github-search-cli 9.7.0 → 9.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-search-cli",
-  "version": "9.7.0",
+  "version": "9.7.1",
   "description": "Search GitHub from your terminal — repo search, trending repos, npm package search, bookmarks, deep-dive, compare, export. Keyboard-driven TUI + pipeable CLI.",
   "type": "module",
   "packageManager": "bun@1",
@@ -37,13 +37,14 @@
     "format:check": "prettier --check .",
     "format": "prettier --write .",
     "typecheck": "tsc --noEmit",
-    "lint": "bunx biome@2.5.13 check .",
+    "lint": "biome check .",
     "check": "prettier --check . && bun test"
   },
   "dependencies": {
     "@opentui/core": "^0.4.3"
   },
   "devDependencies": {
+    "@biomejs/biome": "^2.5.14",
     "@types/bun": "latest",
     "@types/node": "^20.0.0",
     "prettier": "^3.2.0",

package/release-notes/9.7.1.md

@@ -0,0 +1,62 @@
+# What's New in ghfind 9.7.1
+
+The in-app update finally works — plus a Windows URL fix and a new doctor
+check that names every stale install shadowing your updates.
+
+### Fixed
+
+**In-app update installed to the wrong location**
+
+- When the TUI runs under Bun, `performUpdate()` ran `bun install -g
+github-search-cli`, which targets Bun's own global dir (`~/.bun`) — not
+  the npm prefix where the running copy and its `ghfind` shim live. The
+  command exited 0, "update succeeded", and the running install never
+  changed.
+- The updater now detects which package manager owns the running tree
+  (`detectInstallLocation`: npm global prefix vs `~/.bun` global) and
+  installs with `npm install -g --prefix <prefix>` for npm-owned installs,
+  so the update lands exactly where the running install is.
+- Compiled binaries and dev checkouts (no `node_modules` ancestor) refuse
+  self-update honestly instead of npm-installing a copy you aren't running.
+
+**Node fallback couldn't launch npm on Windows**
+
+- `child_process.spawn` without a shell cannot execute `npm.cmd` — recent
+  Node rejects it outright with `EINVAL`. The update spawn now goes through
+  `node:child_process` on every runtime with `shell: true` on win32, so the
+  Node fallback path works on Windows too.
+
+**Windows: URLs truncated at the first `&`**
+
+- Opening URLs via `cmd /c start "" <url>` split the URL at the first
+  unquoted `&` — a query-string separator — and tried to execute the rest
+  as a command. Every pre-filled crash-report/issue link lost its body and
+  labels.
+- Both URL openers now use `explorer.exe` on Windows, which receives the
+  URL as a single argument, so `&` is never interpreted.
+
+**New `ghfind --doctor` check: stale/PATH-shadowing installs**
+
+- Multiple `ghfind` copies on PATH resolving to different versions are the
+  classic "updater said OK but nothing changed" trap: the update lands in
+  one prefix while the shell keeps launching another. `ghfind --doctor` now
+  lists every install with its version and prints the exact
+  `npm uninstall -g github-search-cli --prefix <dir>` command to remove the
+  stale ones.
+
+### Changed
+
+- **CI enforces lint + typecheck** — the repo's first green Biome baseline
+  (198 diagnostics triaged, real `@biomejs/biome` 2.5.14 dependency replacing
+  the phantom `biome@2.5.13` pin) and a `.gitattributes` forcing LF so
+  `prettier --check` passes on Windows runners (main had been red on
+  windows-latest for weeks). Previously both gates were excluded as
+  known-broken; the typecheck-opentui-drift ticket is closed.
+
+### Internal
+
+- `open-url.ts` is runtime-agnostic with a detached Node fallback (it
+  previously crashed under Node via unconditional `Bun.spawn`).
+- Housekeeping: `mcp-server.ts` assignment-in-expressions, `trending-parser.ts`
+  stateful regex loop → `matchAll`, typed casts replacing `as any`, and a
+  repaired unsafe-autofix regression in `TrendingAdapter`.

