@chappibunny/repolens 1.12.0 → 1.12.4

package/CHANGELOG.md

@@ -2,6 +2,88 @@
 
 All notable changes to RepoLens will be documented in this file.
 
+## Unreleased
+
+### Security
+
+- `repolens init` workflows grant `contents: read` and `pull-requests: write`. Architecture Diff comments use the Issues comments API on the pull request, which accepts `pull-requests: write`. `contents: write` is not granted. GitHub Wiki pushes still need `contents: write` on that job only
+
+### Docs
+
+- The README no longer hard-codes the release version. It points at `package.json`, which is the source of the version
+- Test totals are no longer hard-coded in the README, development guide, or security guide. The tests badge follows the `test.yml` workflow status
+
+## 1.12.4
+
+### Security
+
+- GitHub Wiki git commands use an argument array. The token is passed with `http.extraheader` and is no longer written into the clone URL or `origin` remote
+- Wiki page names and generated document names cannot leave their output directory
+- `documentation.output_dir` must stay inside the repository. Absolute paths and `..` are rejected
+- Scan results that resolve outside the repository root are dropped, and absolute `scan.include` patterns are rejected
+- Monorepo workspace globs that point outside the repository are ignored
+- YAML configs are size-capped and alias-capped before `js-yaml` parses them. The js-yaml 4 schema is unchanged
+- Notion, Confluence, GitHub, and Discord error bodies are truncated and redacted before they are logged
+- Confluence URLs with embedded credentials, or a scheme other than http/https, are rejected
+- Discord webhooks must be `https` and time out after 15 seconds
+- AI startup logs no longer print a prefix of the API key
+- Secret detection covers fine-grained GitHub tokens (`github_pat_`), `gho_` / `ghu_` / `ghr_` tokens, and npm tokens
+- `Retry-After` values that are not seconds or an HTTP date no longer become `NaN` delays
+- Browser signup links are opened without a shell
+- GitHub Actions: test and security jobs are `contents: read`. `id-token: write` is only on the npm publish job. The token-present check no longer prints the token length
+- Test workflow runs on Node.js 18, 20, and 22. Node 18 runs `scripts/node18-runtime.js` because Vitest 4 cannot start there (`util.styleText` needs Node 20.12). Node 20 and 22 run the full Vitest suite
+
+### Fixes
+
+- Update checks query `@chappibunny/repolens` on the npm registry. The cache file uses the real home directory on Windows and Unix
+- `repolens init` in CI, tests, and non-TTY sessions scaffolds files instead of exiting before writing anything
+- `repolens demo --target` looks for `.repolens.yml` from the target directory, so a demo of another folder does not scan the shell's current repository
+- `repolens feedback` exits 2 when there is no terminal, and exits 1 when sending fails
+- Unknown flags and missing `--config` / `--target` values exit 2. `--help` and `--version` work before or after the command
+- `repolens --version` and `repolens --help` from the installed binary do not load the scanner or telemetry
+- Empty repositories finish the scan with a warning instead of looking like a hung run. Binary files and files over 1 MB are not parsed as source
+- Git renames in `git diff --name-status` record the new path. Unsafe diff refs are ignored instead of being interpolated into a shell command. A missing repo or ref no longer prints git's usage text, and the diff runs in the scanned repository rather than whatever directory the shell happened to be in
+- Branch filters escape regex metacharacters, so a pattern like `release/*)` does not throw
+- Confluence page-cache filenames cannot contain path separators from the branch name
+- Notion block pagination stops if a cursor repeats
+
+### Dependencies
+
+- `dotenv` 18.0.8 (`import "dotenv/config"` is unchanged; Node `-r dotenv/config` preload was removed upstream)
+- `tinyexec` 1.3.1 (dev dependency, Node 18+)
+- js-yaml stays on 4.x, Vitest stays on 4.x, and `@sentry/node` stays on 10.x so `engines` can remain `>=18`
+
+## 1.12.3
+
+### Security
+
+- Bump runtime `js-yaml` to 4.3.2 (merge-key CPU limit and `!!omap` duplicate-key complexity fixes)
+- Bump transitive `source-map-js` to 1.2.2 (CVE-2026-93749)
+- Bump transitive `postcss` to 8.5.31 (Dependabot #8 requested 8.5.25; 8.5.31 includes those fixes)
+- Bump `vitest` and `@vitest/mocker` to 4.1.12 (Dependabot #10 requested 4.1.11; 4.1.12 is the current 4.1 release and includes that fix)
+- No patched `braces` release exists for GHSA-vfj7-8cjw-p6xm (latest is 3.0.3, which the advisory covers). The release audit now checks production dependencies only and waives that one advisory. Any other high or critical runtime finding still fails the job. See `scripts/audit-waivers.json` and `SECURITY.md`.
+
+### Packaging
+
+- Require Node.js `>=18` (`engines`), matching built-in `fetch` and `node:readline/promises`
+- Add an `exports` map. `main` now points at `src/index.js`, so importing the package does not run the CLI
+- Keep the `repolens` binary on `bin/repolens.js`
+- Replace `node-fetch` with the built-in `fetch` (`AbortSignal.timeout` for the update check)
+- Move `@sentry/node` to `optionalDependencies`. Telemetry and feedback no-op when it is not installed
+- Stop publishing the `docs/` handbook. Runtime document generation stays in `src/docs/`
+
+### CI
+
+- Publish Documentation runs on pushes to `main` and manual dispatch, and skips `dependabot[bot]`, because publisher secrets are not available on Dependabot branches
+- Add a Test workflow that runs `npm test` on pull requests and branch pushes
+- CI installs with `npm ci` so the committed lockfile is what runs. A fresh `npm install` on npm 10 crashes while resolving Vitest 4.1 optional peers
+- Release workflow publishes with `npm publish --provenance` (requires an `NPM_TOKEN` Actions secret)
+
+### Fixes
+
+- `docs:publish` discovers `.repolens.yml` from the current directory instead of `../../.repolens.yml`
+- `release:check` runs `npm pack --dry-run`
+
 ## 1.12.0
 
