@chappibunny/repolens 1.12.2 → 1.13.0

package/CHANGELOG.md

@@ -2,6 +2,106 @@
 
 All notable changes to RepoLens will be documented in this file.
 
+## 1.13.0
+
+### Obsidian vault publisher
+
+Publish generated docs into a folder in a local Obsidian vault. No network calls and no credentials.
+
+- New publisher: `obsidian` (`src/publishers/obsidian.js`)
+- Notes get YAML frontmatter (`title`, `aliases`, `tags`, `type`, `project`, `branch`) and an index note (`RepoLens.md`) with wikilinks
+- Markdown links to generated pages become `[[wikilinks]]`. External URLs and fenced code blocks are left alone
+- Re-running publish is idempotent: identical notes are not rewritten, and notes RepoLens previously published but no longer generates are removed. Other files in the folder stay
+- `obsidian.folder` must resolve inside `obsidian.vault`. Absolute folders, `..`, and symlinks that leave the vault are rejected
+- Optional config on schema v1: `obsidian.vault`, `obsidian.folder`, `obsidian.branches`, `obsidian.index`, `obsidian.frontmatter`, `obsidian.wikilinks`. Existing configs keep working
+- `repolens init` can select the Obsidian publisher and ask for a vault path
+- `repolens doctor` checks that `obsidian.vault` is set and does not require env vars for it
+- Wikilink rewriting is a linear scan with bounded label and target lengths. The previous link regex was polynomial on hostile markdown (CodeQL)
+
+### Security
+
+- `repolens init` workflows grant `contents: read` and `pull-requests: write`. Architecture Diff comments use the Issues comments API on the pull request, which accepts `pull-requests: write`. `contents: write` is not granted. GitHub Wiki pushes still need `contents: write` on that job only
+
+### Docs
+
+- `docs/ROADMAP.md` now summarizes what shipped from v1.1.0 through v1.12.4, and marks the VS Code extension and the Obsidian publisher as shipped
+- README roadmap matches `docs/ROADMAP.md`
+- The README no longer hard-codes the release version. It points at `package.json`, which is the source of the version
+- Test totals are no longer hard-coded in the README, development guide, or security guide. The tests badge follows the `test.yml` workflow status
+- Handbook pages (README, `docs/*`, `SECURITY.md`, `CONTRIBUTING.md`, and `.github/copilot-instructions.md`) describe 1.13.0 and the Obsidian publisher
+- Corrected drift against the code: `scan.ignore` (there is no `scan.exclude`), `publish` has no `--dry-run`, CI installs with `npm ci`, the publish workflow is `repolens.yml`, diagrams are Unicode, and local files use two filename schemes. `outputs.pages` stays the frozen allowlist; the generator still emits the full 17-document plan unless `documentation.sections` or `features` filters it
+
+## 1.12.4
+
+### Security
+
+- GitHub Wiki git commands use an argument array. The token is passed with `http.extraheader` and is no longer written into the clone URL or `origin` remote
+- Wiki page names and generated document names cannot leave their output directory
+- `documentation.output_dir` must stay inside the repository. Absolute paths and `..` are rejected
+- Scan results that resolve outside the repository root are dropped, and absolute `scan.include` patterns are rejected
+- Monorepo workspace globs that point outside the repository are ignored
+- YAML configs are size-capped and alias-capped before `js-yaml` parses them. The js-yaml 4 schema is unchanged
+- Notion, Confluence, GitHub, and Discord error bodies are truncated and redacted before they are logged
+- Confluence URLs with embedded credentials, or a scheme other than http/https, are rejected
+- Discord webhooks must be `https` and time out after 15 seconds
+- AI startup logs no longer print a prefix of the API key
+- Secret detection covers fine-grained GitHub tokens (`github_pat_`), `gho_` / `ghu_` / `ghr_` tokens, and npm tokens
+- `Retry-After` values that are not seconds or an HTTP date no longer become `NaN` delays
+- Browser signup links are opened without a shell
