github-search-cli 9.8.1 → 9.8.2

package/src/error-report.ts

@@ -3,7 +3,8 @@
  * error, print it, and offer to open it in the user's browser.
  *
  * Privacy: never auto-posts. The user sees the URL and decides whether to
- * submit. We redact env vars and only include what the diagnostic needs.
+ * submit. Credentials found in argv or the error text are redacted before
+ * they can reach the URL, and a redacted report is never auto-opened.
  */
 import {
   platform as osPlatform,
@@ -24,6 +25,59 @@ void _osArch;
 const REPO = "codersdfs/search-cli";
 const NEW_ISSUE_URL = `https://github.com/${REPO}/issues/new`;
 
+const SECRET_PLACEHOLDER = "***";
+
+/** Flags whose *next* argument is a credential. */
+const SECRET_FLAGS = /^(?:--token|-t)$/;
+
+/** GitHub credential shapes: classic (ghp_/gho_/ghu_/ghs_/ghr_) and fine-grained. */
+const SECRET_PATTERNS: RegExp[] = [
+  /gh[pousr]_[A-Za-z0-9]{16,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+];
+
+/** Replace anything that looks like a token inside a free-form string. */
+export function redactSecrets(text: string): string {
+  let out = text;
+  for (const pattern of SECRET_PATTERNS) {
+    out = out.replace(pattern, SECRET_PLACEHOLDER);
+  }
+  return out;
+}
+
+/**
+ * Redact an argv: the value following a credential flag, `--token=…`/`-t=…`
+ * forms, and any bare argument that looks like a token.
+ */
+export function redactArgv(argv: string[]): string[] {
+  const out: string[] = [];
+  let redactNext = false;
+  for (const arg of argv) {
+    if (redactNext) {
+      out.push(SECRET_PLACEHOLDER);
+      redactNext = false;
+      continue;
+    }
+    if (SECRET_FLAGS.test(arg)) {
+      out.push(arg);
+      redactNext = true;
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    if (eq > 0 && SECRET_FLAGS.test(arg.slice(0, eq))) {
+      out.push(`${arg.slice(0, eq)}=${SECRET_PLACEHOLDER}`);
+      continue;
+    }
+    out.push(redactSecrets(arg));
+  }
+  return out;
+}
+
+/** True when `argv` carries a credential that redaction would remove. */
+function argvHasSecret(argv: string[]): boolean {
+  return redactArgv(argv).some((arg, i) => arg !== argv[i]);
+}
+
 function getPackageVersion(): string {
   return getVersion();
 }
@@ -43,10 +97,12 @@ export function formatErrorBody(
   context: { command: string; argv: string[] },
 ): string {
   const e = err instanceof Error ? err : new Error(String(err));
-  // biome-ignore lint/suspicious/noControlCharactersInRegex: strips ANSI color escapes from stack traces
-  const stack = (e.stack ?? "(no stack)").replace(/\u001b\[[0-9;]*m/g, "");
-  const message = (e.message || "(no message)").slice(0, 500);
-  const cmd = `${context.command} ${context.argv.join(" ")}`.trim();
+  const stack = redactSecrets(
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: strips ANSI color escapes from stack traces
+    (e.stack ?? "(no stack)").replace(/\u001b\[[0-9;]*m/g, ""),
+  );
+  const message = redactSecrets(e.message || "(no message)").slice(0, 500);
+  const cmd = `${context.command} ${redactArgv(context.argv).join(" ")}`.trim();
   const ghfindVersion = getPackageVersion();
 
