github-search-cli 9.8.1 → 9.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-search-cli",
-  "version": "9.8.1",
+  "version": "9.8.2",
   "description": "Search GitHub from your terminal — repo search, trending repos, npm package search, bookmarks, deep-dive, compare, export. Keyboard-driven TUI + pipeable CLI.",
   "type": "module",
   "packageManager": "bun@1",

package/release-notes/9.8.2.md

@@ -0,0 +1,65 @@
+# v9.8.2
+
+A maintenance release: twenty-three fixes from a full static audit of the
+codebase, most of them invisible until something went wrong. Nothing user-facing
+was added or removed — every flag, key and command behaves as it did in 9.8.1.
+
+## The one that mattered
+
+A GitHub token passed as `--token` could end up in a public URL. When ghfind
+crashed, it built a GitHub issue link straight from `process.argv` — argv
+included your token — and opened it in a browser. The docblock claimed the
+command line was redacted; it was not. Every field that reaches the issue now
+goes through redaction first, and when ghfind sees a credential it prints the
+URL for you to copy instead of opening a browser tab automatically.
+
+## Security, in full
+
+- Tokens are no longer sent to `raw.githubusercontent.com` when fetching a
+  README — only to `api.github.com`, and only for a private repository.
+- Skill sources and ids from the public skills.sh registry are validated before
+  they can reach a shell command or a URL, so a hostile registry entry cannot
+  smuggle `;`, `$(`, backticks or a path traversal into `npx skills add`.
+- The config file that stores your token is now written with `0600`
+  permissions. On Windows the file still inherits the directory ACL, so this
+  closes the hole on POSIX only.
+- `--doctor` masks the token rather than printing a raw prefix.
+
+## Reliability
+
+The most user-visible correctness fix: recoverable errors were treated as
+crashes. The top-level catch tested `err.name === "SearchCliError"`, a string
+that is never true, so a rate limit, a network blip or a layout change on
+GitHub's trending page all opened a browser tab asking you to file a bug. That
+branch now works, and those errors print a short explanation and exit.
+
+`--compare` and the `ghfind_compare_repos` MCP tool both resolved repository
+names through a free-text search with no `repo:` qualifier and never checked
+the `fullName` that came back, so `ghfind --compare oven/bun oven-sh/bun` could
+quietly compare the wrong two repositories. Both now resolve exactly.
+
+State files — bookmarks, history, sessions, saved searches, notifications —
+were written directly to their live path. A crash, a full disk, or a reader
+caught mid-write left a truncated JSON file, which the loader then silently
+replaced with defaults: your data was gone with no error. Writes are now atomic
+(temp file plus rename).
+
+## Smaller fixes
+
+Notification IDs restarted after "dismiss all"; `history --delete` removed
+every duplicate entry instead of one; an invalid `--sort` value degraded
+silently instead of erroring; a failed "load more" in the TUI wiped the results
+already on screen; `--markdown` did not escape `|` in cells while `--csv`
+did; the in-memory cache was not a real LRU; local skill scanning re-walked the
+filesystem on every keystroke; and skill ids containing `_` — common on GitHub
+— were wrongly rejected.
+
+## Verification
+
+482 tests, plus `typecheck`, `lint`, `format:check` and `build` all green.
+The security fixes were additionally verified with runnable probes that assert
+no token substring survives URL encoding in the generated crash-report URL, that
+none of twelve `raw.githubusercontent.com` requests carries an `Authorization`
+header, and that seven of eight hostile skill payloads are rejected.
+
+`README.md` test count updated to match the real suite.

