From 4fb1c8f43d37ddb7bf05838377ff2b6a54a846eb Mon Sep 17 00:00:00 2001
From: retoor <retoor@molodetz.nl>
Date: Sat, 13 Jun 2026 15:24:48 +0200
Subject: [PATCH] Update

---
 AGENTS.md                                    |  9 +++
 CLAUDE.md                                    |  3 +-
 README.md                                    |  5 +-
 devplacepy/database.py                       | 10 +++
 devplacepy/docs_api.py                       | 16 ++++
 devplacepy/routers/feed.py                   | 24 +++++-
 devplacepy/routers/gists.py                  | 19 +++--
 devplacepy/routers/projects.py               |  9 +--
 devplacepy/schemas.py                        |  2 +
 devplacepy/services/devii/actions/catalog.py |  2 +
 devplacepy/templates/feed.html               |  2 +
 devplacepy/templates/gists.html              |  2 +
 devplacepy/templates/projects.html           |  7 +-
 tests/test_feed.py                           | 78 ++++++++++++++++++++
 tests/test_gists.py                          | 75 +++++++++++++++++++
 15 files changed, 240 insertions(+), 23 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 792d7b46..d1ca7094 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1483,6 +1483,15 @@ Both the home page Latest Posts section and the main `/feed` cap how many posts
 
 When building any new "recent items" list, reuse these instead of raw `find(order_by=...)` / `paginate`.
 
+## Listing search (feed, gists, projects)
+
+The three public listings - `/feed`, `/gists`, `/projects` - share one free-text search box at the top of the left filter panel. Two reuse points keep it DRY and consistent:
+
+- **Data layer:** `database.text_search_clause(table, search, fields=("title", "description"))` returns a single SQLAlchemy `or_(col.ilike("%term%") ...)` clause over the given columns (skipping any not present on the table), or `None` when `search` is blank or the table does not exist yet. Append it as a positional clause to `paginate` / `paginate_diverse` / `table.count(...)` **only when not None** (no search leaves the queries unchanged). Field mapping: projects/gists use `("title", "description")`, posts use `("title", "content")`. `projects.py`, `gists.py`, and `feed.py` all call it; never re-inline an `ilike` search clause.
+- **View layer:** `templates/_sidebar_search.html` is the single search-box partial (the `Filter` heading + the GET form). Include it at the very top of `<aside class="sidebar-card">` with three locals: `_action` (the listing URL), `_placeholder`, and `_hidden` (a dict of `name -> value` rendered as hidden inputs so the active category/tab filter survives a search submit - e.g. `{"tab": current_tab, "topic": current_topic}` for the feed). It reads the `search` context var for the current value. Any future listing with a left filter panel reuses this partial plus `text_search_clause`; do not hand-roll another search form.
+
+The `search` value is threaded back into each listing's context and exposed on `FeedOut.search` / `GistsOut.search` / `ProjectsOut.search`, documented as a `search` query param on the `feed-list` / `gists-list` / `projects-list` endpoints in `docs_api.py`, and offered to Devii as the `search` query param on `view_feed` / `list_gists` / `list_projects`.
+
 ## Landing Page News
 
 Articles can be toggled to appear on the landing page via `/admin/news/{uid}/landing`:
diff --git a/CLAUDE.md b/CLAUDE.md
index 386754e0..ab1b1d8b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -59,7 +59,7 @@ Tests run on port 10501 with a tempfile SQLite DB and a dedicated `DEVPLACE_DATA
 ## Architecture
 