   return [
@@ -88,7 +144,9 @@ export function buildIssueUrl(
   context: { command: string; argv: string[] },
 ): string {
   const e = err instanceof Error ? err : new Error(String(err));
-  const title = e.message.slice(0, 80).replace(/[\r\n]+/g, " ");
+  const title = redactSecrets(e.message)
+    .slice(0, 80)
+    .replace(/[\r\n]+/g, " ");
   const body = formatErrorBody(err, context);
   const params = new URLSearchParams({
     title: `[bug] ${title || "Unhandled error"}`,
@@ -138,15 +196,27 @@ export function reportError(
     argv: process.argv.slice(2),
   },
 ): string {
-  const url = buildIssueUrl(err, context);
+  const hadSecret = argvHasSecret(context.argv);
+  // Build the URL from the scrubbed argv, never the raw one.
+  const url = buildIssueUrl(err, {
+    command: context.command,
+    argv: redactArgv(context.argv),
+  });
   console.error("");
   console.error("  ⚠  ghfind encountered an unexpected error.");
   console.error("");
-  console.error("  Help us fix it by opening a bug report with the");
-  console.error("  details pre-filled. Your browser will open the new-issue");
-  console.error("  page; review and submit (or close the tab to skip).");
+  if (hadSecret) {
+    console.error("  A token was found in the command line and has been");
+    console.error("  redacted. Your browser will NOT be opened — review the");
+    console.error("  scrubbed URL below before sharing it anywhere.");
+  } else {
+    console.error("  Help us fix it by opening a bug report with the");
+    console.error("  details pre-filled. Your browser will open the new-issue");
+    console.error("  page; review and submit (or close the tab to skip).");
+  }
   console.error("");
-  const opened = tryOpenUrl(url);
+  // Never auto-open a report that contained a credential.
+  const opened = hadSecret ? false : tryOpenUrl(url);
   if (opened) {
     console.error(`  → Opened: ${url}`);
   } else {

package/src/errors.ts

@@ -4,7 +4,6 @@ export class SearchCliError extends Error {
   constructor(
     message: string,
     public readonly userMessage: string,
-    public readonly recoverable: boolean = true,
   ) {
     super(message);
     this.name = "SearchCliError";

package/src/history.ts

@@ -31,13 +31,10 @@ export function readHistory(): HistoryEntry[] {
 export function deleteHistoryEntry(index: number): void {
   const entries = readHistory();
   if (index < 0 || index >= entries.length) return;
-  const removed = entries[index];
-  const remaining = entries.filter(
-    (e) => e.timestamp !== removed.timestamp || e.query !== removed.query,
-  );
+  entries.splice(index, 1);
   writeRaw(
     HISTORY_FILE,
-    `${remaining
+    `${entries
       .reverse()
       .map((e) => JSON.stringify(e))
       .join("\n")}\n`,

package/src/init.ts

@@ -4,7 +4,7 @@
  * ponytail: simple stdin prompts, no curses/readline UI.
  */
 import { createInterface } from "node:readline";
-import { saveConfig } from "./config";
+import { saveConfig, configPath } from "./config";
 import { isLikelyGithubToken } from "./login";
 import { listThemes } from "./themes";
 import type { Config, SortStrategy } from "./types";
@@ -53,7 +53,6 @@ export async function runInitWizard(): Promise<void> {
   if (token) config.githubToken = token;
 
   saveConfig(config);
-  const { configPath } = await import("./config.ts");
   console.log(`  ✓ Config saved to ${configPath()}`);
   console.log("  Run 'ghfind' to start browsing!");
   console.log("");

package/src/mcp-server.ts

@@ -510,19 +510,14 @@ const TOOLS: ToolDefinition[] = [
         throw new McpToolError("repos must contain 2-5 repo fullNames.");
       }
       const token = resolveToken(state, args.token);
-      const provider = createGitHubSearch(undefined, token ? [token] : []);
       const found: Repo[] = [];
       const missing: string[] = [];
       for (const fullName of names) {
-        const res = await provider.search(parseQuery(fullName), {
-          limit: 1,
-          sort: "stars",
-          json: false,
-          verbose: false,
-          token,
-        });
-        if (res.repos.length > 0) found.push(res.repos[0]);
-        else missing.push(fullName);
+        try {
+          found.push(await resolveRepoFromRef(fullName, token));
+        } catch {
+          missing.push(fullName);
+        }
       }
       if (found.length < 2) {
         throw new McpToolError(

package/src/notifications.ts

@@ -12,10 +12,14 @@ export interface Notification {
 
 let nextId = 1;
 let notifs: Notification[] = [];
+let loaded = false;
 const MAX_NOTIFS = 50;
 const FILE = "notifications.json";
 
