github-search-cli 9.8.1 → 9.8.2

package/CHANGELOG.md

@@ -6,6 +6,69 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). Publish
 
 ---
 
+## [9.8.2] — 2026-09-28 (released)
+
+### Security
+
+- **GitHub tokens no longer leak into crash reports.** An uncaught error
+  auto-built a GitHub issue URL from the raw `process.argv`, so a token passed
+  as `--token` ended up in a public URL. Every field is now redacted before it
+  reaches the URL, title, body or stack trace, and when a credential is
+  detected ghfind prints the URL to copy instead of opening a browser.
+- **Your token is never sent to `raw.githubusercontent.com`** when fetching a
+  README. It is only attached to `api.github.com` requests, and only for a
+  repository marked private.
+- **Untrusted skill sources are validated** before they can reach a shell
+  command or URL. A `source` or `skillId` containing shell metacharacters
+  (`;`, `$`, backticks, newlines, path traversal) is now dropped from
+  registry results instead of being interpolated into `npx skills add`.
+- **The config file holding your token is written with `0600` permissions**
+  (effective on POSIX; on Windows the file still inherits the directory ACL).
+- `--doctor` masks the token with `maskToken()` instead of printing a
+  raw 7-character prefix.
+
+### Fixed
+
+- **Recoverable errors no longer open a bug-report tab.** The catch in
+  `src/cli.ts` tested `err.name === "SearchCliError"`, which is never true
+  because each subclass sets its own name, so rate-limit, network and
+  layout-change errors all fell through to the crash reporter. Routing now uses
+  `instanceof SearchCliError`.
+- **`--compare` and the MCP tool `ghfind_compare_repos` resolve repos
+  exactly.** Both used a free-text search with no `repo:` qualifier and never
+  checked the returned `fullName`, so they could silently compare a different
+  repository. They now use the existing `resolveRepoFromRef()` seam
+  (`GET /repos/{owner}/{repo}`).
+- **State files are written atomically.** Bookmarks, history, sessions, saved
+  searches, notifications and the update check were written straight to their
+  live path; a crash or a full disk left a truncated JSON file that was then
+  silently replaced with defaults, destroying user data. Writes now go to a
+  temp file and are renamed into place.
+- **Notification IDs no longer restart** after "dismiss all" — the id counter
+  was recomputed from an already-empty list.
+- **`ghfind history --delete` no longer removes every duplicate entry.** The
+  delete matched by value instead of by index.
+- **An invalid `--sort` value is rejected** with the list of valid choices and
+  a non-zero exit code instead of silently degrading to the default.
+- **A failed "load more" in the TUI no longer clears the results** already on
+  screen; the error goes to the status bar.
+- **`--markdown` escapes `|` in cells**, matching `--csv`.
+- Local skill scanning is memoised per process, so a search no longer re-walks
+  the skill roots on every keystroke.
+- `MemoryCache.set` is a true LRU — a refreshed entry now moves to the end of
+  the insertion order.
+- Skill ids and sources may contain `_` (e.g. `my_org/my_repo`), which
+  are common on GitHub and were wrongly rejected.
+
+### Changed
+
+- **`postinstall` and the bundled agent skill are unchanged in behaviour**; the
+  skill now states that `--compare` resolves a repository exactly.
+- Internal `--compare` resolution is now shared by the CLI and the MCP server
+  instead of duplicated in both.
+
+---
+
 ## [9.8.1] — 2026-09-26 (released)
 
 ### Added

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 search-cli contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 search-cli contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -313,7 +313,7 @@ cd ghfind
 # With Bun (recommended for TUI)
 bun install
 bun start        # TUI
-bun test         # 414 tests
+bun test         # 482 tests
 bun run check    # format check + tests — the green gate
 bun run build    # build dist/
 
@@ -355,6 +355,16 @@ for the measurements and the remaining work.
 
