@chappibunny/repolens 1.12.2 → 1.13.0

package/src/utils/branch.js

@@ -1,4 +1,4 @@
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 
 /**
  * Detect the current git branch from various sources
@@ -22,7 +22,7 @@ export function getCurrentBranch() {
 
   // 4. Try git command
   try {
-    const branch = execSync("git rev-parse --abbrev-ref HEAD", {
+    const branch = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "ignore"]
     }).trim();
@@ -48,6 +48,24 @@ export function normalizeBranchName(branch) {
     .toLowerCase();
 }
 
+/**
+ * Match a branch name against an exact value or a simple `*` glob.
+ * Regex metacharacters in the pattern are escaped so a bad config cannot
+ * throw or widen the match.
+ */
+export function branchMatches(pattern, branch) {
+  if (pattern === branch) return true;
+  if (typeof pattern !== "string" || typeof branch !== "string" || !pattern.includes("*")) {
+    return false;
+  }
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`).test(branch);
+}
+
+function matchesAnyBranch(patterns, currentBranch) {
+  return patterns.some((pattern) => branchMatches(pattern, currentBranch));
+}
+
 /**
  * Check if current branch should publish to Notion
  * Based on config.notion.branches setting
@@ -63,21 +81,7 @@ export function shouldPublishToNotion(config, currentBranch = getCurrentBranch()
     return true;
   }
 
-  // Check if current branch matches any allowed pattern
-  return config.notion.branches.some(pattern => {
-    // Exact match
-    if (pattern === currentBranch) {
-      return true;
-    }
-
-    // Wildcard pattern (simple glob)
-    if (pattern.includes("*")) {
-      const regex = new RegExp("^" + pattern.replace(/\*/g, ".*") + "$");
-      return regex.test(currentBranch);
-    }
-
-    return false;
-  });
+  return matchesAnyBranch(config.notion.branches, currentBranch);
 }
 
 /**
@@ -95,21 +99,7 @@ export function shouldPublishToConfluence(config, currentBranch = getCurrentBran
     return true;
   }
 
-  // Check if current branch matches any allowed pattern
-  return config.confluence.branches.some(pattern => {
-    // Exact match
-    if (pattern === currentBranch) {
-      return true;
-    }
-
-    // Wildcard pattern (simple glob)
-    if (pattern.includes("*")) {
-      const regex = new RegExp("^" + pattern.replace(/\*/g, ".*") + "$");
-      return regex.test(currentBranch);
-    }
-
-    return false;
-  });
+  return matchesAnyBranch(config.confluence.branches, currentBranch);
 }
 
 /**
@@ -125,18 +115,23 @@ export function shouldPublishToGitHubWiki(config, currentBranch = getCurrentBran
     return true;
   }
 
-  return config.github_wiki.branches.some(pattern => {
-    if (pattern === currentBranch) {
-      return true;
-    }
+  return matchesAnyBranch(config.github_wiki.branches, currentBranch);
+}
 
-    if (pattern.includes("*")) {
-      const regex = new RegExp("^" + pattern.replace(/\*/g, ".*") + "$");
-      return regex.test(currentBranch);
-    }
+/**
+ * Check if current branch should publish to an Obsidian vault.
+ * Based on config.obsidian.branches setting.
+ */
+export function shouldPublishToObsidian(config, currentBranch = getCurrentBranch()) {
+  if (!config.obsidian) {
+    return true;
+  }
 
-    return false;
-  });
+  if (!config.obsidian.branches || config.obsidian.branches.length === 0) {
+    return true;
+  }
+
+  return matchesAnyBranch(config.obsidian.branches, currentBranch);
 }
 