-function load(): void {
+/** Load once per process: re-reading on an empty list would reissue ids. */
+function ensureLoaded(): void {
+  if (loaded) return;
+  loaded = true;
   notifs = readJSON<Notification[]>(FILE, []);
   nextId = Math.max(...notifs.map((n) => n.id), 0) + 1;
 }
@@ -28,7 +32,7 @@ export function addNotification(
   type: Notification["type"],
   message: string,
 ): Notification {
-  if (notifs.length === 0) load();
+  ensureLoaded();
   const n: Notification = {
     id: nextId++,
     type,
@@ -60,16 +64,18 @@ function iconFor(type: Notification["type"]): string {
 }
 
 export function getNotifications(): Notification[] {
-  if (notifs.length === 0) load();
+  ensureLoaded();
   return [...notifs];
 }
 
 export function dismissNotification(id: number): void {
+  ensureLoaded();
   notifs = notifs.filter((n) => n.id !== id);
   save();
 }
 
 export function dismissAll(): void {
+  ensureLoaded();
   notifs = [];
   save();
 }

package/src/org.ts

@@ -171,20 +171,21 @@ export async function fetchOrgProfile(
   if (orgPayload.public_repos > 0) {
     const perPage = Math.min(limit, 100);
     const maxPages = Math.ceil(limit / perPage);
-    for (let page = 1; page <= maxPages; page++) {
-      const url =
-        `https://api.github.com/orgs/${encodeURIComponent(name)}/repos` +
-        `?per_page=${perPage}&sort=pushed&page=${page}`;
-      const res = await fetch(url, { headers: apiHeaders(token) });
-      if (!res.ok) {
-        // Org metadata succeeded; degraded summary beats a hard failure.
-        break;
-      }
-      const items = (await res.json()) as GitHubRepoPayload[];
-      if (!Array.isArray(items)) break; // unexpected shape — degrade gracefully
-      repos.push(...items);
-      if (repos.length >= limit || items.length < perPage) break;
-    }
+    const pages = await Promise.all(
+      Array.from({ length: maxPages }, (_, i) => i + 1).map(async (page) => {
+        const url =
+          `https://api.github.com/orgs/${encodeURIComponent(name)}/repos` +
+          `?per_page=${perPage}&sort=pushed&page=${page}`;
+        const res = await fetch(url, { headers: apiHeaders(token) });
+        if (!res.ok) {
+          // Org metadata succeeded; degraded summary beats a hard failure.
+          return [];
+        }
+        const items = (await res.json()) as GitHubRepoPayload[];
+        return Array.isArray(items) ? items : []; // unexpected shape — skip
+      }),
+    );
+    repos.push(...pages.flat());
   }
 
   return normalizeOrg(orgPayload, repos.slice(0, limit));

package/src/output.ts

@@ -136,18 +136,6 @@ export async function pipeExec(repos: Repo[], target: string): Promise<void> {
   }
 }
 
-// ─── Backward-compatible re-exports ─────────────────────────────────────
+// ─── Narrowed aliases ──────────────────────────────────────────────────
 
 export type ExportFormat = "json" | "csv" | "markdown" | "text";
-export type FormatLine =
-  "urls" | "names" | "ssh-urls" | "clone-commands" | "ids";
-
-/** @deprecated Use `format()` instead. */
-export function formatRepos(repos: Repo[], fmt: ExportFormat): string {
-  return format(repos, fmt);
-}
-
-/** @deprecated Use `format()` instead. */
-export function formatLines(repos: Repo[], fmt: FormatLine): string {
-  return format(repos, fmt);
-}

package/src/readme.ts

@@ -27,17 +27,33 @@ const CANDIDATES: ReadonlyArray<readonly [string, string]> = [
   ["main", "README.rst"],
 ];
 
+/**
+ * Headers for a README request. raw.githubusercontent.com is not the GitHub
+ * API, so the token is only ever attached to api.github.com — and only for
+ * private repos, which are the sole reason to authenticate a README fetch.
+ */
+export function buildReadmeHeaders(
+  url: string,
+  token: string | undefined,
+  isPrivate = false,
+): Record<string, string> {
+  const headers: Record<string, string> = { "User-Agent": "ghfind/1.0" };
+  if (token && isPrivate && new URL(url).origin === "https://api.github.com") {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  return headers;
+}
+
 export async function fetchReadme(
   owner: string,
   repo: string,
-  opts: { token?: string; fetchImpl?: typeof fetch } = {},
+  opts: { token?: string; private?: boolean; fetchImpl?: typeof fetch } = {},
 ): Promise<Readme | null> {
   const fetchImpl = opts.fetchImpl ?? fetch;
-  const headers: Record<string, string> = { "User-Agent": "ghfind/1.0" };
-  if (opts.token) headers.Authorization = `Bearer ${opts.token}`;
 
   const attempts = CANDIDATES.map(async ([branch, file]) => {
     const url = readmeBaseUrl(owner, repo, branch, file);
+    const headers = buildReadmeHeaders(url, opts.token, opts.private);
     const res = await fetchImpl(url, { headers });
     // Reject rather than resolve with null: Promise.any settles on the first
     // *fulfilled* promise, so a 404 that resolved would beat the real README.

