".
+---
+
+# Prototype
+
+A prototype is **throwaway code that answers a question**. The question decides the shape.
+
+## Pick a branch
+
+Identify which question is being answered — from the user's prompt, the surrounding code, or by asking if the user is around:
+
+- **"Does this logic / state model feel right?"** → [LOGIC.md](LOGIC.md). Build a tiny interactive terminal app that pushes the state machine through cases that are hard to reason about on paper.
+- **"What should this look like?"** → [UI.md](UI.md). Generate several radically different UI variations on a single route, switchable via a URL search param and a floating bottom bar.
+
+The two branches produce very different artifacts — getting this wrong wastes the whole prototype. If the question is genuinely ambiguous and the user isn't reachable, default to whichever branch better matches the surrounding code (a backend module → logic; a page or component → UI) and state the assumption at the top of the prototype.
+
+## Rules that apply to both
+
+1. **Throwaway from day one, and clearly marked as such.** Locate the prototype code close to where it will actually be used (next to the module or page it's prototyping for) so context is obvious — but name it so a casual reader can see it's a prototype, not production. For throwaway UI routes, obey whatever routing convention the project already uses; don't invent a new top-level structure.
+2. **One command to run.** Whatever the project's existing task runner supports — `pnpm <name>`, `python <path>`, `bun <path>`, etc. The user must be able to start it without thinking.
+3. **No persistence by default.** State lives in memory. Persistence is the thing the prototype is *checking*, not something it should depend on. If the question explicitly involves a database, hit a scratch DB or a local file with a clear "PROTOTYPE — wipe me" name.
+4. **Skip the polish.** No tests, no error handling beyond what makes the prototype *runnable*, no abstractions. The point is to learn something fast and then delete it.
+5. **Surface the state.** After every action (logic) or on every variant switch (UI), print or render the full relevant state so the user can see what changed.
+6. **Delete or absorb when done.** When the prototype has answered its question, either delete it or fold the validated decision into the real code — don't leave it rotting in the repo.
+
+## When done
+
+The *answer* is the only thing worth keeping from a prototype. Capture it somewhere durable (commit message, ADR, issue, or a `NOTES.md` next to the prototype) along with the question it was answering. If the user is around, that capture is a quick conversation; if not, leave the placeholder so they (or you, on the next pass) can fill in the verdict before deleting the prototype.
diff --git a/.agents/skills/prototype/UI.md b/.agents/skills/prototype/UI.md
new file mode 100644
index 0000000..f3b6e64
--- /dev/null
+++ b/.agents/skills/prototype/UI.md
@@ -0,0 +1,112 @@
+# UI Prototype
+
+Generate **several radically different UI variations** on a single route, switchable from a floating bottom bar. The user flips between variants in the browser, picks one (or steals bits from each), then throws the rest away.
+
+If the question is about logic/state rather than what something looks like — wrong branch. Use [LOGIC.md](LOGIC.md).
+
+## When this is the right shape
+
+- "What should this page look like?"
+- "I want to see a few options for this dashboard before committing."
+- "Try a different layout for the settings screen."
+- Any time the user would otherwise spend a day picking between three vague mockups in their head.
+
+## Two sub-shapes — strongly prefer sub-shape A
+
+A UI prototype is much easier to judge when it's **butting up against the rest of the app** — real header, real sidebar, real data, real density. A throwaway route on its own is a vacuum: every variant looks fine in isolation. Default to sub-shape A whenever there's a plausible existing page to host the variants. Only reach for sub-shape B if the prototype genuinely has no nearby home.
+
+### Sub-shape A — adjustment to an existing page (preferred)
+
+The route already exists. Variants are rendered **on the same route**, gated by a `?variant=` URL search param. The existing data fetching, params, and auth all stay — only the rendering swaps. This is the default; pick it unless there's a specific reason not to.
+
+If the prototype is for something that doesn't yet have a page but *would naturally live inside one* (a new section of the dashboard, a new card on the settings screen, a new step in an existing flow) — that's still sub-shape A. Mount the variants inside the host page.
+
+### Sub-shape B — a new page (last resort)
+
+Only use this when the thing being prototyped genuinely has no existing page to live inside — e.g. an entirely new top-level surface, or a flow that can't be embedded anywhere sensible.
+
+Create a **throwaway route** following whatever routing convention the project already uses — don't invent a new top-level structure. Name it so it's obviously a prototype (e.g. include the word `prototype` in the path or filename). Same `?variant=` pattern.
+
+Before committing to sub-shape B, sanity-check: is there really no existing page this could be embedded in? An empty route hides design problems that a populated one would expose.
+
+In both sub-shapes the floating bottom bar is identical.
+
+## Process
+
+### 1. State the question and pick N
+
+Default to **3 variants**. More than 5 stops being radically different and starts being noise — cap there.
+
+Write down the plan in one line, in the prototype's location or a top-of-file comment:
+
+> "Three variants of the settings page, switchable via `?variant=`, on the existing `/settings` route."
+
+This works whether the user is here to push back or not.
+
+### 2. Generate radically different variants
+
+Draft each variant. Hold each one to:
+
+- The page's purpose and the data it has access to.
+- The project's component library / styling system (TailwindCSS, shadcn, MUI, plain CSS, whatever).
+- A clear exported component name, e.g. `VariantA`, `VariantB`, `VariantC`.
+
+Variants must be **structurally different** — different layout, different information hierarchy, different primary affordance, not just different colours. Three slightly-tweaked card grids isn't a UI prototype, it's wallpaper. If two drafts come out too similar, redo one with explicit "do not use a card grid" guidance.
+
+### 3. Wire them together
+
+Create a single switcher component on the route:
+
+```tsx
+// pseudo-code — adapt to the project's framework
+const variant = searchParams.get('variant') ?? 'A';
+return (
+  <>
+    {variant === 'A' && <VariantA {...data} />}
+    {variant === 'B' && <VariantB {...data} />}
+    {variant === 'C' && <VariantC {...data} />}
+    <PrototypeSwitcher variants={['A','B','C']} current={variant} />
+  </>
+);
+```
+
+For sub-shape A (existing page): keep all the existing data fetching above the switcher; only the rendered subtree changes per variant.
+
+For sub-shape B (new page): the throwaway route under `/prototype/<name>` mounts the same switcher.
+
+### 4. Build the floating switcher
+
+A small fixed-position bar at the bottom-centre of the screen with three pieces:
+
+- **Left arrow** — cycles to the previous variant (wraps around).
+- **Variant label** — shows the current variant key and, if the variant exports a name, that name too. e.g. `B — Sidebar layout`.
+- **Right arrow** — cycles forward (wraps around).
+
+Behaviour:
+
+- Clicking an arrow updates the URL search param (use the framework's router — `router.replace` on Next, `navigate` on React Router, etc) so the variant is shareable and reload-stable.
+- Keyboard: `←` and `→` arrow keys also cycle. Don't intercept arrow keys when an `<input>`, `<textarea>`, or `[contenteditable]` is focused.
+- Visually distinct from the page (e.g. high-contrast pill, subtle shadow) so it's obviously not part of the design being evaluated.
+- Hidden in production builds — gate on `process.env.NODE_ENV !== 'production'` or an equivalent check, so a stray prototype merge can't ship the bar to users.
+
+Put the switcher in a single shared component so both sub-shapes can reuse it. Locate it wherever shared UI lives in the project.
+
+### 5. Hand it over
+
+Surface the URL (and the `?variant=` keys). The user will flip through whenever they get to it. The interesting feedback is usually **"I want the header from B with the sidebar from C"** — that's the actual design they want.
+
+### 6. Capture the answer and clean up
+
+Once a variant has won, write down which one and why (commit message, ADR, issue, or a `NOTES.md` next to the prototype if running AFK and the user hasn't responded yet). Then:
+
+- **Sub-shape A** — delete the losing variants and the switcher; fold the winner into the existing page.
+- **Sub-shape B** — promote the winning variant to a real route, delete the throwaway route and the switcher.
+
+Don't leave variant components or the switcher lying around. They rot fast and confuse the next reader.
+
+## Anti-patterns
+
+- **Variants that differ only in colour or copy.** That's a tweak, not a prototype. Real variants disagree about structure.
+- **Sharing too much code between variants.** A shared `<Header>` is fine; a shared `<Layout>` defeats the point. Each variant should be free to throw out the layout.
+- **Wiring variants to real mutations.** Read-only prototypes are fine. If a variant needs to mutate, point it at a stub — the question is "what should this look like", not "does the backend work".
+- **Promoting the prototype directly to production.** The variant code was written under prototype constraints (no tests, minimal error handling). Rewrite it properly when you fold it in.
diff --git a/.agents/skills/setup-matt-pocock-skills/SKILL.md b/.agents/skills/setup-matt-pocock-skills/SKILL.md
new file mode 100644
index 0000000..1ebc6e1
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/SKILL.md
@@ -0,0 +1,121 @@
+---
+name: setup-matt-pocock-skills
+description: Sets up an `## Agent skills` block in AGENTS.md/CLAUDE.md and `docs/agents/` so the engineering skills know this repo's issue tracker (GitHub or local markdown), triage label vocabulary, and domain doc layout. Run before first use of `to-issues`, `to-prd`, `triage`, `diagnose`, `tdd`, `improve-codebase-architecture`, or `zoom-out` — or if those skills appear to be missing context about the issue tracker, triage labels, or domain docs.
+disable-model-invocation: true
+---
+
+# Setup Matt Pocock's Skills
+
+Scaffold the per-repo configuration that the engineering skills assume:
+
+- **Issue tracker** — where issues live (GitHub by default; local markdown is also supported out of the box)
+- **Triage labels** — the strings used for the five canonical triage roles
+- **Domain docs** — where `CONTEXT.md` and ADRs live, and the consumer rules for reading them
+
+This is a prompt-driven skill, not a deterministic script. Explore, present what you found, confirm with the user, then write.
+
+## Process
+
+### 1. Explore
+
+Look at the current repo to understand its starting state. Read whatever exists; don't assume:
+
+- `git remote -v` and `.git/config` — is this a GitHub repo? Which one?
+- `AGENTS.md` and `CLAUDE.md` at the repo root — does either exist? Is there already an `## Agent skills` section in either?
+- `CONTEXT.md` and `CONTEXT-MAP.md` at the repo root
+- `docs/adr/` and any `src/*/docs/adr/` directories
+- `docs/agents/` — does this skill's prior output already exist?
+- `.scratch/` — sign that a local-markdown issue tracker convention is already in use
+
+### 2. Present findings and ask
+
+Summarise what's present and what's missing. Then walk the user through the three decisions **one at a time** — present a section, get the user's answer, then move to the next. Don't dump all three at once.
+
+Assume the user does not know what these terms mean. Each section starts with a short explainer (what it is, why these skills need it, what changes if they pick differently). Then show the choices and the default.
+
+**Section A — Issue tracker.**
+
+> Explainer: The "issue tracker" is where issues live for this repo. Skills like `to-issues`, `triage`, `to-prd`, and `qa` read from and write to it — they need to know whether to call `gh issue create`, write a markdown file under `.scratch/`, or follow some other workflow you describe. Pick the place you actually track work for this repo.
+
+Default posture: these skills were designed for GitHub. If a `git remote` points at GitHub, propose that. If a `git remote` points at GitLab (`gitlab.com` or a self-hosted host), propose GitLab. Otherwise (or if the user prefers), offer:
+
+- **GitHub** — issues live in the repo's GitHub Issues (uses the `gh` CLI)
+- **GitLab** — issues live in the repo's GitLab Issues (uses the [`glab`](https://gitlab.com/gitlab-org/cli) CLI)
+- **Local markdown** — issues live as files under `.scratch/<feature>/` in this repo (good for solo projects or repos without a remote)
+- **Other** (Jira, Linear, etc.) — ask the user to describe the workflow in one paragraph; the skill will record it as freeform prose
+
+**Section B — Triage label vocabulary.**
+
+> Explainer: When the `triage` skill processes an incoming issue, it moves it through a state machine — needs evaluation, waiting on reporter, ready for an AFK agent to pick up, ready for a human, or won't fix. To do that, it needs to apply labels (or the equivalent in your issue tracker) that match strings *you've actually configured*. If your repo already uses different label names (e.g. `bug:triage` instead of `needs-triage`), map them here so the skill applies the right ones instead of creating duplicates.
+
+The five canonical roles:
+
+- `needs-triage` — maintainer needs to evaluate
+- `needs-info` — waiting on reporter
+- `ready-for-agent` — fully specified, AFK-ready (an agent can pick it up with no human context)
+- `ready-for-human` — needs human implementation
+- `wontfix` — will not be actioned
+
+Default: each role's string equals its name. Ask the user if they want to override any. If their issue tracker has no existing labels, the defaults are fine.
+
+**Section C — Domain docs.**
+
+> Explainer: Some skills (`improve-codebase-architecture`, `diagnose`, `tdd`) read a `CONTEXT.md` file to learn the project's domain language, and `docs/adr/` for past architectural decisions. They need to know whether the repo has one global context or multiple (e.g. a monorepo with separate frontend/backend contexts) so they look in the right place.
+
+Confirm the layout:
+
+- **Single-context** — one `CONTEXT.md` + `docs/adr/` at the repo root. Most repos are this.
+- **Multi-context** — `CONTEXT-MAP.md` at the root pointing to per-context `CONTEXT.md` files (typically a monorepo).
+
+### 3. Confirm and edit
+
+Show the user a draft of:
+
+- The `## Agent skills` block to add to whichever of `CLAUDE.md` / `AGENTS.md` is being edited (see step 4 for selection rules)
+- The contents of `docs/agents/issue-tracker.md`, `docs/agents/triage-labels.md`, `docs/agents/domain.md`
+
+Let them edit before writing.
+
+### 4. Write
+
+**Pick the file to edit:**
+
+- If `CLAUDE.md` exists, edit it.
+- Else if `AGENTS.md` exists, edit it.
+- If neither exists, ask the user which one to create — don't pick for them.
+
+Never create `AGENTS.md` when `CLAUDE.md` already exists (or vice versa) — always edit the one that's already there.
+
+If an `## Agent skills` block already exists in the chosen file, update its contents in-place rather than appending a duplicate. Don't overwrite user edits to the surrounding sections.
+
+The block:
+
+```markdown
+## Agent skills
+
+### Issue tracker
+
+[one-line summary of where issues are tracked]. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+[one-line summary of the label vocabulary]. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+[one-line summary of layout — "single-context" or "multi-context"]. See `docs/agents/domain.md`.
+```
+
+Then write the three docs files using the seed templates in this skill folder as a starting point:
+
+- [issue-tracker-github.md](./issue-tracker-github.md) — GitHub issue tracker
+- [issue-tracker-gitlab.md](./issue-tracker-gitlab.md) — GitLab issue tracker
+- [issue-tracker-local.md](./issue-tracker-local.md) — local-markdown issue tracker
+- [triage-labels.md](./triage-labels.md) — label mapping
+- [domain.md](./domain.md) — domain doc consumer rules + layout
+
+For "other" issue trackers, write `docs/agents/issue-tracker.md` from scratch using the user's description.
+
+### 5. Done
+
+Tell the user the setup is complete and which engineering skills will now read from these files. Mention they can edit `docs/agents/*.md` directly later — re-running this skill is only necessary if they want to switch issue trackers or restart from scratch.
diff --git a/.agents/skills/setup-matt-pocock-skills/domain.md b/.agents/skills/setup-matt-pocock-skills/domain.md
new file mode 100644
index 0000000..c97d6a6
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/domain.md
@@ -0,0 +1,51 @@
+# Domain Docs
+
+How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+
+## Before exploring, read these
+
+- **`CONTEXT.md`** at the repo root, or
+- **`CONTEXT-MAP.md`** at the repo root if it exists — it points at one `CONTEXT.md` per context. Read each one relevant to the topic.
+- **`docs/adr/`** — read ADRs that touch the area you're about to work in. In multi-context repos, also check `src/<context>/docs/adr/` for context-scoped decisions.
+
+If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The producer skill (`/grill-with-docs`) creates them lazily when terms or decisions actually get resolved.
+
+## File structure
+
+Single-context repo (most repos):
+
+```
+/
+├── CONTEXT.md
+├── docs/adr/
+│   ├── 0001-event-sourced-orders.md
+│   └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+Multi-context repo (presence of `CONTEXT-MAP.md` at the root):
+
+```
+/
+├── CONTEXT-MAP.md
+├── docs/adr/                          ← system-wide decisions
+└── src/
+    ├── ordering/
+    │   ├── CONTEXT.md
+    │   └── docs/adr/                  ← context-specific decisions
+    └── billing/
+        ├── CONTEXT.md
+        └── docs/adr/
+```
+
+## Use the glossary's vocabulary
+
+When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift to synonyms the glossary explicitly avoids.
+
+If the concept you need isn't in the glossary yet, that's a signal — either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/grill-with-docs`).
+
+## Flag ADR conflicts
+
+If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders) — but worth reopening because…_
diff --git a/.agents/skills/setup-matt-pocock-skills/issue-tracker-github.md b/.agents/skills/setup-matt-pocock-skills/issue-tracker-github.md
new file mode 100644
index 0000000..cce77ec
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/issue-tracker-github.md
@@ -0,0 +1,22 @@
+# Issue tracker: GitHub
+
+Issues and PRDs for this repo live as GitHub issues. Use the `gh` CLI for all operations.
+
+## Conventions
+
+- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.
+- **Read an issue**: `gh issue view <number> --comments`, filtering comments by `jq` and also fetching labels.
+- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.
+- **Comment on an issue**: `gh issue comment <number> --body "..."`
+- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`
+- **Close**: `gh issue close <number> --comment "..."`
+
+Infer the repo from `git remote -v` — `gh` does this automatically when run inside a clone.
+
+## When a skill says "publish to the issue tracker"
+
+Create a GitHub issue.
+
+## When a skill says "fetch the relevant ticket"
+
+Run `gh issue view <number> --comments`.
diff --git a/.agents/skills/setup-matt-pocock-skills/issue-tracker-gitlab.md b/.agents/skills/setup-matt-pocock-skills/issue-tracker-gitlab.md
new file mode 100644
index 0000000..f54da95
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/issue-tracker-gitlab.md
@@ -0,0 +1,23 @@
+# Issue tracker: GitLab
+
+Issues and PRDs for this repo live as GitLab issues. Use the [`glab`](https://gitlab.com/gitlab-org/cli) CLI for all operations.
+
+## Conventions
+
+- **Create an issue**: `glab issue create --title "..." --description "..."`. Use a heredoc for multi-line descriptions. Pass `--description -` to open an editor.
+- **Read an issue**: `glab issue view <number> --comments`. Use `-F json` for machine-readable output.
+- **List issues**: `glab issue list -F json` with appropriate `--label` filters.
+- **Comment on an issue**: `glab issue note <number> --message "..."`. GitLab calls comments "notes".
+- **Apply / remove labels**: `glab issue update <number> --label "..."` / `--unlabel "..."`. Multiple labels can be comma-separated or by repeating the flag.
+- **Close**: `glab issue close <number>`. `glab issue close` does not accept a closing comment, so post the explanation first with `glab issue note <number> --message "..."`, then close.
+- **Merge requests**: GitLab calls PRs "merge requests". Use `glab mr create`, `glab mr view`, `glab mr note`, etc. — the same shape as `gh pr ...` with `mr` in place of `pr` and `note`/`--message` in place of `comment`/`--body`.
+
+Infer the repo from `git remote -v` — `glab` does this automatically when run inside a clone.
+
+## When a skill says "publish to the issue tracker"
+
+Create a GitLab issue.
+
+## When a skill says "fetch the relevant ticket"
+
+Run `glab issue view <number> --comments`.
diff --git a/.agents/skills/setup-matt-pocock-skills/issue-tracker-local.md b/.agents/skills/setup-matt-pocock-skills/issue-tracker-local.md
new file mode 100644
index 0000000..a2f08fb
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/issue-tracker-local.md
@@ -0,0 +1,19 @@
+# Issue tracker: Local Markdown
+
+Issues and PRDs for this repo live as markdown files in `.scratch/`.
+
+## Conventions
+
+- One feature per directory: `.scratch/<feature-slug>/`
+- The PRD is `.scratch/<feature-slug>/PRD.md`
+- Implementation issues are `.scratch/<feature-slug>/issues/<NN>-<slug>.md`, numbered from `01`
+- Triage state is recorded as a `Status:` line near the top of each issue file (see `triage-labels.md` for the role strings)
+- Comments and conversation history append to the bottom of the file under a `## Comments` heading
+
+## When a skill says "publish to the issue tracker"
+
+Create a new file under `.scratch/<feature-slug>/` (creating the directory if needed).
+
+## When a skill says "fetch the relevant ticket"
+
+Read the file at the referenced path. The user will normally pass the path or the issue number directly.
diff --git a/.agents/skills/setup-matt-pocock-skills/triage-labels.md b/.agents/skills/setup-matt-pocock-skills/triage-labels.md
new file mode 100644
index 0000000..b716855
--- /dev/null
+++ b/.agents/skills/setup-matt-pocock-skills/triage-labels.md
@@ -0,0 +1,15 @@
+# Triage Labels
+
+The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
+
+| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
+| -------------------------- | -------------------- | ---------------------------------------- |
+| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
+| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
+| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
+| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
+| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+
+When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
+
+Edit the right-hand column to match whatever vocabulary you actually use.
diff --git a/.agents/skills/tdd/SKILL.md b/.agents/skills/tdd/SKILL.md
new file mode 100644
index 0000000..7a98941
--- /dev/null
+++ b/.agents/skills/tdd/SKILL.md
@@ -0,0 +1,109 @@
+---
+name: tdd
+description: Test-driven development with red-green-refactor loop. Use when user wants to build features or fix bugs using TDD, mentions "red-green-refactor", wants integration tests, or asks for test-first development.
+---
+
+# Test-Driven Development
+
+## Philosophy
+
+**Core principle**: Tests should verify behavior through public interfaces, not implementation details. Code can change entirely; tests shouldn't.
+
+**Good tests** are integration-style: they exercise real code paths through public APIs. They describe _what_ the system does, not _how_ it does it. A good test reads like a specification - "user can checkout with valid cart" tells you exactly what capability exists. These tests survive refactors because they don't care about internal structure.
+
+**Bad tests** are coupled to implementation. They mock internal collaborators, test private methods, or verify through external means (like querying a database directly instead of using the interface). The warning sign: your test breaks when you refactor, but behavior hasn't changed. If you rename an internal function and tests fail, those tests were testing implementation, not behavior.
+
+See [tests.md](tests.md) for examples and [mocking.md](mocking.md) for mocking guidelines.
+
+## Anti-Pattern: Horizontal Slices
+
+**DO NOT write all tests first, then all implementation.** This is "horizontal slicing" - treating RED as "write all tests" and GREEN as "write all code."
+
+This produces **crap tests**:
+
+- Tests written in bulk test _imagined_ behavior, not _actual_ behavior
+- You end up testing the _shape_ of things (data structures, function signatures) rather than user-facing behavior
+- Tests become insensitive to real changes - they pass when behavior breaks, fail when behavior is fine
+- You outrun your headlights, committing to test structure before understanding the implementation
+
+**Correct approach**: Vertical slices via tracer bullets. One test → one implementation → repeat. Each test responds to what you learned from the previous cycle. Because you just wrote the code, you know exactly what behavior matters and how to verify it.
+
+```
+WRONG (horizontal):
+  RED:   test1, test2, test3, test4, test5
+  GREEN: impl1, impl2, impl3, impl4, impl5
+
+RIGHT (vertical):
+  RED→GREEN: test1→impl1
+  RED→GREEN: test2→impl2
+  RED→GREEN: test3→impl3
+  ...
+```
+
+## Workflow
+
+### 1. Planning
+
+When exploring the codebase, use the project's domain glossary so that test names and interface vocabulary match the project's language, and respect ADRs in the area you're touching.
+
+Before writing any code:
+
+- [ ] Confirm with user what interface changes are needed
+- [ ] Confirm with user which behaviors to test (prioritize)
+- [ ] Identify opportunities for [deep modules](deep-modules.md) (small interface, deep implementation)
+- [ ] Design interfaces for [testability](interface-design.md)
+- [ ] List the behaviors to test (not implementation steps)
+- [ ] Get user approval on the plan
+
+Ask: "What should the public interface look like? Which behaviors are most important to test?"
+
+**You can't test everything.** Confirm with the user exactly which behaviors matter most. Focus testing effort on critical paths and complex logic, not every possible edge case.
+
+### 2. Tracer Bullet
+
+Write ONE test that confirms ONE thing about the system:
+
+```
+RED:   Write test for first behavior → test fails
+GREEN: Write minimal code to pass → test passes
+```
+
+This is your tracer bullet - proves the path works end-to-end.
+
+### 3. Incremental Loop
+
+For each remaining behavior:
+
+```
+RED:   Write next test → fails
+GREEN: Minimal code to pass → passes
+```
+
+Rules:
+
+- One test at a time
+- Only enough code to pass current test
+- Don't anticipate future tests
+- Keep tests focused on observable behavior
+
+### 4. Refactor
+
+After all tests pass, look for [refactor candidates](refactoring.md):
+
+- [ ] Extract duplication
+- [ ] Deepen modules (move complexity behind simple interfaces)
+- [ ] Apply SOLID principles where natural
+- [ ] Consider what new code reveals about existing code
+- [ ] Run tests after each refactor step
+
+**Never refactor while RED.** Get to GREEN first.
+
+## Checklist Per Cycle
+
+```
+[ ] Test describes behavior, not implementation
+[ ] Test uses public interface only
+[ ] Test would survive internal refactor
+[ ] Code is minimal for this test
+[ ] No speculative features added
+```
diff --git a/.agents/skills/tdd/deep-modules.md b/.agents/skills/tdd/deep-modules.md
new file mode 100644
index 0000000..0d9720c
--- /dev/null
+++ b/.agents/skills/tdd/deep-modules.md
@@ -0,0 +1,33 @@
+# Deep Modules
+
+From "A Philosophy of Software Design":
+
+**Deep module** = small interface + lots of implementation
+
+```
+┌─────────────────────┐
+│   Small Interface   │  ← Few methods, simple params
+├─────────────────────┤
+│                     │
+│                     │
+│  Deep Implementation│  ← Complex logic hidden
+│                     │
+│                     │
+└─────────────────────┘
+```
+
+**Shallow module** = large interface + little implementation (avoid)
+
+```
+┌─────────────────────────────────┐
+│       Large Interface           │  ← Many methods, complex params
+├─────────────────────────────────┤
+│  Thin Implementation            │  ← Just passes through
+└─────────────────────────────────┘
+```
+
+When designing interfaces, ask:
+
+- Can I reduce the number of methods?
+- Can I simplify the parameters?
+- Can I hide more complexity inside?
diff --git a/.agents/skills/tdd/interface-design.md b/.agents/skills/tdd/interface-design.md
new file mode 100644
index 0000000..a0a20ca
--- /dev/null
+++ b/.agents/skills/tdd/interface-design.md
@@ -0,0 +1,31 @@
+# Interface Design for Testability
+
+Good interfaces make testing natural:
+
+1. **Accept dependencies, don't create them**
+
+   ```typescript
+   // Testable
+   function processOrder(order, paymentGateway) {}
+
+   // Hard to test
+   function processOrder(order) {
+     const gateway = new StripeGateway();
+   }
+   ```
+
+2. **Return results, don't produce side effects**
+
+   ```typescript
+   // Testable
+   function calculateDiscount(cart): Discount {}
+
+   // Hard to test
+   function applyDiscount(cart): void {
+     cart.total -= discount;
+   }
+   ```
+
+3. **Small surface area**
+   - Fewer methods = fewer tests needed
+   - Fewer params = simpler test setup
diff --git a/.agents/skills/tdd/mocking.md b/.agents/skills/tdd/mocking.md
new file mode 100644
index 0000000..71cbfee
--- /dev/null
+++ b/.agents/skills/tdd/mocking.md
@@ -0,0 +1,59 @@
+# When to Mock
+
+Mock at **system boundaries** only:
+
+- External APIs (payment, email, etc.)
+- Databases (sometimes - prefer test DB)
+- Time/randomness
+- File system (sometimes)
+
+Don't mock:
+
+- Your own classes/modules
+- Internal collaborators
+- Anything you control
+
+## Designing for Mockability
+
+At system boundaries, design interfaces that are easy to mock:
+
+**1. Use dependency injection**
+
+Pass external dependencies in rather than creating them internally:
+
+```typescript
+// Easy to mock
+function processPayment(order, paymentClient) {
+  return paymentClient.charge(order.total);
+}
+
+// Hard to mock
+function processPayment(order) {
+  const client = new StripeClient(process.env.STRIPE_KEY);
+  return client.charge(order.total);
+}
+```
+
+**2. Prefer SDK-style interfaces over generic fetchers**
+
+Create specific functions for each external operation instead of one generic function with conditional logic:
+
+```typescript
+// GOOD: Each function is independently mockable
+const api = {
+  getUser: (id) => fetch(`/users/${id}`),
+  getOrders: (userId) => fetch(`/users/${userId}/orders`),
+  createOrder: (data) => fetch('/orders', { method: 'POST', body: data }),
+};
+
+// BAD: Mocking requires conditional logic inside the mock
+const api = {
+  fetch: (endpoint, options) => fetch(endpoint, options),
+};
+```
+
+The SDK approach means:
+- Each mock returns one specific shape
+- No conditional logic in test setup
+- Easier to see which endpoints a test exercises
+- Type safety per endpoint
diff --git a/.agents/skills/tdd/refactoring.md b/.agents/skills/tdd/refactoring.md
new file mode 100644
index 0000000..8a44439
--- /dev/null
+++ b/.agents/skills/tdd/refactoring.md
@@ -0,0 +1,10 @@
+# Refactor Candidates
+
+After TDD cycle, look for:
+
+- **Duplication** → Extract function/class
+- **Long methods** → Break into private helpers (keep tests on public interface)
+- **Shallow modules** → Combine or deepen
+- **Feature envy** → Move logic to where data lives
+- **Primitive obsession** → Introduce value objects
+- **Existing code** the new code reveals as problematic
diff --git a/.agents/skills/tdd/tests.md b/.agents/skills/tdd/tests.md
new file mode 100644
index 0000000..ff22f80
--- /dev/null
+++ b/.agents/skills/tdd/tests.md
@@ -0,0 +1,61 @@
+# Good and Bad Tests
+
+## Good Tests
+
