
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@johnlindquist/ghi
Advanced tools
ghi is a powerful command‑line tool for deep analysis of GitHub repositories and local directories. It scans your codebase to generate detailed markdown reports that include a summary, a visual directory tree, file metadata, and (optionally) file contents. Use it to quickly understand new projects, generate documentation, or integrate into your CI/CD workflows.
Note: ghi supports both GitHub URLs (by cloning or updating a cached repository) and local directories. It can also generate dependency graphs for projects using tools like madge.
Use your favorite package manager to install ghi globally. For example, with pnpm:
pnpm add -g ghi
Or with npm:
npm install -g @johnlindquist/ghi
The general usage syntax is:
ghi [options] <repo-or-path>
Where <repo-or-path>
can be a GitHub repository URL or a local directory path.
Clone and analyze the repository on the default branch (usually main
):
ghi https://github.com/owner/repo
Scan a local directory with default settings:
ghi /path/to/local/project
Include only specific files (e.g. only TypeScript files) and/or exclude unwanted files:
ghi /path/to/project --include "*.ts,*.tsx" --exclude "*.spec.*,node_modules"
Find Mode (OR behavior): Find files whose names or content contain any of the search terms:
ghi /path/to/project --find "console,debug"
Require Mode (AND behavior): Only return files that contain all specified terms in their content:
ghi /path/to/project --require "console,log"
You can combine --find
and --require
to further fine‑tune the selection.
Branch Checkout:
ghi https://github.com/owner/repo --branch develop
Commit Checkout:
ghi https://github.com/owner/repo --commit a1b2c3d
(When using branch or commit options, ghi will perform the necessary Git operations either with the built‑in git library or using your system’s Git if --use-regular-git
is specified.)
Analyze a project’s dependency structure starting from a given entry file:
ghi /path/to/project --graph /path/to/project/src/index.js
The output includes a tree‑formatted dependency graph and the content of the related files.
Pipe Mode: Output the digest directly to STDOUT rather than opening an editor.
ghi /path/to/project --pipe
Open in Editor: Automatically open the results file in your preferred editor. On first use, you will be prompted to configure your editor command (e.g. code
, vim
, or nano
):
ghi /path/to/project --open
Clipboard Support: Copy the results to your clipboard automatically:
ghi /path/to/project --clipboard
Append AI instructions at the end of the output to generate a single shell script that will recreate the file structure and content:
ghi /path/to/project --bulk --pipe
Debug Mode: Output extra debug logs to help troubleshoot issues.
ghi /path/to/project --debug
Verbose Mode: Include full file contents in the digest (useful for detailed analysis or troubleshooting).
ghi /path/to/project --verbose
By default, ghi will read and apply .gitignore
rules (and other common ignore patterns) to exclude build artifacts and cache files. To disable this behavior:
ghi /path/to/project --ignore=false
Below is a summary of the available options:
Flag(s) | Description |
---|---|
--include, -i | Glob or path patterns to include (comma‑separated or repeatable). |
--exclude, -e | Glob or path patterns to exclude (comma‑separated or repeatable). |
--find, -f | Return files that contain any of these terms (searches file names and content). |
--require, -r | Return files that contain all of these terms in their content. |
--branch, -b | Git branch to clone or check out when analyzing a repository URL. |
--commit, -c | Specific commit SHA to check out when analyzing a repository URL. |
--max-size, -s | Maximum file size (in bytes) to process per file (default: 10 MB). Files exceeding this limit show a placeholder. |
--pipe, -p | Pipe the final output to STDOUT (useful for scripting or CI). |
--open, -o | Open the generated results file in your configured editor. |
--debug | Enable detailed debug logging. |
--verbose | Include detailed file contents in the digest. |
--bulk, -k | Append AI processing instructions for generating a shell script that rebuilds the file structure. |
--ignore | Whether to honor .gitignore rules (default: true). Use --ignore=false to disable. |
--skip-artifacts | Skip dependency files, build artifacts, and generated assets (default: true). |
--clipboard, -y | Copy the results to your clipboard. |
--no-editor, -n | Save the results file but do not open it in an editor. |
--use-regular-git | Use the system’s Git commands rather than a library-based Git client. |
--graph, -g | Analyze a dependency graph starting from the specified entry file. |
When ghi runs, it generates a markdown file containing:
--bulk
.)The results file is saved to a system‑specific configuration directory:
~/Library/Preferences/ghi/config/
~/.config/ghi/config/
%APPDATA%/ghi/config/
If you run with the --pipe
flag, the digest is printed to STDOUT as well as saved.
On first use with the --open
flag, you’ll be prompted to enter your preferred editor command (e.g., code
for VS Code, vim
, or nano
). Your selection is saved for future runs.
To contribute or run ghi locally:
Clone the Repository:
git clone https://github.com/johnlindquist/ghi.git
cd ghi
Install Dependencies:
pnpm install
Run in Development Mode:
You can run the CLI directly using:
pnpm node src/index.ts [options] <repo-or-path>
Build:
pnpm build
Run Tests:
ghi uses Vitest for testing:
pnpm test
This project is licensed under the MIT License. See LICENSE for details.
By covering all of these scenarios and options, ghi provides a flexible solution for codebase analysis, whether you are exploring a new GitHub repository or need to generate comprehensive reports on local projects. Happy analyzing!
FAQs
Ingest GitHub repositories and local directories for analysis
The npm package @johnlindquist/ghi receives a total of 0 weekly downloads. As such, @johnlindquist/ghi popularity was classified as not popular.
We found that @johnlindquist/ghi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.