@chappibunny/repolens 1.12.2 → 1.12.4

package/src/core/diff.js

@@ -1,20 +1,49 @@
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { warn } from "../utils/logger.js";
 
-export function getGitDiff(baseRef = "origin/main") {
+const SAFE_REF = /^[A-Za-z0-9._~^/@+-]+$/;
+
+function emptyDiff() {
+  return { added: [], removed: [], modified: [] };
+}
+
+/**
+ * Classify one `git diff --name-status` line.
+ * Renames and copies (`R100`, `C75`) record the destination path.
+ */
+export function classifyDiffLine(line) {
+  const parts = String(line || "").split("\t");
+  const status = parts[0];
+  if (!status) return null;
+
+  const file = status.startsWith("R") || status.startsWith("C")
+    ? parts[2] || parts[1]
+    : parts[1];
+  if (!file) return null;
+
+  if (status === "A") return { bucket: "added", file };
+  if (status === "D") return { bucket: "removed", file };
+  return { bucket: "modified", file };
+}
+
+export function getGitDiff(baseRef = "origin/main", cwd = process.cwd()) {
+  if (typeof baseRef !== "string" || baseRef.startsWith("-") || !SAFE_REF.test(baseRef)) {
+    warn("git diff skipped: base ref contains unsupported characters.");
+    return emptyDiff();
+  }
+
   let output = "";
 
   try {
-    output = execSync(`git diff --name-status ${baseRef}`, {
-      encoding: "utf8"
+    // Pipe stderr so a missing repo or ref does not dump git's usage text.
+    output = execFileSync("git", ["diff", "--name-status", baseRef], {
+      encoding: "utf8",
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
     });
   } catch (error) {
     warn("git diff failed, returning empty diff.");
-    return {
-      added: [],
-      removed: [],
-      modified: []
-    };
+    return emptyDiff();
   }
 
   const lines = output.split("\n").filter(Boolean);
@@ -24,17 +53,11 @@ export function getGitDiff(baseRef = "origin/main") {
   const modified = [];
 
   for (const line of lines) {
-    const [status, file] = line.split("\t");
-
-    if (!file) continue;
-
-    if (status === "A") {
-      added.push(file);
-    } else if (status === "D") {
-      removed.push(file);
-    } else {
-      modified.push(file);
-    }
+    const classified = classifyDiffLine(line);
+    if (!classified) continue;
+    if (classified.bucket === "added") added.push(classified.file);
+    else if (classified.bucket === "removed") removed.push(classified.file);
+    else modified.push(classified.file);
   }
 
   return {

package/src/core/scan.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { info, warn } from "../utils/logger.js";
 import { trackScan } from "../utils/telemetry.js";
 import { detectMonorepo } from "../analyzers/monorepo-detector.js";
+import { isInsideRoot } from "../utils/safe-path.js";
 
 const norm = (p) => p.replace(/\\/g, "/");
 
@@ -71,8 +72,20 @@ function isNextPage(file) {
   return false;
 }
 
+const MAX_SOURCE_BYTES = 1_000_000;
+
 async function readFileSafe(file) {
   try {
+    const stat = await fs.stat(file);
+    if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return "";
+    const fh = await fs.open(file, "r");
+    try {
+      const sample = Buffer.alloc(Math.min(8192, stat.size));
+      await fh.read(sample, 0, sample.length, 0);
+      if (sample.includes(0)) return "";
+    } finally {
+      await fh.close();
+    }
     return await fs.readFile(file, "utf8");
   } catch {
     return "";
@@ -466,11 +479,18 @@ function isValidRoutePath(p) {
 export async function scanRepo(cfg) {
   const repoRoot = cfg.__repoRoot;
 
-  const files = await fg(cfg.scan.include, {
-    cwd: repoRoot,
+  const rootResolved = path.resolve(repoRoot);
+  const files = (await fg(cfg.scan.include, {
+    cwd: rootResolved,
     ignore: cfg.scan.ignore,
-    onlyFiles: true
-  });
+    onlyFiles: true,
+    followSymbolicLinks: false,
+    absolute: false
+  })).filter((file) => isInsideRoot(rootResolved, path.resolve(rootResolved, file)));
+
+  if (files.length === 0) {
+    warn("No files matched the scan patterns. Documentation will be mostly empty. Check scan.include in .repolens.yml.");
+  }
 