 Recent releases (full history in [CHANGELOG.md](CHANGELOG.md)):
 
+### v9.8.2
+
+- **Security: tokens no longer leak into crash reports** — an uncaught error auto-built a GitHub issue URL from raw `process.argv`, so a `--token` value ended up in a public URL; every field is redacted now, and ghfind prints the URL to copy instead of opening a browser when it finds a credential
+- **Security: your token is never sent to `raw.githubusercontent.com`** when fetching a README, only to `api.github.com` and only for a private repo
+- **Security: untrusted skill sources are validated** before reaching a shell command or URL, so a hostile skills.sh entry cannot inject into `npx skills add`
+- **Recoverable errors no longer open a bug-report tab** — rate limits, network blips and layout changes print a short message and exit
+- **`--compare` resolves repositories exactly** in both the CLI and the `ghfind_compare_repos` MCP tool; it used a free-text search that could silently compare the wrong repo
+- **State files are written atomically** — a crash mid-write used to leave truncated JSON that was silently replaced with defaults, losing bookmarks and history
+- Fixed notification IDs restarting after "dismiss all", `history --delete` removing every duplicate, an invalid `--sort` degrading silently, a failed "load more" clearing the TUI's results, `--markdown` not escaping `|`, and a not-quite-LRU memory cache
+
 ### v9.8.1
 
 - **`ghfind skill search <query>`** finds agent skills by keyword and prints why
@@ -376,13 +386,6 @@ Recent releases (full history in [CHANGELOG.md](CHANGELOG.md)):
 - **Images render inline — see [Known limitations](#known-limitations)** — relative and `/`-rooted paths resolve against the README's branch, `github.com/.../blob/...` links are rewritten to raw content, downloads are cached and size-capped, SVG and badge-service images are skipped, and anything unloadable falls back to an `🖼 alt` caption; press `i` in the viewer to toggle images
 - **No new dependencies** — the PNG decoder, image-to-cells rasteriser, and fetch cache are plain TypeScript, and images draw with truecolor half blocks, so they work on any truecolor terminal without image-protocol support
 
-### v9.7.1
-
-- **In-app update actually works now** — it used to `bun install -g` into `~/.bun` while your running copy lives in an npm prefix, reporting success while nothing changed; it now detects which package manager owns the running install and updates it in place
-- **New `ghfind --doctor` check** — flags stale/PATH-shadowing global installs (multiple `ghfind` copies with different versions) and prints the exact uninstall command
-- **Windows URL fix** — links with query params were truncated at the first `&` by `cmd /c start`; every pre-filled crash-report/issue link now opens complete
-- Fixed `open-url` crashing under Node; CI now enforces lint + typecheck gates (first green Biome baseline)
-
 ## License
 
