gent-cli 7.0.0 → 9.0.0

package/src/commands/password.js

@@ -0,0 +1,134 @@
+/**
+ * Password Command - Change or reset your account password.
+ *
+ * USAGE:
+ *   gent password change             → change password (prompts current + new)
+ *   gent password reset [email]      → email yourself a reset link
+ *   gent password reset-confirm      → finish a reset with uid + token from the email
+ *
+ * BACKEND:
+ *   POST /api/auth/password/change/          { current_password, new_password, new_password_confirm }
+ *   POST /api/auth/password/reset/           { email }
+ *   POST /api/auth/password/reset/confirm/   { uid, token, new_password, new_password_confirm }
+ *
+ * Note: changing/resetting the password blacklists all refresh tokens, so
+ * `change` re-logs you in with the new password to keep the session alive.
+ */
+
+const chalk = require('chalk');
+const inquirer = require('inquirer');
+const ora = require('ora');
+const { API_ENDPOINTS } = require('../utils/constants');
+const apiClient = require('../utils/api-client');
+const authStorage = require('../utils/auth-storage');
+const authService = require('../services/auth-service');
+
+async function password(action, options = {}) {
+    try {
+        const act = action || 'change';
+        if (act === 'change') {
+            await changePassword();
+        } else if (act === 'reset') {
+            await requestReset(options);
+        } else if (act === 'reset-confirm') {
+            await confirmReset();
+        } else {
+            console.error(chalk.red(`Unknown action '${action}'`));
+            console.log(chalk.yellow('Usage: gent password [change | reset [email] | reset-confirm]'));
+        }
+    } catch (error) {
+        handleError(error);
+    }
+}
+
+async function changePassword() {
+    if (!(await authStorage.isAuthenticated())) {
+        console.error(chalk.red('Not authenticated'));
+        console.log(chalk.yellow('Run "gent login" first'));
+        return;
+    }
+    const user = await authStorage.getUser();
+
+    const answers = await inquirer.prompt([
+        { type: 'password', name: 'current', message: 'Current password:', mask: '*' },
+        {
+            type: 'password', name: 'next', message: 'New password:', mask: '*',
+            validate: (v) => v.length >= 8 || 'Password must be at least 8 characters long'
+        },
+        {
+            type: 'password', name: 'confirm', message: 'Confirm new password:', mask: '*',
+            validate: (v, a) => v === a.next || 'Passwords do not match'
+        },
+    ]);
+
+    const spinner = ora('Changing password...').start();
+    await apiClient.post(API_ENDPOINTS.PASSWORD_CHANGE, {
+        current_password: answers.current,
+        new_password: answers.next,
+        new_password_confirm: answers.confirm,
+    });
+
+    // The backend blacklisted our refresh token; re-login to refresh the session.
+    try {
+        if (user?.email) await authService.login(user.email, answers.next);
+        spinner.succeed(chalk.green('Password changed'));
+    } catch {
+        await authStorage.clearAuth();
+        spinner.succeed(chalk.green('Password changed'));
+        console.log(chalk.yellow('Please run "gent login" again with your new password.'));
+    }
+}
+
+async function requestReset(options) {
+    let email = options.email;
+    if (!email) {
+        ({ email } = await inquirer.prompt([{ type: 'input', name: 'email', message: 'Account email:' }]));
+    }
+
+    const spinner = ora('Requesting password reset...').start();
+    const res = await apiClient.post(API_ENDPOINTS.PASSWORD_RESET, { email });
+    spinner.succeed(chalk.green(res.message || 'If that account exists, a reset link has been sent.'));
+    console.log(chalk.gray('Open the link in your email, then run "gent password reset-confirm".'));
+}
+
+async function confirmReset() {
+    const a = await inquirer.prompt([
+        { type: 'input', name: 'uid', message: 'uid (from reset link):' },
+        { type: 'input', name: 'token', message: 'token (from reset link):' },
+        {
+            type: 'password', name: 'next', message: 'New password:', mask: '*',
+            validate: (v) => v.length >= 8 || 'Password must be at least 8 characters long'
+        },
+        {
+            type: 'password', name: 'confirm', message: 'Confirm new password:', mask: '*',
+            validate: (v, ans) => v === ans.next || 'Passwords do not match'
+        },
+    ]);
+
+    const spinner = ora('Resetting password...').start();
+    const res = await apiClient.post(API_ENDPOINTS.PASSWORD_RESET_CONFIRM, {
+        uid: a.uid,
+        token: a.token,
+        new_password: a.next,
+        new_password_confirm: a.confirm,
+    });
+    spinner.succeed(chalk.green(res.message || 'Password reset successfully'));
+    console.log(chalk.gray('Run "gent login" with your new password.'));
+}
+
+function handleError(error) {
+    const data = error.response?.data;
+    if (error.response?.status === 401 && data?.current_password) {
+        console.error(chalk.red('Current password is incorrect'));
+    } else if (data) {
+        // DRF returns { field: [messages] } or { error/detail: message }.
+        const msg = data.error || data.detail
+            || (typeof data === 'object' ? Object.values(data).flat().join(', ') : data);
+        console.error(chalk.red(msg || 'Request failed'));
+    } else {
+        console.error(chalk.red('Error:'), error.message);
+    }
+    process.exit(1);
+}
+
+module.exports = password;

