github-search-cli 9.8.1 → 9.8.2

package/dist/cli.js

@@ -1,21 +1,11 @@
-import {
-  cacheDir,
-  configPath,
-  loadConfig,
-  saveConfig,
-  stateDir
-} from "./chunk-GYIL4S5X.js";
-
 // src/errors.ts
 var SearchCliError = class extends Error {
-  constructor(message, userMessage, recoverable = true) {
+  constructor(message, userMessage) {
     super(message);
     this.userMessage = userMessage;
-    this.recoverable = recoverable;
     this.name = "SearchCliError";
   }
   userMessage;
-  recoverable;
 };
 var NetworkError = class extends SearchCliError {
   constructor() {
@@ -154,6 +144,7 @@ var MemoryCache = class {
     return entry.data;
   }
   set(key, data, ttlMs) {
+    this.cache.delete(key);
     if (this.cache.size >= MAX_CACHE_SIZE) {
       const firstKey = this.cache.keys().next().value;
       if (firstKey !== void 0) this.cache.delete(firstKey);
@@ -1190,13 +1181,199 @@ async function launchPackageBrowser() {
 }
 
 // src/doctor.ts
-import { existsSync, readFileSync, mkdirSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, mkdirSync as mkdirSync2 } from "fs";
 import { spawnSync } from "child_process";
-import { join, dirname } from "path";
+import { join as join3, dirname } from "path";
 import { fileURLToPath } from "url";
-import { homedir, platform, arch } from "os";
+import { homedir as homedir3, platform, arch } from "os";
+
+// src/config.ts
+import { homedir } from "os";
+import { join } from "path";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+function stateDir() {
+  const xdg = process.env.XDG_STATE_HOME;
+  const base = xdg ? join(xdg, "ghfind") : join(homedir(), ".local", "share", "ghfind");
+  return base;
+}
+function cacheDir() {
+  const xdg = process.env.XDG_CACHE_HOME;
+  const base = xdg ? join(xdg, "ghfind") : join(homedir(), ".cache", "ghfind");
+  return base;
+}
+var DEFAULTS = {
+  defaultSort: "best-match",
+  defaultLimit: 50,
+  theme: "tokyo-night",
+  cacheTtlSeconds: 300,
+  defaultTab: "search"
+};
+function configPath() {
+  const envPath = process.env.GHFIND_CONFIG;
+  if (envPath) return envPath;
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const base = xdg ? join(xdg, "ghfind") : join(homedir(), ".config", "ghfind");
+  return join(base, "config.json");
+}
+function loadConfig() {
+  const path = configPath();
+  try {
+    const raw = readFileSync(path, "utf-8");
+    const parsed = JSON.parse(raw);
+    return mergeWithEnv({ ...DEFAULTS, ...parsed });
+  } catch {
+    return mergeWithEnv({ ...DEFAULTS });
+  }
+}
+function saveConfig(config) {
+  const path = configPath();
+  const dir = path.slice(
+    0,
+    Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\"))
+  );
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(path, JSON.stringify(config, null, 2), {
+    encoding: "utf-8",
+    mode: 384
+  });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function mergeWithEnv(config) {
+  if (process.env.GITHUB_TOKEN) config.githubToken = process.env.GITHUB_TOKEN;
+  return config;
+}
+
+// src/login.ts
+import { createInterface } from "readline";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+var TOKEN_PREFIXES = ["ghp_", "gho_", "github_pat_"];
+function isLikelyGithubToken(token) {
+  return TOKEN_PREFIXES.some((prefix) => token.startsWith(prefix));
+}
+function maskToken(token) {
+  if (token.length <= 11) return `${token.slice(0, 4)}\u2026`;
+  return `${token.slice(0, 7)}\u2026${token.slice(-4)}`;
+}
+function ghCliConfigDir() {
+  return process.env.GH_CONFIG_DIR || join2(homedir2(), ".config", "gh");
+}
+function parseHostsYmlToken(text, host = "github.com") {
+  let inHost = false;
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (/^[A-Za-z0-9.-]+:\s*$/.test(trimmed)) {
+      inHost = trimmed.slice(0, -1).trim() === host;
+      continue;
+    }
+    if (inHost) {
+      const match = trimmed.match(/^oauth_token:\s*["']?([^"'\s]+)/);
+      if (match) return match[1];
+    }
+  }
+  return void 0;
+}
+function readGhCliToken(ghDir = ghCliConfigDir(), host = process.env.GH_HOST ?? "github.com") {
+  const hostsFile = join2(ghDir, "hosts.yml");
+  if (!existsSync(hostsFile)) return void 0;
+  try {
+    return parseHostsYmlToken(readFileSync2(hostsFile, "utf-8"), host);
+  } catch {
+    return void 0;
+  }
+}
+function persistToken(token, deps) {
+  const config = deps.readConfig();
+  config.githubToken = token;
+  deps.writeConfig(config);
+}
+function createAsk() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return (query) => new Promise((resolve) => {
+    rl.question(query, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+function defaultLoginDeps() {
+  return {
+    ask: createAsk(),
+    readGhCliToken: () => readGhCliToken(),
+    readConfig: loadConfig,
+    writeConfig: (config) => saveConfig(config)
+  };
+}
+function successNote() {
+  return [
+    "  Authentication raises the search rate limit from 60 to",
+    "  5,000 requests/hour. Remove the token anytime by editing",
+    `  ${configPath()} \u2014 delete the "githubToken" line and save.`
+  ];
+}
+async function runLoginWizard(deps = defaultLoginDeps()) {
+  const { ask: ask2 } = deps;
+  console.log("");
+  console.log("  ghfind login");
+  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log("");
+  if (process.env.GITHUB_TOKEN) {
+    console.log(
+      "  \u2139 GITHUB_TOKEN is set in the environment and already takes precedence."