 /**

package/src/utils/github-repo.js

@@ -0,0 +1,8 @@
+export const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+export function assertGitHubRepo(repo) {
+  if (typeof repo !== "string" || !GITHUB_REPO_PATTERN.test(repo)) {
+    throw new Error(`Invalid GitHub repository "${repo}". Expected owner/name.`);
+  }
+  return repo;
+}

package/src/utils/interactive.js

@@ -0,0 +1,20 @@
+/**
+ * Sessions where RepoLens must not wait on a prompt.
+ * Covers CI providers, explicit opt-out, the test runner, and pipes.
+ */
+export function isNonInteractiveEnvironment() {
+  if (
+    process.env.CI ||
+    process.env.GITHUB_ACTIONS ||
+    process.env.GITLAB_CI ||
+    process.env.CIRCLECI ||
+    process.env.JENKINS_HOME ||
+    process.env.CODEBUILD_BUILD_ID ||
+    process.env.REPOLENS_NON_INTERACTIVE ||
+    process.env.NODE_ENV === "test" ||
+    process.env.VITEST
+  ) {
+    return true;
+  }
+  return !process.stdin.isTTY;
+}

package/src/utils/logger.js

@@ -59,7 +59,11 @@ function sanitizeArgs(args) {
       return sanitizeSecrets(arg);
     }
     if (typeof arg === "object" && arg !== null) {
-      return JSON.parse(sanitizeSecrets(JSON.stringify(arg)));
+      try {
+        return JSON.parse(sanitizeSecrets(JSON.stringify(arg)));
+      } catch {
+        return "[unserializable]";
+      }
     }
     return arg;
   });

package/src/utils/retry.js

@@ -8,6 +8,30 @@ function isRetryableStatus(status) {
   return status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
 }
 
+const MAX_RETRY_AFTER_MS = 60_000;
+
+/**
+ * Honour Retry-After when it is delta-seconds or an HTTP date.
+ * Unparseable values fall back to exponential backoff. Delays are capped
+ * so a hostile header cannot stall the process.
+ */
+export function retryDelayMs(retryAfterHeader, attempt, baseDelayMs, maxDelayMs) {
+  const fallback = Math.min(baseDelayMs * 2 ** attempt, maxDelayMs);
+  if (retryAfterHeader == null || retryAfterHeader === "") return fallback;
+
+  const seconds = Number(retryAfterHeader);
+  if (Number.isFinite(seconds) && seconds >= 0) {
+    return Math.min(seconds * 1000, MAX_RETRY_AFTER_MS);
+  }
+
+  const when = Date.parse(retryAfterHeader);
+  if (Number.isFinite(when)) {
+    return Math.min(Math.max(0, when - Date.now()), MAX_RETRY_AFTER_MS);
+  }
+
+  return fallback;
+}
+
 export async function fetchWithRetry(url, options = {}, config = {}) {
   const {
     retries = 3,
@@ -37,12 +61,12 @@ export async function fetchWithRetry(url, options = {}, config = {}) {
         return response;
       }
 
-      const retryAfterHeader = response.headers.get("retry-after");
-      const retryAfterMs = retryAfterHeader != null
-        ? Number(retryAfterHeader) * 1000
-        : null;
-
-      const delay = retryAfterMs != null ? retryAfterMs : Math.min(baseDelayMs * 2 ** attempt, maxDelayMs);
+      const delay = retryDelayMs(
+        response.headers.get("retry-after"),
+        attempt,
+        baseDelayMs,
+        maxDelayMs
+      );
 
       warn(`${label} failed with retryable status ${response.status}. Retrying in ${delay}ms (attempt ${attempt + 1}/${retries + 1})`);
       await sleep(delay);

package/src/utils/safe-path.js

@@ -0,0 +1,50 @@
+import path from "node:path";
+
+/**
+ * True when `target` is `root` or a path inside it.
+ * Comparison uses resolved paths so `..`, absolute segments, and
+ * platform separators cannot escape the root.
+ */
+export function isInsideRoot(root, target) {
+  const rootResolved = path.resolve(root);
+  const targetResolved = path.resolve(target);
+  const rel = path.relative(rootResolved, targetResolved);
+  return rel === "" || (!rel.startsWith(`..${path.sep}`) && rel !== ".." && !path.isAbsolute(rel));
+}
+
+/**
+ * Resolve a documentation output directory and keep it inside `root`.
+ * Absolute paths and `..` escapes are rejected. An empty value means `.repolens`.
+ */
+export function resolveOutputDir(root, outputDir = ".repolens") {
+  const relative = outputDir == null || outputDir === "" ? ".repolens" : outputDir;
+  if (typeof relative !== "string") {
+    throw new Error("Output directory must be a string");
+  }
+  if (relative.includes("\0")) {
+    throw new Error("Output directory contains a null byte");
+  }
+  if (path.isAbsolute(relative)) {
+    throw new Error(`Output directory must be a relative path inside the repository (received ${relative})`);
+  }
+
+  const rootResolved = path.resolve(root);
+  const resolved = path.resolve(rootResolved, relative);
+  if (!isInsideRoot(rootResolved, resolved)) {
+    throw new Error(`Output directory escapes the repository: ${relative}`);
+  }
+  return resolved;
+}
+
+/**
+ * Reduce a document or wiki name to a single path segment.
+ */
+export function safeFileName(name, fallback = "document.md") {
+  if (typeof name !== "string" || name.length === 0) return fallback;
+  const normalized = name.replace(/\\/g, "/");
+  const base = path.posix.basename(normalized);
+  if (!base || base === "." || base === ".." || base.includes("\0") || base.includes("/") || base.includes("\\")) {
+    return fallback;
+  }
+  return base;
+}