+**Integration-style**: Test through real interfaces, not mocks of internal parts.
+
+```typescript
+// GOOD: Tests observable behavior
+test("user can checkout with valid cart", async () => {
+  const cart = createCart();
+  cart.add(product);
+  const result = await checkout(cart, paymentMethod);
+  expect(result.status).toBe("confirmed");
+});
+```
+
+Characteristics:
+
+- Tests behavior users/callers care about
+- Uses public API only
+- Survives internal refactors
+- Describes WHAT, not HOW
+- One logical assertion per test
+
+## Bad Tests
+
+**Implementation-detail tests**: Coupled to internal structure.
+
+```typescript
+// BAD: Tests implementation details
+test("checkout calls paymentService.process", async () => {
+  const mockPayment = jest.mock(paymentService);
+  await checkout(cart, payment);
+  expect(mockPayment.process).toHaveBeenCalledWith(cart.total);
+});
+```
+
+Red flags:
+
+- Mocking internal collaborators
+- Testing private methods
+- Asserting on call counts/order
+- Test breaks when refactoring without behavior change
+- Test name describes HOW not WHAT
+- Verifying through external means instead of interface
+
+```typescript
+// BAD: Bypasses interface to verify
+test("createUser saves to database", async () => {
+  await createUser({ name: "Alice" });
+  const row = await db.query("SELECT * FROM users WHERE name = ?", ["Alice"]);
+  expect(row).toBeDefined();
+});
+
+// GOOD: Verifies through interface
+test("createUser makes user retrievable", async () => {
+  const user = await createUser({ name: "Alice" });
+  const retrieved = await getUser(user.id);
+  expect(retrieved.name).toBe("Alice");
+});
+```
diff --git a/.agents/skills/to-issues/SKILL.md b/.agents/skills/to-issues/SKILL.md
new file mode 100644
index 0000000..9f6efbf
--- /dev/null
+++ b/.agents/skills/to-issues/SKILL.md
@@ -0,0 +1,83 @@
+---
+name: to-issues
+description: Break a plan, spec, or PRD into independently-grabbable issues on the project issue tracker using tracer-bullet vertical slices. Use when user wants to convert a plan into issues, create implementation tickets, or break down work into issues.
+---
+
+# To Issues
+
+Break a plan into independently-grabbable issues using vertical slices (tracer bullets).
+
+The issue tracker and triage label vocabulary should have been provided to you — run `/setup-matt-pocock-skills` if not.
+
+## Process
+
+### 1. Gather context
+
+Work from whatever is already in the conversation context. If the user passes an issue reference (issue number, URL, or path) as an argument, fetch it from the issue tracker and read its full body and comments.
+
+### 2. Explore the codebase (optional)
+
+If you have not already explored the codebase, do so to understand the current state of the code. Issue titles and descriptions should use the project's domain glossary vocabulary, and respect ADRs in the area you're touching.
+
+### 3. Draft vertical slices
+
+Break the plan into **tracer bullet** issues. Each issue is a thin vertical slice that cuts through ALL integration layers end-to-end, NOT a horizontal slice of one layer.
+
+Slices may be 'HITL' or 'AFK'. HITL slices require human interaction, such as an architectural decision or a design review. AFK slices can be implemented and merged without human interaction. Prefer AFK over HITL where possible.
+
+<vertical-slice-rules>
+- Each slice delivers a narrow but COMPLETE path through every layer (schema, API, UI, tests)
+- A completed slice is demoable or verifiable on its own
+- Prefer many thin slices over few thick ones
+</vertical-slice-rules>
+
+### 4. Quiz the user
+
+Present the proposed breakdown as a numbered list. For each slice, show:
+
+- **Title**: short descriptive name
+- **Type**: HITL / AFK
+- **Blocked by**: which other slices (if any) must complete first
+- **User stories covered**: which user stories this addresses (if the source material has them)
+
+Ask the user:
+
+- Does the granularity feel right? (too coarse / too fine)
+- Are the dependency relationships correct?
+- Should any slices be merged or split further?
+- Are the correct slices marked as HITL and AFK?
+
+Iterate until the user approves the breakdown.
+
+### 5. Publish the issues to the issue tracker
+
+For each approved slice, publish a new issue to the issue tracker. Use the issue body template below. These issues are considered ready for AFK agents, so publish them with the correct triage label unless instructed otherwise.
+
+Publish issues in dependency order (blockers first) so you can reference real issue identifiers in the "Blocked by" field.
+
+<issue-template>
+## Parent
+
+A reference to the parent issue on the issue tracker (if the source was an existing issue, otherwise omit this section).
+
+## What to build
+
+A concise description of this vertical slice. Describe the end-to-end behavior, not layer-by-layer implementation.
+
+Avoid specific file paths or code snippets — they go stale fast. Exception: if a prototype produced a snippet that encodes a decision more precisely than prose can (state machine, reducer, schema, type shape), inline it here and note briefly that it came from a prototype. Trim to the decision-rich parts — not a working demo, just the important bits.
+
+## Acceptance criteria
+
+- [ ] Criterion 1
+- [ ] Criterion 2
+- [ ] Criterion 3
+
+## Blocked by
+
+- A reference to the blocking ticket (if any)
+
+Or "None - can start immediately" if no blockers.
+
+</issue-template>
+
+Do NOT close or modify any parent issue.
diff --git a/.agents/skills/to-prd/SKILL.md b/.agents/skills/to-prd/SKILL.md
new file mode 100644
index 0000000..47a01d4
--- /dev/null
+++ b/.agents/skills/to-prd/SKILL.md
@@ -0,0 +1,76 @@
+---
+name: to-prd
+description: Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.
+---
+
+This skill takes the current conversation context and codebase understanding and produces a PRD. Do NOT interview the user — just synthesize what you already know.
+
+The issue tracker and triage label vocabulary should have been provided to you — run `/setup-matt-pocock-skills` if not.
+
+## Process
+
+1. Explore the repo to understand the current state of the codebase, if you haven't already. Use the project's domain glossary vocabulary throughout the PRD, and respect any ADRs in the area you're touching.
+
+2. Sketch out the major modules you will need to build or modify to complete the implementation. Actively look for opportunities to extract deep modules that can be tested in isolation.
+
+A deep module (as opposed to a shallow module) is one which encapsulates a lot of functionality in a simple, testable interface which rarely changes.
+
+Check with the user that these modules match their expectations. Check with the user which modules they want tests written for.
+
+3. Write the PRD using the template below, then publish it to the project issue tracker. Apply the `ready-for-agent` triage label - no need for additional triage.
+
+<prd-template>
+
+## Problem Statement
+
+The problem that the user is facing, from the user's perspective.
+
+## Solution
+
+The solution to the problem, from the user's perspective.
+
+## User Stories
+
+A LONG, numbered list of user stories. Each user story should be in the format of:
+
+1. As an <actor>, I want a <feature>, so that <benefit>
+
+<user-story-example>
+1. As a mobile bank customer, I want to see balance on my accounts, so that I can make better informed decisions about my spending
+</user-story-example>
+
+This list of user stories should be extremely extensive and cover all aspects of the feature.
+
+## Implementation Decisions
+
+A list of implementation decisions that were made. This can include:
+
+- The modules that will be built/modified
+- The interfaces of those modules that will be modified
+- Technical clarifications from the developer
+- Architectural decisions
+- Schema changes
+- API contracts
+- Specific interactions
+
+Do NOT include specific file paths or code snippets. They may end up being outdated very quickly.
+
+Exception: if a prototype produced a snippet that encodes a decision more precisely than prose can (state machine, reducer, schema, type shape), inline it within the relevant decision and note briefly that it came from a prototype. Trim to the decision-rich parts — not a working demo, just the important bits.
+
+## Testing Decisions
+
+A list of testing decisions that were made. Include:
+
+- A description of what makes a good test (only test external behavior, not implementation details)
+- Which modules will be tested
+- Prior art for the tests (i.e. similar types of tests in the codebase)
+
+## Out of Scope
+
+A description of the things that are out of scope for this PRD.
+
+## Further Notes
+
+Any further notes about the feature.
+
+</prd-template>
diff --git a/.agents/skills/triage/AGENT-BRIEF.md b/.agents/skills/triage/AGENT-BRIEF.md
new file mode 100644
index 0000000..2efecdf
--- /dev/null
+++ b/.agents/skills/triage/AGENT-BRIEF.md
@@ -0,0 +1,168 @@
+# Writing Agent Briefs
+
+An agent brief is a structured comment posted on a GitHub issue when it moves to `ready-for-agent`. It is the authoritative specification that an AFK agent will work from. The original issue body and discussion are context — the agent brief is the contract.
+
+## Principles
+
+### Durability over precision
+
+The issue may sit in `ready-for-agent` for days or weeks. The codebase will change in the meantime. Write the brief so it stays useful even as files are renamed, moved, or refactored.
+
+- **Do** describe interfaces, types, and behavioral contracts
+- **Do** name specific types, function signatures, or config shapes that the agent should look for or modify
+- **Don't** reference file paths — they go stale
+- **Don't** reference line numbers
+- **Don't** assume the current implementation structure will remain the same
+
+### Behavioral, not procedural
+
+Describe **what** the system should do, not **how** to implement it. The agent will explore the codebase fresh and make its own implementation decisions.
+
+- **Good:** "The `SkillConfig` type should accept an optional `schedule` field of type `CronExpression`"
+- **Bad:** "Open src/types/skill.ts and add a schedule field on line 42"
+- **Good:** "When a user runs `/triage` with no arguments, they should see a summary of issues needing attention"
+- **Bad:** "Add a switch statement in the main handler function"
+
+### Complete acceptance criteria
+
+The agent needs to know when it's done. Every agent brief must have concrete, testable acceptance criteria. Each criterion should be independently verifiable.
+
+- **Good:** "Running `gh issue list --label needs-triage` returns issues that have been through initial classification"
+- **Bad:** "Triage should work correctly"
+
+### Explicit scope boundaries
+
+State what is out of scope. This prevents the agent from gold-plating or making assumptions about adjacent features.
+
+## Template
+
+```markdown
+## Agent Brief
+
+**Category:** bug / enhancement
+**Summary:** one-line description of what needs to happen
+
+**Current behavior:**
+Describe what happens now. For bugs, this is the broken behavior.
+For enhancements, this is the status quo the feature builds on.
+
+**Desired behavior:**
+Describe what should happen after the agent's work is complete.
+Be specific about edge cases and error conditions.
+
+**Key interfaces:**
+- `TypeName` — what needs to change and why
+- `functionName()` return type — what it currently returns vs what it should return
+- Config shape — any new configuration options needed
+
+**Acceptance criteria:**
+- [ ] Specific, testable criterion 1
+- [ ] Specific, testable criterion 2
+- [ ] Specific, testable criterion 3
+
+**Out of scope:**
+- Thing that should NOT be changed or addressed in this issue
+- Adjacent feature that might seem related but is separate
+```
+
+## Examples
+
+### Good agent brief (bug)
+
+```markdown
+## Agent Brief
+
+**Category:** bug
+**Summary:** Skill description truncation drops mid-word, producing broken output
+
+**Current behavior:**
+When a skill description exceeds 1024 characters, it is truncated at exactly
+1024 characters regardless of word boundaries. This produces descriptions
+that end mid-word (e.g. "Use when the user wants to confi").
+
+**Desired behavior:**
+Truncation should break at the last word boundary before 1024 characters
+and append "..." to indicate truncation.
+
+**Key interfaces:**
+- The `SkillMetadata` type's `description` field — no type change needed,
+  but the validation/processing logic that populates it needs to respect
+  word boundaries
+- Any function that reads SKILL.md frontmatter and extracts the description
+
+**Acceptance criteria:**
+- [ ] Descriptions under 1024 chars are unchanged
+- [ ] Descriptions over 1024 chars are truncated at the last word boundary
+      before 1024 chars
+- [ ] Truncated descriptions end with "..."
+- [ ] The total length including "..." does not exceed 1024 chars
+
+**Out of scope:**
+- Changing the 1024 char limit itself
+- Multi-line description support
+```
+
+### Good agent brief (enhancement)
+
+```markdown
+## Agent Brief
+
+**Category:** enhancement
+**Summary:** Add `.out-of-scope/` directory support for tracking rejected feature requests
+
+**Current behavior:**
+When a feature request is rejected, the issue is closed with a `wontfix` label
+and a comment. There is no persistent record of the decision or reasoning.
+Future similar requests require the maintainer to recall or search for the
+prior discussion.
+
+**Desired behavior:**
+Rejected feature requests should be documented in `.out-of-scope/<concept>.md`
+files that capture the decision, reasoning, and links to all issues that
+requested the feature. When triaging new issues, these files should be
+checked for matches.
+
+**Key interfaces:**
+- Markdown file format in `.out-of-scope/` — each file should have a
+  `# Concept Name` heading, a `**Decision:**` line, a `**Reason:**` line,
+  and a `**Prior requests:**` list with issue links
+- The triage workflow should read all `.out-of-scope/*.md` files early
+  and match incoming issues against them by concept similarity
+
+**Acceptance criteria:**
+- [ ] Closing a feature as wontfix creates/updates a file in `.out-of-scope/`
+- [ ] The file includes the decision, reasoning, and link to the closed issue
+- [ ] If a matching `.out-of-scope/` file already exists, the new issue is
+      appended to its "Prior requests" list rather than creating a duplicate
+- [ ] During triage, existing `.out-of-scope/` files are checked and surfaced
+      when a new issue matches a prior rejection
+
+**Out of scope:**
+- Automated matching (human confirms the match)
+- Reopening previously rejected features
+- Bug reports (only enhancement rejections go to `.out-of-scope/`)
+```
+
+### Bad agent brief
+
+```markdown
+## Agent Brief
+
+**Summary:** Fix the triage bug
+
+**What to do:**
+The triage thing is broken. Look at the main file and fix it.
+The function around line 150 has the issue.
+
+**Files to change:**
+- src/triage/handler.ts (line 150)
+- src/types.ts (line 42)
+```
+
+This is bad because:
+- No category
+- Vague description ("the triage thing is broken")
+- References file paths and line numbers that will go stale
+- No acceptance criteria
+- No scope boundaries
+- No description of current vs desired behavior
diff --git a/.agents/skills/triage/OUT-OF-SCOPE.md b/.agents/skills/triage/OUT-OF-SCOPE.md
new file mode 100644
index 0000000..cc8ea25
--- /dev/null
+++ b/.agents/skills/triage/OUT-OF-SCOPE.md
@@ -0,0 +1,101 @@
+# Out-of-Scope Knowledge Base
+
+The `.out-of-scope/` directory in a repo stores persistent records of rejected feature requests. It serves two purposes:
+
+1. **Institutional memory** — why a feature was rejected, so the reasoning isn't lost when the issue is closed
+2. **Deduplication** — when a new issue comes in that matches a prior rejection, the skill can surface the previous decision instead of re-litigating it
+
+## Directory structure
+
+```
+.out-of-scope/
+├── dark-mode.md
+├── plugin-system.md
+└── graphql-api.md
+```
+
+One file per **concept**, not per issue. Multiple issues requesting the same thing are grouped under one file.
+
+## File format
+
+The file should be written in a relaxed, readable style — more like a short design document than a database entry. Use paragraphs, code samples, and examples to make the reasoning clear and useful to someone encountering it for the first time.
+
+```markdown
+# Dark Mode
+
+This project does not support dark mode or user-facing theming.
+
+## Why this is out of scope
+
+The rendering pipeline assumes a single color palette defined in
+`ThemeConfig`. Supporting multiple themes would require:
+
+- A theme context provider wrapping the entire component tree
+- Per-component theme-aware style resolution
+- A persistence layer for user theme preferences
+
+This is a significant architectural change that doesn't align with the
+project's focus on content authoring. Theming is a concern for downstream
+consumers who embed or redistribute the output.
+
+```ts
+// The current ThemeConfig interface is not designed for runtime switching:
+interface ThemeConfig {
+  colors: ColorPalette; // single palette, resolved at build time
+  fonts: FontStack;
+}
+```
+
+## Prior requests
+
+- #42 — "Add dark mode support"
+- #87 — "Night theme for accessibility"
+- #134 — "Dark theme option"
+```
+
+### Naming the file
+
+Use a short, descriptive kebab-case name for the concept: `dark-mode.md`, `plugin-system.md`, `graphql-api.md`. The name should be recognizable enough that someone browsing the directory understands what was rejected without opening the file.
+
+### Writing the reason
+
+The reason should be substantive — not "we don't want this" but why. Good reasons reference:
+
+- Project scope or philosophy ("This project focuses on X; theming is a downstream concern")
+- Technical constraints ("Supporting this would require Y, which conflicts with our Z architecture")
+- Strategic decisions ("We chose to use A instead of B because...")
+
+The reason should be durable. Avoid referencing temporary circumstances ("we're too busy right now") — those aren't real rejections, they're deferrals.
+
+## When to check `.out-of-scope/`
+
+During triage (Step 1: Gather context), read all files in `.out-of-scope/`. When evaluating a new issue:
+
+- Check if the request matches an existing out-of-scope concept
+- Matching is by concept similarity, not keyword — "night theme" matches `dark-mode.md`
+- If there's a match, surface it to the maintainer: "This is similar to `.out-of-scope/dark-mode.md` — we rejected this before because [reason]. Do you still feel the same way?"
+
+The maintainer may:
+
+- **Confirm** — the new issue gets added to the existing file's "Prior requests" list, then closed
+- **Reconsider** — the out-of-scope file gets deleted or updated, and the issue proceeds through normal triage
+- **Disagree** — the issues are related but distinct, proceed with normal triage
+
+## When to write to `.out-of-scope/`
+
+Only when an **enhancement** (not a bug) is rejected as `wontfix`. The flow:
+
+1. Maintainer decides a feature request is out of scope
+2. Check if a matching `.out-of-scope/` file already exists
+3. If yes: append the new issue to the "Prior requests" list
+4. If no: create a new file with the concept name, decision, reason, and first prior request
+5. Post a comment on the issue explaining the decision and mentioning the `.out-of-scope/` file
+6. Close the issue with the `wontfix` label
+
+## Updating or removing out-of-scope files
+
+If the maintainer changes their mind about a previously rejected concept:
+
+- Delete the `.out-of-scope/` file
+- The skill does not need to reopen old issues — they're historical records
+- The new issue that triggered the reconsideration proceeds through normal triage
diff --git a/.agents/skills/triage/SKILL.md b/.agents/skills/triage/SKILL.md
new file mode 100644
index 0000000..3dee68f
--- /dev/null
+++ b/.agents/skills/triage/SKILL.md
@@ -0,0 +1,103 @@
+---
+name: triage
+description: Triage issues through a state machine driven by triage roles. Use when user wants to create an issue, triage issues, review incoming bugs or feature requests, prepare issues for an AFK agent, or manage issue workflow.
+---
+
+# Triage
+
+Move issues on the project issue tracker through a small state machine of triage roles.
+
+Every comment or issue posted to the issue tracker during triage **must** start with this disclaimer:
+
+```
+> *This was generated by AI during triage.*
+```
+
+## Reference docs
+
+- [AGENT-BRIEF.md](AGENT-BRIEF.md) — how to write durable agent briefs
+- [OUT-OF-SCOPE.md](OUT-OF-SCOPE.md) — how the `.out-of-scope/` knowledge base works
+
+## Roles
+
+Two **category** roles:
+
+- `bug` — something is broken
+- `enhancement` — new feature or improvement
+
+Five **state** roles:
+
+- `needs-triage` — maintainer needs to evaluate
+- `needs-info` — waiting on reporter for more information
+- `ready-for-agent` — fully specified, ready for an AFK agent
+- `ready-for-human` — needs human implementation
+- `wontfix` — will not be actioned
+
+Every triaged issue should carry exactly one category role and one state role. If state roles conflict, flag it and ask the maintainer before doing anything else.
+
+These are canonical role names — the actual label strings used in the issue tracker may differ. The mapping should have been provided to you - run `/setup-matt-pocock-skills` if not.
+
+State transitions: an unlabeled issue normally goes to `needs-triage` first; from there it moves to `needs-info`, `ready-for-agent`, `ready-for-human`, or `wontfix`. `needs-info` returns to `needs-triage` once the reporter replies. The maintainer can override at any time — flag transitions that look unusual and ask before proceeding.
+
+## Invocation
+
+The maintainer invokes `/triage` and describes what they want in natural language. Interpret the request and act. Examples:
+
+- "Show me anything that needs my attention"
+- "Let's look at #42"
+- "Move #42 to ready-for-agent"
+- "What's ready for agents to pick up?"
+
+## Show what needs attention
+
+Query the issue tracker and present three buckets, oldest first:
+
+1. **Unlabeled** — never triaged.
+2. **`needs-triage`** — evaluation in progress.
+3. **`needs-info` with reporter activity since the last triage notes** — needs re-evaluation.
+
+Show counts and a one-line summary per issue. Let the maintainer pick.
+
+## Triage a specific issue
+
+1. **Gather context.** Read the full issue (body, comments, labels, reporter, dates). Parse any prior triage notes so you don't re-ask resolved questions. Explore the codebase using the project's domain glossary, respecting ADRs in the area. Read `.out-of-scope/*.md` and surface any prior rejection that resembles this issue.
+
+2. **Recommend.** Tell the maintainer your category and state recommendation with reasoning, plus a brief codebase summary relevant to the issue. Wait for direction.
+
+3. **Reproduce (bugs only).** Before any grilling, attempt reproduction: read the reporter's steps, trace the relevant code, run tests or commands. Report what happened — successful repro with code path, failed repro, or insufficient detail (a strong `needs-info` signal). A confirmed repro makes a much stronger agent brief.
+
+4. **Grill (if needed).** If the issue needs fleshing out, run a `/grill-with-docs` session.
+
+5. **Apply the outcome:**
+   - `ready-for-agent` — post an agent brief comment ([AGENT-BRIEF.md](AGENT-BRIEF.md)).
+   - `ready-for-human` — same structure as an agent brief, but note why it can't be delegated (judgment calls, external access, design decisions, manual testing).
+   - `needs-info` — post triage notes (template below).
+   - `wontfix` (bug) — polite explanation, then close.
+   - `wontfix` (enhancement) — write to `.out-of-scope/`, link to it from a comment, then close ([OUT-OF-SCOPE.md](OUT-OF-SCOPE.md)).
+   - `needs-triage` — apply the role. Optional comment if there's partial progress.
+
+## Quick state override
+
+If the maintainer says "move #42 to ready-for-agent", trust them and apply the role directly. Confirm what you're about to do (role changes, comment, close), then act. Skip grilling. If moving to `ready-for-agent` without a grilling session, ask whether they want to write an agent brief.
+
+## Needs-info template
+
+```markdown
+## Triage Notes
+
+**What we've established so far:**
+
+- point 1
+- point 2
+
+**What we still need from you (@reporter):**
+
+- question 1
+- question 2
+```
+
+Capture everything resolved during grilling under "established so far" so the work isn't lost. Questions must be specific and actionable, not "please provide more info".
+
+## Resuming a previous session
+
+If prior triage notes exist on the issue, read them, check whether the reporter has answered any outstanding questions, and present an updated picture before continuing. Don't re-ask resolved questions.
diff --git a/.agents/skills/write-a-skill/SKILL.md b/.agents/skills/write-a-skill/SKILL.md
new file mode 100644
index 0000000..7339c8a
--- /dev/null
+++ b/.agents/skills/write-a-skill/SKILL.md
@@ -0,0 +1,117 @@
+---
+name: write-a-skill
+description: Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.
+---
+
+# Writing Skills
+
+## Process
+
+1. **Gather requirements** - ask user about:
+   - What task/domain does the skill cover?
+   - What specific use cases should it handle?
+   - Does it need executable scripts or just instructions?
+   - Any reference materials to include?
+
+2. **Draft the skill** - create:
+   - SKILL.md with concise instructions
+   - Additional reference files if content exceeds 500 lines
+   - Utility scripts if deterministic operations needed
+
+3. **Review with user** - present draft and ask:
+   - Does this cover your use cases?
+   - Anything missing or unclear?
+   - Should any section be more/less detailed?
+
+## Skill Structure
+
+```
+skill-name/
+├── SKILL.md           # Main instructions (required)
+├── REFERENCE.md       # Detailed docs (if needed)
+├── EXAMPLES.md        # Usage examples (if needed)
+└── scripts/           # Utility scripts (if needed)
+    └── helper.js
+```
+
+## SKILL.md Template
+
+```md
+---
+name: skill-name
+description: Brief description of capability. Use when [specific triggers].
+---
+
+# Skill Name
+
+## Quick start
+
+[Minimal working example]
+
+## Workflows
+
+[Step-by-step processes with checklists for complex tasks]
+
+## Advanced features
+
+[Link to separate files: See [REFERENCE.md](REFERENCE.md)]
+```
+
+## Description Requirements
+
+The description is **the only thing your agent sees** when deciding which skill to load. It's surfaced in the system prompt alongside all other installed skills. Your agent reads these descriptions and picks the relevant skill based on the user's request.
+
+**Goal**: Give your agent just enough info to know:
+
+1. What capability this skill provides
+2. When/why to trigger it (specific keywords, contexts, file types)
+
+**Format**:
+
+- Max 1024 chars
+- Write in third person
+- First sentence: what it does
+- Second sentence: "Use when [specific triggers]"
+
+**Good example**:
+
+```
+Extract text and tables from PDF files, fill forms, merge documents. Use when working with PDF files or when user mentions PDFs, forms, or document extraction.
+```
+
+**Bad example**:
+
+```
+Helps with documents.
+```
+
+The bad example gives your agent no way to distinguish this from other document skills.
+
+## When to Add Scripts
+
+Add utility scripts when:
+
+- Operation is deterministic (validation, formatting)
+- Same code would be generated repeatedly
+- Errors need explicit handling
+
+Scripts save tokens and improve reliability vs generated code.
+
+## When to Split Files
+
+Split into separate files when:
+
+- SKILL.md exceeds 100 lines
+- Content has distinct domains (finance vs sales schemas)
+- Advanced features are rarely needed
+
+## Review Checklist
+
+After drafting, verify:
+
+- [ ] Description includes triggers ("Use when...")
+- [ ] SKILL.md under 100 lines
+- [ ] No time-sensitive info
+- [ ] Consistent terminology
+- [ ] Concrete examples included
+- [ ] References one level deep
diff --git a/.agents/skills/zoom-out/SKILL.md b/.agents/skills/zoom-out/SKILL.md
new file mode 100644
index 0000000..1e7a5dc
--- /dev/null
+++ b/.agents/skills/zoom-out/SKILL.md
@@ -0,0 +1,7 @@
+---
+name: zoom-out
+description: Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.
+disable-model-invocation: true
+---
+
+I don't know this area of code well. Go up a layer of abstraction. Give me a map of all the relevant modules and callers, using the project's domain glossary vocabulary.
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..f6699d4
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,13 @@
+## Agent skills
+
+### Issue tracker
+
+GitHub Issues on `lostiv/GithubStarsManager`, operated via the `gh` CLI. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+Standard five-role vocabulary: `needs-triage`, `needs-info`, `ready-for-agent`, `ready-for-human`, `wontfix`. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Single-context repo — one `CONTEXT.md` at root + `docs/adr/` for architecture decisions. See `docs/agents/domain.md`.
diff --git a/docs/agents/domain.md b/docs/agents/domain.md
new file mode 100644
index 0000000..a4fcfd9
--- /dev/null
+++ b/docs/agents/domain.md
@@ -0,0 +1,34 @@
+# Domain Docs
+
+How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+
+## Before exploring, read these
+
+- **`CONTEXT.md`** at the repo root
+- **`docs/adr/`** — read ADRs that touch the area you're about to work in.
+
+If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The producer skill (`/grill-with-docs`) creates them lazily when terms or decisions actually get resolved.
+
+## File structure
+
+Single-context repo:
+
+```
+/
+├── CONTEXT.md
+├── docs/adr/
+├── docs/agents/
+└── src/
+```
+
+## Use the glossary's vocabulary
+
+When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift to synonyms the glossary explicitly avoids.
+
+If the concept you need isn't in the glossary yet, that's a signal — either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/grill-with-docs`).
+
+## Flag ADR conflicts
+
+If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders) — but worth reopening because…_
diff --git a/docs/agents/issue-tracker.md b/docs/agents/issue-tracker.md
new file mode 100644
index 0000000..cce77ec
--- /dev/null
+++ b/docs/agents/issue-tracker.md
@@ -0,0 +1,22 @@
+# Issue tracker: GitHub
+
+Issues and PRDs for this repo live as GitHub issues. Use the `gh` CLI for all operations.
+
+## Conventions
+
+- **Create an issue**: `gh issue create --title "..." --body "..."`. Use a heredoc for multi-line bodies.
+- **Read an issue**: `gh issue view <number> --comments`, filtering comments by `jq` and also fetching labels.
+- **List issues**: `gh issue list --state open --json number,title,body,labels,comments --jq '[.[] | {number, title, body, labels: [.labels[].name], comments: [.comments[].body]}]'` with appropriate `--label` and `--state` filters.
+- **Comment on an issue**: `gh issue comment <number> --body "..."`
+- **Apply / remove labels**: `gh issue edit <number> --add-label "..."` / `--remove-label "..."`
+- **Close**: `gh issue close <number> --comment "..."`
+
+Infer the repo from `git remote -v` — `gh` does this automatically when run inside a clone.
+
+## When a skill says "publish to the issue tracker"
+
+Create a GitHub issue.
+
+## When a skill says "fetch the relevant ticket"
+
+Run `gh issue view <number> --comments`.
diff --git a/docs/agents/triage-labels.md b/docs/agents/triage-labels.md
new file mode 100644
index 0000000..ad2d1ca
--- /dev/null
+++ b/docs/agents/triage-labels.md
@@ -0,0 +1,13 @@
+# Triage Labels
+
+The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
+
+| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
+| -------------------------- | -------------------- | ---------------------------------------- |
+| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
+| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
+| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
+| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
+| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+
+When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
diff --git a/server/src/index.ts b/server/src/index.ts
index c609aba..8bbc058 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -15,6 +15,8 @@ import configsRouter from './routes/configs.js';
 import syncRouter from './routes/sync.js';
 import proxyRouter from './routes/proxy.js';
 import analysisRouter from './routes/analysis.js';
+import backupRouter from './routes/backup.js';
+import { startBackupScheduler, stopBackupScheduler } from './services/backupService.js';
 