 ### 🛡️ Security Pattern Detection

package/README.md

@@ -10,14 +10,14 @@
 
 [![npm version](https://img.shields.io/npm/v/@chappibunny/repolens)](https://www.npmjs.com/package/@chappibunny/repolens)
 [![VS Code Extension](https://img.shields.io/visual-studio-marketplace/v/CHAPIBUNNY.repolens-architecture?label=VS%20Code)](https://marketplace.visualstudio.com/items?itemName=CHAPIBUNNY.repolens-architecture)
-[![Tests](https://img.shields.io/badge/tests-480%20passing-brightgreen)](https://github.com/CHAPIBUNNY/repolens/actions)
+[![Tests](https://img.shields.io/github/actions/workflow/status/CHAPIBUNNY/repolens/test.yml?label=tests)](https://github.com/CHAPIBUNNY/repolens/actions/workflows/test.yml)
 [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 
 **Your architecture docs are already outdated.** RepoLens fixes that.
 
 RepoLens scans your repository, generates living architecture documentation, and publishes it to Notion, Confluence, GitHub Wiki, or Markdown — automatically on every push. Engineers get technical docs. Stakeholders get readable system overviews. Nobody writes a word.
 
-> Stable as of v1.0 — [API guarantees](docs/STABILITY.md) · [Security hardened](SECURITY.md) · v1.12.0
+> Stable as of v1.0 — [API guarantees](docs/STABILITY.md) · [Security hardened](SECURITY.md) · version from [`package.json`](package.json)
 
 ---
 
@@ -50,7 +50,7 @@ Plus framework detection: **Django** · **FastAPI** · **Flask** · **Gin** · *
 
 ## 🚀 Quick Start (60 seconds)
 
-**Step 1: Install**
+**Step 1: Install** (Node.js 18+)
 ```bash
 npm install @chappibunny/repolens
 ```
@@ -259,7 +259,7 @@ When you open a pull request, RepoLens posts:
 | [Configuration](docs/CONFIGURATION.md) | Complete `.repolens.yml` schema and examples |
 | [Environment Variables](docs/ENVIRONMENT.md) | All env vars by publisher and feature |
 | [Architecture](docs/ARCHITECTURE.md) | Pipeline diagram, project structure |
-| [Development](docs/DEVELOPMENT.md) | Setup, tests (380 across 22 files), release process |
+| [Development](docs/DEVELOPMENT.md) | Setup, tests, and the release process |
 | [Security](SECURITY.md) | Threat model, secret detection, validation layers |
 | [Telemetry](docs/TELEMETRY.md) | Opt-in privacy-first usage analytics |
 | [Troubleshooting](docs/TROUBLESHOOTING.md) | Common issues and fixes |

