@chappibunny/repolens 1.12.2 → 1.12.4

package/src/publishers/github-wiki.js

@@ -13,12 +13,14 @@
 //     sidebar: true              # Generate _Sidebar.md (default: true)
 //     footer: true               # Generate _Footer.md (default: true)
 
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs/promises";
 import path from "node:path";
 import os from "node:os";
 import { info, warn } from "../utils/logger.js";
-import { getCurrentBranch, getBranchQualifiedTitle, normalizeBranchName } from "../utils/branch.js";
+import { getCurrentBranch, getBranchQualifiedTitle } from "../utils/branch.js";
+import { assertGitHubRepo } from "../utils/github-repo.js";
+import { isInsideRoot, safeFileName } from "../utils/safe-path.js";
 
 const PAGE_ORDER = [
   "executive_summary",
@@ -176,7 +178,7 @@ function detectGitHubRepo() {
   }
 
   try {
-    const remoteUrl = execSync("git remote get-url origin", {
+    const remoteUrl = execFileSync("git", ["remote", "get-url", "origin"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "ignore"],
     }).trim();
@@ -194,10 +196,30 @@ function detectGitHubRepo() {
 }
 
 /**
- * Build the authenticated wiki clone URL.
+ * Wiki clone URL. The token is passed to git through http.extraheader,
+ * not embedded in the URL, so it does not show up in process arguments
+ * or in the temporary repo's origin remote.
  */
-function buildWikiCloneUrl(repo, token) {
-  return `https://x-access-token:${token}@github.com/${repo}.wiki.git`;
+function buildWikiCloneUrl(repo) {
+  return `https://github.com/${repo}.wiki.git`;
+}
+
+function gitEnv(token) {
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  if (token) {
+    env.GIT_CONFIG_COUNT = "1";
+    env.GIT_CONFIG_KEY_0 = "http.https://github.com/.extraheader";
+    env.GIT_CONFIG_VALUE_0 = `AUTHORIZATION: bearer ${token}`;
+  }
+  return env;
+}
+
+export function sanitizeGitError(text) {
+  return String(text || "")
+    .replace(/x-access-token:[^\s@]+/gi, "x-access-token:***")
+    .replace(/bearer\s+[A-Za-z0-9._\-]+/gi, "bearer ***")
+    .replace(/github_pat_[A-Za-z0-9_]+/g, "github_pat_***")
+    .replace(/gh[pousr]_[A-Za-z0-9_]+/g, "gh*_***");
 }
 
 /**
@@ -205,7 +227,7 @@ function buildWikiCloneUrl(repo, token) {
  */
 function pageFileName(key) {
   const title = getPageDisplayTitle(key);
-  return title.replace(/\s+/g, "-") + ".md";
+  return safeFileName(`${title.replace(/\s+/g, "-")}.md`);
 }
 
 /**
@@ -346,23 +368,29 @@ function pageHeader(key, branch) {
 
 /**
  * Run a git command in the specified directory.
- * Token is never exposed in error output.
+ * `args` is an argument array. The token stays in the environment, not argv.
  */
-function git(args, cwd) {
+function git(args, cwd, token) {
   try {
-    return execSync(`git ${args}`, {
+    return execFileSync("git", args, {
       cwd,
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+      env: gitEnv(token),
     });
   } catch (err) {
-    const sanitized = (err.stderr || err.message || "").replace(
-      /x-access-token:[^\s@]+/g,
-      "x-access-token:***"
-    );
-    throw new Error(`Git command failed: git ${args.split(" ")[0]} — ${sanitized}`);
+    const sanitized = sanitizeGitError(err.stderr || err.message || "");
+    throw new Error(`Git command failed: git ${args[0]} — ${sanitized}`);
+  }
+}
+
+async function writeWikiFile(tmpDir, fileName, content) {
+  const safe = safeFileName(fileName);
+  const full = path.resolve(tmpDir, safe);
+  if (!isInsideRoot(tmpDir, full)) {
+    throw new Error(`Refusing to write wiki file outside the workspace: ${fileName}`);
   }
+  await fs.writeFile(full, content, "utf8");
 }
 
 /**
@@ -378,13 +406,14 @@ export async function publishToGitHubWiki(cfg, renderedPages) {
     );
   }
 