package/src/releases.ts

@@ -5,6 +5,8 @@ import { loadConfig } from "./config";
 
 const RELEASES_FILE = "release-cache.json";
 const PER_REPO = 5;
+/** Bookmarks checked in parallel — enough to be fast, few enough to stay polite. */
+const CONCURRENCY = 6;
 
 export interface TrackedRelease {
   id: number;
@@ -87,47 +89,47 @@ export async function checkReleases(
     error?: string;
   }> = [];
 
-  for (const bm of bookmarks) {
+  const checkOne = async (
+    fullName: string,
+  ): Promise<{
+    fullName: string;
+    newReleases: TrackedRelease[];
+    error?: string;
+  }> => {
     try {
-      const prev = cache[bm.repo.fullName];
-      const lastSeen = getLastSeen(bm.repo.fullName);
+      const prev = cache[fullName];
+      const lastSeen = getLastSeen(fullName);
       const isNew = (r: TrackedRelease) =>
         !r.publishedAt || new Date(r.publishedAt).getTime() > lastSeen;
 
       const { status, etag, releases } = await fetchReleases(
-        bm.repo.fullName,
+        fullName,
         prev?.etag,
         token,
       );
 
       if (status === 304 && prev) {
         // Unchanged upstream; recompute against lastSeenAt (it may have moved).
-        results.push({
-          fullName: bm.repo.fullName,
-          newReleases: prev.releases.filter(isNew),
-        });
-        continue;
+        return { fullName, newReleases: prev.releases.filter(isNew) };
       }
       if (status !== 200 || !releases) {
-        results.push({
-          fullName: bm.repo.fullName,
-          newReleases: [],
-          error: `HTTP ${status}`,
-        });
-        continue;
+        return { fullName, newReleases: [], error: `HTTP ${status}` };
       }
-      cache[bm.repo.fullName] = { checkedAt: Date.now(), etag, releases };
-      results.push({
-        fullName: bm.repo.fullName,
-        newReleases: releases.filter(isNew),
-      });
+      cache[fullName] = { checkedAt: Date.now(), etag, releases };
+      return { fullName, newReleases: releases.filter(isNew) };
     } catch (err) {
-      results.push({
-        fullName: bm.repo.fullName,
-        newReleases: [],
-        error: (err as Error).message,
-      });
+      return { fullName, newReleases: [], error: (err as Error).message };
     }
+  };
+
+  // Run in small batches rather than one-at-a-time: a serial loop over every
+  // bookmark spends all its time waiting on the network, and bursts straight
+  // through the unauthenticated rate limit.
+  for (let i = 0; i < bookmarks.length; i += CONCURRENCY) {
+    const batch = bookmarks
+      .slice(i, i + CONCURRENCY)
+      .map((bm) => checkOne(bm.repo.fullName));
+    results.push(...(await Promise.all(batch)));
   }
 
   saveCache(cache);
@@ -158,9 +160,9 @@ export function allCachedReleases(): Array<
   TrackedRelease & { fullName: string }
 > {
   const cache = loadCache();
-  const bookmarks = getBookmarks();
+  const bookmarked = new Set(getBookmarks().map((b) => b.repo.fullName));
   return Object.entries(cache)
-    .filter(([fullName]) => bookmarks.some((b) => b.repo.fullName === fullName))
+    .filter(([fullName]) => bookmarked.has(fullName))
     .flatMap(([fullName, s]) => s.releases.map((r) => ({ ...r, fullName })))
     .sort(
       (a, b) =>

package/src/search.ts

@@ -58,6 +58,10 @@ export class MemoryCache<T> {
   }
 
   set(key: string, data: T, ttlMs?: number): void {
+    // Re-inserting an existing key must move it to the end of the
+    // insertion-ordered Map, otherwise a refreshed entry keeps its original
+    // position and is the first one evicted — FIFO instead of LRU.
+    this.cache.delete(key);
     if (this.cache.size >= MAX_CACHE_SIZE) {
       const firstKey = this.cache.keys().next().value;
       if (firstKey !== undefined) this.cache.delete(firstKey);

package/src/skill-finder.ts

@@ -80,6 +80,13 @@ export const MIN_QUERY_LENGTH = 2;
 /** Result cap, applied to both sources. */
 export const MAX_SKILL_RESULTS = 100;
 
