@chappibunny/repolens 1.12.2 → 1.13.0

package/src/init.js

@@ -1,10 +1,11 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
-import { exec } from "node:child_process";
+import { spawn } from "node:child_process";
 import { info, warn } from "./utils/logger.js";
+import { isNonInteractiveEnvironment } from "./utils/interactive.js";
 
-const PUBLISHER_CHOICES = ["markdown", "notion", "confluence", "github_wiki"];
+const PUBLISHER_CHOICES = ["markdown", "notion", "confluence", "github_wiki", "obsidian"];
 
 // ============================================================================
 // URL PARSING HELPERS
@@ -337,8 +338,14 @@ on:
       - main
   pull_request:
 
+# contents: read checks out the repository.
+# pull-requests: write creates and updates the Architecture Diff
+# comment on pull requests (Issues comments API). Repository write
+# is not required for that comment. Add it only on a job that
+# publishes the GitHub Wiki.
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   publish:
@@ -428,6 +435,10 @@ If you configured Notion credentials during setup, documentation will publish au
    - \`NOTION_TOKEN\` — Get from https://www.notion.so/my-integrations
    - \`NOTION_PARENT_PAGE_ID\` — The page where docs will be published
 
+### Obsidian and GitHub Wiki
+
+Obsidian writes notes into a folder in a local vault. Set \`obsidian.vault\` in \`.repolens.yml\`. No API key and no network. GitHub Wiki needs \`github_wiki\` in \`publishers\` and \`GITHUB_TOKEN\`.
+
 ### Confluence Publishing
 
 To publish documentation to Atlassian Confluence:
@@ -461,25 +472,24 @@ For automated publishing on every push:
 
 3. Push to main branch
 
+The workflow token is \`contents: read\` plus \`pull-requests: write\`. That is enough for checkout and the Architecture Diff comment. It cannot push commits. GitHub Wiki publishing pushes a separate wiki repository, so add \`contents: write\` on that job only when you enable the wiki publisher.
+
 ## 📊 Generated Documentation
 
-RepoLens generates documentation in two modes:
+RepoLens generates 17 documents by default. Diagrams are Unicode.
 
-### Deterministic Mode (Default - Free)
-- **System Overview** — Technical profile and stats
-- **Module Catalog** — Complete code inventory
-- **API Surface** — Internal endpoints + external integrations
-- **Route Map** — Application routes
-- **System Map** — Unicode architecture diagram
-- **Architecture Diff** — Change tracking
+### Always written
+- **System Overview**, **Module Catalog**, **API Surface**, **Route Map**, **System Map** (Unicode diagram), **Architecture Diff**
+- **GraphQL Schema**, **Type Graph**, **Dependency Graph**, **Architecture Drift**, **Security Hotspots**, **Code Health**
 
-### AI-Enhanced Mode (Optional - Requires API Key)
-Adds 5 natural language documents readable by non-technical audiences:
+### AI-Enhanced Mode (Optional)
+These documents use AI when it is enabled, and a deterministic fallback when it is not:
 - **Executive Summary** — Project overview for leadership
 - **Business Domains** — What the system does by function
 - **Architecture Overview** — Layered technical analysis
-- **Data Flows** — How information moves through system
+- **Data Flows** — How information moves through the system
 - **Developer Onboarding** — Getting started guide
+- **Change Impact** and the hybrid pages above (module catalog, route map, API surface, system map)
 
 ## 🤖 Enabling AI Features
 
@@ -520,11 +530,7 @@ No API key signup needed. Uses \`gpt-4o-mini\` by default.
 
 **Cost estimate**: $0.10-$0.40 per run for typical projects (or free with GitHub Models)
 
-See [AI.md](https://github.com/CHAPIBUNNY/repolens/blob/main/AI.md) for full documentation
-- **Module Catalog** — Detected code modules
-- **API Surface** — REST API endpoints
-- **Route Map** — Application routes
-- **System Map** — Architecture diagram (Unicode ASCII art)
+See [AI.md](https://github.com/CHAPIBUNNY/repolens/blob/main/docs/AI.md) for full documentation.
 
