chore: bump to v0.4.5 with changelog

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Author: mickmicksh

CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to LAP (Lean API Platform) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.5] - 2026-03-12
+
+### Added
+- **Registry search**: `lapsh search <query>` -- search the LAP registry for APIs
+  - Supports `--tag`, `--sort`, `--limit`, `--offset`, `--json` flags
+  - Output sanitization against ANSI injection from server responses
+  - Pagination hints when more results available
+- **TypeScript SDK search**: `LAPClient.search()` method for registry search
+- **Search test coverage**: 64 Python tests + 6 TypeScript tests
+
+### Fixed
+- TS SDK `fromRegistry()` used wrong URL path (`/specs/` -> `/v1/apis/`)
+- TypeScript SDK `SearchResponse` type and parser exports
+
 ## [0.4.2] - 2026-03-10
 
 ### Fixed

lap/__init__.py

@@ -1,3 +1,3 @@
 """LAP -- Lean API Platform. Token-efficient API specs for AI agents."""
 
-__version__ = "0.4.4"
+__version__ = "0.4.5"

lap/cli/main.py

@@ -9,6 +9,7 @@
 import glob
 import json
 import os
+import re
 import sys
 from contextlib import contextmanager
 from pathlib import Path
@@ -29,6 +30,31 @@
     console = None
 
 
+# ── Security helpers ─────────────────────────────────────────────────
+
+_ANSI_ESCAPE = re.compile(r'\x1b(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])')
+_CTRL_CHARS  = re.compile(r'[\x00-\x08\x0b-\x1f\x7f]')
+
+def _sanitize(s: str) -> str:
+    """Strip ANSI escapes and control characters from server-supplied strings."""
+    return _CTRL_CHARS.sub('', _ANSI_ESCAPE.sub('', s))
+
+def _validate_search_response(result):
+    """Validate registry response shape before field access."""
+    if not isinstance(result, dict):
+        error("Unexpected response format from registry.")
+    results = result.get("results", [])
+    if not isinstance(results, list):
+        error("Registry returned malformed results.")
+    for r in results:
+        if not isinstance(r, dict):
+            error("Registry returned malformed result entry.")
+    if not isinstance(result.get("total", 0), int):
+        result["total"] = len(results)
+    if not isinstance(result.get("offset", 0), int):
+        result["offset"] = 0
+
+
 # ── Helpers ──────────────────────────────────────────────────────────
 
 def info(msg):
@@ -684,6 +710,78 @@ def cmd_skill_install(args):
     info(f"Installed {len(files)} files to {install_dir}")
 
 
+def _format_search_results(results, total, offset):
+    """Format and print search results."""
+    rows = []
+    for r in results:
+        name = _sanitize(r.get("name", ""))
+        desc = _sanitize(r.get("description", ""))
+        ep = r.get("endpoints")
+        ep_str = f"{ep} endpoints" if isinstance(ep, int) else ""
+        size = r.get("size", 0)
+        lean = r.get("lean_size")
+        if isinstance(size, (int, float)) and isinstance(lean, (int, float)) and lean:
+            ratio_str = f"{size / lean:.1f}x compressed"
+        else:
+            ratio_str = ""
+        skill = " [skill]" if r.get("has_skill") else ""
+        rows.append((name, ep_str, ratio_str, desc, skill))
+
+    name_w = max((len(r[0]) for r in rows), default=0)
+    ep_w = max((len(r[1]) for r in rows), default=0)
+    ratio_w = max((len(r[2]) for r in rows), default=0)
+
+    for name, ep_str, ratio_str, desc, skill in rows:
+        print(f"  {name:<{name_w}}  {ep_str:>{ep_w}}  {ratio_str:>{ratio_w}}   {desc}{skill}")
+
+    shown = offset + len(results)
+    if shown < total:
+        info(f"Showing {shown}/{total} results. Use --offset {shown} for more.")
+
+
+def cmd_search(args):
+    """Search the LAP registry for APIs. No auth required."""
+    from lap.cli.auth import api_request
+    from urllib.parse import urlencode
+
+    query = " ".join(args.query)
+    if not query.strip():
+        error("Please provide a search query.")
+
+    params = {"q": query}
+    if args.tag:
+        params["tag"] = args.tag
+    if args.sort:
+        params["sort"] = args.sort
+    if args.limit is not None:
+        params["limit"] = str(args.limit)
+    if args.offset is not None:
+        params["offset"] = str(args.offset)
+
+    try:
+        result = api_request("GET", f"/v1/search?{urlencode(params)}")
+    except SystemExit:
+        raise
+    except Exception as e:
+        error(f"Search failed: {e}")
+
+    _validate_search_response(result)
+
+    results = result.get("results", [])
+    total = result.get("total", len(results))
+    offset = result.get("offset", 0)
+
+    if args.json:
+        print(json.dumps(result, indent=2, ensure_ascii=True))
+        return
+
+    if not results:
+        info(f"No results for '{query}'.")
+        return
+
+    _format_search_results(results, total, offset)
+
+
 def cmd_benchmark_skill(args):
     """Benchmark skill token usage for a spec."""
     from lap.core.compilers import compile as compile_spec
@@ -936,6 +1034,15 @@ def main():
     p.add_argument("name", help="API name from the registry")
     p.add_argument("--dir", help="Custom install directory (default: ~/.claude/skills/)")
 