package/src/commands/pull.js

@@ -11,13 +11,10 @@
  *   gent pull                          → Pull from origin/current-branch
  *   gent pull <remote> <branch>        → Pull specific remote/branch
  *
- * ALGORITHM (client-side, no /pull/ endpoint):
- *   1. GET .../branches/{branch}/ → get remote branch head SHA
- *   2. GET .../commits/ → list all remote commits
- *   3. Diff local vs remote commits, find new ones
- *   4. For each new commit, fetch tree + blobs via individual endpoints
- *   5. Store objects locally
- *   6. If diverged: run 3-way merge. If fast-forward: advance pointer
+ * ALGORITHM:
+ *   1. GET .../pull/?branch=&since= → { commits, objects (base64), head } in one call
+ *   2. Store objects locally, add new commits to the local store
+ *   3. If diverged: run 3-way merge. If fast-forward: advance the pointer
  *
  * ============================================================================
  */
@@ -30,7 +27,7 @@ const { getGentPath, readJSON, writeJSON } = require('../utils/fileSystem');
 const { COMMITS_FILE, CONFIG_FILE, API_ENDPOINTS, buildRepoUrl, parseRemoteUrl } = require('../utils/constants');
 const apiClient = require('../utils/api-client');
 const authStorage = require('../utils/auth-storage');
-const { storeBlob, objectExists, readBlobAsString, decodeRemoteBlobContent } = require('../utils/hash-engine');
+const { storeBlob, readBlob } = require('../utils/hash-engine');
 const { findMergeBase, mergeTreeEntries } = require('../utils/merge-engine');
 const { generateCommitHash } = require('../utils/helpers');
 
@@ -73,104 +70,48 @@ async function pull(remoteName, branchName, options) {
         const branch = branchName || repository.currentBranch;
         const localHead = repository.branches[branch] || null;
 
-        // 1. Get remote branch info to find remote HEAD
-        spinner.text = `Fetching branch info for ${branch}...`;
-        let remoteHead;
+        // 1. Fetch commits + objects for this branch in a single call. `since`
+        //    lets the server send only what we don't have on a fast-forward.
+        spinner.text = `Fetching updates for ${branch}...`;
+        let pullData;
         try {
-            const branchInfo = await apiClient.get(
-                buildRepoUrl(API_ENDPOINTS.REPO_BRANCH_DETAIL, { ...repoInfo, branch_name: branch })
-            );
-            remoteHead = branchInfo.commit_sha;
+            const pullUrl = buildRepoUrl(API_ENDPOINTS.REPO_PULL, repoInfo);
+            const query = localHead
+                ? `?branch=${encodeURIComponent(branch)}&since=${encodeURIComponent(localHead)}`
+                : `?branch=${encodeURIComponent(branch)}`;
+            pullData = await apiClient.get(pullUrl + query);
         } catch (error) {
             if (error.response?.status === 404) {
                 spinner.succeed(chalk.green('Remote branch not found — nothing to pull'));
                 return;
             }
+            if (error.response?.status === 403) {
+                spinner.fail(chalk.red('Access denied — you are not a member of this private repository'));
+                return;
+            }
             throw error;
         }
 
-        if (!remoteHead || remoteHead === localHead) {
-            spinner.succeed(chalk.green('Already up-to-date'));
-            return;
-        }
-
-        // 2. Fetch all remote commits
-        spinner.text = `Fetching commits...`;
-        const remoteCommits = await apiClient.get(
-            buildRepoUrl(API_ENDPOINTS.REPO_COMMITS, repoInfo)
-        );
-
-        // 3. Find commits we don't have locally
-        const localCommitSet = new Set((repository.commits || []).map(c => c.hash || c.sha));
-        const newRemoteCommits = remoteCommits.filter(c => !localCommitSet.has(c.sha));
+        const remoteHead = pullData.head;
+        config.remoteRefs = config.remoteRefs || {};
 
