github-search-cli 9.8.0 → 9.8.2

package/dist/cli.js

@@ -1,21 +1,11 @@
-import {
-  cacheDir,
-  configPath,
-  loadConfig,
-  saveConfig,
-  stateDir
-} from "./chunk-GYIL4S5X.js";
-
 // src/errors.ts
 var SearchCliError = class extends Error {
-  constructor(message, userMessage, recoverable = true) {
+  constructor(message, userMessage) {
     super(message);
     this.userMessage = userMessage;
-    this.recoverable = recoverable;
     this.name = "SearchCliError";
   }
   userMessage;
-  recoverable;
 };
 var NetworkError = class extends SearchCliError {
   constructor() {
@@ -154,6 +144,7 @@ var MemoryCache = class {
     return entry.data;
   }
   set(key, data, ttlMs) {
+    this.cache.delete(key);
     if (this.cache.size >= MAX_CACHE_SIZE) {
       const firstKey = this.cache.keys().next().value;
       if (firstKey !== void 0) this.cache.delete(firstKey);
@@ -1190,13 +1181,199 @@ async function launchPackageBrowser() {
 }
 
 // src/doctor.ts
-import { existsSync, readFileSync, mkdirSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, mkdirSync as mkdirSync2 } from "fs";
 import { spawnSync } from "child_process";
-import { join, dirname } from "path";
+import { join as join3, dirname } from "path";
 import { fileURLToPath } from "url";
-import { homedir, platform, arch } from "os";
+import { homedir as homedir3, platform, arch } from "os";
+
+// src/config.ts
+import { homedir } from "os";
+import { join } from "path";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+function stateDir() {
+  const xdg = process.env.XDG_STATE_HOME;
+  const base = xdg ? join(xdg, "ghfind") : join(homedir(), ".local", "share", "ghfind");
+  return base;
+}
+function cacheDir() {
+  const xdg = process.env.XDG_CACHE_HOME;
+  const base = xdg ? join(xdg, "ghfind") : join(homedir(), ".cache", "ghfind");
+  return base;
+}
+var DEFAULTS = {
+  defaultSort: "best-match",
+  defaultLimit: 50,
+  theme: "tokyo-night",
+  cacheTtlSeconds: 300,
+  defaultTab: "search"
+};
+function configPath() {
+  const envPath = process.env.GHFIND_CONFIG;
+  if (envPath) return envPath;
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const base = xdg ? join(xdg, "ghfind") : join(homedir(), ".config", "ghfind");
+  return join(base, "config.json");
+}
+function loadConfig() {
+  const path = configPath();
+  try {
+    const raw = readFileSync(path, "utf-8");
+    const parsed = JSON.parse(raw);
+    return mergeWithEnv({ ...DEFAULTS, ...parsed });
+  } catch {
+    return mergeWithEnv({ ...DEFAULTS });
+  }
+}
+function saveConfig(config) {
+  const path = configPath();
+  const dir = path.slice(
+    0,
+    Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\"))
+  );
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(path, JSON.stringify(config, null, 2), {
+    encoding: "utf-8",
+    mode: 384
+  });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function mergeWithEnv(config) {
+  if (process.env.GITHUB_TOKEN) config.githubToken = process.env.GITHUB_TOKEN;
+  return config;
+}
+
+// src/login.ts
+import { createInterface } from "readline";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+var TOKEN_PREFIXES = ["ghp_", "gho_", "github_pat_"];
+function isLikelyGithubToken(token) {
+  return TOKEN_PREFIXES.some((prefix) => token.startsWith(prefix));
+}
+function maskToken(token) {
+  if (token.length <= 11) return `${token.slice(0, 4)}\u2026`;
+  return `${token.slice(0, 7)}\u2026${token.slice(-4)}`;
+}
+function ghCliConfigDir() {
+  return process.env.GH_CONFIG_DIR || join2(homedir2(), ".config", "gh");
+}
+function parseHostsYmlToken(text, host = "github.com") {
+  let inHost = false;
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (/^[A-Za-z0-9.-]+:\s*$/.test(trimmed)) {
+      inHost = trimmed.slice(0, -1).trim() === host;
+      continue;
+    }
+    if (inHost) {
+      const match = trimmed.match(/^oauth_token:\s*["']?([^"'\s]+)/);
+      if (match) return match[1];
+    }
+  }
+  return void 0;
+}
+function readGhCliToken(ghDir = ghCliConfigDir(), host = process.env.GH_HOST ?? "github.com") {
+  const hostsFile = join2(ghDir, "hosts.yml");
+  if (!existsSync(hostsFile)) return void 0;
+  try {
+    return parseHostsYmlToken(readFileSync2(hostsFile, "utf-8"), host);
+  } catch {
+    return void 0;
+  }
+}
+function persistToken(token, deps) {
+  const config = deps.readConfig();
+  config.githubToken = token;
+  deps.writeConfig(config);
+}
+function createAsk() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return (query) => new Promise((resolve) => {
+    rl.question(query, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+function defaultLoginDeps() {
+  return {
+    ask: createAsk(),
+    readGhCliToken: () => readGhCliToken(),
+    readConfig: loadConfig,
+    writeConfig: (config) => saveConfig(config)
+  };
+}
+function successNote() {
+  return [
+    "  Authentication raises the search rate limit from 60 to",
+    "  5,000 requests/hour. Remove the token anytime by editing",
+    `  ${configPath()} \u2014 delete the "githubToken" line and save.`
+  ];
+}
+async function runLoginWizard(deps = defaultLoginDeps()) {
+  const { ask: ask2 } = deps;
+  console.log("");
+  console.log("  ghfind login");
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log("");
+  if (process.env.GITHUB_TOKEN) {
+    console.log(
+      "  \u2139 GITHUB_TOKEN is set in the environment and already takes precedence."
+    );
+    console.log("");
+  }
+  const current = deps.readConfig();
+  if (current.githubToken) {
+    console.log(
+      `  \u2713 A token is already saved: ${maskToken(current.githubToken)}`
+    );
+  }
+  const ghToken = deps.readGhCliToken();
+  if (ghToken) {
+    console.log("  \u2713 Found a token managed by the GitHub CLI (gh).");
+    const answer = await ask2("  Import it into ghfind? [Y/n]: ");
+    if (answer.toLowerCase() !== "n") {
+      persistToken(ghToken, deps);
+      finishLogin(ghToken);
+      return;
+    }
+  }
+  const pasted = await ask2("  Paste a GitHub token (Enter to skip): ");
+  if (!pasted) {
+    console.log("  Skipped \u2014 no token saved.");
+    console.log("");
+    return;
+  }
+  if (!isLikelyGithubToken(pasted)) {
+    console.log(
+      `  \u26A0 That doesn't look like a GitHub token (expected one of: ${TOKEN_PREFIXES.join(", ")}).`
+    );
+    const confirm = await ask2("  Save it anyway? [y/N]: ");
+    if (confirm.toLowerCase() !== "y") {
+      console.log("  Cancelled \u2014 nothing saved.");
+      console.log("");
+      return;
+    }
+  }
+  persistToken(pasted, deps);
+  finishLogin(pasted);
+}
+function finishLogin(token) {
+  console.log(`  \u2713 Token saved to ${configPath()}`);
+  console.log(`    (masked: ${maskToken(token)})`);
+  console.log("");
+  for (const line of successNote()) console.log(line);
+  console.log("");
+}
+
+// src/doctor.ts
 var __dirname = dirname(fileURLToPath(import.meta.url));
-var PKG_DIR = join(__dirname, "..");
+var PKG_DIR = join3(__dirname, "..");
 var results = [];
 function add(status, label, detail) {
   results.push({ status, label, detail });
@@ -1222,7 +1399,7 @@ function hasSystemBun() {
   return res.status === 0 ? { ok: true, version: res.stdout.trim() } : { ok: false };
 }
 function bundledBunPath() {
-  return join(PKG_DIR, "vendor", platform() === "win32" ? "bun.exe" : "bun");
+  return join3(PKG_DIR, "vendor", platform() === "win32" ? "bun.exe" : "bun");
 }
 function bunRuns(bin) {
   const res = run(bin, ["--version"]);
@@ -1232,7 +1409,7 @@ function bunRuns(bin) {
 function detectLibc() {
   if (platform() !== "linux") return "unknown";
   try {
-    const osRelease = readFileSync("/etc/os-release", "utf8");
+    const osRelease = readFileSync3("/etc/os-release", "utf8");
     if (/alpine|musl/i.test(osRelease)) return "musl";
   } catch {
   }
@@ -1253,7 +1430,7 @@ async function checkRuntime() {
 }
 function checkBundledBun() {
   const path = bundledBunPath();
-  if (!existsSync(path)) {
+  if (!existsSync2(path)) {
     add(
       "WARN",
       "Bundled Bun",
@@ -1302,8 +1479,8 @@ function checkNodeVersion() {
   }
 }
 function checkBuildOutput() {
-  const dist = join(PKG_DIR, "dist", "cli.js");
-  if (existsSync(dist)) {
+  const dist = join3(PKG_DIR, "dist", "cli.js");
+  if (existsSync2(dist)) {
     add("PASS", "Build output", `${dist}`);
   } else {
     add(
@@ -1314,8 +1491,8 @@ function checkBuildOutput() {
   }
 }
 function checkSource() {
-  const src = join(PKG_DIR, "src", "cli.ts");
-  if (existsSync(src)) {
+  const src = join3(PKG_DIR, "src", "cli.ts");
+  if (existsSync2(src)) {
     add("PASS", "Source", `${src}`);
   } else {
     add("FAIL", "Source", "src/cli.ts not found. Reinstall the package.");
@@ -1331,7 +1508,7 @@ function checkTuiBackend() {
 }
 function checkConfig() {
   const path = configPath();
-  if (!existsSync(path)) {
+  if (!existsSync2(path)) {
     add(
       "WARN",
       "Config",
@@ -1340,7 +1517,7 @@ function checkConfig() {
     return;
   }
   try {
-    const raw = readFileSync(path, "utf-8");
+    const raw = readFileSync3(path, "utf-8");
     JSON.parse(raw);
     add("PASS", "Config", `${path} (valid JSON)`);
   } catch (err) {
@@ -1355,8 +1532,8 @@ function checkGithubToken() {
   const config = loadConfig();
   const token = config.githubToken || process.env.GITHUB_TOKEN;
   if (token) {
-    const preview = token.slice(0, 7);
-    add("PASS", "GitHub token", `Configured (${preview}\u2026).`);
+    const preview = maskToken(token);
+    add("PASS", "GitHub token", `Configured (${preview}).`);
   } else {
     add(
       "WARN",
@@ -1371,7 +1548,7 @@ function checkDirs() {
     ["Cache dir", cacheDir()]
   ]) {
     try {
-      mkdirSync(dir, { recursive: true });
+      mkdirSync2(dir, { recursive: true });
       add("PASS", label, dir);
     } catch (err) {
       add(
@@ -1387,7 +1564,7 @@ var BIN_NAME = "ghfind";
 function runningVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync(join(PKG_DIR, "package.json"), "utf8")
+      readFileSync3(join3(PKG_DIR, "package.json"), "utf8")
     );
     return pkg.version ?? "";
   } catch {
@@ -1397,11 +1574,11 @@ function runningVersion() {
 function installVersionAt(shimPath) {
   const dir = dirname(shimPath);
   for (const ancestor of [dir, dirname(dir)]) {
-    for (const sub of ["node_modules", join("lib", "node_modules")]) {
-      const pkgJson = join(ancestor, sub, PKG_NAME, "package.json");
-      if (existsSync(pkgJson)) {
+    for (const sub of ["node_modules", join3("lib", "node_modules")]) {
+      const pkgJson = join3(ancestor, sub, PKG_NAME, "package.json");
+      if (existsSync2(pkgJson)) {
         try {
-          const pkg = JSON.parse(readFileSync(pkgJson, "utf8"));
+          const pkg = JSON.parse(readFileSync3(pkgJson, "utf8"));
           return { version: pkg.version ?? "", dir: dirname(pkgJson) };
         } catch {
         }
@@ -1481,7 +1658,7 @@ function printReport() {
     return `${code}${s}\x1B[0m`;
   };
   console.log("\n  ghfind doctor \u2014 environment diagnostics");
-  console.log(`  ${platform()} ${arch} \xB7 ${homedir()}`);
+  console.log(`  ${platform()} ${arch} \xB7 ${homedir3()}`);
   console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   for (const r of results) {
     console.log(
@@ -1531,20 +1708,20 @@ import {
 import { spawn as spawn2 } from "child_process";
 