package/scripts/brew.rb

@@ -1,53 +1,53 @@
-# typed: true
-# frozen_string_literal: true
-
-# Homebrew formula for ghfind.
-#
-# NOTE: this file is a template, kept in-tree for a future homebrew tap.
-# Before use:
-#   1. Replace VERSION with the released version tag.
-#   2. Fill SHA256 placeholders from the SHA256SUMS.txt asset attached to
-#      the GitHub Release (the release workflow generates it).
-#   3. Host it in a tap repo (e.g. codersdfs/tap) at Formula/ghfind.rb,
-#      then: brew install codersdfs/tap/ghfind
-# See marketing/README.md (Track B) for the rollout order.
-
-class Ghfind < Formula
-  desc "Search GitHub repos from your terminal — trending, bookmarks, deep-dive"
-  homepage "https://github.com/codersdfs/search-cli"
-  version "9.5.1"
-  license "MIT"
-
-  livecheck do
-    url :stable
-    regex(/^v?(\d+(?:\.\d+)+)$/i)
-  end
-
-  on_macos do
-    if Hardware::CPU.arm?
-      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-darwin-arm64"
-      sha256 "SHA256_PLACEHOLDER"
-    else
-      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-darwin-x64"
-      sha256 "SHA256_PLACEHOLDER"
-    end
-  end
-
-  on_linux do
-    if Hardware::CPU.arm? && Hardware::CPU.is_64_bit?
-      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-linux-arm64"
-      sha256 "SHA256_PLACEHOLDER"
-    else
-      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-linux-x64"
-      sha256 "SHA256_PLACEHOLDER"
-    end
-  end
-
-  def install
-    bin.install "ghfind" => "ghfind"
-  end
-
-  test do
-    assert_match version.to_s, shell_output("#{bin}/ghfind --version")
-  end
-end
+# typed: true
+# frozen_string_literal: true
+
+# Homebrew formula for ghfind.
+#
+# NOTE: this file is a template, kept in-tree for a future homebrew tap.
+# Before use:
+#   1. Replace VERSION with the released version tag.
+#   2. Fill SHA256 placeholders from the SHA256SUMS.txt asset attached to
+#      the GitHub Release (the release workflow generates it).
+#   3. Host it in a tap repo (e.g. codersdfs/tap) at Formula/ghfind.rb,
+#      then: brew install codersdfs/tap/ghfind
+# See marketing/README.md (Track B) for the rollout order.
+
+class Ghfind < Formula
+  desc "Search GitHub repos from your terminal — trending, bookmarks, deep-dive"
+  homepage "https://github.com/codersdfs/search-cli"
+  version "9.5.1"
+  license "MIT"
+
+  livecheck do
+    url :stable
+    regex(/^v?(\d+(?:\.\d+)+)$/i)
+  end
+
+  on_macos do
+    if Hardware::CPU.arm?
+      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-darwin-arm64"
+      sha256 "SHA256_PLACEHOLDER"
+    else
+      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-darwin-x64"
+      sha256 "SHA256_PLACEHOLDER"
+    end
+  end
+
+  on_linux do
+    if Hardware::CPU.arm? && Hardware::CPU.is_64_bit?
+      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-linux-arm64"
+      sha256 "SHA256_PLACEHOLDER"
+    else
+      url "https://github.com/codersdfs/search-cli/releases/download/v#{version}/ghfind-linux-x64"
+      sha256 "SHA256_PLACEHOLDER"
+    end
+  end
+
+  def install
+    bin.install "ghfind" => "ghfind"
+  end
+
+  test do
+    assert_match version.to_s, shell_output("#{bin}/ghfind --version")
+  end
+end

package/scripts/postinstall.js

@@ -18,6 +18,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { platform, arch } from "node:os";
 import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { inflateRawSync } from "node:zlib";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -96,6 +97,35 @@ const key = `${platform()}-${arch}`;
 const assetName = map[key];
 const version = "1.3.14";
 
+/**
+ * Pinned SHA256 of every Bun release asset this script can install, taken
+ * from that release's own SHASUMS256.txt. The download is verified before
+ * anything is written, so a tampered or truncated archive can never become
+ * an executable in vendor/.
+ *
+ * ponytail: hand-pinned per Bun release — regenerate this table (and bump
+ * `version`) whenever the release is bumped; the check is what makes the
+ * hardcoded `version` above trustworthy.
+ */
+const SHA256 = {
+  "bun-windows-x64.zip":
+    "0a0620930b6675d7ba440e81f4e0e00d3cfbe096c4b140d3fff02205e9e18922",
+  "bun-windows-aarch64.zip":
+    "89841f5a57f2348b67ec0839b718f4bf4ea7d07c371c9ba4b77b6c790f918953",
+  "bun-darwin-x64.zip":
+    "4183df3374623e5bab315c547cfa0974533cd457d86b73b639f7a87974cd6633",
+  "bun-darwin-aarch64.zip":
+    "d8b96221828ad6f97ac7ac0ab7e95872341af763001e8803e8267652c2652620",
+  "bun-linux-x64.zip":
+    "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f",
+  "bun-linux-x64-musl.zip":
+    "14bd9aedeebf1dba67e8def9531c89bc989ecfdf1de42e5bfcaf1b8cd9294719",
+  "bun-linux-aarch64.zip":
+    "a27ffb63a8310375836e0d6f668ae17fa8d8d18b88c37c821c65331973a19a3b",
+  "bun-linux-aarch64-musl.zip":
+    "b98e0ad3625c5c00d1d5b5ff55605c7adddbfae151861e68ade57b2d3b8703bb",
+};
+
 if (!assetName) {
   console.error(
     `[ghfind] Unsupported platform: ${key}. Install Bun manually: https://bun.sh`,
@@ -116,6 +146,14 @@ try {
 