-        if (newRemoteCommits.length === 0) {
-            // We have all commits but pointer is different — update ref
-            config.remoteRefs = config.remoteRefs || {};
-            config.remoteRefs[`${remote}/${branch}`] = remoteHead;
+        if (!remoteHead || remoteHead === localHead) {
+            if (remoteHead) config.remoteRefs[`${remote}/${branch}`] = remoteHead;
             await writeJSON(path.join(gentPath, CONFIG_FILE), config);
             spinner.succeed(chalk.green('Already up-to-date'));
             return;
         }
 
-        // 4. For each new commit, fetch tree and blobs
-        spinner.text = `Fetching ${newRemoteCommits.length} new commit(s) + objects...`;
-
-        const fetchedCommits = [];
-        for (const commit of newRemoteCommits) {
-            // Fetch tree for this commit
-            let treeEntries = [];
-            if (commit.tree_sha) {
-                try {
-                    const tree = await apiClient.get(
-                        buildRepoUrl(API_ENDPOINTS.REPO_TREE_DETAIL, { ...repoInfo, sha: commit.tree_sha })
-                    );
-                    treeEntries = tree.entries || [];
-                } catch {
-                    // Tree may not be available
-                }
-            }
-
-            // Fetch and store blobs
-            for (const entry of treeEntries) {
-                if (entry.type === 'blob' && entry.sha) {
-                    if (!(await objectExists(gentPath, entry.sha))) {
-                        try {
-                            const blob = await apiClient.get(
-                                buildRepoUrl(API_ENDPOINTS.REPO_BLOB_DETAIL, { ...repoInfo, sha: entry.sha })
-                            );
-                            if (blob.content) {
-                                const buf = decodeRemoteBlobContent(blob.content, entry.sha);
-                                await storeBlob(gentPath, buf);
-                            }
-                        } catch {
-                            // Blob fetch failed, continue
-                        }
-                    }
-                }
-            }
-
-            // Convert remote commit format to local format
-            fetchedCommits.push({
-                hash: commit.sha,
-                message: commit.message,
-                author: { name: commit.author_name, email: commit.author_email },
-                timestamp: commit.committed_at,
-                parent: commit.parent_shas && commit.parent_shas[0] || null,
-                mergeParent: commit.parent_shas && commit.parent_shas[1] || null,
-                treeHash: commit.tree_sha,
-                tree: treeEntries.map(e => ({
-                    mode: e.mode || '100644',
-                    name: e.name,
-                    hash: e.sha,
-                    type: e.type || 'blob'
-                })),
-                files: treeEntries.map(e => ({ path: e.name, hash: e.sha })),
-                stats: {}
-            });
+        // 2. Store blob objects (base64) into the local object store.
+        spinner.text = 'Storing objects...';
+        for (const obj of pullData.objects || []) {
+            if (obj.type !== 'blob' || typeof obj.data !== 'string') continue;
+            await storeBlob(gentPath, Buffer.from(obj.data, 'base64'));
         }
 
-        // 5. Add new commits to local store (dedup)
+        // 3. Add new remote commits to the local store (dedup by hash). The
+        //    server returns them in the CLI's native commit shape already.
+        const fetchedCommits = pullData.commits || [];
         let newCount = 0;
         const commitSet = new Set((repository.commits || []).map(c => c.hash));
         for (const commit of fetchedCommits) {
@@ -182,9 +123,7 @@ async function pull(remoteName, branchName, options) {
             }
         }
 
