github-search-cli 9.8.1 → 9.8.3

package/src/notifications.ts

@@ -12,10 +12,14 @@ export interface Notification {
 
 let nextId = 1;
 let notifs: Notification[] = [];
+let loaded = false;
 const MAX_NOTIFS = 50;
 const FILE = "notifications.json";
 
-function load(): void {
+/** Load once per process: re-reading on an empty list would reissue ids. */
+function ensureLoaded(): void {
+  if (loaded) return;
+  loaded = true;
   notifs = readJSON<Notification[]>(FILE, []);
   nextId = Math.max(...notifs.map((n) => n.id), 0) + 1;
 }
@@ -28,7 +32,7 @@ export function addNotification(
   type: Notification["type"],
   message: string,
 ): Notification {
-  if (notifs.length === 0) load();
+  ensureLoaded();
   const n: Notification = {
     id: nextId++,
     type,
@@ -60,16 +64,18 @@ function iconFor(type: Notification["type"]): string {
 }
 
 export function getNotifications(): Notification[] {
-  if (notifs.length === 0) load();
+  ensureLoaded();
   return [...notifs];
 }
 
 export function dismissNotification(id: number): void {
+  ensureLoaded();
   notifs = notifs.filter((n) => n.id !== id);
   save();
 }
 
 export function dismissAll(): void {
+  ensureLoaded();
   notifs = [];
   save();
 }

package/src/org.ts

@@ -171,20 +171,21 @@ export async function fetchOrgProfile(
   if (orgPayload.public_repos > 0) {
     const perPage = Math.min(limit, 100);
     const maxPages = Math.ceil(limit / perPage);
-    for (let page = 1; page <= maxPages; page++) {
-      const url =
-        `https://api.github.com/orgs/${encodeURIComponent(name)}/repos` +
-        `?per_page=${perPage}&sort=pushed&page=${page}`;
-      const res = await fetch(url, { headers: apiHeaders(token) });
-      if (!res.ok) {
-        // Org metadata succeeded; degraded summary beats a hard failure.
-        break;
-      }
-      const items = (await res.json()) as GitHubRepoPayload[];
-      if (!Array.isArray(items)) break; // unexpected shape — degrade gracefully
-      repos.push(...items);
-      if (repos.length >= limit || items.length < perPage) break;
-    }
+    const pages = await Promise.all(
+      Array.from({ length: maxPages }, (_, i) => i + 1).map(async (page) => {
+        const url =
+          `https://api.github.com/orgs/${encodeURIComponent(name)}/repos` +
+          `?per_page=${perPage}&sort=pushed&page=${page}`;
+        const res = await fetch(url, { headers: apiHeaders(token) });
+        if (!res.ok) {
+          // Org metadata succeeded; degraded summary beats a hard failure.
+          return [];
+        }
+        const items = (await res.json()) as GitHubRepoPayload[];
+        return Array.isArray(items) ? items : []; // unexpected shape — skip
+      }),
+    );
+    repos.push(...pages.flat());
   }
 
   return normalizeOrg(orgPayload, repos.slice(0, limit));

package/src/output.ts

@@ -136,18 +136,6 @@ export async function pipeExec(repos: Repo[], target: string): Promise<void> {
   }
 }
 
-// ─── Backward-compatible re-exports ─────────────────────────────────────
+// ─── Narrowed aliases ──────────────────────────────────────────────────
 
 export type ExportFormat = "json" | "csv" | "markdown" | "text";
-export type FormatLine =
-  "urls" | "names" | "ssh-urls" | "clone-commands" | "ids";
-
-/** @deprecated Use `format()` instead. */
-export function formatRepos(repos: Repo[], fmt: ExportFormat): string {
-  return format(repos, fmt);
-}
-
-/** @deprecated Use `format()` instead. */
-export function formatLines(repos: Repo[], fmt: FormatLine): string {
-  return format(repos, fmt);
-}

package/src/readme.ts

@@ -27,17 +27,33 @@ const CANDIDATES: ReadonlyArray<readonly [string, string]> = [
   ["main", "README.rst"],
 ];
 