 ## ⚙️ Configuration
 
@@ -538,8 +544,8 @@ Edit \`.repolens.yml\` to customize:
 ## 📚 Learn More
 
 - [RepoLens GitHub](https://github.com/CHAPIBUNNY/repolens)
-- [Configuration Docs](https://github.com/CHAPIBUNNY/repolens#configuration)
-- [Troubleshooting](https://github.com/CHAPIBUNNY/repolens#troubleshooting)
+- [Configuration](https://github.com/CHAPIBUNNY/repolens/blob/main/docs/CONFIGURATION.md)
+- [Troubleshooting](https://github.com/CHAPIBUNNY/repolens/blob/main/docs/TROUBLESHOOTING.md)
 `;
 
 async function fileExists(filePath) {
@@ -564,24 +570,27 @@ async function dirExists(dirPath) {
  * Open a URL in the default browser (cross-platform).
  */
 function openUrl(url) {
-  const platform = process.platform;
-  let cmd;
-  if (platform === "darwin") {
-    cmd = `open "${url}"`;
-  } else if (platform === "win32") {
-    cmd = `start "" "${url}"`;
-  } else {
-    cmd = `xdg-open "${url}"`;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return Promise.resolve(false);
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    return Promise.resolve(false);
   }
+
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "rundll32" : "xdg-open";
+  const args = platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+
   return new Promise((resolve) => {
-    exec(cmd, (err) => {
-      if (err) {
-        warn(`Could not open browser: ${err.message}`);
-        resolve(false);
-      } else {
-        resolve(true);
-      }
+    const child = spawn(cmd, args, { stdio: "ignore" });
+    child.on("error", (err) => {
+      warn(`Could not open browser: ${err.message}`);
+      resolve(false);
     });
+    child.on("close", (code) => resolve(code === 0));
   });
 }
 
@@ -742,6 +751,17 @@ function buildRepoLensConfig(projectName, detectedRoots, options = {}) {
     `#     - main        # Only publish from main branch`,
     `#     - develop     # Or add specific branches`,
     ``,
+    `# Optional: Publish into a local Obsidian vault (no network)`,
+    `# publishers also needs: - obsidian`,
+    `# obsidian:`,
+    `#   vault: "/path/to/vault"     # absolute, or relative to this repo`,
+    `#   folder: "RepoLens/my-app"   # stays inside the vault`,
+    `#   branches:`,
+    `#     - main`,
+    `#   index: true`,
+    `#   frontmatter: true`,
+    `#   wikilinks: true`,
+    ``,
     `# Optional: GitHub integration for SVG diagram hosting`,
     `# github:`,
     `#   owner: "your-username"`,
@@ -844,23 +864,10 @@ function detectProjectName(repoRoot) {
 }
 
 async function promptNotionCredentials() {
-  // Skip prompts in CI environments or test mode
-  const isCI = process.env.CI || 
-               process.env.GITHUB_ACTIONS || 
-               process.env.GITLAB_CI || 
-               process.env.CIRCLECI ||
-               process.env.JENKINS_HOME ||
-               process.env.CODEBUILD_BUILD_ID;
-  
-  const isTest = process.env.NODE_ENV === 'test' || process.env.VITEST;
-  
-  if (isCI) {
-    info("⏭️  Skipping interactive prompts (CI environment detected)");
-    return null;
-  }
-  
-  if (isTest) {
-    // Skip silently in test mode
+  if (isNonInteractiveEnvironment()) {
+    if (process.env.NODE_ENV !== "test" && !process.env.VITEST) {
+      info("⏭️  Skipping interactive prompts (non-interactive environment)");
+    }
     return null;
   }
 
@@ -943,11 +950,6 @@ async function ensureEnvInGitignore(repoRoot) {
  * Returns a structured config that replaces the auto-detected defaults.
  */
 async function runInteractiveWizard(repoRoot) {
-  const isCI = process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI ||
-               process.env.CIRCLECI || process.env.JENKINS_HOME || process.env.CODEBUILD_BUILD_ID;
-  const isTest = process.env.NODE_ENV === "test" || process.env.VITEST;
-  if (isCI || isTest) return null;
-
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   const ask = (q) => rl.question(q);
 