 ### Request pipeline
-`main.py` mounts `/static`, registers every router with its prefix, installs middlewares (`X-Robots-Tag`/`X-Content-Type-Options` security headers, a per-IP rate limit held in an in-process `defaultdict`, and a maintenance gate), and registers global 404/500 handlers that render `error.html` via the shared templates instance. The rate limit reads `rate_limit_per_minute` / `rate_limit_window_seconds` from `site_settings` (default 60/60s, floored to `max(1, …)`). The maintenance middleware short-circuits non-admin requests with a 503 `error.html` when `maintenance_mode="1"`, but always allows `/static`, `/avatar`, `/auth`, `/admin` and admin users so an operator can never lock themselves out.
+`main.py` mounts `/static`, registers every router with its prefix, installs middlewares (`X-Robots-Tag`/`X-Content-Type-Options` security headers, a per-IP rate limit held in an in-process `defaultdict`, and a maintenance gate), and registers global 404/500 handlers that render `error.html` via the shared templates instance. The rate limit reads `rate_limit_per_minute` / `rate_limit_window_seconds` from `site_settings` (default 60/60s, floored to `max(1, …)`). **It applies only to mutating methods (`POST`/`PUT`/`DELETE`/`PATCH`); reads (`GET`/`HEAD`) and the whole `/openai` gateway are exempt** - so a burst of `GET` requests is never throttled (verified against production: 400 concurrent `GET /` all `200`, while 150 concurrent `POST /auth/login` allowed exactly 60 then returned `429`). The bucket is keyed on the `X-Real-IP` header (set by the reverse proxy) falling back to `request.client.host`, and an over-limit request gets a `429` carrying `Retry-After: <window>` (HTML body, or the shared JSON error shape for `Accept: application/json` clients). The maintenance middleware short-circuits non-admin requests with a 503 `error.html` when `maintenance_mode="1"`, but always allows `/static`, `/avatar`, `/auth`, `/admin` and admin users so an operator can never lock themselves out.
 
 `@app.on_event("startup")` calls `init_db()` and, unless `DEVPLACE_DISABLE_SERVICES` is set, registers `NewsService` with `service_manager` and kicks off `start_all()` as an asyncio task. `@app.on_event("shutdown")` calls `service_manager.stop_all()`.
 
@@ -107,6 +107,7 @@ Docs (`routers/docs.py` `DOCS_PAGES`) entries take optional `admin: True` (hidde
 - **Shared frontend utilities (do not re-implement these):** `Http` (`static/js/Http.js`) is the single fetch helper (`getJson`, `sendForm`, and `send` which throws `error.message` on non-2xx or a `200 {ok:false}` body); every live-update loop uses `Poller` (`new Poller(fn, intervalMs, {pauseHidden})`); async-job status polls use `JobPoller.run(statusUrl, {onDone, onFailed, onTimeout})` (`ProjectForker`, `ZipDownloader`); click-to-POST engagement controllers (`VoteManager`/`ReactionBar`/`BookmarkManager`/`PollManager`) extend `OptimisticAction` and call `this.submit(url, params, errorTarget, render)`. Floating windows (container terminals and Devii) extend `FloatingWindow`. See `AGENTS.md` -> "Shared frontend utilities (DRY)".
 - CDN scripts in `base.html` (marked, highlight.js, emoji-picker-element) MUST use `defer` or `type="module"` - otherwise `wait_until="domcontentloaded"` in Playwright tests will time out.
 - For clickable avatars/usernames, reuse `templates/_avatar_link.html` and `templates/_user_link.html` via `{% include %}` with `_user`, `_size`, `_size_class` locals.
+- The three public listings (`/feed`, `/gists`, `/projects`) share one search box: the `templates/_sidebar_search.html` partial (included at the top of `.sidebar-card` with `_action`/`_placeholder`/`_hidden` locals) plus the `database.text_search_clause(table, search, fields)` data helper. Any new listing with a left filter panel reuses both - never re-inline an `ilike` search clause or hand-roll another search form. See `AGENTS.md` -> "Listing search".
 