 // src/version.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join2, dirname as dirname2 } from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import { join as join4, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var cached = null;
 function getVersion() {
   if (cached) return cached;
   if (true) {
-    cached = "9.8.0";
+    cached = "9.8.2";
     return cached;
   }
   try {
     const here = dirname2(fileURLToPath2(import.meta.url));
     const pkg = JSON.parse(
-      readFileSync2(join2(here, "..", "package.json"), "utf-8")
+      readFileSync4(join4(here, "..", "package.json"), "utf-8")
     );
     cached = pkg.version ?? "unknown";
   } catch {
@@ -1556,6 +1733,45 @@ function getVersion() {
 // src/error-report.ts
 var REPO = "codersdfs/search-cli";
 var NEW_ISSUE_URL = `https://github.com/${REPO}/issues/new`;
+var SECRET_PLACEHOLDER = "***";
+var SECRET_FLAGS = /^(?:--token|-t)$/;
+var SECRET_PATTERNS = [
+  /gh[pousr]_[A-Za-z0-9]{16,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g
+];
+function redactSecrets(text) {
+  let out = text;
+  for (const pattern of SECRET_PATTERNS) {
+    out = out.replace(pattern, SECRET_PLACEHOLDER);
+  }
+  return out;
+}
+function redactArgv(argv) {
+  const out = [];
+  let redactNext = false;
+  for (const arg of argv) {
+    if (redactNext) {
+      out.push(SECRET_PLACEHOLDER);
+      redactNext = false;
+      continue;
+    }
+    if (SECRET_FLAGS.test(arg)) {
+      out.push(arg);
+      redactNext = true;
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    if (eq > 0 && SECRET_FLAGS.test(arg.slice(0, eq))) {
+      out.push(`${arg.slice(0, eq)}=${SECRET_PLACEHOLDER}`);
+      continue;
+    }
+    out.push(redactSecrets(arg));
+  }
+  return out;
+}
+function argvHasSecret(argv) {
+  return redactArgv(argv).some((arg, i) => arg !== argv[i]);
+}
 function getPackageVersion() {
   return getVersion();
 }
@@ -1565,9 +1781,12 @@ function runtimeName() {
 }
 function formatErrorBody(err, context) {
   const e = err instanceof Error ? err : new Error(String(err));
-  const stack = (e.stack ?? "(no stack)").replace(/\u001b\[[0-9;]*m/g, "");
-  const message = (e.message || "(no message)").slice(0, 500);
-  const cmd = `${context.command} ${context.argv.join(" ")}`.trim();
+  const stack = redactSecrets(
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: strips ANSI color escapes from stack traces
+    (e.stack ?? "(no stack)").replace(/\u001b\[[0-9;]*m/g, "")
+  );
+  const message = redactSecrets(e.message || "(no message)").slice(0, 500);
+  const cmd = `${context.command} ${redactArgv(context.argv).join(" ")}`.trim();
   const ghfindVersion = getPackageVersion();
   return [
     "## What happened",
@@ -1601,7 +1820,7 @@ function formatErrorBody(err, context) {
 }
 function buildIssueUrl(err, context) {
   const e = err instanceof Error ? err : new Error(String(err));
-  const title = e.message.slice(0, 80).replace(/[\r\n]+/g, " ");
+  const title = redactSecrets(e.message).slice(0, 80).replace(/[\r\n]+/g, " ");
   const body = formatErrorBody(err, context);
   const params = new URLSearchParams({
     title: `[bug] ${title || "Unhandled error"}`,
@@ -1633,15 +1852,25 @@ function reportError(err, context = {
   command: "ghfind",
   argv: process.argv.slice(2)
 }) {
-  const url = buildIssueUrl(err, context);
+  const hadSecret = argvHasSecret(context.argv);
+  const url = buildIssueUrl(err, {
+    command: context.command,
+    argv: redactArgv(context.argv)
+  });
   console.error("");
   console.error("  \u26A0  ghfind encountered an unexpected error.");
   console.error("");
-  console.error("  Help us fix it by opening a bug report with the");
-  console.error("  details pre-filled. Your browser will open the new-issue");
-  console.error("  page; review and submit (or close the tab to skip).");
+  if (hadSecret) {
+    console.error("  A token was found in the command line and has been");
+    console.error("  redacted. Your browser will NOT be opened \u2014 review the");
+    console.error("  scrubbed URL below before sharing it anywhere.");
+  } else {
+    console.error("  Help us fix it by opening a bug report with the");
+    console.error("  details pre-filled. Your browser will open the new-issue");
+    console.error("  page; review and submit (or close the tab to skip).");
+  }
   console.error("");
-  const opened = tryOpenUrl(url);
+  const opened = hadSecret ? false : tryOpenUrl(url);
   if (opened) {
     console.error(`  \u2192 Opened: ${url}`);
   } else {
@@ -1654,7 +1883,7 @@ function reportError(err, context = {
 }
 
 // src/output.ts
-import { writeFileSync } from "fs";
+import { writeFileSync as writeFileSync2 } from "fs";
 var FORMATS = /* @__PURE__ */ new Map([
   // Export formats
   ["json", formatJson],
@@ -1722,7 +1951,7 @@ function exportToFile(repos, fmt) {
   const ext = fmt === "markdown" ? "md" : fmt;
   const ts = Date.now();
   const path = `./ghfind-export-${ts}.${ext}`;
-  writeFileSync(path, format(repos, fmt), "utf-8");
+  writeFileSync2(path, format(repos, fmt), "utf-8");
   return path;
 }
 async function pipeExec(repos, target) {
@@ -1880,17 +2109,18 @@ async function fetchOrgProfile(org, options = {}) {
   if (orgPayload.public_repos > 0) {
     const perPage = Math.min(limit, 100);
     const maxPages = Math.ceil(limit / perPage);
-    for (let page = 1; page <= maxPages; page++) {
-      const url = `https://api.github.com/orgs/${encodeURIComponent(name)}/repos?per_page=${perPage}&sort=pushed&page=${page}`;
-      const res = await fetch(url, { headers: apiHeaders(token) });
-      if (!res.ok) {
-        break;
-      }
-      const items = await res.json();
-      if (!Array.isArray(items)) break;
-      repos.push(...items);
-      if (repos.length >= limit || items.length < perPage) break;
-    }
+    const pages = await Promise.all(
+      Array.from({ length: maxPages }, (_, i) => i + 1).map(async (page) => {
+        const url = `https://api.github.com/orgs/${encodeURIComponent(name)}/repos?per_page=${perPage}&sort=pushed&page=${page}`;
+        const res = await fetch(url, { headers: apiHeaders(token) });
+        if (!res.ok) {
+          return [];
+        }
+        const items = await res.json();
+        return Array.isArray(items) ? items : [];
+      })
+    );
+    repos.push(...pages.flat());
   }
   return normalizeOrg(orgPayload, repos.slice(0, limit));
 }
@@ -2094,17 +2324,18 @@ async function fetchUserProfile(user, options = {}) {
   if (userPayload.public_repos > 0) {
     const perPage = Math.min(limit, 100);
     const maxPages = Math.ceil(limit / perPage);
-    for (let page = 1; page <= maxPages; page++) {
-      const url = `https://api.github.com/users/${encodeURIComponent(name)}/repos?per_page=${perPage}&sort=pushed&page=${page}`;
-      const res = await fetch(url, { headers: apiHeaders2(token) });
-      if (!res.ok) {
-        break;
-      }
-      const items = await res.json();
-      if (!Array.isArray(items)) break;
-      repos.push(...items);
-      if (repos.length >= limit || items.length < perPage) break;
-    }
+    const pages = await Promise.all(
+      Array.from({ length: maxPages }, (_, i) => i + 1).map(async (page) => {
+        const url = `https://api.github.com/users/${encodeURIComponent(name)}/repos?per_page=${perPage}&sort=pushed&page=${page}`;
+        const res = await fetch(url, { headers: apiHeaders2(token) });
+        if (!res.ok) {
+          return [];
+        }
+        const items = await res.json();
+        return Array.isArray(items) ? items : [];
+      })
+    );
+    repos.push(...pages.flat());
   }
   return normalizeUser(userPayload, repos.slice(0, limit));
 }
@@ -2220,34 +2451,48 @@ function formatUserMarkdown(p) {
 