 MIT

package/completions/ghfind.bash

@@ -1,55 +1,55 @@
-# ghfind bash completion
-# Source: source <(ghfind --completion bash)
-
-_ghfind() {
-  local cur prev opts
-  COMPREPLY=()
-  cur="${COMP_WORDS[COMP_CWORD]}"
-  prev="${COMP_WORDS[COMP_CWORD-1]}"
-
-  opts="--json --csv --markdown --count --limit --sort --token --trending --language --since --pipe --format --registry --watch --interval --version --help --completion --remote --local --copy --raw --as pkg login init doctor org user mcp skill bookmarks history topics saved readme share trending deep-dive compare"
-
-  case "${prev}" in
-    --sort)
-      COMPREPLY=( $(compgen -W "best-match stars updated forks" -- "${cur}") )
-      return 0
-      ;;
-    --since)
-      COMPREPLY=( $(compgen -W "daily weekly monthly" -- "${cur}") )
-      return 0
-      ;;
-    --pipe)
-      COMPREPLY=( $(compgen -W "clone open" -- "${cur}") )
-      return 0
-      ;;
-    --format)
-      COMPREPLY=( $(compgen -W "urls names ssh-urls clone-commands ids" -- "${cur}") )
-      return 0
-      ;;
-    --completion)
-      COMPREPLY=( $(compgen -W "bash zsh fish" -- "${cur}") )
-      return 0
-      ;;
-    --as)
-      COMPREPLY=( $(compgen -W "markdown plain gh-cli short" -- "${cur}") )
-      return 0
-      ;;
-    --registry)
-      COMPREPLY=( $(compgen -W "npm" -- "${cur}") )
-      return 0
-      ;;
-    --language)
-      COMPREPLY=( $(compgen -W "rust python typescript javascript go c c++ c# java ruby php swift kotlin zig" -- "${cur}") )
-      return 0
-      ;;
-    --limit|--interval)
-      return 0
-      ;;
-    *)
-      ;;
-  esac
-
-  COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
-  return 0
-}
-complete -F _ghfind ghfind
+# ghfind bash completion
+# Source: source <(ghfind --completion bash)
+
+_ghfind() {
+  local cur prev opts
+  COMPREPLY=()
+  cur="${COMP_WORDS[COMP_CWORD]}"
+  prev="${COMP_WORDS[COMP_CWORD-1]}"
+
+  opts="--json --csv --markdown --count --limit --sort --token --trending --language --since --pipe --format --registry --watch --interval --version --help --completion --remote --local --copy --raw --as pkg login init doctor org user mcp skill bookmarks history topics saved readme share trending deep-dive compare"
+
+  case "${prev}" in
+    --sort)
+      COMPREPLY=( $(compgen -W "best-match stars updated forks" -- "${cur}") )
+      return 0
+      ;;
+    --since)
+      COMPREPLY=( $(compgen -W "daily weekly monthly" -- "${cur}") )
+      return 0
+      ;;
+    --pipe)
+      COMPREPLY=( $(compgen -W "clone open" -- "${cur}") )
+      return 0
+      ;;
+    --format)
+      COMPREPLY=( $(compgen -W "urls names ssh-urls clone-commands ids" -- "${cur}") )
+      return 0
+      ;;
+    --completion)
+      COMPREPLY=( $(compgen -W "bash zsh fish" -- "${cur}") )
+      return 0
+      ;;
+    --as)
+      COMPREPLY=( $(compgen -W "markdown plain gh-cli short" -- "${cur}") )
+      return 0
+      ;;
+    --registry)
+      COMPREPLY=( $(compgen -W "npm" -- "${cur}") )
+      return 0
+      ;;
+    --language)
+      COMPREPLY=( $(compgen -W "rust python typescript javascript go c c++ c# java ruby php swift kotlin zig" -- "${cur}") )
+      return 0
+      ;;
+    --limit|--interval)
+      return 0
+      ;;
+    *)
+      ;;
+  esac
+
+  COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+  return 0
+}
+complete -F _ghfind ghfind