+    );
+    console.log("");
+  }
+  const current = deps.readConfig();
+  if (current.githubToken) {
+    console.log(
+      `  \u2713 A token is already saved: ${maskToken(current.githubToken)}`
+    );
+  }
+  const ghToken = deps.readGhCliToken();
+  if (ghToken) {
+    console.log("  \u2713 Found a token managed by the GitHub CLI (gh).");
+    const answer = await ask2("  Import it into ghfind? [Y/n]: ");
+    if (answer.toLowerCase() !== "n") {
+      persistToken(ghToken, deps);
+      finishLogin(ghToken);
+      return;
+    }
+  }
+  const pasted = await ask2("  Paste a GitHub token (Enter to skip): ");
+  if (!pasted) {
+    console.log("  Skipped \u2014 no token saved.");
+    console.log("");
+    return;
+  }
+  if (!isLikelyGithubToken(pasted)) {
+    console.log(
+      `  \u26A0 That doesn't look like a GitHub token (expected one of: ${TOKEN_PREFIXES.join(", ")}).`
+    );
+    const confirm = await ask2("  Save it anyway? [y/N]: ");
+    if (confirm.toLowerCase() !== "y") {
+      console.log("  Cancelled \u2014 nothing saved.");
+      console.log("");
+      return;
+    }
+  }
+  persistToken(pasted, deps);
+  finishLogin(pasted);
+}
+function finishLogin(token) {
+  console.log(`  \u2713 Token saved to ${configPath()}`);
+  console.log(`    (masked: ${maskToken(token)})`);
+  console.log("");
+  for (const line of successNote()) console.log(line);
+  console.log("");
+}
+
+// src/doctor.ts
 var __dirname = dirname(fileURLToPath(import.meta.url));
-var PKG_DIR = join(__dirname, "..");
+var PKG_DIR = join3(__dirname, "..");
 var results = [];
 function add(status, label, detail) {
   results.push({ status, label, detail });
@@ -1222,7 +1399,7 @@ function hasSystemBun() {
   return res.status === 0 ? { ok: true, version: res.stdout.trim() } : { ok: false };
 }
 function bundledBunPath() {
-  return join(PKG_DIR, "vendor", platform() === "win32" ? "bun.exe" : "bun");
+  return join3(PKG_DIR, "vendor", platform() === "win32" ? "bun.exe" : "bun");
 }
 function bunRuns(bin) {
   const res = run(bin, ["--version"]);
@@ -1232,7 +1409,7 @@ function bunRuns(bin) {
 function detectLibc() {
   if (platform() !== "linux") return "unknown";
   try {
-    const osRelease = readFileSync("/etc/os-release", "utf8");
+    const osRelease = readFileSync3("/etc/os-release", "utf8");
     if (/alpine|musl/i.test(osRelease)) return "musl";
   } catch {
   }
@@ -1253,7 +1430,7 @@ async function checkRuntime() {
 }
 function checkBundledBun() {
   const path = bundledBunPath();
-  if (!existsSync(path)) {
+  if (!existsSync2(path)) {
     add(
       "WARN",
       "Bundled Bun",
@@ -1302,8 +1479,8 @@ function checkNodeVersion() {
   }
 }
 function checkBuildOutput() {
-  const dist = join(PKG_DIR, "dist", "cli.js");
-  if (existsSync(dist)) {
+  const dist = join3(PKG_DIR, "dist", "cli.js");
+  if (existsSync2(dist)) {
     add("PASS", "Build output", `${dist}`);
   } else {
     add(
@@ -1314,8 +1491,8 @@ function checkBuildOutput() {
   }
 }
 function checkSource() {
-  const src = join(PKG_DIR, "src", "cli.ts");
-  if (existsSync(src)) {
+  const src = join3(PKG_DIR, "src", "cli.ts");
+  if (existsSync2(src)) {
     add("PASS", "Source", `${src}`);
   } else {
     add("FAIL", "Source", "src/cli.ts not found. Reinstall the package.");
@@ -1331,7 +1508,7 @@ function checkTuiBackend() {
 }
 function checkConfig() {
   const path = configPath();
-  if (!existsSync(path)) {
+  if (!existsSync2(path)) {
     add(
       "WARN",
       "Config",
@@ -1340,7 +1517,7 @@ function checkConfig() {
     return;
   }
   try {
-    const raw = readFileSync(path, "utf-8");
+    const raw = readFileSync3(path, "utf-8");
     JSON.parse(raw);
     add("PASS", "Config", `${path} (valid JSON)`);
   } catch (err) {
@@ -1355,8 +1532,8 @@ function checkGithubToken() {
   const config = loadConfig();
   const token = config.githubToken || process.env.GITHUB_TOKEN;
   if (token) {
-    const preview = token.slice(0, 7);
-    add("PASS", "GitHub token", `Configured (${preview}\u2026).`);
+    const preview = maskToken(token);
+    add("PASS", "GitHub token", `Configured (${preview}).`);
   } else {
     add(
       "WARN",
@@ -1371,7 +1548,7 @@ function checkDirs() {
     ["Cache dir", cacheDir()]
   ]) {
     try {
-      mkdirSync(dir, { recursive: true });
+      mkdirSync2(dir, { recursive: true });
       add("PASS", label, dir);
     } catch (err) {
       add(
@@ -1387,7 +1564,7 @@ var BIN_NAME = "ghfind";
 function runningVersion() {
   try {
     const pkg = JSON.parse(
-      readFileSync(join(PKG_DIR, "package.json"), "utf8")
+      readFileSync3(join3(PKG_DIR, "package.json"), "utf8")
     );
     return pkg.version ?? "";
   } catch {
@@ -1397,11 +1574,11 @@ function runningVersion() {
 function installVersionAt(shimPath) {
   const dir = dirname(shimPath);
   for (const ancestor of [dir, dirname(dir)]) {
-    for (const sub of ["node_modules", join("lib", "node_modules")]) {
-      const pkgJson = join(ancestor, sub, PKG_NAME, "package.json");
-      if (existsSync(pkgJson)) {
+    for (const sub of ["node_modules", join3("lib", "node_modules")]) {
+      const pkgJson = join3(ancestor, sub, PKG_NAME, "package.json");
+      if (existsSync2(pkgJson)) {
         try {
-          const pkg = JSON.parse(readFileSync(pkgJson, "utf8"));
+          const pkg = JSON.parse(readFileSync3(pkgJson, "utf8"));
           return { version: pkg.version ?? "", dir: dirname(pkgJson) };
         } catch {
         }
@@ -1481,7 +1658,7 @@ function printReport() {
     return `${code}${s}\x1B[0m`;
   };
   console.log("\n  ghfind doctor \u2014 environment diagnostics");
-  console.log(`  ${platform()} ${arch} \xB7 ${homedir()}`);
+  console.log(`  ${platform()} ${arch} \xB7 ${homedir3()}`);
   console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   for (const r of results) {
     console.log(
@@ -1531,20 +1708,20 @@ import {
 import { spawn as spawn2 } from "child_process";
 
 // src/version.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join2, dirname as dirname2 } from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import { join as join4, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var cached = null;
 function getVersion() {
   if (cached) return cached;
   if (true) {
-    cached = "9.8.1";
+    cached = "9.8.2";
     return cached;
   }
   try {
     const here = dirname2(fileURLToPath2(import.meta.url));
     const pkg = JSON.parse(
-      readFileSync2(join2(here, "..", "package.json"), "utf-8")
+      readFileSync4(join4(here, "..", "package.json"), "utf-8")
     );
     cached = pkg.version ?? "unknown";
   } catch {
@@ -1556,6 +1733,45 @@ function getVersion() {
 // src/error-report.ts
 var REPO = "codersdfs/search-cli";
 var NEW_ISSUE_URL = `https://github.com/${REPO}/issues/new`;
+var SECRET_PLACEHOLDER = "***";
+var SECRET_FLAGS = /^(?:--token|-t)$/;
+var SECRET_PATTERNS = [
+  /gh[pousr]_[A-Za-z0-9]{16,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g
+];
+function redactSecrets(text) {
+  let out = text;
+  for (const pattern of SECRET_PATTERNS) {
+    out = out.replace(pattern, SECRET_PLACEHOLDER);
+  }
+  return out;
+}
+function redactArgv(argv) {
+  const out = [];
+  let redactNext = false;
+  for (const arg of argv) {
+    if (redactNext) {
+      out.push(SECRET_PLACEHOLDER);
+      redactNext = false;
+      continue;
+    }
+    if (SECRET_FLAGS.test(arg)) {
+      out.push(arg);
+      redactNext = true;