 ### Content rendering pipeline
 `ContentRenderer.js` runs on every element with `data-render`, in this exact order: emoji shortcode → markdown via `marked` → **`DOMPurify.sanitize`** → `highlight.js` on `<pre><code>` → image URL → YouTube URL → autolink. Uses a `NodeIterator` that skips `CODE`/`PRE`/`SCRIPT`/`STYLE` so URLs inside code blocks are never rewritten.
diff --git a/README.md b/README.md
index 4ab53671..37f1cfc4 100644
--- a/README.md
+++ b/README.md
@@ -53,11 +53,12 @@ devplacepy/
 |--------|---------|
 | `/` | Home page: marketing splash for guests, personalized home (welcome, feed shortcut, latest posts, news) for signed-in users. Does not redirect. Latest-posts section shows at most two posts per author. |
 | `/auth` | Signup, login, logout, forgot/reset password |
-| `/feed` | Post feed with topic/tab filtering (public). Each page shows at most two posts per author. |
+| `/feed` | Post feed with topic/tab filtering and free-text `search` (title and content) in the left panel (public). Each page shows at most two posts per author. |
 | `/news` | Developer news listing, detail page with comments |
 | `/posts` | Post detail, creation |
+| `/gists` | Code gist listing, detail, creation, and editing; left panel offers language filtering and free-text `search` (title and description), public read |
 | `/comments` | Comment creation, deletion |
-| `/projects` | Project listing, creation, owner editing (`POST /projects/edit/{slug}`), and per-project visibility toggles: `POST /projects/{slug}/private` (owner-only visibility) and `POST /projects/{slug}/readonly` (immutable files) |
+| `/projects` | Project listing (left panel offers type filtering and free-text `search` over title and description), creation, owner editing (`POST /projects/edit/{slug}`), and per-project visibility toggles: `POST /projects/{slug}/private` (owner-only visibility) and `POST /projects/{slug}/readonly` (immutable files) |
 | `/projects/{slug}/files` | Per-project filesystem: directory and file CRUD, upload, inline editing, and line-range operations (`lines` read, `replace-lines`, `insert-lines`, `delete-lines`, `append`) for surgical edits to large text files (public read, owner write; all writes refused while the project is read-only) |
 | `/zips` | Zip job status (`/zips/{uid}`) and archive download (`/zips/{uid}/download`); archives are queued via `/projects/{slug}/zip` and `/projects/{slug}/files/zip` |
 | `/forks` | Fork job status (`/forks/{uid}`); forks are queued via `/projects/{slug}/fork`. Any signed-in user can fork a project they can view into a new project they own; once the job finishes the response carries the new project URL |
diff --git a/devplacepy/database.py b/devplacepy/database.py
index 47214525..d7ce3139 100644
--- a/devplacepy/database.py
+++ b/devplacepy/database.py
@@ -2,6 +2,7 @@
 
 import dataset
 import logging
+from sqlalchemy import or_
 from collections import defaultdict
 from datetime import datetime, timedelta, timezone
 from devplacepy.cache import TTLCache
@@ -2035,6 +2036,15 @@ def get_target_owner_uid(target_type: str, target_uid: str) -> str | None:
 PAGE_SIZE = 25
 
 
+def text_search_clause(table, search, fields=("title", "description")):
+    if not search or not search.strip() or not table.exists:
+        return None
+    columns = table.table.columns
+    like = f"%{search.strip()}%"
+    matches = [columns[field].ilike(like) for field in fields if field in columns]
+    return or_(*matches) if matches else None
+
+
 def paginate(
     table, *clauses, before=None, order=None, cursor_field="created_at", **filters
 ):
diff --git a/devplacepy/docs_api.py b/devplacepy/docs_api.py
index 1f066bbf..6bd7e029 100644
--- a/devplacepy/docs_api.py
+++ b/devplacepy/docs_api.py
@@ -719,6 +719,14 @@ four ways to sign requests.
                     field(
                         "topic", "query", "enum", False, "", "Filter by topic.", TOPICS
                     ),
+                    field(
+                        "search",
+                        "query",
+                        "string",
+                        False,
+                        "",
+                        "Search post title and content.",
+                    ),
                     field("before", "query", "string", False, "", "Pagination cursor."),
                 ],
             ),
@@ -1382,6 +1390,14 @@ four ways to sign requests.
                         "",
                         "Filter by author UID.",
                     ),
+                    field(
+                        "search",
+                        "query",
+                        "string",
+                        False,
+                        "",
+                        "Search gist title and description.",
+                    ),
                     field("before", "query", "string", False, "", "Pagination cursor."),
                 ],
             ),
diff --git a/devplacepy/routers/feed.py b/devplacepy/routers/feed.py
index d4aa2bc3..03c21042 100644
--- a/devplacepy/routers/feed.py
+++ b/devplacepy/routers/feed.py
@@ -15,6 +15,7 @@ from devplacepy.database import (
     get_user_bookmarks,
     get_polls_by_post_uids,
     paginate_diverse,
+    text_search_clause,
 )
 from devplacepy.attachments import get_attachments_batch
 from devplacepy.content import enrich_items
@@ -27,9 +28,13 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
-def get_feed_posts(user, tab: str = "all", topic: str = None, before: str = None):
+def get_feed_posts(
+    user, tab: str = "all", topic: str = None, search: str = "", before: str = None
+):
     posts_table = get_table("posts")
     order = ["-stars", "-created_at"] if tab == "trending" else ["-created_at"]
+    search_match = text_search_clause(posts_table, search, ("title", "content"))
+    search_clauses = [search_match] if search_match is not None else []
 