 export function createApp(): express.Express {
   const app = express();
@@ -42,6 +44,7 @@ export function createApp(): express.Express {
   app.use(proxyRouter);
 
   app.use(analysisRouter);
+  app.use(backupRouter);
 
   // Global error handler
   app.use(errorHandler);
@@ -55,6 +58,10 @@ function startServer(): void {
   runMigrations(db);
   console.log('✅ Database initialized');
 
+  // Start auto-backup scheduler
+  startBackupScheduler();
+  console.log('✅ Backup scheduler started');
+
   const app = createApp();
 
   const server = app.listen(config.port, () => {
@@ -68,6 +75,7 @@ function startServer(): void {
   const shutdown = () => {
     console.log('\n🛑 Shutting down...');
     server.close(() => {
+      stopBackupScheduler();
       closeDb();
       console.log('👋 Server stopped');
       process.exit(0);
diff --git a/server/src/routes/backup.ts b/server/src/routes/backup.ts
new file mode 100644
index 0000000..6c2ba37
--- /dev/null
+++ b/server/src/routes/backup.ts
@@ -0,0 +1,116 @@
+import { Router } from 'express';
+import { getDb } from '../db/connection.js';
+import { getBackupStatus, performAutoBackup } from '../services/backupService.js';
+
+const router = Router();
+
+// GET /api/backup/settings
+router.get('/api/backup/settings', (_req, res) => {
+  try {
+    const db = getDb();
+    const rows = db.prepare('SELECT key, value FROM settings WHERE key LIKE ?').all(
+      'auto_backup_%'
+    ) as { key: string; value: string | null }[];
+
+    const settings: Record<string, unknown> = {
+      auto_backup_enabled: false,
+      auto_backup_interval_hours: 24,
+      auto_backup_retention_count: 30,
+    };
+
+    for (const row of rows) {
+      if (row.key === 'auto_backup_enabled') {
+        settings[row.key] = row.value === 'true';
+      } else if (row.key === 'auto_backup_interval_hours' || row.key === 'auto_backup_retention_count') {
+        settings[row.key] = row.value ? parseInt(row.value, 10) : settings[row.key];
+      }
+    }
+
+    res.json(settings);
+  } catch (err) {
+    console.error('GET /api/backup/settings error:', err);
+    res.status(500).json({ error: 'Failed to fetch backup settings', code: 'FETCH_BACKUP_SETTINGS_FAILED' });
+  }
+});
+
+// PUT /api/backup/settings
+router.put('/api/backup/settings', (req, res) => {
+  try {
+    const db = getDb();
+    const { auto_backup_enabled, auto_backup_interval_hours, auto_backup_retention_count } = req.body as {
+      auto_backup_enabled?: boolean;
+      auto_backup_interval_hours?: number;
+      auto_backup_retention_count?: number;
+    };
+
+    const errors: string[] = [];
+
+    if (auto_backup_interval_hours !== undefined) {
+      if (typeof auto_backup_interval_hours !== 'number' || auto_backup_interval_hours < 1 || auto_backup_interval_hours > 720) {
+        errors.push('备份间隔必须在 1-720 小时之间');
+      }
+    }
+
+    if (auto_backup_retention_count !== undefined) {
+      if (typeof auto_backup_retention_count !== 'number' || auto_backup_retention_count < 0 || auto_backup_retention_count > 365) {
+        errors.push('保留份数必须在 0-365 之间（0 表示不限制）');
+      }
+    }
+
+    if (auto_backup_enabled === true) {
+      const activeConfig = db.prepare('SELECT id FROM webdav_configs WHERE is_active = 1').get();
+      if (!activeConfig) {
+        errors.push('启用自动备份前，请先在 WebDAV 设置中激活一个配置');
+      }
+    }
+
+    if (errors.length > 0) {
+      res.status(400).json({ error: errors.join('；'), code: 'VALIDATION_FAILED' });
+      return;
+    }
+
+    const stmt = db.prepare('INSERT OR REPLACE INTO settings (key, value) VALUES (?, ?)');
+
+    const upsert = db.transaction(() => {
+      if (auto_backup_enabled !== undefined) {
+        stmt.run('auto_backup_enabled', auto_backup_enabled ? 'true' : 'false');
+      }
+      if (auto_backup_interval_hours !== undefined) {
+        stmt.run('auto_backup_interval_hours', String(auto_backup_interval_hours));
+      }
+      if (auto_backup_retention_count !== undefined) {
+        stmt.run('auto_backup_retention_count', String(auto_backup_retention_count));
+      }
+    });
+
+    upsert();
+    res.json({ updated: true });
+  } catch (err) {
+    console.error('PUT /api/backup/settings error:', err);
+    res.status(500).json({ error: 'Failed to update backup settings', code: 'UPDATE_BACKUP_SETTINGS_FAILED' });
+  }
+});
+
+// GET /api/backup/status
+router.get('/api/backup/status', (_req, res) => {
+  try {
+    const status = getBackupStatus();
+    res.json(status);
+  } catch (err) {
+    console.error('GET /api/backup/status error:', err);
+    res.status(500).json({ error: 'Failed to fetch backup status', code: 'FETCH_BACKUP_STATUS_FAILED' });
+  }
+});
+
+// POST /api/backup/trigger
+router.post('/api/backup/trigger', async (_req, res) => {
+  try {
+    const result = await performAutoBackup();
+    res.json(result);
+  } catch (err) {
+    console.error('POST /api/backup/trigger error:', err);
+    res.status(500).json({ success: false, message: '触发备份失败', error: 'TRIGGER_BACKUP_FAILED' });
+  }
+});
+
+export default router;
diff --git a/server/src/routes/sync.ts b/server/src/routes/sync.ts
index 2368449..d4dcffd 100644
--- a/server/src/routes/sync.ts
+++ b/server/src/routes/sync.ts
@@ -2,82 +2,15 @@ import { Router } from 'express';
 import { getDb } from '../db/connection.js';
 import { encrypt, decrypt } from '../services/crypto.js';
 import { config } from '../config.js';
+import { exportAllData } from '../services/backupService.js';
 
 const router = Router();
 