package/bin/repolens.js

@@ -1,2 +1,22 @@
 #!/usr/bin/env node
-import "../src/cli.js";
+import { readFileSync } from "node:fs";
+
+const argv = process.argv.slice(2);
+const wantsHelp = argv.includes("--help") || argv.includes("-h") || argv[0] === "help";
+const wantsVersion = argv.includes("--version") || argv.includes("-v") || argv[0] === "version";
+
+// --version and --help must not load the scanner, publishers, or telemetry.
+if (wantsVersion && !wantsHelp) {
+  const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+  console.log(pkg.version || "0.0.0");
+  process.exit(0);
+}
+
+if (wantsHelp) {
+  const { printHelp } = await import("../src/help.js");
+  printHelp();
+  process.exit(0);
+}
+
+const { runCli } = await import("../src/cli.js");
+runCli();

package/package.json

@@ -1,17 +1,23 @@
 {
   "name": "@chappibunny/repolens",
-  "version": "1.12.0",
+  "version": "1.12.4",
   "description": "AI-assisted documentation intelligence system for technical and non-technical audiences",
   "license": "MIT",
   "type": "module",
-  "main": "src/cli.js",
+  "engines": {
+    "node": ">=18"
+  },
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./package.json": "./package.json"
+  },
   "bin": {
     "repolens": "bin/repolens.js"
   },
   "files": [
     "bin",
     "src",
-    "docs",
     "package.json",
     "README.md",
     "CHANGELOG.md"
@@ -47,28 +53,32 @@
   },
   "scripts": {
     "test:notion": "node notion-test.js",
-    "docs:publish": "node src/cli.js publish --config ../../.repolens.yml",
+    "docs:publish": "node bin/repolens.js publish",
     "init:test": "node src/cli.js init --target /tmp/repolens-init-test",
     "test": "NODE_ENV=test vitest run --no-watch --reporter=verbose",
     "pack:check": "npm pack",
-    "release:check": "npm test && npm pack",
+    "audit:runtime": "node scripts/audit-runtime.js",
+    "release:check": "npm test && npm run audit:runtime && npm pack --dry-run",
     "test:install": "./test-install.sh",
     "release:patch": "npm version patch",
     "release:minor": "npm version minor",
     "release:major": "npm version major"
   },
   "dependencies": {
-    "@sentry/node": "^10.42.0",
-    "dotenv": "^17.3.1",
+    "dotenv": "^18.0.8",
     "fast-glob": "^3.3.3",
-    "js-yaml": "^4.1.0",
-    "node-fetch": "^3.3.2"
+    "js-yaml": "^4.3.2"
+  },
+  "optionalDependencies": {
+    "@sentry/node": "^10.42.0"
   },
   "devDependencies": {
-    "tinyexec": "1.0.2",
-    "vitest": "^4.0.18"
+    "tinyexec": "^1.3.1",
+    "vitest": "^4.1.11"
   },
   "overrides": {
-    "yauzl": ">=3.2.1"
+    "yauzl": ">=3.2.1",
+    "brace-expansion": ">=5.0.6",
+    "@opentelemetry/core": ">=2.8.0"
   }
 }

package/src/ai/provider.js

@@ -83,8 +83,7 @@ export async function generateText({ system, user, temperature, maxTokens, confi
   
   // Log configuration once per run
   if (!hasLoggedConfig) {
-    const keyPreview = apiKey.substring(0, 8) + "...";
-    info(`AI Config: provider=${provider}, model=${model}, key=${keyPreview}`);
+    info(`AI Config: provider=${provider}, model=${model}, key=set`);
     hasLoggedConfig = true;
   }
   

package/src/analyzers/monorepo-detector.js

@@ -4,6 +4,8 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { info } from "../utils/logger.js";
+import { isInsideRoot } from "../utils/safe-path.js";
+import { loadYaml } from "../utils/yaml.js";
 
