github-search-cli 9.8.0 → 9.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-search-cli",
-  "version": "9.8.0",
+  "version": "9.8.2",
   "description": "Search GitHub from your terminal — repo search, trending repos, npm package search, bookmarks, deep-dive, compare, export. Keyboard-driven TUI + pipeable CLI.",
   "type": "module",
   "packageManager": "bun@1",

package/release-notes/9.8.1.md

@@ -0,0 +1,74 @@
+# What's New in ghfind 9.8.1
+
+Agent skills and read-only CLI views for scripts.
+
+This is a patch release. It also corrects the v9.8.0 release notes, which
+claimed README image rendering worked. It does not, and this release does not
+fix it — see the note at the end.
+
+### Added
+
+**`ghfind skill search <query>`**
+
+- Finds agent skills by keyword and prints why each one matched.
+- Scans `SKILL.md` files under `~/.codex/skills`, `~/.agents/skills`,
+  `<project>/.codex/skills` and `<project>/.github/skills`, in that
+  priority order, de-duplicated by name.
+- `--remote` queries the public [skills.sh](https://skills.sh) ecosystem
+  instead, returning each hit's install count and `npx skills add` command.
+- `GHFIND_SKILL_ROOTS` overrides which directories are scanned.
+
+**MCP tool `ghfind_skill_search`**
+
+- Agents can search skills as soon as they connect: `source: "local"` (the
+  default) searches installed skills, `source: "registry"` searches
+  skills.sh. Read-only — it returns install commands and never writes to disk.
+
+**Read-only CLI views of local state**
+
+- `ghfind bookmarks [query]`, `ghfind history [query]`, `ghfind saved`
+  and `ghfind topics`, each with `--json` for agents. They print what the
+  TUI has stored and never modify it.
+
+**`ghfind readme <owner/repo>` and `ghfind share <owner/repo>`**
+
+- `ghfind readme` prints a repository's README (`--raw` skips the header,
+  `--json` returns `{ owner, name, sourceUrl, text }`), bringing the TUI's
+  README viewer to scripts and agents.
+- `ghfind share` prints a share snippet (`--as markdown|plain|gh-cli|short`),
+  with `--copy` to also put it on the clipboard.
+
+**Shell completions**
+
+- bash, zsh and fish completions cover every new subcommand and flag.
+
+### Changed
+
+- The bundled `ghfind-cli` agent skill documents skill search and the new
+  read-only commands, so CLI-first agents discover them without reading
+  `--help`.
+
+### Fixed
+
+**README image rendering is not working — please read this before upgrading**
+
+The 9.8.0 README viewer added inline image support. On real repositories it
+does not work reliably, and this release does not fix it. Known failures, all
+verified against live READMEs:
+
+- **An image wrapped in a link renders nothing.** `[![alt](shot.png)](url)`
+  is a common way to write a linked screenshot. The whole block is treated as
+  prose and the image is dropped. This affects repositories such as
+  `sst/opencode`.
+- **A README with hundreds of small images is unusable.** `openclaw/openclaw`
+  has 661 `<img>` tags, 648 of them 48x48 sponsor avatars. Each becomes a
+  full screen of terminal cells, so the document is 15,552 rows tall.
+- **An image smaller than 100px is skipped**, judged by the `width`/`height`
+  its `<img>` tag declares. A README that understates an image's size hides
+  that image.
+- **SVG is not rendered.**
+
+Plain `![]()` images and large banners do render, correctly and quickly. The
+v9.8.0 notes described image rendering as working; that was wrong, and it is
+corrected here. Measurements, root causes and the remaining work are tracked
+in `.issues/tickets/readme-image-rendering.md`.