package/scripts/build.ts

@@ -2,7 +2,7 @@
  * Build script — compile ghfind for distribution.
  * Usage: npm run build
  */
-import { execFileSync } from "child_process";
+import { execFileSync } from "node:child_process";
 
 async function main() {
   console.log("Building ghfind...");

package/scripts/postinstall.js

@@ -13,12 +13,12 @@ import {
   chmodSync,
   writeFileSync,
   readFileSync,
-} from "fs";
-import { join, dirname } from "path";
-import { fileURLToPath } from "url";
-import { platform, arch } from "os";
-import { spawnSync } from "child_process";
-import { inflateRawSync } from "zlib";
+} from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { platform, arch } from "node:os";
+import { spawnSync } from "node:child_process";
+import { inflateRawSync } from "node:zlib";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, "..");
@@ -121,8 +121,8 @@ try {
   let cdOffset = buffer.indexOf(cdSig, 0);
   while (cdOffset !== -1) {
     const nameLen = buffer.readUInt16LE(cdOffset + 28);
-    const extraLen = buffer.readUInt16LE(cdOffset + 30);
-    const commentLen = buffer.readUInt16LE(cdOffset + 32);
+    const _extraLen = buffer.readUInt16LE(cdOffset + 30);
+    const _commentLen = buffer.readUInt16LE(cdOffset + 32);
     const localHeaderOffset = buffer.readUInt32LE(cdOffset + 42);
     const compSize = buffer.readUInt32LE(cdOffset + 20);
     const compMethod = buffer.readUInt16LE(cdOffset + 10);

package/src/cli.ts

@@ -22,11 +22,9 @@ import { runDoctor } from "./doctor";
 import { reportError } from "./error-report";
 import {
   format as formatOutput,
-  exportToFile,
   pipeExec,
   type Format,
   type ExportFormat,
-  type FormatLine,
 } from "./output";
 import { runWatch } from "./watch";
 import {
@@ -61,9 +59,9 @@ import {
 } from "./deepdive";
 import { resolveTrendingLanguage } from "./search";
 import type { Repo } from "./types";
-import { readFileSync } from "fs";
-import { join, dirname } from "path";
-import { fileURLToPath } from "url";
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import { launchBrowser } from "./tui";
 import { getVersion } from "./version";
 import { runMcpServer } from "./mcp-server";
@@ -139,7 +137,7 @@ function parseArgs(args: string[]): CLIFlags {
     mcp: false,
   };
 
-  let queryParts: string[] = [];
+  const queryParts: string[] = [];
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     switch (arg) {
@@ -200,8 +198,8 @@ function parseArgs(args: string[]): CLIFlags {
         flags.login = true;
         break;
       case "--limit": {
-        const parsed = parseInt(args[++i]);
-        if (isNaN(parsed) || parsed < 1 || parsed > 100) {
+        const parsed = parseInt(args[++i], 10);
+        if (Number.isNaN(parsed) || parsed < 1 || parsed > 100) {
           console.error(`Invalid limit: must be 1-100. Using default 50.`);
           flags.limit = 50;
         } else {
@@ -513,7 +511,12 @@ async function runUserProfile(
   outputFormat?: ExportFormat,
 ): Promise<void> {
   try {
-    const profile = await fetchUserProfile(flags.user!, {
+    const user = flags.user ?? "";
+    if (!user) {
+      console.error("Usage: ghfind user <name> [--json] [--token <t>]");
+      process.exit(1);
+    }
+    const profile = await fetchUserProfile(user, {
       token: flags.token,
       limit: flags.limit,
     });
@@ -540,7 +543,12 @@ async function runOrgProfile(
   outputFormat?: ExportFormat,
 ): Promise<void> {
   try {
-    const profile = await fetchOrgProfile(flags.org!, {
+    const org = flags.org ?? "";
+    if (!org) {
+      console.error("Usage: ghfind org <name> [--json] [--token <t>]");
+      process.exit(1);
+    }
+    const profile = await fetchOrgProfile(org, {
       token: flags.token,
       limit: flags.limit,
     });
@@ -566,7 +574,7 @@ async function runDeepDive(
   flags: CLIFlags,
   outputFormat?: ExportFormat,
 ): Promise<void> {
-  const ref = flags.deepDive!;
+  const ref = flags.deepDive;
   if (!ref) {
     console.error(
       "Usage: ghfind deep-dive <owner/repo> [--json] [--token <t>]",
@@ -684,7 +692,7 @@ async function runReleases(
 async function runNonInteractive(flags: CLIFlags, outputFormat?: ExportFormat) {
   // Dispatch table: each handler receives shared context + flags, returns void.
   const handlers: Record<string, (ctx: SearchContext) => Promise<void>> = {
-    trending: async (ctx) => {
+    trending: async (_ctx) => {
       const since =
         flags.since === "weekly"
           ? "weekly"
@@ -773,7 +781,7 @@ async function runNonInteractive(flags: CLIFlags, outputFormat?: ExportFormat) {
         token: flags.token,
       });
       const repos = rankRepos(response.repos, flags.sort);
-      await pipeExec(repos, flags.pipe!);
+      if (flags.pipe) await pipeExec(repos, flags.pipe);
     },
     format: async (ctx) => {
       const response = await ctx.provider.search(ctx.parsed, {