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    if (eq > 0 && SECRET_FLAGS.test(arg.slice(0, eq))) {
+      out.push(`${arg.slice(0, eq)}=${SECRET_PLACEHOLDER}`);
+      continue;
+    }
+    out.push(redactSecrets(arg));
+  }
+  return out;
+}
+function argvHasSecret(argv) {
+  return redactArgv(argv).some((arg, i) => arg !== argv[i]);
+}
 function getPackageVersion() {
   return getVersion();
 }
@@ -1565,9 +1781,12 @@ function runtimeName() {
 }
 function formatErrorBody(err, context) {
   const e = err instanceof Error ? err : new Error(String(err));
-  const stack = (e.stack ?? "(no stack)").replace(/\u001b\[[0-9;]*m/g, "");
-  const message = (e.message || "(no message)").slice(0, 500);
-  const cmd = `${context.command} ${context.argv.join(" ")}`.trim();
+  const stack = redactSecrets(
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: strips ANSI color escapes from stack traces
+    (e.stack ?? "(no stack)").replace(/\u001b\[[0-9;]*m/g, "")
+  );
+  const message = redactSecrets(e.message || "(no message)").slice(0, 500);
+  const cmd = `${context.command} ${redactArgv(context.argv).join(" ")}`.trim();
   const ghfindVersion = getPackageVersion();
   return [
     "## What happened",
@@ -1601,7 +1820,7 @@ function formatErrorBody(err, context) {
 }
 function buildIssueUrl(err, context) {
   const e = err instanceof Error ? err : new Error(String(err));
-  const title = e.message.slice(0, 80).replace(/[\r\n]+/g, " ");
+  const title = redactSecrets(e.message).slice(0, 80).replace(/[\r\n]+/g, " ");
   const body = formatErrorBody(err, context);
   const params = new URLSearchParams({
     title: `[bug] ${title || "Unhandled error"}`,
@@ -1633,15 +1852,25 @@ function reportError(err, context = {
   command: "ghfind",
   argv: process.argv.slice(2)
 }) {
-  const url = buildIssueUrl(err, context);
+  const hadSecret = argvHasSecret(context.argv);
+  const url = buildIssueUrl(err, {
+    command: context.command,
+    argv: redactArgv(context.argv)
+  });
   console.error("");
   console.error("  \u26A0  ghfind encountered an unexpected error.");
   console.error("");
-  console.error("  Help us fix it by opening a bug report with the");
-  console.error("  details pre-filled. Your browser will open the new-issue");
-  console.error("  page; review and submit (or close the tab to skip).");
+  if (hadSecret) {
+    console.error("  A token was found in the command line and has been");
+    console.error("  redacted. Your browser will NOT be opened \u2014 review the");
+    console.error("  scrubbed URL below before sharing it anywhere.");
+  } else {
+    console.error("  Help us fix it by opening a bug report with the");
+    console.error("  details pre-filled. Your browser will open the new-issue");
+    console.error("  page; review and submit (or close the tab to skip).");
+  }
   console.error("");
-  const opened = tryOpenUrl(url);
+  const opened = hadSecret ? false : tryOpenUrl(url);
   if (opened) {
     console.error(`  \u2192 Opened: ${url}`);
   } else {
@@ -1654,7 +1883,7 @@ function reportError(err, context = {
 }
 
 // src/output.ts
-import { writeFileSync } from "fs";
+import { writeFileSync as writeFileSync2 } from "fs";
 var FORMATS = /* @__PURE__ */ new Map([
   // Export formats
   ["json", formatJson],
@@ -1722,7 +1951,7 @@ function exportToFile(repos, fmt) {
   const ext = fmt === "markdown" ? "md" : fmt;
   const ts = Date.now();
   const path = `./ghfind-export-${ts}.${ext}`;
-  writeFileSync(path, format(repos, fmt), "utf-8");
+  writeFileSync2(path, format(repos, fmt), "utf-8");
   return path;
 }
 async function pipeExec(repos, target) {
@@ -1880,17 +2109,18 @@ async function fetchOrgProfile(org, options = {}) {
   if (orgPayload.public_repos > 0) {
     const perPage = Math.min(limit, 100);
     const maxPages = Math.ceil(limit / perPage);
-    for (let page = 1; page <= maxPages; page++) {
-      const url = `https://api.github.com/orgs/${encodeURIComponent(name)}/repos?per_page=${perPage}&sort=pushed&page=${page}`;
-      const res = await fetch(url, { headers: apiHeaders(token) });
-      if (!res.ok) {
-        break;
-      }
-      const items = await res.json();
-      if (!Array.isArray(items)) break;
-      repos.push(...items);
-      if (repos.length >= limit || items.length < perPage) break;
-    }
+    const pages = await Promise.all(
+      Array.from({ length: maxPages }, (_, i) => i + 1).map(async (page) => {
+        const url = `https://api.github.com/orgs/${encodeURIComponent(name)}/repos?per_page=${perPage}&sort=pushed&page=${page}`;
+        const res = await fetch(url, { headers: apiHeaders(token) });
+        if (!res.ok) {
+          return [];
+        }
+        const items = await res.json();
+        return Array.isArray(items) ? items : [];
+      })
+    );
+    repos.push(...pages.flat());
   }
   return normalizeOrg(orgPayload, repos.slice(0, limit));
 }
@@ -2094,17 +2324,18 @@ async function fetchUserProfile(user, options = {}) {
   if (userPayload.public_repos > 0) {
     const perPage = Math.min(limit, 100);
     const maxPages = Math.ceil(limit / perPage);
-    for (let page = 1; page <= maxPages; page++) {
-      const url = `https://api.github.com/users/${encodeURIComponent(name)}/repos?per_page=${perPage}&sort=pushed&page=${page}`;
-      const res = await fetch(url, { headers: apiHeaders2(token) });
-      if (!res.ok) {
-        break;
-      }
-      const items = await res.json();
-      if (!Array.isArray(items)) break;
-      repos.push(...items);
-      if (repos.length >= limit || items.length < perPage) break;
-    }
+    const pages = await Promise.all(
+      Array.from({ length: maxPages }, (_, i) => i + 1).map(async (page) => {
+        const url = `https://api.github.com/users/${encodeURIComponent(name)}/repos?per_page=${perPage}&sort=pushed&page=${page}`;
+        const res = await fetch(url, { headers: apiHeaders2(token) });
+        if (!res.ok) {
+          return [];
+        }
+        const items = await res.json();
+        return Array.isArray(items) ? items : [];
+      })
+    );
+    repos.push(...pages.flat());
   }
   return normalizeUser(userPayload, repos.slice(0, limit));
 }
@@ -2220,34 +2451,48 @@ function formatUserMarkdown(p) {
 
 // src/storage.ts
 import {
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync3,
-  writeFileSync as writeFileSync2,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync3,
   appendFileSync,
-  unlinkSync
+  unlinkSync,
+  renameSync
 } from "fs";
-import { join as join3 } from "path";
+import { join as join5 } from "path";
 function ensureDir() {
-  mkdirSync2(stateDir(), { recursive: true });
+  mkdirSync3(stateDir(), { recursive: true });
 }
 function readJSON(filename, fallback) {
   ensureDir();
   try {
-    return JSON.parse(readFileSync3(join3(stateDir(), filename), "utf-8"));
+    return JSON.parse(readFileSync5(join5(stateDir(), filename), "utf-8"));
   } catch {
     return fallback;
   }
 }
-function writeJSON(filename, data) {
+function writeFileAtomic(filename, data) {
   ensureDir();
-  writeFileSync2(join3(stateDir(), filename), JSON.stringify(data, null, 2));
+  const target = join5(stateDir(), filename);
+  const tmp = `${target}.tmp-${process.pid}`;
+  try {
+    writeFileSync3(tmp, data, "utf-8");
+    renameSync(tmp, target);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw e;
+  }
+}
+function writeJSON(filename, data) {
+  writeFileAtomic(filename, JSON.stringify(data, null, 2));
 }
 function appendJSONL(filename, obj) {