 /**
  * Detect monorepo workspaces in a repository.
@@ -68,24 +70,8 @@ async function detectPnpmWorkspaces(repoRoot) {
   try {
     const yamlPath = path.join(repoRoot, "pnpm-workspace.yaml");
     const raw = await fs.readFile(yamlPath, "utf8");
-
-    // Simple YAML parsing for packages array (avoid adding js-yaml dependency for this)
-    const patterns = [];
-    let inPackages = false;
-    for (const line of raw.split("\n")) {
-      const trimmed = line.trim();
-      if (trimmed === "packages:") {
-        inPackages = true;
-        continue;
-      }
-      if (inPackages) {
-        if (trimmed.startsWith("- ")) {
-          patterns.push(trimmed.slice(2).replace(/['"]/g, "").trim());
-        } else if (trimmed && !trimmed.startsWith("#")) {
-          break; // End of packages list
-        }
-      }
-    }
+    const doc = loadYaml(raw);
+    const patterns = Array.isArray(doc?.packages) ? doc.packages.filter((item) => typeof item === "string") : [];
 
     return await resolveWorkspacePatterns(repoRoot, patterns);
   } catch {
@@ -116,8 +102,10 @@ async function resolveWorkspacePatterns(repoRoot, patterns) {
   for (const pattern of patterns) {
     // Convert glob pattern to directory search
     // e.g. "packages/*" → list dirs in packages/
-    const basePath = pattern.replace(/\/?\*.*$/, "");
-    const searchDir = path.join(repoRoot, basePath);
+    if (typeof pattern !== "string" || pattern.includes("\0")) continue;
+    const basePath = pattern.replace(/\/?\*.*$/, "") || ".";
+    const searchDir = path.resolve(repoRoot, basePath);
+    if (!isInsideRoot(repoRoot, searchDir)) continue;
 
     try {
       const entries = await fs.readdir(searchDir, { withFileTypes: true });

package/src/cli-args.js

@@ -0,0 +1,60 @@
+const FLAGS_WITH_VALUE = new Set(["--config", "--target"]);
+const BOOLEAN_FLAGS = new Set([
+  "--quick",
+  "--non-interactive",
+  "--dry-run",
+  "--force",
+  "--verbose",
+  "--help",
+  "-h",
+  "--version",
+  "-v",
+]);
+
+/**
+ * Parse RepoLens argv (already sliced past node and the script path).
+ * Global options may appear before or after the command.
+ */
+export function parseCliArgs(argv) {
+  const flags = {};
+  const positionals = [];
+  const errors = [];
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--") {
+      positionals.push(...argv.slice(i + 1));
+      break;
+    }
+    if (arg.startsWith("-")) {
+      if (FLAGS_WITH_VALUE.has(arg)) {
+        const value = argv[i + 1];
+        if (value == null || value.startsWith("-")) {
+          errors.push(`${arg} requires a value`);
+        } else {
+          flags[arg] = value;
+          i += 1;
+        }
+      } else if (BOOLEAN_FLAGS.has(arg)) {
+        flags[arg] = true;
+      } else {
+        errors.push(`Unknown option: ${arg}`);
+      }
+    } else {
+      positionals.push(arg);
+    }
+  }
+
+  if (positionals.length > 1) {
+    errors.push(`Unexpected argument: ${positionals.slice(1).join(" ")}`);
+  }
+
+  const command = positionals[0];
+  return {
+    command,
+    flags,
+    errors,
+    help: Boolean(flags["--help"] || flags["-h"] || command === "help"),
+    version: Boolean(flags["--version"] || flags["-v"] || command === "version"),
+  };
+}

package/src/cli.js

@@ -1,7 +1,7 @@
 import "dotenv/config";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { loadConfig } from "./core/config.js";
 import { scanRepo } from "./core/scan.js";
@@ -29,6 +29,9 @@ import { generateDocumentSet } from "./docs/generate-doc-set.js";
 import { writeDocumentSet } from "./docs/write-doc-set.js";
 import { loadPlugins } from "./plugins/loader.js";
 import { PluginManager } from "./plugins/manager.js";
+import { printHelp } from "./help.js";
+import { parseCliArgs } from "./cli-args.js";
+import { isNonInteractiveEnvironment } from "./utils/interactive.js";
 import { 
   initTelemetry, 
   captureError, 
@@ -219,56 +222,33 @@ async function findConfig(startDir = process.cwd()) {
   }
 }
 