-function maskApiKey(key: string | null | undefined): string {
-  if (!key || typeof key !== 'string') return '';
-  if (key.length <= 4) return '****';
-  return '***' + key.slice(-4);
-}
-
 // POST /api/sync/export
 router.post('/api/sync/export', (_req, res) => {
   try {
     const db = getDb();
-
-    const repositories = db.prepare('SELECT * FROM repositories').all() as Record<string, unknown>[];
-    const releases = db.prepare('SELECT * FROM releases').all() as Record<string, unknown>[];
-    const categories = db.prepare('SELECT * FROM categories').all() as Record<string, unknown>[];
-    const assetFilters = db.prepare('SELECT * FROM asset_filters').all() as Record<string, unknown>[];
-
-    // AI configs — mask api_key
-    const aiConfigRows = db.prepare('SELECT * FROM ai_configs').all() as Record<string, unknown>[];
-    const aiConfigs = aiConfigRows.map((row) => {
-      const masked = { ...row };
-      if (masked.api_key_encrypted && typeof masked.api_key_encrypted === 'string') {
-        try {
-          masked.api_key_masked = maskApiKey(decrypt(masked.api_key_encrypted, config.encryptionKey));
-        } catch {
-          masked.api_key_masked = '****';
-        }
-      }
-      delete masked.api_key_encrypted;
-      return masked;
-    });
-
-    // WebDAV configs — mask password
-    const webdavRows = db.prepare('SELECT * FROM webdav_configs').all() as Record<string, unknown>[];
-    const webdavConfigs = webdavRows.map((row) => {
-      const masked = { ...row };
-      if (masked.password_encrypted && typeof masked.password_encrypted === 'string') {
-        try {
-          masked.password_masked = maskApiKey(decrypt(masked.password_encrypted, config.encryptionKey));
-        } catch {
-          masked.password_masked = '****';
-        }
-      }
-      delete masked.password_encrypted;
-      return masked;
-    });
-
-    // Settings — mask github_token
-    const settingsRows = db.prepare('SELECT * FROM settings').all() as Record<string, unknown>[];
-    const settings: Record<string, unknown> = {};
-    for (const row of settingsRows) {
-      const key = row.key as string;
-      let value = row.value as string | null;
-      if (key === 'github_token' && value) {
-        try {
-          value = maskApiKey(decrypt(value, config.encryptionKey));
-        } catch {
-          value = '****';
-        }
-      }
-      settings[key] = value;
-    }
-
-    res.json({
-      version: 1,
-      exported_at: new Date().toISOString(),
-      repositories,
-      releases,
-      categories,
-      asset_filters: assetFilters,
-      ai_configs: aiConfigs,
-      webdav_configs: webdavConfigs,
-      settings,
-    });
+    res.json(exportAllData(db, true));
   } catch (err) {
     console.error('POST /api/sync/export error:', err);
     res.status(500).json({ error: 'Failed to export data', code: 'EXPORT_DATA_FAILED' });
diff --git a/server/src/services/backupService.ts b/server/src/services/backupService.ts
new file mode 100644
index 0000000..ac1bafb
--- /dev/null
+++ b/server/src/services/backupService.ts
@@ -0,0 +1,395 @@
+import { getDb } from '../db/connection.js';
+import { config } from '../config.js';
+import { encrypt, decrypt } from '../services/crypto.js';
+import { proxyRequest } from '../services/proxyService.js';
+import type Database from 'better-sqlite3';
+
+let schedulerTimer: ReturnType<typeof setInterval> | null = null;
+let lastBackupTime: number | null = null;
+let lastActiveConfigId: string | null = null;
+let isBackingUp = false;
+
+function maskApiKey(key: string | null | undefined): string {
+  if (!key || typeof key !== 'string') return '';
+  if (key.length <= 4) return '****';
+  return '***' + key.slice(-4);
+}
+
+export function exportAllData(db: Database.Database, mask = true): Record<string, unknown> {
+  const repositories = db.prepare('SELECT * FROM repositories').all() as Record<string, unknown>[];
+  const releases = db.prepare('SELECT * FROM releases').all() as Record<string, unknown>[];
+  const categories = db.prepare('SELECT * FROM categories').all() as Record<string, unknown>[];
+  const assetFilters = db.prepare('SELECT * FROM asset_filters').all() as Record<string, unknown>[];
+
+  const aiConfigRows = db.prepare('SELECT * FROM ai_configs').all() as Record<string, unknown>[];
+  const aiConfigs = aiConfigRows.map((row) => {
+    if (!mask) return { ...row };
+    const masked = { ...row };
+    if (masked.api_key_encrypted && typeof masked.api_key_encrypted === 'string') {
+      try {
+        masked.api_key_masked = maskApiKey(decrypt(masked.api_key_encrypted, config.encryptionKey));
+      } catch {
+        masked.api_key_masked = '****';
+      }
+    }
+    delete masked.api_key_encrypted;
+    return masked;
+  });
+
+  const webdavRows = db.prepare('SELECT * FROM webdav_configs').all() as Record<string, unknown>[];
+  const webdavConfigs = webdavRows.map((row) => {
+    if (!mask) return { ...row };
+    const masked = { ...row };
+    if (masked.password_encrypted && typeof masked.password_encrypted === 'string') {
+      try {
+        masked.password_masked = maskApiKey(decrypt(masked.password_encrypted, config.encryptionKey));
+      } catch {
+        masked.password_masked = '****';
+      }
+    }
+    delete masked.password_encrypted;
+    return masked;
+  });
+
+  const settingsRows = db.prepare('SELECT * FROM settings').all() as Record<string, unknown>[];
+  const settings: Record<string, unknown> = {};
+  for (const row of settingsRows) {
+    const key = row.key as string;
+    let value = row.value as string | null;
+    if (mask && key === 'github_token' && value) {
+      try {
+        value = maskApiKey(decrypt(value, config.encryptionKey));
+      } catch {
+        value = '****';
+      }
+    }
+    settings[key] = value;
+  }
+
+  return {
+    version: 1,
+    exported_at: new Date().toISOString(),
+    repositories,
+    releases,
+    categories,
+    asset_filters: assetFilters,
+    ai_configs: aiConfigs,
+    webdav_configs: webdavConfigs,
+    settings,
+  };
+}
+
+// ── WebDAV helpers ──
+
+function getWebDAVAuthHeader(username: string, password: string): string {
+  const credentials = Buffer.from(`${username}:${password}`).toString('base64');
+  return `Basic ${credentials}`;
+}
+
+async function webdavUpload(
+  baseUrl: string,
+  username: string,
+  password: string,
+  filePath: string,
+  content: string
+): Promise<void> {
+  const targetUrl = `${baseUrl}${filePath}`;
+  const result = await proxyRequest({
+    url: targetUrl,
+    method: 'PUT',
+    headers: {
+      'Authorization': getWebDAVAuthHeader(username, password),
+      'Content-Type': 'application/json',
+    },
+    body: content,
+    timeout: 120000,
+  });
+  if (result.status < 200 || result.status >= 300) {
+    throw new Error(`WebDAV PUT failed: HTTP ${result.status}`);
+  }
+}
+
+async function webdavListFiles(
+  baseUrl: string,
+  username: string,
+  password: string,
+  dirPath: string
+): Promise<string[]> {
+  const propfindBody = `<?xml version="1.0" encoding="utf-8" ?>
+<D:propfind xmlns:D="DAV:">
+  <D:prop>
+    <D:displayname/>
+    <D:getlastmodified/>
+    <D:getcontentlength/>
+  </D:prop>
+</D:propfind>`;
+
+  const result = await proxyRequest({
+    url: `${baseUrl}${dirPath}`,
+    method: 'PROPFIND',
+    headers: {
+      'Authorization': getWebDAVAuthHeader(username, password),
+      'Content-Type': 'application/xml',
+      'Depth': '1',
+    },
+    body: propfindBody,
+    timeout: 30000,
+  });
+
+  if (!(result.status === 207 || (result.status >= 200 && result.status < 300))) {
+    throw new Error(`WebDAV PROPFIND failed: HTTP ${result.status}`);
+  }
+
+  const xmlText = typeof result.data === 'string' ? result.data : JSON.stringify(result.data);
+  return parsePropfindXml(xmlText);
+}
+
+async function webdavDeleteFile(
+  baseUrl: string,
+  username: string,
+  password: string,
+  filePath: string
+): Promise<void> {
+  const result = await proxyRequest({
+    url: `${baseUrl}${filePath}`,
+    method: 'DELETE',
+    headers: {
+      'Authorization': getWebDAVAuthHeader(username, password),
+    },
+    timeout: 15000,
+  });
+  if (result.status < 200 || result.status >= 300) {
+    console.warn(`WebDAV DELETE ${filePath} returned HTTP ${result.status}`);
+  }
+}
+
+function parsePropfindXml(xmlText: string): string[] {
+  // Try DOMParser first (backend may not have it), then fall back to regex
+  try {
+    const regex = /<D:href>([^<]+)<\/D:href>/gi;
+    const results: string[] = [];
+    let match;
+    while ((match = regex.exec(xmlText)) !== null) {
+      let href = match[1].trim();
+      href = href.replace(/\/+$/, '');
+      const parts = href.split('/').filter(Boolean);
+      if (parts.length === 0) continue;
+      const last = decodeURIComponent(parts[parts.length - 1]);
+      if (last.toLowerCase().endsWith('.json')) {
+        results.push(last.trim());
+      }
+    }
+    if (results.length > 0) return results;
+  } catch {
+    // ignore
+  }
+
+  // Fallback: extract displayname
+  const nameRegex = /<D:displayname>([^<]+)<\/D:displayname>/gi;
+  const names: string[] = [];
+  let m;
+  while ((m = nameRegex.exec(xmlText)) !== null) {
+    const name = m[1].trim();
+    if (name.toLowerCase().endsWith('.json')) names.push(name);
+  }
+  return names;
+}
+
+// ── Backup logic ──
+
+const BACKUP_FILENAME_REGEX = /^github-stars-backup-\d{4}-\d{2}-\d{2}(?:T\d{2}-\d{2}-\d{2})?\.json$/;
+
+async function cleanupOldBackups(
+  baseUrl: string,
+  username: string,
+  password: string,
+  dirPath: string,
+  retentionCount: number
+): Promise<{ deleted: number; retained: number }> {
+  try {
+    const allFiles = await webdavListFiles(baseUrl, username, password, dirPath);
+    const backupFiles = allFiles.filter(f => BACKUP_FILENAME_REGEX.test(f)).sort();
+
+    if (backupFiles.length <= retentionCount) {
+      return { deleted: 0, retained: backupFiles.length };
+    }
+
+    const toDelete = backupFiles.slice(0, backupFiles.length - retentionCount);
+    const basePath = dirPath.endsWith('/') ? dirPath : `${dirPath}/`;
+
+    for (const file of toDelete) {
+      try {
+        await webdavDeleteFile(baseUrl, username, password, `${basePath}${file}`);
+        console.log(`[Backup] Deleted old backup: ${file}`);
+      } catch (err) {
+        console.warn(`[Backup] Failed to delete ${file}:`, err);
+      }
+    }
+
+    return { deleted: toDelete.length, retained: backupFiles.length - toDelete.length };
+  } catch (err) {
+    console.warn('[Backup] Failed to cleanup old backups:', err);
+    return { deleted: 0, retained: 0 };
+  }
+}
+
+async function getActiveConfig(): Promise<{
+  id: string; name: string; url: string; username: string; password: string; path: string;
+} | null> {
+  const db = getDb();
+  const row = db.prepare('SELECT * FROM webdav_configs WHERE is_active = 1').get() as Record<string, unknown> | undefined;
+  if (!row) return null;
+
+  try {
+    const password = decrypt(row.password_encrypted as string, config.encryptionKey);
+    return {
+      id: row.id as string,
+      name: row.name as string,
+      url: row.url as string,
+      username: row.username as string,
+      password,
+      path: (row.path as string) || '/',
+    };
+  } catch (err) {
+    console.warn('[Backup] Failed to decrypt WebDAV password:', err);
+    return null;
+  }
+}
+
+export async function performAutoBackup(): Promise<{
+  success: boolean;
+  message: string;
+  backupTime?: string;
+  retainedCount?: number;
+}> {
+  if (isBackingUp) {
+    return { success: false, message: '另一个备份任务正在执行中' };
+  }
+  isBackingUp = true;
+  try {
+    const activeConfig = await getActiveConfig();
+    if (!activeConfig) {
+      return { success: false, message: '没有活跃的 WebDAV 配置' };
+    }
+
+    // Reset last backup time if active config changed
+    if (lastActiveConfigId !== activeConfig.id) {
+      lastBackupTime = null;
+      lastActiveConfigId = activeConfig.id;
+    }
+
+    const db = getDb();
+    const data = exportAllData(db, false);
+    const timestamp = new Date().toISOString().replace(/:/g, '-').replace(/\..+/, '');
+    const filename = `github-stars-backup-${timestamp}.json`;
+
+    const basePath = activeConfig.path.endsWith('/') ? activeConfig.path : `${activeConfig.path}/`;
+
+    await webdavUpload(activeConfig.url, activeConfig.username, activeConfig.password, `${basePath}${filename}`, JSON.stringify(data));
+
+    lastBackupTime = Date.now();
+
+    // Read retention count from settings
+    const retentionRow = db.prepare("SELECT value FROM settings WHERE key = 'auto_backup_retention_count'").get() as { value: string } | undefined;
+    const retentionCount = retentionRow ? parseInt(retentionRow.value, 10) || 30 : 30;
+
+    let cleanupResult = { deleted: 0, retained: 0 };
+    if (retentionCount > 0) {
+      cleanupResult = await cleanupOldBackups(
+        activeConfig.url, activeConfig.username, activeConfig.password,
+        activeConfig.path, retentionCount
+      );
+    }
+
+    console.log(`[Backup] Auto backup completed: ${filename}, retained ${cleanupResult.retained} files`);
+
+    return {
+      success: true,
+      message: `备份成功: ${filename}`,
+      backupTime: new Date().toISOString(),
+      retainedCount: cleanupResult.retained,
+    };
+  } catch (err) {
+    console.error('[Backup] Auto backup failed:', err);
+    return { success: false, message: `备份失败: ${err instanceof Error ? err.message : '未知错误'}` };
+  } finally {
+    isBackingUp = false;
+  }
+}
+
+// ── Scheduler ──
+
+export function startBackupScheduler(): void {
+  if (schedulerTimer) return;
+
+  // Immediate check on startup
+  checkAndBackup().catch((err) => console.warn('[Backup] Initial backup check failed:', err));
+
+  schedulerTimer = setInterval(() => {
+    checkAndBackup().catch((err) => console.warn('[Backup] Scheduled backup check failed:', err));
+  }, 60000);
+}
+
+export function stopBackupScheduler(): void {
+  if (schedulerTimer) {
+    clearInterval(schedulerTimer);
+    schedulerTimer = null;
+  }
+}
+
+async function checkAndBackup(): Promise<void> {
+  const db = getDb();
+  const enabledRow = db.prepare("SELECT value FROM settings WHERE key = 'auto_backup_enabled'").get() as { value: string } | undefined;
+  const enabled = enabledRow?.value === 'true';
+  if (!enabled) return;
+
+  const activeConfig = await getActiveConfig();
+  if (!activeConfig) return;
+
+  const intervalRow = db.prepare("SELECT value FROM settings WHERE key = 'auto_backup_interval_hours'").get() as { value: string } | undefined;
+  const intervalHours = intervalRow ? parseInt(intervalRow.value, 10) || 24 : 24;
+  const intervalMs = intervalHours * 3600 * 1000;
+
+  if (lastBackupTime && (Date.now() - lastBackupTime) < intervalMs) return;
+
+  await performAutoBackup();
+}
+
+export function getBackupStatus(): {
+  lastBackupTime: string | null;
+  nextScheduledTime: string | null;
+  isEnabled: boolean;
+  activeConfigId: string | null;
+  activeConfigName: string | null;
+  intervalHours: number;
+  retentionCount: number;
+  isBackingUp: boolean;
+} {
+  const db = getDb();
+
+  const enabledRow = db.prepare("SELECT value FROM settings WHERE key = 'auto_backup_enabled'").get() as { value: string } | undefined;
+  const isEnabled = enabledRow?.value === 'true';
+
+  const intervalRow = db.prepare("SELECT value FROM settings WHERE key = 'auto_backup_interval_hours'").get() as { value: string } | undefined;
+  const intervalHours = intervalRow ? parseInt(intervalRow.value, 10) || 24 : 24;
+
+  const retentionRow = db.prepare("SELECT value FROM settings WHERE key = 'auto_backup_retention_count'").get() as { value: string } | undefined;
+  const retentionCount = retentionRow ? parseInt(retentionRow.value, 10) || 30 : 30;
+
+  const activeConfig = db.prepare('SELECT id, name FROM webdav_configs WHERE is_active = 1').get() as { id: string; name: string } | undefined;
+
+  const nextScheduledTime = (isEnabled && lastBackupTime)
+    ? new Date(lastBackupTime + intervalHours * 3600 * 1000).toISOString()
+    : null;
+
+  return {
+    lastBackupTime: lastBackupTime ? new Date(lastBackupTime).toISOString() : null,
+    nextScheduledTime,
+    isEnabled,
+    activeConfigId: activeConfig?.id ?? null,
+    activeConfigName: activeConfig?.name ?? null,
+    intervalHours,
+    retentionCount,
+    isBackingUp,
+  };
+}
diff --git a/skills-lock.json b/skills-lock.json
new file mode 100644
index 0000000..7652f59
--- /dev/null
+++ b/skills-lock.json
@@ -0,0 +1,89 @@
+{
+  "version": 1,
+  "skills": {
+    "caveman": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/productivity/caveman/SKILL.md",
+      "computedHash": "934433479903febc585bf6deb5f0cebc63137e3f86b7babe0aab1ecb94d6d7a4"
+    },
+    "diagnose": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/diagnose/SKILL.md",
+      "computedHash": "15939a26f86edec2d4862042b8564e5a062cb81d04e047a0cea6305c8830b5f5"
+    },
+    "grill-me": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/productivity/grill-me/SKILL.md",
+      "computedHash": "784f0dbb7403b0f00324bce9a112f715342777a0daee7bbb7385f9c6f0a170ea"
+    },
+    "grill-with-docs": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/grill-with-docs/SKILL.md",
+      "computedHash": "31a5b1ae116558bf7d3f633f442835f54bd7645923d4f45c7823e52a97317666"
+    },
+    "handoff": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/productivity/handoff/SKILL.md",
+      "computedHash": "d543685cbfb0c64b7bc51a8dc3465975528da9b64f987f863765973b2f3867ab"
+    },
+    "improve-codebase-architecture": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/improve-codebase-architecture/SKILL.md",
+      "computedHash": "c77b86b4332919499608f9af1880074e1fec65a59b95c70c27a9f39cd137865e"
+    },
+    "prototype": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/prototype/SKILL.md",
+      "computedHash": "aa9d68879fb51af13d47247b5fb73474324e38985ead454e6ea85b64344b7485"
+    },
+    "setup-matt-pocock-skills": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/setup-matt-pocock-skills/SKILL.md",
+      "computedHash": "0164a8b1ef998abca426056c6ed8a7716a9d4692fc6daa5378f68381a6dafd24"
+    },
+    "tdd": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/tdd/SKILL.md",
+      "computedHash": "15a7b5e36383ebadb2dec5e586679e55e9663d292da418926b8da6fc0ef27d84"
+    },
+    "to-issues": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/to-issues/SKILL.md",
+      "computedHash": "47f648f3414848ccfc62cb41d2828b7e575fb5e7cbd6c4bdf630c063b5dc5e82"
+    },
+    "to-prd": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/to-prd/SKILL.md",
+      "computedHash": "6d741474efd4bc3db55fabc2722ed78ca9c374cabcb6212936d79d4fd4a30fcb"
+    },
+    "triage": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/triage/SKILL.md",
+      "computedHash": "2b6efb6da12d92551772fcc04acf331f4e0e6f7bd9d4cb23ce0b301e0b128feb"
+    },
+    "write-a-skill": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/productivity/write-a-skill/SKILL.md",
+      "computedHash": "b44d8aab2ead83c716e01af4c9a24ccc4575ce70ad58ec4f1749fb88c9cc82ba"
+    },
+    "zoom-out": {
+      "source": "mattpocock/skills",
+      "sourceType": "github",
+      "skillPath": "skills/engineering/zoom-out/SKILL.md",
+      "computedHash": "8357aeaece3b709c442eab67e64b86844e05e2f1ea95b109565eba50b6def36e"
+    }
+  }
+}
diff --git a/src/components/SettingsPanel.tsx b/src/components/SettingsPanel.tsx
index 6bd9810..85995eb 100644
--- a/src/components/SettingsPanel.tsx
+++ b/src/components/SettingsPanel.tsx
@@ -5,6 +5,7 @@ import {
   Bot,
   Cloud,
   Database,
+  Clock,
   Server,
   Package,
   X,
@@ -16,12 +17,13 @@ import {
   AIConfigPanel,
   WebDAVPanel,
   BackupPanel,
+  AutoBackupPanel,
   BackendPanel,
   CategoryPanel,
   DataManagementPanel,
 } from './settings';
 
-type SettingsTab = 'general' | 'ai' | 'webdav' | 'backup' | 'backend' | 'category' | 'data';
+type SettingsTab = 'general' | 'ai' | 'webdav' | 'backup' | 'auto-backup' | 'backend' | 'category' | 'data';
 