 // src/storage.ts
 import {
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync3,
-  writeFileSync as writeFileSync2,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync3,
   appendFileSync,
-  unlinkSync
+  unlinkSync,
+  renameSync
 } from "fs";
-import { join as join3 } from "path";
+import { join as join5 } from "path";
 function ensureDir() {
-  mkdirSync2(stateDir(), { recursive: true });
+  mkdirSync3(stateDir(), { recursive: true });
 }
 function readJSON(filename, fallback) {
   ensureDir();
   try {
-    return JSON.parse(readFileSync3(join3(stateDir(), filename), "utf-8"));
+    return JSON.parse(readFileSync5(join5(stateDir(), filename), "utf-8"));
   } catch {
     return fallback;
   }
 }
-function writeJSON(filename, data) {
+function writeFileAtomic(filename, data) {
   ensureDir();
-  writeFileSync2(join3(stateDir(), filename), JSON.stringify(data, null, 2));
+  const target = join5(stateDir(), filename);
+  const tmp = `${target}.tmp-${process.pid}`;
+  try {
+    writeFileSync3(tmp, data, "utf-8");
+    renameSync(tmp, target);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw e;
+  }
+}
+function writeJSON(filename, data) {
+  writeFileAtomic(filename, JSON.stringify(data, null, 2));
 }
 function appendJSONL(filename, obj) {
   ensureDir();
   try {
     appendFileSync(
-      join3(stateDir(), filename),
+      join5(stateDir(), filename),
       `${JSON.stringify(obj)}
 `,
       "utf-8"
@@ -2258,7 +2503,7 @@ function appendJSONL(filename, obj) {
 function readJSONL(filename) {
   ensureDir();
   try {
-    const raw = readFileSync3(join3(stateDir(), filename), "utf-8").trim();
+    const raw = readFileSync5(join5(stateDir(), filename), "utf-8").trim();
     if (!raw) return [];
     return raw.split("\n").filter(Boolean).map((l) => JSON.parse(l));
   } catch {
@@ -2266,14 +2511,13 @@ function readJSONL(filename) {
   }
 }
 function writeRaw(filename, data) {
-  ensureDir();
-  writeFileSync2(join3(stateDir(), filename), data);
+  writeFileAtomic(filename, data);
 }
 function debugLog(msg) {
   if (!process.env.DEBUG) return;
   try {
     appendFileSync(
-      join3(stateDir(), "ghfind-debug.log"),
+      join5(stateDir(), "ghfind-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}
 `,
       "utf-8"
@@ -2309,6 +2553,12 @@ function removeBookmark(fullName) {
   const bookmarks = loadRaw().filter((b) => b.repo.fullName !== fullName);
   saveRaw(bookmarks);
 }
+function searchBookmarks(query) {
+  const q = query.toLowerCase();
+  return getBookmarks().filter(
+    (b) => b.repo.fullName.toLowerCase().includes(q) || (b.repo.description ?? "").toLowerCase().includes(q) || b.tags.some((t3) => t3.toLowerCase().includes(q))
+  );
+}
 function getLastSeen(fullName) {
   return loadRaw().find((b) => b.repo.fullName === fullName)?.lastSeenAt ?? 0;
 }
@@ -2324,9 +2574,12 @@ function markSeen(fullName) {
 // src/notifications.ts
 var nextId = 1;
 var notifs = [];
+var loaded = false;
 var MAX_NOTIFS = 50;
 var FILE = "notifications.json";
-function load() {
+function ensureLoaded() {
+  if (loaded) return;
+  loaded = true;
   notifs = readJSON(FILE, []);
   nextId = Math.max(...notifs.map((n) => n.id), 0) + 1;
 }
@@ -2334,7 +2587,7 @@ function save() {
   writeJSON(FILE, notifs);
 }
 function addNotification(type, message) {
-  if (notifs.length === 0) load();
+  ensureLoaded();
   const n = {
     id: nextId++,
     type,
@@ -2364,14 +2617,16 @@ function iconFor(type) {
   }
 }
 function getNotifications() {
-  if (notifs.length === 0) load();
+  ensureLoaded();
   return [...notifs];
 }
 function dismissNotification(id) {
+  ensureLoaded();
   notifs = notifs.filter((n) => n.id !== id);
   save();
 }
 function dismissAll() {
+  ensureLoaded();
   notifs = [];
   save();
 }
@@ -2379,6 +2634,7 @@ function dismissAll() {
 // src/releases.ts
 var RELEASES_FILE = "release-cache.json";
 var PER_REPO = 5;
+var CONCURRENCY = 6;
 function loadCache() {
   return readJSON(RELEASES_FILE, {});
 }
@@ -2418,43 +2674,31 @@ async function checkReleases(opts = {}) {
   const config = loadConfig();
   const token = opts.token ?? config.githubToken ?? process.env.GITHUB_TOKEN;
   const results2 = [];
-  for (const bm of bookmarks) {
+  const checkOne = async (fullName) => {
     try {
-      const prev = cache2[bm.repo.fullName];
-      const lastSeen = getLastSeen(bm.repo.fullName);
+      const prev = cache2[fullName];
+      const lastSeen = getLastSeen(fullName);
       const isNew = (r) => !r.publishedAt || new Date(r.publishedAt).getTime() > lastSeen;
       const { status, etag, releases } = await fetchReleases(
-        bm.repo.fullName,
+        fullName,
         prev?.etag,
         token
       );
       if (status === 304 && prev) {
-        results2.push({
-          fullName: bm.repo.fullName,
-          newReleases: prev.releases.filter(isNew)
-        });
-        continue;
+        return { fullName, newReleases: prev.releases.filter(isNew) };
       }
       if (status !== 200 || !releases) {
-        results2.push({
-          fullName: bm.repo.fullName,
-          newReleases: [],
-          error: `HTTP ${status}`
-        });
-        continue;
+        return { fullName, newReleases: [], error: `HTTP ${status}` };
       }
-      cache2[bm.repo.fullName] = { checkedAt: Date.now(), etag, releases };
-      results2.push({
-        fullName: bm.repo.fullName,
-        newReleases: releases.filter(isNew)
-      });
+      cache2[fullName] = { checkedAt: Date.now(), etag, releases };
+      return { fullName, newReleases: releases.filter(isNew) };
     } catch (err) {
-      results2.push({
-        fullName: bm.repo.fullName,
-        newReleases: [],
-        error: err.message
-      });
+      return { fullName, newReleases: [], error: err.message };
     }
+  };
+  for (let i = 0; i < bookmarks.length; i += CONCURRENCY) {
+    const batch = bookmarks.slice(i, i + CONCURRENCY).map((bm) => checkOne(bm.repo.fullName));
+    results2.push(...await Promise.all(batch));
   }
   saveCache(cache2);
   return results2;
@@ -2474,144 +2718,17 @@ async function checkAndNotify(opts = {}) {
 }
 function allCachedReleases() {
   const cache2 = loadCache();
-  const bookmarks = getBookmarks();
-  return Object.entries(cache2).filter(([fullName]) => bookmarks.some((b) => b.repo.fullName === fullName)).flatMap(([fullName, s]) => s.releases.map((r) => ({ ...r, fullName }))).sort(
+  const bookmarked = new Set(getBookmarks().map((b) => b.repo.fullName));
+  return Object.entries(cache2).filter(([fullName]) => bookmarked.has(fullName)).flatMap(([fullName, s]) => s.releases.map((r) => ({ ...r, fullName }))).sort(
     (a, b) => new Date(b.publishedAt).getTime() - new Date(a.publishedAt).getTime()
   );
 }
 
 // src/init.ts
 import { createInterface as createInterface2 } from "readline";
-
-// src/login.ts
-import { createInterface } from "readline";
-import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-var TOKEN_PREFIXES = ["ghp_", "gho_", "github_pat_"];
-function isLikelyGithubToken(token) {
-  return TOKEN_PREFIXES.some((prefix) => token.startsWith(prefix));
-}
-function maskToken(token) {
-  if (token.length <= 11) return `${token.slice(0, 4)}\u2026`;
-  return `${token.slice(0, 7)}\u2026${token.slice(-4)}`;
-}
-function ghCliConfigDir() {
-  return process.env.GH_CONFIG_DIR || join4(homedir2(), ".config", "gh");
-}
-function parseHostsYmlToken(text, host = "github.com") {
-  let inHost = false;
-  for (const line of text.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (/^[A-Za-z0-9.-]+:\s*$/.test(trimmed)) {
-      inHost = trimmed.slice(0, -1).trim() === host;
-      continue;
-    }
-    if (inHost) {
-      const match = trimmed.match(/^oauth_token:\s*["']?([^"'\s]+)/);
-      if (match) return match[1];
-    }
-  }
-  return void 0;
-}
-function readGhCliToken(ghDir = ghCliConfigDir(), host = process.env.GH_HOST ?? "github.com") {
-  const hostsFile = join4(ghDir, "hosts.yml");
-  if (!existsSync3(hostsFile)) return void 0;
-  try {
-    return parseHostsYmlToken(readFileSync4(hostsFile, "utf-8"), host);
-  } catch {
-    return void 0;
-  }
-}
-function persistToken(token, deps) {
-  const config = deps.readConfig();
-  config.githubToken = token;
-  deps.writeConfig(config);
-}
-function createAsk() {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return (query) => new Promise((resolve) => {
-    rl.question(query, (answer) => {
-      rl.close();
-      resolve(answer.trim());
-    });
-  });
-}
-function defaultLoginDeps() {
-  return {
-    ask: createAsk(),
-    readGhCliToken: () => readGhCliToken(),
-    readConfig: loadConfig,
-    writeConfig: (config) => saveConfig(config)
-  };
-}
-function successNote() {
-  return [
-    "  Authentication raises the search rate limit from 60 to",
-    "  5,000 requests/hour. Remove the token anytime by editing",
-    `  ${configPath()} \u2014 delete the "githubToken" line and save.`
-  ];
-}
-async function runLoginWizard(deps = defaultLoginDeps()) {
-  const { ask: ask2 } = deps;
-  console.log("");
-  console.log("  ghfind login");
-  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  console.log("");
-  if (process.env.GITHUB_TOKEN) {
-    console.log(
-      "  \u2139 GITHUB_TOKEN is set in the environment and already takes precedence."
-    );
-    console.log("");
-  }
-  const current = deps.readConfig();
-  if (current.githubToken) {
-    console.log(
-      `  \u2713 A token is already saved: ${maskToken(current.githubToken)}`
-    );
-  }
-  const ghToken = deps.readGhCliToken();
-  if (ghToken) {
-    console.log("  \u2713 Found a token managed by the GitHub CLI (gh).");
-    const answer = await ask2("  Import it into ghfind? [Y/n]: ");
-    if (answer.toLowerCase() !== "n") {
-      persistToken(ghToken, deps);
-      finishLogin(ghToken);
-      return;
-    }
-  }
-  const pasted = await ask2("  Paste a GitHub token (Enter to skip): ");
-  if (!pasted) {
-    console.log("  Skipped \u2014 no token saved.");
-    console.log("");
-    return;
-  }
-  if (!isLikelyGithubToken(pasted)) {
-    console.log(
-      `  \u26A0 That doesn't look like a GitHub token (expected one of: ${TOKEN_PREFIXES.join(", ")}).`
-    );
-    const confirm = await ask2("  Save it anyway? [y/N]: ");
-    if (confirm.toLowerCase() !== "y") {
-      console.log("  Cancelled \u2014 nothing saved.");
-      console.log("");
-      return;
-    }
-  }
-  persistToken(pasted, deps);
-  finishLogin(pasted);
-}
-function finishLogin(token) {
-  console.log(`  \u2713 Token saved to ${configPath()}`);
-  console.log(`    (masked: ${maskToken(token)})`);
-  console.log("");
-  for (const line of successNote()) console.log(line);
-  console.log("");
-}
-
-// src/init.ts
-function ask(query) {
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
+function ask(query) {
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
     rl.question(query, (answer) => {
       rl.close();
       resolve(answer.trim());
@@ -2644,8 +2761,7 @@ async function runInitWizard() {
   };
   if (token) config.githubToken = token;
   saveConfig(config);
-  const { configPath: configPath2 } = await import("./config-OCIPF2IF.js");
-  console.log(`  \u2713 Config saved to ${configPath2()}`);
+  console.log(`  \u2713 Config saved to ${configPath()}`);
   console.log("  Run 'ghfind' to start browsing!");
   console.log("");
 }
@@ -2749,6 +2865,203 @@ function comparisonMarkdown(repos) {
   return [header, sep, ...rows].join("\n");
 }
 