+    # search
+    p = sub.add_parser("search", help="Search the LAP registry for APIs")
+    p.add_argument("query", nargs="+", help="Search query")
+    p.add_argument("--tag", help="Filter by tag")
+    p.add_argument("--sort", choices=["relevance", "popularity", "date"], help="Sort order")
+    p.add_argument("--limit", type=int, help="Max results (default: 50)")
+    p.add_argument("--offset", type=int, help="Pagination offset")
+    p.add_argument("--json", action="store_true", help="Output raw JSON")
+
     # benchmark-skill
     p = sub.add_parser("benchmark-skill", help="Benchmark skill token usage for a spec")
     p.add_argument("spec", help="Path to API spec file")
@@ -959,6 +1066,7 @@ def main():
         "skill": cmd_skill,
         "skill-batch": cmd_skill_batch,
         "skill-install": cmd_skill_install,
+        "search": cmd_search,
         "benchmark-skill": cmd_benchmark_skill,
         "benchmark-skill-all": cmd_benchmark_skill_all,
     }

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "lapsh"
-version = "0.4.4"
+version = "0.4.5"
 description = "Lean API Platform -- Token-efficient API specs for AI agents"
 readme = "README.md"
 license = "Apache-2.0"

sdks/typescript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lap-platform/lapsh",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "TypeScript SDK for LAP (Lean API Platform) -- Parse and work with LAP API specifications",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",

sdks/typescript/src/client.ts

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as http from 'http';
 import * as https from 'https';
-import { parse, LAPSpec } from './parser';
+import { parse, LAPSpec, SearchResponse } from './parser';
 
 export interface ToContextOptions {
   lean?: boolean;
@@ -19,15 +19,32 @@ export class LAPClient {
   }
 
   async fromRegistry(registryUrl: string, apiName: string): Promise<LAPSpec> {
-    const url = `${registryUrl.replace(/\/$/, '')}/specs/${encodeURIComponent(apiName)}`;
+    const url = `${registryUrl.replace(/\/$/, '')}/v1/apis/${encodeURIComponent(apiName)}`;
     const text = await this._fetch(url);
     return parse(text);
   }
 
-  private _fetch(url: string): Promise<string> {
+  async search(
+    registryUrl: string,
+    query: string,
+    options?: { tag?: string; sort?: string; limit?: number; offset?: number }
+  ): Promise<SearchResponse> {
+    const params = new URLSearchParams({ q: query });
+    if (options?.tag) params.set('tag', options.tag);
+    if (options?.sort) params.set('sort', options.sort);
+    if (options?.limit !== undefined) params.set('limit', String(options.limit));
+    if (options?.offset !== undefined) params.set('offset', String(options.offset));
+
+    const url = `${registryUrl.replace(/\/$/, '')}/v1/search?${params}`;
+    const text = await this._fetch(url, { Accept: 'application/json' });
+    return JSON.parse(text) as SearchResponse;
+  }
+
+  private _fetch(url: string, headers?: Record<string, string>): Promise<string> {
     return new Promise((resolve, reject) => {
       const mod = url.startsWith('https') ? https : http;
-      mod.get(url, res => {
+      const options = headers ? { headers } : {};
+      mod.get(url, options, res => {
         let data = '';
         res.on('data', chunk => data += chunk);
         res.on('end', () => {

sdks/typescript/src/index.ts

@@ -6,6 +6,8 @@ export {
   ResponseSchema,
   ResponseField,
   ErrorSchema,
+  SearchResult,
+  SearchResponse,
 } from './parser';
 
 export { LAPClient, toContext, ToContextOptions } from './client';

sdks/typescript/src/parser.ts

@@ -290,6 +290,32 @@ function parseErrors(line: string): ErrorSchema[] {
   });
 }
 