 interface SettingsTabItem {
   id: SettingsTab;
@@ -267,6 +269,11 @@ export const SettingsPanel: React.FC<SettingsPanelProps> = ({
       label: t('备份恢复', 'Backup'),
       icon: <Database className="w-5 h-5" />,
     },
+    {
+      id: 'auto-backup',
+      label: t('自动备份', 'Auto Backup'),
+      icon: <Clock className="w-5 h-5" />,
+    },
     {
       id: 'backend',
       label: t('后端同步', 'Backend'),
@@ -295,6 +302,8 @@ export const SettingsPanel: React.FC<SettingsPanelProps> = ({
           return <WebDAVPanel t={t} />;
         case 'backup':
           return <BackupPanel t={t} />;
+        case 'auto-backup':
+          return <AutoBackupPanel t={t} />;
         case 'backend':
           return <BackendPanel t={t} />;
         case 'category':
diff --git a/src/components/settings/AutoBackupPanel.tsx b/src/components/settings/AutoBackupPanel.tsx
new file mode 100644
index 0000000..830396f
--- /dev/null
+++ b/src/components/settings/AutoBackupPanel.tsx
@@ -0,0 +1,253 @@
+import React, { useState, useEffect } from 'react';
+import { Clock, RotateCw, AlertCircle, CheckCircle2 } from 'lucide-react';
+import { backend } from '../../services/backendAdapter';
+import { useAppStore } from '../../store/useAppStore';
+import { useDialog } from '../../hooks/useDialog';
+
+interface AutoBackupPanelProps {
+  t: (zh: string, en: string) => string;
+}
+
+export const AutoBackupPanel: React.FC<AutoBackupPanelProps> = ({ t }) => {
+  const { webdavConfigs, activeWebDAVConfig } = useAppStore();
+  const { toast } = useDialog();
+
+  const [enabled, setEnabled] = useState(false);
+  const [intervalHours, setIntervalHours] = useState(24);
+  const [retentionCount, setRetentionCount] = useState(30);
+  const [loading, setLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+  const [triggering, setTriggering] = useState(false);
+
+  const [lastBackup, setLastBackup] = useState<string | null>(null);
+  const [nextBackup, setNextBackup] = useState<string | null>(null);
+  const [activeConfigName, setActiveConfigName] = useState<string | null>(null);
+
+  const activeConfig = webdavConfigs.find(c => c.id === activeWebDAVConfig);
+
+  useEffect(() => {
+    loadSettings();
+    loadStatus();
+  }, []);
+
+  const loadSettings = async () => {
+    try {
+      if (!backend.isAvailable) { setLoading(false); return; }
+      const settings = await backend.fetchBackupSettings();
+      setEnabled(settings.auto_backup_enabled);
+      setIntervalHours(settings.auto_backup_interval_hours);
+      setRetentionCount(settings.auto_backup_retention_count);
+    } catch {
+      // silent fail
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const loadStatus = async () => {
+    try {
+      if (!backend.isAvailable) return;
+      const status = await backend.fetchBackupStatus();
+      setLastBackup(status.lastBackupTime);
+      setNextBackup(status.nextScheduledTime);
+      setActiveConfigName(status.activeConfigName);
+    } catch {
+      // silent fail
+    }
+  };
+
+  const handleSave = async () => {
+    setSaving(true);
+    try {
+      await backend.updateBackupSettings({
+        auto_backup_enabled: enabled,
+        auto_backup_interval_hours: intervalHours,
+        auto_backup_retention_count: retentionCount,
+      });
+      await loadStatus();
+      toast(
+        t('自动备份设置已保存', 'Auto backup settings saved'),
+        'success'
+      );
+    } catch (err) {
+      toast(
+        t(`保存失败: ${err instanceof Error ? err.message : '未知错误'}`, `Failed to save: ${err instanceof Error ? err.message : 'Unknown error'}`),
+        'error'
+      );
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const handleTrigger = async () => {
+    setTriggering(true);
+    try {
+      const result = await backend.triggerBackup();
+      if (result.success) {
+        toast(
+          t(`备份成功: ${result.message}`, `Backup successful: ${result.message}`),
+          'success'
+        );
+      } else {
+        toast(
+          t(`备份失败: ${result.message}`, `Backup failed: ${result.message}`),
+          'error'
+        );
+      }
+      await loadStatus();
+    } catch (err) {
+      toast(
+        t(`触发备份失败: ${err instanceof Error ? err.message : '未知错误'}`, `Trigger backup failed: ${err instanceof Error ? err.message : 'Unknown error'}`),
+        'error'
+      );
+    } finally {
+      setTriggering(false);
+    }
+  };
+
+  const formatTime = (iso: string | null): string => {
+    if (!iso) return t('暂无', 'None');
+    try {
+      return new Date(iso).toLocaleString();
+    } catch {
+      return iso;
+    }
+  };
+
+  if (loading) {
+    return (
+      <div className="p-4 bg-gray-50 dark:bg-gray-800 rounded-lg">
+        <div className="animate-pulse h-4 w-32 bg-gray-300 dark:bg-gray-600 rounded" />
+      </div>
+    );
+  }
+
+  const noActiveConfig = !activeConfig;
+
+  return (
+    <div className="space-y-4">
+      <div className="flex items-center gap-2">
+        <Clock className="w-5 h-5 text-gray-600 dark:text-gray-400" />
+        <h3 className="text-lg font-semibold text-gray-900 dark:text-gray-100">
+          {t('自动备份', 'Auto Backup')}
+        </h3>
+      </div>
+
+      {noActiveConfig && (
+        <div className="flex items-start gap-2 p-3 bg-yellow-50 dark:bg-yellow-900/20 rounded-lg text-sm text-yellow-800 dark:text-yellow-200">
+          <AlertCircle className="w-4 h-4 mt-0.5 shrink-0" />
+          <span>{t(
+            '请先在 WebDAV 设置中激活一个配置以启用自动备份。',
+            'Please activate a WebDAV configuration first to enable auto backup.'
+          )}</span>
+        </div>
+      )}
+
+      {/* Enable toggle */}
+      <div className="flex items-center justify-between">
+        <label className="text-sm font-medium text-gray-700 dark:text-gray-300">
+          {t('启用自动备份', 'Enable Auto Backup')}
+        </label>
+        <button
+          type="button"
+          role="switch"
+          aria-checked={enabled}
+          disabled={noActiveConfig}
+          onClick={() => setEnabled(!enabled)}
+          className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 ${
+            noActiveConfig ? 'opacity-50 cursor-not-allowed' : ''
+          } ${enabled ? 'bg-blue-600' : 'bg-gray-300 dark:bg-gray-600'}`}
+        >
+          <span
+            className={`inline-block h-4 w-4 transform rounded-full bg-white transition-transform ${
+              enabled ? 'translate-x-6' : 'translate-x-1'
+            }`}
+          />
+        </button>
+      </div>
+
+      {/* Interval */}
+      <div>
+        <label className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">
+          {t('备份间隔（小时）', 'Backup Interval (Hours)')}
+        </label>
+        <input
+          type="number"
+          min={1}
+          max={720}
+          value={intervalHours}
+          onChange={(e) => setIntervalHours(Math.max(1, Math.min(720, parseInt(e.target.value) || 24)))}
+          className="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 focus:ring-2 focus:ring-blue-500 focus:border-transparent"
+        />
+        <p className="mt-1 text-xs text-gray-500 dark:text-gray-400">
+          {t('范围: 1-720 小时 (最多30天)', 'Range: 1-720 hours (up to 30 days)')}
+        </p>
+      </div>
+
+      {/* Retention */}
+      <div>
+        <label className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">
+          {t('保留最近份数', 'Retention Count')}
+        </label>
+        <input
+          type="number"
+          min={0}
+          max={365}
+          value={retentionCount}
+          onChange={(e) => setRetentionCount(Math.max(0, Math.min(365, parseInt(e.target.value) || 0)))}
+          className="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 focus:ring-2 focus:ring-blue-500 focus:border-transparent"
+        />
+        <p className="mt-1 text-xs text-gray-500 dark:text-gray-400">
+          {t('0 = 不限制, 最大 365 份', '0 = unlimited, max 365')}
+        </p>
+      </div>
+
+      {/* Save button */}
+      <button
+        onClick={handleSave}
+        disabled={saving}
+        className="w-full px-4 py-2 bg-blue-600 hover:bg-blue-700 disabled:opacity-50 disabled:cursor-not-allowed text-white rounded-lg transition-colors flex items-center justify-center gap-2"
+      >
+        <RotateCw className={`w-4 h-4 ${saving ? 'animate-spin' : ''}`} />
+        {saving ? t('保存中...', 'Saving...') : t('保存设置', 'Save Settings')}
+      </button>
+
+      {/* Status */}
+      <div className="p-3 bg-gray-50 dark:bg-gray-800 rounded-lg space-y-2 text-sm">
+        <div className="flex items-center gap-2">
+          {enabled ? (
+            <CheckCircle2 className="w-4 h-4 text-green-500" />
+          ) : (
+            <AlertCircle className="w-4 h-4 text-gray-400" />
+          )}
+          <span className="text-gray-600 dark:text-gray-400">
+            {t('状态', 'Status')}: {enabled ? t('已启用', 'Enabled') : t('已禁用', 'Disabled')}
+          </span>
+        </div>
+        {activeConfigName && (
+          <div className="text-gray-600 dark:text-gray-400">
+            {t('活跃配置', 'Active Config')}: {activeConfigName}
+          </div>
+        )}
+        <div className="text-gray-600 dark:text-gray-400">
+          {t('上次备份', 'Last Backup')}: {formatTime(lastBackup)}
+        </div>
+        {enabled && nextBackup && (
+          <div className="text-gray-600 dark:text-gray-400">
+            {t('下次备份', 'Next Backup')}: {formatTime(nextBackup)}
+          </div>
+        )}
+      </div>
+
+      {/* Trigger button */}
+      <button
+        onClick={handleTrigger}
+        disabled={triggering || !activeConfig}
+        className="w-full px-4 py-2 border border-gray-300 dark:border-gray-600 hover:bg-gray-50 dark:hover:bg-gray-700 disabled:opacity-50 disabled:cursor-not-allowed text-gray-700 dark:text-gray-300 rounded-lg transition-colors flex items-center justify-center gap-2"
+      >
+        <RotateCw className={`w-4 h-4 ${triggering ? 'animate-spin' : ''}`} />
+        {triggering ? t('备份中...', 'Backing up...') : t('立即备份', 'Backup Now')}
+      </button>
+    </div>
+  );
+};
diff --git a/src/components/settings/index.ts b/src/components/settings/index.ts
index d7e71ff..425c602 100644
--- a/src/components/settings/index.ts
+++ b/src/components/settings/index.ts
@@ -1,6 +1,7 @@
 export { AIConfigPanel } from './AIConfigPanel';
 export { WebDAVPanel } from './WebDAVPanel';
 export { BackupPanel } from './BackupPanel';
+export { AutoBackupPanel } from './AutoBackupPanel';
 export { BackendPanel } from './BackendPanel';
 export { CategoryPanel } from './CategoryPanel';
 export { GeneralPanel } from './GeneralPanel';
diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index 566ee99..65fcef8 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -775,6 +775,90 @@ class BackendAdapter {
       followers: number;
     }> }>;
   }
+
+  // === Backup Settings ===
+
+  async fetchBackupSettings(): Promise<{
+    auto_backup_enabled: boolean;
+    auto_backup_interval_hours: number;
+    auto_backup_retention_count: number;
+  }> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/backup/settings`, {
+      headers: this.getAuthHeaders()
+    });
+    if (!res.ok) await this.throwTranslatedError(res, 'Fetch backup settings error');
+    return res.json() as Promise<{
+      auto_backup_enabled: boolean;
+      auto_backup_interval_hours: number;
+      auto_backup_retention_count: number;
+    }>;
+  }
+
+  async updateBackupSettings(settings: {
+    auto_backup_enabled?: boolean;
+    auto_backup_interval_hours?: number;
+    auto_backup_retention_count?: number;
+  }): Promise<void> {
+    if (!this._backendUrl) return;
+
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/backup/settings`, {
+      method: 'PUT',
+      headers: this.getAuthHeaders(),
+      body: JSON.stringify(settings),
+    });
+    if (!res.ok) await this.throwTranslatedError(res, 'Update backup settings error');
+  }
+
+  async fetchBackupStatus(): Promise<{
+    lastBackupTime: string | null;
+    nextScheduledTime: string | null;
+    isEnabled: boolean;
+    activeConfigId: string | null;
+    activeConfigName: string | null;
+    intervalHours: number;
+    retentionCount: number;
+    isBackingUp: boolean;
+  }> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/backup/status`, {
+      headers: this.getAuthHeaders()
+    });
+    if (!res.ok) await this.throwTranslatedError(res, 'Fetch backup status error');
+    return res.json() as Promise<{
+      lastBackupTime: string | null;
+      nextScheduledTime: string | null;
+      isEnabled: boolean;
+      activeConfigId: string | null;
+      activeConfigName: string | null;
+      intervalHours: number;
+      retentionCount: number;
+      isBackingUp: boolean;
+    }>;
+  }
+
+  async triggerBackup(): Promise<{
+    success: boolean;
+    message: string;
+    backupTime?: string;
+    retainedCount?: number;
+  }> {
+    if (!this._backendUrl) throw new Error('Backend not available');
+
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/backup/trigger`, {
+      method: 'POST',
+      headers: this.getAuthHeaders(),
+    });
+    if (!res.ok) await this.throwTranslatedError(res, 'Trigger backup error');
+    return res.json() as Promise<{
+      success: boolean;
+      message: string;
+      backupTime?: string;
+      retainedCount?: number;
+    }>;
+  }
 }
 
 export const backend = new BackendAdapter();
diff --git a/src/services/webdavService.ts b/src/services/webdavService.ts
index 64a9603..85339ca 100644
--- a/src/services/webdavService.ts
+++ b/src/services/webdavService.ts
@@ -531,6 +531,53 @@ export class WebDAVService {
     }
   }
 
+  async deleteFile(filename: string): Promise<boolean> {
+    try {
+      if (this.useProxy) {
+        const response = await this.proxyFetch('DELETE', this.getRelativePath(filename));
+        if (response.ok) return true;
+        if (response.status === 404) return false;
+        if (response.status === 401) throw new Error('身份验证失败。请检查用户名和密码。');
+        throw new Error(`删除失败，HTTP状态码 ${response.status}`);
+      }
+
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 15000);
+
+      try {
+        const response = await fetch(this.getFullPath(filename), {
+          method: 'DELETE',
+          headers: {
+            'Authorization': this.getAuthHeader(),
+          },
+          signal: controller.signal,
+        });
+
+        clearTimeout(timeoutId);
+
+        if (response.ok) return true;
+        if (response.status === 404) return false;
+        if (response.status === 401) throw new Error('身份验证失败。请检查用户名和密码。');
+        throw new Error(`删除失败，HTTP状态码 ${response.status}: ${response.statusText}`);
+      } catch (fetchError: unknown) {
+        clearTimeout(timeoutId);
+
+        if ((fetchError as Error).name === 'AbortError') {
+          throw new Error('删除超时。请检查网络连接。');
+        }
+
+        throw fetchError;
+      }
+    } catch (error: unknown) {
+      const err = error as Error;
+      if (err.message.includes('身份验证失败') ||
+          err.message.includes('删除超时')) {
+        throw error;
+      }
+      return this.handleNetworkError(error, '删除');
+    }
+  }
+
   private parsePropfindXml(xmlText: string): string[] {
     const collectionUrl = `${this.config.url}${this.basePath}`;
 

From d3821084a2761e8f26d6263a907d9db015a45027 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 11:35:26 +0800
Subject: [PATCH 35/47] =?UTF-8?q?fix:=20CodeRabbit=E5=AE=A1=E6=9F=A5?=
 =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20=E2=80=94=20webdavDeleteFile=E8=BF=94?=
 =?UTF-8?q?=E5=9B=9E=E5=80=BC=E3=80=81=E8=BE=93=E5=85=A5=E6=A0=A1=E9=AA=8C?=
 =?UTF-8?q?=E3=80=81=E6=97=A0=E9=9A=9C=E7=A2=8D=E5=B1=9E=E6=80=A7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- webdavDeleteFile 返回 boolean，清理逻辑根据实际删除结果计数
- backup settings 路由增加 req.body 类型检查和 Number.isInteger 校验
- AutoBackupPanel 开关和输入框添加 aria-labelledby/htmlFor 关联
---
 server/src/routes/backup.ts                 | 22 +++++++++++++++++++--
 server/src/services/backupService.ts        | 21 +++++++++++++-------
 src/components/settings/AutoBackupPanel.tsx |  9 ++++++---
 3 files changed, 40 insertions(+), 12 deletions(-)

diff --git a/server/src/routes/backup.ts b/server/src/routes/backup.ts
index 6c2ba37..6836e2c 100644
--- a/server/src/routes/backup.ts
+++ b/server/src/routes/backup.ts
@@ -37,6 +37,12 @@ router.get('/api/backup/settings', (_req, res) => {
 router.put('/api/backup/settings', (req, res) => {
   try {
     const db = getDb();
+
+    if (!req.body || typeof req.body !== 'object' || Array.isArray(req.body)) {
+      res.status(400).json({ error: '请求体格式无效', code: 'VALIDATION_FAILED' });
+      return;
+    }
+
     const { auto_backup_enabled, auto_backup_interval_hours, auto_backup_retention_count } = req.body as {
       auto_backup_enabled?: boolean;
       auto_backup_interval_hours?: number;
@@ -46,13 +52,25 @@ router.put('/api/backup/settings', (req, res) => {
     const errors: string[] = [];
 
     if (auto_backup_interval_hours !== undefined) {
-      if (typeof auto_backup_interval_hours !== 'number' || auto_backup_interval_hours < 1 || auto_backup_interval_hours > 720) {
+      if (
+        typeof auto_backup_interval_hours !== 'number' ||
+        !Number.isFinite(auto_backup_interval_hours) ||
+        !Number.isInteger(auto_backup_interval_hours) ||
+        auto_backup_interval_hours < 1 ||
+        auto_backup_interval_hours > 720
+      ) {
         errors.push('备份间隔必须在 1-720 小时之间');
       }
     }
 
     if (auto_backup_retention_count !== undefined) {
-      if (typeof auto_backup_retention_count !== 'number' || auto_backup_retention_count < 0 || auto_backup_retention_count > 365) {
+      if (
+        typeof auto_backup_retention_count !== 'number' ||
+        !Number.isFinite(auto_backup_retention_count) ||
+        !Number.isInteger(auto_backup_retention_count) ||
+        auto_backup_retention_count < 0 ||
+        auto_backup_retention_count > 365
+      ) {
         errors.push('保留份数必须在 0-365 之间（0 表示不限制）');
       }
     }
diff --git a/server/src/services/backupService.ts b/server/src/services/backupService.ts
index ac1bafb..de1942a 100644
--- a/server/src/services/backupService.ts
+++ b/server/src/services/backupService.ts
@@ -149,7 +149,7 @@ async function webdavDeleteFile(
   username: string,
   password: string,
   filePath: string
-): Promise<void> {
+): Promise<boolean> {
   const result = await proxyRequest({
     url: `${baseUrl}${filePath}`,
     method: 'DELETE',
@@ -158,9 +158,10 @@ async function webdavDeleteFile(
     },
     timeout: 15000,
   });
-  if (result.status < 200 || result.status >= 300) {
-    console.warn(`WebDAV DELETE ${filePath} returned HTTP ${result.status}`);
-  }
+  if (result.status >= 200 && result.status < 300) return true;
+  if (result.status === 404) return false;
+  console.warn(`WebDAV DELETE ${filePath} returned HTTP ${result.status}`);
+  return false;
 }
 
 function parsePropfindXml(xmlText: string): string[] {
@@ -217,16 +218,22 @@ async function cleanupOldBackups(
     const toDelete = backupFiles.slice(0, backupFiles.length - retentionCount);
     const basePath = dirPath.endsWith('/') ? dirPath : `${dirPath}/`;
 
+    let deletedCount = 0;
     for (const file of toDelete) {
       try {
-        await webdavDeleteFile(baseUrl, username, password, `${basePath}${file}`);
-        console.log(`[Backup] Deleted old backup: ${file}`);
+        const deleted = await webdavDeleteFile(baseUrl, username, password, `${basePath}${file}`);
+        if (deleted) {
+          deletedCount++;
+          console.log(`[Backup] Deleted old backup: ${file}`);
+        } else {
+          console.warn(`[Backup] Skip delete (not removed): ${file}`);
+        }
       } catch (err) {
         console.warn(`[Backup] Failed to delete ${file}:`, err);
       }
     }
 
-    return { deleted: toDelete.length, retained: backupFiles.length - toDelete.length };
+    return { deleted: deletedCount, retained: backupFiles.length - deletedCount };
   } catch (err) {
     console.warn('[Backup] Failed to cleanup old backups:', err);
     return { deleted: 0, retained: 0 };
diff --git a/src/components/settings/AutoBackupPanel.tsx b/src/components/settings/AutoBackupPanel.tsx
index 830396f..e24e778 100644
--- a/src/components/settings/AutoBackupPanel.tsx
+++ b/src/components/settings/AutoBackupPanel.tsx
@@ -145,13 +145,14 @@ export const AutoBackupPanel: React.FC<AutoBackupPanelProps> = ({ t }) => {
 
       {/* Enable toggle */}
       <div className="flex items-center justify-between">
-        <label className="text-sm font-medium text-gray-700 dark:text-gray-300">
+        <label id="auto-backup-label" className="text-sm font-medium text-gray-700 dark:text-gray-300">
           {t('启用自动备份', 'Enable Auto Backup')}
         </label>
         <button
           type="button"
           role="switch"
           aria-checked={enabled}
+          aria-labelledby="auto-backup-label"
           disabled={noActiveConfig}
           onClick={() => setEnabled(!enabled)}
           className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 ${
@@ -168,10 +169,11 @@ export const AutoBackupPanel: React.FC<AutoBackupPanelProps> = ({ t }) => {
 
       {/* Interval */}
       <div>
-        <label className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">
+        <label htmlFor="auto-backup-interval" className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">
           {t('备份间隔（小时）', 'Backup Interval (Hours)')}
         </label>
         <input
+          id="auto-backup-interval"
           type="number"
           min={1}
           max={720}
@@ -186,10 +188,11 @@ export const AutoBackupPanel: React.FC<AutoBackupPanelProps> = ({ t }) => {
 
       {/* Retention */}
       <div>
-        <label className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">
+        <label htmlFor="auto-backup-retention" className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">
           {t('保留最近份数', 'Retention Count')}
         </label>
         <input
+          id="auto-backup-retention"
           type="number"
           min={0}
           max={365}

From 1302a63a8b392eb0e8a6c5bc39a0d26ff66661e8 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 11:43:41 +0800
Subject: [PATCH 36/47] =?UTF-8?q?fix:=20CodeRabbit=E5=AE=A1=E6=9F=A5=20?=
 =?UTF-8?q?=E2=80=94=20auto=5Fbackup=5Fenabled=20=E6=B7=BB=E5=8A=A0?=
 =?UTF-8?q?=E5=B8=83=E5=B0=94=E7=B1=BB=E5=9E=8B=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

防止字符串 "false" 被当作 truthy 存储为 'true'。
---
 server/src/routes/backup.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/server/src/routes/backup.ts b/server/src/routes/backup.ts
index 6836e2c..37dc43b 100644
--- a/server/src/routes/backup.ts
+++ b/server/src/routes/backup.ts
@@ -51,6 +51,10 @@ router.put('/api/backup/settings', (req, res) => {
 
     const errors: string[] = [];
 
+    if (auto_backup_enabled !== undefined && typeof auto_backup_enabled !== 'boolean') {
+      errors.push('auto_backup_enabled 必须为布尔类型');
+    }
+
     if (auto_backup_interval_hours !== undefined) {
       if (
         typeof auto_backup_interval_hours !== 'number' ||

From 0a91e0d43d020745f5e1e7fa5e546ddb7f6110d3 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 11:44:55 +0800
Subject: [PATCH 37/47] chore: bump version to 0.6.2

---
 package.json        | 2 +-
 server/package.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 1153563..a84764f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "github-stars-manager",
   "private": true,
-  "version": "0.6.1",
+  "version": "0.6.2",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/server/package.json b/server/package.json
index fd71d3f..c0a7756 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "github-stars-manager-server",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "private": true,
   "type": "module",
   "scripts": {

From dd3c4159f6e0cd6e391c171b1dc43e4e17e2793a Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 12:36:10 +0800
Subject: [PATCH 38/47] =?UTF-8?q?fix:=20=E8=87=AA=E5=8A=A8=E5=A4=87?=
 =?UTF-8?q?=E4=BB=BD400=E9=94=99=E8=AF=AF=E4=BF=AE=E5=A4=8D=E5=8F=8A?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=E5=88=87=E6=8D=A2=E8=B0=83=E5=BA=A6=E7=BC=BA?=
 =?UTF-8?q?=E9=99=B7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- throwTranslatedError 优先使用 data.error 中的具体错误信息，避免校验失败原因被丢弃
- checkAndBackup 增加活跃配置变更检测，切换 WebDAV 配置后立即触发新备份
- 补充 VALIDATION_FAILED 及备份相关错误码映射
---
 server/src/services/backupService.ts | 6 ++++++
 src/services/backendAdapter.ts       | 5 +++++
 src/utils/backendErrors.ts           | 5 +++++
 3 files changed, 16 insertions(+)

diff --git a/server/src/services/backupService.ts b/server/src/services/backupService.ts
index de1942a..2e68db8 100644
--- a/server/src/services/backupService.ts
+++ b/server/src/services/backupService.ts
@@ -353,6 +353,12 @@ async function checkAndBackup(): Promise<void> {
   const activeConfig = await getActiveConfig();
   if (!activeConfig) return;
 
+  // 检测活跃配置是否变更，若变更则重置上次备份时间，确保新配置尽快备份
+  if (lastActiveConfigId !== activeConfig.id) {
+    lastBackupTime = null;
+    lastActiveConfigId = activeConfig.id;
+  }
+
   const intervalRow = db.prepare("SELECT value FROM settings WHERE key = 'auto_backup_interval_hours'").get() as { value: string } | undefined;
   const intervalHours = intervalRow ? parseInt(intervalRow.value, 10) || 24 : 24;
   const intervalMs = intervalHours * 3600 * 1000;
diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index 65fcef8..39c8aba 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -78,10 +78,15 @@ class BackendAdapter {
   }
   private async throwTranslatedError(res: Response, fallbackPrefix: string): Promise<never> {
     let code: string | undefined;
+    let serverError: string | undefined;
     try {
       const data = await res.json();
       code = data.code;
+      serverError = data.error;
     } catch { /* body not JSON */ }
+    if (serverError) {
+      throw new Error(serverError);
+    }
     throw new Error(translateBackendError(code, `${fallbackPrefix}: ${res.status}`));
   }
 
diff --git a/src/utils/backendErrors.ts b/src/utils/backendErrors.ts
index 00dbe5b..4d9c4f1 100644
--- a/src/utils/backendErrors.ts
+++ b/src/utils/backendErrors.ts
@@ -51,6 +51,11 @@ const ERROR_MESSAGES: Record<string, { zh: string; en: string }> = {
   SYNC_AI_CONFIGS_FAILED: { zh: '同步 AI 配置失败', en: 'Failed to sync AI configs' },
   SYNC_WEBDAV_CONFIGS_FAILED: { zh: '同步 WebDAV 配置失败', en: 'Failed to sync WebDAV configs' },
   INVALID_REQUEST: { zh: '无效的请求', en: 'Invalid request' },
+  VALIDATION_FAILED: { zh: '请求参数校验失败', en: 'Request validation failed' },
+  UPDATE_BACKUP_SETTINGS_FAILED: { zh: '更新备份设置失败', en: 'Failed to update backup settings' },
+  FETCH_BACKUP_SETTINGS_FAILED: { zh: '获取备份设置失败', en: 'Failed to fetch backup settings' },
+  FETCH_BACKUP_STATUS_FAILED: { zh: '获取备份状态失败', en: 'Failed to fetch backup status' },
+  TRIGGER_BACKUP_FAILED: { zh: '触发备份失败', en: 'Failed to trigger backup' },
   FETCH_SETTINGS_FAILED: { zh: '获取设置失败', en: 'Failed to fetch settings' },
   UPDATE_SETTINGS_FAILED: { zh: '更新设置失败', en: 'Failed to update settings' },
   // Sync