-        // 6. Merge strategy
-        config.remoteRefs = config.remoteRefs || {};
-
+        // 4. Merge strategy
         if (!localHead || isAncestor(repository.commits, localHead, remoteHead)) {
             // Fast-forward
             const previousTree = localHead ? getCommitTree(repository.commits, localHead) : [];
@@ -224,7 +163,7 @@ async function pull(remoteName, branchName, options) {
             const mergeCommit = {
                 hash: generateCommitHash(),
                 message: `Merge remote-tracking branch '${remote}/${branch}'`,
-                author: (repository.commits.find(c => c.hash === localHead) || {}).author || { name: 'Unknown', email: '' },
+                author: (repository.commits.find(c => c.hash === localHead) || {}).author || { name: 'Unknown', email: (await authStorage.getUser())?.email || '' },
                 timestamp: new Date().toISOString(),
                 parent: localHead,
                 mergeParent: remoteHead,
@@ -259,6 +198,8 @@ async function pull(remoteName, branchName, options) {
         spinner.fail(chalk.red('Pull failed'));
         if (error.response?.status === 401) {
             console.error(chalk.red('Authentication failed — run "gent login"'));
+        } else if (error.response?.status === 403) {
+            console.error(chalk.red('Access denied — you are not a member of this private repository'));
         } else if (error.response?.data) {
             console.error(chalk.red(JSON.stringify(error.response.data)));
         } else {
@@ -311,10 +252,11 @@ async function checkoutTree(gentPath, cwd, previousTree, nextTree) {
         const relPath = entry.name || entry.path;
         if (!relPath || !entry.hash) continue;
 
-        const content = await readBlobAsString(gentPath, entry.hash);
+        // Write the raw Buffer so binary blobs round-trip byte-exact.
+        const buf = await readBlob(gentPath, entry.hash);
         const fullPath = path.join(cwd, relPath);
         await fs.mkdir(path.dirname(fullPath), { recursive: true });
-        await fs.writeFile(fullPath, content, 'utf-8');
+        await fs.writeFile(fullPath, buf);
     }
 }
 

package/src/commands/push.js

@@ -178,17 +178,39 @@ async function push(remoteName, branchName, options) {
             }
         }
 
-        // Build commits for the pack
+        // Build commits for the pack. author_email must satisfy the backend's
+        // EmailField(required=True); fall back to the logged-in user's email so
+        // merge/legacy commits with a blank email don't 400 the whole push.
+        const fallbackEmail = (await authStorage.getUser())?.email || '';
         const packCommits = commitsToPush.map(c => ({
             sha: c.hash,
             message: c.message,
             tree_sha: c.treeHash || '',
             parent_shas: [c.parent, c.mergeParent].filter(Boolean),
-            author_name: typeof c.author === 'object' ? (c.author.name || 'Unknown') : (c.author || 'Unknown'),
-            author_email: typeof c.author === 'object' ? (c.author.email || '') : '',
+            author_name: (typeof c.author === 'object' ? c.author.name : c.author) || 'Unknown',
+            author_email: (typeof c.author === 'object' ? c.author.email : '') || fallbackEmail,
             committed_at: c.timestamp || new Date().toISOString()
         }));
 
+        // Only send tags whose target commit will exist on the remote after this
+        // push (in this pack, or reachable from an already-pushed remote ref).
+        // The backend validates every tag's commit and atomically 400s the whole
+        // push for any tag pointing at a commit it doesn't have.
+        const pushableShas = new Set(commitsToPush.map(c => c.hash));
+        const commitByHash = new Map(commits.map(c => [c.hash, c]));
+        for (const [refName, refHead] of Object.entries(config.remoteRefs || {})) {
+            if (!refName.startsWith(`${remote}/`)) continue;
+            let cur = refHead;
+            while (cur && !pushableShas.has(cur)) {
+                pushableShas.add(cur);
+                cur = commitByHash.get(cur)?.parent || null;
+            }
+        }
+        const tagsToPush = {};
+        for (const [name, tag] of Object.entries(repository.tags || {})) {
+            if (tag && tag.hash && pushableShas.has(tag.hash)) tagsToPush[name] = tag;
+        }
+
         // Build push payload matching PushPackRequest schema
         const payload = {
             pack: {
@@ -200,7 +222,7 @@ async function push(remoteName, branchName, options) {
                 name: branch,
                 commit_sha: localHead
             }],
-            tags: repository.tags || {}
+            tags: tagsToPush
         };
 
         // Send to backend
@@ -224,7 +246,7 @@ async function push(remoteName, branchName, options) {
         } else if (error.response?.status === 401) {
             console.error(chalk.red('Authentication failed — run "gent login"'));
         } else if (error.response?.status === 403) {
-            console.error(chalk.red('Permission denied — only repo owner can push'));
+            console.error(chalk.red(error.response.data?.error || error.response.data?.detail || 'Permission denied — you need write access to this repository'));
         } else if (error.response?.data) {
             console.error(chalk.red(JSON.stringify(error.response.data, null, 2)));
         } else {