@@ -1162,6 +1164,20 @@ async function runInteractiveWizard(repoRoot) {
       githubSecretsNeeded.push("CONFLUENCE_URL", "CONFLUENCE_EMAIL", "CONFLUENCE_API_TOKEN", "CONFLUENCE_SPACE_KEY", "CONFLUENCE_PARENT_PAGE_ID");
     }
 
+    // Obsidian vault (local path only — no credentials)
+    let obsidian = null;
+    if (publishers.includes("obsidian")) {
+      info("\n📝 Obsidian Vault");
+      info("   Notes are written into a folder in your vault. Nothing is uploaded.");
+      const vault = (await ask("   Vault path (absolute, or relative to the repo): ")).trim();
+      const folderDefault = `RepoLens/${projectName}`;
+      const folder = (await ask(`   Folder inside the vault (${folderDefault}): `)).trim();
+      obsidian = { vault, folder: folder || folderDefault };
+      if (!vault) {
+        warn("   No vault path yet. Add obsidian.vault to .repolens.yml before publishing.");
+      }
+    }
+
     // GitHub Wiki setup
     if (publishers.includes("github_wiki")) {
       info("\n📝 GitHub Wiki Setup");
@@ -1284,7 +1300,7 @@ async function runInteractiveWizard(repoRoot) {
 
     // 6. Branch filtering
     info("\n🌿 Branch Filtering");
-    info("   Limits which branches can publish to Notion/Confluence.");
+    info("   Limits which branches can publish to Notion, Confluence, and Obsidian.");
     const branchInput = (await ask("   Allowed branches (comma-separated, default: main): ")).trim() || "main";
     const branches = branchInput.split(",").map((b) => b.trim()).filter(Boolean);
 
@@ -1342,7 +1358,8 @@ async function runInteractiveWizard(repoRoot) {
       branches, 
       enableDiscord,
       credentials,
-      githubSecretsNeeded: uniqueSecrets
+      githubSecretsNeeded: uniqueSecrets,
+      obsidian,
     };
   } finally {
     rl.close();
@@ -1354,6 +1371,7 @@ const PUBLISHER_DESCRIPTIONS = {
   notion: "Notion workspace pages",
   confluence: "Atlassian Confluence pages",
   github_wiki: "Repository wiki pages",
+  obsidian: "Local Obsidian vault folder",
 };
 
 /**
@@ -1386,6 +1404,22 @@ function buildWizardConfig(answers) {
     lines.push(`  branches:`);
     for (const b of answers.branches) lines.push(`    - ${b}`);
   }
+  if (answers.publishers.includes("obsidian")) {
+    lines.push(``);
+    lines.push(`obsidian:`);
+    if (answers.obsidian?.vault) {
+      lines.push(`  vault: ${JSON.stringify(answers.obsidian.vault)}`);
+    }
+    const folder = answers.obsidian?.folder || `RepoLens/${answers.projectName}`;
+    lines.push(`  folder: ${JSON.stringify(folder)}`);
+    if (answers.branches?.length) {
+      lines.push(`  branches:`);
+      for (const b of answers.branches) lines.push(`    - ${b}`);
+    }
+    lines.push(`  index: true`);
+    lines.push(`  frontmatter: true`);
+    lines.push(`  wikilinks: true`);
+  }
 
   if (answers.enableDiscord) {
     lines.push(``);
@@ -1515,14 +1549,17 @@ export async function runInit(targetDir = process.cwd(), options = {}) {
   // Ensure target directory exists
   await fs.mkdir(repoRoot, { recursive: true });
 
-  // Interactive wizard is now the default (--quick skips it)
+  // Interactive wizard is the default (--quick skips it).
+  // CI, tests, and closed stdin used to return null from the wizard and
+  // abort before any files were written. Fall through to quick setup instead.
   let wizardAnswers = null;
-  if (options.interactive) {
+  if (options.interactive && !isNonInteractiveEnvironment()) {
     wizardAnswers = await runInteractiveWizard(repoRoot);
     if (!wizardAnswers) {
-      // User cancelled the wizard
       return;
     }
+  } else if (options.interactive) {
+    info("Non-interactive environment detected — running quick setup instead of the wizard.");
   }
 