From 53665012e1f1dd14f54ded827d5eadf68d1de83b Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 12:52:15 +0800
Subject: [PATCH 39/47] =?UTF-8?q?fix:=20=E6=94=B6=E6=95=9B=20data.error=20?=
 =?UTF-8?q?=E7=B1=BB=E5=9E=8B=E5=AE=88=E5=8D=AB=EF=BC=8C=E9=81=BF=E5=85=8D?=
 =?UTF-8?q?=E9=9D=9E=E5=AD=97=E7=AC=A6=E4=B8=B2=E9=94=99=E8=AF=AF=E4=BF=A1?=
 =?UTF-8?q?=E6=81=AF=E9=80=80=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CodeRabbit 审查：data.error 若非字符串会变成 [object Object]，增加 typeof 检查，仅当非空字符串时直抛，否则走 code 翻译回退。
---
 src/services/backendAdapter.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index 39c8aba..ab2aa07 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -80,9 +80,11 @@ class BackendAdapter {
     let code: string | undefined;
     let serverError: string | undefined;
     try {
-      const data = await res.json();
-      code = data.code;
-      serverError = data.error;
+      const data = await res.json() as { code?: unknown; error?: unknown };
+      code = typeof data.code === 'string' ? data.code : undefined;
+      if (typeof data.error === 'string' && data.error.trim()) {
+        serverError = data.error.trim();
+      }
     } catch { /* body not JSON */ }
     if (serverError) {
       throw new Error(serverError);

From d15fa76f66027804f1dcff5dd59f2bbc05f1058e Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 13:16:35 +0800
Subject: [PATCH 40/47] =?UTF-8?q?refactor:=20=E5=90=88=E5=B9=B6=E8=87=AA?=
 =?UTF-8?q?=E5=8A=A8=E5=A4=87=E4=BB=BD=E8=AE=BE=E7=BD=AE=E5=88=B0=E5=A4=87?=
 =?UTF-8?q?=E4=BB=BD=E6=81=A2=E5=A4=8D=E9=9D=A2=E6=9D=BF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 移除独立的自动备份标签页，功能整合进备份与恢复
- 恢复数据支持从备份文件列表中选择特定备份
- 立即备份优先使用后端触发，回退直传 WebDAV
- 修复保存设置时后端不可用误报成功
- 修复上次备份时间取旧值的问题
---
 src/components/SettingsPanel.tsx        |  11 +-
 src/components/settings/BackupPanel.tsx | 572 ++++++++++++++++--------
 src/components/settings/index.ts        |   1 -
 3 files changed, 386 insertions(+), 198 deletions(-)

diff --git a/src/components/SettingsPanel.tsx b/src/components/SettingsPanel.tsx
index 85995eb..6bd9810 100644
--- a/src/components/SettingsPanel.tsx
+++ b/src/components/SettingsPanel.tsx
@@ -5,7 +5,6 @@ import {
   Bot,
   Cloud,
   Database,
-  Clock,
   Server,
   Package,
   X,
@@ -17,13 +16,12 @@ import {
   AIConfigPanel,
   WebDAVPanel,
   BackupPanel,
-  AutoBackupPanel,
   BackendPanel,
   CategoryPanel,
   DataManagementPanel,
 } from './settings';
 
-type SettingsTab = 'general' | 'ai' | 'webdav' | 'backup' | 'auto-backup' | 'backend' | 'category' | 'data';
+type SettingsTab = 'general' | 'ai' | 'webdav' | 'backup' | 'backend' | 'category' | 'data';
 
 interface SettingsTabItem {
   id: SettingsTab;
@@ -269,11 +267,6 @@ export const SettingsPanel: React.FC<SettingsPanelProps> = ({
       label: t('备份恢复', 'Backup'),
       icon: <Database className="w-5 h-5" />,
     },
-    {
-      id: 'auto-backup',
-      label: t('自动备份', 'Auto Backup'),
-      icon: <Clock className="w-5 h-5" />,
-    },
     {
       id: 'backend',
       label: t('后端同步', 'Backend'),
@@ -302,8 +295,6 @@ export const SettingsPanel: React.FC<SettingsPanelProps> = ({
           return <WebDAVPanel t={t} />;
         case 'backup':
           return <BackupPanel t={t} />;
-        case 'auto-backup':
-          return <AutoBackupPanel t={t} />;
         case 'backend':
           return <BackendPanel t={t} />;
         case 'category':
diff --git a/src/components/settings/BackupPanel.tsx b/src/components/settings/BackupPanel.tsx
index 522ffc0..d27723d 100644
--- a/src/components/settings/BackupPanel.tsx
+++ b/src/components/settings/BackupPanel.tsx
@@ -1,8 +1,9 @@
-import React, { useState } from 'react';
-import { Download, Upload, RefreshCw, Cloud, AlertCircle } from 'lucide-react';
+import React, { useState, useEffect } from 'react';
+import { Download, Upload, RefreshCw, Cloud, AlertCircle, Clock, CheckCircle2, RotateCw } from 'lucide-react';
 import { AIConfig, WebDAVConfig } from '../../types';
 import { useAppStore } from '../../store/useAppStore';
 import { WebDAVService } from '../../services/webdavService';
+import { backend } from '../../services/backendAdapter';
 import { useDialog } from '../../hooks/useDialog';
 
 interface BackupPanelProps {
@@ -36,46 +37,122 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
 
   const { toast, confirm } = useDialog();
 
+  const activeConfig = webdavConfigs.find(config => config.id === activeWebDAVConfig);
+  const noActiveConfig = !activeConfig;
+
+  // ─── 自动备份状态 ───
+  const [autoEnabled, setAutoEnabled] = useState(false);
+  const [intervalHours, setIntervalHours] = useState(24);
+  const [retentionCount, setRetentionCount] = useState(30);
+  const [autoLoading, setAutoLoading] = useState(true);
+  const [autoSaving, setAutoSaving] = useState(false);
+
+  // 上次/下次备份（从后端状态获取）
+  const [backendLastBackup, setBackendLastBackup] = useState<string | null>(null);
+  const [nextBackup, setNextBackup] = useState<string | null>(null);
+  const [activeConfigName, setActiveConfigName] = useState<string | null>(null);
+
+  // ─── 手动操作状态 ───
   const [isBackingUp, setIsBackingUp] = useState(false);
   const [isRestoring, setIsRestoring] = useState(false);
+  const [backupFiles, setBackupFiles] = useState<string[]>([]);
+  const [selectedFile, setSelectedFile] = useState<string>('');
+  const [loadingFiles, setLoadingFiles] = useState(false);
 
-  const activeConfig = webdavConfigs.find(config => config.id === activeWebDAVConfig);
+  // ─── 加载自动备份设置和状态 ───
+  useEffect(() => {
+    loadAutoSettings();
+    loadAutoStatus();
+  }, []);
 
-  const handleBackup = async () => {
-    if (!activeConfig) {
-      toast(t('请先配置并激活WebDAV服务。', 'Please configure and activate WebDAV service first.'), 'error');
+  const loadAutoSettings = async () => {
+    try {
+      if (!backend.isAvailable) { setAutoLoading(false); return; }
+      const settings = await backend.fetchBackupSettings();
+      setAutoEnabled(settings.auto_backup_enabled);
+      setIntervalHours(settings.auto_backup_interval_hours);
+      setRetentionCount(settings.auto_backup_retention_count);
+    } catch {
+      // silent
+    } finally {
+      setAutoLoading(false);
+    }
+  };
+
+  const loadAutoStatus = async () => {
+    try {
+      if (!backend.isAvailable) return;
+      const status = await backend.fetchBackupStatus();
+      setBackendLastBackup(status.lastBackupTime);
+      setNextBackup(status.nextScheduledTime);
+      setActiveConfigName(status.activeConfigName);
+    } catch {
+      // silent
+    }
+  };
+
+  const saveAutoSettings = async () => {
+    if (!backend.isAvailable) {
+      toast(t('后端服务不可用，无法保存设置', 'Backend not available, cannot save settings'), 'error');
       return;
     }
+    setAutoSaving(true);
+    try {
+      await backend.updateBackupSettings({
+        auto_backup_enabled: autoEnabled,
+        auto_backup_interval_hours: intervalHours,
+        auto_backup_retention_count: retentionCount,
+      });
+      await loadAutoStatus();
+      toast(t('自动备份设置已保存', 'Auto backup settings saved'), 'success');
+    } catch (err) {
+      toast(
+        t(`保存失败: ${err instanceof Error ? err.message : '未知错误'}`, `Failed to save: ${err instanceof Error ? err.message : 'Unknown error'}`),
+        'error'
+      );
+    } finally {
+      setAutoSaving(false);
+    }
+  };
 
+  const triggerBackup = async () => {
     setIsBackingUp(true);
     try {
-      const webdavService = new WebDAVService(activeConfig);
+      // 优先使用后端触发（含保留策略清理）
+      if (backend.isAvailable) {
+        const result = await backend.triggerBackup();
+        if (result.success) {
+          setLastBackup(new Date().toISOString());
+          await loadAutoStatus();
+          toast(t(`备份成功: ${result.message}`, `Backup successful: ${result.message}`), 'success');
+        } else {
+          toast(t(`备份失败: ${result.message}`, `Backup failed: ${result.message}`), 'error');
+        }
+        return;
+      }
 
+      // 回退：前端直传 WebDAV
+      if (!activeConfig) {
+        toast(t('请先配置并激活WebDAV服务。', 'Please configure and activate WebDAV service first.'), 'error');
+        return;
+      }
+      const webdavService = new WebDAVService(activeConfig);
       const backupData = {
         repositories,
         releases,
         customCategories,
         hiddenDefaultCategoryIds,
-        aiConfigs: aiConfigs.map(config => ({
-          ...config,
-          apiKey: config.apiKey ? '***' : ''
-        })),
-        webdavConfigs: webdavConfigs.map(config => ({
-          ...config,
-          password: config.password ? '***' : ''
-        })),
+        aiConfigs: aiConfigs.map(config => ({ ...config, apiKey: config.apiKey ? '***' : '' })),
+        webdavConfigs: webdavConfigs.map(config => ({ ...config, password: config.password ? '***' : '' })),
         exportedAt: new Date().toISOString(),
         version: '1.0'
       };
-
       const filename = `github-stars-backup-${new Date().toISOString().split('T')[0]}.json`;
       const success = await webdavService.uploadFile(filename, JSON.stringify(backupData, null, 2));
-
       if (success) {
         setLastBackup(new Date().toISOString());
         toast(t('数据备份成功！', 'Data backup successful!'), 'success');
       } else {
-        console.error('Backup failed: uploadFile returned falsy');
         toast(t('数据备份失败！', 'Data backup failed!'), 'error');
       }
     } catch (error) {
@@ -86,15 +163,45 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
     }
   };
 
+  // ─── 加载备份文件列表 ───
+  const loadBackupFiles = async () => {
+    if (!activeConfig) {
+      toast(t('请先配置并激活WebDAV服务。', 'Please configure and activate WebDAV service first.'), 'error');
+      return;
+    }
+    setLoadingFiles(true);
+    try {
+      const webdavService = new WebDAVService(activeConfig);
+      const files = await webdavService.listFiles();
+      const backupFiles = files
+        .filter(file => file.startsWith('github-stars-backup-') && file.endsWith('.json'))
+        .sort()
+        .reverse();
+      setBackupFiles(backupFiles);
+      if (backupFiles.length > 0 && !selectedFile) {
+        setSelectedFile(backupFiles[0]);
+      }
+    } catch (error) {
+      toast(`${t('获取备份列表失败', 'Failed to load backup list')}: ${(error as Error).message}`, 'error');
+    } finally {
+      setLoadingFiles(false);
+    }
+  };
+
+  // ─── 恢复 ───
   const handleRestore = async () => {
     if (!activeConfig) {
       toast(t('请先配置并激活WebDAV服务。', 'Please configure and activate WebDAV service first.'), 'error');
       return;
     }
+    if (!selectedFile) {
+      toast(t('请先选择一个备份文件。', 'Please select a backup file first.'), 'error');
+      return;
+    }
 
     const confirmed = await confirm(
       t('恢复数据', 'Restore Data'),
-      t('恢复数据将覆盖当前所有数据，是否继续？', 'Restoring data will overwrite all current data. Continue?'),
+      t(`将从 ${selectedFile} 恢复数据，当前所有数据将被覆盖，是否继续？`, `Will restore data from ${selectedFile}. All current data will be overwritten. Continue?`),
       { type: 'warning' }
     );
     if (!confirmed) return;
@@ -102,154 +209,98 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
     setIsRestoring(true);
     try {
       const webdavService = new WebDAVService(activeConfig);
-      const files = await webdavService.listFiles();
-
-      const backupFiles = files.filter(file => file.startsWith('github-stars-backup-'));
-      if (backupFiles.length === 0) {
-        toast(t('未找到备份文件。', 'No backup files found.'), 'error');
-        return;
-      }
-
-      const latestBackup = backupFiles.sort().reverse()[0];
-      const backupContent = await webdavService.downloadFile(latestBackup);
+      const backupContent = await webdavService.downloadFile(selectedFile);
 
       if (!backupContent) {
         toast(t('备份文件内容为空，无法恢复。', 'Backup file is empty, cannot restore.'), 'error');
         return;
       }
 
-      try {
-        const backupData = JSON.parse(backupContent);
+      const backupData = JSON.parse(backupContent);
+
+      if (Array.isArray(backupData.repositories)) {
+        setRepositories(backupData.repositories);
+      }
+      if (Array.isArray(backupData.releases)) {
+        setReleases(backupData.releases);
+      }
 
-        if (Array.isArray(backupData.repositories)) {
-          setRepositories(backupData.repositories);
+      // 分类
+      const currentCategories = useAppStore.getState().customCategories;
+      if (Array.isArray(currentCategories)) {
+        for (const cat of currentCategories) {
+          if (cat && cat.id) deleteCustomCategory(cat.id);
         }
-        if (Array.isArray(backupData.releases)) {
-          setReleases(backupData.releases);
+      }
+      if (Array.isArray(backupData.customCategories)) {
+        for (const cat of backupData.customCategories) {
+          if (cat && cat.id && cat.name) addCustomCategory({ ...cat, isCustom: true });
         }
-
-        try {
-          // 先获取当前所有自定义分类并删除
-          const currentCategories = useAppStore.getState().customCategories;
-          if (Array.isArray(currentCategories)) {
-            for (const cat of currentCategories) {
-              if (cat && cat.id) {
-                deleteCustomCategory(cat.id);
-              }
-            }
-          }
-          // 添加备份中的分类
-          if (Array.isArray(backupData.customCategories)) {
-            for (const cat of backupData.customCategories) {
-              if (cat && cat.id && cat.name) {
-                addCustomCategory({ ...cat, isCustom: true });
-              }
-            }
-          }
-          // 在 restore 回调中，先获取最新状态
-          const currentHidden = useAppStore.getState().hiddenDefaultCategoryIds;
-          // 显示当前隐藏的分类（恢复前它们被隐藏，需要显示）
-          if (Array.isArray(currentHidden)) {
-            for (const categoryId of currentHidden) {
-              if (typeof categoryId === 'string') {
-                showDefaultCategory(categoryId);
-              }
-            }
-          }
-          // 再隐藏备份数据中标记为隐藏的分类
-          if (Array.isArray(backupData.hiddenDefaultCategoryIds)) {
-            for (const categoryId of backupData.hiddenDefaultCategoryIds) {
-              if (typeof categoryId === 'string') {
-                hideDefaultCategory(categoryId);
-              }
-            }
-          }
-        } catch (e) {
-          console.warn('恢复自定义分类时发生问题：', e);
+      }
+      const currentHidden = useAppStore.getState().hiddenDefaultCategoryIds;
+      if (Array.isArray(currentHidden)) {
+        for (const categoryId of currentHidden) {
+          if (typeof categoryId === 'string') showDefaultCategory(categoryId);
+        }
+      }
+      if (Array.isArray(backupData.hiddenDefaultCategoryIds)) {
+        for (const categoryId of backupData.hiddenDefaultCategoryIds) {
+          if (typeof categoryId === 'string') hideDefaultCategory(categoryId);
         }
+      }
 
-        try {
-          if (Array.isArray(backupData.aiConfigs)) {
-            const latestAIConfigs = useAppStore.getState().aiConfigs;
-            const currentMap = new Map(latestAIConfigs.map((c: AIConfig) => [c.id, c]));
-            const backupIdSet = new Set((backupData.aiConfigs as AIConfig[]).map(cfg => cfg.id).filter(Boolean));
-            for (const [id] of currentMap) {
-              if (!backupIdSet.has(id)) {
-                deleteAIConfig(id);
-              }
-            }
-            for (const cfg of backupData.aiConfigs as AIConfig[]) {
-              if (!cfg || !cfg.id) continue;
-              const existing = currentMap.get(cfg.id);
-              if (existing) {
-                updateAIConfig(cfg.id, {
-                  name: cfg.name,
-                  apiType: cfg.apiType,
-                  baseUrl: cfg.baseUrl,
-                  model: cfg.model,
-                  customPrompt: cfg.customPrompt,
-                  useCustomPrompt: cfg.useCustomPrompt,
-                  concurrency: cfg.concurrency,
-                  reasoningEffort: cfg.reasoningEffort,
-                  apiKey: cfg.apiKey || existing.apiKey,
-                  isActive: existing.isActive,
-                });
-              } else {
-                addAIConfig({
-                  ...cfg,
-                  apiKey: cfg.apiKey || '',
-                  isActive: cfg.isActive,
-                });
-              }
-            }
+      // AI 配置
+      if (Array.isArray(backupData.aiConfigs)) {
+        const latestAIConfigs = useAppStore.getState().aiConfigs;
+        const currentMap = new Map(latestAIConfigs.map((c: AIConfig) => [c.id, c]));
+        const backupIdSet = new Set((backupData.aiConfigs as AIConfig[]).map(cfg => cfg.id).filter(Boolean));
+        for (const [id] of currentMap) {
+          if (!backupIdSet.has(id)) deleteAIConfig(id);
+        }
+        for (const cfg of backupData.aiConfigs as AIConfig[]) {
+          if (!cfg || !cfg.id) continue;
+          const existing = currentMap.get(cfg.id);
+          if (existing) {
+            updateAIConfig(cfg.id, {
+              name: cfg.name, apiType: cfg.apiType, baseUrl: cfg.baseUrl,
+              model: cfg.model, customPrompt: cfg.customPrompt,
+              useCustomPrompt: cfg.useCustomPrompt, concurrency: cfg.concurrency,
+              reasoningEffort: cfg.reasoningEffort,
+              apiKey: cfg.apiKey || existing.apiKey, isActive: existing.isActive,
+            });
+          } else {
+            addAIConfig({ ...cfg, apiKey: cfg.apiKey || '', isActive: cfg.isActive });
           }
-        } catch (e) {
-          console.warn('恢复 AI 配置时发生问题：', e);
         }
+      }
 
-        try {
-          if (Array.isArray(backupData.webdavConfigs)) {
-            const latestWebDAVConfigs = useAppStore.getState().webdavConfigs;
-            const currentMap = new Map(latestWebDAVConfigs.map((c: WebDAVConfig) => [c.id, c]));
-            const backupIdSet = new Set((backupData.webdavConfigs as WebDAVConfig[]).map(cfg => cfg.id).filter(Boolean));
-            for (const [id] of currentMap) {
-              if (!backupIdSet.has(id)) {
-                deleteWebDAVConfig(id);
-              }
-            }
-            for (const cfg of backupData.webdavConfigs as WebDAVConfig[]) {
-              if (!cfg || !cfg.id) continue;
-              const existing = currentMap.get(cfg.id);
-              if (existing) {
-                updateWebDAVConfig(cfg.id, {
-                  name: cfg.name,
-                  url: cfg.url,
-                  username: cfg.username,
-                  path: cfg.path,
-                  password: cfg.password || existing.password,
-                  isActive: existing.isActive,
-                });
-              } else {
-                addWebDAVConfig({
-                  ...cfg,
-                  password: cfg.password || '',
-                  isActive: false,
-                });
-              }
-            }
+      // WebDAV 配置
+      if (Array.isArray(backupData.webdavConfigs)) {
+        const latestWebDAVConfigs = useAppStore.getState().webdavConfigs;
+        const currentMap = new Map(latestWebDAVConfigs.map((c: WebDAVConfig) => [c.id, c]));
+        const backupIdSet = new Set((backupData.webdavConfigs as WebDAVConfig[]).map(cfg => cfg.id).filter(Boolean));
+        for (const [id] of currentMap) {
+          if (!backupIdSet.has(id)) deleteWebDAVConfig(id);
+        }
+        for (const cfg of backupData.webdavConfigs as WebDAVConfig[]) {
+          if (!cfg || !cfg.id) continue;
+          const existing = currentMap.get(cfg.id);
+          if (existing) {
+            updateWebDAVConfig(cfg.id, {
+              name: cfg.name, url: cfg.url, username: cfg.username,
+              path: cfg.path, password: cfg.password || existing.password,
+              isActive: existing.isActive,
+            });
+          } else {
+            addWebDAVConfig({ ...cfg, password: cfg.password || '', isActive: false });
           }
-        } catch (e) {
-          console.warn('恢复 WebDAV 配置时发生问题：', e);
         }
-
-        toast(t(
-          `已从备份恢复数据：仓库 ${backupData.repositories?.length ?? 0}，发布 ${backupData.releases?.length ?? 0}，自定义分类 ${backupData.customCategories?.length ?? 0}。`,
-          `Data restored from backup: repositories ${backupData.repositories?.length ?? 0}, releases ${backupData.releases?.length ?? 0}, custom categories ${backupData.customCategories?.length ?? 0}.`
-        ), 'success');
-      } catch (error) {
-        console.error('Restore failed:', error);
-        toast(`${t('恢复失败', 'Restore failed')}: ${(error as Error).message}`, 'error');
       }
+
+      toast(t(
+        `已从 ${selectedFile} 恢复数据：仓库 ${backupData.repositories?.length ?? 0}，发布 ${backupData.releases?.length ?? 0}，自定义分类 ${backupData.customCategories?.length ?? 0}。`,
+        `Restored from ${selectedFile}: repositories ${backupData.repositories?.length ?? 0}, releases ${backupData.releases?.length ?? 0}, custom categories ${backupData.customCategories?.length ?? 0}.`
+      ), 'success');
     } catch (error) {
       console.error('Restore failed:', error);
       toast(`${t('恢复失败', 'Restore failed')}: ${(error as Error).message}`, 'error');
@@ -258,6 +309,13 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
     }
   };
 
+  const formatTime = (iso: string | null): string => {
+    if (!iso) return t('暂无', 'None');
+    try { return new Date(iso).toLocaleString(); } catch { return iso; }
+  };
+
+  // ─── 渲染 ───
+
   return (
     <div className="space-y-6">
       <div className="flex items-center space-x-3">
@@ -267,47 +325,154 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
         </h3>
       </div>
 