-function printHelp() {
-  console.log(`
-RepoLens — Repository Intelligence CLI
-
-Usage:
-  repolens <command> [options]
-
-Commands:
-  init        Scaffold RepoLens files in your repository
-  doctor      Validate your RepoLens setup
-  migrate     Upgrade workflow files to current format
-  publish     Scan, render, and publish documentation
-  demo        Generate local docs without API keys (quick preview)
-  watch       Watch for file changes and regenerate docs
-  uninstall   Remove all RepoLens-generated files from your repository
-  feedback    Send feedback to the RepoLens team
-  version     Print the current RepoLens version
-
-Options:
-  --config        Path to .repolens.yml (auto-discovered if not provided)
-  --target        Target repository path for init/doctor/migrate
-  --quick         Run init with minimal prompts (skip wizard)
-  --dry-run       Preview migration changes without applying them
-  --force         Skip interactive confirmation for migration
-  --verbose       Enable verbose logging
-  --version       Print version
-  --help          Show this help message
-
-Examples:
-  repolens init                                 # Full interactive wizard (recommended)
-  repolens init --quick                         # Minimal setup, skip wizard
-  repolens init --target /tmp/my-repo
-  repolens doctor --target /tmp/my-repo
-  repolens migrate                              # Migrate workflows in current directory
-  repolens migrate --dry-run                    # Preview changes without applying
-  repolens publish                              # Auto-discovers .repolens.yml
-  repolens publish --config /path/.repolens.yml # Explicit config path
-  repolens demo                                  # Quick local preview (no API keys)
-  repolens watch                                # Watch mode (Markdown only)
-  repolens uninstall                             # Remove all RepoLens files
-  repolens uninstall --target /tmp/my-repo       # Uninstall from specific repo
-  repolens --version
-`);
-}
-
 async function main() {
-  const command = process.argv[2];
+  const parsed = parseCliArgs(process.argv.slice(2));
+
+  // Help and version return before telemetry and the update check.
+  // bin/repolens.js answers --version/--help without loading this module.
+  if (parsed.help) {
+    printHelp();
+    return;
+  }
 
-  // Initialize telemetry (opt-in via REPOLENS_TELEMETRY_ENABLED=true)
-  initTelemetry();
+  if (parsed.version) {
+    const version = await getPackageVersion();
+    console.log(version);
+    return;
+  }
+
+  if (parsed.errors.length > 0) {
+    for (const message of parsed.errors) error(message);
+    error("Run 'repolens help' for usage information.");
+    process.exit(EXIT_VALIDATION);
+  }
+
+  const command = parsed.command;
+
+  // Initialize telemetry (opt-in via REPOLENS_TELEMETRY_ENABLED=true).
+  // @sentry/node is optional; init is a no-op when it is not installed.
+  await initTelemetry();
   setContext("cli", {
     command: command || "publish",
     args: process.argv.slice(2),
@@ -279,17 +259,6 @@ async function main() {
   // Check for updates (non-blocking, runs in background)
   checkForUpdates().catch(() => {/* Silently fail */});
 
-  if (command === "--help" || command === "-h" || command === "help") {
-    printHelp();
-    return;
-  }
-
-  if (command === "--version" || command === "-v" || command === "version") {
-    const version = await getPackageVersion();
-    console.log(version);
-    return;
-  }
-
   if (command === "init") {
     await printBanner();
     const targetDir = getArg("--target") || process.cwd();
@@ -392,13 +361,6 @@ async function main() {
     return;
   }
 
-  // Reject unknown flags/commands before falling through to publish
-  if (command && command.startsWith("--") && !["--help", "-h", "--version", "-v"].includes(command)) {
-    error(`Unknown option: ${command}`);
-    error("Run 'repolens help' for usage information.");
-    process.exit(EXIT_ERROR);
-  }
-
   if (command === "publish" || !command) {
     await printBanner();
     
@@ -461,7 +423,7 @@ async function main() {
       process.exit(EXIT_ERROR);
     }
 
-    const rawDiff = getGitDiff("origin/main");
+    const rawDiff = getGitDiff("origin/main", cfg.__repoRoot || process.cwd());
     const diffData = buildArchitectureDiffData(rawDiff);
 
     try {
@@ -534,10 +496,12 @@ async function main() {
     const commandTimer = startTimer("demo");
     const targetDir = getArg("--target") || process.cwd();
     
-    // Try to load existing config, otherwise use sensible defaults
+    // Try to load existing config, otherwise use sensible defaults.
+    // Start at --target so a demo of another directory does not pick up
+    // the config in the shell's current directory.
     let cfg;
     try {
-      const configPath = getArg("--config") || await findConfig();
+      const configPath = getArg("--config") || await findConfig(targetDir);
       info(`Using config: ${configPath}`);
       cfg = await loadConfig(configPath);
     } catch {
@@ -580,7 +544,7 @@ async function main() {
       stopTimer(scanTimer);
       info(`Detected ${scan.modules?.length || 0} modules, ${scan.filesCount || 0} files`);
       