     if tab == "following":
         if not user:
@@ -44,6 +49,7 @@ def get_feed_posts(user, tab: str = "all", topic: str = None, before: str = None
         posts, next_cursor = paginate_diverse(
             posts_table,
             posts_table.table.columns.user_uid.in_(following),
+            *search_clauses,
             before=before,
             order=order,
             max_per_author=2,
@@ -51,7 +57,12 @@ def get_feed_posts(user, tab: str = "all", topic: str = None, before: str = None
     else:
         filters = {"topic": topic} if topic else {}
         posts, next_cursor = paginate_diverse(
-            posts_table, before=before, order=order, max_per_author=2, **filters
+            posts_table,
+            *search_clauses,
+            before=before,
+            order=order,
+            max_per_author=2,
+            **filters,
         )
 
     if not posts:
@@ -66,10 +77,14 @@ def get_feed_posts(user, tab: str = "all", topic: str = None, before: str = None
 
 @router.get("", response_class=HTMLResponse)
 async def feed_page(
-    request: Request, tab: str = "all", topic: str = None, before: str = None
+    request: Request,
+    tab: str = "all",
+    topic: str = None,
+    search: str = "",
+    before: str = None,
 ):
     user = get_current_user(request)
-    posts, next_cursor = get_feed_posts(user, tab, topic, before)
+    posts, next_cursor = get_feed_posts(user, tab, topic, search, before)
     stats = get_site_stats()
     top_authors = get_top_authors(5)
     daily_topic = get_daily_topic()
@@ -110,6 +125,7 @@ async def feed_page(
             "posts": posts,
             "current_tab": tab,
             "current_topic": topic,
+            "search": search,
             "total_members": stats["total_members"],
             "posts_today": stats["posts_today"],
             "total_projects": stats["total_projects"],
diff --git a/devplacepy/routers/gists.py b/devplacepy/routers/gists.py
index 4b6b3072..214d4266 100644
--- a/devplacepy/routers/gists.py
+++ b/devplacepy/routers/gists.py
@@ -10,6 +10,7 @@ from devplacepy.database import (
     get_users_by_uids,
     get_gist_languages,
     paginate,
+    text_search_clause,
 )
 from devplacepy.content import (
     load_detail,
@@ -67,7 +68,7 @@ LANGUAGES = [
 ]
 
 
-def get_gists_list(user_uid=None, language=None, before=None, viewer=None):
+def get_gists_list(user_uid=None, language=None, search="", before=None, viewer=None):
     gists_table = get_table("gists")
     filters = {}
     if user_uid:
@@ -75,8 +76,11 @@ def get_gists_list(user_uid=None, language=None, before=None, viewer=None):
     if language:
         filters["language"] = language
 
-    total = gists_table.count(deleted_at=None, **filters)
-    gists, next_cursor = paginate(gists_table, before=before, **filters)
+    search_match = text_search_clause(gists_table, search, ("title", "description"))
+    clauses = [search_match] if search_match is not None else []
+
+    total = gists_table.count(*clauses, deleted_at=None, **filters)
+    gists, next_cursor = paginate(gists_table, *clauses, before=before, **filters)
 
     if not gists:
         return [], next_cursor, total
@@ -87,11 +91,15 @@ def get_gists_list(user_uid=None, language=None, before=None, viewer=None):
 