+export interface SearchResult {
+  name: string;
+  description: string;
+  version: string;
+  base_url: string;
+  endpoints: number;
+  tags: string[];
+  size: number;
+  lean_size: number | null;
+  has_skill: boolean;
+  skill_size: number | null;
+  provider: { slug: string; display_name: string; domain: string };
+  source_url: string;
+  last_updated: string;
+  is_community: boolean;
+}
+
+export interface SearchResponse {
+  query: string;
+  results: SearchResult[];
+  total: number;
+  limit: number;
+  offset: number;
+  has_more: boolean;
+}
+
 export function parse(text: string): LAPSpec {
   const lines = text.split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('//'));
 

sdks/typescript/tests/search.test.ts

@@ -0,0 +1,95 @@
+import { describe, it, before, after } from 'node:test';
+import * as assert from 'node:assert';
+import * as http from 'node:http';
+import { LAPClient } from '../src/client';
+
+describe('LAPClient.search', () => {
+  let server: http.Server;
+  let baseUrl: string;
+  let captured: { url?: string; headers?: http.IncomingHttpHeaders };
+  let mockStatus = 200;
+  let mockBody = JSON.stringify({
+    query: 'test',
+    results: [],
+    total: 0,
+    limit: 20,
+    offset: 0,
+    has_more: false,
+  });
+
+  before(async () => {
+    server = http.createServer((req, res) => {
+      captured = { url: req.url, headers: req.headers };
+      res.writeHead(mockStatus, { 'Content-Type': 'application/json' });
+      res.end(mockBody);
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const addr = server.address() as { port: number };
+    baseUrl = `http://127.0.0.1:${addr.port}`;
+  });
+
+  after(() => {
+    server.close();
+  });
+
+  it('builds correct URL with query only', async () => {
+    const client = new LAPClient();
+    await client.search(baseUrl, 'stripe');
+    assert.ok(captured.url);
+    assert.strictEqual(captured.url, '/v1/search?q=stripe');
+  });
+
+  it('builds correct URL with all options', async () => {
+    const client = new LAPClient();
+    await client.search(baseUrl, 'stripe', { tag: 'pay', sort: 'popularity', limit: 5, offset: 10 });
+    assert.ok(captured.url);
+    const params = new URL(captured.url, baseUrl).searchParams;
+    assert.strictEqual(params.get('q'), 'stripe');
+    assert.strictEqual(params.get('tag'), 'pay');
+    assert.strictEqual(params.get('sort'), 'popularity');
+    assert.strictEqual(params.get('limit'), '5');
+    assert.strictEqual(params.get('offset'), '10');
+  });
+
+  it('sends Accept: application/json header', async () => {
+    const client = new LAPClient();
+    await client.search(baseUrl, 'test');
+    assert.ok(captured.headers);
+    assert.strictEqual(captured.headers.accept, 'application/json');
+  });
+
+  it('parses JSON response correctly', async () => {
+    const canned = {
+      query: 'stripe',
+      results: [{ name: 'Stripe', description: 'Payments', endpoints: 587 }],
+      total: 1,
+      limit: 20,
+      offset: 0,
+      has_more: false,
+    };
+    mockBody = JSON.stringify(canned);
+    const client = new LAPClient();
+    const result = await client.search(baseUrl, 'stripe');
+    assert.strictEqual(result.query, 'stripe');
+    assert.strictEqual(result.results.length, 1);
+    assert.strictEqual(result.results[0].name, 'Stripe');
+    assert.strictEqual(result.total, 1);
+    // Reset
+    mockBody = JSON.stringify({ query: 'test', results: [], total: 0, limit: 20, offset: 0, has_more: false });
+  });
+
+  it('rejects on server error', async () => {
+    mockStatus = 500;
+    const client = new LAPClient();
+    await assert.rejects(() => client.search(baseUrl, 'fail'), /500/);
+    mockStatus = 200;
+  });
+
+  it('strips trailing slash from registryUrl', async () => {
+    const client = new LAPClient();
+    await client.search(baseUrl + '/', 'test');
+    assert.ok(captured.url);
+    assert.ok(!captured.url.startsWith('//'), 'URL should not have double slash');
+    assert.ok(captured.url.startsWith('/v1/search'), 'URL should start with /v1/search');
+  });
+});