+/**
+ * Headers for a README request. raw.githubusercontent.com is not the GitHub
+ * API, so the token is only ever attached to api.github.com — and only for
+ * private repos, which are the sole reason to authenticate a README fetch.
+ */
+export function buildReadmeHeaders(
+  url: string,
+  token: string | undefined,
+  isPrivate = false,
+): Record<string, string> {
+  const headers: Record<string, string> = { "User-Agent": "ghfind/1.0" };
+  if (token && isPrivate && new URL(url).origin === "https://api.github.com") {
+    headers.Authorization = `Bearer ${token}`;
+  }
+  return headers;
+}
+
 export async function fetchReadme(
   owner: string,
   repo: string,
-  opts: { token?: string; fetchImpl?: typeof fetch } = {},
+  opts: { token?: string; private?: boolean; fetchImpl?: typeof fetch } = {},
 ): Promise<Readme | null> {
   const fetchImpl = opts.fetchImpl ?? fetch;
-  const headers: Record<string, string> = { "User-Agent": "ghfind/1.0" };
-  if (opts.token) headers.Authorization = `Bearer ${opts.token}`;
 
   const attempts = CANDIDATES.map(async ([branch, file]) => {
     const url = readmeBaseUrl(owner, repo, branch, file);
+    const headers = buildReadmeHeaders(url, opts.token, opts.private);
     const res = await fetchImpl(url, { headers });
     // Reject rather than resolve with null: Promise.any settles on the first
     // *fulfilled* promise, so a 404 that resolved would beat the real README.

package/src/releases.ts

@@ -5,6 +5,8 @@ import { loadConfig } from "./config";
 
 const RELEASES_FILE = "release-cache.json";
 const PER_REPO = 5;
+/** Bookmarks checked in parallel — enough to be fast, few enough to stay polite. */
+const CONCURRENCY = 6;
 
 export interface TrackedRelease {
   id: number;
@@ -87,47 +89,47 @@ export async function checkReleases(
     error?: string;
   }> = [];
 
-  for (const bm of bookmarks) {
+  const checkOne = async (
+    fullName: string,
+  ): Promise<{
+    fullName: string;
+    newReleases: TrackedRelease[];
+    error?: string;
+  }> => {
     try {
-      const prev = cache[bm.repo.fullName];
-      const lastSeen = getLastSeen(bm.repo.fullName);
+      const prev = cache[fullName];
+      const lastSeen = getLastSeen(fullName);
       const isNew = (r: TrackedRelease) =>
         !r.publishedAt || new Date(r.publishedAt).getTime() > lastSeen;
 
       const { status, etag, releases } = await fetchReleases(
-        bm.repo.fullName,
+        fullName,
         prev?.etag,
         token,
       );
 
       if (status === 304 && prev) {
         // Unchanged upstream; recompute against lastSeenAt (it may have moved).
-        results.push({
-          fullName: bm.repo.fullName,
-          newReleases: prev.releases.filter(isNew),
-        });
-        continue;
+        return { fullName, newReleases: prev.releases.filter(isNew) };
       }
       if (status !== 200 || !releases) {
-        results.push({
-          fullName: bm.repo.fullName,
-          newReleases: [],
-          error: `HTTP ${status}`,
-        });
-        continue;
+        return { fullName, newReleases: [], error: `HTTP ${status}` };
       }
-      cache[bm.repo.fullName] = { checkedAt: Date.now(), etag, releases };
-      results.push({
-        fullName: bm.repo.fullName,
-        newReleases: releases.filter(isNew),
-      });
+      cache[fullName] = { checkedAt: Date.now(), etag, releases };
+      return { fullName, newReleases: releases.filter(isNew) };
     } catch (err) {
-      results.push({
-        fullName: bm.repo.fullName,
-        newReleases: [],
-        error: (err as Error).message,
-      });
+      return { fullName, newReleases: [], error: (err as Error).message };
     }
+  };
+
+  // Run in small batches rather than one-at-a-time: a serial loop over every
+  // bookmark spends all its time waiting on the network, and bursts straight
+  // through the unauthenticated rate limit.
+  for (let i = 0; i < bookmarks.length; i += CONCURRENCY) {
+    const batch = bookmarks
+      .slice(i, i + CONCURRENCY)
+      .map((bm) => checkOne(bm.repo.fullName));
+    results.push(...(await Promise.all(batch)));
   }
 