+- GitHub Actions: test and security jobs are `contents: read`. `id-token: write` is only on the npm publish job. The token-present check no longer prints the token length
+- Test workflow runs on Node.js 18, 20, and 22. Node 18 runs `scripts/node18-runtime.js` because Vitest 4 cannot start there (`util.styleText` needs Node 20.12). Node 20 and 22 run the full Vitest suite
+
+### Fixes
+
+- Update checks query `@chappibunny/repolens` on the npm registry. The cache file uses the real home directory on Windows and Unix
+- `repolens init` in CI, tests, and non-TTY sessions scaffolds files instead of exiting before writing anything
+- `repolens demo --target` looks for `.repolens.yml` from the target directory, so a demo of another folder does not scan the shell's current repository
+- `repolens feedback` exits 2 when there is no terminal, and exits 1 when sending fails
+- Unknown flags and missing `--config` / `--target` values exit 2. `--help` and `--version` work before or after the command
+- `repolens --version` and `repolens --help` from the installed binary do not load the scanner or telemetry
+- Empty repositories finish the scan with a warning instead of looking like a hung run. Binary files and files over 1 MB are not parsed as source
+- Git renames in `git diff --name-status` record the new path. Unsafe diff refs are ignored instead of being interpolated into a shell command. A missing repo or ref no longer prints git's usage text, and the diff runs in the scanned repository rather than whatever directory the shell happened to be in
+- Branch filters escape regex metacharacters, so a pattern like `release/*)` does not throw
+- Confluence page-cache filenames cannot contain path separators from the branch name
+- Notion block pagination stops if a cursor repeats
+
+### Dependencies
+
+- `dotenv` 18.0.8 (`import "dotenv/config"` is unchanged; Node `-r dotenv/config` preload was removed upstream)
+- `tinyexec` 1.3.1 (dev dependency, Node 18+)
+- js-yaml stays on 4.x, Vitest stays on 4.x, and `@sentry/node` stays on 10.x so `engines` can remain `>=18`
+
+## 1.12.3
+
+### Security
+
+- Bump runtime `js-yaml` to 4.3.2 (merge-key CPU limit and `!!omap` duplicate-key complexity fixes)
+- Bump transitive `source-map-js` to 1.2.2 (CVE-2026-93749)
+- Bump transitive `postcss` to 8.5.31 (Dependabot #8 requested 8.5.25; 8.5.31 includes those fixes)
+- Bump `vitest` and `@vitest/mocker` to 4.1.12 (Dependabot #10 requested 4.1.11; 4.1.12 is the current 4.1 release and includes that fix)
+- No patched `braces` release exists for GHSA-vfj7-8cjw-p6xm (latest is 3.0.3, which the advisory covers). The release audit now checks production dependencies only and waives that one advisory. Any other high or critical runtime finding still fails the job. See `scripts/audit-waivers.json` and `SECURITY.md`.
+
+### Packaging
+
+- Require Node.js `>=18` (`engines`), matching built-in `fetch` and `node:readline/promises`
+- Add an `exports` map. `main` now points at `src/index.js`, so importing the package does not run the CLI
+- Keep the `repolens` binary on `bin/repolens.js`
+- Replace `node-fetch` with the built-in `fetch` (`AbortSignal.timeout` for the update check)
+- Move `@sentry/node` to `optionalDependencies`. Telemetry and feedback no-op when it is not installed
+- Stop publishing the `docs/` handbook. Runtime document generation stays in `src/docs/`
+
+### CI
+
+- Publish Documentation runs on pushes to `main` and manual dispatch, and skips `dependabot[bot]`, because publisher secrets are not available on Dependabot branches
+- Add a Test workflow that runs `npm test` on pull requests and branch pushes
+- CI installs with `npm ci` so the committed lockfile is what runs. A fresh `npm install` on npm 10 crashes while resolving Vitest 4.1 optional peers
+- Release workflow publishes with `npm publish --provenance` (requires an `NPM_TOKEN` Actions secret)
+
+### Fixes
+
+- `docs:publish` discovers `.repolens.yml` from the current directory instead of `../../.repolens.yml`
+- `release:check` runs `npm pack --dry-run`
+
 ## 1.12.0
 