   // Performance guardrails
   if (files.length > MAX_FILES_LIMIT) {

package/src/delivery/comment.js

@@ -1,6 +1,7 @@
-import { execSync } from "node:child_process";
 import { log } from "../utils/logger.js";
 import { fetchWithRetry } from "../utils/retry.js";
+import { assertGitHubRepo } from "../utils/github-repo.js";
+import { sanitizeSecrets } from "../utils/secrets.js";
 
 function safe(text) {
   return String(text || "").trim();
@@ -72,7 +73,8 @@ async function githubRequest(method, url, body) {
 
   if (!res.ok) {
     const text = await res.text();
-    throw new Error(`GitHub API error ${res.status}: ${text}`);
+    const clipped = sanitizeSecrets(String(text || "").replace(/\s+/g, " ").slice(0, 500));
+    throw new Error(`GitHub API error ${res.status}: ${clipped}`);
   }
 
   return await res.json();
@@ -114,6 +116,7 @@ export async function upsertPrComment(diff) {
     return;
   }
 
+  assertGitHubRepo(repoFull);
   const [owner, repo] = repoFull.split("/");
   const body = buildBody(diff);
 

package/src/docs/write-doc-set.js

@@ -3,13 +3,14 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { info } from "../utils/logger.js";
+import { resolveOutputDir, safeFileName } from "../utils/safe-path.js";
 
 export async function writeDocumentSet(docSet, targetDir = process.cwd()) {
   const { documents, artifacts, config } = docSet;
   
-  // Determine output directory
-  const outputDir = path.join(
-    targetDir, 
+  // Determine output directory. Reject absolute paths and `..` escapes.
+  const outputDir = resolveOutputDir(
+    targetDir,
     config.documentation?.output_dir || ".repolens"
   );
   
@@ -20,9 +21,10 @@ export async function writeDocumentSet(docSet, targetDir = process.cwd()) {
   
   // Write each document
   for (const doc of documents) {
-    const filePath = path.join(outputDir, doc.filename);
+    const fileName = safeFileName(doc.filename);
+    const filePath = path.join(outputDir, fileName);
     await fs.writeFile(filePath, doc.content, "utf8");
-    info(`✓ Wrote ${doc.filename}`);
+    info(`✓ Wrote ${fileName}`);
   }
   
   // Write artifacts if enabled
@@ -59,12 +61,12 @@ export async function writeDocumentSet(docSet, targetDir = process.cwd()) {
   return {
     outputDir,
     documentCount: documents.length,
-    files: documents.map(d => d.filename)
+    files: documents.map(d => safeFileName(d.filename))
   };
 }
 
 export async function readPreviousDocumentSet(targetDir = process.cwd(), config) {
-  const outputDir = path.join(
+  const outputDir = resolveOutputDir(
     targetDir,
     config.documentation?.output_dir || ".repolens"
   );

package/src/doctor.js

@@ -1,6 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import yaml from "js-yaml";
+import { loadYaml } from "./utils/yaml.js";
 import { loadConfig } from "./core/config.js";
 import { detectConfigTypos } from "./core/config-schema.js";
 import { info } from "./utils/logger.js";
@@ -118,7 +118,7 @@ export async function runDoctor(targetDir = process.cwd()) {
     let rawConfig = null;
     try {
       const rawYaml = await fs.readFile(repolensConfigPath, "utf8");
-      rawConfig = yaml.load(rawYaml);
+      rawConfig = loadYaml(rawYaml);
       
       // Check for config key typos before validation
       if (rawConfig && typeof rawConfig === "object") {

package/src/help.js

@@ -0,0 +1,54 @@
+export function printHelp() {
+  console.log(`
+RepoLens — Repository Intelligence CLI
+
+Usage:
+  repolens <command> [options]
+
+Commands:
+  init        Scaffold RepoLens files in your repository
+  doctor      Validate your RepoLens setup
+  migrate     Upgrade workflow files to current format
+  publish     Scan, render, and publish documentation
+  demo        Generate local docs without API keys (quick preview)
+  watch       Watch for file changes and regenerate docs
+  uninstall   Remove RepoLens-generated files from a repository
+  feedback    Send feedback to the RepoLens team
+  version     Print the current RepoLens version
+  help        Show this help message
+
+Options:
+  --config <path>   Path to .repolens.yml (auto-discovered if omitted)
+  --target <path>   Repository path for init, doctor, migrate, demo, uninstall
+  --quick           Scaffold without the wizard (also --non-interactive)
+  --dry-run         Preview migration changes without writing them
+  --force           Apply migrate or uninstall without a confirmation prompt
+  --verbose         Print debug logs and full stacks on unexpected errors
+  --version, -v     Print version and exit
+  --help, -h        Show this help message
+
+Non-interactive sessions (CI, pipes, or REPOLENS_NON_INTERACTIVE):
+  init falls back to --quick instead of waiting on the wizard
+  yes/no prompts use their default and do not wait (uninstall defaults to no
+    on a closed terminal outside CI; CI still removes files and tells you so)
+  feedback exits with code 2 because it needs a terminal
+
+Exit codes:
+  0  success (including a cancelled wizard)
+  1  runtime error, or an unknown command
+  2  invalid flags, missing config, or a failed doctor check
+
+Examples:
+  repolens init
+  repolens init --quick
+  repolens init --target /tmp/my-repo
+  repolens doctor --target /tmp/my-repo
+  repolens migrate --dry-run
+  repolens publish
+  repolens publish --config /path/.repolens.yml
+  repolens demo
+  repolens watch
+  repolens uninstall --target /tmp/my-repo
+  repolens --version
+`);
+}