+/**
+ * The only shape accepted for registry `source` / `skillId`. Both end up
+ * inside a shell command (`npx skills add …`) that an agent is expected to
+ * run, so anything with shell metacharacters is rejected outright.
+ */
+const SAFE_ID_RE = /^[A-Za-z0-9._/-]+$/;
+
 // ─── Local roots ──────────────────────────────────────────────────────────
 
 /** One scan root: where it is, and the label results carry. */
@@ -193,6 +200,9 @@ export function parseSkillFrontmatter(
 
 // ─── Local scan ───────────────────────────────────────────────────────────
 
+/** Memoised scan results, keyed by root path + label. */
+const scanCache = new Map<string, LocalSkillHit[]>();
+
 /**
  * Walk the roots and collect every readable SKILL.md, de-duplicated by name.
  *
@@ -203,6 +213,12 @@ export function parseSkillFrontmatter(
 export function scanLocalSkills(
   roots: SkillRoot[] = resolveSkillRoots(),
 ): LocalSkillHit[] {
+  // The filesystem does not change within a process, so a repeat scan is pure
+  // duplicate blocking I/O. Keyed on the roots so callers passing their own
+  // roots (tests, GHFIND_SKILL_ROOTS) still get a distinct cache entry.
+  const key = roots.map((r) => `${r.path}\u0000${r.label}`).join("\u0001");
+  const cached = scanCache.get(key);
+  if (cached) return cached;
   const byName = new Map<string, LocalSkillHit>();
   for (const root of roots) {
     for (const dir of walkDirs(root.path)) {
@@ -224,7 +240,9 @@ export function scanLocalSkills(
       }
     }
   }
-  return [...byName.values()];
+  const hits = [...byName.values()];
+  scanCache.set(key, hits);
+  return hits;
 }
 
 /** Directory entries, or null when the directory is missing or unreadable. */
@@ -326,7 +344,20 @@ function normalizeRegistrySkill(raw: unknown): RegistrySkillHit | null {
   const obj = raw as Record<string, unknown>;
   const source = typeof obj.source === "string" ? obj.source : "";
   const skillId = typeof obj.skillId === "string" ? obj.skillId : "";
-  if (!source || !skillId) return null;
+  // The registry is untrusted input and these two are interpolated into a
+  // shell command and a URL handed to an agent, so anything but a plain
+  // owner/repo + skill-id shape is dropped rather than escaped.
+  // `SAFE_ID_RE` allows `/` and `.`, so `../` passes it — reject traversal
+  // segments explicitly; they would land in the URL path and the npx command.
+  const hasTraversal = (s: string) => s === ".." || s.includes("..");
+  if (
+    !SAFE_ID_RE.test(source) ||
+    !SAFE_ID_RE.test(skillId) ||
+    hasTraversal(source) ||
+    hasTraversal(skillId)
+  ) {
+    return null;
+  }
   const name =
     typeof obj.name === "string" && obj.name.trim() ? obj.name : skillId;
   const installs = typeof obj.installs === "number" ? obj.installs : 0;

package/src/storage.ts

@@ -2,16 +2,15 @@
  * Storage adapter — single point of file I/O for state files.
  *
  * All domain modules (history, bookmarks, saved-searches, notifications,
- * session, config) delegate file I/O here. Swap for an in-memory
- * implementation in tests.
+ * session, config) delegate file I/O here.
  */
 import {
-  existsSync,
   mkdirSync,
   readFileSync,
   writeFileSync,
   appendFileSync,
   unlinkSync,
+  renameSync,
 } from "node:fs";
 import { join } from "node:path";
 import { stateDir } from "./config";
@@ -31,10 +30,27 @@ export function readJSON<T>(filename: string, fallback: T): T {
   }
 }
 