-  const repo = detectGitHubRepo();
-  if (!repo) {
+  const detected = detectGitHubRepo();
+  if (!detected) {
     throw new Error(
       "Could not detect GitHub repository. Set GITHUB_REPOSITORY=owner/repo\n" +
       "or ensure git remote 'origin' points to a GitHub URL."
     );
   }
+  const repo = assertGitHubRepo(detected);
 
   const branch = getCurrentBranch();
   const wikiConfig = cfg.github_wiki || {};
@@ -395,16 +424,16 @@ export async function publishToGitHubWiki(cfg, renderedPages) {
   const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "repolens-wiki-"));
 
   try {
-    const cloneUrl = buildWikiCloneUrl(repo, token);
+    const cloneUrl = buildWikiCloneUrl(repo);
 
     try {
-      git(`clone --depth 1 ${cloneUrl} .`, tmpDir);
+      git(["clone", "--depth", "1", cloneUrl, "."], tmpDir, token);
     } catch {
       warn("Wiki repository not found — initializing. Enable the wiki tab in GitHub repo settings.");
       // GitHub Wiki uses 'master' as default branch; ensure compatibility
       // regardless of the local git init.defaultBranch setting
-      git("init -b master", tmpDir);
-      git(`remote add origin ${cloneUrl}`, tmpDir);
+      git(["init", "-b", "master"], tmpDir, token);
+      git(["remote", "add", "origin", cloneUrl], tmpDir, token);
     }
 
     // Only include pages that have actual content
@@ -415,34 +444,34 @@ export async function publishToGitHubWiki(cfg, renderedPages) {
 
     // Write Home.md
     const home = generateHome(pageKeys, projectName, branch, repo);
-    await fs.writeFile(path.join(tmpDir, "Home.md"), home, "utf8");
+    await writeWikiFile(tmpDir, "Home.md", home);
 
     // Write each rendered page with metadata header
     for (const [key, markdown] of populatedPages) {
       const fileName = pageFileName(key);
       const header = pageHeader(key, branch);
-      await fs.writeFile(path.join(tmpDir, fileName), header + markdown, "utf8");
+      await writeWikiFile(tmpDir, fileName, header + markdown);
     }
 
     // Generate sidebar
     if (includeSidebar) {
       const sidebar = generateSidebar(pageKeys, projectName, branch);
-      await fs.writeFile(path.join(tmpDir, "_Sidebar.md"), sidebar, "utf8");
+      await writeWikiFile(tmpDir, "_Sidebar.md", sidebar);
     }
 
     // Generate footer
     if (includeFooter) {
       const footer = generateFooter(branch);
-      await fs.writeFile(path.join(tmpDir, "_Footer.md"), footer, "utf8");
+      await writeWikiFile(tmpDir, "_Footer.md", footer);
     }
 
     // Stage, commit, push
-    git("config user.name \"RepoLens Bot\"", tmpDir);
-    git("config user.email \"repolens@users.noreply.github.com\"", tmpDir);
-    git("add -A", tmpDir);
+    git(["config", "user.name", "RepoLens Bot"], tmpDir, token);
+    git(["config", "user.email", "repolens@users.noreply.github.com"], tmpDir, token);
+    git(["add", "-A"], tmpDir, token);
 
     try {
-      execSync("git diff --cached --quiet", { cwd: tmpDir, stdio: "pipe" });
+      execFileSync("git", ["diff", "--cached", "--quiet"], { cwd: tmpDir, stdio: "pipe" });
       info("GitHub Wiki is already up to date — no changes to push.");
       return;
     } catch {
@@ -451,10 +480,10 @@ export async function publishToGitHubWiki(cfg, renderedPages) {
 
     const branchLabel = branch !== "main" && branch !== "master" ? ` [${branch}]` : "";
     const commitMsg = `docs: update RepoLens documentation${branchLabel}`;
-    git(`commit -m "${commitMsg}"`, tmpDir);
+    git(["commit", "-m", commitMsg], tmpDir, token);
 
     // GitHub Wiki serves from 'master'; push explicitly to master
-    git("push origin HEAD:refs/heads/master", tmpDir);
+    git(["push", "origin", "HEAD:refs/heads/master"], tmpDir, token);
     info(`GitHub Wiki published (${pageKeys.length} pages): https://github.com/${repo}/wiki`);
 