 @router.get("", response_class=HTMLResponse)
 async def gists_page(
-    request: Request, language: str = None, user_uid: str = None, before: str = None
+    request: Request,
+    language: str = None,
+    user_uid: str = None,
+    search: str = "",
+    before: str = None,
 ):
     user = get_current_user(request)
     gists_list, next_cursor, total_count = get_gists_list(
-        user_uid, language, before, viewer=user
+        user_uid, language, search, before, viewer=user
     )
     seo_ctx = list_page_seo(
         request,
@@ -114,6 +122,7 @@ async def gists_page(
             "total_count": total_count,
             "next_cursor": next_cursor,
             "current_language": language,
+            "search": search,
             "languages": LANGUAGES,
             "gist_language_codes": get_gist_languages(),
         },
diff --git a/devplacepy/routers/projects.py b/devplacepy/routers/projects.py
index e3872f98..0ed39e01 100644
--- a/devplacepy/routers/projects.py
+++ b/devplacepy/routers/projects.py
@@ -12,6 +12,7 @@ from devplacepy.database import (
     get_site_stats,
     get_user_votes,
     paginate,
+    text_search_clause,
     resolve_by_slug,
     get_fork_parent,
     count_forks,
@@ -74,11 +75,9 @@ def get_projects_list(
     if projects.exists:
         columns = projects.table.columns
         clauses.append(columns.deleted_at.is_(None))
-        if search:
-            like = f"%{search}%"
-            clauses.append(
-                or_(columns.title.ilike(like), columns.description.ilike(like))
-            )
+        search_match = text_search_clause(projects, search, ("title", "description"))
+        if search_match is not None:
+            clauses.append(search_match)
         if not is_admin(viewer) and "is_private" in columns:
             visible = or_(columns.is_private.is_(None), columns.is_private == 0)
             if viewer:
diff --git a/devplacepy/schemas.py b/devplacepy/schemas.py
index 8de1dc67..135ef6c7 100644
--- a/devplacepy/schemas.py
+++ b/devplacepy/schemas.py
@@ -428,6 +428,7 @@ class FeedOut(_Out):
     posts: list[FeedItemOut] = []
     current_tab: Optional[str] = None
     current_topic: Optional[str] = None
+    search: Optional[str] = None
     next_cursor: Optional[str] = None
     total_members: Optional[int] = None
     posts_today: Optional[int] = None
@@ -488,6 +489,7 @@ class GistsOut(_Out):
     total_count: Optional[int] = None
     next_cursor: Optional[str] = None
     current_language: Optional[str] = None
+    search: Optional[str] = None
     languages: list[tuple[str, str]] = []
     gist_language_codes: list[str] = []
 