package/release-notes/9.8.2.md

@@ -0,0 +1,65 @@
+# v9.8.2
+
+A maintenance release: twenty-three fixes from a full static audit of the
+codebase, most of them invisible until something went wrong. Nothing user-facing
+was added or removed — every flag, key and command behaves as it did in 9.8.1.
+
+## The one that mattered
+
+A GitHub token passed as `--token` could end up in a public URL. When ghfind
+crashed, it built a GitHub issue link straight from `process.argv` — argv
+included your token — and opened it in a browser. The docblock claimed the
+command line was redacted; it was not. Every field that reaches the issue now
+goes through redaction first, and when ghfind sees a credential it prints the
+URL for you to copy instead of opening a browser tab automatically.
+
+## Security, in full
+
+- Tokens are no longer sent to `raw.githubusercontent.com` when fetching a
+  README — only to `api.github.com`, and only for a private repository.
+- Skill sources and ids from the public skills.sh registry are validated before
+  they can reach a shell command or a URL, so a hostile registry entry cannot
+  smuggle `;`, `$(`, backticks or a path traversal into `npx skills add`.
+- The config file that stores your token is now written with `0600`
+  permissions. On Windows the file still inherits the directory ACL, so this
+  closes the hole on POSIX only.
+- `--doctor` masks the token rather than printing a raw prefix.
+
+## Reliability
+
+The most user-visible correctness fix: recoverable errors were treated as
+crashes. The top-level catch tested `err.name === "SearchCliError"`, a string
+that is never true, so a rate limit, a network blip or a layout change on
+GitHub's trending page all opened a browser tab asking you to file a bug. That
+branch now works, and those errors print a short explanation and exit.
+
+`--compare` and the `ghfind_compare_repos` MCP tool both resolved repository
+names through a free-text search with no `repo:` qualifier and never checked
+the `fullName` that came back, so `ghfind --compare oven/bun oven-sh/bun` could
+quietly compare the wrong two repositories. Both now resolve exactly.
+
+State files — bookmarks, history, sessions, saved searches, notifications —
+were written directly to their live path. A crash, a full disk, or a reader
+caught mid-write left a truncated JSON file, which the loader then silently
+replaced with defaults: your data was gone with no error. Writes are now atomic
+(temp file plus rename).
+
+## Smaller fixes
+
+Notification IDs restarted after "dismiss all"; `history --delete` removed
+every duplicate entry instead of one; an invalid `--sort` value degraded
+silently instead of erroring; a failed "load more" in the TUI wiped the results
+already on screen; `--markdown` did not escape `|` in cells while `--csv`
+did; the in-memory cache was not a real LRU; local skill scanning re-walked the
+filesystem on every keystroke; and skill ids containing `_` — common on GitHub
+— were wrongly rejected.
+
+## Verification
+
+482 tests, plus `typecheck`, `lint`, `format:check` and `build` all green.
+The security fixes were additionally verified with runnable probes that assert
+no token substring survives URL encoding in the generated crash-report URL, that
+none of twelve `raw.githubusercontent.com` requests carries an `Authorization`
+header, and that seven of eight hostile skill payloads are rejected.
+
+`README.md` test count updated to match the real suite.

package/scripts/brew.rb

@@ -1,53 +1,53 @@
-# typed: true
-# frozen_string_literal: true
-
-# Homebrew formula for ghfind.
-#
-# NOTE: this file is a template, kept in-tree for a future homebrew tap.
-# Before use:
-#   1. Replace VERSION with the released version tag.
-#   2. Fill SHA256 placeholders from the SHA256SUMS.txt asset attached to
-#      the GitHub Release (the release workflow generates it).
-#   3. Host it in a tap repo (e.g. codersdfs/tap) at Formula/ghfind.rb,
-#      then: brew install codersdfs/tap/ghfind
-# See marketing/README.md (Track B) for the rollout order.
-
-class Ghfind < Formula
-  desc "Search GitHub repos from your terminal — trending, bookmarks, deep-dive"
-  homepage "https://github.com/codersdfs/search-cli"
-  version "9.5.1"
-  license "MIT"
-
-  livecheck do
-    url :stable
-    regex(/^v?(\d+(?:\.\d+)+)$/i)
-  end
-
-  on_macos do
-    if Hardware::CPU.arm?
-      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-darwin-arm64"
-      sha256 "SHA256_PLACEHOLDER"
-    else
-      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-darwin-x64"
-      sha256 "SHA256_PLACEHOLDER"
-    end
-  end
-
-  on_linux do
-    if Hardware::CPU.arm? && Hardware::CPU.is_64_bit?
-      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-linux-arm64"
-      sha256 "SHA256_PLACEHOLDER"
-    else
-      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-linux-x64"
-      sha256 "SHA256_PLACEHOLDER"
-    end
-  end
-
-  def install
-    bin.install "ghfind" => "ghfind"
-  end
-
-  test do
-    assert_match version.to_s, shell_output("#{bin}/ghfind --version")
-  end
-end
+# typed: true
+# frozen_string_literal: true
+
+# Homebrew formula for ghfind.
+#
+# NOTE: this file is a template, kept in-tree for a future homebrew tap.
+# Before use:
+#   1. Replace VERSION with the released version tag.
+#   2. Fill SHA256 placeholders from the SHA256SUMS.txt asset attached to
+#      the GitHub Release (the release workflow generates it).
+#   3. Host it in a tap repo (e.g. codersdfs/tap) at Formula/ghfind.rb,
+#      then: brew install codersdfs/tap/ghfind
+# See marketing/README.md (Track B) for the rollout order.
+
+class Ghfind < Formula
+  desc "Search GitHub repos from your terminal — trending, bookmarks, deep-dive"
+  homepage "https://github.com/codersdfs/search-cli"
+  version "9.5.1"
+  license "MIT"
+
+  livecheck do
+    url :stable
+    regex(/^v?(\d+(?:\.\d+)+)$/i)
+  end
+
+  on_macos do
+    if Hardware::CPU.arm?
+      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-darwin-arm64"
+      sha256 "SHA256_PLACEHOLDER"
+    else
+      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-darwin-x64"
+      sha256 "SHA256_PLACEHOLDER"
+    end
+  end
+
+  on_linux do
+    if Hardware::CPU.arm? && Hardware::CPU.is_64_bit?
+      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-linux-arm64"
+      sha256 "SHA256_PLACEHOLDER"
+    else
+      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-linux-x64"
+      sha256 "SHA256_PLACEHOLDER"
+    end
+  end
+
+  def install
+    bin.install "ghfind" => "ghfind"
+  end
+
+  test do
+    assert_match version.to_s, shell_output("#{bin}/ghfind --version")
+  end
+end