   } finally {

package/src/publishers/index.js

@@ -2,7 +2,8 @@ import { publishToNotion } from "./publish.js";
 import { publishToMarkdown } from "./markdown.js";
 import { publishToConfluence, hasConfluenceSecrets } from "./confluence.js";
 import { publishToGitHubWiki, hasGitHubWikiSecrets } from "./github-wiki.js";
-import { shouldPublishToNotion, shouldPublishToConfluence, shouldPublishToGitHubWiki, getCurrentBranch } from "../utils/branch.js";
+import { shouldPublishToNotion, shouldPublishToConfluence, shouldPublishToGitHubWiki, getCurrentBranch, branchMatches } from "../utils/branch.js";
+import { resolveOutputDir } from "../utils/safe-path.js";
 import { info, warn } from "../utils/logger.js";
 import { trackPublishing } from "../utils/telemetry.js";
 import { collectMetrics } from "../utils/metrics.js";
@@ -27,7 +28,7 @@ export async function publishDocs(cfg, renderedPages, scanResult, pluginManager
   let notionUrl = null;
 
   // --- Hash-based caching: skip unchanged documents ---
-  const cacheDir = path.join(process.cwd(), cfg.documentation?.output_dir || ".repolens");
+  const cacheDir = resolveOutputDir(process.cwd(), cfg.documentation?.output_dir || ".repolens");
   const { cache: previousCache, age: cacheAge } = await loadDocCache(cacheDir);
   const { changedPages, unchangedKeys, newCache } = filterChangedDocs(renderedPages, previousCache);
   logCacheStats(Object.keys(changedPages).length, unchangedKeys.length, cacheAge);
@@ -154,13 +155,7 @@ export async function publishDocs(cfg, renderedPages, scanResult, pluginManager
       
       // Check if we should send notification for this branch
       const allowedBranches = discordConfig.branches || [currentBranch]; // Default to current branch
-      const branchAllowed = allowedBranches.some(pattern => {
-        if (pattern.includes("*")) {
-          const regex = new RegExp(`^${pattern.replace(/\*/g, ".*")}$`);
-          return regex.test(currentBranch);
-        }
-        return pattern === currentBranch;
-      });
+      const branchAllowed = allowedBranches.some((pattern) => branchMatches(pattern, currentBranch));
       
       if (webhookUrl && discordEnabled && branchAllowed) {
         // Calculate change percent (if we have history)

package/src/publishers/markdown.js

@@ -1,9 +1,10 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { info } from "../utils/logger.js";
+import { resolveOutputDir, safeFileName } from "../utils/safe-path.js";
 
 function outputDir(cfg) {
-  return path.join(cfg.__repoRoot, ".repolens");
+  return resolveOutputDir(cfg.__repoRoot, ".repolens");
 }
 
 function pageFileName(key) {
@@ -27,7 +28,7 @@ function pageFileName(key) {
     code_health: "code_health.md"
   };
 
-  return mapping[key] || `${key}.md`;
+  return safeFileName(mapping[key] || `${key}.md`);
 }
 
 export async function publishToMarkdown(cfg, renderedPages) {

package/src/publishers/notion.js

@@ -1,10 +1,10 @@
-import fetch from "node-fetch";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { log, warn } from "../utils/logger.js";
 import { fetchWithRetry } from "../utils/retry.js";
 import { executeNotionRequest } from "../utils/rate-limit.js";
 import { createRepoLensError } from "../utils/errors.js";
+import { sanitizeSecrets } from "../utils/secrets.js";
 
 function notionHeaders() {
   const token = process.env.NOTION_TOKEN;
@@ -36,7 +36,8 @@ async function notionRequest(method, url, body) {
 
     if (!res.ok) {
       const text = await res.text();
-      throw new Error(`Notion API error ${res.status}: ${text}`);
+      const clipped = sanitizeSecrets(String(text || "").replace(/\s+/g, " ").slice(0, 500));
+      throw new Error(`Notion API error ${res.status}: ${clipped}`);
     }
 
     return await res.json();
@@ -62,10 +63,15 @@ async function writeCache(cache) {
 
 async function getChildBlocks(blockId) {
   const results = [];
+  const seenCursors = new Set();
   let cursor = undefined;
 