diff --git a/devplacepy/services/devii/actions/catalog.py b/devplacepy/services/devii/actions/catalog.py
index f3711e5d..75ed6707 100644
--- a/devplacepy/services/devii/actions/catalog.py
+++ b/devplacepy/services/devii/actions/catalog.py
@@ -112,6 +112,7 @@ ACTIONS: tuple[Action, ...] = (
         params=(
             query("tab", "Feed tab to view."),
             query("topic", "Filter by topic."),
+            query("search", "Search post title and content."),
             query("before", "Pagination cursor."),
         ),
     ),
@@ -888,6 +889,7 @@ ACTIONS: tuple[Action, ...] = (
         params=(
             query("language", "Filter by language."),
             query("user_uid", "Filter by owner uid."),
+            query("search", "Search gist title and description."),
             query("before", "Pagination cursor."),
         ),
     ),
diff --git a/devplacepy/templates/feed.html b/devplacepy/templates/feed.html
index 37b73afb..712495fa 100644
--- a/devplacepy/templates/feed.html
+++ b/devplacepy/templates/feed.html
@@ -9,6 +9,8 @@
 <h1 class="sr-only">Feed</h1>
 <div class="feed-layout">
     <aside class="sidebar-card">
+        {% set _action = "/feed" %}{% set _placeholder = "Search posts..." %}{% set _hidden = {"tab": current_tab, "topic": current_topic} %}{% include "_sidebar_search.html" %}
+
         <div class="sidebar-heading">Topics</div>
         <div class="sidebar-nav">
             <a href="/feed" class="sidebar-link {% if not current_topic %}active{% endif %}">
diff --git a/devplacepy/templates/gists.html b/devplacepy/templates/gists.html
index 540e2c15..fd54492f 100644
--- a/devplacepy/templates/gists.html
+++ b/devplacepy/templates/gists.html
@@ -10,6 +10,8 @@
 {% block content %}
 <div class="gists-layout">
     <aside class="sidebar-card">
+        {% set _action = "/gists" %}{% set _placeholder = "Search gists..." %}{% set _hidden = {"language": current_language, "user_uid": request.query_params.get('user_uid')} %}{% include "_sidebar_search.html" %}
+
         <div class="sidebar-heading">Languages</div>
         <div class="sidebar-nav">
             <a href="/gists" class="sidebar-link {% if not current_language %}active{% endif %}">
diff --git a/devplacepy/templates/projects.html b/devplacepy/templates/projects.html
index 053cd2b6..15c3ebce 100644
--- a/devplacepy/templates/projects.html
+++ b/devplacepy/templates/projects.html
@@ -8,12 +8,7 @@
 {% block content %}
 <div class="projects-layout">
     <aside class="sidebar-card">
-        <div class="sidebar-heading">Filter</div>
-        <div class="sidebar-section">
-            <form method="GET" action="/projects">
-                <input type="text" name="search" placeholder="Search projects..." value="{{ search }}">
-            </form>
-        </div>
+        {% set _action = "/projects" %}{% set _placeholder = "Search projects..." %}{% set _hidden = {"tab": current_tab, "project_type": project_type} %}{% include "_sidebar_search.html" %}
 
         <div class="sidebar-section">
             <div class="sidebar-heading">Type</div>
diff --git a/tests/test_feed.py b/tests/test_feed.py
index 4cfaaeed..fa3ad704 100644
--- a/tests/test_feed.py
+++ b/tests/test_feed.py
@@ -177,6 +177,84 @@ def test_feed_topic_filter_navigation(alice):
     page.wait_for_url(f"{BASE_URL}/feed?topic=devlog", wait_until="domcontentloaded")
 
 
+def _seed_searchable_posts():
+    token = uuid4().hex[:10]
+    users = get_table("users")
+    posts = get_table("posts")
+    base = datetime(2026, 1, 1, tzinfo=timezone.utc)
+    match_title = f"Findable post {token}"
+    other_title = f"Unrelated post {uuid4().hex[:10]}"
+    for offset, title in ((0, match_title), (1, other_title)):
+        owner = str(uuid4())
+        users.insert(
+            {
+                "uid": owner,
+                "username": f"srch_{owner[:8]}",
+                "email": f"{owner[:8]}@test.devplace",
+                "password_hash": "x",
+                "role": "Member",
+                "is_active": True,
+                "created_at": datetime.now(timezone.utc).isoformat(),
+            }
+        )
+        uid = str(uuid4())
+        posts.insert(
+            {
+                "uid": uid,
+                "user_uid": owner,
+                "slug": make_combined_slug(title, uid),
+                "title": title,
+                "content": f"Body for {title}",
+                "topic": "devlog",
+                "project_uid": None,
+                "image": None,
+                "stars": 0,
+                "created_at": (base - timedelta(seconds=offset)).isoformat(),
+                "deleted_at": None,
+                "deleted_by": None,
+            }
+        )
+    return token, match_title, other_title
+
+
+def test_feed_search_bar_visible(alice):
+    page, user = alice
+    page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    search = page.locator("input[name='search'][placeholder='Search posts...']")
+    assert search.is_visible()
+
+
+def test_feed_search_filters(alice):
+    page, user = alice
+    token, match_title, other_title = _seed_searchable_posts()
+    page.goto(f"{BASE_URL}/feed?search={token}", wait_until="domcontentloaded")
+    assert page.locator(f".post-title:has-text('{match_title}')").count() == 1
+    assert page.locator(f".post-title:has-text('{other_title}')").count() == 0
+
+
+def test_feed_search_no_match(alice):
+    page, user = alice
+    _seed_searchable_posts()
+    page.goto(
+        f"{BASE_URL}/feed?search=zzz{uuid4().hex}", wait_until="domcontentloaded"
+    )
+    assert page.is_visible(".empty-state")
+    assert page.locator(".post-title").count() == 0
+
+
+def test_feed_search_preserves_topic(alice):
+    page, user = alice
+    token, match_title, _ = _seed_searchable_posts()
+    page.goto(
+        f"{BASE_URL}/feed?topic=devlog&search={token}", wait_until="domcontentloaded"
+    )
+    assert page.locator(f".post-title:has-text('{match_title}')").count() == 1
+    preserved = page.locator(
+        ".sidebar-card form input[type='hidden'][name='topic'][value='devlog']"
+    )
+    assert preserved.count() == 1
+
+
 def test_feed_community_stats(alice):
     page, user = alice
     page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
diff --git a/tests/test_gists.py b/tests/test_gists.py
index d3721641..64ab7149 100644
--- a/tests/test_gists.py
+++ b/tests/test_gists.py
@@ -261,6 +261,81 @@ def test_language_filter(alice, app_server):
     assert not page.is_visible(f"text={title}")
 