package/completions/ghfind.fish

@@ -1,29 +1,29 @@
-# ghfind fish completion
-# Source: source (ghfind --completion fish | psub)
-
-complete -c ghfind -l json -d "JSON output"
-complete -c ghfind -l csv -d "CSV output"
-complete -c ghfind -l markdown -d "Markdown table output"
-complete -c ghfind -l count -d "Only result count"
-complete -c ghfind -l limit -d "Max results" -r
-complete -c ghfind -l sort -d "Sort strategy" -r -f -a "best-match stars updated forks"
-complete -c ghfind -l token -d "GitHub token" -r
-complete -c ghfind -l trending -d "Trending mode"
-complete -c ghfind -l language -d "Trending language filter" -r -f -a "rust python typescript javascript go c c++ c# java ruby php swift kotlin zig"
-complete -c ghfind -l since -d "Trending period" -r -f -a "daily weekly monthly"
-complete -c ghfind -l pipe -d "Pipe target" -r -f -a "clone open"
-complete -c ghfind -l format -d "Output format" -r -f -a "urls names ssh-urls clone-commands ids"
-complete -c ghfind -l registry -d "Registry for pkg" -r -f -a "npm"
-
-complete -c ghfind -l watch -d "Watch mode"
-complete -c ghfind -l interval -d "Watch interval seconds" -r
-complete -c ghfind -l version -d "Print version"
-complete -c ghfind -l help -d "Print help"
-complete -c ghfind -l completion -d "Shell" -r -f -a "bash zsh fish"
-complete -c ghfind -l as -d "Share format" -r -f -a "markdown plain gh-cli short"
-complete -c ghfind -l remote -d "Skill search: query skills.sh instead of this machine"
-complete -c ghfind -l local -d "Skill search: force the local scan (default)"
-complete -c ghfind -l copy -d "Share: also copy the snippet to the clipboard"
-complete -c ghfind -l raw -d "Readme: print the raw markdown with no header"
-
+# ghfind fish completion
+# Source: source (ghfind --completion fish | psub)
+
+complete -c ghfind -l json -d "JSON output"
+complete -c ghfind -l csv -d "CSV output"
+complete -c ghfind -l markdown -d "Markdown table output"
+complete -c ghfind -l count -d "Only result count"
+complete -c ghfind -l limit -d "Max results" -r
+complete -c ghfind -l sort -d "Sort strategy" -r -f -a "best-match stars updated forks"
+complete -c ghfind -l token -d "GitHub token" -r
+complete -c ghfind -l trending -d "Trending mode"
+complete -c ghfind -l language -d "Trending language filter" -r -f -a "rust python typescript javascript go c c++ c# java ruby php swift kotlin zig"
+complete -c ghfind -l since -d "Trending period" -r -f -a "daily weekly monthly"
+complete -c ghfind -l pipe -d "Pipe target" -r -f -a "clone open"
+complete -c ghfind -l format -d "Output format" -r -f -a "urls names ssh-urls clone-commands ids"
+complete -c ghfind -l registry -d "Registry for pkg" -r -f -a "npm"
+
+complete -c ghfind -l watch -d "Watch mode"
+complete -c ghfind -l interval -d "Watch interval seconds" -r
+complete -c ghfind -l version -d "Print version"
+complete -c ghfind -l help -d "Print help"
+complete -c ghfind -l completion -d "Shell" -r -f -a "bash zsh fish"
+complete -c ghfind -l as -d "Share format" -r -f -a "markdown plain gh-cli short"
+complete -c ghfind -l remote -d "Skill search: query skills.sh instead of this machine"
+complete -c ghfind -l local -d "Skill search: force the local scan (default)"
+complete -c ghfind -l copy -d "Share: also copy the snippet to the clipboard"
+complete -c ghfind -l raw -d "Readme: print the raw markdown with no header"
+
 complete -c ghfind -f -a "login init doctor org user bookmarks history topics saved readme share pkg mcp skill trending deep-dive compare"