-  while (true) {
-    const suffix = cursor ? `?start_cursor=${cursor}` : "";
+  while (results.length < 10000) {
+    if (cursor) {
+      if (seenCursors.has(cursor)) break;
+      seenCursors.add(cursor);
+    }
+    const suffix = cursor ? `?start_cursor=${encodeURIComponent(cursor)}` : "";
     const response = await notionRequest("GET", `/blocks/${blockId}/children${suffix}`);
 
     if (response.results?.length) {

package/src/utils/branch.js

@@ -1,4 +1,4 @@
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 
 /**
  * Detect the current git branch from various sources
@@ -22,7 +22,7 @@ export function getCurrentBranch() {
 
   // 4. Try git command
   try {
-    const branch = execSync("git rev-parse --abbrev-ref HEAD", {
+    const branch = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "ignore"]
     }).trim();
@@ -48,6 +48,24 @@ export function normalizeBranchName(branch) {
     .toLowerCase();
 }
 
+/**
+ * Match a branch name against an exact value or a simple `*` glob.
+ * Regex metacharacters in the pattern are escaped so a bad config cannot
+ * throw or widen the match.
+ */
+export function branchMatches(pattern, branch) {
+  if (pattern === branch) return true;
+  if (typeof pattern !== "string" || typeof branch !== "string" || !pattern.includes("*")) {
+    return false;
+  }
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`).test(branch);
+}
+
+function matchesAnyBranch(patterns, currentBranch) {
+  return patterns.some((pattern) => branchMatches(pattern, currentBranch));
+}
+
 /**
  * Check if current branch should publish to Notion
  * Based on config.notion.branches setting
@@ -63,21 +81,7 @@ export function shouldPublishToNotion(config, currentBranch = getCurrentBranch()
     return true;
   }
 
-  // Check if current branch matches any allowed pattern
-  return config.notion.branches.some(pattern => {
-    // Exact match
-    if (pattern === currentBranch) {
-      return true;
-    }
-
-    // Wildcard pattern (simple glob)
-    if (pattern.includes("*")) {
-      const regex = new RegExp("^" + pattern.replace(/\*/g, ".*") + "$");
-      return regex.test(currentBranch);
-    }
-
-    return false;
-  });
+  return matchesAnyBranch(config.notion.branches, currentBranch);
 }
 
 /**
@@ -95,21 +99,7 @@ export function shouldPublishToConfluence(config, currentBranch = getCurrentBran
     return true;
   }
 
-  // Check if current branch matches any allowed pattern
-  return config.confluence.branches.some(pattern => {
-    // Exact match
-    if (pattern === currentBranch) {
-      return true;
-    }
-
-    // Wildcard pattern (simple glob)
-    if (pattern.includes("*")) {
-      const regex = new RegExp("^" + pattern.replace(/\*/g, ".*") + "$");
-      return regex.test(currentBranch);
-    }
-
-    return false;
-  });
+  return matchesAnyBranch(config.confluence.branches, currentBranch);
 }
 
 /**
@@ -125,18 +115,7 @@ export function shouldPublishToGitHubWiki(config, currentBranch = getCurrentBran
     return true;
   }
 
-  return config.github_wiki.branches.some(pattern => {
-    if (pattern === currentBranch) {
-      return true;
-    }
-
-    if (pattern.includes("*")) {
-      const regex = new RegExp("^" + pattern.replace(/\*/g, ".*") + "$");
-      return regex.test(currentBranch);
-    }
-
-    return false;
-  });
+  return matchesAnyBranch(config.github_wiki.branches, currentBranch);
 }
 
 /**

package/src/utils/github-repo.js

@@ -0,0 +1,8 @@
+export const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+export function assertGitHubRepo(repo) {
+  if (typeof repo !== "string" || !GITHUB_REPO_PATTERN.test(repo)) {
+    throw new Error(`Invalid GitHub repository "${repo}". Expected owner/name.`);
+  }
+  return repo;
+}

package/src/utils/interactive.js

@@ -0,0 +1,20 @@
+/**
+ * Sessions where RepoLens must not wait on a prompt.
+ * Covers CI providers, explicit opt-out, the test runner, and pipes.
+ */
+export function isNonInteractiveEnvironment() {
+  if (
+    process.env.CI ||
+    process.env.GITHUB_ACTIONS ||
+    process.env.GITLAB_CI ||
+    process.env.CIRCLECI ||
+    process.env.JENKINS_HOME ||
+    process.env.CODEBUILD_BUILD_ID ||
+    process.env.REPOLENS_NON_INTERACTIVE ||
+    process.env.NODE_ENV === "test" ||
+    process.env.VITEST
+  ) {
+    return true;
+  }
+  return !process.stdin.isTTY;
+}

package/src/utils/logger.js

@@ -59,7 +59,11 @@ function sanitizeArgs(args) {
       return sanitizeSecrets(arg);
     }
     if (typeof arg === "object" && arg !== null) {
-      return JSON.parse(sanitizeSecrets(JSON.stringify(arg)));
+      try {
+        return JSON.parse(sanitizeSecrets(JSON.stringify(arg)));
+      } catch {
+        return "[unserializable]";
+      }
     }
     return arg;
   });

package/src/utils/retry.js

@@ -8,6 +8,30 @@ function isRetryableStatus(status) {
   return status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
 }
 