   ensureDir();
   try {
     appendFileSync(
-      join3(stateDir(), filename),
+      join5(stateDir(), filename),
       `${JSON.stringify(obj)}
 `,
       "utf-8"
@@ -2258,7 +2503,7 @@ function appendJSONL(filename, obj) {
 function readJSONL(filename) {
   ensureDir();
   try {
-    const raw = readFileSync3(join3(stateDir(), filename), "utf-8").trim();
+    const raw = readFileSync5(join5(stateDir(), filename), "utf-8").trim();
     if (!raw) return [];
     return raw.split("\n").filter(Boolean).map((l) => JSON.parse(l));
   } catch {
@@ -2266,14 +2511,13 @@ function readJSONL(filename) {
   }
 }
 function writeRaw(filename, data) {
-  ensureDir();
-  writeFileSync2(join3(stateDir(), filename), data);
+  writeFileAtomic(filename, data);
 }
 function debugLog(msg) {
   if (!process.env.DEBUG) return;
   try {
     appendFileSync(
-      join3(stateDir(), "ghfind-debug.log"),
+      join5(stateDir(), "ghfind-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}
 `,
       "utf-8"
@@ -2330,9 +2574,12 @@ function markSeen(fullName) {
 // src/notifications.ts
 var nextId = 1;
 var notifs = [];
+var loaded = false;
 var MAX_NOTIFS = 50;
 var FILE = "notifications.json";
-function load() {
+function ensureLoaded() {
+  if (loaded) return;
+  loaded = true;
   notifs = readJSON(FILE, []);
   nextId = Math.max(...notifs.map((n) => n.id), 0) + 1;
 }
@@ -2340,7 +2587,7 @@ function save() {
   writeJSON(FILE, notifs);
 }
 function addNotification(type, message) {
-  if (notifs.length === 0) load();
+  ensureLoaded();
   const n = {
     id: nextId++,
     type,
@@ -2370,14 +2617,16 @@ function iconFor(type) {
   }
 }
 function getNotifications() {
-  if (notifs.length === 0) load();
+  ensureLoaded();
   return [...notifs];
 }
 function dismissNotification(id) {
+  ensureLoaded();
   notifs = notifs.filter((n) => n.id !== id);
   save();
 }
 function dismissAll() {
+  ensureLoaded();
   notifs = [];
   save();
 }
@@ -2385,6 +2634,7 @@ function dismissAll() {
 // src/releases.ts
 var RELEASES_FILE = "release-cache.json";
 var PER_REPO = 5;
+var CONCURRENCY = 6;
 function loadCache() {
   return readJSON(RELEASES_FILE, {});
 }
@@ -2424,43 +2674,31 @@ async function checkReleases(opts = {}) {
   const config = loadConfig();
   const token = opts.token ?? config.githubToken ?? process.env.GITHUB_TOKEN;
   const results2 = [];
-  for (const bm of bookmarks) {
+  const checkOne = async (fullName) => {
     try {
-      const prev = cache2[bm.repo.fullName];
-      const lastSeen = getLastSeen(bm.repo.fullName);
+      const prev = cache2[fullName];
+      const lastSeen = getLastSeen(fullName);
       const isNew = (r) => !r.publishedAt || new Date(r.publishedAt).getTime() > lastSeen;
       const { status, etag, releases } = await fetchReleases(
-        bm.repo.fullName,
+        fullName,
         prev?.etag,
         token
       );
       if (status === 304 && prev) {
-        results2.push({
-          fullName: bm.repo.fullName,
-          newReleases: prev.releases.filter(isNew)
-        });
-        continue;
+        return { fullName, newReleases: prev.releases.filter(isNew) };
       }
       if (status !== 200 || !releases) {
-        results2.push({
-          fullName: bm.repo.fullName,
-          newReleases: [],
-          error: `HTTP ${status}`
-        });
-        continue;
+        return { fullName, newReleases: [], error: `HTTP ${status}` };
       }
-      cache2[bm.repo.fullName] = { checkedAt: Date.now(), etag, releases };
-      results2.push({
-        fullName: bm.repo.fullName,
-        newReleases: releases.filter(isNew)
-      });
+      cache2[fullName] = { checkedAt: Date.now(), etag, releases };
+      return { fullName, newReleases: releases.filter(isNew) };
     } catch (err) {
-      results2.push({
-        fullName: bm.repo.fullName,
-        newReleases: [],
-        error: err.message
-      });
+      return { fullName, newReleases: [], error: err.message };
     }
+  };
+  for (let i = 0; i < bookmarks.length; i += CONCURRENCY) {
+    const batch = bookmarks.slice(i, i + CONCURRENCY).map((bm) => checkOne(bm.repo.fullName));
+    results2.push(...await Promise.all(batch));
   }
   saveCache(cache2);
   return results2;
@@ -2480,141 +2718,14 @@ async function checkAndNotify(opts = {}) {
 }
 function allCachedReleases() {
   const cache2 = loadCache();
-  const bookmarks = getBookmarks();
-  return Object.entries(cache2).filter(([fullName]) => bookmarks.some((b) => b.repo.fullName === fullName)).flatMap(([fullName, s]) => s.releases.map((r) => ({ ...r, fullName }))).sort(
+  const bookmarked = new Set(getBookmarks().map((b) => b.repo.fullName));
+  return Object.entries(cache2).filter(([fullName]) => bookmarked.has(fullName)).flatMap(([fullName, s]) => s.releases.map((r) => ({ ...r, fullName }))).sort(
     (a, b) => new Date(b.publishedAt).getTime() - new Date(a.publishedAt).getTime()
   );
 }
 
 // src/init.ts
 import { createInterface as createInterface2 } from "readline";
-
-// src/login.ts
-import { createInterface } from "readline";
-import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
-var TOKEN_PREFIXES = ["ghp_", "gho_", "github_pat_"];
-function isLikelyGithubToken(token) {
-  return TOKEN_PREFIXES.some((prefix) => token.startsWith(prefix));
-}
-function maskToken(token) {
-  if (token.length <= 11) return `${token.slice(0, 4)}\u2026`;
-  return `${token.slice(0, 7)}\u2026${token.slice(-4)}`;
-}
-function ghCliConfigDir() {
-  return process.env.GH_CONFIG_DIR || join4(homedir2(), ".config", "gh");
-}
-function parseHostsYmlToken(text, host = "github.com") {
-  let inHost = false;
-  for (const line of text.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (/^[A-Za-z0-9.-]+:\s*$/.test(trimmed)) {
-      inHost = trimmed.slice(0, -1).trim() === host;
-      continue;
-    }
-    if (inHost) {
-      const match = trimmed.match(/^oauth_token:\s*["']?([^"'\s]+)/);
-      if (match) return match[1];
-    }
-  }
-  return void 0;
-}
-function readGhCliToken(ghDir = ghCliConfigDir(), host = process.env.GH_HOST ?? "github.com") {
-  const hostsFile = join4(ghDir, "hosts.yml");
-  if (!existsSync3(hostsFile)) return void 0;
-  try {
-    return parseHostsYmlToken(readFileSync4(hostsFile, "utf-8"), host);
-  } catch {
-    return void 0;
-  }
-}
-function persistToken(token, deps) {
-  const config = deps.readConfig();
-  config.githubToken = token;
-  deps.writeConfig(config);
-}
-function createAsk() {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return (query) => new Promise((resolve) => {
-    rl.question(query, (answer) => {
-      rl.close();
-      resolve(answer.trim());
-    });
-  });
-}
-function defaultLoginDeps() {
-  return {
-    ask: createAsk(),
-    readGhCliToken: () => readGhCliToken(),
-    readConfig: loadConfig,
-    writeConfig: (config) => saveConfig(config)
-  };
-}
-function successNote() {
-  return [
-    "  Authentication raises the search rate limit from 60 to",
-    "  5,000 requests/hour. Remove the token anytime by editing",
-    `  ${configPath()} \u2014 delete the "githubToken" line and save.`
-  ];
-}
-async function runLoginWizard(deps = defaultLoginDeps()) {
-  const { ask: ask2 } = deps;
-  console.log("");
-  console.log("  ghfind login");
-  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  console.log("");
-  if (process.env.GITHUB_TOKEN) {
-    console.log(
-      "  \u2139 GITHUB_TOKEN is set in the environment and already takes precedence."