   const buffer = Buffer.from(await res.arrayBuffer());
 
+  const expected = SHA256[assetName];
+  const actual = createHash("sha256").update(buffer).digest("hex");
+  if (expected !== actual) {
+    throw new Error(
+      `checksum mismatch for ${assetName} (expected ${expected}, got ${actual})`,
+    );
+  }
+
   // Find the central directory file header signature (PK\x01\x02)
   const cdSig = "PK\x01\x02";
   let cdOffset = buffer.indexOf(cdSig, 0);

package/src/cli.ts

@@ -140,6 +140,20 @@ interface CLIFlags {
   limitExplicit: boolean;
 }
 
+/**
+ * Valid `--sort` values: the repo strategies plus the npm-package strategies
+ * (the `pkg` subcommand validates its own narrower set).
+ */
+const SORT_VALUES = [
+  "best-match",
+  "stars",
+  "updated",
+  "forks",
+  "score",
+  "downloads",
+  "name",
+];
+
 function parseArgs(args: string[]): CLIFlags {
   const flags: CLIFlags = {
     query: "",
@@ -246,9 +260,17 @@ function parseArgs(args: string[]): CLIFlags {
         }
         break;
       }
-      case "--sort":
-        flags.sort = args[++i] as SearchOptions["sort"];
+      case "--sort": {
+        const sort = args[++i];
+        if (!sort || !SORT_VALUES.includes(sort)) {
+          console.error(
+            `Invalid sort: ${sort ?? "(missing)"} (use best-match|stars|updated|forks).`,
+          );
+          process.exit(1);
+        }
+        flags.sort = sort as SearchOptions["sort"];
         break;
+      }
       case "--token":
         flags.token = args[++i];
         break;
@@ -883,10 +905,11 @@ function rowsToCsv(header: string[], rows: string[][]): string {
 
 /** Markdown table for the same small local-state tables. */
 function rowsToMarkdown(header: string[], rows: string[][]): string {
+  const cell = (value: string) => value.replace(/\|/g, "\\|");
   return [
-    `| ${header.join(" | ")} |`,
+    `| ${header.map(cell).join(" | ")} |`,
     `|${header.map(() => "---").join("|")}|`,
-    ...rows.map((row) => `| ${row.join(" | ")} |`),
+    ...rows.map((row) => `| ${row.map(cell).join(" | ")} |`),
   ].join("\n");
 }
 
@@ -945,7 +968,12 @@ async function runReadme(flags: CLIFlags): Promise<void> {
   }
   try {
     const { owner, name } = repoFromRef(ref); // validates the ref
-    const readme = await fetchReadme(owner, name, { token: flags.token });
+    const readme = await fetchReadme(owner, name, {
+      // A bare ref carries no visibility info, so the token is never
+      // forwarded to raw.githubusercontent.com.
+      token: flags.token,
+      private: false,
+    });
     if (!readme) {
       console.error(`No README found for ${owner}/${name}.`);
       process.exit(1);
@@ -1224,22 +1252,14 @@ async function runNonInteractive(flags: CLIFlags, outputFormat?: ExportFormat) {
       }
     },
     compare: async (_ctx) => {
-      const search = createGitHubSearch(undefined, [flags.token ?? ""]);
       const repos: Repo[] = [];
       const missing: string[] = [];
       for (const fullName of flags.compare) {
-        const res = await search.search(
-          { keywords: [fullName], qualifiers: [], raw: fullName },
-          {
-            limit: 1,
-            sort: "stars",
-            json: false,
-            verbose: false,
-            token: flags.token,
-          },
-        );
-        if (res.repos.length > 0) repos.push(...res.repos);
-        else missing.push(fullName);
+        try {
+          repos.push(await resolveRepoFromRef(fullName, flags.token));
+        } catch {
+          missing.push(fullName);
+        }
       }
       if (repos.length < 2) {
         console.error(
@@ -1281,11 +1301,9 @@ async function runNonInteractive(flags: CLIFlags, outputFormat?: ExportFormat) {
 }
 