+// src/image-loader.ts
+var MAX_IMAGE_BYTES = 6 * 1024 * 1024;
+var BADGE_HOST = /(^|\.)(shields\.io|badgen\.net|badge\.fury\.io|codecov\.io|coveralls\.io|travis-ci\.(org|com)|snyk\.io|sonarcloud\.io|david-dm\.(org|io))$/i;
+var RAW_HOSTS = /* @__PURE__ */ new Set([
+  "raw.githubusercontent.com",
+  "camo.githubusercontent.com",
+  "user-images.githubusercontent.com",
+  "private-user-images.githubusercontent.com",
+  "avatars.githubusercontent.com",
+  "objects.githubusercontent.com"
+]);
+var RASTER_EXT = /\.(png|jpe?g|webp|gif|bmp|avif|heic|tiff?)(?:[?#]|$)/i;
+var CACHE_LIMIT = 24;
+var MAX_CONCURRENT_IMAGE_FETCHES = 4;
+var cache = /* @__PURE__ */ new Map();
+var activeFetches = 0;
+var waiting = [];
+function releaseSlot() {
+  activeFetches--;
+  waiting.shift()?.();
+}
+async function withSlot(job) {
+  if (activeFetches >= MAX_CONCURRENT_IMAGE_FETCHES) {
+    await new Promise((resolve) => waiting.push(resolve));
+  }
+  activeFetches++;
+  try {
+    return await job();
+  } finally {
+    releaseSlot();
+  }
+}
+function decodeDataUri(uri) {
+  const match = /^data:([^;,]+)?(;base64)?,(.*)$/is.exec(uri);
+  if (!match) return null;
+  const mime = (match[1] ?? "").toLowerCase();
+  if (mime.includes("svg")) return null;
+  const payload = match[3];
+  try {
+    if (match[2]) return new Uint8Array(Buffer.from(payload, "base64"));
+    return new Uint8Array(Buffer.from(decodeURIComponent(payload), "binary"));
+  } catch {
+    return null;
+  }
+}
+function toRawGitHubUrl(url) {
+  if (url.hostname.toLowerCase() !== "github.com") return url;
+  const match = /^\/([^/]+)\/([^/]+)\/(?:blob|raw)\/(.+)$/.exec(url.pathname);
+  if (!match) return url;
+  const [, owner, repo, rest] = match;
+  return new URL(
+    `https://raw.githubusercontent.com/${owner}/${repo}/${rest}${url.search}`
+  );
+}
+function resolveRootRelative(path, base) {
+  let parsed;
+  try {
+    parsed = new URL(base);
+  } catch {
+    return null;
+  }
+  if (parsed.hostname.toLowerCase() !== "raw.githubusercontent.com") {
+    return null;
+  }
+  const segments = parsed.pathname.split("/").filter(Boolean);
+  if (segments.length < 3) return null;
+  return new URL(`${parsed.origin}/${segments.slice(0, 3).join("/")}${path}`);
+}
+function resolveReadmeImageUrl(raw, base) {
+  const cleaned = raw.trim();
+  if (!cleaned) return null;
+  if (/^data:/i.test(cleaned)) {
+    return isRenderableImageUrl(cleaned) ? cleaned : null;
+  }
+  let url = null;
+  try {
+    url = cleaned.startsWith("/") ? resolveRootRelative(cleaned, base) : new URL(cleaned, base);
+  } catch {
+    return null;
+  }
+  if (!url) return null;
+  url = toRawGitHubUrl(url);
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  url.hash = "";
+  const resolved = url.toString();
+  return isRenderableImageUrl(resolved) ? resolved : null;
+}
+function isRenderableImageUrl(url) {
+  if (/^data:/i.test(url)) return !/svg/i.test(url.slice(0, 64));
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+  if (BADGE_HOST.test(parsed.hostname)) return false;
+  const path = parsed.pathname.toLowerCase();
+  if (path.endsWith(".svg") || path.endsWith(".svgz")) return false;
+  if (parsed.hostname.toLowerCase().endsWith("github.com")) {
+    if (/^\/user-attachments\//.test(path)) return true;
+    if (!RAW_HOSTS.has(parsed.hostname)) {
+      return /\.(png|jpe?g|webp|gif|bmp|avif|heic|tiff?)$/i.test(path);
+    }
+  }
+  if (/\.[a-z0-9]{1,5}$/.test(path) && !RASTER_EXT.test(path)) return false;
+  return true;
+}
+function isGitHubHost(hostname) {
+  return /(^|\.)githubusercontent\.com$|(^|\.)github\.com$/i.test(hostname);
+}
+async function fetchImageBytes(url, opts = {}) {
+  const cached2 = cache.get(url);
+  if (cached2) return cached2;
+  const pending = withSlot(() => loadImageBytes(url, opts));
+  cache.set(url, pending);
+  while (cache.size > CACHE_LIMIT) {
+    const oldest = cache.keys().next().value;
+    if (oldest === void 0) break;
+    cache.delete(oldest);
+  }
+  return pending;
+}
+async function loadImageBytes(url, opts) {
+  if (/^data:/i.test(url)) return decodeDataUri(url);
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const timeoutMs = opts.timeoutMs ?? 1e4;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const headers = {
+      "User-Agent": "ghfind/1.0",
+      Accept: "image/*,*/*;q=0.5"
+    };
+    let host = "";
+    try {
+      host = new URL(url).hostname;
+    } catch {
+      return null;
+    }
+    if (opts.token && isGitHubHost(host)) {
+      headers.Authorization = `Bearer ${opts.token}`;
+    }
+    const res = await fetchImpl(url, { headers, signal: controller.signal });
+    if (!res.ok) return null;
+    const contentType = res.headers.get("content-type") ?? "";
+    if (contentType && !/^image\//i.test(contentType)) {
+      const githubHost = isGitHubHost(host);
+      if (!githubHost || !/octet-stream/i.test(contentType)) return null;
+    }
+    if (/svg/i.test(contentType)) return null;
+    const declared = Number(res.headers.get("content-length") ?? "0");
+    if (declared > MAX_IMAGE_BYTES) return null;
+    const buffer = new Uint8Array(await res.arrayBuffer());
+    if (buffer.byteLength === 0 || buffer.byteLength > MAX_IMAGE_BYTES) {
+      return null;
+    }
+    return buffer;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function readmeBaseUrl(owner, repo, branch, path = "README.md") {
+  return `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${path}`;
+}
+
+// src/readme.ts
+var CANDIDATES = [
+  ["main", "README.md"],
+  ["master", "README.md"],
+  ["main", "README.rst"]
+];
+function buildReadmeHeaders(url, token, isPrivate = false) {
+  const headers = { "User-Agent": "ghfind/1.0" };
+  if (token && isPrivate && new URL(url).origin === "https://api.github.com") {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  return headers;
+}
+async function fetchReadme(owner, repo, opts = {}) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const attempts = CANDIDATES.map(async ([branch, file]) => {
+    const url = readmeBaseUrl(owner, repo, branch, file);
+    const headers = buildReadmeHeaders(url, opts.token, opts.private);
+    const res = await fetchImpl(url, { headers });
+    if (!res.ok) throw new Error(`no readme at ${url}`);
+    return { text: await res.text(), sourceUrl: url };
+  });
+  try {
+    return await Promise.any(attempts);
+  } catch {
+    return null;
+  }
+}
+
 // src/deepdive.ts
 var USER_AGENT = "ghfind/1.0";
 function buildHeaders(token) {
@@ -2793,42 +3106,46 @@ function repoFromRef(fullName) {
 async function resolveRepoFromRef(fullName, token) {
   const ref = parseRepoRef(fullName);
   const canonical = `${ref.owner}/${ref.name}`;
+  let res;
   try {
-    const res = await fetch(`https://api.github.com/repos/${canonical}`, {
+    res = await fetch(`https://api.github.com/repos/${canonical}`, {
       headers: buildHeaders(token)
     });
-    if (res.status === 404) {
-      throw new Error(`Repo not found: ${canonical}`);
-    }
-    if (res.ok) {
-      const api = await res.json();
-      return {
-        id: 0,
-        fullName: canonical,
-        name: ref.name,
-        owner: ref.owner,
-        description: api.description,
-        url: api.html_url,
-        stars: api.stargazers_count ?? 0,
-        forks: api.forks_count ?? 0,
-        watchers: api.subscribers_count ?? 0,
-        language: api.language,
-        topics: api.topics ?? [],
-        archived: api.archived ?? false,
-        isFork: api.fork ?? false,
-        private: false,
-        createdAt: api.created_at ?? "",
-        updatedAt: api.updated_at ?? "",
-        pushedAt: api.pushed_at ?? "",
-        score: 0
-      };
-    }
-  } catch (err) {
-    if (err instanceof Error && err.message.startsWith("Repo not found")) {
-      throw err;
-    }
+  } catch {
+    return repoFromRef(canonical);
+  }
+  if (res.status === 404) {
+    throw new Error(`Repo not found: ${canonical}`);
   }
-  return repoFromRef(canonical);
+  if (!res.ok) {
+    throw new Error(`GitHub API error ${res.status} for ${canonical}`);
+  }
+  let api;
+  try {
+    api = await res.json();
+  } catch {
+    return repoFromRef(canonical);
+  }
+  return {
+    id: 0,
+    fullName: canonical,
+    name: ref.name,
+    owner: ref.owner,
+    description: api.description,
+    url: api.html_url,
+    stars: api.stargazers_count ?? 0,
+    forks: api.forks_count ?? 0,
+    watchers: api.subscribers_count ?? 0,
+    language: api.language,
+    topics: api.topics ?? [],
+    archived: api.archived ?? false,
+    isFork: api.fork ?? false,
+    private: api.private ?? false,
+    createdAt: api.created_at ?? "",
+    updatedAt: api.updated_at ?? "",
+    pushedAt: api.pushed_at ?? "",
+    score: 0
+  };
 }
 var README_MAX_CHARS = 5e3;
 async function fetchDeepDiveRaw(repo, token) {
@@ -2842,20 +3159,11 @@ async function fetchDeepDiveRaw(repo, token) {
       { headers }
     )
   ]);
-  let readmeText = "";
-  for (const path of [
-    `${repo.owner}/${repo.name}/main/README.md`,
-    `${repo.owner}/${repo.name}/master/README.md`,
-    `${repo.owner}/${repo.name}/main/README.rst`
-  ]) {
-    const r = await fetch(`https://raw.githubusercontent.com/${path}`, {
-      headers
-    });
-    if (r.ok) {
-      readmeText = await r.text();
-      break;
-    }
-  }
+  const readme = await fetchReadme(repo.owner, repo.name, {
+    token: repo.private ? token : void 0,
+    private: repo.private
+  });
+  const readmeText = readme?.text ?? "";
   const langEntries = languagesRes.ok ? Object.entries(
     await languagesRes.json().catch(() => ({}))
   ) : [];
@@ -2946,8 +3254,8 @@ function buildDeepDiveText(data) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { join as join6, dirname as dirname4 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join8, dirname as dirname4 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/tui.ts
@@ -3170,13 +3478,10 @@ function readHistory() {
 function deleteHistoryEntry(index) {
   const entries = readHistory();
   if (index < 0 || index >= entries.length) return;
-  const removed = entries[index];
-  const remaining = entries.filter(
-    (e) => e.timestamp !== removed.timestamp || e.query !== removed.query
-  );
+  entries.splice(index, 1);
   writeRaw(
     HISTORY_FILE,
-    `${remaining.reverse().map((e) => JSON.stringify(e)).join("\n")}
+    `${entries.reverse().map((e) => JSON.stringify(e)).join("\n")}
 `
   );
 }
@@ -3564,156 +3869,6 @@ async function rasterizeImage(bytes, opts) {
   }
 }
 