+const MAX_RETRY_AFTER_MS = 60_000;
+
+/**
+ * Honour Retry-After when it is delta-seconds or an HTTP date.
+ * Unparseable values fall back to exponential backoff. Delays are capped
+ * so a hostile header cannot stall the process.
+ */
+export function retryDelayMs(retryAfterHeader, attempt, baseDelayMs, maxDelayMs) {
+  const fallback = Math.min(baseDelayMs * 2 ** attempt, maxDelayMs);
+  if (retryAfterHeader == null || retryAfterHeader === "") return fallback;
+
+  const seconds = Number(retryAfterHeader);
+  if (Number.isFinite(seconds) && seconds >= 0) {
+    return Math.min(seconds * 1000, MAX_RETRY_AFTER_MS);
+  }
+
+  const when = Date.parse(retryAfterHeader);
+  if (Number.isFinite(when)) {
+    return Math.min(Math.max(0, when - Date.now()), MAX_RETRY_AFTER_MS);
+  }
+
+  return fallback;
+}
+
 export async function fetchWithRetry(url, options = {}, config = {}) {
   const {
     retries = 3,
@@ -37,12 +61,12 @@ export async function fetchWithRetry(url, options = {}, config = {}) {
         return response;
       }
 
-      const retryAfterHeader = response.headers.get("retry-after");
-      const retryAfterMs = retryAfterHeader != null
-        ? Number(retryAfterHeader) * 1000
-        : null;
-
-      const delay = retryAfterMs != null ? retryAfterMs : Math.min(baseDelayMs * 2 ** attempt, maxDelayMs);
+      const delay = retryDelayMs(
+        response.headers.get("retry-after"),
+        attempt,
+        baseDelayMs,
+        maxDelayMs
+      );
 
       warn(`${label} failed with retryable status ${response.status}. Retrying in ${delay}ms (attempt ${attempt + 1}/${retries + 1})`);
       await sleep(delay);

package/src/utils/safe-path.js

@@ -0,0 +1,50 @@
+import path from "node:path";
+
+/**
+ * True when `target` is `root` or a path inside it.
+ * Comparison uses resolved paths so `..`, absolute segments, and
+ * platform separators cannot escape the root.
+ */
+export function isInsideRoot(root, target) {
+  const rootResolved = path.resolve(root);
+  const targetResolved = path.resolve(target);
+  const rel = path.relative(rootResolved, targetResolved);
+  return rel === "" || (!rel.startsWith(`..${path.sep}`) && rel !== ".." && !path.isAbsolute(rel));
+}
+
+/**
+ * Resolve a documentation output directory and keep it inside `root`.
+ * Absolute paths and `..` escapes are rejected. An empty value means `.repolens`.
+ */
+export function resolveOutputDir(root, outputDir = ".repolens") {
+  const relative = outputDir == null || outputDir === "" ? ".repolens" : outputDir;
+  if (typeof relative !== "string") {
+    throw new Error("Output directory must be a string");
+  }
+  if (relative.includes("\0")) {
+    throw new Error("Output directory contains a null byte");
+  }
+  if (path.isAbsolute(relative)) {
+    throw new Error(`Output directory must be a relative path inside the repository (received ${relative})`);
+  }
+
+  const rootResolved = path.resolve(root);
+  const resolved = path.resolve(rootResolved, relative);
+  if (!isInsideRoot(rootResolved, resolved)) {
+    throw new Error(`Output directory escapes the repository: ${relative}`);
+  }
+  return resolved;
+}
+
+/**
+ * Reduce a document or wiki name to a single path segment.
+ */
+export function safeFileName(name, fallback = "document.md") {
+  if (typeof name !== "string" || name.length === 0) return fallback;
+  const normalized = name.replace(/\\/g, "/");
+  const base = path.posix.basename(normalized);
+  if (!base || base === "." || base === ".." || base.includes("\0") || base.includes("/") || base.includes("\\")) {
+    return fallback;
+  }
+  return base;
+}