 ### 🛡️ Security Pattern Detection

package/README.md

@@ -10,14 +10,14 @@
 
 [![npm version](https://img.shields.io/npm/v/@chappibunny/repolens)](https://www.npmjs.com/package/@chappibunny/repolens)
 [![VS Code Extension](https://img.shields.io/visual-studio-marketplace/v/CHAPIBUNNY.repolens-architecture?label=VS%20Code)](https://marketplace.visualstudio.com/items?itemName=CHAPIBUNNY.repolens-architecture)
-[![Tests](https://img.shields.io/badge/tests-480%20passing-brightgreen)](https://github.com/CHAPIBUNNY/repolens/actions)
+[![Tests](https://img.shields.io/github/actions/workflow/status/CHAPIBUNNY/repolens/test.yml?label=tests)](https://github.com/CHAPIBUNNY/repolens/actions/workflows/test.yml)
 [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 
 **Your architecture docs are already outdated.** RepoLens fixes that.
 
-RepoLens scans your repository, generates living architecture documentation, and publishes it to Notion, Confluence, GitHub Wiki, or Markdown — automatically on every push. Engineers get technical docs. Stakeholders get readable system overviews. Nobody writes a word.
+RepoLens scans your repository, generates living architecture documentation, and publishes it to Notion, Confluence, GitHub Wiki, Obsidian, or Markdown — automatically on every push. Engineers get technical docs. Stakeholders get readable system overviews. Nobody writes a word.
 
-> Stable as of v1.0 — [API guarantees](docs/STABILITY.md) · [Security hardened](SECURITY.md) · v1.12.0
+> Stable as of v1.0 — [API guarantees](docs/STABILITY.md) · [Security hardened](SECURITY.md) · version from [`package.json`](package.json)
 
 ---
 
@@ -50,7 +50,7 @@ Plus framework detection: **Django** · **FastAPI** · **Flask** · **Gin** · *
 