 main().catch((err) => {
-  if (err instanceof Error && err.name === "SearchCliError") {
+  if (err instanceof SearchCliError) {
     // ponytail: known user-facing errors already carry a friendly message; skip the report prompt
-    console.error(
-      err instanceof SearchCliError ? err.userMessage : err.message,
-    );
+    console.error(err.userMessage);
   } else {
     console.error(err instanceof Error ? err.message : String(err));
     reportError(err);

package/src/config.ts

@@ -9,7 +9,7 @@
 import type { Config } from "./types";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 
 /** Directory for persistent state (history, bookmarks, session). */
 export function stateDir(): string {
@@ -61,7 +61,17 @@ export function saveConfig(config: Config): void {
     Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\")),
   );
   mkdirSync(dir, { recursive: true });
-  writeFileSync(path, JSON.stringify(config, null, 2));
+  // The file holds a plaintext GitHub token — owner-only, and tighten any
+  // pre-existing world-readable file too.
+  writeFileSync(path, JSON.stringify(config, null, 2), {
+    encoding: "utf-8",
+    mode: 0o600,
+  });
+  try {
+    chmodSync(path, 0o600);
+  } catch {
+    // best effort (read-only file / unsupported filesystem)
+  }
 }
 
 function mergeWithEnv(config: Config): Config {

package/src/deepdive.ts

@@ -1,5 +1,6 @@
 /** Repo deep-dive — fetch and format rich repo details. */
 import type { Repo } from "./types";
+import { fetchReadme } from "./readme";
 
 const USER_AGENT = "ghfind/1.0";
 
@@ -56,11 +57,29 @@ export function repoFromRef(fullName: string): Repo {
   };
 }
 