   // Prompt for Notion credentials interactively (only in non-wizard mode)

package/src/integrations/discord.js

@@ -3,8 +3,8 @@
  * Sends rich embed notifications to Discord channels via webhooks
  */
 
-import fetch from "node-fetch";
 import { info, warn, error } from "../utils/logger.js";
+import { sanitizeSecrets } from "../utils/secrets.js";
 
 /**
  * Send a notification to Discord webhook
@@ -26,15 +26,29 @@ export async function sendDiscordNotification(webhookUrl, payload) {
       embeds: [embed],
     };
 
+    let webhook;
+    try {
+      webhook = new URL(webhookUrl);
+    } catch {
+      warn("Discord webhook URL is not a valid URL, skipping notification");
+      return false;
+    }
+    if (webhook.protocol !== "https:") {
+      warn("Discord webhook URL must use https, skipping notification");
+      return false;
+    }
+
     const response = await fetch(webhookUrl, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(body),
+      signal: AbortSignal.timeout(15000),
+      redirect: "error",
     });
 
     if (!response.ok) {
       const text = await response.text();
-      error(`Discord webhook failed (${response.status}): ${text}`);
+      error(`Discord webhook failed (${response.status}): ${sanitizeSecrets(String(text).slice(0, 300))}`);
       return false;
     }
 

package/src/migrate.js

@@ -1,6 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import yaml from "js-yaml";
+import { loadYaml } from "./utils/yaml.js";
 import { info, warn, error as logError } from "./utils/logger.js";
 import { trackMigration } from "./utils/telemetry.js";
 
@@ -141,7 +141,7 @@ async function migrateConfigFile(targetDir, options = {}) {
   const raw = await fs.readFile(configPath, "utf8");
   let parsed;
   try {
-    parsed = yaml.load(raw);
+    parsed = loadYaml(raw);
   } catch {
     warn(`   ⚠️  Could not parse ${filename} — skipping config migration`);
     return { migrated: false, filePath: configPath, reason: "parse-error" };

package/src/publishers/confluence.js

@@ -1,10 +1,10 @@
-import fetch from "node-fetch";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { log, info, warn } from "../utils/logger.js";
 import { fetchWithRetry } from "../utils/retry.js";
 import { getCurrentBranch, getBranchQualifiedTitle } from "../utils/branch.js";
 import { createRepoLensError } from "../utils/errors.js";
+import { sanitizeSecrets } from "../utils/secrets.js";
 
 /**
  * Confluence Publisher for RepoLens
@@ -50,6 +50,19 @@ function getConfluenceBaseUrl() {
     );
   }
   
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("CONFLUENCE_URL is not a valid URL");
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new Error("CONFLUENCE_URL must use http or https");
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error("CONFLUENCE_URL must not include embedded credentials. Use CONFLUENCE_EMAIL and CONFLUENCE_API_TOKEN.");
+  }
+
   // Normalize URL (remove trailing slash, ensure /wiki for Cloud)
   let normalized = url.replace(/\/+$/, "");
   
@@ -84,7 +97,8 @@ async function confluenceRequest(method, endpoint, body = null) {
 
   if (!res.ok) {
     const text = await res.text();
-    let errorMsg = `Confluence API error ${res.status}: ${text}`;
+    const clipped = sanitizeSecrets(String(text || "").replace(/\s+/g, " ").slice(0, 500));
+    let errorMsg = `Confluence API error ${res.status}: ${clipped}`;
     
     // Provide helpful error messages
     if (res.status === 401) {
@@ -114,7 +128,7 @@ async function confluenceRequest(method, endpoint, body = null) {
 const CACHE_DIR = path.join(process.cwd(), ".cache");
 
 function getCacheFile() {
-  const branch = getCurrentBranch();
+  const branch = getCurrentBranch().replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80) || "unknown";
   return path.join(CACHE_DIR, `confluence-pages-${branch}.json`);
 }
 

package/src/publishers/github-wiki.js

@@ -13,12 +13,14 @@
 //     sidebar: true              # Generate _Sidebar.md (default: true)
 //     footer: true               # Generate _Footer.md (default: true)
 