-// src/image-loader.ts
-var MAX_IMAGE_BYTES = 6 * 1024 * 1024;
-var BADGE_HOST = /(^|\.)(shields\.io|badgen\.net|badge\.fury\.io|codecov\.io|coveralls\.io|travis-ci\.(org|com)|snyk\.io|sonarcloud\.io|david-dm\.(org|io))$/i;
-var RAW_HOSTS = /* @__PURE__ */ new Set([
-  "raw.githubusercontent.com",
-  "camo.githubusercontent.com",
-  "user-images.githubusercontent.com",
-  "private-user-images.githubusercontent.com",
-  "avatars.githubusercontent.com",
-  "objects.githubusercontent.com"
-]);
-var RASTER_EXT = /\.(png|jpe?g|webp|gif|bmp|avif|heic|tiff?)(?:[?#]|$)/i;
-var CACHE_LIMIT = 24;
-var cache = /* @__PURE__ */ new Map();
-function decodeDataUri(uri) {
-  const match = /^data:([^;,]+)?(;base64)?,(.*)$/is.exec(uri);
-  if (!match) return null;
-  const mime = (match[1] ?? "").toLowerCase();
-  if (mime.includes("svg")) return null;
-  const payload = match[3];
-  try {
-    if (match[2]) return new Uint8Array(Buffer.from(payload, "base64"));
-    return new Uint8Array(Buffer.from(decodeURIComponent(payload), "binary"));
-  } catch {
-    return null;
-  }
-}
-function toRawGitHubUrl(url) {
-  if (url.hostname.toLowerCase() !== "github.com") return url;
-  const match = /^\/([^/]+)\/([^/]+)\/(?:blob|raw)\/(.+)$/.exec(url.pathname);
-  if (!match) return url;
-  const [, owner, repo, rest] = match;
-  return new URL(
-    `https://raw.githubusercontent.com/${owner}/${repo}/${rest}${url.search}`
-  );
-}
-function resolveRootRelative(path, base) {
-  let parsed;
-  try {
-    parsed = new URL(base);
-  } catch {
-    return null;
-  }
-  if (parsed.hostname.toLowerCase() !== "raw.githubusercontent.com") {
-    return null;
-  }
-  const segments = parsed.pathname.split("/").filter(Boolean);
-  if (segments.length < 3) return null;
-  return new URL(`${parsed.origin}/${segments.slice(0, 3).join("/")}${path}`);
-}
-function resolveReadmeImageUrl(raw, base) {
-  const cleaned = raw.trim();
-  if (!cleaned) return null;
-  if (/^data:/i.test(cleaned)) {
-    return isRenderableImageUrl(cleaned) ? cleaned : null;
-  }
-  let url = null;
-  try {
-    url = cleaned.startsWith("/") ? resolveRootRelative(cleaned, base) : new URL(cleaned, base);
-  } catch {
-    return null;
-  }
-  if (!url) return null;
-  url = toRawGitHubUrl(url);
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  url.hash = "";
-  const resolved = url.toString();
-  return isRenderableImageUrl(resolved) ? resolved : null;
-}
-function isRenderableImageUrl(url) {
-  if (/^data:/i.test(url)) return !/svg/i.test(url.slice(0, 64));
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return false;
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
-  if (BADGE_HOST.test(parsed.hostname)) return false;
-  const path = parsed.pathname.toLowerCase();
-  if (path.endsWith(".svg") || path.endsWith(".svgz")) return false;
-  if (parsed.hostname.toLowerCase().endsWith("github.com")) {
-    if (/^\/user-attachments\//.test(path)) return true;
-    if (!RAW_HOSTS.has(parsed.hostname)) {
-      return /\.(png|jpe?g|webp|gif|bmp|avif|heic|tiff?)$/i.test(path);
-    }
-  }
-  if (/\.[a-z0-9]{1,5}$/.test(path) && !RASTER_EXT.test(path)) return false;
-  return true;
-}
-function isGitHubHost(hostname) {
-  return /(^|\.)githubusercontent\.com$|(^|\.)github\.com$/i.test(hostname);
-}
-async function fetchImageBytes(url, opts = {}) {
-  const cached2 = cache.get(url);
-  if (cached2) return cached2;
-  const pending = loadImageBytes(url, opts);
-  cache.set(url, pending);
-  while (cache.size > CACHE_LIMIT) {
-    const oldest = cache.keys().next().value;
-    if (oldest === void 0) break;
-    cache.delete(oldest);
-  }
-  return pending;
-}
-async function loadImageBytes(url, opts) {
-  if (/^data:/i.test(url)) return decodeDataUri(url);
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const timeoutMs = opts.timeoutMs ?? 1e4;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const headers = {
-      "User-Agent": "ghfind/1.0",
-      Accept: "image/*,*/*;q=0.5"
-    };
-    let host = "";
-    try {
-      host = new URL(url).hostname;
-    } catch {
-      return null;
-    }
-    if (opts.token && isGitHubHost(host)) {
-      headers.Authorization = `Bearer ${opts.token}`;
-    }
-    const res = await fetchImpl(url, { headers, signal: controller.signal });
-    if (!res.ok) return null;
-    const contentType = res.headers.get("content-type") ?? "";
-    if (contentType && !/^image\//i.test(contentType)) {
-      const githubHost = isGitHubHost(host);
-      if (!githubHost || !/octet-stream/i.test(contentType)) return null;
-    }
-    if (/svg/i.test(contentType)) return null;
-    const declared = Number(res.headers.get("content-length") ?? "0");
-    if (declared > MAX_IMAGE_BYTES) return null;
-    const buffer = new Uint8Array(await res.arrayBuffer());
-    if (buffer.byteLength === 0 || buffer.byteLength > MAX_IMAGE_BYTES) {
-      return null;
-    }
-    return buffer;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function readmeBaseUrl(owner, repo, branch, path = "README.md") {
-  return `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${path}`;
-}
-
 // src/markdown-images.ts
 var IMG_TAG = /<img\b[^>]*?src\s*=\s*["']([^"']+)["'][^>]*>/gi;
 var ALT_ATTR = /\balt\s*=\s*["']([^"']*)["']/i;
@@ -3793,6 +3948,7 @@ function extractImageRefs(token) {
 
 // src/markdown-view.ts
 var MAX_IMAGE_ROWS = 24;
+var RASTER_CACHE_LIMIT = 32;
 function createMarkdownStyle(colors2) {
   const surface = colors2.surface ?? colors2.bg;
   return SyntaxStyle.fromStyles({
@@ -3887,6 +4043,11 @@ function createMarkdownView(opts) {
       });
     })();
     rasterCache.set(key, pending);
+    while (rasterCache.size > RASTER_CACHE_LIMIT) {
+      const oldest = rasterCache.keys().next().value;
+      if (oldest === void 0) break;
+      rasterCache.delete(oldest);
+    }
     return pending;
   };
   const imageNode = (image) => {
@@ -3902,9 +4063,6 @@ function createMarkdownView(opts) {
     container.add(placeholder);
     void rasterize(url).then(
       (cells) => {
-        console.error(
-          `[dbg] image resolved: cells=${cells ? `${cells.cols}x${cells.rows}` : "null"} destroyed=${container.isDestroyed} parent=${!!container.parent} enabled=${imagesEnabled}`
-        );
         if (container.isDestroyed || !container.parent) return;
         container.remove(placeholder);
         placeholder.destroy();
@@ -3923,7 +4081,7 @@ function createMarkdownView(opts) {
         renderable.requestRender();
       },
       (err) => {
-        console.error("[dbg] image promise rejected:", err);
+        void err;
       }
     );
     return container;
@@ -3978,6 +4136,8 @@ function createMarkdownView(opts) {
       renderable.fg = text();
       renderable.bg = bg();
       renderable.content = markdown;
+      renderable.streaming = false;
+      renderable.requestRender();
     },
     setImagesEnabled(enabled) {
       if (imagesEnabled === enabled) return;
@@ -4137,23 +4297,23 @@ function nextTip() {
 }
 
 // src/update-check.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join5, dirname as dirname3, posix } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join6, dirname as dirname3, posix } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var REGISTRY_URL = "https://registry.npmjs.org/github-search-cli/latest";
 var PKG_NAME2 = "github-search-cli";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 5e3;
 var __dirname2 = dirname3(fileURLToPath3(import.meta.url));
-var PKG_DIR2 = join5(__dirname2, "..");
+var PKG_DIR2 = join6(__dirname2, "..");
 var STATE_FILE = "update-state.json";
-var DEFAULTS = {
+var DEFAULTS2 = {
   lastCheck: 0,
   snoozeUntil: 0,
   suppressed: false
 };
 function readUpdateState() {
-  return { ...DEFAULTS, ...readJSON(STATE_FILE, {}) };
+  return { ...DEFAULTS2, ...readJSON(STATE_FILE, {}) };
 }
 function writeUpdateState(state) {
   writeJSON(STATE_FILE, state);
@@ -4286,14 +4446,14 @@ function recordPreUpdateState(currentVersion) {
 }
 function fetchReleaseNotes(version) {
   try {
-    const notesPath = join5(PKG_DIR2, "release-notes", `${version}.md`);
-    const md = readFileSync5(notesPath, "utf-8");
+    const notesPath = join6(PKG_DIR2, "release-notes", `${version}.md`);
+    const md = readFileSync6(notesPath, "utf-8");
     if (md.trim().length > 0) return md;
   } catch {
   }
   try {
-    const changelogPath = join5(PKG_DIR2, "CHANGELOG.md");
-    const changelog = readFileSync5(changelogPath, "utf-8");
+    const changelogPath = join6(PKG_DIR2, "CHANGELOG.md");
+    const changelog = readFileSync6(changelogPath, "utf-8");
     const header = `## [${version}]`;
     const start = changelog.indexOf(header);
     if (start === -1) return null;
@@ -5889,27 +6049,14 @@ async function launchBrowser(theme_override) {
     readmeScroll.scrollTop = 0;
     showOverlay("readme");
     try {
-      const headers = { "User-Agent": "ghfind/1.0" };
-      if (githubToken) headers.Authorization = `Bearer ${githubToken}`;
-      let text = "";
-      let sourceUrl = "";
-      for (const [branch, file] of [
-        ["main", "README.md"],
-        ["master", "README.md"],
-        ["main", "README.rst"]
-      ]) {
-        const url = readmeBaseUrl(repo.owner, repo.name, branch, file);
-        const r = await fetch(url, { headers });
-        if (r.ok) {
-          text = await r.text();
-          sourceUrl = url;
-          break;
-        }
-      }
-      if (!text) {
-        readmeView.setContent(`_(no README found for ${repo.fullName})_`);
+      const readme = await fetchReadme(repo.owner, repo.name, {
+        token: githubToken,
+        private: repo.private
+      });
+      if (readme) {
+        readmeView.setContent(readme.text, readme.sourceUrl);
       } else {
-        readmeView.setContent(text, sourceUrl);
+        readmeView.setContent(`_(no README found for ${repo.fullName})_`);
       }
     } catch {
       readmeView.setContent("_Failed to load README._");
@@ -6336,10 +6483,12 @@ async function launchBrowser(theme_override) {
         }
       }
     } catch (err) {
-      currentRepos = [];
-      resultsSelect.options = [
-        { name: " (error)", description: "", value: null }
-      ];
+      if (!append) {
+        currentRepos = [];
+        resultsSelect.options = [
+          { name: " (error)", description: "", value: null }
+        ];
+      }
       const msg = err instanceof SearchCliError ? err.userMessage : err instanceof Error ? err.message : String(err);
       statusMgr.set("error", msg.slice(0, 60));
     }
@@ -6857,16 +7006,11 @@ ${pack.description ?? ""}`;
   renderer.requestRender();
 }
 function formatResultLine(repo) {
-  const stars = formatStars(repo.stars);
+  const stars = `\u2605 ${fmtStars(repo.stars)}`;
   const lang = (repo.language ?? "?").padEnd(12).slice(0, 12);
   const name = repo.fullName.padEnd(40).slice(0, 40);
   return `${name}  ${lang}  ${stars}`;
 }
-function formatStars(n) {
-  if (n >= 1e6) return `\u2605 ${(n / 1e6).toFixed(1).replace(/\.0$/, "")}M`;
-  if (n >= 1e3) return `\u2605 ${(n / 1e3).toFixed(1).replace(/\.0$/, "")}k`;
-  return `\u2605 ${n}`;
-}
 function formatToolbar(sort, limit, totalCount) {
   const sortLabel = SORT_MODES.find((m) => m.key === sort)?.label ?? sort;
   return ` sort: ${sortLabel}   limit: ${limit}   results: ${totalCount.toLocaleString()}`;
@@ -6931,6 +7075,12 @@ reported in text output and via the error message.
     ghfind deep-dive owner/repo --json
 Text output (no flag) prints the same sections formatted for the terminal.
 