 ## 🚀 Quick Start (60 seconds)
 
-**Step 1: Install**
+**Step 1: Install** (Node.js 18+)
 ```bash
 npm install @chappibunny/repolens
 ```
@@ -83,7 +83,7 @@ CONFLUENCE_SPACE_KEY=DOCS
 npx @chappibunny/repolens publish
 ```
 
-**Done!** Your docs are now live in Notion, Confluence, and/or `.repolens/` directory.
+**Done!** Numbered notes and the Markdown publisher’s files are in `.repolens/`. Notion, Confluence, GitHub Wiki, and Obsidian publish only when you configure them. Obsidian needs `obsidian.vault` in `.repolens.yml` and does not use an API key.
 
 **🔄 Upgrading from v0.3.0 or earlier?**
 Run `npx @chappibunny/repolens migrate` to automatically update your workflow files. See [MIGRATION.md](docs/MIGRATION.md) for details.
@@ -96,9 +96,9 @@ Run `npx @chappibunny/repolens migrate` to automatically update your workflow fi
 
 | Audience | Documents |
 |---|---|
-| **Stakeholders** (founders, PMs, ops) | Executive Summary · Business Domains · Data Flows |
-| **Everyone** | System Overview · Developer Onboarding · Change Impact · Architecture Drift · Code Health |
-| **Engineers** | Architecture Overview · Module Catalog · API Surface · Route Map · System Map · GraphQL Schema · TypeScript Type Graph · Dependency Graph · Security Hotspots |
+| **Stakeholders** | Executive Summary |
+| **Mixed** | System Overview · Business Domains · Route Map · Data Flows · Change Impact · System Map · Architecture Drift · Code Health |
+| **Engineers** | Architecture Overview · Module Catalog · API Surface · Developer Onboarding · GraphQL Schema · TypeScript Type Graph · Dependency Graph · Security Hotspots |
 
 **Two modes:** Deterministic (free, fast, always works) or AI-Enhanced (optional — GitHub Models, OpenAI, Anthropic, Google, Azure, Ollama).
 
@@ -110,7 +110,7 @@ Run `npx @chappibunny/repolens migrate` to automatically update your workflow fi
 |---|---|
 | 🤖 **Autonomous** | Runs on every push via GitHub Actions — docs stay evergreen |
 | 👥 **Multi-Audience** | Technical docs + stakeholder-readable overviews from one scan |
-| 📤 **Multi-Publisher** | Notion, Confluence, GitHub Wiki, Markdown — or all four at once |
+| 📤 **Multi-Publisher** | Notion, Confluence, GitHub Wiki, Obsidian, Markdown — together or one at a time |
 | 🧠 **AI-Assisted** | Optional AI with zero-hallucination policy (structured context only) |
 | 🔍 **Smart Detection** | Frameworks, domains, data flows, dependencies, drift — all automatic |
 | 🔌 **Extensible** | Plugin system for custom renderers, publishers, and hooks |
@@ -155,7 +155,7 @@ The extension reads your `.repolens.yml` configuration and provides an interacti
 
 ## 🎓 Onboarding Guide
 
-Step-by-step setup for publishers, AI features, Notion, Confluence, GitHub Wiki, Discord, and CI/CD automation.
+Step-by-step setup for publishers, AI features, Notion, Confluence, GitHub Wiki, Obsidian, Discord, and CI/CD automation.
 
 **[→ Full Onboarding Guide](docs/ONBOARDING.md)**
 
@@ -183,28 +183,11 @@ Step-by-step setup for publishers, AI features, Notion, Confluence, GitHub Wiki,
 
 ## 📸 Example Output
 
-### System Map with Dependencies
-
-```mermaid
-graph LR
-    CLI[bin/repolens<br/>1 file] --> Core[src/core<br/>4 files]
-    Publishers[src/publishers<br/>6 files] --> Core
-    Publishers --> Renderers[src/renderers<br/>4 files]
-    Publishers --> Utils[src/utils<br/>10 files]
-    Renderers --> Core
-    Delivery[src/delivery<br/>1 file] --> Publishers
-    Tests[tests<br/>15 files] -. tests .-> CLI
-    Tests -. tests .-> Core
-    Tests -. tests .-> Publishers
-    
-    style CLI fill:#9b59b6,color:#fff
-    style Core fill:#f39c12,color:#000
-    style Publishers fill:#27ae60,color:#fff
-    style Renderers fill:#27ae60,color:#fff
-    style Delivery fill:#16a085,color:#fff
-    style Utils fill:#95a5a6,color:#000
-    style Tests fill:#e67e22,color:#fff
-```
+### System map
+
+Published system maps are Unicode diagrams drawn from import edges. RepoLens does not emit Mermaid.
+
+The publisher set in 1.13.0 is Notion, Confluence, GitHub Wiki, Obsidian, and Markdown (`src/publishers`, 7 files). Layout and counts are in [ARCHITECTURE.md](docs/ARCHITECTURE.md).
 