package/completions/ghfind.zsh

@@ -1,53 +1,53 @@
-# ghfind zsh completion
-# Source: source <(ghfind --completion zsh)
-
-_ghfind() {
-  local -a opts
-  opts=(
-    '--json[JSON output]'
-    '--csv[CSV output]'
-    '--markdown[Markdown table output]'
-    '--count[Only result count]'
-    '--limit[Max results]:limit:'
-    '--sort[Sort strategy]:(best-match stars updated forks)'
-    '--token[GitHub token]:token:'
-    '--trending[Trending mode]'
-    '--language[Trending language filter]:language:'
-    '--since[Trending period]:(daily weekly monthly)'
-    '--pipe[Pipe target]:(clone open)'
-    '--format[Output format]:(urls names ssh-urls clone-commands ids)'
-    '--registry[Registry for pkg]:(npm)'
-
-    '--watch[Watch mode]'
-    '--interval[Watch interval seconds]:seconds:'
-    '--version[Print version]'
-    '--help[Print help]'
-    '--completion[Shell]:(bash zsh fish)'
-    '--as[Share format]:(markdown plain gh-cli short)'
-    '--remote[Skill search: query skills.sh instead of this machine]'
-    '--local[Skill search: force the local scan (default)]'
-    '--copy[Share: also copy the snippet to the clipboard]'
-    '--raw[Readme: print the raw markdown with no header]'
-
-    'login[Import a GitHub token from the gh CLI or paste one]'
-    'init[Run the setup wizard]'
-    'doctor[Environment diagnostics]'
-    'org[Org profile]:org name:'
-    'user[User profile]:user name:'
-    'bookmarks[List saved repos]:query:'
-    'history[List past searches]:query:'
-    'topics[Browse popular GitHub topics]'
-    'saved[List saved searches]'
-    'readme[Print a repository README]:owner/repo:'
-    'share[Print a share snippet]:owner/repo:'
-    'pkg[Search packages]:query:'
-    'trending[Trending repos, optionally by language]'
-    'deep-dive[Repo deep-dive: languages, contributors, README]:owner/repo:'
-    'mcp[Run the MCP server for AI agents (stdio)]'
-    'skill[Print an agent skill guide, or search with: skill search <query>]:skill name:'
-    'compare[Compare repositories]'
-  )
-  _arguments "${opts[@]}" '*:query:'
-}
-
+# ghfind zsh completion
+# Source: source <(ghfind --completion zsh)
+
+_ghfind() {
+  local -a opts
+  opts=(
+    '--json[JSON output]'
+    '--csv[CSV output]'
+    '--markdown[Markdown table output]'
+    '--count[Only result count]'
+    '--limit[Max results]:limit:'
+    '--sort[Sort strategy]:(best-match stars updated forks)'
+    '--token[GitHub token]:token:'
+    '--trending[Trending mode]'
+    '--language[Trending language filter]:language:'
+    '--since[Trending period]:(daily weekly monthly)'
+    '--pipe[Pipe target]:(clone open)'
+    '--format[Output format]:(urls names ssh-urls clone-commands ids)'
+    '--registry[Registry for pkg]:(npm)'
+
+    '--watch[Watch mode]'
+    '--interval[Watch interval seconds]:seconds:'
+    '--version[Print version]'
+    '--help[Print help]'
+    '--completion[Shell]:(bash zsh fish)'
+    '--as[Share format]:(markdown plain gh-cli short)'
+    '--remote[Skill search: query skills.sh instead of this machine]'
+    '--local[Skill search: force the local scan (default)]'
+    '--copy[Share: also copy the snippet to the clipboard]'
+    '--raw[Readme: print the raw markdown with no header]'
+
+    'login[Import a GitHub token from the gh CLI or paste one]'
+    'init[Run the setup wizard]'
+    'doctor[Environment diagnostics]'
+    'org[Org profile]:org name:'
+    'user[User profile]:user name:'
+    'bookmarks[List saved repos]:query:'
+    'history[List past searches]:query:'
+    'topics[Browse popular GitHub topics]'
+    'saved[List saved searches]'
+    'readme[Print a repository README]:owner/repo:'
+    'share[Print a share snippet]:owner/repo:'
+    'pkg[Search packages]:query:'
+    'trending[Trending repos, optionally by language]'
+    'deep-dive[Repo deep-dive: languages, contributors, README]:owner/repo:'
+    'mcp[Run the MCP server for AI agents (stdio)]'
+    'skill[Print an agent skill guide, or search with: skill search <query>]:skill name:'
+    'compare[Compare repositories]'
+  )
+  _arguments "${opts[@]}" '*:query:'
+}
+
 compdef _ghfind ghfind