-      const rawDiff = getGitDiff("origin/main");
+      const rawDiff = getGitDiff("origin/main", cfg.__repoRoot || targetDir);
       
       info("Generating documentation set...");
       const renderTimer = startTimer("render");
@@ -675,7 +639,7 @@ async function main() {
       const isTest = process.env.NODE_ENV === "test" || process.env.VITEST;
       
       if (isCI || isTest) {
-        info("\nCI/test environment detected — skipping confirmation (use --force to suppress this message).");
+        info("\nNon-interactive environment: removing RepoLens files without a prompt. Pass --force to hide this notice.");
       } else {
         const confirmed = await promptYesNo(`\nRemove ${found.length} item${found.length === 1 ? "" : "s"}? This cannot be undone.`, false);
         
@@ -717,6 +681,11 @@ async function main() {
 
   if (command === "feedback") {
     await printBanner();
+    if (isNonInteractiveEnvironment()) {
+      error("feedback needs an interactive terminal.");
+      await closeTelemetry();
+      process.exit(EXIT_VALIDATION);
+    }
     info("Send feedback to the RepoLens team");
     info("Your feedback is anonymous and helps us improve RepoLens.\n");
 
@@ -754,6 +723,8 @@ async function main() {
       captureError(err, { command: "feedback" });
       error("Failed to send feedback:");
       error(err.message);
+      await closeTelemetry();
+      process.exit(EXIT_ERROR);
     }
 
     await closeTelemetry();
@@ -765,32 +736,41 @@ async function main() {
   process.exit(EXIT_ERROR);
 }
 
-main().catch(async (err) => {
-  // Capture unexpected errors
-  captureError(err, { 
-    type: "uncaught",
-    command: process.argv[2] || "unknown"
+export function runCli() {
+  return main().catch(async (err) => {
+    // Capture unexpected errors
+    captureError(err, {
+      type: "uncaught",
+      command: process.argv[2] || "unknown"
+    });
+
+    console.error("\n❌ RepoLens encountered an unexpected error:\n");
+
+    if (err.code === "ENOENT") {
+      error(formatError("FILE_NOT_FOUND", err.path));
+    } else if (err.code === "EACCES") {
+      error(formatError("FILE_PERMISSION_DENIED", err.path));
+    } else if (err.message) {
+      error(err.message);
+    } else {
+      error(err);
+    }
+
+    if (process.env.VERBOSE || process.argv.includes("--verbose")) {
+      console.error("\nStack trace:");
+      console.error(err.stack);
+    } else {
+      console.error("\nRun with --verbose for full error details.");
+    }
+
+    await closeTelemetry();
+    process.exit(EXIT_ERROR);
   });
-  
-  console.error("\n❌ RepoLens encountered an unexpected error:\n");
-  
-  if (err.code === "ENOENT") {
-    error(formatError("FILE_NOT_FOUND", err.path));
-  } else if (err.code === "EACCES") {
-    error(formatError("FILE_PERMISSION_DENIED", err.path));
-  } else if (err.message) {
-    error(err.message);
-  } else {
-    error(err);
-  }
-  
-  if (process.env.VERBOSE || process.argv.includes("--verbose")) {
-    console.error("\nStack trace:");
-    console.error(err.stack);
-  } else {
-    console.error("\nRun with --verbose for full error details.");
-  }
-  
-  await closeTelemetry();
-  process.exit(EXIT_ERROR);
-});
+}
+
+// Run only when this file is the process entry (node src/cli.js).
+// bin/repolens.js imports runCli() explicitly so a package import does not start the CLI.
+const entryArg = process.argv[1];
+if (entryArg && pathToFileURL(path.resolve(entryArg)).href === import.meta.url) {
+  runCli();
+}

package/src/core/config.js

@@ -1,14 +1,17 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import yaml from "js-yaml";
 import { validateConfig as validateSchema } from "./config-schema.js";
 import { validateConfig } from "../utils/validate.js";
 import { warn, error } from "../utils/logger.js";
+import { loadYaml } from "../utils/yaml.js";
 
 export async function loadConfig(configPath) {
   const absoluteConfigPath = path.resolve(configPath);
   const raw = await fs.readFile(absoluteConfigPath, "utf8");
-  const cfg = yaml.load(raw);
+  const cfg = loadYaml(raw);
+  if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) {
+    throw new Error("Configuration must be a YAML mapping");
+  }
 
   // Validate config against schema (structure)
   validateSchema(cfg);