   saveCache(cache);
@@ -158,9 +160,9 @@ export function allCachedReleases(): Array<
   TrackedRelease & { fullName: string }
 > {
   const cache = loadCache();
-  const bookmarks = getBookmarks();
+  const bookmarked = new Set(getBookmarks().map((b) => b.repo.fullName));
   return Object.entries(cache)
-    .filter(([fullName]) => bookmarks.some((b) => b.repo.fullName === fullName))
+    .filter(([fullName]) => bookmarked.has(fullName))
     .flatMap(([fullName, s]) => s.releases.map((r) => ({ ...r, fullName })))
     .sort(
       (a, b) =>

package/src/search.ts

@@ -15,7 +15,13 @@ import type {
   SortStrategy,
   CacheEntry,
 } from "./types";
-import { NetworkError, RateLimitError, ParseError } from "./errors";
+import {
+  NetworkError,
+  RateLimitError,
+  ParseError,
+  AuthError,
+  ForbiddenError,
+} from "./errors";
 import { parseTrendingHtml, type RawTrendingRepo } from "./trending-parser";
 
 export interface Logger {
@@ -58,6 +64,10 @@ export class MemoryCache<T> {
   }
 
   set(key: string, data: T, ttlMs?: number): void {
+    // Re-inserting an existing key must move it to the end of the
+    // insertion-ordered Map, otherwise a refreshed entry keeps its original
+    // position and is the first one evicted — FIFO instead of LRU.
+    this.cache.delete(key);
     if (this.cache.size >= MAX_CACHE_SIZE) {
       const firstKey = this.cache.keys().next().value;
       if (firstKey !== undefined) this.cache.delete(firstKey);
@@ -444,7 +454,14 @@ export class GitHubSearchAdapter implements SearchAdapter {
             this.logger.error(
               `[github] non-rate-limit 403: ${body.slice(0, 200)}`,
             );
-            throw new NetworkError();
+            throw new ForbiddenError();
+          }
+          if (res.status === 401) {
+            const body = await res.text().catch(() => "");
+            this.logger.error(
+              `[github] auth rejected (401): ${body.slice(0, 200)}`,
+            );
+            throw new AuthError();
           }
           if (!res.ok) {
             const body = await res.text().catch(() => "");
@@ -488,6 +505,10 @@ export class GitHubSearchAdapter implements SearchAdapter {
           lastErr = undefined;
           break;
         } catch (err) {
+          // RateLimitError must propagate: swallowing it turns the failure
+          // into a silent zero-result "success" and the user never learns
+          // why their search died.
+          if (err instanceof RateLimitError) throw err;
           lastErr = err as Error;
           if (rateLimited) break;
         }

package/src/session.ts

@@ -6,9 +6,63 @@ import { readJSON, writeJSON } from "./storage";
 
 const SESSION_FILE = "session.json";
 