package/demo.svg

@@ -1,71 +1,71 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 803" width="900" height="803">
-  <defs>
-    <style>
-      @import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;700&amp;display=swap');
-    </style>
-    <filter id="shadow" x="-5%" y="-5%" width="115%" height="115%">
-      <feDropShadow dx="0" dy="4" stdDeviation="8" flood-color="#000" flood-opacity="0.4"/>
-    </filter>
-  </defs>
-
-  <rect width="100%" height="100%" fill="#0d0d1a"/>
-
-  <!-- Window -->
-  <rect x="12" y="10" width="876" height="783" fill="#1a1b26" rx="8" filter="url(#shadow)"/>
-  <rect x="12" y="10" width="876" height="36" fill="#16161e" rx="8"/>
-  <rect x="12" y="46" width="876" height="2" fill="#24283b"/>
-
-  <!-- Traffic lights -->
-  <circle cx="24" cy="28" r="5" fill="#f7768e"/>
-  <circle cx="42" cy="28" r="5" fill="#e0af68"/>
-  <circle cx="60" cy="28" r="5" fill="#9ece6a"/>
-  <text x="450" y="34" fill="#565f89" font-family="'JetBrains Mono','Fira Code',monospace" font-size="13" text-anchor="middle">ghfind — terminal GitHub browser</text>
-
-  <g font-family="'JetBrains Mono','Fira Code','Cascadia Code',monospace" font-size="14">
-    <text x="14" y="62" fill="#565f89" font-family="'JetBrains Mono','Fira Code','Cascadia Code',monospace" font-size="14">ghfind — GitHub repo browser   [t]rending  [/]search  [g]raph  [r]efresh  [q]uit</text>
-    <rect x="14" y="69" width="860" height="54.5" fill="#1a1b26" stroke="#7aa2f7" stroke-width="1" rx="3"/>
-    <text x="22" y="88" fill="#7aa2f7" font-family="'JetBrains Mono','Fira Code','Cascadia Code',monospace" font-size="14">&gt; language:TypeScript stars:&gt;1000</text>
-    <text x="14" y="150.2" fill="#565f89" font-family="'JetBrains Mono','Fira Code','Cascadia Code',monospace" font-size="14">sort: stars   limit: 50   (s=cycle sort  l=cycle limit)</text>
-    <rect x="14" y="159.3" width="432" height="378" fill="#24283b" stroke="#1f2335" stroke-width="1"/>
-    <!-- Search results list -->
-    <rect x="14" y="159.3" width="432" height="19" fill="#7aa2f7" opacity="0.15"/>
-    <text x="22" y="173" fill="#c0caf5">✓  facebook/react                          ★ 218k     JavaScript</text>
-    <text x="22" y="193" fill="#c0caf5">✓  vercel/next.js                          ★ 116k     TypeScript</text>
-    <text x="22" y="213" fill="#c0caf5">✓  microsoft/vscode                         ★ 158k     TypeScript</text>
-    <text x="22" y="233" fill="#c0caf5">✓  tanstack/router                          ★ 15k      TypeScript</text>
-    <text x="22" y="253" fill="#c0caf5">✓  tailwindlabs/tailwindcss                  ★ 81k      TypeScript</text>
-    <text x="22" y="273" fill="#c0caf5">✓  denoland/deno                             ★ 93k      Rust</text>
-    <text x="22" y="293" fill="#c0caf5">✓  oven-sh/bun                               ★ 65k      TypeScript</text>
-    <text x="22" y="313" fill="#c0caf5">✓  sagoie/open-tui                           ★ 3.2k     TypeScript</text>
-    <text x="22" y="333" fill="#e0af68">→  ghfind/cli                                ★ 4.8k     TypeScript</text>
-    <text x="22" y="353" fill="#c0caf5">✓  biomejs/biome                             ★ 28k      Rust</text>
-    <!-- ... more results ... -->
-    <text x="14" y="525" fill="#565f89">   10 of 847 results  [Page 1/85]</text>
-