package/src/utils/secrets.js

@@ -12,7 +12,9 @@ const SECRET_PATTERNS = [
   // API Keys
   { name: "OpenAI API Key", pattern: /sk-[a-zA-Z0-9]{20,}/, severity: "high" },
   { name: "Anthropic API Key", pattern: /sk-ant-[a-zA-Z0-9_-]{95,}/, severity: "high" },
-  { name: "GitHub Token", pattern: /gh[ps]_[a-zA-Z0-9]{36,}/, severity: "critical" },
+  { name: "GitHub Token", pattern: /gh[pousr]_[a-zA-Z0-9]{36,}/, severity: "critical" },
+  { name: "GitHub Fine-Grained Token", pattern: /github_pat_[a-zA-Z0-9_]{20,}/, severity: "critical" },
+  { name: "npm Token", pattern: /npm_[a-zA-Z0-9]{36,}/, severity: "critical" },
   { name: "Generic API Key", pattern: /api[_-]?key[_-]?[a-zA-Z0-9]{20,}/i, severity: "high" },
   
   // OAuth Tokens

package/src/utils/telemetry.js

@@ -1,4 +1,3 @@
-import * as Sentry from "@sentry/node";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
@@ -9,12 +8,32 @@ const __dirname = dirname(__filename);
 
 let initialized = false;
 let enabled = false;
+let Sentry = null;
+let sentryLoadFailed = false;
+
+/**
+ * Load @sentry/node on demand. Telemetry is opt-in and the package is an
+ * optional dependency, so a missing install must not crash the CLI.
+ */
+async function loadSentry() {
+  if (Sentry) return Sentry;
+  if (sentryLoadFailed) return null;
+
+  try {
+    Sentry = await import("@sentry/node");
+    return Sentry;
+  } catch {
+    sentryLoadFailed = true;
+    Sentry = null;
+    return null;
+  }
+}
 
 /**
  * Initialize error tracking (Sentry)
  * Only enabled if REPOLENS_TELEMETRY_ENABLED=true
  */
-export function initTelemetry() {
+export async function initTelemetry() {
   // Skip if already initialized
   if (initialized) return;
   initialized = true;
@@ -27,6 +46,13 @@ export function initTelemetry() {
     return;
   }
 
+  const sentry = await loadSentry();
+  if (!sentry) {
+    console.error("Telemetry enabled but optional dependency @sentry/node is not installed. Continuing without telemetry.");
+    enabled = false;
+    return;
+  }
+
   try {
     // Get version from package.json
     const packageJsonPath = join(__dirname, "../../package.json");
@@ -35,7 +61,7 @@ export function initTelemetry() {
 
     const dsn = process.env.REPOLENS_SENTRY_DSN || "https://082083dbf5899ed7e65dfd9b8dc72f90@o4511014913703936.ingest.de.sentry.io/4511014919209040";
 
-    Sentry.init({
+    sentry.init({
       dsn,
       
       // Release tracking
@@ -405,7 +431,9 @@ export function trackMigration(migratedCount, skippedCount) {
  * Ensure Sentry is initialized for feedback submission.
  * Feedback always works, even if REPOLENS_TELEMETRY_ENABLED is false.
  */
-function ensureSentryForFeedback() {
+async function ensureSentryForFeedback() {
+  const sentry = await loadSentry();
+  if (!sentry) return false;
   if (enabled) return true;
 