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs/promises";
 import path from "node:path";
 import os from "node:os";
 import { info, warn } from "../utils/logger.js";
-import { getCurrentBranch, getBranchQualifiedTitle, normalizeBranchName } from "../utils/branch.js";
+import { getCurrentBranch, getBranchQualifiedTitle } from "../utils/branch.js";
+import { assertGitHubRepo } from "../utils/github-repo.js";
+import { isInsideRoot, safeFileName } from "../utils/safe-path.js";
 
 const PAGE_ORDER = [
   "executive_summary",
@@ -176,7 +178,7 @@ function detectGitHubRepo() {
   }
 
   try {
-    const remoteUrl = execSync("git remote get-url origin", {
+    const remoteUrl = execFileSync("git", ["remote", "get-url", "origin"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "ignore"],
     }).trim();
@@ -194,10 +196,30 @@ function detectGitHubRepo() {
 }
 
 /**
- * Build the authenticated wiki clone URL.
+ * Wiki clone URL. The token is passed to git through http.extraheader,
+ * not embedded in the URL, so it does not show up in process arguments
+ * or in the temporary repo's origin remote.
  */
-function buildWikiCloneUrl(repo, token) {
-  return `https://x-access-token:${token}@github.com/${repo}.wiki.git`;
+function buildWikiCloneUrl(repo) {
+  return `https://github.com/${repo}.wiki.git`;
+}
+
+function gitEnv(token) {
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  if (token) {
+    env.GIT_CONFIG_COUNT = "1";
+    env.GIT_CONFIG_KEY_0 = "http.https://github.com/.extraheader";
+    env.GIT_CONFIG_VALUE_0 = `AUTHORIZATION: bearer ${token}`;
+  }
+  return env;
+}
+
+export function sanitizeGitError(text) {
+  return String(text || "")
+    .replace(/x-access-token:[^\s@]+/gi, "x-access-token:***")
+    .replace(/bearer\s+[A-Za-z0-9._\-]+/gi, "bearer ***")
+    .replace(/github_pat_[A-Za-z0-9_]+/g, "github_pat_***")
+    .replace(/gh[pousr]_[A-Za-z0-9_]+/g, "gh*_***");
 }
 
 /**
@@ -205,7 +227,7 @@ function buildWikiCloneUrl(repo, token) {
  */
 function pageFileName(key) {
   const title = getPageDisplayTitle(key);
-  return title.replace(/\s+/g, "-") + ".md";
+  return safeFileName(`${title.replace(/\s+/g, "-")}.md`);
 }
 
 /**
@@ -346,23 +368,29 @@ function pageHeader(key, branch) {
 
 /**
  * Run a git command in the specified directory.
- * Token is never exposed in error output.
+ * `args` is an argument array. The token stays in the environment, not argv.
  */
-function git(args, cwd) {
+function git(args, cwd, token) {
   try {
-    return execSync(`git ${args}`, {
+    return execFileSync("git", args, {
       cwd,
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
-      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+      env: gitEnv(token),
     });
   } catch (err) {
-    const sanitized = (err.stderr || err.message || "").replace(
-      /x-access-token:[^\s@]+/g,
-      "x-access-token:***"
-    );
-    throw new Error(`Git command failed: git ${args.split(" ")[0]} — ${sanitized}`);
+    const sanitized = sanitizeGitError(err.stderr || err.message || "");
+    throw new Error(`Git command failed: git ${args[0]} — ${sanitized}`);
+  }
+}
+
+async function writeWikiFile(tmpDir, fileName, content) {
+  const safe = safeFileName(fileName);
+  const full = path.resolve(tmpDir, safe);
+  if (!isInsideRoot(tmpDir, full)) {
+    throw new Error(`Refusing to write wiki file outside the workspace: ${fileName}`);
   }
+  await fs.writeFile(full, content, "utf8");
 }
 