package/src/commands/review.js

@@ -0,0 +1,157 @@
+/**
+ * Review Command - AI code review on staged or HEAD changes.
+ *
+ *   gent review                → review staged changes (or HEAD if no staging)
+ *   gent review --staged       → force staged
+ *   gent review --head         → force HEAD commit diff
+ *   gent review <ref>          → review diff for that commit
+ *
+ * Output: prioritized bug/risk list followed by smaller polish suggestions.
+ * Without an AI key, prints the raw diff so the command still has value.
+ */
+
+const path = require('path');
+const chalk = require('chalk');
+const ora = require('ora');
+const { getGentPath, readJSON } = require('../utils/fileSystem');
+const { COMMITS_FILE, STAGING_FILE } = require('../utils/constants');
+const { readBlobAsString, treeToMap } = require('../utils/hash-engine');
+const { formatUnifiedDiff } = require('../utils/diff-engine');
+const ai = require('../utils/ai-service');
+
+const MAX_DIFF_CHARS = 16000;
+
+async function review(refArg, options = {}) {
+    try {
+        const gentPath = await getGentPath();
+        const repository = await readJSON(path.join(gentPath, COMMITS_FILE));
+        const commits = repository.commits || [];
+        const commitMap = new Map(commits.map(c => [c.hash, c]));
+
+        let title;
+        let diffText;
+
+        const explicitStaged = options.staged === true;
+        const explicitHead = options.head === true;
+        let useStaged = explicitStaged;
+
+        if (!explicitStaged && !explicitHead && !refArg) {
+            // Default: staged if anything is staged, else HEAD
+            const staging = await readJSON(path.join(gentPath, STAGING_FILE)).catch(() => ({}));
+            const entries = staging.entries || [];
+            useStaged = entries.length > 0;
+        }
+
+        if (useStaged) {
+            const result = await stagedDiff(gentPath, repository, commitMap);
+            if (!result) {
+                console.log(chalk.yellow('Nothing staged to review.'));
+                return;
+            }
+            title = 'Staged changes';
+            diffText = result;
+        } else {
+            const ref = refArg || repository.branches[repository.currentBranch];
+            const commit = ref ? (commitMap.get(ref) || commits.find(c => c.hash.startsWith(ref))) : null;
+            if (!commit) {
+                console.log(chalk.yellow(ref ? `Commit '${ref}' not found` : 'No commits yet'));
+                return;
+            }
+            const parent = commit.parent ? commitMap.get(commit.parent) : null;
+            title = `Commit ${commit.hash.slice(0, 7)} — ${commit.message.split('\n')[0]}`;
+            diffText = await diffTrees(gentPath, treeEntriesOf(parent), treeEntriesOf(commit));
+        }
+
+        if (!diffText) {
+            console.log(chalk.gray('No textual changes to review.'));
+            return;
+        }
+
+        const trimmed = diffText.length > MAX_DIFF_CHARS
+            ? diffText.slice(0, MAX_DIFF_CHARS) + '\n... (diff truncated)'
+            : diffText;
+
+        console.log(chalk.bold.cyan(`\n${title}\n`));
+
+        if (!ai.isEnabled()) {
+            console.log(trimmed);
+            console.log(chalk.gray(`\n${ai.disabledHint()}`));
+            return;
+        }
+
+        const spinner = ora(`Reviewing with ${ai.getModel()}...`).start();
+        try {
+            const out = await ai.complete({
+                system:
+                    'You are a senior code reviewer. Given a unified diff, list concrete ' +
+                    'issues you would block on, then smaller suggestions. Format:\n' +
+                    '🔴 Bugs / risks\n  - file:line — short description\n' +
+                    '🟡 Suggestions\n  - file — short description\n' +
+                    '🟢 Looks good\n  - one-line positive note\n' +
+                    'Be specific. If nothing is wrong, say so plainly.',
+                prompt: `Review this diff:\n\n${trimmed}`,
+                maxTokens: 1500,
+                thinking: true,
+            });
+            spinner.stop();
+            console.log(out + '\n');
+        } catch (err) {
+            spinner.fail(chalk.yellow('AI review failed — showing the raw diff instead'));
+            console.log(chalk.gray(`(${err.message})\n`));
+            console.log(trimmed);
+        }
+    } catch (error) {
+        if (error.code === 'ENOENT' && error.message.includes('.gent')) {
+            console.error(chalk.red('Error: Not a gent repository'));
+        } else {
+            console.error(chalk.red('Error:'), error.message);
+        }
+        process.exit(1);
+    }
+}
+
+function treeEntriesOf(commit) {
+    if (!commit) return [];
+    if (Array.isArray(commit.tree)) return commit.tree;
+    return (commit.files || []).map(f => ({ name: f.path || f.name, hash: f.hash }));
+}
+
+async function diffTrees(gentPath, oldEntries, newEntries) {
+    const oldMap = treeToMap(oldEntries);
+    const newMap = treeToMap(newEntries);
+    const files = new Set([...oldMap.keys(), ...newMap.keys()]);
+    const parts = [];
+    for (const file of files) {
+        const oh = oldMap.get(file);
+        const nh = newMap.get(file);
+        if (oh === nh) continue;
+        let oldText = '', newText = '';
+        try { if (oh) oldText = await readBlobAsString(gentPath, oh); } catch { /* binary */ }
+        try { if (nh) newText = await readBlobAsString(gentPath, nh); } catch { /* binary */ }
+        const d = formatUnifiedDiff(file, oldText, newText);
+        if (d) parts.push(d);
+    }
+    return parts.join('\n\n');
+}
+
+async function stagedDiff(gentPath, repository, commitMap) {
+    const staging = await readJSON(path.join(gentPath, STAGING_FILE)).catch(() => ({}));
+    const entries = staging.entries || [];
+    if (entries.length === 0) return null;
+
+    const headHash = repository.branches[repository.currentBranch];
+    const head = headHash ? commitMap.get(headHash) : null;
+    const headTree = treeEntriesOf(head);
+    const overlay = new Map(headTree.map(e => [e.name, e.hash]));
+    for (const e of entries) {
+        if (e.status === 'deleted') overlay.delete(e.path);
+        else overlay.set(e.path, e.hash);
+    }
+    return diffTrees(
+        gentPath,
+        headTree,
+        [...overlay].map(([name, hash]) => ({ name, hash }))
+    );
+}
+
+module.exports = review;