package/src/utils/secrets.js

@@ -12,7 +12,9 @@ const SECRET_PATTERNS = [
   // API Keys
   { name: "OpenAI API Key", pattern: /sk-[a-zA-Z0-9]{20,}/, severity: "high" },
   { name: "Anthropic API Key", pattern: /sk-ant-[a-zA-Z0-9_-]{95,}/, severity: "high" },
-  { name: "GitHub Token", pattern: /gh[ps]_[a-zA-Z0-9]{36,}/, severity: "critical" },
+  { name: "GitHub Token", pattern: /gh[pousr]_[a-zA-Z0-9]{36,}/, severity: "critical" },
+  { name: "GitHub Fine-Grained Token", pattern: /github_pat_[a-zA-Z0-9_]{20,}/, severity: "critical" },
+  { name: "npm Token", pattern: /npm_[a-zA-Z0-9]{36,}/, severity: "critical" },
   { name: "Generic API Key", pattern: /api[_-]?key[_-]?[a-zA-Z0-9]{20,}/i, severity: "high" },
   
   // OAuth Tokens

package/src/utils/telemetry.js

@@ -1,4 +1,3 @@
-import * as Sentry from "@sentry/node";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
@@ -9,12 +8,32 @@ const __dirname = dirname(__filename);
 
 let initialized = false;
 let enabled = false;
+let Sentry = null;
+let sentryLoadFailed = false;
+
+/**
+ * Load @sentry/node on demand. Telemetry is opt-in and the package is an
+ * optional dependency, so a missing install must not crash the CLI.
+ */
+async function loadSentry() {
+  if (Sentry) return Sentry;
+  if (sentryLoadFailed) return null;
+
+  try {
+    Sentry = await import("@sentry/node");
+    return Sentry;
+  } catch {
+    sentryLoadFailed = true;
+    Sentry = null;
+    return null;
+  }
+}
 
 /**
  * Initialize error tracking (Sentry)
  * Only enabled if REPOLENS_TELEMETRY_ENABLED=true
  */
-export function initTelemetry() {
+export async function initTelemetry() {
   // Skip if already initialized
   if (initialized) return;
   initialized = true;
@@ -27,6 +46,13 @@ export function initTelemetry() {
     return;
   }
 
+  const sentry = await loadSentry();
+  if (!sentry) {
+    console.error("Telemetry enabled but optional dependency @sentry/node is not installed. Continuing without telemetry.");
+    enabled = false;
+    return;
+  }
+
   try {
     // Get version from package.json
     const packageJsonPath = join(__dirname, "../../package.json");
@@ -35,7 +61,7 @@ export function initTelemetry() {
 
     const dsn = process.env.REPOLENS_SENTRY_DSN || "https://082083dbf5899ed7e65dfd9b8dc72f90@o4511014913703936.ingest.de.sentry.io/4511014919209040";
 
-    Sentry.init({
+    sentry.init({
       dsn,
       
       // Release tracking
@@ -405,7 +431,9 @@ export function trackMigration(migratedCount, skippedCount) {
  * Ensure Sentry is initialized for feedback submission.
  * Feedback always works, even if REPOLENS_TELEMETRY_ENABLED is false.
  */
-function ensureSentryForFeedback() {
+async function ensureSentryForFeedback() {
+  const sentry = await loadSentry();
+  if (!sentry) return false;
   if (enabled) return true;
 
   // Initialize Sentry in a minimal mode just for feedback
@@ -416,7 +444,7 @@ function ensureSentryForFeedback() {
 
     const dsn = process.env.REPOLENS_SENTRY_DSN || "https://082083dbf5899ed7e65dfd9b8dc72f90@o4511014913703936.ingest.de.sentry.io/4511014919209040";
 
-    Sentry.init({
+    sentry.init({
       dsn,
       release: `repolens@${version}`,
       environment: process.env.NODE_ENV || "production",
@@ -439,7 +467,7 @@ function ensureSentryForFeedback() {
  */
 export async function sendFeedback(name, email, message) {
   try {
-    if (!ensureSentryForFeedback()) {
+    if (!(await ensureSentryForFeedback())) {
       return false;
     }