-    );
-    console.log("");
-  }
-  const current = deps.readConfig();
-  if (current.githubToken) {
-    console.log(
-      `  \u2713 A token is already saved: ${maskToken(current.githubToken)}`
-    );
-  }
-  const ghToken = deps.readGhCliToken();
-  if (ghToken) {
-    console.log("  \u2713 Found a token managed by the GitHub CLI (gh).");
-    const answer = await ask2("  Import it into ghfind? [Y/n]: ");
-    if (answer.toLowerCase() !== "n") {
-      persistToken(ghToken, deps);
-      finishLogin(ghToken);
-      return;
-    }
-  }
-  const pasted = await ask2("  Paste a GitHub token (Enter to skip): ");
-  if (!pasted) {
-    console.log("  Skipped \u2014 no token saved.");
-    console.log("");
-    return;
-  }
-  if (!isLikelyGithubToken(pasted)) {
-    console.log(
-      `  \u26A0 That doesn't look like a GitHub token (expected one of: ${TOKEN_PREFIXES.join(", ")}).`
-    );
-    const confirm = await ask2("  Save it anyway? [y/N]: ");
-    if (confirm.toLowerCase() !== "y") {
-      console.log("  Cancelled \u2014 nothing saved.");
-      console.log("");
-      return;
-    }
-  }
-  persistToken(pasted, deps);
-  finishLogin(pasted);
-}
-function finishLogin(token) {
-  console.log(`  \u2713 Token saved to ${configPath()}`);
-  console.log(`    (masked: ${maskToken(token)})`);
-  console.log("");
-  for (const line of successNote()) console.log(line);
-  console.log("");
-}
-
-// src/init.ts
 function ask(query) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
@@ -2650,8 +2761,7 @@ async function runInitWizard() {
   };
   if (token) config.githubToken = token;
   saveConfig(config);
-  const { configPath: configPath2 } = await import("./config-OCIPF2IF.js");
-  console.log(`  \u2713 Config saved to ${configPath2()}`);
+  console.log(`  \u2713 Config saved to ${configPath()}`);
   console.log("  Run 'ghfind' to start browsing!");
   console.log("");
 }
@@ -2755,6 +2865,203 @@ function comparisonMarkdown(repos) {
   return [header, sep, ...rows].join("\n");
 }
 
+// src/image-loader.ts
+var MAX_IMAGE_BYTES = 6 * 1024 * 1024;
+var BADGE_HOST = /(^|\.)(shields\.io|badgen\.net|badge\.fury\.io|codecov\.io|coveralls\.io|travis-ci\.(org|com)|snyk\.io|sonarcloud\.io|david-dm\.(org|io))$/i;
+var RAW_HOSTS = /* @__PURE__ */ new Set([
+  "raw.githubusercontent.com",
+  "camo.githubusercontent.com",
+  "user-images.githubusercontent.com",
+  "private-user-images.githubusercontent.com",
+  "avatars.githubusercontent.com",
+  "objects.githubusercontent.com"
+]);
+var RASTER_EXT = /\.(png|jpe?g|webp|gif|bmp|avif|heic|tiff?)(?:[?#]|$)/i;
+var CACHE_LIMIT = 24;
+var MAX_CONCURRENT_IMAGE_FETCHES = 4;
+var cache = /* @__PURE__ */ new Map();
+var activeFetches = 0;
+var waiting = [];
+function releaseSlot() {
+  activeFetches--;
+  waiting.shift()?.();
+}
+async function withSlot(job) {
+  if (activeFetches >= MAX_CONCURRENT_IMAGE_FETCHES) {
+    await new Promise((resolve) => waiting.push(resolve));
+  }
+  activeFetches++;
+  try {
+    return await job();
+  } finally {
+    releaseSlot();
+  }
+}
+function decodeDataUri(uri) {
+  const match = /^data:([^;,]+)?(;base64)?,(.*)$/is.exec(uri);
+  if (!match) return null;
+  const mime = (match[1] ?? "").toLowerCase();
+  if (mime.includes("svg")) return null;
+  const payload = match[3];
+  try {
+    if (match[2]) return new Uint8Array(Buffer.from(payload, "base64"));
+    return new Uint8Array(Buffer.from(decodeURIComponent(payload), "binary"));
+  } catch {
+    return null;
+  }
+}
+function toRawGitHubUrl(url) {
+  if (url.hostname.toLowerCase() !== "github.com") return url;
+  const match = /^\/([^/]+)\/([^/]+)\/(?:blob|raw)\/(.+)$/.exec(url.pathname);
+  if (!match) return url;
+  const [, owner, repo, rest] = match;
+  return new URL(
+    `https://raw.githubusercontent.com/${owner}/${repo}/${rest}${url.search}`
+  );
+}
+function resolveRootRelative(path, base) {
+  let parsed;
+  try {
+    parsed = new URL(base);
+  } catch {
+    return null;
+  }
+  if (parsed.hostname.toLowerCase() !== "raw.githubusercontent.com") {
+    return null;
+  }
+  const segments = parsed.pathname.split("/").filter(Boolean);
+  if (segments.length < 3) return null;
+  return new URL(`${parsed.origin}/${segments.slice(0, 3).join("/")}${path}`);
+}
+function resolveReadmeImageUrl(raw, base) {
+  const cleaned = raw.trim();
+  if (!cleaned) return null;
+  if (/^data:/i.test(cleaned)) {
+    return isRenderableImageUrl(cleaned) ? cleaned : null;
+  }
+  let url = null;
+  try {
+    url = cleaned.startsWith("/") ? resolveRootRelative(cleaned, base) : new URL(cleaned, base);
+  } catch {
+    return null;
+  }
+  if (!url) return null;
+  url = toRawGitHubUrl(url);
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  url.hash = "";
+  const resolved = url.toString();
+  return isRenderableImageUrl(resolved) ? resolved : null;
+}
+function isRenderableImageUrl(url) {
+  if (/^data:/i.test(url)) return !/svg/i.test(url.slice(0, 64));
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+  if (BADGE_HOST.test(parsed.hostname)) return false;
+  const path = parsed.pathname.toLowerCase();
+  if (path.endsWith(".svg") || path.endsWith(".svgz")) return false;
+  if (parsed.hostname.toLowerCase().endsWith("github.com")) {
+    if (/^\/user-attachments\//.test(path)) return true;
+    if (!RAW_HOSTS.has(parsed.hostname)) {
+      return /\.(png|jpe?g|webp|gif|bmp|avif|heic|tiff?)$/i.test(path);
+    }
+  }
+  if (/\.[a-z0-9]{1,5}$/.test(path) && !RASTER_EXT.test(path)) return false;
+  return true;
+}
+function isGitHubHost(hostname) {
+  return /(^|\.)githubusercontent\.com$|(^|\.)github\.com$/i.test(hostname);
+}
+async function fetchImageBytes(url, opts = {}) {
+  const cached2 = cache.get(url);
+  if (cached2) return cached2;
+  const pending = withSlot(() => loadImageBytes(url, opts));
+  cache.set(url, pending);
+  while (cache.size > CACHE_LIMIT) {
+    const oldest = cache.keys().next().value;
+    if (oldest === void 0) break;
+    cache.delete(oldest);
+  }
+  return pending;
+}
+async function loadImageBytes(url, opts) {
+  if (/^data:/i.test(url)) return decodeDataUri(url);
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const timeoutMs = opts.timeoutMs ?? 1e4;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const headers = {
+      "User-Agent": "ghfind/1.0",
+      Accept: "image/*,*/*;q=0.5"
+    };
+    let host = "";
+    try {
+      host = new URL(url).hostname;
+    } catch {
+      return null;
+    }
+    if (opts.token && isGitHubHost(host)) {
+      headers.Authorization = `Bearer ${opts.token}`;
+    }
+    const res = await fetchImpl(url, { headers, signal: controller.signal });
+    if (!res.ok) return null;
+    const contentType = res.headers.get("content-type") ?? "";
+    if (contentType && !/^image\//i.test(contentType)) {
+      const githubHost = isGitHubHost(host);
+      if (!githubHost || !/octet-stream/i.test(contentType)) return null;
+    }
+    if (/svg/i.test(contentType)) return null;
+    const declared = Number(res.headers.get("content-length") ?? "0");
+    if (declared > MAX_IMAGE_BYTES) return null;
+    const buffer = new Uint8Array(await res.arrayBuffer());
+    if (buffer.byteLength === 0 || buffer.byteLength > MAX_IMAGE_BYTES) {
+      return null;
+    }
+    return buffer;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function readmeBaseUrl(owner, repo, branch, path = "README.md") {
+  return `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${path}`;
+}
+
+// src/readme.ts
+var CANDIDATES = [
+  ["main", "README.md"],
+  ["master", "README.md"],
+  ["main", "README.rst"]
+];
+function buildReadmeHeaders(url, token, isPrivate = false) {
+  const headers = { "User-Agent": "ghfind/1.0" };