 /**
@@ -378,13 +406,14 @@ export async function publishToGitHubWiki(cfg, renderedPages) {
     );
   }
 
-  const repo = detectGitHubRepo();
-  if (!repo) {
+  const detected = detectGitHubRepo();
+  if (!detected) {
     throw new Error(
       "Could not detect GitHub repository. Set GITHUB_REPOSITORY=owner/repo\n" +
       "or ensure git remote 'origin' points to a GitHub URL."
     );
   }
+  const repo = assertGitHubRepo(detected);
 
   const branch = getCurrentBranch();
   const wikiConfig = cfg.github_wiki || {};
@@ -395,16 +424,16 @@ export async function publishToGitHubWiki(cfg, renderedPages) {
   const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "repolens-wiki-"));
 
   try {
-    const cloneUrl = buildWikiCloneUrl(repo, token);
+    const cloneUrl = buildWikiCloneUrl(repo);
 
     try {
-      git(`clone --depth 1 ${cloneUrl} .`, tmpDir);
+      git(["clone", "--depth", "1", cloneUrl, "."], tmpDir, token);
     } catch {
       warn("Wiki repository not found — initializing. Enable the wiki tab in GitHub repo settings.");
       // GitHub Wiki uses 'master' as default branch; ensure compatibility
       // regardless of the local git init.defaultBranch setting
-      git("init -b master", tmpDir);
-      git(`remote add origin ${cloneUrl}`, tmpDir);
+      git(["init", "-b", "master"], tmpDir, token);
+      git(["remote", "add", "origin", cloneUrl], tmpDir, token);
     }
 
     // Only include pages that have actual content
@@ -415,34 +444,34 @@ export async function publishToGitHubWiki(cfg, renderedPages) {
 
     // Write Home.md
     const home = generateHome(pageKeys, projectName, branch, repo);
-    await fs.writeFile(path.join(tmpDir, "Home.md"), home, "utf8");
+    await writeWikiFile(tmpDir, "Home.md", home);
 
     // Write each rendered page with metadata header
     for (const [key, markdown] of populatedPages) {
       const fileName = pageFileName(key);
       const header = pageHeader(key, branch);
-      await fs.writeFile(path.join(tmpDir, fileName), header + markdown, "utf8");
+      await writeWikiFile(tmpDir, fileName, header + markdown);
     }
 
     // Generate sidebar
     if (includeSidebar) {
       const sidebar = generateSidebar(pageKeys, projectName, branch);
-      await fs.writeFile(path.join(tmpDir, "_Sidebar.md"), sidebar, "utf8");
+      await writeWikiFile(tmpDir, "_Sidebar.md", sidebar);
     }
 
     // Generate footer
     if (includeFooter) {
       const footer = generateFooter(branch);
-      await fs.writeFile(path.join(tmpDir, "_Footer.md"), footer, "utf8");
+      await writeWikiFile(tmpDir, "_Footer.md", footer);
     }
 
     // Stage, commit, push
-    git("config user.name \"RepoLens Bot\"", tmpDir);
-    git("config user.email \"repolens@users.noreply.github.com\"", tmpDir);
-    git("add -A", tmpDir);
+    git(["config", "user.name", "RepoLens Bot"], tmpDir, token);
+    git(["config", "user.email", "repolens@users.noreply.github.com"], tmpDir, token);
+    git(["add", "-A"], tmpDir, token);
 
     try {
-      execSync("git diff --cached --quiet", { cwd: tmpDir, stdio: "pipe" });
+      execFileSync("git", ["diff", "--cached", "--quiet"], { cwd: tmpDir, stdio: "pipe" });
       info("GitHub Wiki is already up to date — no changes to push.");
       return;
     } catch {
@@ -451,10 +480,10 @@ export async function publishToGitHubWiki(cfg, renderedPages) {
 
     const branchLabel = branch !== "main" && branch !== "master" ? ` [${branch}]` : "";
     const commitMsg = `docs: update RepoLens documentation${branchLabel}`;
-    git(`commit -m "${commitMsg}"`, tmpDir);
+    git(["commit", "-m", commitMsg], tmpDir, token);
 