 ### System Overview (Technical Profile)
 
@@ -255,11 +238,11 @@ When you open a pull request, RepoLens posts:
 
 | Guide | Description |
 |---|---|
-| [Onboarding Guide](docs/ONBOARDING.md) | Step-by-step setup: publishers, AI, Notion, Confluence, Discord |
+| [Onboarding Guide](docs/ONBOARDING.md) | Step-by-step setup: publishers, AI, Notion, Confluence, GitHub Wiki, Obsidian, Discord |
 | [Configuration](docs/CONFIGURATION.md) | Complete `.repolens.yml` schema and examples |
 | [Environment Variables](docs/ENVIRONMENT.md) | All env vars by publisher and feature |
 | [Architecture](docs/ARCHITECTURE.md) | Pipeline diagram, project structure |
-| [Development](docs/DEVELOPMENT.md) | Setup, tests (380 across 22 files), release process |
+| [Development](docs/DEVELOPMENT.md) | Setup, tests, and the release process |
 | [Security](SECURITY.md) | Threat model, secret detection, validation layers |
 | [Telemetry](docs/TELEMETRY.md) | Opt-in privacy-first usage analytics |
 | [Troubleshooting](docs/TROUBLESHOOTING.md) | Common issues and fixes |
@@ -285,10 +268,16 @@ v1.0+ features complete — CLI, config schema, and plugin interface are frozen.
 
 **Completed:**
 - [x] VS Code extension ([available on Marketplace](https://marketplace.visualstudio.com/items?itemName=CHAPIBUNNY.repolens-architecture))
+- [x] Obsidian vault publisher (local notes with wikilinks and frontmatter)
 
 **Next:**
-- [ ] Obsidian publisher
-- [ ] GitHub App
+- [ ] GitHub App for automated setup and status checks
+- [ ] Slack notifications
+- [ ] Custom webhook support
+- [ ] Cross-repository architecture analysis
+- [ ] Security boundary validation
+- [ ] Interactive HTML documentation output
+- [ ] Architecture decision records (ADR) generation
 
 See [ROADMAP.md](docs/ROADMAP.md) for detailed planning.
 

package/bin/repolens.js

@@ -1,2 +1,22 @@
 #!/usr/bin/env node
-import "../src/cli.js";
+import { readFileSync } from "node:fs";
+
+const argv = process.argv.slice(2);
+const wantsHelp = argv.includes("--help") || argv.includes("-h") || argv[0] === "help";
+const wantsVersion = argv.includes("--version") || argv.includes("-v") || argv[0] === "version";
+
+// --version and --help must not load the scanner, publishers, or telemetry.
+if (wantsVersion && !wantsHelp) {
+  const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+  console.log(pkg.version || "0.0.0");
+  process.exit(0);
+}
+
+if (wantsHelp) {
+  const { printHelp } = await import("../src/help.js");
+  printHelp();
+  process.exit(0);
+}
+
+const { runCli } = await import("../src/cli.js");
+runCli();

package/package.json

@@ -1,17 +1,23 @@
 {
   "name": "@chappibunny/repolens",
-  "version": "1.12.2",
+  "version": "1.13.0",
   "description": "AI-assisted documentation intelligence system for technical and non-technical audiences",
   "license": "MIT",
   "type": "module",
-  "main": "src/cli.js",
+  "engines": {
+    "node": ">=18"
+  },
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./package.json": "./package.json"
+  },
   "bin": {
     "repolens": "bin/repolens.js"
   },
   "files": [
     "bin",
     "src",
-    "docs",
     "package.json",
     "README.md",
     "CHANGELOG.md"
@@ -30,6 +36,7 @@
     "metrics",
     "team-collaboration",
     "discord",
+    "obsidian",
     "ai-documentation"
   ],
   "repository": {
@@ -47,26 +54,28 @@
   },
   "scripts": {
     "test:notion": "node notion-test.js",
-    "docs:publish": "node src/cli.js publish --config ../../.repolens.yml",
+    "docs:publish": "node bin/repolens.js publish",
     "init:test": "node src/cli.js init --target /tmp/repolens-init-test",
     "test": "NODE_ENV=test vitest run --no-watch --reporter=verbose",
     "pack:check": "npm pack",
-    "release:check": "npm test && npm pack",
+    "audit:runtime": "node scripts/audit-runtime.js",
+    "release:check": "npm test && npm run audit:runtime && npm pack --dry-run",
     "test:install": "./test-install.sh",
     "release:patch": "npm version patch",
     "release:minor": "npm version minor",
     "release:major": "npm version major"
   },
   "dependencies": {
-    "@sentry/node": "^10.42.0",
-    "dotenv": "^17.3.1",
+    "dotenv": "^18.0.8",
     "fast-glob": "^3.3.3",
-    "js-yaml": "^4.1.0",
-    "node-fetch": "^3.3.2"