+/** Upper bound for a plausible search query; anything longer is garbage. */
+const MAX_QUERY_LENGTH = 200;
+
+/**
+ * Drop JSON-shaped or oversized queries. A search line is never raw JSON
+ * (objects/arrays always arrive as paste payloads — e.g. an MCP handshake
+ * request that a client piped into the TUI) and never thousands of chars,
+ * so such a "query" is corruption, not intent. The TUI's input handler
+ * applies the same shape rule to live pastes.
+ */
+export function sanitizeQuery(query: unknown): string | undefined {
+  if (typeof query !== "string") return undefined;
+  const trimmed = query.trim();
+  if (trimmed.length === 0 || trimmed.length > MAX_QUERY_LENGTH) {
+    return undefined;
+  }
+  if (
+    (trimmed.startsWith("{") && trimmed.endsWith("}")) ||
+    (trimmed.startsWith("[") && trimmed.endsWith("]"))
+  ) {
+    return undefined;
+  }
+  return trimmed;
+}
+
+/** Keep only well-formed, known-good fields from a session snapshot. */
+export function sanitizeSession(
+  state: SessionState | null | undefined,
+): SessionState | null {
+  if (!state || typeof state !== "object") return null;
+  const mode =
+    state.mode === "trending" ||
+    state.mode === "packages" ||
+    state.mode === "search"
+      ? state.mode
+      : "search";
+  const trendingTab =
+    typeof state.trendingTab === "string" && state.trendingTab.length > 0
+      ? state.trendingTab
+      : "This Week";
+  const limit =
+    typeof state.limit === "number" && Number.isFinite(state.limit)
+      ? state.limit
+      : 50;
+  const sort = typeof state.sort === "string" ? state.sort : "best-match";
+  return {
+    mode,
+    query: sanitizeQuery(state.query) ?? "",
+    sort,
+    limit,
+    trendingTab,
+  };
+}
+
 export function saveSession(state: SessionState): void {
   try {
-    writeJSON(SESSION_FILE, state);
+    writeJSON(SESSION_FILE, sanitizeSession(state));
   } catch (err) {
     if (process.env.DEBUG)
       console.error(
@@ -18,7 +72,9 @@ export function saveSession(state: SessionState): void {
 }
 
 export function restoreSession(): SessionState | null {
-  return readJSON<SessionState | null>(SESSION_FILE, null);
+  // Anything read from disk passes the same sanitizer as anything written —
+  // protects against files corrupted before this guard existed.
+  return sanitizeSession(readJSON<SessionState | null>(SESSION_FILE, null));
 }
 
 export function clearSession(): void {

package/src/skill-finder.ts

@@ -80,6 +80,13 @@ export const MIN_QUERY_LENGTH = 2;
 /** Result cap, applied to both sources. */
 export const MAX_SKILL_RESULTS = 100;
 
+/**
+ * The only shape accepted for registry `source` / `skillId`. Both end up
+ * inside a shell command (`npx skills add …`) that an agent is expected to
+ * run, so anything with shell metacharacters is rejected outright.
+ */
+const SAFE_ID_RE = /^[A-Za-z0-9._/-]+$/;
+
 // ─── Local roots ──────────────────────────────────────────────────────────
 
 /** One scan root: where it is, and the label results carry. */
@@ -193,6 +200,9 @@ export function parseSkillFrontmatter(
 
 // ─── Local scan ───────────────────────────────────────────────────────────
 
+/** Memoised scan results, keyed by root path + label. */
+const scanCache = new Map<string, LocalSkillHit[]>();
+
 /**
  * Walk the roots and collect every readable SKILL.md, de-duplicated by name.
  *
@@ -203,6 +213,12 @@ export function parseSkillFrontmatter(
 export function scanLocalSkills(
   roots: SkillRoot[] = resolveSkillRoots(),
 ): LocalSkillHit[] {
+  // The filesystem does not change within a process, so a repeat scan is pure
+  // duplicate blocking I/O. Keyed on the roots so callers passing their own
+  // roots (tests, GHFIND_SKILL_ROOTS) still get a distinct cache entry.
+  const key = roots.map((r) => `${r.path}\u0000${r.label}`).join("\u0001");
+  const cached = scanCache.get(key);
+  if (cached) return cached;
   const byName = new Map<string, LocalSkillHit>();
   for (const root of roots) {
     for (const dir of walkDirs(root.path)) {
@@ -224,7 +240,9 @@ export function scanLocalSkills(
       }
     }
   }
-  return [...byName.values()];
+  const hits = [...byName.values()];
+  scanCache.set(key, hits);
+  return hits;
 }
 