package/src/index.js

@@ -0,0 +1,13 @@
+/**
+ * Programmatic entry for @chappibunny/repolens.
+ *
+ * Importing this module does not start the CLI. The `repolens` binary
+ * lives in bin/repolens.js and calls runCli() from src/cli.js.
+ */
+
+export { loadConfig } from "./core/config.js";
+export { scanRepo } from "./core/scan.js";
+export { generateDocumentSet } from "./docs/generate-doc-set.js";
+export { writeDocumentSet, readPreviousDocumentSet } from "./docs/write-doc-set.js";
+export { publishDocs } from "./publishers/index.js";
+export { runDoctor } from "./doctor.js";

package/src/init.js

@@ -1,8 +1,9 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
-import { exec } from "node:child_process";
+import { spawn } from "node:child_process";
 import { info, warn } from "./utils/logger.js";
+import { isNonInteractiveEnvironment } from "./utils/interactive.js";
 
 const PUBLISHER_CHOICES = ["markdown", "notion", "confluence", "github_wiki"];
 
@@ -337,8 +338,14 @@ on:
       - main
   pull_request:
 
+# contents: read checks out the repository.
+# pull-requests: write creates and updates the Architecture Diff
+# comment on pull requests (Issues comments API). Repository write
+# is not required for that comment. Add it only on a job that
+# publishes the GitHub Wiki.
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   publish:
@@ -461,6 +468,8 @@ For automated publishing on every push:
 
 3. Push to main branch
 
+The workflow token is \`contents: read\` plus \`pull-requests: write\`. That is enough for checkout and the Architecture Diff comment. It cannot push commits. GitHub Wiki publishing pushes a separate wiki repository, so add \`contents: write\` on that job only when you enable the wiki publisher.
+
 ## 📊 Generated Documentation
 
 RepoLens generates documentation in two modes:
@@ -564,24 +573,27 @@ async function dirExists(dirPath) {
  * Open a URL in the default browser (cross-platform).
  */
 function openUrl(url) {
-  const platform = process.platform;
-  let cmd;
-  if (platform === "darwin") {
-    cmd = `open "${url}"`;
-  } else if (platform === "win32") {
-    cmd = `start "" "${url}"`;
-  } else {
-    cmd = `xdg-open "${url}"`;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return Promise.resolve(false);
   }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    return Promise.resolve(false);
+  }
+
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "rundll32" : "xdg-open";
+  const args = platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+
   return new Promise((resolve) => {
-    exec(cmd, (err) => {
-      if (err) {
-        warn(`Could not open browser: ${err.message}`);
-        resolve(false);
-      } else {
-        resolve(true);
-      }
+    const child = spawn(cmd, args, { stdio: "ignore" });
+    child.on("error", (err) => {
+      warn(`Could not open browser: ${err.message}`);
+      resolve(false);
     });
+    child.on("close", (code) => resolve(code === 0));
   });
 }
 
@@ -844,23 +856,10 @@ function detectProjectName(repoRoot) {
 }
 
 async function promptNotionCredentials() {
-  // Skip prompts in CI environments or test mode
-  const isCI = process.env.CI || 
-               process.env.GITHUB_ACTIONS || 
-               process.env.GITLAB_CI || 
-               process.env.CIRCLECI ||
-               process.env.JENKINS_HOME ||
-               process.env.CODEBUILD_BUILD_ID;
-  
-  const isTest = process.env.NODE_ENV === 'test' || process.env.VITEST;
-  
-  if (isCI) {
-    info("⏭️  Skipping interactive prompts (CI environment detected)");
-    return null;
-  }
-  
-  if (isTest) {
-    // Skip silently in test mode
+  if (isNonInteractiveEnvironment()) {
+    if (process.env.NODE_ENV !== "test" && !process.env.VITEST) {
+      info("⏭️  Skipping interactive prompts (non-interactive environment)");
+    }
     return null;
   }
 
@@ -943,11 +942,6 @@ async function ensureEnvInGitignore(repoRoot) {
  * Returns a structured config that replaces the auto-detected defaults.
  */
 async function runInteractiveWizard(repoRoot) {
-  const isCI = process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI ||
-               process.env.CIRCLECI || process.env.JENKINS_HOME || process.env.CODEBUILD_BUILD_ID;
-  const isTest = process.env.NODE_ENV === "test" || process.env.VITEST;
-  if (isCI || isTest) return null;
-
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   const ask = (q) => rl.question(q);
 