package/src/compare.ts

@@ -52,9 +52,9 @@ export function buildComparisonTable(repos: Repo[]): string {
   const sep = ["".padEnd(14, "─"), ...names.map(() => "".padEnd(colW, "─"))];
 
   const lines: string[] = [
-    "┌" + sep.map((s) => "─" + s + "─").join("┬") + "┐",
-    "│" + header.map((h) => ` ${h} `).join("│") + "│",
-    "├" + sep.map((s) => "─" + s + "─").join("┼") + "┤",
+    `┌${sep.map((s) => `─${s}─`).join("┬")}┐`,
+    `│${header.map((h) => ` ${h} `).join("│")}│`,
+    `├${sep.map((s) => `─${s}─`).join("┼")}┤`,
   ];
 
   for (const row of rows) {
@@ -62,10 +62,10 @@ export function buildComparisonTable(repos: Repo[]): string {
       row.label.padEnd(14),
       ...row.values.map((v) => v.padEnd(colW)),
     ];
-    lines.push("│" + cells.map((c) => ` ${c} `).join("│") + "│");
+    lines.push(`│${cells.map((c) => ` ${c} `).join("│")}│`);
   }
 
-  lines.push("└" + sep.map((s) => "─" + s + "─").join("┴") + "┘");
+  lines.push(`└${sep.map((s) => `─${s}─`).join("┴")}┘`);
   return lines.join("\n");
 }
 

package/src/config.ts

@@ -7,9 +7,9 @@
  *   3. ~/.config/ghfind/config.json
  */
 import type { Config } from "./types";
-import { homedir } from "os";
-import { join } from "path";
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 
 /** Directory for persistent state (history, bookmarks, session). */
 export function stateDir(): string {

package/src/deepdive.ts

@@ -1,6 +1,5 @@
 /** Repo deep-dive — fetch and format rich repo details. */
 import type { Repo } from "./types";
-import { NetworkError } from "./errors";
 
 const USER_AGENT = "ghfind/1.0";
 