-      {!activeConfig && (
-        <div className="p-4 bg-light-surface dark:bg-white/[0.04] rounded-lg border border-black/[0.06] dark:border-white/[0.04] dark:border-black/[0.06] dark:border-white/[0.04]">
-          <div className="flex items-start space-x-3">
-            <AlertCircle className="w-5 h-5 text-gray-700 dark:text-text-secondary mt-0.5" />
-            <div>
-              <p className="text-sm text-gray-700 dark:text-text-secondary ">
-                {t('请先配置并激活WebDAV服务', 'Please configure and activate WebDAV service first')}
-              </p>
-              <p className="text-xs text-gray-700 dark:text-text-secondary mt-1">
-                {t('备份和恢复功能需要WebDAV服务支持', 'Backup and restore features require WebDAV service')}
-              </p>
-            </div>
-          </div>
+      {/* 无活跃配置警告 */}
+      {noActiveConfig && (
+        <div className="flex items-start gap-2 p-3 bg-yellow-50 dark:bg-yellow-900/20 rounded-lg text-sm text-yellow-800 dark:text-yellow-200">
+          <AlertCircle className="w-4 h-4 mt-0.5 shrink-0" />
+          <span>{t(
+            '请先在 WebDAV 设置中激活一个配置以使用备份功能。',
+            'Please activate a WebDAV configuration first to use backup features.'
+          )}</span>
         </div>
       )}
 
-      {lastBackup && (
-        <div className="p-4 bg-light-surface dark:bg-white/[0.04] rounded-lg">
-          <p className="text-sm text-gray-700 dark:text-text-secondary ">
-            <span className="font-medium">{t('上次备份:', 'Last backup:')}</span>{' '}
-            {new Date(lastBackup).toLocaleString()}
-          </p>
+      {/* ─── 自动备份设置 ─── */}
+      <div className="p-4 bg-gray-50 dark:bg-gray-800 rounded-lg space-y-4">
+        <div className="flex items-center gap-2">
+          <Clock className="w-5 h-5 text-gray-600 dark:text-gray-400" />
+          <h4 className="font-medium text-gray-900 dark:text-gray-100">
+            {t('自动备份', 'Auto Backup')}
+          </h4>
         </div>
-      )}
 
+        {autoLoading ? (
+          <div className="animate-pulse h-4 w-32 bg-gray-300 dark:bg-gray-600 rounded" />
+        ) : (
+          <>
+            {/* 启用开关 */}
+            <div className="flex items-center justify-between">
+              <label id="auto-backup-label" className="text-sm font-medium text-gray-700 dark:text-gray-300">
+                {t('启用自动备份', 'Enable Auto Backup')}
+              </label>
+              <button
+                type="button"
+                role="switch"
+                aria-checked={autoEnabled}
+                aria-labelledby="auto-backup-label"
+                disabled={noActiveConfig && !autoEnabled}
+                onClick={() => setAutoEnabled(!autoEnabled)}
+                className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 ${
+                  noActiveConfig && !autoEnabled ? 'opacity-50 cursor-not-allowed' : ''
+                } ${autoEnabled ? 'bg-blue-600' : 'bg-gray-300 dark:bg-gray-600'}`}
+              >
+                <span className={`inline-block h-4 w-4 transform rounded-full bg-white transition-transform ${
+                  autoEnabled ? 'translate-x-6' : 'translate-x-1'
+                }`} />
+              </button>
+            </div>
+
+            {autoEnabled && (
+              <>
+                {/* 间隔 */}
+                <div>
+                  <label htmlFor="auto-backup-interval" className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">
+                    {t('备份间隔（小时）', 'Backup Interval (Hours)')}
+                  </label>
+                  <input
+                    id="auto-backup-interval"
+                    type="number"
+                    min={1} max={720}
+                    value={intervalHours}
+                    onChange={(e) => setIntervalHours(Math.max(1, Math.min(720, parseInt(e.target.value) || 24)))}
+                    className="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 focus:ring-2 focus:ring-blue-500 focus:border-transparent"
+                  />
+                  <p className="mt-1 text-xs text-gray-500 dark:text-gray-400">
+                    {t('范围: 1-720 小时 (最多30天)', 'Range: 1-720 hours (up to 30 days)')}
+                  </p>
+                </div>
+
+                {/* 保留份数 */}
+                <div>
+                  <label htmlFor="auto-backup-retention" className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">
+                    {t('保留最近份数', 'Retention Count')}
+                  </label>
+                  <input
+                    id="auto-backup-retention"
+                    type="number"
+                    min={0} max={365}
+                    value={retentionCount}
+                    onChange={(e) => setRetentionCount(Math.max(0, Math.min(365, parseInt(e.target.value) || 0)))}
+                    className="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 focus:ring-2 focus:ring-blue-500 focus:border-transparent"
+                  />
+                  <p className="mt-1 text-xs text-gray-500 dark:text-gray-400">
+                    {t('0 = 不限制, 最大 365 份', '0 = unlimited, max 365')}
+                  </p>
+                </div>
+              </>
+            )}
+
+            {/* 保存 */}
+            <button
+              onClick={saveAutoSettings}
+              disabled={autoSaving}
+              className="w-full px-4 py-2 bg-blue-600 hover:bg-blue-700 disabled:opacity-50 disabled:cursor-not-allowed text-white rounded-lg transition-colors flex items-center justify-center gap-2"
+            >
+              <RotateCw className={`w-4 h-4 ${autoSaving ? 'animate-spin' : ''}`} />
+              {autoSaving ? t('保存中...', 'Saving...') : t('保存设置', 'Save Settings')}
+            </button>
+
+            {/* 状态信息 */}
+            <div className="p-3 bg-white dark:bg-gray-700 rounded-lg space-y-2 text-sm">
+              <div className="flex items-center gap-2">
+                {autoEnabled ? (
+                  <CheckCircle2 className="w-4 h-4 text-green-500" />
+                ) : (
+                  <AlertCircle className="w-4 h-4 text-gray-400" />
+                )}
+                <span className="text-gray-600 dark:text-gray-400">
+                  {t('状态', 'Status')}: {autoEnabled ? t('已启用', 'Enabled') : t('已禁用', 'Disabled')}
+                </span>
+              </div>
+              {activeConfigName && (
+                <div className="text-gray-600 dark:text-gray-400">
+                  {t('活跃配置', 'Active Config')}: {activeConfigName}
+                </div>
+              )}
+              <div className="text-gray-600 dark:text-gray-400">
+                {t('上次备份', 'Last Backup')}: {formatTime(
+                  backendLastBackup && lastBackup
+                    ? (new Date(backendLastBackup) > new Date(lastBackup) ? backendLastBackup : lastBackup)
+                    : (backendLastBackup || lastBackup)
+                )}
+              </div>
+              {autoEnabled && nextBackup && (
+                <div className="text-gray-600 dark:text-gray-400">
+                  {t('下次备份', 'Next Backup')}: {formatTime(nextBackup)}
+                </div>
+              )}
+            </div>
+          </>
+        )}
+      </div>
+
+      {/* ─── 手动操作 ─── */}
       <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
+        {/* 立即备份 */}
         <div className="p-6 bg-light-bg dark:bg-white/[0.04] rounded-lg border border-black/[0.06] dark:border-white/[0.04]">
           <div className="flex items-center space-x-3 mb-4">
             <Upload className="w-8 h-8 text-gray-700 dark:text-text-secondary" />
             <div>
               <h4 className="font-medium text-gray-900 dark:text-text-primary">
-                {t('备份数据', 'Backup Data')}
+                {t('立即备份', 'Backup Now')}
               </h4>
               <p className="text-sm text-gray-500 dark:text-text-tertiary">
-                {t('将数据备份到WebDAV', 'Backup data to WebDAV')}
+                {t('立即创建一份备份', 'Create a backup immediately')}
               </p>
             </div>
           </div>
           <button
-            onClick={handleBackup}
-            disabled={isBackingUp || !activeConfig}
+            onClick={triggerBackup}
+            disabled={isBackingUp || noActiveConfig}
             className="w-full flex items-center justify-center space-x-2 px-4 py-3 bg-brand-indigo text-white rounded-lg hover:bg-brand-hover transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
           >
             {isBackingUp ? (
@@ -319,6 +484,7 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
           </button>
         </div>
 
+        {/* 恢复数据 */}
         <div className="p-6 bg-light-bg dark:bg-white/[0.04] rounded-lg border border-black/[0.06] dark:border-white/[0.04]">
           <div className="flex items-center space-x-3 mb-4">
             <Download className="w-8 h-8 text-gray-700 dark:text-text-secondary" />
@@ -327,25 +493,57 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
                 {t('恢复数据', 'Restore Data')}
               </h4>
               <p className="text-sm text-gray-500 dark:text-text-tertiary">
-                {t('从WebDAV恢复数据', 'Restore data from WebDAV')}
+                {t('选择备份文件恢复', 'Select a backup file to restore')}
               </p>
             </div>
           </div>
-          <button
-            onClick={handleRestore}
-            disabled={isRestoring || !activeConfig}
-            className="w-full flex items-center justify-center space-x-2 px-4 py-3 bg-brand-indigo text-white rounded-lg hover:bg-brand-hover transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
-          >
-            {isRestoring ? (
-              <RefreshCw className="w-5 h-5 animate-spin" />
-            ) : (
-              <Download className="w-5 h-5" />
-            )}
-            <span>{isRestoring ? t('恢复中...', 'Restoring...') : t('开始恢复', 'Start Restore')}</span>
-          </button>
+
+          {/* 备份文件列表 */}
+          {backupFiles.length > 0 ? (
+            <div className="mb-3">
+              <select
+                id="backup-file-select"
+                value={selectedFile}
+                onChange={(e) => setSelectedFile(e.target.value)}
+                className="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 text-sm focus:ring-2 focus:ring-blue-500 focus:border-transparent"
+              >
+                {backupFiles.map(file => (
+                  <option key={file} value={file}>{file}</option>
+                ))}
+              </select>
+            </div>
+          ) : (
+            <p className="text-sm text-gray-500 dark:text-text-tertiary mb-3">
+              {t('点击下方按钮加载备份文件列表', 'Click the button below to load backup files')}
+            </p>
+          )}
+
+          <div className="flex gap-2">
+            <button
+              onClick={loadBackupFiles}
+              disabled={loadingFiles || noActiveConfig}
+              className="flex-1 flex items-center justify-center space-x-1 px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg text-sm text-gray-700 dark:text-gray-300 hover:bg-gray-50 dark:hover:bg-gray-700 disabled:opacity-50 disabled:cursor-not-allowed transition-colors"
+            >
+              <RefreshCw className={`w-4 h-4 ${loadingFiles ? 'animate-spin' : ''}`} />
+              <span>{loadingFiles ? t('加载中...', 'Loading...') : t('刷新列表', 'Refresh List')}</span>
+            </button>
+            <button
+              onClick={handleRestore}
+              disabled={isRestoring || !selectedFile || noActiveConfig}
+              className="flex-1 flex items-center justify-center space-x-2 px-4 py-2 bg-brand-indigo text-white rounded-lg hover:bg-brand-hover transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+            >
+              {isRestoring ? (
+                <RefreshCw className="w-4 h-4 animate-spin" />
+              ) : (
+                <Download className="w-4 h-4" />
+              )}
+              <span className="text-sm">{isRestoring ? t('恢复中...', 'Restoring...') : t('恢复选中', 'Restore Selected')}</span>
+            </button>
+          </div>
         </div>
       </div>
 
+      {/* ─── 备份内容说明 ─── */}
       <div className="p-4 bg-light-bg dark:bg-white/[0.04] rounded-lg">
         <h4 className="font-medium text-gray-900 dark:text-text-primary mb-2">
           {t('备份内容包括：', 'Backup includes:')}
diff --git a/src/components/settings/index.ts b/src/components/settings/index.ts
index 425c602..d7e71ff 100644
--- a/src/components/settings/index.ts
+++ b/src/components/settings/index.ts
@@ -1,7 +1,6 @@
 export { AIConfigPanel } from './AIConfigPanel';
 export { WebDAVPanel } from './WebDAVPanel';
 export { BackupPanel } from './BackupPanel';
-export { AutoBackupPanel } from './AutoBackupPanel';
 export { BackendPanel } from './BackendPanel';
 export { CategoryPanel } from './CategoryPanel';
 export { GeneralPanel } from './GeneralPanel';

From 6cc793f4efe439dcd0855adef1a7f01fe36997d8 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 13:19:19 +0800
Subject: [PATCH 41/47] =?UTF-8?q?style:=20=E7=BB=9F=E4=B8=80=E5=A4=87?=
 =?UTF-8?q?=E4=BB=BD=E9=9D=A2=E6=9D=BF=E6=8C=89=E9=92=AE=E4=B8=BA=E5=93=81?=
 =?UTF-8?q?=E7=89=8C=E8=89=B2=20brand-indigo?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/components/settings/BackupPanel.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/components/settings/BackupPanel.tsx b/src/components/settings/BackupPanel.tsx
index d27723d..551b8c0 100644
--- a/src/components/settings/BackupPanel.tsx
+++ b/src/components/settings/BackupPanel.tsx
@@ -363,7 +363,7 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
                 onClick={() => setAutoEnabled(!autoEnabled)}
                 className={`relative inline-flex h-6 w-11 items-center rounded-full transition-colors focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 ${
                   noActiveConfig && !autoEnabled ? 'opacity-50 cursor-not-allowed' : ''
-                } ${autoEnabled ? 'bg-blue-600' : 'bg-gray-300 dark:bg-gray-600'}`}
+                } ${autoEnabled ? 'bg-brand-indigo' : 'bg-gray-300 dark:bg-gray-600'}`}
               >
                 <span className={`inline-block h-4 w-4 transform rounded-full bg-white transition-transform ${
                   autoEnabled ? 'translate-x-6' : 'translate-x-1'
@@ -415,7 +415,7 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
             <button
               onClick={saveAutoSettings}
               disabled={autoSaving}
-              className="w-full px-4 py-2 bg-blue-600 hover:bg-blue-700 disabled:opacity-50 disabled:cursor-not-allowed text-white rounded-lg transition-colors flex items-center justify-center gap-2"
+              className="w-full px-4 py-2 bg-brand-indigo hover:bg-brand-hover disabled:opacity-50 disabled:cursor-not-allowed text-white rounded-lg transition-colors flex items-center justify-center gap-2"
             >
               <RotateCw className={`w-4 h-4 ${autoSaving ? 'animate-spin' : ''}`} />
               {autoSaving ? t('保存中...', 'Saving...') : t('保存设置', 'Save Settings')}

From a1675baeb451f0d413c578dab1313646de14f7fa Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 13:33:33 +0800
Subject: [PATCH 42/47] =?UTF-8?q?fix:=20CodeRabbit=20=E5=AE=A1=E6=9F=A5=20?=
 =?UTF-8?q?=E2=80=94=20=E4=BF=AE=E5=A4=8D=E5=8D=A0=E4=BD=8D=E7=AC=A6?=
 =?UTF-8?q?=E6=B1=A1=E6=9F=93=E5=AF=86=E9=92=A5=E3=80=81=E6=8C=89=E9=92=AE?=
 =?UTF-8?q?=E7=A6=81=E7=94=A8=E9=80=BB=E8=BE=91=E5=92=8C=E6=97=A0=E9=9A=9C?=
 =?UTF-8?q?=E7=A2=8D=E6=A0=87=E7=AD=BE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/components/settings/BackupPanel.tsx | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/components/settings/BackupPanel.tsx b/src/components/settings/BackupPanel.tsx
index 551b8c0..b166978 100644
--- a/src/components/settings/BackupPanel.tsx
+++ b/src/components/settings/BackupPanel.tsx
@@ -266,10 +266,10 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
               model: cfg.model, customPrompt: cfg.customPrompt,
               useCustomPrompt: cfg.useCustomPrompt, concurrency: cfg.concurrency,
               reasoningEffort: cfg.reasoningEffort,
-              apiKey: cfg.apiKey || existing.apiKey, isActive: existing.isActive,
+              apiKey: (cfg.apiKey && cfg.apiKey !== '***') ? cfg.apiKey : existing.apiKey, isActive: existing.isActive,
             });
           } else {
-            addAIConfig({ ...cfg, apiKey: cfg.apiKey || '', isActive: cfg.isActive });
+            addAIConfig({ ...cfg, apiKey: (cfg.apiKey && cfg.apiKey !== '***') ? cfg.apiKey : '', isActive: cfg.isActive });
           }
         }
       }
@@ -288,11 +288,11 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
           if (existing) {
             updateWebDAVConfig(cfg.id, {
               name: cfg.name, url: cfg.url, username: cfg.username,
-              path: cfg.path, password: cfg.password || existing.password,
+              path: cfg.path, password: (cfg.password && cfg.password !== '***') ? cfg.password : existing.password,
               isActive: existing.isActive,
             });
           } else {
-            addWebDAVConfig({ ...cfg, password: cfg.password || '', isActive: false });
+            addWebDAVConfig({ ...cfg, password: (cfg.password && cfg.password !== '***') ? cfg.password : '', isActive: false });
           }
         }
       }
@@ -472,7 +472,7 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
           </div>
           <button
             onClick={triggerBackup}
-            disabled={isBackingUp || noActiveConfig}
+            disabled={isBackingUp || (!backend.isAvailable && noActiveConfig)}
             className="w-full flex items-center justify-center space-x-2 px-4 py-3 bg-brand-indigo text-white rounded-lg hover:bg-brand-hover transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
           >
             {isBackingUp ? (
@@ -501,8 +501,10 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
           {/* 备份文件列表 */}
           {backupFiles.length > 0 ? (
             <div className="mb-3">
+              <label htmlFor="backup-file-select" className="sr-only">{t('选择备份文件', 'Select backup file')}</label>
               <select
                 id="backup-file-select"
+                aria-label={t('选择备份文件', 'Select backup file')}
                 value={selectedFile}
                 onChange={(e) => setSelectedFile(e.target.value)}
                 className="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 text-sm focus:ring-2 focus:ring-blue-500 focus:border-transparent"

From bf6f321755949bd036125c7553739da17488ef5d Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Tue, 12 May 2026 14:41:25 +0800
Subject: [PATCH 43/47] =?UTF-8?q?fix:=20=E4=BF=9D=E5=AD=98=E8=87=AA?=
 =?UTF-8?q?=E5=8A=A8=E5=A4=87=E4=BB=BD=E5=89=8D=E7=BD=AE=E5=90=8C=E6=AD=A5?=
 =?UTF-8?q?=20WebDAV=E3=80=81=E6=81=A2=E5=A4=8D=E5=85=BC=E5=AE=B9=E5=90=8E?=
 =?UTF-8?q?=E7=AB=AF=E6=A0=BC=E5=BC=8F=E3=80=81=E6=96=87=E4=BB=B6=E5=90=8D?=
 =?UTF-8?q?=E5=8A=A0=E6=97=B6=E9=97=B4=E6=88=B3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/components/settings/BackupPanel.tsx | 41 +++++++++++++++++++++++--
 1 file changed, 39 insertions(+), 2 deletions(-)

diff --git a/src/components/settings/BackupPanel.tsx b/src/components/settings/BackupPanel.tsx
index b166978..c2fc874 100644
--- a/src/components/settings/BackupPanel.tsx
+++ b/src/components/settings/BackupPanel.tsx
@@ -98,6 +98,10 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
     }
     setAutoSaving(true);
     try {
+      // 启用自动备份时，先同步 WebDAV 配置到后端，确保校验时有活跃配置
+      if (autoEnabled) {
+        await backend.syncWebDAVConfigs(webdavConfigs);
+      }
       await backend.updateBackupSettings({
         auto_backup_enabled: autoEnabled,
         auto_backup_interval_hours: intervalHours,
@@ -147,7 +151,7 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
         exportedAt: new Date().toISOString(),
         version: '1.0'
       };
-      const filename = `github-stars-backup-${new Date().toISOString().split('T')[0]}.json`;
+      const filename = `github-stars-backup-${new Date().toISOString().replace(/:/g, '-').replace(/\..+/, '')}.json`;
       const success = await webdavService.uploadFile(filename, JSON.stringify(backupData, null, 2));
       if (success) {
         setLastBackup(new Date().toISOString());
@@ -178,8 +182,10 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
         .sort()
         .reverse();
       setBackupFiles(backupFiles);
-      if (backupFiles.length > 0 && !selectedFile) {
+      if (backupFiles.length > 0 && (!selectedFile || !backupFiles.includes(selectedFile))) {
         setSelectedFile(backupFiles[0]);
+      } else if (backupFiles.length === 0) {
+        setSelectedFile('');
       }
     } catch (error) {
       toast(`${t('获取备份列表失败', 'Failed to load backup list')}: ${(error as Error).message}`, 'error');
@@ -218,6 +224,36 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
 
       const backupData = JSON.parse(backupContent);
 
+      // 兼容后端备份格式（snake_case → camelCase）
+      if (!backupData.aiConfigs && Array.isArray(backupData.ai_configs)) {
+        backupData.aiConfigs = (backupData.ai_configs as Record<string, unknown>[]).map((c: Record<string, unknown>) => ({
+          id: c.id, name: c.name,
+          apiType: c.api_type || c.apiType,
+          baseUrl: c.base_url || c.baseUrl,
+          model: c.model,
+          apiKey: c.api_key_encrypted ? '***' : (c.apiKey || ''),
+          customPrompt: c.custom_prompt || c.customPrompt,
+          useCustomPrompt: c.use_custom_prompt ?? c.useCustomPrompt,
+          concurrency: c.concurrency,
+          reasoningEffort: c.reasoning_effort || c.reasoningEffort,
+          isActive: c.is_active ?? c.isActive,
+        }));
+      }
+      if (!backupData.webdavConfigs && Array.isArray(backupData.webdav_configs)) {
+        backupData.webdavConfigs = (backupData.webdav_configs as Record<string, unknown>[]).map((c: Record<string, unknown>) => ({
+          id: c.id, name: c.name, url: c.url, username: c.username,
+          password: c.password_encrypted ? '***' : (c.password || ''),
+          path: c.path,
+          isActive: c.is_active ?? c.isActive,
+        }));
+      }
+      if (!backupData.customCategories && Array.isArray(backupData.categories)) {
+        backupData.customCategories = (backupData.categories as Record<string, unknown>[]).map((c: Record<string, unknown>) => ({
+          id: c.id, name: c.name,
+          isCustom: c.is_custom ?? c.isCustom ?? true,
+        }));
+      }
+
       if (Array.isArray(backupData.repositories)) {
         setRepositories(backupData.repositories);
       }
@@ -301,6 +337,7 @@ export const BackupPanel: React.FC<BackupPanelProps> = ({ t }) => {
         `已从 ${selectedFile} 恢复数据：仓库 ${backupData.repositories?.length ?? 0}，发布 ${backupData.releases?.length ?? 0}，自定义分类 ${backupData.customCategories?.length ?? 0}。`,
         `Restored from ${selectedFile}: repositories ${backupData.repositories?.length ?? 0}, releases ${backupData.releases?.length ?? 0}, custom categories ${backupData.customCategories?.length ?? 0}.`
       ), 'success');
+      await loadAutoStatus();
     } catch (error) {
       console.error('Restore failed:', error);
       toast(`${t('恢复失败', 'Restore failed')}: ${(error as Error).message}`, 'error');