-    <rect x="456" y="159.3" width="418" height="378" fill="#24283b" stroke="#1f2335" stroke-width="1"/>
-    <!-- Right panel: repo info -->
-    <text x="468" y="183" fill="#bb9af7" font-weight="bold">facebook/react</text>
-    <text x="468" y="203" fill="#565f89">React is a JavaScript library for building user interfaces</text>
-    <text x="468" y="228" fill="#e0af68">★ 218,847</text>
-    <text x="540" y="228" fill="#565f89">  Forks: 46,231</text>
-    <text x="468" y="248" fill="#9ece6a">License: MIT</text>
-    <text x="468" y="268" fill="#7aa2f7">Language: JavaScript</text>
-    <text x="468" y="293" fill="#c0caf5">Updated: today</text>
-    <text x="468" y="318" fill="#565f89">Topics: react, javascript, ui, frontend, framework</text>
-
-    <text x="468" y="348" fill="#7aa2f7" font-weight="bold">Description</text>
-    <text x="468" y="368" fill="#c0caf5">A declarative, efficient, and flexible JavaScript library</text>
-    <text x="468" y="383" fill="#c0caf5">for building user interfaces.</text>
-
-    <text x="468" y="413" fill="#7aa2f7" font-weight="bold">README Preview</text>
-    <text x="468" y="433" fill="#c0caf5"># React</text>
-    <text x="468" y="453" fill="#565f89">  A JavaScript library for building user interfaces</text>
-    <text x="468" y="478" fill="#565f89">  ──────────────────────────────────────────────────</text>
-    <text x="468" y="503" fill="#c0caf5">React lets you build user interfaces out of individual</text>
-    <text x="468" y="518" fill="#c0caf5">pieces called components.</text>
-
-    <rect x="456" y="545" width="418" height="40" fill="#16161e" stroke="#1f2335"/>
-    <text x="468" y="570" fill="#565f89">  [r]eadme  [d]eepdive  [→] open  [h]elp  [q]uit</text>
-  </g>
-</svg>
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 900 803" width="900" height="803">
+  <defs>
+    <style>
+      @import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;700&amp;display=swap');
+    </style>
+    <filter id="shadow" x="-5%" y="-5%" width="115%" height="115%">
+      <feDropShadow dx="0" dy="4" stdDeviation="8" flood-color="#000" flood-opacity="0.4"/>
+    </filter>
+  </defs>
+
+  <rect width="100%" height="100%" fill="#0d0d1a"/>
+
+  <!-- Window -->
+  <rect x="12" y="10" width="876" height="783" fill="#1a1b26" rx="8" filter="url(#shadow)"/>
+  <rect x="12" y="10" width="876" height="36" fill="#16161e" rx="8"/>
+  <rect x="12" y="46" width="876" height="2" fill="#24283b"/>
+
+  <!-- Traffic lights -->
+  <circle cx="24" cy="28" r="5" fill="#f7768e"/>
+  <circle cx="42" cy="28" r="5" fill="#e0af68"/>
+  <circle cx="60" cy="28" r="5" fill="#9ece6a"/>
+  <text x="450" y="34" fill="#565f89" font-family="'JetBrains Mono','Fira Code',monospace" font-size="13" text-anchor="middle">ghfind — terminal GitHub browser</text>
+
+  <g font-family="'JetBrains Mono','Fira Code','Cascadia Code',monospace" font-size="14">
+    <text x="14" y="62" fill="#565f89" font-family="'JetBrains Mono','Fira Code','Cascadia Code',monospace" font-size="14">ghfind — GitHub repo browser   [t]rending  [/]search  [g]raph  [r]efresh  [q]uit</text>
+    <rect x="14" y="69" width="860" height="54.5" fill="#1a1b26" stroke="#7aa2f7" stroke-width="1" rx="3"/>
+    <text x="22" y="88" fill="#7aa2f7" font-family="'JetBrains Mono','Fira Code','Cascadia Code',monospace" font-size="14">&gt; language:TypeScript stars:&gt;1000</text>