+## Finding skills
+    ghfind skill search QUERY            # skills installed on this machine
+    ghfind skill search QUERY --remote   # the public skills.sh ecosystem
+Results carry path+description (local) or install command (registry, read-only --
+nothing is installed). The MCP server exposes the same search as
+ghfind_skill_search.
 ## Rate limits
 
 60 req/hr unauthenticated, 5,000 with GITHUB_TOKEN (env var or \`ghfind login\`).
@@ -6942,6 +7092,14 @@ Bookmarks live in ghfind's local state, not GitHub. An agent can read the
 release feed with:
     ghfind --releases --json
 Marking releases seen and editing bookmarks is a TUI action; skip it.
+## Local state (read-only)
+    ghfind bookmarks [QUERY] --json    # saved repos, newest first
+    ghfind history [QUERY] --json      # past searches
+    ghfind saved --json                # named searches
+    ghfind topics --json               # popular GitHub topics
+    ghfind readme owner/repo           # print a repo README
+    ghfind share owner/repo --as gh-cli|markdown|plain|short
+These never write local state; skip them when nothing needs reading.
 
 ## Token efficiency
 
@@ -6950,35 +7108,272 @@ you only need fullNames, and --limit to cap payload size (default 50, max 100).
 `
   };
 }
-var registry = /* @__PURE__ */ new Map();
-function registerSkill(skill) {
-  registry.set(skill.name, skill);
+var registry = /* @__PURE__ */ new Map();
+function registerSkill(skill) {
+  registry.set(skill.name, skill);
+}
+function getSkill(name) {
+  return registry.get(name);
+}
+function listSkills() {
+  return [...registry.values()].sort((a, b) => {
+    if (a.builtin !== b.builtin) return a.builtin ? -1 : 1;
+    return a.name.localeCompare(b.name);
+  });
+}
+function ensureBuiltinSkill() {
+  if (!registry.has("ghfind-cli")) {
+    registerSkill(buildGhfindSkill());
+  }
+}
+function formatSkillCatalog() {
+  ensureBuiltinSkill();
+  const lines = listSkills().map(
+    (s) => `  ${s.name.padEnd(16)} ${s.description}`
+  );
+  return [
+    "Available agent skills:",
+    ...lines,
+    "",
+    `Run \`ghfind skill <name>\` to print one (ghfind v${getVersion()}).`
+  ].join("\n");
+}
+
+// src/skill-finder.ts
+import { readdirSync, readFileSync as readFileSync7 } from "fs";
+import { homedir as homedir4 } from "os";
+import { delimiter, join as join7 } from "path";
+var REGISTRY_SEARCH_ENDPOINT = "https://skills.sh/api/search";
+var MIN_QUERY_LENGTH = 2;
+var MAX_SKILL_RESULTS = 100;
+var SAFE_ID_RE = /^[A-Za-z0-9._/-]+$/;
+function displayPath(path) {
+  const home = homedir4();
+  const normalized = path.replace(/\\/g, "/");
+  const homeNorm = home.replace(/\\/g, "/").replace(/\/$/, "");
+  if (normalized === homeNorm) return "~";
+  if (normalized.startsWith(`${homeNorm}/`)) {
+    return `~${normalized.slice(homeNorm.length)}`;
+  }
+  return normalized;
+}
+function defaultSkillRoots(cwd = process.cwd()) {
+  const home = homedir4();
+  return [
+    join7(home, ".codex", "skills"),
+    join7(home, ".agents", "skills"),
+    join7(cwd, ".codex", "skills"),
+    join7(cwd, ".github", "skills")
+  ];
+}
+function resolveSkillRoots(cwd = process.cwd()) {
+  const override = process.env.GHFIND_SKILL_ROOTS;
+  const paths = override?.trim() ? override.split(delimiter).filter((p) => p.trim()).map((p) => p.trim()) : defaultSkillRoots(cwd);
+  return paths.map((path) => ({ path, label: displayPath(path) }));
+}
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+var MAX_DEPTH = 4;
+function unquote(value) {
+  const trimmed = value.trim();
+  if (trimmed.length >= 2 && (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+function parseSkillFrontmatter(text) {
+  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
+  if (!match) return null;
+  const lines = match[1].split(/\r?\n/);
+  const fields = {};
+  for (let i = 0; i < lines.length; i++) {
+    const field = /^([A-Za-z_][\w-]*):[ \t]*(.*)$/.exec(lines[i]);
+    if (!field) continue;
+    const key = field[1].toLowerCase();
+    const inline = field[2].trim();
+    if (inline === ">" || inline === "|" || /^[>|][-+]?$/.test(inline)) {
+      const literal = inline.startsWith("|");
+      const parts = [];
+      while (i + 1 < lines.length && /^[ \t]+\S/.test(lines[i + 1])) {
+        parts.push(lines[++i].trim());
+      }
+      fields[key] = literal ? parts.join("\n") : parts.join(" ");
+    } else {
+      fields[key] = unquote(inline);
+    }
+  }
+  const name = fields.name ?? "";
+  if (!name) return null;
+  return { name, description: fields.description ?? "" };
+}
+var scanCache = /* @__PURE__ */ new Map();
+function scanLocalSkills(roots = resolveSkillRoots()) {
+  const key = roots.map((r) => `${r.path}\0${r.label}`).join("
");
+  const cached2 = scanCache.get(key);
+  if (cached2) return cached2;
+  const byName = /* @__PURE__ */ new Map();
+  for (const root of roots) {
+    for (const dir of walkDirs(root.path)) {
+      const entries = listDir(dir);
+      if (!entries) continue;
+      if (!entries.some((e) => e.isFile() && e.name === "SKILL.md")) continue;
+      const file = join7(dir, "SKILL.md");
+      try {
+        const parsed = parseSkillFrontmatter(readFileSync7(file, "utf-8"));
+        if (!parsed || byName.has(parsed.name)) continue;
+        byName.set(parsed.name, {
+          name: parsed.name,
+          description: parsed.description.replace(/\s+/g, " ").trim(),
+          path: file,
+          origin: root.label
+        });
+      } catch {
+      }
+    }
+  }
+  const hits = [...byName.values()];
+  scanCache.set(key, hits);
+  return hits;
+}
+function listDir(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+}
+function* walkDirs(root) {
+  const queue = [[root, 0]];
+  while (queue.length > 0) {
+    const [dir, depth] = queue.shift();
+    const entries = listDir(dir);
+    if (!entries) continue;
+    yield dir;
+    if (depth >= MAX_DEPTH) continue;
+    for (const entry of entries) {
+      if (!entry.isDirectory() || SKIP_DIRS.has(entry.name)) continue;
+      queue.push([join7(dir, entry.name), depth + 1]);
+    }
+  }
+}
+function localMatchTier(hit, needle) {
+  const name = hit.name.toLowerCase();
+  if (name === needle) return 0;
+  if (name.startsWith(needle)) return 1;
+  if (name.includes(needle)) return 2;
+  if (hit.description.toLowerCase().includes(needle)) return 3;
+  return null;
+}
+function rankLocalSkills(hits, query, limit = MAX_SKILL_RESULTS) {
+  const needle = query.trim().toLowerCase();
+  return hits.map((hit) => ({ hit, tier: localMatchTier(hit, needle) })).filter(
+    (entry) => entry.tier !== null
+  ).sort((a, b) => a.tier - b.tier || a.hit.name.localeCompare(b.hit.name)).slice(0, clampLimit(limit)).map((entry) => entry.hit);
+}
+function clampLimit(limit) {
+  const n = Math.trunc(Number(limit));
+  if (!Number.isFinite(n)) return MAX_SKILL_RESULTS;
+  return Math.min(Math.max(n, 1), MAX_SKILL_RESULTS);
+}
+function assertSearchableQuery(query) {
+  const trimmed = query.trim();
+  if (trimmed.length < MIN_QUERY_LENGTH) {
+    throw new Error(
+      `Query must be at least ${MIN_QUERY_LENGTH} characters (got "${trimmed}").`
+    );
+  }
+  return trimmed;
+}
+function searchLocalSkills(query, opts = {}) {
+  const trimmed = assertSearchableQuery(query);
+  const skills = rankLocalSkills(
+    scanLocalSkills(opts.roots ?? resolveSkillRoots()),
+    trimmed,
+    opts.limit ?? MAX_SKILL_RESULTS
+  );
+  return { query: trimmed, source: "local", count: skills.length, skills };
+}
+function normalizeRegistrySkill(raw) {
+  if (typeof raw !== "object" || raw === null) return null;
+  const obj = raw;
+  const source = typeof obj.source === "string" ? obj.source : "";
+  const skillId = typeof obj.skillId === "string" ? obj.skillId : "";
+  const hasTraversal = (s) => s === ".." || s.includes("..");
+  if (!SAFE_ID_RE.test(source) || !SAFE_ID_RE.test(skillId) || hasTraversal(source) || hasTraversal(skillId)) {
+    return null;
+  }
+  const name = typeof obj.name === "string" && obj.name.trim() ? obj.name : skillId;
+  const installs = typeof obj.installs === "number" ? obj.installs : 0;
+  const id = typeof obj.id === "string" && obj.id ? obj.id : `${source}/${skillId}`;
+  return {
+    id,
+    source,
+    skillId,
+    name,
+    installs,
+    installCommand: `npx skills add ${source}@${skillId}`,
+    url: `https://skills.sh/${source}/${skillId}`
+  };
+}
+async function searchRegistrySkills(query, opts = {}) {
+  const trimmed = assertSearchableQuery(query);
+  const limit = clampLimit(opts.limit ?? MAX_SKILL_RESULTS);
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const url = `${REGISTRY_SEARCH_ENDPOINT}?q=${encodeURIComponent(trimmed)}&limit=${limit}`;
+  let res;
+  try {
+    res = await fetchImpl(url, {
+      headers: { Accept: "application/json", "User-Agent": "ghfind/1.0" }
+    });
+  } catch (err) {
+    throw new Error(
+      `Could not reach skills.sh: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!res.ok) {
+    throw new Error(
+      `skills.sh returned HTTP ${res.status} for "${trimmed}". Retry, or search locally with --local.`
+    );
+  }
+  let payload;
+  try {
+    payload = await res.json();
+  } catch {
+    throw new Error("skills.sh returned a response that was not JSON.");
+  }
+  const items = payload?.skills ?? [];
+  const skills = items.map(normalizeRegistrySkill).filter((s) => s !== null).slice(0, limit);
+  return { query: trimmed, source: "registry", count: skills.length, skills };
 }
-function getSkill(name) {
-  return registry.get(name);
+async function searchSkills(query, opts = {}) {
+  if ((opts.source ?? "local") === "registry") {
+    return searchRegistrySkills(query, opts);
+  }
+  return searchLocalSkills(query, opts);
 }
-function listSkills() {
-  return [...registry.values()].sort((a, b) => {
-    if (a.builtin !== b.builtin) return a.builtin ? -1 : 1;
-    return a.name.localeCompare(b.name);
-  });
+function formatSkillSearchJson(result) {
+  return JSON.stringify(result, null, 2);
 }
-function ensureBuiltinSkill() {
-  if (!registry.has("ghfind-cli")) {
-    registerSkill(buildGhfindSkill());
+function shortDescription(description, width = 100) {
+  if (description.length <= width) return description;
+  return `${description.slice(0, width - 1).trimEnd()}\u2026`;
+}
+function formatSkillSearchText(result) {
+  if (result.count === 0) {
+    return result.source === "local" ? `No installed skills match "${result.query}". Try --remote to search the skills.sh ecosystem.` : `No skills.sh entries match "${result.query}".`;
   }
+  if (result.source === "local") {
+    return result.skills.map(
+      (s) => `${s.name}  (${s.origin})
+  ${shortDescription(s.description)}`
+    ).join("\n");
+  }
+  return result.skills.map(
+    (s) => `${s.name}  ${s.installs.toLocaleString()} installs  [${s.source}]
+  ${s.installCommand}`
+  ).join("\n");
 }
-function formatSkillCatalog() {
-  ensureBuiltinSkill();
-  const lines = listSkills().map(
-    (s) => `  ${s.name.padEnd(16)} ${s.description}`
-  );
-  return [
-    "Available agent skills:",
-    ...lines,
-    "",
-    `Run \`ghfind skill <name>\` to print one (ghfind v${getVersion()}).`
-  ].join("\n");
+function formatSkillSearchNames(result) {
+  return result.skills.map((s) => s.name).join("\n");
 }
 