+  if (token && isPrivate && new URL(url).origin === "https://api.github.com") {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  return headers;
+}
+async function fetchReadme(owner, repo, opts = {}) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const attempts = CANDIDATES.map(async ([branch, file]) => {
+    const url = readmeBaseUrl(owner, repo, branch, file);
+    const headers = buildReadmeHeaders(url, opts.token, opts.private);
+    const res = await fetchImpl(url, { headers });
+    if (!res.ok) throw new Error(`no readme at ${url}`);
+    return { text: await res.text(), sourceUrl: url };
+  });
+  try {
+    return await Promise.any(attempts);
+  } catch {
+    return null;
+  }
+}
+
 // src/deepdive.ts
 var USER_AGENT = "ghfind/1.0";
 function buildHeaders(token) {
@@ -2799,42 +3106,46 @@ function repoFromRef(fullName) {
 async function resolveRepoFromRef(fullName, token) {
   const ref = parseRepoRef(fullName);
   const canonical = `${ref.owner}/${ref.name}`;
+  let res;
   try {
-    const res = await fetch(`https://api.github.com/repos/${canonical}`, {
+    res = await fetch(`https://api.github.com/repos/${canonical}`, {
       headers: buildHeaders(token)
     });
-    if (res.status === 404) {
-      throw new Error(`Repo not found: ${canonical}`);
-    }
-    if (res.ok) {
-      const api = await res.json();
-      return {
-        id: 0,
-        fullName: canonical,
-        name: ref.name,
-        owner: ref.owner,
-        description: api.description,
-        url: api.html_url,
-        stars: api.stargazers_count ?? 0,
-        forks: api.forks_count ?? 0,
-        watchers: api.subscribers_count ?? 0,
-        language: api.language,
-        topics: api.topics ?? [],
-        archived: api.archived ?? false,
-        isFork: api.fork ?? false,
-        private: false,
-        createdAt: api.created_at ?? "",
-        updatedAt: api.updated_at ?? "",
-        pushedAt: api.pushed_at ?? "",
-        score: 0
-      };
-    }
-  } catch (err) {
-    if (err instanceof Error && err.message.startsWith("Repo not found")) {
-      throw err;
-    }
+  } catch {
+    return repoFromRef(canonical);
+  }
+  if (res.status === 404) {
+    throw new Error(`Repo not found: ${canonical}`);
+  }
+  if (!res.ok) {
+    throw new Error(`GitHub API error ${res.status} for ${canonical}`);
+  }
+  let api;
+  try {
+    api = await res.json();
+  } catch {
+    return repoFromRef(canonical);
   }
-  return repoFromRef(canonical);
+  return {
+    id: 0,
+    fullName: canonical,
+    name: ref.name,
+    owner: ref.owner,
+    description: api.description,
+    url: api.html_url,
+    stars: api.stargazers_count ?? 0,
+    forks: api.forks_count ?? 0,
+    watchers: api.subscribers_count ?? 0,
+    language: api.language,
+    topics: api.topics ?? [],
+    archived: api.archived ?? false,
+    isFork: api.fork ?? false,
+    private: api.private ?? false,
+    createdAt: api.created_at ?? "",
+    updatedAt: api.updated_at ?? "",
+    pushedAt: api.pushed_at ?? "",
+    score: 0
+  };
 }
 var README_MAX_CHARS = 5e3;
 async function fetchDeepDiveRaw(repo, token) {
@@ -2848,20 +3159,11 @@ async function fetchDeepDiveRaw(repo, token) {
       { headers }
     )
   ]);
-  let readmeText = "";
-  for (const path of [
-    `${repo.owner}/${repo.name}/main/README.md`,
-    `${repo.owner}/${repo.name}/master/README.md`,
-    `${repo.owner}/${repo.name}/main/README.rst`
-  ]) {
-    const r = await fetch(`https://raw.githubusercontent.com/${path}`, {
-      headers
-    });
-    if (r.ok) {
-      readmeText = await r.text();
-      break;
-    }
-  }
+  const readme = await fetchReadme(repo.owner, repo.name, {
+    token: repo.private ? token : void 0,
+    private: repo.private
+  });
+  const readmeText = readme?.text ?? "";
   const langEntries = languagesRes.ok ? Object.entries(
     await languagesRes.json().catch(() => ({}))
   ) : [];
@@ -2952,8 +3254,8 @@ function buildDeepDiveText(data) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join7, dirname as dirname4 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join8, dirname as dirname4 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/tui.ts
@@ -3176,13 +3478,10 @@ function readHistory() {
 function deleteHistoryEntry(index) {
   const entries = readHistory();
   if (index < 0 || index >= entries.length) return;
-  const removed = entries[index];
-  const remaining = entries.filter(
-    (e) => e.timestamp !== removed.timestamp || e.query !== removed.query
-  );
+  entries.splice(index, 1);
   writeRaw(
     HISTORY_FILE,
-    `${remaining.reverse().map((e) => JSON.stringify(e)).join("\n")}
+    `${entries.reverse().map((e) => JSON.stringify(e)).join("\n")}
 `
   );
 }
@@ -3570,174 +3869,6 @@ async function rasterizeImage(bytes, opts) {
   }
 }
 
-// src/image-loader.ts
-var MAX_IMAGE_BYTES = 6 * 1024 * 1024;
-var BADGE_HOST = /(^|\.)(shields\.io|badgen\.net|badge\.fury\.io|codecov\.io|coveralls\.io|travis-ci\.(org|com)|snyk\.io|sonarcloud\.io|david-dm\.(org|io))$/i;
-var RAW_HOSTS = /* @__PURE__ */ new Set([
-  "raw.githubusercontent.com",
-  "camo.githubusercontent.com",
-  "user-images.githubusercontent.com",
-  "private-user-images.githubusercontent.com",
-  "avatars.githubusercontent.com",
-  "objects.githubusercontent.com"
-]);
-var RASTER_EXT = /\.(png|jpe?g|webp|gif|bmp|avif|heic|tiff?)(?:[?#]|$)/i;
-var CACHE_LIMIT = 24;
-var MAX_CONCURRENT_IMAGE_FETCHES = 4;
-var cache = /* @__PURE__ */ new Map();
-var activeFetches = 0;
-var waiting = [];
-function releaseSlot() {
-  activeFetches--;
-  waiting.shift()?.();
-}
-async function withSlot(job) {
-  if (activeFetches >= MAX_CONCURRENT_IMAGE_FETCHES) {
-    await new Promise((resolve) => waiting.push(resolve));
-  }
-  activeFetches++;
-  try {
-    return await job();
-  } finally {
-    releaseSlot();
-  }
-}
-function decodeDataUri(uri) {
-  const match = /^data:([^;,]+)?(;base64)?,(.*)$/is.exec(uri);
-  if (!match) return null;
-  const mime = (match[1] ?? "").toLowerCase();
-  if (mime.includes("svg")) return null;
-  const payload = match[3];
-  try {
-    if (match[2]) return new Uint8Array(Buffer.from(payload, "base64"));
-    return new Uint8Array(Buffer.from(decodeURIComponent(payload), "binary"));
-  } catch {
-    return null;
-  }
-}
-function toRawGitHubUrl(url) {
-  if (url.hostname.toLowerCase() !== "github.com") return url;
-  const match = /^\/([^/]+)\/([^/]+)\/(?:blob|raw)\/(.+)$/.exec(url.pathname);
-  if (!match) return url;
-  const [, owner, repo, rest] = match;
-  return new URL(
-    `https://raw.githubusercontent.com/${owner}/${repo}/${rest}${url.search}`
-  );
-}
-function resolveRootRelative(path, base) {
-  let parsed;
-  try {
-    parsed = new URL(base);
-  } catch {
-    return null;
-  }
-  if (parsed.hostname.toLowerCase() !== "raw.githubusercontent.com") {
-    return null;
-  }
-  const segments = parsed.pathname.split("/").filter(Boolean);
-  if (segments.length < 3) return null;
-  return new URL(`${parsed.origin}/${segments.slice(0, 3).join("/")}${path}`);
-}
-function resolveReadmeImageUrl(raw, base) {
-  const cleaned = raw.trim();
-  if (!cleaned) return null;
-  if (/^data:/i.test(cleaned)) {
-    return isRenderableImageUrl(cleaned) ? cleaned : null;
-  }
-  let url = null;
-  try {
-    url = cleaned.startsWith("/") ? resolveRootRelative(cleaned, base) : new URL(cleaned, base);
-  } catch {
-    return null;
-  }
-  if (!url) return null;
-  url = toRawGitHubUrl(url);
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  url.hash = "";
-  const resolved = url.toString();
-  return isRenderableImageUrl(resolved) ? resolved : null;
-}
-function isRenderableImageUrl(url) {
-  if (/^data:/i.test(url)) return !/svg/i.test(url.slice(0, 64));