   // Initialize Sentry in a minimal mode just for feedback
@@ -416,7 +444,7 @@ function ensureSentryForFeedback() {
 
     const dsn = process.env.REPOLENS_SENTRY_DSN || "https://082083dbf5899ed7e65dfd9b8dc72f90@o4511014913703936.ingest.de.sentry.io/4511014919209040";
 
-    Sentry.init({
+    sentry.init({
       dsn,
       release: `repolens@${version}`,
       environment: process.env.NODE_ENV || "production",
@@ -439,7 +467,7 @@ function ensureSentryForFeedback() {
  */
 export async function sendFeedback(name, email, message) {
   try {
-    if (!ensureSentryForFeedback()) {
+    if (!(await ensureSentryForFeedback())) {
       return false;
     }
 

package/src/utils/update-check.js

@@ -1,14 +1,26 @@
 import fs from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import fetch from "node-fetch";
 import { info, warn } from "./logger.js";
 
+// The unscoped `repolens` package is a different project. Always query this one.
+export const LATEST_VERSION_URL = "https://registry.npmjs.org/@chappibunny%2Frepolens/latest";
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 const CHECK_INTERVAL = 1000 * 60 * 60 * 24; // 24 hours
-const CACHE_FILE = path.join(process.env.HOME || process.env.USERPROFILE, ".repolens-update-check.json");
+
+function cacheFile() {
+  try {
+    const home = os.homedir();
+    if (!home) return null;
+    return path.join(home, ".repolens-update-check.json");
+  } catch {
+    return null;
+  }
+}
 
 async function getCurrentVersion() {
   try {
@@ -22,8 +34,9 @@ async function getCurrentVersion() {
 
 async function getLatestVersion() {
   try {
-    const response = await fetch("https://registry.npmjs.org/repolens/latest", {
-      timeout: 3000
+    const response = await fetch(LATEST_VERSION_URL, {
+      signal: AbortSignal.timeout(3000),
+      redirect: "error",
     });
     
     if (!response.ok) return null;
@@ -36,8 +49,10 @@ async function getLatestVersion() {
 }
 
 async function readCache() {
+  const file = cacheFile();
+  if (!file) return null;
   try {
-    const cache = JSON.parse(await fs.readFile(CACHE_FILE, "utf8"));
+    const cache = JSON.parse(await fs.readFile(file, "utf8"));
     return cache;
   } catch {
     return null;
@@ -45,8 +60,10 @@ async function readCache() {
 }
 
 async function writeCache(data) {
+  const file = cacheFile();
+  if (!file) return;
   try {
-    await fs.writeFile(CACHE_FILE, JSON.stringify(data), "utf8");
+    await fs.writeFile(file, JSON.stringify(data), "utf8");
   } catch {
     // Fail silently - not critical
   }

package/src/utils/validate.js

@@ -5,6 +5,7 @@
  * Prevents injection attacks, validates types, and enforces constraints.
  */
 
+import path from "node:path";
 import { detectSecrets } from "./secrets.js";
 
 /**
@@ -48,6 +49,12 @@ export function validateConfig(config) {
     warnings.push(...notionWarnings);
   }
   
+  // Validate Obsidian configuration (local vault path; no credentials)
+  if (config.obsidian) {
+    const obsidianErrors = validateObsidianConfig(config.obsidian);
+    errors.push(...obsidianErrors);
+  }
+
   // Validate domains (if present)
   if (config.domains) {
     const domainErrors = validateDomains(config.domains);
@@ -94,6 +101,12 @@ function validateScanConfig(scan) {
         if (pattern.includes("..")) {
           errors.push(`Dangerous pattern in scan.include: ${pattern} (contains "..")`);
         }
+        if (pattern.includes("\0")) {
+          errors.push(`Dangerous pattern in scan.include: null byte`);
+        }
+        if (path.isAbsolute(pattern) || /^[A-Za-z]:[\\/]/.test(pattern)) {
+          errors.push(`Absolute pattern in scan.include: ${pattern}`);
+        }
         
         // Warn about overly broad patterns
         if (pattern === "**" || pattern === "**/*") {
@@ -135,7 +148,7 @@ function validatePublishers(publishers) {
     return errors;
   }
   