+/** Write a file atomically: temp file in the same dir, then rename. */
+function writeFileAtomic(filename: string, data: string): void {
+  ensureDir();
+  const target = join(stateDir(), filename);
+  const tmp = `${target}.tmp-${process.pid}`;
+  try {
+    writeFileSync(tmp, data, "utf-8");
+    renameSync(tmp, target);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+      // temp already gone
+    }
+    throw e;
+  }
+}
+
 /** Write data as JSON to a file. */
 export function writeJSON(filename: string, data: unknown): void {
-  ensureDir();
-  writeFileSync(join(stateDir(), filename), JSON.stringify(data, null, 2));
+  writeFileAtomic(filename, JSON.stringify(data, null, 2));
 }
 
 /** Append one JSON object as a line to a JSONL file. */
@@ -68,8 +84,7 @@ export function readJSONL<T>(filename: string): T[] {
 
 /** Write raw text to a file (bypasses JSON encoding). */
 export function writeRaw(filename: string, data: string): void {
-  ensureDir();
-  writeFileSync(join(stateDir(), filename), data);
+  writeFileAtomic(filename, data);
 }
 
 /** Delete a file if it exists. */
@@ -94,43 +109,3 @@ export function debugLog(msg: string): void {
     /* ignore */
   }
 }
-
-/** Check if a file exists in the state dir. */
-export function fileExists(filename: string): boolean {
-  return existsSync(join(stateDir(), filename));
-}
-
-// ─── In-memory implementation for tests ────────────────────────────────
-
-const memStore = new Map<string, string>();
-
-export const memoryStorage = {
-  readJSON<T>(filename: string, fallback: T): T {
-    const raw = memStore.get(filename);
-    if (!raw) return fallback;
-    try {
-      return JSON.parse(raw) as T;
-    } catch {
-      return fallback;
-    }
-  },
-  writeJSON(filename: string, data: unknown): void {
-    memStore.set(filename, JSON.stringify(data, null, 2));
-  },
-  appendJSONL(filename: string, obj: unknown): void {
-    const existing = memStore.get(filename) ?? "";
-    memStore.set(filename, `${existing + JSON.stringify(obj)}\n`);
-  },
-  readJSONL<T>(filename: string): T[] {
-    const raw = memStore.get(filename);
-    if (!raw) return [];
-    return raw
-      .trim()
-      .split("\n")
-      .filter(Boolean)
-      .map((l) => JSON.parse(l) as T);
-  },
-  clear(): void {
-    memStore.clear();
-  },
-};

package/src/tui.ts

@@ -1891,6 +1891,7 @@ export async function launchBrowser(theme_override?: string): Promise<void> {
     try {
       const readme = await fetchReadme(repo.owner, repo.name, {
         token: githubToken,
+        private: repo.private,
       });
       if (readme) {
         readmeView.setContent(readme.text, readme.sourceUrl);
@@ -2426,10 +2427,13 @@ export async function launchBrowser(theme_override?: string): Promise<void> {
         }
       }
     } catch (err) {
-      currentRepos = [];
-      resultsSelect.options = [
-        { name: " (error)", description: "", value: null },
-      ];
+      // A failed "load more" page must not wipe the pages already on screen.
+      if (!append) {
+        currentRepos = [];
+        resultsSelect.options = [
+          { name: " (error)", description: "", value: null },
+        ];
+      }
       const msg =
         err instanceof SearchCliError
           ? err.userMessage
@@ -3071,18 +3075,12 @@ ${pack.description ?? ""}`;
 // ── Utilities ─────────────────────────────────────────────────────────
 
 function formatResultLine(repo: Repo): string {
-  const stars = formatStars(repo.stars);
+  const stars = `★ ${fmtStars(repo.stars)}`;
   const lang = (repo.language ?? "?").padEnd(12).slice(0, 12);
   const name = repo.fullName.padEnd(40).slice(0, 40);
   return `${name}  ${lang}  ${stars}`;
 }
 
-function formatStars(n: number): string {
-  if (n >= 1000000) return `★ ${(n / 1000000).toFixed(1).replace(/\.0$/, "")}M`;
-  if (n >= 1000) return `★ ${(n / 1000).toFixed(1).replace(/\.0$/, "")}k`;
-  return `★ ${n}`;
-}
-
 function formatToolbar(
   sort: SortStrategy | PackageSortMode,
   limit: number,