 /** Directory entries, or null when the directory is missing or unreadable. */
@@ -326,7 +344,20 @@ function normalizeRegistrySkill(raw: unknown): RegistrySkillHit | null {
   const obj = raw as Record<string, unknown>;
   const source = typeof obj.source === "string" ? obj.source : "";
   const skillId = typeof obj.skillId === "string" ? obj.skillId : "";
-  if (!source || !skillId) return null;
+  // The registry is untrusted input and these two are interpolated into a
+  // shell command and a URL handed to an agent, so anything but a plain
+  // owner/repo + skill-id shape is dropped rather than escaped.
+  // `SAFE_ID_RE` allows `/` and `.`, so `../` passes it — reject traversal
+  // segments explicitly; they would land in the URL path and the npx command.
+  const hasTraversal = (s: string) => s === ".." || s.includes("..");
+  if (
+    !SAFE_ID_RE.test(source) ||
+    !SAFE_ID_RE.test(skillId) ||
+    hasTraversal(source) ||
+    hasTraversal(skillId)
+  ) {
+    return null;
+  }
   const name =
     typeof obj.name === "string" && obj.name.trim() ? obj.name : skillId;
   const installs = typeof obj.installs === "number" ? obj.installs : 0;

package/src/storage.ts

@@ -2,16 +2,15 @@
  * Storage adapter — single point of file I/O for state files.
  *
  * All domain modules (history, bookmarks, saved-searches, notifications,
- * session, config) delegate file I/O here. Swap for an in-memory
- * implementation in tests.
+ * session, config) delegate file I/O here.
  */
 import {
-  existsSync,
   mkdirSync,
   readFileSync,
   writeFileSync,
   appendFileSync,
   unlinkSync,
+  renameSync,
 } from "node:fs";
 import { join } from "node:path";
 import { stateDir } from "./config";
@@ -31,10 +30,27 @@ export function readJSON<T>(filename: string, fallback: T): T {
   }
 }
 
+/** Write a file atomically: temp file in the same dir, then rename. */
+function writeFileAtomic(filename: string, data: string): void {
+  ensureDir();
+  const target = join(stateDir(), filename);
+  const tmp = `${target}.tmp-${process.pid}`;
+  try {
+    writeFileSync(tmp, data, "utf-8");
+    renameSync(tmp, target);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+      // temp already gone
+    }
+    throw e;
+  }
+}
+
 /** Write data as JSON to a file. */
 export function writeJSON(filename: string, data: unknown): void {
-  ensureDir();
-  writeFileSync(join(stateDir(), filename), JSON.stringify(data, null, 2));
+  writeFileAtomic(filename, JSON.stringify(data, null, 2));
 }
 
 /** Append one JSON object as a line to a JSONL file. */
@@ -68,8 +84,7 @@ export function readJSONL<T>(filename: string): T[] {
 
 /** Write raw text to a file (bypasses JSON encoding). */
 export function writeRaw(filename: string, data: string): void {
-  ensureDir();
-  writeFileSync(join(stateDir(), filename), data);
+  writeFileAtomic(filename, data);
 }
 
 /** Delete a file if it exists. */
@@ -94,43 +109,3 @@ export function debugLog(msg: string): void {
     /* ignore */
   }
 }
-
-/** Check if a file exists in the state dir. */
-export function fileExists(filename: string): boolean {
-  return existsSync(join(stateDir(), filename));
-}
-
-// ─── In-memory implementation for tests ────────────────────────────────
-
-const memStore = new Map<string, string>();
-
-export const memoryStorage = {
-  readJSON<T>(filename: string, fallback: T): T {
-    const raw = memStore.get(filename);
-    if (!raw) return fallback;
-    try {
-      return JSON.parse(raw) as T;
-    } catch {
-      return fallback;
-    }
-  },
-  writeJSON(filename: string, data: unknown): void {
-    memStore.set(filename, JSON.stringify(data, null, 2));
-  },
-  appendJSONL(filename: string, obj: unknown): void {
-    const existing = memStore.get(filename) ?? "";
-    memStore.set(filename, `${existing + JSON.stringify(obj)}\n`);
-  },
-  readJSONL<T>(filename: string): T[] {
-    const raw = memStore.get(filename);
-    if (!raw) return [];
-    return raw
-      .trim()
-      .split("\n")
-      .filter(Boolean)
-      .map((l) => JSON.parse(l) as T);
-  },
-  clear(): void {
-    memStore.clear();
-  },
-};