+    "js-yaml": "^4.3.2"
+  },
+  "optionalDependencies": {
+    "@sentry/node": "^10.42.0"
   },
   "devDependencies": {
-    "tinyexec": "1.0.2",
-    "vitest": "^4.1.0"
+    "tinyexec": "^1.3.1",
+    "vitest": "^4.1.11"
   },
   "overrides": {
     "yauzl": ">=3.2.1",

package/src/ai/provider.js

@@ -83,8 +83,7 @@ export async function generateText({ system, user, temperature, maxTokens, confi
   
   // Log configuration once per run
   if (!hasLoggedConfig) {
-    const keyPreview = apiKey.substring(0, 8) + "...";
-    info(`AI Config: provider=${provider}, model=${model}, key=${keyPreview}`);
+    info(`AI Config: provider=${provider}, model=${model}, key=set`);
     hasLoggedConfig = true;
   }
   

package/src/analyzers/monorepo-detector.js

@@ -4,6 +4,8 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { info } from "../utils/logger.js";
+import { isInsideRoot } from "../utils/safe-path.js";
+import { loadYaml } from "../utils/yaml.js";
 
 /**
  * Detect monorepo workspaces in a repository.
@@ -68,24 +70,8 @@ async function detectPnpmWorkspaces(repoRoot) {
   try {
     const yamlPath = path.join(repoRoot, "pnpm-workspace.yaml");
     const raw = await fs.readFile(yamlPath, "utf8");
-
-    // Simple YAML parsing for packages array (avoid adding js-yaml dependency for this)
-    const patterns = [];
-    let inPackages = false;
-    for (const line of raw.split("\n")) {
-      const trimmed = line.trim();
-      if (trimmed === "packages:") {
-        inPackages = true;
-        continue;
-      }
-      if (inPackages) {
-        if (trimmed.startsWith("- ")) {
-          patterns.push(trimmed.slice(2).replace(/['"]/g, "").trim());
-        } else if (trimmed && !trimmed.startsWith("#")) {
-          break; // End of packages list
-        }
-      }
-    }
+    const doc = loadYaml(raw);
+    const patterns = Array.isArray(doc?.packages) ? doc.packages.filter((item) => typeof item === "string") : [];
 
     return await resolveWorkspacePatterns(repoRoot, patterns);
   } catch {
@@ -116,8 +102,10 @@ async function resolveWorkspacePatterns(repoRoot, patterns) {
   for (const pattern of patterns) {
     // Convert glob pattern to directory search
     // e.g. "packages/*" → list dirs in packages/
-    const basePath = pattern.replace(/\/?\*.*$/, "");
-    const searchDir = path.join(repoRoot, basePath);
+    if (typeof pattern !== "string" || pattern.includes("\0")) continue;
+    const basePath = pattern.replace(/\/?\*.*$/, "") || ".";
+    const searchDir = path.resolve(repoRoot, basePath);
+    if (!isInsideRoot(repoRoot, searchDir)) continue;
 
     try {
       const entries = await fs.readdir(searchDir, { withFileTypes: true });

package/src/cli-args.js

@@ -0,0 +1,60 @@
+const FLAGS_WITH_VALUE = new Set(["--config", "--target"]);
+const BOOLEAN_FLAGS = new Set([
+  "--quick",
+  "--non-interactive",
+  "--dry-run",
+  "--force",
+  "--verbose",
+  "--help",
+  "-h",
+  "--version",
+  "-v",
+]);
+
+/**
+ * Parse RepoLens argv (already sliced past node and the script path).
+ * Global options may appear before or after the command.
+ */
+export function parseCliArgs(argv) {
+  const flags = {};
+  const positionals = [];
+  const errors = [];
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--") {
+      positionals.push(...argv.slice(i + 1));
+      break;
+    }
+    if (arg.startsWith("-")) {
+      if (FLAGS_WITH_VALUE.has(arg)) {
+        const value = argv[i + 1];
+        if (value == null || value.startsWith("-")) {
+          errors.push(`${arg} requires a value`);
+        } else {
+          flags[arg] = value;
+          i += 1;
+        }
+      } else if (BOOLEAN_FLAGS.has(arg)) {
+        flags[arg] = true;
+      } else {
+        errors.push(`Unknown option: ${arg}`);
+      }
+    } else {
+      positionals.push(arg);
+    }
+  }
+
+  if (positionals.length > 1) {
+    errors.push(`Unexpected argument: ${positionals.slice(1).join(" ")}`);
+  }
+
+  const command = positionals[0];
+  return {
+    command,
+    flags,
+    errors,
+    help: Boolean(flags["--help"] || flags["-h"] || command === "help"),
+    version: Boolean(flags["--version"] || flags["-v"] || command === "version"),
+  };
+}