 
+def _seed_searchable_gists(language="python"):
+    token = uuid4().hex[:10]
+    owner = str(uuid4())
+    get_table("users").insert(
+        {
+            "uid": owner,
+            "username": f"gsrch_{owner[:8]}",
+            "email": f"{owner[:8]}@test.devplace",
+            "password_hash": "x",
+            "role": "Member",
+            "is_active": True,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    base = datetime(2026, 1, 1, tzinfo=timezone.utc)
+    gists = get_table("gists")
+    match_title = f"Findable gist {token}"
+    other_title = f"Unrelated gist {uuid4().hex[:10]}"
+    for offset, title in ((0, match_title), (1, other_title)):
+        uid = str(uuid4())
+        gists.insert(
+            {
+                "uid": uid,
+                "user_uid": owner,
+                "slug": make_combined_slug(title, uid),
+                "title": title,
+                "language": language,
+                "description": f"Description for {title}",
+                "source_code": "x = 1",
+                "stars": 0,
+                "created_at": (base - timedelta(seconds=offset)).isoformat(),
+                "deleted_at": None,
+                "deleted_by": None,
+            }
+        )
+    return token, match_title, other_title
+
+
+def test_gists_search_bar_visible(alice):
+    page, _ = alice
+    page.goto(f"{BASE_URL}/gists", wait_until="domcontentloaded")
+    search = page.locator("input[name='search'][placeholder='Search gists...']")
+    assert search.is_visible()
+
+
+def test_gists_search_filters(alice):
+    page, _ = alice
+    token, match_title, other_title = _seed_searchable_gists()
+    page.goto(f"{BASE_URL}/gists?search={token}", wait_until="domcontentloaded")
+    assert page.locator(f".gist-card-title:has-text('{match_title}')").count() == 1
+    assert page.locator(f".gist-card-title:has-text('{other_title}')").count() == 0
+
+
+def test_gists_search_no_match(alice):
+    page, _ = alice
+    _seed_searchable_gists()
+    page.goto(
+        f"{BASE_URL}/gists?search=zzz{uuid4().hex}", wait_until="domcontentloaded"
+    )
+    assert page.locator(".gist-card-title").count() == 0
+
+
+def test_gists_search_preserves_language(alice):
+    page, _ = alice
+    token, match_title, _ = _seed_searchable_gists(language="go")
+    page.goto(
+        f"{BASE_URL}/gists?language=go&search={token}", wait_until="domcontentloaded"
+    )
+    assert page.locator(f".gist-card-title:has-text('{match_title}')").count() == 1
+    preserved = page.locator(
+        ".sidebar-card form input[type='hidden'][name='language'][value='go']"
+    )
+    assert preserved.count() == 1
+
+
 def test_gist_comments(alice, app_server):
     page, _ = alice
     title = f"Comment Test {int(time.time())}"