From 5f14de8be24e5947ec58ee81fd7de696b858dbd9 Mon Sep 17 00:00:00 2001
From: lostiv <30612717+lostiv@users.noreply.github.com>
Date: Tue, 12 May 2026 19:58:02 +0800
Subject: [PATCH 44/47] =?UTF-8?q?fix:=20WebDAV=20=E9=85=8D=E7=BD=AE?=
 =?UTF-8?q?=E6=BF=80=E6=B4=BB=E5=90=8E=20isActive=20=E5=AD=97=E6=AE=B5?=
 =?UTF-8?q?=E6=9C=AA=E5=90=8C=E6=AD=A5=EF=BC=8C=E5=AF=BC=E8=87=B4=E8=87=AA?=
 =?UTF-8?q?=E5=8A=A8=E5=A4=87=E4=BB=BD=E6=A0=A1=E9=AA=8C=E5=A4=B1=E8=B4=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/store/useAppStore.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/store/useAppStore.ts b/src/store/useAppStore.ts
index 35b907b..c11b7dc 100644
--- a/src/store/useAppStore.ts
+++ b/src/store/useAppStore.ts
@@ -355,7 +355,9 @@ const normalizePersistedState = (
       sortBy: safePersisted.searchFilters?.sortBy || 'stars',
       sortOrder: safePersisted.searchFilters?.sortOrder || 'desc',
     },
-    webdavConfigs: Array.isArray(safePersisted.webdavConfigs) ? safePersisted.webdavConfigs : [],
+    webdavConfigs: Array.isArray(safePersisted.webdavConfigs)
+      ? safePersisted.webdavConfigs.map(c => ({ ...c, isActive: c.id === safePersisted.activeWebDAVConfig }))
+      : [],
     customCategories: Array.isArray(safePersisted.customCategories) ? safePersisted.customCategories : [],
     hiddenDefaultCategoryIds: (() => {
       const persistedIds = (safePersisted as Record<string, unknown>).hiddenDefaultCategoryIds;
@@ -890,7 +892,10 @@ export const useAppStore = create<AppState & AppActions>()(
         webdavConfigs: state.webdavConfigs.filter(config => config.id !== id),
         activeWebDAVConfig: state.activeWebDAVConfig === id ? null : state.activeWebDAVConfig
       })),
-      setActiveWebDAVConfig: (activeWebDAVConfig) => set({ activeWebDAVConfig }),
+      setActiveWebDAVConfig: (activeWebDAVConfig) => set((state) => ({
+        webdavConfigs: state.webdavConfigs.map(c => ({ ...c, isActive: c.id === activeWebDAVConfig })),
+        activeWebDAVConfig
+      })),
       setWebDAVConfigs: (webdavConfigs) => set({ webdavConfigs }),
       setLastBackup: (lastBackup) => set({ lastBackup }),
 

From 8b0c69dcc5dc738e474e33b676daf9f0a429a1b5 Mon Sep 17 00:00:00 2001
From: lostiv <30612717+lostiv@users.noreply.github.com>
Date: Tue, 12 May 2026 20:09:08 +0800
Subject: [PATCH 45/47] =?UTF-8?q?fix:=20hydration=20=E6=97=B6=E6=B8=85?=
 =?UTF-8?q?=E7=90=86=E6=8C=87=E5=90=91=E5=B7=B2=E5=88=A0=E9=99=A4=E9=85=8D?=
 =?UTF-8?q?=E7=BD=AE=E7=9A=84=20activeWebDAVConfig=20=E5=AD=A4=E5=84=BF?=
 =?UTF-8?q?=E5=BC=95=E7=94=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/store/useAppStore.ts | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/src/store/useAppStore.ts b/src/store/useAppStore.ts
index c11b7dc..4d4aa42 100644
--- a/src/store/useAppStore.ts
+++ b/src/store/useAppStore.ts
@@ -355,9 +355,17 @@ const normalizePersistedState = (
       sortBy: safePersisted.searchFilters?.sortBy || 'stars',
       sortOrder: safePersisted.searchFilters?.sortOrder || 'desc',
     },
-    webdavConfigs: Array.isArray(safePersisted.webdavConfigs)
-      ? safePersisted.webdavConfigs.map(c => ({ ...c, isActive: c.id === safePersisted.activeWebDAVConfig }))
-      : [],
+    webdavConfigs: (() => {
+      if (!Array.isArray(safePersisted.webdavConfigs)) return [];
+      return safePersisted.webdavConfigs.map(c => ({ ...c, isActive: c.id === safePersisted.activeWebDAVConfig }));
+    })(),
+    // 如果 activeWebDAVConfig 指向的配置已不存在，清除该引用
+    activeWebDAVConfig: (() => {
+      const configs = safePersisted.webdavConfigs;
+      const id = safePersisted.activeWebDAVConfig;
+      if (!id || !Array.isArray(configs)) return null;
+      return configs.some(c => c.id === id) ? id : null;
+    })(),
     customCategories: Array.isArray(safePersisted.customCategories) ? safePersisted.customCategories : [],
     hiddenDefaultCategoryIds: (() => {
       const persistedIds = (safePersisted as Record<string, unknown>).hiddenDefaultCategoryIds;

From fd20a00f2eea9d33f328b85ae0f4a970d4ea2903 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Wed, 13 May 2026 15:40:42 +0800
Subject: [PATCH 46/47] =?UTF-8?q?@=20fix:=20Release=E5=B7=B2=E8=AF=BB?=
 =?UTF-8?q?=E7=8A=B6=E6=80=81=E8=B7=A8=E8=AE=BE=E5=A4=87=E5=90=8C=E6=AD=A5?=
 =?UTF-8?q?=20+=20=E4=BB=93=E5=BA=93=E5=9B=9B=E5=AD=97=E6=AE=B5=E6=8C=81?=
 =?UTF-8?q?=E4=B9=85=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- store markReleaseAsRead/markAllReleasesAsRead 同步设置 is_read
- backendAdapter 添加 markReleaseAsRead/markAllReleasesAsRead 调用后端
- ReleaseTimeline onMarkAsRead fire-and-forget 推送后端
- autoSync 拉取时合并后端 is_read 到本地 readReleases Set
- DB migration v2 添加 forks_count/forks/last_release_fetch_time/has_fetched_releases
- repositories 路由 transformRepo/PUT/PATCH 支持新四字段
@
---
 server/src/db/migrations.ts        |  3 +++
 server/src/db/schema.ts            | 10 +++++++++-
 server/src/routes/repositories.ts  | 19 ++++++++++++++++---
 server/src/types/api.ts            |  4 ++++
 src/components/ReleaseTimeline.tsx |  4 ++--
 src/services/autoSync.ts           |  9 +++++++++
 src/services/backendAdapter.ts     | 19 +++++++++++++++++++
 src/store/useAppStore.ts           | 13 ++++++++++---
 8 files changed, 72 insertions(+), 9 deletions(-)

diff --git a/server/src/db/migrations.ts b/server/src/db/migrations.ts
index 5d65e69..2918c27 100644
--- a/server/src/db/migrations.ts
+++ b/server/src/db/migrations.ts
@@ -5,6 +5,9 @@ const migrations: Record<number, (db: Database.Database) => void> = {
   1: (db) => {
     initializeSchema(db);
   },
+  2: (db) => {
+    initializeSchema(db);
+  },
 };
 
 export function runMigrations(db: Database.Database): void {
diff --git a/server/src/db/schema.ts b/server/src/db/schema.ts
index 2c48dfa..8ed63a0 100644
--- a/server/src/db/schema.ts
+++ b/server/src/db/schema.ts
@@ -39,7 +39,11 @@ export function initializeSchema(db: Database.Database): void {
       custom_category TEXT,
       category_locked INTEGER DEFAULT 0,
       last_edited TEXT,
-      subscribed_to_releases INTEGER DEFAULT 0
+      subscribed_to_releases INTEGER DEFAULT 0,
+      forks_count INTEGER DEFAULT 0,
+      forks INTEGER DEFAULT 0,
+      last_release_fetch_time TEXT,
+      has_fetched_releases INTEGER DEFAULT 0
     );
 
     CREATE TABLE IF NOT EXISTS releases (
@@ -118,4 +122,8 @@ export function initializeSchema(db: Database.Database): void {
   addColumnIfMissing(db, 'asset_filters', 'description', 'TEXT');
   addColumnIfMissing(db, 'asset_filters', 'platform', 'TEXT');
   addColumnIfMissing(db, 'asset_filters', 'sort_order', 'INTEGER DEFAULT 0');
+  addColumnIfMissing(db, 'repositories', 'forks_count', 'INTEGER DEFAULT 0');
+  addColumnIfMissing(db, 'repositories', 'forks', 'INTEGER DEFAULT 0');
+  addColumnIfMissing(db, 'repositories', 'last_release_fetch_time', 'TEXT');
+  addColumnIfMissing(db, 'repositories', 'has_fetched_releases', 'INTEGER DEFAULT 0');
 }
diff --git a/server/src/routes/repositories.ts b/server/src/routes/repositories.ts
index aed6d58..eab22b4 100644
--- a/server/src/routes/repositories.ts
+++ b/server/src/routes/repositories.ts
@@ -21,6 +21,8 @@ function transformRepo(row: Record<string, unknown>) {
     description: row.description,
     html_url: row.html_url,
     stargazers_count: row.stargazers_count,
+    forks_count: row.forks_count ?? 0,
+    forks: row.forks ?? 0,
     language: row.language,
     created_at: row.created_at,
     updated_at: row.updated_at,
@@ -39,6 +41,8 @@ function transformRepo(row: Record<string, unknown>) {
     category_locked: !!row.category_locked,
     last_edited: row.last_edited,
     subscribed_to_releases: !!row.subscribed_to_releases,
+    last_release_fetch_time: row.last_release_fetch_time ?? undefined,
+    has_fetched_releases: !!row.has_fetched_releases,
   };
 }
 
@@ -126,8 +130,9 @@ router.put('/api/repositories', (req, res) => {
         owner_login, owner_avatar_url, topics,
         ai_summary, ai_tags, ai_platforms, analyzed_at, analysis_failed,
         custom_description, custom_tags, custom_category, category_locked, last_edited,
-        subscribed_to_releases
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        subscribed_to_releases,
+        forks_count, forks, last_release_fetch_time, has_fetched_releases
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
 
     const deleteAllReleases = db.prepare('DELETE FROM releases');
@@ -238,7 +243,11 @@ router.put('/api/repositories', (req, res) => {
           repo.custom_description ?? null,
           JSON.stringify(Array.isArray(repo.custom_tags) ? repo.custom_tags : []),
           repo.custom_category ?? null, (repo.category_locked === true || repo.category_locked === 1) ? 1 : 0, repo.last_edited ?? null,
-          (repo.subscribed_to_releases === true || repo.subscribed_to_releases === 1) ? 1 : 0
+          (repo.subscribed_to_releases === true || repo.subscribed_to_releases === 1) ? 1 : 0,
+          repo.forks_count ?? 0,
+          repo.forks ?? 0,
+          repo.last_release_fetch_time ?? null,
+          (repo.has_fetched_releases === true || repo.has_fetched_releases === 1) ? 1 : 0
         );
         count++;
       }
@@ -274,6 +283,10 @@ router.patch('/api/repositories/:id', (req, res) => {
       subscribed_to_releases: (v) => (v === true || v === 1) ? 1 : 0,
       description: (v) => v,
       name: (v) => v,
+      forks_count: (v) => (typeof v === 'number' ? v : 0),
+      forks: (v) => (typeof v === 'number' ? v : 0),
+      last_release_fetch_time: (v) => v,
+      has_fetched_releases: (v) => (v === true || v === 1) ? 1 : 0,
     };
 
     const setClauses: string[] = [];
diff --git a/server/src/types/api.ts b/server/src/types/api.ts
index 0474167..2a95e35 100644
--- a/server/src/types/api.ts
+++ b/server/src/types/api.ts
@@ -24,6 +24,10 @@ export interface RepositoryRow {
   category_locked: number;
   last_edited: string | null;
   subscribed_to_releases: number;
+  forks_count: number;
+  forks: number;
+  last_release_fetch_time: string | null;
+  has_fetched_releases: number;
 }
 
 export interface ReleaseRow {
diff --git a/src/components/ReleaseTimeline.tsx b/src/components/ReleaseTimeline.tsx
index 1e47d12..fd7d452 100644
--- a/src/components/ReleaseTimeline.tsx
+++ b/src/components/ReleaseTimeline.tsx
@@ -943,7 +943,7 @@ export const ReleaseTimeline: React.FC = () => {
                 onToggleReleaseNotes={() => toggleReleaseNotes(release.id)}
                 onToggleFullContent={(e) => toggleFullContent(release.id, e)}
                 onUnsubscribe={() => handleUnsubscribeRelease(release.repository.id)}
-                onMarkAsRead={() => markReleaseAsRead(release.id)}
+                onMarkAsRead={() => { markReleaseAsRead(release.id); backend.markReleaseAsRead(release.id).catch(() => {}); }}
                 language={language}
                 formatFileSize={formatFileSize}
               />
@@ -1027,7 +1027,7 @@ export const ReleaseTimeline: React.FC = () => {
                             onToggleReleaseNotes={() => toggleReleaseNotes(release.id)}
                             onToggleFullContent={(e) => toggleFullContent(release.id, e)}
                             onUnsubscribe={() => handleUnsubscribeRelease(release.repository.id)}
-                            onMarkAsRead={() => markReleaseAsRead(release.id)}
+                            onMarkAsRead={() => { markReleaseAsRead(release.id); backend.markReleaseAsRead(release.id).catch(() => {}); }}
                             language={language}
                             formatFileSize={formatFileSize}
                           />
diff --git a/src/services/autoSync.ts b/src/services/autoSync.ts
index 5cb43a3..ec95c76 100644
--- a/src/services/autoSync.ts
+++ b/src/services/autoSync.ts
@@ -111,6 +111,15 @@ export async function syncFromBackend(): Promise<void> {
     }
     if (changed.releases && releasesResult.status === 'fulfilled') {
       state.setReleases(releasesResult.value.releases);
+      // Merge backend is_read into local readReleases Set
+      const backendReadIds = releasesResult.value.releases
+        .filter((r: { is_read?: boolean; id: number }) => r.is_read)
+        .map((r: { is_read?: boolean; id: number }) => r.id);
+      if (backendReadIds.length > 0) {
+        const latestReadReleases = useAppStore.getState().readReleases;
+        const merged = new Set([...latestReadReleases, ...backendReadIds]);
+        useAppStore.setState({ readReleases: merged });
+      }
       _lastHash.releases = hashes.releases;
     }
     if (changed.ai && aiResult.status === 'fulfilled') {
diff --git a/src/services/backendAdapter.ts b/src/services/backendAdapter.ts
index ab2aa07..c1a79e2 100644
--- a/src/services/backendAdapter.ts
+++ b/src/services/backendAdapter.ts
@@ -584,6 +584,25 @@ class BackendAdapter {
     return res.json() as Promise<{ releases: Release[]; total: number }>;
   }
 
+  async markReleaseAsRead(releaseId: number): Promise<void> {
+    if (!this._backendUrl) return;
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/releases/${releaseId}`, {
+      method: 'PATCH',
+      headers: this.getAuthHeaders(),
+      body: JSON.stringify({ is_read: true }),
+    });
+    if (!res.ok) console.warn(`Failed to mark release ${releaseId} as read on backend: ${res.status}`);
+  }
+
+  async markAllReleasesAsRead(): Promise<void> {
+    if (!this._backendUrl) return;
+    const res = await this.fetchWithTimeout(`${this._backendUrl}/releases/mark-all-read`, {
+      method: 'POST',
+      headers: this.getAuthHeaders(),
+    });
+    if (!res.ok) console.warn(`Failed to mark all releases as read on backend: ${res.status}`);
+  }
+
   async syncAIConfigs(configs: AIConfig[]): Promise<void> {
     if (!this._backendUrl) return;
 
diff --git a/src/store/useAppStore.ts b/src/store/useAppStore.ts
index 4d4aa42..13364a5 100644
--- a/src/store/useAppStore.ts
+++ b/src/store/useAppStore.ts
@@ -968,11 +968,18 @@ export const useAppStore = create<AppState & AppActions>()(
       markReleaseAsRead: (releaseId) => set((state) => {
         const newReadReleases = new Set(state.readReleases);
         newReadReleases.add(releaseId);
-        return { readReleases: newReadReleases };
+        const updatedReleases = state.releases.map(r =>
+          r.id === releaseId ? { ...r, is_read: true } : r
+        );
+        return { readReleases: newReadReleases, releases: updatedReleases };
       }),
       markAllReleasesAsRead: () => set((state) => {
-        const allReleaseIds = new Set(state.releases.map(r => r.id));
-        return { readReleases: allReleaseIds };
+        const allReleaseIds = state.releases.map(r => r.id);
+        const updatedReleases = state.releases.map(r => ({ ...r, is_read: true }));
+        return {
+          readReleases: new Set(allReleaseIds),
+          releases: updatedReleases,
+        };
       }),
 
       // Category actions

From 5590fcaed59e4cd14092c5f77fa3d95b8ebcc4c0 Mon Sep 17 00:00:00 2001
From: lostiv <lost4@qq.com>
Date: Wed, 13 May 2026 15:57:45 +0800
Subject: [PATCH 47/47] =?UTF-8?q?@=20fix:=20CodeRabbit=E5=AE=A1=E6=9F=A5?=
 =?UTF-8?q?=20=E2=80=94=20PUT/PATCH=E6=96=B0=E5=AD=97=E6=AE=B5=E5=85=A5?=
 =?UTF-8?q?=E5=8F=A3=E6=A0=A1=E9=AA=8C=20+=20autoSync=E5=8E=9F=E5=AD=90?=
 =?UTF-8?q?=E6=9B=B4=E6=96=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- PUT repositories: forks_count/forks/last_release_fetch_time/has_fetched_releases 入参严格校验
- PATCH repositories: 新字段校验前置，allowedFields 简化为透传
- autoSync: 合并 releases 与 readReleases 单次 setState 原子更新
@
---
 server/src/routes/repositories.ts | 33 +++++++++++++++++++++++++++++--
 src/services/autoSync.ts          | 20 +++++++++----------
 2 files changed, 41 insertions(+), 12 deletions(-)

diff --git a/server/src/routes/repositories.ts b/server/src/routes/repositories.ts
index eab22b4..3aa237d 100644
--- a/server/src/routes/repositories.ts
+++ b/server/src/routes/repositories.ts
@@ -121,6 +121,22 @@ router.put('/api/repositories', (req, res) => {
         res.status(400).json({ error: 'Each repository must have a valid non-negative stargazers_count', code: 'INVALID_STARGAZERS_COUNT' });
         return;
       }
+      if (repo.forks_count !== undefined && repo.forks_count !== null && (!Number.isInteger(repo.forks_count) || (repo.forks_count as number) < 0)) {
+        res.status(400).json({ error: 'forks_count must be a non-negative integer', code: 'INVALID_FORKS_COUNT' });
+        return;
+      }
+      if (repo.forks !== undefined && repo.forks !== null && (!Number.isInteger(repo.forks) || (repo.forks as number) < 0)) {
+        res.status(400).json({ error: 'forks must be a non-negative integer', code: 'INVALID_FORKS' });
+        return;
+      }
+      if (repo.last_release_fetch_time !== undefined && repo.last_release_fetch_time !== null && typeof repo.last_release_fetch_time !== 'string') {
+        res.status(400).json({ error: 'last_release_fetch_time must be a string or null', code: 'INVALID_LAST_RELEASE_FETCH_TIME' });
+        return;
+      }
+      if (repo.has_fetched_releases !== undefined && repo.has_fetched_releases !== null && ![true, false, 0, 1].includes(repo.has_fetched_releases as never)) {
+        res.status(400).json({ error: 'has_fetched_releases must be a boolean or 0/1', code: 'INVALID_HAS_FETCHED_RELEASES' });
+        return;
+      }
     }
 
     const stmt = db.prepare(`
@@ -269,6 +285,19 @@ router.patch('/api/repositories/:id', (req, res) => {
     const id = parseInt(req.params.id);
     const updates = req.body as Record<string, unknown>;
 
+    if (updates.forks_count !== undefined && updates.forks_count !== null && (!Number.isInteger(updates.forks_count) || (updates.forks_count as number) < 0)) {
+      res.status(400).json({ error: 'forks_count must be a non-negative integer', code: 'INVALID_FORKS_COUNT' });
+      return;
+    }
+    if (updates.forks !== undefined && updates.forks !== null && (!Number.isInteger(updates.forks) || (updates.forks as number) < 0)) {
+      res.status(400).json({ error: 'forks must be a non-negative integer', code: 'INVALID_FORKS' });
+      return;
+    }
+    if (updates.last_release_fetch_time !== undefined && updates.last_release_fetch_time !== null && typeof updates.last_release_fetch_time !== 'string') {
+      res.status(400).json({ error: 'last_release_fetch_time must be a string or null', code: 'INVALID_LAST_RELEASE_FETCH_TIME' });
+      return;
+    }
+
     const allowedFields: Record<string, (v: unknown) => unknown> = {
       ai_summary: (v) => v,
       ai_tags: (v) => JSON.stringify(Array.isArray(v) ? v : []),
@@ -283,8 +312,8 @@ router.patch('/api/repositories/:id', (req, res) => {
       subscribed_to_releases: (v) => (v === true || v === 1) ? 1 : 0,
       description: (v) => v,
       name: (v) => v,
-      forks_count: (v) => (typeof v === 'number' ? v : 0),
-      forks: (v) => (typeof v === 'number' ? v : 0),
+      forks_count: (v) => v,
+      forks: (v) => v,
       last_release_fetch_time: (v) => v,
       has_fetched_releases: (v) => (v === true || v === 1) ? 1 : 0,
     };
diff --git a/src/services/autoSync.ts b/src/services/autoSync.ts
index ec95c76..347560b 100644
--- a/src/services/autoSync.ts
+++ b/src/services/autoSync.ts
@@ -110,16 +110,16 @@ export async function syncFromBackend(): Promise<void> {
       _lastHash.repos = hashes.repos;
     }
     if (changed.releases && releasesResult.status === 'fulfilled') {
-      state.setReleases(releasesResult.value.releases);
-      // Merge backend is_read into local readReleases Set
-      const backendReadIds = releasesResult.value.releases
-        .filter((r: { is_read?: boolean; id: number }) => r.is_read)
-        .map((r: { is_read?: boolean; id: number }) => r.id);
-      if (backendReadIds.length > 0) {
-        const latestReadReleases = useAppStore.getState().readReleases;
-        const merged = new Set([...latestReadReleases, ...backendReadIds]);
-        useAppStore.setState({ readReleases: merged });
-      }
+      const backendReleases = releasesResult.value.releases;
+      const backendReadIds = new Set(
+        backendReleases.filter((r: { is_read?: boolean; id: number }) => r.is_read).map((r: { is_read?: boolean; id: number }) => r.id)
+      );
+      const latestReadReleases = useAppStore.getState().readReleases;
+      const mergedReadReleases = new Set([...latestReadReleases, ...backendReadIds]);
+      const mergedReleases = backendReleases.map((r: { is_read?: boolean; id: number }) =>
+        mergedReadReleases.has(r.id) ? { ...r, is_read: true } : r
+      );
+      useAppStore.setState({ releases: mergedReleases, readReleases: mergedReadReleases });
       _lastHash.releases = hashes.releases;
     }
     if (changed.ai && aiResult.status === 'fulfilled') {