     // GitHub Wiki serves from 'master'; push explicitly to master
-    git("push origin HEAD:refs/heads/master", tmpDir);
+    git(["push", "origin", "HEAD:refs/heads/master"], tmpDir, token);
     info(`GitHub Wiki published (${pageKeys.length} pages): https://github.com/${repo}/wiki`);
 
   } finally {

package/src/publishers/index.js

@@ -2,7 +2,9 @@ import { publishToNotion } from "./publish.js";
 import { publishToMarkdown } from "./markdown.js";
 import { publishToConfluence, hasConfluenceSecrets } from "./confluence.js";
 import { publishToGitHubWiki, hasGitHubWikiSecrets } from "./github-wiki.js";
-import { shouldPublishToNotion, shouldPublishToConfluence, shouldPublishToGitHubWiki, getCurrentBranch } from "../utils/branch.js";
+import { publishToObsidian } from "./obsidian.js";
+import { shouldPublishToNotion, shouldPublishToConfluence, shouldPublishToGitHubWiki, shouldPublishToObsidian, getCurrentBranch, branchMatches } from "../utils/branch.js";
+import { resolveOutputDir } from "../utils/safe-path.js";
 import { info, warn } from "../utils/logger.js";
 import { trackPublishing } from "../utils/telemetry.js";
 import { collectMetrics } from "../utils/metrics.js";
@@ -27,7 +29,7 @@ export async function publishDocs(cfg, renderedPages, scanResult, pluginManager
   let notionUrl = null;
 
   // --- Hash-based caching: skip unchanged documents ---
-  const cacheDir = path.join(process.cwd(), cfg.documentation?.output_dir || ".repolens");
+  const cacheDir = resolveOutputDir(process.cwd(), cfg.documentation?.output_dir || ".repolens");
   const { cache: previousCache, age: cacheAge } = await loadDocCache(cacheDir);
   const { changedPages, unchangedKeys, newCache } = filterChangedDocs(renderedPages, previousCache);
   logCacheStats(Object.keys(changedPages).length, unchangedKeys.length, cacheAge);
@@ -95,6 +97,25 @@ export async function publishDocs(cfg, renderedPages, scanResult, pluginManager
     }
   }
 
+  // Obsidian vault (local files only — no credentials, no network)
+  if (publishers.includes("obsidian")) {
+    if (shouldPublishToObsidian(cfg, currentBranch)) {
+      info(`Publishing to Obsidian vault from branch: ${currentBranch}`);
+      try {
+        await publishToObsidian(cfg, renderedPages);
+        publishedTo.push("obsidian");
+      } catch (err) {
+        warn(`Obsidian publish failed: ${err.message}`);
+        publishErrors.push({ publisher: "obsidian", error: err });
+        publishStatus = "partial";
+      }
+    } else {
+      const allowedBranches = cfg.obsidian?.branches?.join(", ") || "none configured";
+      warn(`Skipping Obsidian publish: branch "${currentBranch}" not in allowed list (${allowedBranches})`);
+      info("To publish from this branch, add it to obsidian.branches in .repolens.yml");
+    }
+  }
+
   // GitHub Wiki publishing (opt-in if secrets configured)
   if (publishers.includes("github_wiki") || hasGitHubWikiSecrets() && publishers.includes("github_wiki")) {
     if (!hasGitHubWikiSecrets()) {
@@ -154,13 +175,7 @@ export async function publishDocs(cfg, renderedPages, scanResult, pluginManager
       
       // Check if we should send notification for this branch
       const allowedBranches = discordConfig.branches || [currentBranch]; // Default to current branch
-      const branchAllowed = allowedBranches.some(pattern => {
-        if (pattern.includes("*")) {
-          const regex = new RegExp(`^${pattern.replace(/\*/g, ".*")}$`);
-          return regex.test(currentBranch);
-        }
-        return pattern === currentBranch;
-      });
+      const branchAllowed = allowedBranches.some((pattern) => branchMatches(pattern, currentBranch));
       
       if (webhookUrl && discordEnabled && branchAllowed) {
         // Calculate change percent (if we have history)