+/** Repo payload as returned by GET /repos/{owner}/{repo}. */
+interface GitHubRepoApi {
+  description: string | null;
+  html_url: string;
+  stargazers_count: number;
+  forks_count: number;
+  subscribers_count?: number;
+  language: string | null;
+  topics?: string[];
+  archived: boolean;
+  fork: boolean;
+  private?: boolean;
+  created_at: string;
+  updated_at: string;
+  pushed_at: string;
+}
+
 /**
  * Resolve a repo ref to a real Repo by fetching canonical metadata from the
- * GitHub API. Returns a stub via repoFromRef when the metadata fetch fails
- * (offline, rate limit) — the ref is still validated first. Deep-dive
- * sub-fetches tolerate missing data either way.
+ * GitHub API. The ref is validated first. Only transport-level failures
+ * (offline, unparseable body) degrade to a stub via repoFromRef — an auth
+ * error or a rate limit is surfaced, because a stub with `stars: 0` is
+ * indistinguishable from a real repo with no data.
  */
 export async function resolveRepoFromRef(
   fullName: string,
@@ -68,58 +87,50 @@ export async function resolveRepoFromRef(
 ): Promise<Repo> {
   const ref = parseRepoRef(fullName); // throws for malformed refs
   const canonical = `${ref.owner}/${ref.name}`;
+
+  let res: Response;
   try {
-    const res = await fetch(`https://api.github.com/repos/${canonical}`, {
+    res = await fetch(`https://api.github.com/repos/${canonical}`, {
       headers: buildHeaders(token),
     });
-    if (res.status === 404) {
-      throw new Error(`Repo not found: ${canonical}`);
-    }
-    if (res.ok) {
-      const api = (await res.json()) as {
-        description: string | null;
-        html_url: string;
-        stargazers_count: number;
-        forks_count: number;
-        subscribers_count?: number;
-        language: string | null;
-        topics?: string[];
-        archived: boolean;
-        fork: boolean;
-        created_at: string;
-        updated_at: string;
-        pushed_at: string;
-      };
-      return {
-        id: 0,
-        fullName: canonical,
-        name: ref.name,
-        owner: ref.owner,
-        description: api.description,
-        url: api.html_url,
-        stars: api.stargazers_count ?? 0,
-        forks: api.forks_count ?? 0,
-        watchers: api.subscribers_count ?? 0,
-        language: api.language,
-        topics: api.topics ?? [],
-        archived: api.archived ?? false,
-        isFork: api.fork ?? false,
-        private: false,
-        createdAt: api.created_at ?? "",
-        updatedAt: api.updated_at ?? "",
-        pushedAt: api.pushed_at ?? "",
-        score: 0,
-      };
-    }
-  } catch (err) {
-    // Let the not-found error propagate; only network/parse failures degrade
-    // to the stub below.
-    if (err instanceof Error && err.message.startsWith("Repo not found")) {
-      throw err;
-    }
-    // Fall through to the stub.
+  } catch {
+    return repoFromRef(canonical);
+  }
+
+  if (res.status === 404) {
+    throw new Error(`Repo not found: ${canonical}`);
+  }
+  if (!res.ok) {
+    throw new Error(`GitHub API error ${res.status} for ${canonical}`);
+  }
+
+  let api: GitHubRepoApi;
+  try {
+    api = (await res.json()) as GitHubRepoApi;
+  } catch {
+    return repoFromRef(canonical);
   }
-  return repoFromRef(canonical);
+
+  return {
+    id: 0,
+    fullName: canonical,
+    name: ref.name,
+    owner: ref.owner,
+    description: api.description,
+    url: api.html_url,
+    stars: api.stargazers_count ?? 0,
+    forks: api.forks_count ?? 0,
+    watchers: api.subscribers_count ?? 0,
+    language: api.language,
+    topics: api.topics ?? [],
+    archived: api.archived ?? false,
+    isFork: api.fork ?? false,
+    private: api.private ?? false,
+    createdAt: api.created_at ?? "",
+    updatedAt: api.updated_at ?? "",
+    pushedAt: api.pushed_at ?? "",
+    score: 0,
+  };
 }
 
 /** Language breakdown: { [lang]: bytes } */
@@ -176,21 +187,14 @@ export async function fetchDeepDiveRaw(
     ),
   ]);
 
-  // README with branch fallback: main → master → README.rst
-  let readmeText = "";
-  for (const path of [
-    `${repo.owner}/${repo.name}/main/README.md`,
-    `${repo.owner}/${repo.name}/master/README.md`,
-    `${repo.owner}/${repo.name}/main/README.rst`,
-  ]) {
-    const r = await fetch(`https://raw.githubusercontent.com/${path}`, {
-      headers,
-    });
-    if (r.ok) {
-      readmeText = await r.text();
-      break;
-    }
-  }
+  // README: main → master → README.rst, probed in parallel by fetchReadme.
+  // Public READMEs are served unauthenticated, so the token is only forwarded
+  // to raw.githubusercontent.com when the repo actually needs it.
+  const readme = await fetchReadme(repo.owner, repo.name, {
+    token: repo.private ? token : undefined,
+    private: repo.private,
+  });
+  const readmeText = readme?.text ?? "";
 
   const langEntries: [string, number][] = languagesRes.ok
     ? Object.entries(

package/src/doctor.ts

@@ -11,6 +11,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir, platform, arch } from "node:os";
 import { loadConfig, configPath, stateDir, cacheDir } from "./config";
+import { maskToken } from "./login";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_DIR = join(__dirname, "..");
@@ -212,8 +213,8 @@ function checkGithubToken(): void {
   const config = loadConfig();
   const token = config.githubToken || process.env.GITHUB_TOKEN;
   if (token) {
-    const preview = token.slice(0, 7);
-    add("PASS", "GitHub token", `Configured (${preview}…).`);
+    const preview = maskToken(token);
+    add("PASS", "GitHub token", `Configured (${preview}).`);
   } else {
     add(
       "WARN",