 // src/mcp-server.ts
@@ -7043,6 +7438,7 @@ function asMcpToolError(err) {
 }
 var TRENDING_QUERY = { keywords: [], qualifiers: [], raw: "trending" };
 var REPO_SORTS = ["best-match", "stars", "updated", "forks"];
+var SKILL_SOURCES = ["local", "registry"];
 var TRENDING_SINCE = ["daily", "weekly", "monthly"];
 var PKG_SORTS = ["best-match", "score", "downloads", "name"];
 var TOOLS = [
@@ -7300,19 +7696,14 @@ var TOOLS = [
         throw new McpToolError("repos must contain 2-5 repo fullNames.");
       }
       const token = resolveToken(state, args.token);
-      const provider = createGitHubSearch(void 0, token ? [token] : []);
       const found = [];
       const missing = [];
       for (const fullName of names) {
-        const res = await provider.search(parseQuery(fullName), {
-          limit: 1,
-          sort: "stars",
-          json: false,
-          verbose: false,
-          token
-        });
-        if (res.repos.length > 0) found.push(res.repos[0]);
-        else missing.push(fullName);
+        try {
+          found.push(await resolveRepoFromRef(fullName, token));
+        } catch {
+          missing.push(fullName);
+        }
       }
       if (found.length < 2) {
         throw new McpToolError(
@@ -7387,6 +7778,52 @@ Not found: ${missing.join(", ")}` : "");
         data: { name: "ghfind-cli" }
       };
     }
+  },
+  {
+    name: "ghfind_skill_search",
+    title: "Search agent skills",
+    description: "Search installed agent skills (SKILL.md files under the user's skill directories) or the public skills.sh ecosystem by keyword, and return matching skills with their descriptions. Read-only: it never installs anything - registry hits include the `npx skills add` command for the user to run deliberately. Use when the user asks to find a skill for a task, or asks what skills are available.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: {
+          type: "string",
+          description: 'Keyword to match against skill names and descriptions, e.g. "changelog" or "testing" (2+ characters).'
+        },
+        source: {
+          type: "string",
+          description: "Where to search: 'local' for skills installed on this machine (default), 'registry' for the public skills.sh ecosystem.",
+          enum: [...SKILL_SOURCES]
+        },
+        limit: {
+          type: "number",
+          description: "Max results, 1-100 (default 20).",
+          minimum: 1,
+          maximum: 100
+        }
+      },
+      required: ["query"]
+    },
+    async run(args) {
+      const source = coerceEnum(
+        args.source,
+        SKILL_SOURCES,
+        "local"
+      );
+      const limit = coerceInt(args.limit, 20, 1, 100);
+      const result = await searchSkills(
+        String(args.query ?? ""),
+        { source, limit }
+      );
+      const where = result.source === "local" ? "installed skills on this machine" : "the public skills.sh ecosystem";
+      const header = `${result.count} match(es) for "${result.query}" in ${where}:`;
+      return {
+        text: `${header}
+
+${formatSkillSearchText(result)}`,
+        data: { ...result }
+      };
+    }
   }
 ];
 function toolSummaries() {
@@ -7465,7 +7902,7 @@ async function processServerLine(line, state, config) {
             title: "ghfind \u2014 GitHub search for agents",
             version: getVersion()
           },
-          instructions: "ghfind gives agents GitHub search: repositories, trending, npm packages, org/user profiles, repo comparison and deep-dives. Call ghfind_skill for the full CLI guide. Unauthenticated requests are rate-limited to 60/hr; pass a token or set GITHUB_TOKEN for 5,000/hr."
+          instructions: "ghfind gives agents GitHub search: repositories, trending, npm packages, org/user profiles, repo comparison and deep-dives. ghfind_skill_search finds agent skills, either installed on this machine or in the public skills.sh ecosystem. Call ghfind_skill for the full CLI guide. Unauthenticated requests are rate-limited to 60/hr; pass a token or set GITHUB_TOKEN for 5,000/hr."
         })
       );
       return;
@@ -7569,7 +8006,16 @@ async function runMcpServer(options = {}) {
 // src/cli.ts
 process.env.GHFIND_CLI_RUN = "1";
 var __dirname3 = dirname4(fileURLToPath4(import.meta.url));
-var PKG_DIR3 = join6(__dirname3, "..");
+var PKG_DIR3 = join8(__dirname3, "..");
+var SORT_VALUES = [
+  "best-match",
+  "stars",
+  "updated",
+  "forks",
+  "score",
+  "downloads",
+  "name"
+];
 function parseArgs(args) {
   const flags = {
     query: "",
@@ -7593,7 +8039,16 @@ function parseArgs(args) {
     registry: "npm",
     compare: [],
     doctor: false,
-    mcp: false
+    mcp: false,
+    bookmarks: false,
+    history: false,
+    topics: false,
+    saved: false,
+    remote: false,
+    local: false,
+    copy: false,
+    raw: false,
+    limitExplicit: false
   };
   const queryParts = [];
   for (let i = 0; i < args.length; i++) {
@@ -7650,6 +8105,7 @@ function parseArgs(args) {
         break;
       case "--limit": {
         const parsed = parseInt(args[++i], 10);
+        flags.limitExplicit = true;
         if (Number.isNaN(parsed) || parsed < 1 || parsed > 100) {
           console.error(`Invalid limit: must be 1-100. Using default 50.`);
           flags.limit = 50;
@@ -7658,9 +8114,17 @@ function parseArgs(args) {
         }
         break;
       }
-      case "--sort":
-        flags.sort = args[++i];
+      case "--sort": {
+        const sort = args[++i];
+        if (!sort || !SORT_VALUES.includes(sort)) {
+          console.error(
+            `Invalid sort: ${sort ?? "(missing)"} (use best-match|stars|updated|forks).`
+          );
+          process.exit(1);
+        }
+        flags.sort = sort;
         break;
+      }
       case "--token":
         flags.token = args[++i];
         break;
@@ -7682,9 +8146,56 @@ function parseArgs(args) {
       case "--completion":
         flags.completion = args[++i];
         break;
+      case "--remote":
+        flags.remote = true;
+        break;
+      case "--local":
+        flags.local = true;
+        break;
+      case "--copy":
+        flags.copy = true;
+        break;
+      case "--raw":
+        flags.raw = true;
+        break;
+      case "--as":
+        flags.sharedAs = args[++i];
+        break;
       case "mcp":
         flags.mcp = true;
         break;
+      case "bookmarks":
+        flags.bookmarks = true;
+        break;
+      case "history":
+        flags.history = true;
+        break;
+      case "topics":
+        flags.topics = true;
+        break;
+      case "saved":
+        flags.saved = true;
+        break;
+      case "readme": {
+        const next = args[i + 1];
+        if (next && !next.startsWith("-")) {
+          flags.readme = next;
+          i++;
+        } else {
+          flags.readme = "";
+        }
+        break;
+      }
+      case "share": {
+        const next = args[i + 1];
+        if (next && !next.startsWith("-")) {
+          flags.share = next;
+          i++;
+        } else {
+          flags.share = "";
+        }
+        break;
+      }
       case "deep-dive": {
         const next = args[i + 1];
         if (next && !next.startsWith("-")) {
@@ -7695,6 +8206,17 @@ function parseArgs(args) {
       }
       case "skill": {
         const next = args[i + 1];
+        if (next === "search") {
+          i++;
+          const query = args[i + 1];
+          if (query && !query.startsWith("-")) {
+            flags.skillSearch = query;
+            i++;
+          } else {
+            flags.skillSearch = "";
+          }
+          break;
+        }
         if (next && !next.startsWith("-")) {
           flags.skill = next;
           i++;
@@ -7773,6 +8295,13 @@ Usage:
   ghfind pkg <query>               Search npm packages, text list
   ghfind mcp                       Run the MCP server for AI agents (stdio)
   ghfind skill [name]              Print the agent skill guide (or catalog)
+  ghfind bookmarks [query]         Saved repos, newest first
+  ghfind history [query]           Past searches, newest first
+  ghfind topics                    Browse popular GitHub topics
+  ghfind saved                     Named searches saved in the TUI
+  ghfind readme <owner/repo>       Print a repository README
+  ghfind share a/b --as gh-cli     Share snippet (--copy to clipboard)
+  ghfind skill search <query>      Find skills locally, or --remote
   ghfind --watch <query>           Watch mode (poll every Ns)
   ghfind init                      Run setup wizard
   ghfind login                     Import the gh CLI token or paste one
@@ -7797,14 +8326,19 @@ Options:
   --releases                           New-release feed for bookmarks
   --interval <s>                       Watch interval in seconds (default: 300)
   --completion <shell>                 Generate completions
+  --remote                             skill search: query skills.sh instead of this machine
+  --local                              skill search: force the local scan (default)
+  --as <fmt>                           share format: markdown|plain|gh-cli|short
+  --copy                               share: also copy the snippet to the clipboard
+  --raw                                readme: print the raw markdown with no header
 `);
     return;
   }
   if (flags.completion) {
     const shell = flags.completion;
     try {
-      const content = readFileSync6(
-        join6(PKG_DIR3, "completions", `ghfind.${shell}`),
+      const content = readFileSync8(
+        join8(PKG_DIR3, "completions", `ghfind.${shell}`),
         "utf-8"
       );