package/src/doctor.ts

@@ -5,11 +5,11 @@
  * Runs a battery of checks and prints a PASS / WARN / FAIL report, then exits
  * non-zero if any FAIL check was detected.
  */
-import { existsSync, readFileSync, mkdirSync } from "fs";
-import { spawnSync } from "child_process";
-import { join, dirname } from "path";
-import { fileURLToPath } from "url";
-import { homedir, platform, arch } from "os";
+import { existsSync, readFileSync, mkdirSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir, platform, arch } from "node:os";
 import { loadConfig, configPath, stateDir, cacheDir } from "./config";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -31,9 +31,14 @@ function add(status: CheckStatus, label: string, detail: string): void {
 function run(
   cmd: string,
   args: string[],
+  opts: { shell?: boolean; timeout?: number } = {},
 ): { status: number | null; stdout: string; stderr: string } {
   try {
-    const res = spawnSync(cmd, args, { encoding: "utf8", timeout: 15000 });
+    const res = spawnSync(cmd, args, {
+      encoding: "utf8",
+      timeout: 15000,
+      ...opts,
+    });
     return {
       status: res.status,
       stdout: res.stdout ?? "",
@@ -123,13 +128,13 @@ function checkSystemBun(bundledOk: boolean): void {
     add(
       "WARN",
       "System Bun",
-      "No \`bun\` on PATH. Bundled Bun is working, so this is only a fallback.",
+      "No `bun` on PATH. Bundled Bun is working, so this is only a fallback.",
     );
   } else {
     add(
       "FAIL",
       "System Bun",
-      "No \`bun\` on PATH. Install it: curl -fsSL https://bun.sh/install | bash",
+      "No `bun` on PATH. Install it: curl -fsSL https://bun.sh/install | bash",
     );
   }
 }
@@ -236,6 +241,136 @@ function checkDirs(): void {
   }
 }
 
+const PKG_NAME = "github-search-cli";
+const BIN_NAME = "ghfind";
+
+function runningVersion(): string {
+  try {
+    const pkg = JSON.parse(
+      readFileSync(join(PKG_DIR, "package.json"), "utf8"),
+    ) as { version?: string };
+    return pkg.version ?? "";
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Best-effort version of the install that owns a `ghfind` shim on PATH.
+ * Prefers reading the sibling package.json (cheap, exact); falls back to
+ * executing the shim with `--version` (handles bun/unknown layouts).
+ */
+export function installVersionAt(
+  shimPath: string,
+): { version: string; dir: string } | null {
+  const dir = dirname(shimPath);
+  // npm layouts: <prefix>/node_modules/<pkg> (win) or <prefix>/lib/node_modules/<pkg> (unix)
+  for (const ancestor of [dir, dirname(dir)]) {
+    for (const sub of ["node_modules", join("lib", "node_modules")]) {
+      const pkgJson = join(ancestor, sub, PKG_NAME, "package.json");
+      if (existsSync(pkgJson)) {
+        try {
+          const pkg = JSON.parse(readFileSync(pkgJson, "utf8")) as {
+            version?: string;
+          };
+          return { version: pkg.version ?? "", dir: dirname(pkgJson) };
+        } catch {
+          // fall through to shim execution
+        }
+      }
+    }
+  }
+  // .cmd/.bat shims require shell:true under Node (EINVAL otherwise); the
+  // package.json read above already covered the common npm layouts.
+  const res = run(shimPath, ["--version"], {
+    shell: platform() === "win32",
+    timeout: 10000,
+  });
+  const m = /\d+\.\d+\.\d+/.exec(res.stdout);
+  return m ? { version: m[0], dir } : null;
+}
+
+/**
+ * Detect stale/shadowing global installs: multiple `ghfind` binaries on PATH
+ * resolving to different versions means the shell may keep launching an old
+ * copy even after a successful update — the exact "updater says OK but
+ * nothing changed" trap. Warns and names the offending prefixes.
+ */
+function checkInstallShadowing(): void {
+  const isWin = platform() === "win32";
+  const res = isWin ? run("where", [BIN_NAME]) : run("which", ["-a", BIN_NAME]);
+  const shims = [
+    ...new Set(
+      res.stdout
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0),
+    ),
+  ];
+  if (shims.length === 0) {
+    add("WARN", "Global installs", `${BIN_NAME} not found on PATH.`);
+    return;
+  }
+  const running = runningVersion();
+  const norm = (p: string) => (isWin ? p.replace(/\\/g, "/").toLowerCase() : p);
+  const seenDirs = new Set<string>();
+  const stale: string[] = [];
+  let knownCount = 0;
+  let staleVersion = "";
+  let staleDir = "";
+
+  for (const shim of shims) {
+    const info = installVersionAt(shim);
+    // Group shims that live in the same install (ghfind + ghfind.cmd + ghfind.ps1)
+    const dirKey = norm(dirname(shim));
+    if (seenDirs.has(dirKey)) continue;
+    seenDirs.add(dirKey);
+    knownCount++;
+    const isRunningInstall = info !== null && norm(info.dir) === norm(PKG_DIR);
+    if (
+      !isRunningInstall &&
+      info !== null &&
+      running &&
+      info.version !== running
+    ) {
+      stale.push(`${dirname(shim)} (v${info.version} ≠ running v${running})`);
+      staleVersion = info.version;
+      staleDir = dirname(shim);
+    }
+  }
+
+  if (stale.length > 0 && knownCount > 1) {
+    // Shadowing needs ≥2 installs: the shell can keep launching an old copy
+    // while updates land in another prefix.
+    add(
+      "WARN",
+      "Global installs",
+      `${knownCount} install(s) on PATH; stale copies shadowing updates → ${stale.join("; ")}. Remove with: npm uninstall -g ${PKG_NAME} --prefix <dir>`,
+    );
+  } else if (stale.length > 0) {
+    // Single install whose version differs from the running copy — normal
+    // when developing from source (running vNEWER than the published one).
+    // Uninstalling it would be harmful advice.
+    add(
+      "PASS",
+      "Global installs",
+      `v${staleVersion} at ${staleDir} (running v${running || "?"} from source/build) — single install, nothing shadowed.`,
+    );
+  } else if (knownCount > 1) {
+    add(
+      "PASS",
+      "Global installs",
+      `${knownCount} install(s) on PATH, all v${running || "?"}.`,
+    );
+  } else {
+    add(
+      "PASS",
+      "Global installs",
+      `v${running || "?"} at ${dirname(shims[0])}.`,
+    );
+  }
+}
+
 function printReport(): void {
   // Respect NO_COLOR (https://no-color.org/): plain text when set (any value,
   // including the empty string) or when stdout is not a TTY.
@@ -284,6 +419,7 @@ export async function runDoctor(): Promise<void> {
   checkConfig();
   checkGithubToken();
   checkDirs();
+  checkInstallShadowing();
   printReport();
 