package/src/commands/search.js

@@ -0,0 +1,77 @@
+/**
+ * Search Command - Fuzzy-search your repositories on the gent backend.
+ *
+ *   gent search <query>
+ *   gent search --mine                   → only repos you own
+ *   gent search --json                   → machine-readable output
+ *
+ * The current backend's /api/repos/ endpoint returns the user's repos; we
+ * filter client-side. If the backend grows a search endpoint, switch the URL.
+ */
+
+const chalk = require('chalk');
+const ora = require('ora');
+const { API_ENDPOINTS } = require('../utils/constants');
+const apiClient = require('../utils/api-client');
+const authStorage = require('../utils/auth-storage');
+
+async function search(query, options = {}) {
+    try {
+        if (!query && !options.mine) {
+            console.error(chalk.red('Usage: gent search <query>'));
+            process.exit(1);
+        }
+
+        const isAuth = await authStorage.isAuthenticated();
+        if (!isAuth) {
+            console.error(chalk.red('Not authenticated.'));
+            console.log(chalk.yellow('Run `gent login` first.'));
+            process.exit(1);
+        }
+
+        const spinner = ora('Searching...').start();
+        const data = await apiClient.get(API_ENDPOINTS.REPOS);
+        const repos = Array.isArray(data) ? data : (data.results || []);
+        spinner.stop();
+
+        const me = await authStorage.getUser();
+        const myId = me?.id;
+
+        const q = (query || '').toLowerCase();
+        const filtered = repos.filter(r => {
+            if (options.mine && myId && r.owner_id !== myId) return false;
+            if (!q) return true;
+            const haystack = [r.name, r.description, r.owner_email]
+                .filter(Boolean).join(' ').toLowerCase();
+            return haystack.includes(q);
+        });
+
+        if (options.json) {
+            console.log(JSON.stringify(filtered, null, 2));
+            return;
+        }
+
+        if (filtered.length === 0) {
+            console.log(chalk.gray('No matches.'));
+            return;
+        }
+
+        console.log(chalk.bold.cyan(`\nFound ${filtered.length} repo(s):\n`));
+        for (const r of filtered) {
+            const visibility = r.is_private ? chalk.red('private') : chalk.green('public');
+            const desc = r.description ? chalk.gray(` — ${r.description}`) : '';
+            console.log(`  ${chalk.white.bold(r.name)} [${visibility}]${desc}`);
+            console.log(`    ${chalk.gray(`/api/repos/${r.owner_id}/${r.name}`)}`);
+        }
+        console.log();
+    } catch (error) {
+        if (error.response?.status === 401) {
+            console.error(chalk.red('Authentication failed — run `gent login`.'));
+        } else {
+            console.error(chalk.red('Error:'), error.message);
+        }
+        process.exit(1);
+    }
+}
+
+module.exports = search;