@@ -1515,14 +1509,17 @@ export async function runInit(targetDir = process.cwd(), options = {}) {
   // Ensure target directory exists
   await fs.mkdir(repoRoot, { recursive: true });
 
-  // Interactive wizard is now the default (--quick skips it)
+  // Interactive wizard is the default (--quick skips it).
+  // CI, tests, and closed stdin used to return null from the wizard and
+  // abort before any files were written. Fall through to quick setup instead.
   let wizardAnswers = null;
-  if (options.interactive) {
+  if (options.interactive && !isNonInteractiveEnvironment()) {
     wizardAnswers = await runInteractiveWizard(repoRoot);
     if (!wizardAnswers) {
-      // User cancelled the wizard
       return;
     }
+  } else if (options.interactive) {
+    info("Non-interactive environment detected — running quick setup instead of the wizard.");
   }
 
   // Prompt for Notion credentials interactively (only in non-wizard mode)

package/src/integrations/discord.js

@@ -3,8 +3,8 @@
  * Sends rich embed notifications to Discord channels via webhooks
  */
 
-import fetch from "node-fetch";
 import { info, warn, error } from "../utils/logger.js";
+import { sanitizeSecrets } from "../utils/secrets.js";
 
 /**
  * Send a notification to Discord webhook
@@ -26,15 +26,29 @@ export async function sendDiscordNotification(webhookUrl, payload) {
       embeds: [embed],
     };
 
+    let webhook;
+    try {
+      webhook = new URL(webhookUrl);
+    } catch {
+      warn("Discord webhook URL is not a valid URL, skipping notification");
+      return false;
+    }
+    if (webhook.protocol !== "https:") {
+      warn("Discord webhook URL must use https, skipping notification");
+      return false;
+    }
+
     const response = await fetch(webhookUrl, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(body),
+      signal: AbortSignal.timeout(15000),
+      redirect: "error",
     });
 
     if (!response.ok) {
       const text = await response.text();
-      error(`Discord webhook failed (${response.status}): ${text}`);
+      error(`Discord webhook failed (${response.status}): ${sanitizeSecrets(String(text).slice(0, 300))}`);
       return false;
     }
 

package/src/migrate.js

@@ -1,6 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import yaml from "js-yaml";
+import { loadYaml } from "./utils/yaml.js";
 import { info, warn, error as logError } from "./utils/logger.js";
 import { trackMigration } from "./utils/telemetry.js";
 
@@ -141,7 +141,7 @@ async function migrateConfigFile(targetDir, options = {}) {
   const raw = await fs.readFile(configPath, "utf8");
   let parsed;
   try {
-    parsed = yaml.load(raw);
+    parsed = loadYaml(raw);
   } catch {
     warn(`   ⚠️  Could not parse ${filename} — skipping config migration`);
     return { migrated: false, filePath: configPath, reason: "parse-error" };

package/src/publishers/confluence.js

@@ -1,10 +1,10 @@
-import fetch from "node-fetch";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { log, info, warn } from "../utils/logger.js";
 import { fetchWithRetry } from "../utils/retry.js";
 import { getCurrentBranch, getBranchQualifiedTitle } from "../utils/branch.js";
 import { createRepoLensError } from "../utils/errors.js";
+import { sanitizeSecrets } from "../utils/secrets.js";
 
 /**
  * Confluence Publisher for RepoLens
@@ -50,6 +50,19 @@ function getConfluenceBaseUrl() {
     );
   }
   
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("CONFLUENCE_URL is not a valid URL");
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error("CONFLUENCE_URL must use http or https");
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error("CONFLUENCE_URL must not include embedded credentials. Use CONFLUENCE_EMAIL and CONFLUENCE_API_TOKEN.");
+  }
+
   // Normalize URL (remove trailing slash, ensure /wiki for Cloud)
   let normalized = url.replace(/\/+$/, "");
   
@@ -84,7 +97,8 @@ async function confluenceRequest(method, endpoint, body = null) {
 
   if (!res.ok) {
     const text = await res.text();
-    let errorMsg = `Confluence API error ${res.status}: ${text}`;
+    const clipped = sanitizeSecrets(String(text || "").replace(/\s+/g, " ").slice(0, 500));
+    let errorMsg = `Confluence API error ${res.status}: ${clipped}`;
     
     // Provide helpful error messages
     if (res.status === 401) {
@@ -114,7 +128,7 @@ async function confluenceRequest(method, endpoint, body = null) {
 const CACHE_DIR = path.join(process.cwd(), ".cache");
 
 function getCacheFile() {
-  const branch = getCurrentBranch();
+  const branch = getCurrentBranch().replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80) || "unknown";
   return path.join(CACHE_DIR, `confluence-pages-${branch}.json`);
 }