package/scripts/postinstall.js

@@ -18,6 +18,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { platform, arch } from "node:os";
 import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { inflateRawSync } from "node:zlib";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -96,6 +97,35 @@ const key = `${platform()}-${arch}`;
 const assetName = map[key];
 const version = "1.3.14";
 
+/**
+ * Pinned SHA256 of every Bun release asset this script can install, taken
+ * from that release's own SHASUMS256.txt. The download is verified before
+ * anything is written, so a tampered or truncated archive can never become
+ * an executable in vendor/.
+ *
+ * ponytail: hand-pinned per Bun release — regenerate this table (and bump
+ * `version`) whenever the release is bumped; the check is what makes the
+ * hardcoded `version` above trustworthy.
+ */
+const SHA256 = {
+  "bun-windows-x64.zip":
+    "0a0620930b6675d7ba440e81f4e0e00d3cfbe096c4b140d3fff02205e9e18922",
+  "bun-windows-aarch64.zip":
+    "89841f5a57f2348b67ec0839b718f4bf4ea7d07c371c9ba4b77b6c790f918953",
+  "bun-darwin-x64.zip":
+    "4183df3374623e5bab315c547cfa0974533cd457d86b73b639f7a87974cd6633",
+  "bun-darwin-aarch64.zip":
+    "d8b96221828ad6f97ac7ac0ab7e95872341af763001e8803e8267652c2652620",
+  "bun-linux-x64.zip":
+    "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f",
+  "bun-linux-x64-musl.zip":
+    "14bd9aedeebf1dba67e8def9531c89bc989ecfdf1de42e5bfcaf1b8cd9294719",
+  "bun-linux-aarch64.zip":
+    "a27ffb63a8310375836e0d6f668ae17fa8d8d18b88c37c821c65331973a19a3b",
+  "bun-linux-aarch64-musl.zip":
+    "b98e0ad3625c5c00d1d5b5ff55605c7adddbfae151861e68ade57b2d3b8703bb",
+};
+
 if (!assetName) {
   console.error(
     `[ghfind] Unsupported platform: ${key}. Install Bun manually: https://bun.sh`,
@@ -116,6 +146,14 @@ try {
 
   const buffer = Buffer.from(await res.arrayBuffer());
 
+  const expected = SHA256[assetName];
+  const actual = createHash("sha256").update(buffer).digest("hex");
+  if (expected !== actual) {
+    throw new Error(
+      `checksum mismatch for ${assetName} (expected ${expected}, got ${actual})`,
+    );
+  }
+
   // Find the central directory file header signature (PK\x01\x02)
   const cdSig = "PK\x01\x02";
   let cdOffset = buffer.indexOf(cdSig, 0);

package/src/agent-skill.ts

@@ -77,6 +77,12 @@ reported in text output and via the error message.
     ghfind deep-dive owner/repo --json
 Text output (no flag) prints the same sections formatted for the terminal.
 
+## Finding skills
+    ghfind skill search QUERY            # skills installed on this machine
+    ghfind skill search QUERY --remote   # the public skills.sh ecosystem
+Results carry path+description (local) or install command (registry, read-only --
+nothing is installed). The MCP server exposes the same search as
+ghfind_skill_search.
 ## Rate limits
 
 60 req/hr unauthenticated, 5,000 with GITHUB_TOKEN (env var or \`ghfind login\`).
@@ -88,6 +94,14 @@ Bookmarks live in ghfind's local state, not GitHub. An agent can read the
 release feed with:
     ghfind --releases --json
 Marking releases seen and editing bookmarks is a TUI action; skip it.
+## Local state (read-only)
+    ghfind bookmarks [QUERY] --json    # saved repos, newest first
+    ghfind history [QUERY] --json      # past searches
+    ghfind saved --json                # named searches
+    ghfind topics --json               # popular GitHub topics
+    ghfind readme owner/repo           # print a repo README
+    ghfind share owner/repo --as gh-cli|markdown|plain|short
+These never write local state; skip them when nothing needs reading.
 
 ## Token efficiency