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return false;
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
-  if (BADGE_HOST.test(parsed.hostname)) return false;
-  const path = parsed.pathname.toLowerCase();
-  if (path.endsWith(".svg") || path.endsWith(".svgz")) return false;
-  if (parsed.hostname.toLowerCase().endsWith("github.com")) {
-    if (/^\/user-attachments\//.test(path)) return true;
-    if (!RAW_HOSTS.has(parsed.hostname)) {
-      return /\.(png|jpe?g|webp|gif|bmp|avif|heic|tiff?)$/i.test(path);
-    }
-  }
-  if (/\.[a-z0-9]{1,5}$/.test(path) && !RASTER_EXT.test(path)) return false;
-  return true;
-}
-function isGitHubHost(hostname) {
-  return /(^|\.)githubusercontent\.com$|(^|\.)github\.com$/i.test(hostname);
-}
-async function fetchImageBytes(url, opts = {}) {
-  const cached2 = cache.get(url);
-  if (cached2) return cached2;
-  const pending = withSlot(() => loadImageBytes(url, opts));
-  cache.set(url, pending);
-  while (cache.size > CACHE_LIMIT) {
-    const oldest = cache.keys().next().value;
-    if (oldest === void 0) break;
-    cache.delete(oldest);
-  }
-  return pending;
-}
-async function loadImageBytes(url, opts) {
-  if (/^data:/i.test(url)) return decodeDataUri(url);
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const timeoutMs = opts.timeoutMs ?? 1e4;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const headers = {
-      "User-Agent": "ghfind/1.0",
-      Accept: "image/*,*/*;q=0.5"
-    };
-    let host = "";
-    try {
-      host = new URL(url).hostname;
-    } catch {
-      return null;
-    }
-    if (opts.token && isGitHubHost(host)) {
-      headers.Authorization = `Bearer ${opts.token}`;
-    }
-    const res = await fetchImpl(url, { headers, signal: controller.signal });
-    if (!res.ok) return null;
-    const contentType = res.headers.get("content-type") ?? "";
-    if (contentType && !/^image\//i.test(contentType)) {
-      const githubHost = isGitHubHost(host);
-      if (!githubHost || !/octet-stream/i.test(contentType)) return null;
-    }
-    if (/svg/i.test(contentType)) return null;
-    const declared = Number(res.headers.get("content-length") ?? "0");
-    if (declared > MAX_IMAGE_BYTES) return null;
-    const buffer = new Uint8Array(await res.arrayBuffer());
-    if (buffer.byteLength === 0 || buffer.byteLength > MAX_IMAGE_BYTES) {
-      return null;
-    }
-    return buffer;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function readmeBaseUrl(owner, repo, branch, path = "README.md") {
-  return `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${path}`;
-}
-
 // src/markdown-images.ts
 var IMG_TAG = /<img\b[^>]*?src\s*=\s*["']([^"']+)["'][^>]*>/gi;
 var ALT_ATTR = /\balt\s*=\s*["']([^"']*)["']/i;
@@ -4017,29 +4148,6 @@ function createMarkdownView(opts) {
   };
 }
 
-// src/readme.ts
-var CANDIDATES = [
-  ["main", "README.md"],
-  ["master", "README.md"],
-  ["main", "README.rst"]
-];
-async function fetchReadme(owner, repo, opts = {}) {
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const headers = { "User-Agent": "ghfind/1.0" };
-  if (opts.token) headers.Authorization = `Bearer ${opts.token}`;
-  const attempts = CANDIDATES.map(async ([branch, file]) => {
-    const url = readmeBaseUrl(owner, repo, branch, file);
-    const res = await fetchImpl(url, { headers });
-    if (!res.ok) throw new Error(`no readme at ${url}`);
-    return { text: await res.text(), sourceUrl: url };
-  });
-  try {
-    return await Promise.any(attempts);
-  } catch {
-    return null;
-  }
-}
-
 // src/explore.ts
 async function fetchTopics() {
   const res = await fetch(
@@ -4189,23 +4297,23 @@ function nextTip() {
 }
 
 // src/update-check.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join5, dirname as dirname3, posix } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join6, dirname as dirname3, posix } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var REGISTRY_URL = "https://registry.npmjs.org/github-search-cli/latest";
 var PKG_NAME2 = "github-search-cli";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var REQUEST_TIMEOUT_MS = 5e3;
 var __dirname2 = dirname3(fileURLToPath3(import.meta.url));
-var PKG_DIR2 = join5(__dirname2, "..");
+var PKG_DIR2 = join6(__dirname2, "..");
 var STATE_FILE = "update-state.json";
-var DEFAULTS = {
+var DEFAULTS2 = {
   lastCheck: 0,
   snoozeUntil: 0,
   suppressed: false
 };
 function readUpdateState() {
-  return { ...DEFAULTS, ...readJSON(STATE_FILE, {}) };
+  return { ...DEFAULTS2, ...readJSON(STATE_FILE, {}) };
 }
 function writeUpdateState(state) {
   writeJSON(STATE_FILE, state);
@@ -4338,14 +4446,14 @@ function recordPreUpdateState(currentVersion) {
 }
 function fetchReleaseNotes(version) {
   try {
-    const notesPath = join5(PKG_DIR2, "release-notes", `${version}.md`);
-    const md = readFileSync5(notesPath, "utf-8");
+    const notesPath = join6(PKG_DIR2, "release-notes", `${version}.md`);
+    const md = readFileSync6(notesPath, "utf-8");
     if (md.trim().length > 0) return md;
   } catch {
   }
   try {
-    const changelogPath = join5(PKG_DIR2, "CHANGELOG.md");
-    const changelog = readFileSync5(changelogPath, "utf-8");
+    const changelogPath = join6(PKG_DIR2, "CHANGELOG.md");
+    const changelog = readFileSync6(changelogPath, "utf-8");
     const header = `## [${version}]`;
     const start = changelog.indexOf(header);
     if (start === -1) return null;
@@ -5942,7 +6050,8 @@ async function launchBrowser(theme_override) {
     showOverlay("readme");
     try {
       const readme = await fetchReadme(repo.owner, repo.name, {
-        token: githubToken
+        token: githubToken,
+        private: repo.private
       });
       if (readme) {
         readmeView.setContent(readme.text, readme.sourceUrl);
@@ -6374,10 +6483,12 @@ async function launchBrowser(theme_override) {
         }
       }
     } catch (err) {
-      currentRepos = [];
-      resultsSelect.options = [
-        { name: " (error)", description: "", value: null }
-      ];
+      if (!append) {
+        currentRepos = [];
+        resultsSelect.options = [
+          { name: " (error)", description: "", value: null }
+        ];
+      }
       const msg = err instanceof SearchCliError ? err.userMessage : err instanceof Error ? err.message : String(err);
       statusMgr.set("error", msg.slice(0, 60));
     }
@@ -6895,16 +7006,11 @@ ${pack.description ?? ""}`;
   renderer.requestRender();
 }
 function formatResultLine(repo) {
-  const stars = formatStars(repo.stars);
+  const stars = `\u2605 ${fmtStars(repo.stars)}`;
   const lang = (repo.language ?? "?").padEnd(12).slice(0, 12);
   const name = repo.fullName.padEnd(40).slice(0, 40);
   return `${name}  ${lang}  ${stars}`;
 }
-function formatStars(n) {
-  if (n >= 1e6) return `\u2605 ${(n / 1e6).toFixed(1).replace(/\.0$/, "")}M`;
-  if (n >= 1e3) return `\u2605 ${(n / 1e3).toFixed(1).replace(/\.0$/, "")}k`;
-  return `\u2605 ${n}`;
-}
 function formatToolbar(sort, limit, totalCount) {
   const sortLabel = SORT_MODES.find((m) => m.key === sort)?.label ?? sort;
   return ` sort: ${sortLabel}   limit: ${limit}   results: ${totalCount.toLocaleString()}`;
@@ -7034,14 +7140,15 @@ function formatSkillCatalog() {
 }
 
 // src/skill-finder.ts
-import { readdirSync, readFileSync as readFileSync6 } from "fs";
-import { homedir as homedir3 } from "os";
-import { delimiter, join as join6 } from "path";
+import { readdirSync, readFileSync as readFileSync7 } from "fs";
+import { homedir as homedir4 } from "os";
+import { delimiter, join as join7 } from "path";
 var REGISTRY_SEARCH_ENDPOINT = "https://skills.sh/api/search";
 var MIN_QUERY_LENGTH = 2;
 var MAX_SKILL_RESULTS = 100;
+var SAFE_ID_RE = /^[A-Za-z0-9._/-]+$/;