-  const validPublishers = ["notion", "markdown", "confluence", "github_wiki"];
+  const validPublishers = ["notion", "markdown", "confluence", "github_wiki", "obsidian"];
   
   if (Array.isArray(publishers)) {
     for (const pub of publishers) {
@@ -189,6 +202,62 @@ function validateNotionConfig(notion) {
   return errors;
 }
 
+/**
+ * Validate Obsidian vault configuration.
+ * The vault may be absolute (it lives outside the repo). The folder must
+ * stay inside that vault.
+ */
+function validateObsidianConfig(obsidian) {
+  const errors = [];
+
+  if (typeof obsidian !== "object" || Array.isArray(obsidian)) {
+    errors.push("obsidian must be an object");
+    return errors;
+  }
+
+  if (obsidian.vault !== undefined) {
+    if (typeof obsidian.vault !== "string" || obsidian.vault.trim() === "") {
+      errors.push("obsidian.vault must be a non-empty string");
+    } else if (obsidian.vault.includes("\0")) {
+      errors.push("obsidian.vault contains a null byte");
+    }
+  }
+
+  if (obsidian.folder !== undefined) {
+    if (typeof obsidian.folder !== "string" || obsidian.folder.trim() === "") {
+      errors.push("obsidian.folder must be a non-empty string");
+    } else if (obsidian.folder.includes("\0")) {
+      errors.push("obsidian.folder contains a null byte");
+    } else if (
+      path.isAbsolute(obsidian.folder) ||
+      /^[A-Za-z]:[\\/]/.test(obsidian.folder) ||
+      obsidian.folder.split(/[\\/]/).some((part) => part === "..")
+    ) {
+      errors.push("obsidian.folder must be a relative path inside the vault");
+    }
+  }
+
+  if (obsidian.branches !== undefined) {
+    if (!Array.isArray(obsidian.branches)) {
+      errors.push("obsidian.branches must be an array");
+    } else {
+      for (const branch of obsidian.branches) {
+        if (typeof branch !== "string") {
+          errors.push(`Invalid branch name: ${branch} (must be string)`);
+        }
+      }
+    }
+  }
+
+  for (const flag of ["index", "frontmatter", "wikilinks"]) {
+    if (obsidian[flag] !== undefined && typeof obsidian[flag] !== "boolean") {
+      errors.push(`obsidian.${flag} must be a boolean`);
+    }
+  }
+
+  return errors;
+}
+
 /**
  * Check for Notion configuration warnings
  */

package/src/utils/yaml.js

@@ -0,0 +1,27 @@
+import yaml from "js-yaml";
+
+const MAX_YAML_CHARS = 1_000_000;
+const MAX_YAML_ALIASES = 2000;
+
+/**
+ * Parse YAML without executing custom tags.
+ * js-yaml 4 `load` is already safe (no JS types). This adds a size cap and
+ * an alias cap so a config cannot expand into a billion-laughs document.
+ * The js-yaml 4 default schema is unchanged (`true`/`false` are booleans;
+ * the YAML 1.1 spellings `yes` and `no` stay strings).
+ */
+export function loadYaml(raw) {
+  if (typeof raw !== "string") {
+    throw new Error("YAML input must be a string");
+  }
+  if (raw.length > MAX_YAML_CHARS) {
+    throw new Error(`YAML document exceeds ${MAX_YAML_CHARS} characters`);
+  }
+
+  const aliasUses = raw.match(/(^|[\s\[\{,])\*[A-Za-z_][\w-]*/g);
+  if (aliasUses && aliasUses.length > MAX_YAML_ALIASES) {
+    throw new Error(`YAML document has too many aliases (${aliasUses.length})`);
+  }
+
+  return yaml.load(raw);
+}

package/src/watch.js

@@ -22,7 +22,7 @@ async function rebuild(configPath) {
   try {
     const cfg = await loadConfig(configPath);
     const scan = await scanRepo(cfg);
-    const rawDiff = getGitDiff("origin/main");
+    const rawDiff = getGitDiff("origin/main", cfg.__repoRoot || process.cwd());
     const docSet = await generateDocumentSet(scan, cfg, rawDiff);
     const result = await writeDocumentSet(docSet, process.cwd());
     const elapsed = Date.now() - start;