+    <text x="14" y="150.2" fill="#565f89" font-family="'JetBrains Mono','Fira Code','Cascadia Code',monospace" font-size="14">sort: stars   limit: 50   (s=cycle sort  l=cycle limit)</text>
+    <rect x="14" y="159.3" width="432" height="378" fill="#24283b" stroke="#1f2335" stroke-width="1"/>
+    <!-- Search results list -->
+    <rect x="14" y="159.3" width="432" height="19" fill="#7aa2f7" opacity="0.15"/>
+    <text x="22" y="173" fill="#c0caf5">✓  facebook/react                          ★ 218k     JavaScript</text>
+    <text x="22" y="193" fill="#c0caf5">✓  vercel/next.js                          ★ 116k     TypeScript</text>
+    <text x="22" y="213" fill="#c0caf5">✓  microsoft/vscode                         ★ 158k     TypeScript</text>
+    <text x="22" y="233" fill="#c0caf5">✓  tanstack/router                          ★ 15k      TypeScript</text>
+    <text x="22" y="253" fill="#c0caf5">✓  tailwindlabs/tailwindcss                  ★ 81k      TypeScript</text>
+    <text x="22" y="273" fill="#c0caf5">✓  denoland/deno                             ★ 93k      Rust</text>
+    <text x="22" y="293" fill="#c0caf5">✓  oven-sh/bun                               ★ 65k      TypeScript</text>
+    <text x="22" y="313" fill="#c0caf5">✓  sagoie/open-tui                           ★ 3.2k     TypeScript</text>
+    <text x="22" y="333" fill="#e0af68">→  ghfind/cli                                ★ 4.8k     TypeScript</text>
+    <text x="22" y="353" fill="#c0caf5">✓  biomejs/biome                             ★ 28k      Rust</text>
+    <!-- ... more results ... -->
+    <text x="14" y="525" fill="#565f89">   10 of 847 results  [Page 1/85]</text>
+
+    <rect x="456" y="159.3" width="418" height="378" fill="#24283b" stroke="#1f2335" stroke-width="1"/>
+    <!-- Right panel: repo info -->
+    <text x="468" y="183" fill="#bb9af7" font-weight="bold">facebook/react</text>
+    <text x="468" y="203" fill="#565f89">React is a JavaScript library for building user interfaces</text>
+    <text x="468" y="228" fill="#e0af68">★ 218,847</text>
+    <text x="540" y="228" fill="#565f89">  Forks: 46,231</text>
+    <text x="468" y="248" fill="#9ece6a">License: MIT</text>
+    <text x="468" y="268" fill="#7aa2f7">Language: JavaScript</text>
+    <text x="468" y="293" fill="#c0caf5">Updated: today</text>
+    <text x="468" y="318" fill="#565f89">Topics: react, javascript, ui, frontend, framework</text>
+
+    <text x="468" y="348" fill="#7aa2f7" font-weight="bold">Description</text>
+    <text x="468" y="368" fill="#c0caf5">A declarative, efficient, and flexible JavaScript library</text>
+    <text x="468" y="383" fill="#c0caf5">for building user interfaces.</text>
+
+    <text x="468" y="413" fill="#7aa2f7" font-weight="bold">README Preview</text>
+    <text x="468" y="433" fill="#c0caf5"># React</text>
+    <text x="468" y="453" fill="#565f89">  A JavaScript library for building user interfaces</text>
+    <text x="468" y="478" fill="#565f89">  ──────────────────────────────────────────────────</text>
+    <text x="468" y="503" fill="#c0caf5">React lets you build user interfaces out of individual</text>
+    <text x="468" y="518" fill="#c0caf5">pieces called components.</text>
+
+    <rect x="456" y="545" width="418" height="40" fill="#16161e" stroke="#1f2335"/>
+    <text x="468" y="570" fill="#565f89">  [r]eadme  [d]eepdive  [→] open  [h]elp  [q]uit</text>
+  </g>
+</svg>