Eighteen extracted items feed an editable bid workspace
Yibiao's README says tender parsing extracts 18 items through an Electron 41 desktop client before writers build outlines and technical sections. The app also covers proposal expansion, multiple lots, multiple bidding stages, preset export formats, generated images, Mermaid diagrams, and global facts. A local knowledge base can hold company material and previous work. Later checks look for duplicate wording, rejection risks, typos, logical problems, and inconsistency across the document. This is a specific procurement workflow, rather than a blank chat window with a DOCX download button.
The client uses React 19, TypeScript 5.9, and Vite 7. Configuration and cached output live in local files, while business state uses SQLite. Long parsing and generation jobs run in the Electron main process and persist so a writer can change pages and resume. That local shape is useful for proposals assembled from sensitive internal material, although the data boundary still depends on which model and parsing providers the team selects.
A 62-second install still leaves model and document choices
Our run installed 721 npm packages in 62 seconds and occupied 1,409 MB on disk. The source lives under client/, where the documented development path is npm ci followed by npm run dev. Yibiao can call OpenAI-compatible endpoints or local models through Ollama and LM Studio. Teams therefore choose the model, cost policy, endpoint, and retention terms instead of inheriting one hosted service.
Document processing has the same split. The README describes local parsing and an optional MinerU path, plus local image rendering and Open XML work. Open XML debugging or local packaging requires the .NET 10 SDK in addition to Node.js 22. The repository provides package commands for Windows x64 and macOS Intel or Apple Silicon, but no Linux packaging command is documented. A desktop trial is straightforward; a managed company rollout still needs provider, operating-system, and update decisions.
What happened when we ran it
Our sandbox cloned commit f0eb5df into an unprivileged Debian container with 3 CPUs and 8 GB of RAM. The checkout contained 486 files, about 102,014 lines of source, and used 33.3 MB. Installation succeeded in 62 seconds, pulled 721 packages, and expanded the working environment to 1,409 MB. The build then succeeded in 20 seconds. Those results show that the measured commit compiles in a clean Node 22 environment.
There was no tests script or test target, so we skipped tests rather than inventing a passing result. Our npm audit reported 32 known vulnerabilities: 3 critical, 22 high, 5 moderate, and 2 low. The repository had 3 CI workflow files, no Dockerfile, and no tests directory in the same measurement. This setup result says nothing about tender accuracy, Word layout fidelity, or model output quality; our method checked repository installation, build behavior, and the supplied dependency tree.
Thirty-two advisories and zero test targets need an owner
Our npm audit found 32 vulnerabilities in the measured dependency tree, including 3 critical and 22 high-severity findings. An audit count does not prove that every advisory is exploitable through the desktop app, but accepting all of them without triage is hard to defend when the software opens tender files, stores company knowledge, and calls model services. A serious pilot should record which packages are reachable, which upgrades are safe, and which risks remain accepted.
The absent test target makes upgrades harder. The repository includes build and packaging scripts, agent-tool verification, a native Electron smoke command, and 3 CI workflow files, yet client/package.json exposes no general automated test script. Open issue 211 reports that a top-level outline can sometimes omit the technical proposal. That is exactly the kind of workflow failure a regression fixture should catch before a writer discovers it near a deadline.
Windows and AGPL duties narrow the comfortable audience
Yibiao's documented development path requires Node.js 22, and Open XML packaging adds .NET 10. The README positions the local workspace for Windows bid-document handling, even though it also documents macOS packaging. Developers can edit the Electron application, connect different model providers, and add company-specific material. The AGPL-3.0 license permits use and modification, while its network-service obligations matter if a company turns a modified copy into a closed hosted product. Legal review is sensible before redistribution or network deployment.
Operational scope is less settled than document scope. Issue 213, opened August 26, asks for each bid process and result to remain grouped under a persistent project, plus a technical-proposal mode that does not begin with a tender file. Teams expecting a proposal portfolio or presales workspace should verify the current behavior themselves. The app persists background tasks, but that is different from the project archive the issue describes.
An August 27 push shows activity, while release polish lags
GitHub recorded the latest push on August 27, 2026, and 2,547 stars when we fetched the repository. The newest release was v2.25.19, published August 24, and the repository listed 52 open issues with no open pull requests in the first 100 open items returned by GitHub. Recent issue creation and merged work show active maintenance; the open count is an issue count here, not a combined estimate.
Fast activity does not cancel the 1,409 MB install, missing test target, or 32 advisories. Yibiao earns a trial because its workflow matches the actual shape of bid production: parse requirements, reuse company facts, draft sections, add diagrams, export, and check the result. Its output still needs a named human owner. Start with a non-sensitive proposal, keep the model route local if policy demands it, and require manual comparison against every tender requirement before submission.