   const hasFail = results.some((r) => r.status === "FAIL");

package/src/error-report.ts

@@ -10,8 +10,8 @@ import {
   arch as osArch,
   version as nodeVersion,
   versions as nodeVersions,
-} from "process";
-import { spawn } from "child_process";
+} from "node:process";
+import { spawn } from "node:child_process";
 import { getVersion } from "./version";
 
 // ponytail: in bun, process.platform is a string property; in node, same.
@@ -43,6 +43,7 @@ export function formatErrorBody(
   context: { command: string; argv: string[] },
 ): string {
   const e = err instanceof Error ? err : new Error(String(err));
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: strips ANSI color escapes from stack traces
   const stack = (e.stack ?? "(no stack)").replace(/\u001b\[[0-9;]*m/g, "");
   const message = (e.message || "(no message)").slice(0, 500);
   const cmd = `${context.command} ${context.argv.join(" ")}`.trim();
@@ -105,14 +106,19 @@ function tryOpenUrl(url: string): boolean {
   try {
     const p = osPlatform;
     if (typeof Bun !== "undefined") {
-      if (p === "win32") Bun.spawn(["cmd", "/c", "start", "", url]);
-      else if (p === "darwin") Bun.spawn(["open", url]);
+      if (p === "win32") {
+        // explorer.exe, not `cmd /c start` — cmd splits the URL at the first
+        // unquoted `&` (query separator) and runs the rest as a command,
+        // truncating every pre-filled issue URL. See src/open-url.ts.
+        Bun.spawn(["explorer", url]);
+      } else if (p === "darwin") Bun.spawn(["open", url]);
       else Bun.spawn(["xdg-open", url]);
       return true;
     }
     // Node fallback — use child_process.spawn detached so it survives exit
-    const cmd = p === "win32" ? "cmd" : p === "darwin" ? "open" : "xdg-open";
-    const args = p === "win32" ? ["/c", "start", "", url] : [url];
+    const cmd =
+      p === "win32" ? "explorer" : p === "darwin" ? "open" : "xdg-open";
+    const args = [url];
     const child = spawn(cmd, args, { detached: true, stdio: "ignore" });
     child.unref();
     return true;
@@ -142,11 +148,11 @@ export function reportError(
   console.error("");
   const opened = tryOpenUrl(url);
   if (opened) {
-    console.error("  → Opened: " + url);
+    console.error(`  → Opened: ${url}`);
   } else {
     console.error("  Copy this URL to file a bug report:");
     console.error("");
-    console.error("    " + url);
+    console.error(`    ${url}`);
   }
   console.error("");
   return url;