       console.log(content);
@@ -7826,10 +8360,38 @@ Options:
     await runMcpServer({ token: flags.token });
     return;
   }
+  if (flags.skillSearch !== void 0) {
+    await runSkillSearch(flags);
+    return;
+  }
   if (flags.skill !== void 0) {
     printAgentSkill(flags.skill);
     return;
   }
+  if (flags.bookmarks) {
+    runBookmarks(flags);
+    return;
+  }
+  if (flags.history) {
+    runHistory(flags);
+    return;
+  }
+  if (flags.saved) {
+    runSavedSearches(flags);
+    return;
+  }
+  if (flags.topics) {
+    await runTopics(flags);
+    return;
+  }
+  if (flags.readme !== void 0) {
+    await runReadme(flags);
+    return;
+  }
+  if (flags.share !== void 0) {
+    await runShare(flags);
+    return;
+  }
   if (flags.pkg) {
     const interactive = !flags.query && !flags.json && !flags.csv && !flags.markdown && !flags.count && !flags.format;
     if (interactive) {
@@ -7963,6 +8525,239 @@ async function runDeepDive(flags, outputFormat) {
     process.exit(1);
   }
 }
+async function runSkillSearch(flags) {
+  const query = flags.skillSearch ?? "";
+  if (!query.trim()) {
+    console.error(
+      "Usage: ghfind skill search <query> [--remote] [--limit <n>] [--json]"
+    );
+    process.exit(1);
+  }
+  if (flags.remote && flags.local) {
+    console.error(
+      "Contradictory flags: pass either --remote or --local, not both."
+    );
+    process.exit(1);
+  }
+  const source = flags.remote ? "registry" : "local";
+  try {
+    const result = await searchSkills(query, {
+      source,
+      limit: flags.limit
+    });
+    if (flags.json) {
+      console.log(formatSkillSearchJson(result));
+    } else if (flags.format === "names") {
+      console.log(formatSkillSearchNames(result));
+    } else {
+      console.log(formatSkillSearchText(result));
+    }
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+function runBookmarks(flags) {
+  const query = flags.query.trim();
+  const bookmarks = query ? searchBookmarks(query) : getBookmarks();
+  if (flags.json) {
+    console.log(JSON.stringify(bookmarks, null, 2));
+    return;
+  }
+  if (bookmarks.length === 0) {
+    console.log(
+      query ? `No bookmarks match "${query}".` : "No bookmarks yet. Press Space \u2192 Bookmark in the TUI to save one."
+    );
+    return;
+  }
+  if (flags.csv || flags.markdown) {
+    const header = ["full_name", "stars", "language", "tags", "saved_at"];
+    const rows = bookmarks.map((b) => [
+      b.repo.fullName,
+      String(b.repo.stars),
+      b.repo.language ?? "",
+      b.tags.join(" "),
+      new Date(b.savedAt).toISOString().slice(0, 10)
+    ]);
+    console.log(
+      flags.csv ? rowsToCsv(header, rows) : rowsToMarkdown(header, rows)
+    );
+    return;
+  }
+  for (const b of bookmarks) {
+    const tags = b.tags.length > 0 ? `  [${b.tags.join(", ")}]` : "";
+    console.log(
+      `${b.repo.fullName}  \u2014 ${b.repo.stars.toLocaleString()}  ${b.repo.language ?? "n/a"}${tags}`
+    );
+  }
+}
+function runHistory(flags) {
+  const limit = flags.limitExplicit ? flags.limit : 20;
+  const query = flags.query.trim().toLowerCase();
+  const entries = readHistory().filter((e) => !query || e.query.toLowerCase().includes(query)).slice(0, limit);
+  if (flags.json) {
+    console.log(JSON.stringify(entries, null, 2));
+    return;
+  }
+  if (entries.length === 0) {
+    console.log(
+      query ? `No history matches "${query}".` : "No search history yet."
+    );
+    return;
+  }
+  if (flags.csv || flags.markdown) {
+    const header = ["query", "mode", "results", "when"];
+    const rows = entries.map((e) => [
+      e.query,
+      e.mode,
+      String(e.resultCount),
+      new Date(e.timestamp).toISOString()
+    ]);
+    console.log(
+      flags.csv ? rowsToCsv(header, rows) : rowsToMarkdown(header, rows)
+    );
+    return;
+  }
+  for (const e of entries) {
+    const when = new Date(e.timestamp).toISOString().slice(0, 10);
+    console.log(
+      `${e.query}  \u2014 ${e.mode}  \u2014 ${e.resultCount} results  \u2014 ${when}`
+    );
+  }
+}
+function runSavedSearches(flags) {
+  const saved = getSavedSearches();
+  if (flags.json) {
+    console.log(JSON.stringify(saved, null, 2));
+    return;
+  }
+  if (saved.length === 0) {
+    console.log("No saved searches yet. Save one from the TUI command menu.");
+    return;
+  }
+  if (flags.csv || flags.markdown) {
+    const header = ["name", "query", "mode", "limit"];
+    const rows = saved.map((s) => [s.name, s.query, s.mode, String(s.limit)]);
+    console.log(
+      flags.csv ? rowsToCsv(header, rows) : rowsToMarkdown(header, rows)
+    );
+    return;
+  }
+  for (const s of saved) {
+    console.log(`${s.name}  \u2014 ${s.query}  \u2014 ${s.mode}  \u2014 limit ${s.limit}`);
+  }
+}
+function rowsToCsv(header, rows) {
+  const quote = (value) => /[",\n]/.test(value) ? `"${value.replace(/"/g, '""')}"` : value;
+  return [header, ...rows].map((row) => row.map(quote).join(",")).join("\n");
+}
+function rowsToMarkdown(header, rows) {
+  const cell = (value) => value.replace(/\|/g, "\\|");
+  return [
+    `| ${header.map(cell).join(" | ")} |`,
+    `|${header.map(() => "---").join("|")}|`,
+    ...rows.map((row) => `| ${row.map(cell).join(" | ")} |`)
+  ].join("\n");
+}
+function truncate2(text, width) {
+  if (text.length <= width) return text;
+  return `${text.slice(0, width - 1).trimEnd()}\u2026`;
+}
+function plainText(html) {
+  return html.replace(/<\/p>|<br\s*\/?>/gi, " ").replace(/<[^>]*>/g, "").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&nbsp;/g, " ").replace(/\s+/g, " ").trim();
+}
+async function runTopics(flags) {
+  try {
+    const topics = (await fetchTopics()).slice(0, flags.limit);
+    if (flags.json) {
+      console.log(JSON.stringify(topics, null, 2));
+      return;
+    }
+    if (topics.length === 0) {
+      console.log("No topics returned.");
+      return;
+    }
+    for (const t3 of topics) {
+      const description = truncate2(plainText(t3.description), 140);
+      console.log(description ? `${t3.name}  ${description}` : t3.name);
+    }
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+async function runReadme(flags) {
+  const ref = flags.readme ?? "";
+  if (!ref) {
+    console.error(
+      "Usage: ghfind readme <owner/repo> [--json] [--raw] [--token <t>]"
+    );
+    process.exit(1);
+  }
+  try {
+    const { owner, name } = repoFromRef(ref);
+    const readme = await fetchReadme(owner, name, {
+      // A bare ref carries no visibility info, so the token is never
+      // forwarded to raw.githubusercontent.com.
+      token: flags.token,
+      private: false
+    });
+    if (!readme) {
+      console.error(`No README found for ${owner}/${name}.`);
+      process.exit(1);
+    }
+    if (flags.json) {
+      console.log(
+        JSON.stringify(
+          { owner, name, sourceUrl: readme.sourceUrl, text: readme.text },
+          null,
+          2
+        )
+      );
+      return;
+    }
+    if (!flags.raw) {
+      console.log(`# ${owner}/${name} README (${readme.sourceUrl})`);
+      console.log("");
+    }
+    console.log(readme.text);
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
+async function runShare(flags) {
+  const ref = flags.share ?? "";
+  if (!ref) {
+    console.error(
+      "Usage: ghfind share <owner/repo> [--as markdown|plain|gh-cli|short] [--copy]"
+    );
+    process.exit(1);
+  }
+  const SHARE_FORMATS = ["markdown", "plain", "gh-cli", "short"];
+  const as = flags.sharedAs ?? "markdown";
+  if (!SHARE_FORMATS.includes(as)) {
+    console.error(
+      `Invalid --as value: "${flags.sharedAs}" (use markdown|plain|gh-cli|short).`
+    );
+    process.exit(1);
+  }
+  try {
+    repoFromRef(ref);
+    const repo = await resolveRepoFromRef(ref, flags.token);
+    const text = formatShare(repo, as);
+    console.log(text);
+    if (flags.copy) {
+      const copied = await copyToClipboard(text);
+      console.error(
+        copied ? "Copied to clipboard." : "Could not copy to the clipboard on this platform."
+      );
+    }
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+}
 async function runPackageSearch(flags) {
   if (flags.registry !== "npm") {
     console.error(`Registry "${flags.registry}" not yet supported (only npm).`);
@@ -8155,22 +8950,14 @@ async function runNonInteractive(flags, outputFormat) {
       }
     },
     compare: async (_ctx) => {
-      const search = createGitHubSearch(void 0, [flags.token ?? ""]);
       const repos = [];
       const missing = [];
       for (const fullName of flags.compare) {
-        const res = await search.search(
-          { keywords: [fullName], qualifiers: [], raw: fullName },
-          {
-            limit: 1,
-            sort: "stars",
-            json: false,
-            verbose: false,
-            token: flags.token
-          }
-        );
-        if (res.repos.length > 0) repos.push(...res.repos);
-        else missing.push(fullName);
+        try {
+          repos.push(await resolveRepoFromRef(fullName, flags.token));
+        } catch {
+          missing.push(fullName);
+        }
       }
       if (repos.length < 2) {
         console.error(
@@ -8197,10 +8984,8 @@ Not found: ${missing.join(", ")}` : "";
   await handlers[key](ctx);
 }
 main().catch((err) => {
-  if (err instanceof Error && err.name === "SearchCliError") {
-    console.error(
-      err instanceof SearchCliError ? err.userMessage : err.message
-    );
+  if (err instanceof SearchCliError) {
+    console.error(err.userMessage);
   } else {
     console.error(err instanceof Error ? err.message : String(err));
     reportError(err);