 function displayPath(path) {
-  const home = homedir3();
+  const home = homedir4();
   const normalized = path.replace(/\\/g, "/");
   const homeNorm = home.replace(/\\/g, "/").replace(/\/$/, "");
   if (normalized === homeNorm) return "~";
@@ -7051,12 +7158,12 @@ function displayPath(path) {
   return normalized;
 }
 function defaultSkillRoots(cwd = process.cwd()) {
-  const home = homedir3();
+  const home = homedir4();
   return [
-    join6(home, ".codex", "skills"),
-    join6(home, ".agents", "skills"),
-    join6(cwd, ".codex", "skills"),
-    join6(cwd, ".github", "skills")
+    join7(home, ".codex", "skills"),
+    join7(home, ".agents", "skills"),
+    join7(cwd, ".codex", "skills"),
+    join7(cwd, ".github", "skills")
   ];
 }
 function resolveSkillRoots(cwd = process.cwd()) {
@@ -7098,16 +7205,20 @@ function parseSkillFrontmatter(text) {
   if (!name) return null;
   return { name, description: fields.description ?? "" };
 }
+var scanCache = /* @__PURE__ */ new Map();
 function scanLocalSkills(roots = resolveSkillRoots()) {
+  const key = roots.map((r) => `${r.path}\0${r.label}`).join("
");
+  const cached2 = scanCache.get(key);
+  if (cached2) return cached2;
   const byName = /* @__PURE__ */ new Map();
   for (const root of roots) {
     for (const dir of walkDirs(root.path)) {
       const entries = listDir(dir);
       if (!entries) continue;
       if (!entries.some((e) => e.isFile() && e.name === "SKILL.md")) continue;
-      const file = join6(dir, "SKILL.md");
+      const file = join7(dir, "SKILL.md");
       try {
-        const parsed = parseSkillFrontmatter(readFileSync6(file, "utf-8"));
+        const parsed = parseSkillFrontmatter(readFileSync7(file, "utf-8"));
         if (!parsed || byName.has(parsed.name)) continue;
         byName.set(parsed.name, {
           name: parsed.name,
@@ -7119,7 +7230,9 @@ function scanLocalSkills(roots = resolveSkillRoots()) {
       }
     }
   }
-  return [...byName.values()];
+  const hits = [...byName.values()];
+  scanCache.set(key, hits);
+  return hits;
 }
 function listDir(dir) {
   try {
@@ -7138,7 +7251,7 @@ function* walkDirs(root) {
     if (depth >= MAX_DEPTH) continue;
     for (const entry of entries) {
       if (!entry.isDirectory() || SKIP_DIRS.has(entry.name)) continue;
-      queue.push([join6(dir, entry.name), depth + 1]);
+      queue.push([join7(dir, entry.name), depth + 1]);
     }
   }
 }
@@ -7184,7 +7297,10 @@ function normalizeRegistrySkill(raw) {
   const obj = raw;
   const source = typeof obj.source === "string" ? obj.source : "";
   const skillId = typeof obj.skillId === "string" ? obj.skillId : "";
-  if (!source || !skillId) return null;
+  const hasTraversal = (s) => s === ".." || s.includes("..");
+  if (!SAFE_ID_RE.test(source) || !SAFE_ID_RE.test(skillId) || hasTraversal(source) || hasTraversal(skillId)) {
+    return null;
+  }
   const name = typeof obj.name === "string" && obj.name.trim() ? obj.name : skillId;
   const installs = typeof obj.installs === "number" ? obj.installs : 0;
   const id = typeof obj.id === "string" && obj.id ? obj.id : `${source}/${skillId}`;
@@ -7580,19 +7696,14 @@ var TOOLS = [
         throw new McpToolError("repos must contain 2-5 repo fullNames.");
       }
       const token = resolveToken(state, args.token);
-      const provider = createGitHubSearch(void 0, token ? [token] : []);
       const found = [];
       const missing = [];
       for (const fullName of names) {
-        const res = await provider.search(parseQuery(fullName), {
-          limit: 1,
-          sort: "stars",
-          json: false,
-          verbose: false,
-          token
-        });
-        if (res.repos.length > 0) found.push(res.repos[0]);
-        else missing.push(fullName);
+        try {
+          found.push(await resolveRepoFromRef(fullName, token));
+        } catch {
+          missing.push(fullName);
+        }
       }
       if (found.length < 2) {
         throw new McpToolError(
@@ -7895,7 +8006,16 @@ async function runMcpServer(options = {}) {
 // src/cli.ts
 process.env.GHFIND_CLI_RUN = "1";
 var __dirname3 = dirname4(fileURLToPath4(import.meta.url));
-var PKG_DIR3 = join7(__dirname3, "..");
+var PKG_DIR3 = join8(__dirname3, "..");
+var SORT_VALUES = [
+  "best-match",
+  "stars",
+  "updated",
+  "forks",
+  "score",
+  "downloads",
+  "name"
+];
 function parseArgs(args) {
   const flags = {
     query: "",
@@ -7994,9 +8114,17 @@ function parseArgs(args) {
         }
         break;
       }
-      case "--sort":
-        flags.sort = args[++i];
+      case "--sort": {
+        const sort = args[++i];
+        if (!sort || !SORT_VALUES.includes(sort)) {
+          console.error(
+            `Invalid sort: ${sort ?? "(missing)"} (use best-match|stars|updated|forks).`
+          );
+          process.exit(1);
+        }
+        flags.sort = sort;
         break;
+      }
       case "--token":
         flags.token = args[++i];
         break;
@@ -8209,8 +8337,8 @@ Options:
   if (flags.completion) {
     const shell = flags.completion;
     try {
-      const content = readFileSync7(
-        join7(PKG_DIR3, "completions", `ghfind.${shell}`),
+      const content = readFileSync8(
+        join8(PKG_DIR3, "completions", `ghfind.${shell}`),
         "utf-8"
       );
       console.log(content);
@@ -8524,10 +8652,11 @@ function rowsToCsv(header, rows) {
   return [header, ...rows].map((row) => row.map(quote).join(",")).join("\n");
 }
 function rowsToMarkdown(header, rows) {
+  const cell = (value) => value.replace(/\|/g, "\\|");
   return [
-    `| ${header.join(" | ")} |`,
+    `| ${header.map(cell).join(" | ")} |`,
     `|${header.map(() => "---").join("|")}|`,
-    ...rows.map((row) => `| ${row.join(" | ")} |`)
+    ...rows.map((row) => `| ${row.map(cell).join(" | ")} |`)
   ].join("\n");
 }
 function truncate2(text, width) {
@@ -8567,7 +8696,12 @@ async function runReadme(flags) {
   }
   try {
     const { owner, name } = repoFromRef(ref);
-    const readme = await fetchReadme(owner, name, { token: flags.token });
+    const readme = await fetchReadme(owner, name, {
+      // A bare ref carries no visibility info, so the token is never
+      // forwarded to raw.githubusercontent.com.
+      token: flags.token,
+      private: false
+    });
     if (!readme) {
       console.error(`No README found for ${owner}/${name}.`);
       process.exit(1);
@@ -8816,22 +8950,14 @@ async function runNonInteractive(flags, outputFormat) {
       }
     },
     compare: async (_ctx) => {
-      const search = createGitHubSearch(void 0, [flags.token ?? ""]);
       const repos = [];
       const missing = [];
       for (const fullName of flags.compare) {
-        const res = await search.search(
-          { keywords: [fullName], qualifiers: [], raw: fullName },
-          {
-            limit: 1,
-            sort: "stars",
-            json: false,
-            verbose: false,
-            token: flags.token
-          }
-        );
-        if (res.repos.length > 0) repos.push(...res.repos);
-        else missing.push(fullName);
+        try {
+          repos.push(await resolveRepoFromRef(fullName, flags.token));
+        } catch {
+          missing.push(fullName);
+        }
       }
       if (repos.length < 2) {
         console.error(
@@ -8858,10 +8984,8 @@ Not found: ${missing.join(", ")}` : "";
   await handlers[key](ctx);
 }
 main().catch((err) => {
-  if (err instanceof Error && err.name === "SearchCliError") {
-    console.error(
-      err instanceof SearchCliError ? err.userMessage : err.message
-    );
+  if (err instanceof SearchCliError) {
+    console.error(err.userMessage);
   } else {
     console.error(err instanceof Error ? err.message : String(err));
     reportError(err);