package/src/export.ts

@@ -1,7 +1,7 @@
 /**
  * Export — format repos as JSON, CSV, Markdown, or plain text.
  */
-import { writeFileSync } from "fs";
+import { writeFileSync } from "node:fs";
 import type { Repo } from "./types";
 
 export type ExportFormat = "json" | "csv" | "markdown" | "text";

package/src/history.ts

@@ -2,7 +2,7 @@
  * Persistent search history — append-only JSONL with rotation.
  */
 import type { HistoryEntry } from "./types";
-import { readJSONL, appendJSONL, writeJSON, writeRaw } from "./storage";
+import { readJSONL, appendJSONL, writeRaw } from "./storage";
 
 const HISTORY_FILE = "history.jsonl";
 const MAX_ENTRIES = 500;
@@ -37,10 +37,10 @@ export function deleteHistoryEntry(index: number): void {
   );
   writeRaw(
     HISTORY_FILE,
-    remaining
+    `${remaining
       .reverse()
       .map((e) => JSON.stringify(e))
-      .join("\n") + "\n",
+      .join("\n")}\n`,
   );
 }
 
@@ -56,10 +56,10 @@ export function rotateHistory(): void {
   const trimmed = entries.slice(0, MAX_ENTRIES);
   writeRaw(
     HISTORY_FILE,
-    trimmed
+    `${trimmed
       .reverse()
       .map((e) => JSON.stringify(e))
-      .join("\n") + "\n",
+      .join("\n")}\n`,
   );
 }
 

package/src/init.ts

@@ -3,7 +3,7 @@
  *
  * ponytail: simple stdin prompts, no curses/readline UI.
  */
-import { createInterface } from "readline";
+import { createInterface } from "node:readline";
 import { saveConfig } from "./config";
 import { isLikelyGithubToken } from "./login";
 import { listThemes } from "./themes";
@@ -44,7 +44,7 @@ export async function runInitWizard(): Promise<void> {
     defaultSort: (["best-match", "stars", "updated", "forks"].includes(sortStr)
       ? sortStr
       : "best-match") as SortStrategy,
-    defaultLimit: Math.min(100, Math.max(10, parseInt(limitStr) || 50)),
+    defaultLimit: Math.min(100, Math.max(10, parseInt(limitStr, 10) || 50)),
     theme: themes.includes(themeStr) ? themeStr : themes[0],
     cacheTtlSeconds: 300,
     defaultTab: "search",

package/src/login.ts

@@ -6,10 +6,10 @@
  * used by `ghfind init` (~/.config/ghfind/config.json). `GITHUB_TOKEN` in the
  * environment always takes precedence at runtime (see src/config.ts).
  */
-import { createInterface } from "readline";
-import { homedir } from "os";
-import { join } from "path";
-import { existsSync, readFileSync } from "fs";
+import { createInterface } from "node:readline";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
 import { loadConfig, saveConfig, configPath } from "./config";
 import type { Config } from "./types";