@chappibunny/repolens 1.15.4 → 1.16.0

package/CHANGELOG.md

@@ -2,6 +2,70 @@
 
 All notable changes to RepoLens will be documented in this file.
 
+## 1.16.0
+
+### GitHub App
+
+- `repolens app` self-hosts a GitHub App webhook. It checks `X-Hub-Signature-256`, acknowledges `installation` and `installation_repositories`, and on `pull_request` `opened`, `synchronize`, `reopened`, and `ready_for_review` runs the existing architecture diff. It posts a Check Run named RepoLens (the same summary as the sticky comment) and updates that comment. A finished diff is a successful check. The check fails only when the analysis throws
+- Manifest: `app.yml` and `github-app-manifest.json`, also `repolens app --manifest`. Permissions are checks write, pull requests write, contents read, and metadata read. The hook URL in the repo is a placeholder (`https://example.com/api/github/webhooks`). This release does not register an app and CI does not need new secrets
+- The server answers 202 before the clone and scoring finish, because GitHub allows about 10 seconds for the HTTP response. Setup is in [docs/GITHUB_APP.md](docs/GITHUB_APP.md)
+
+### Security
+
+- Route parameters in `src/renderers/renderDiff.js` no longer use `/\[(.*?)\]/g`. That lazy pattern is polynomial on a long string of `[` with no `]` (CodeQL `js/polynomial-redos`, alert #6). The replacement is a linear scan, including the same pattern in `src/core/scan.js` and the route-group labels in `src/renderers/renderMap.js`. A regression test feeds 100,000 brackets and expects a fast result
+
+### Output accuracy
+
+Hands-on `repolens demo` on expressjs/express, pallets/flask, and spf13/cobra:
+
+- Express 5 has no `main` field. A description that says library, SDK, parser, toolkit, or framework is a library. Express reads as a library, not an API service
+- `app.get('query parser fn')` is a setting lookup, not a route. Comment lines are skipped. Routes in tests, examples, and docs are not the product API. The Express route map is skipped
+- A flat package at the repository root is named after the directory (`cobra`, not `root`). The system map connects that package to `doc/` (one relationship). Files with no directory belong to that flat module
+- External imports that appear only in tests or examples are development tooling even when there is no `package.json`. Flask no longer lists `site_app` and the other test fixtures as runtime packages. Cobra lists `pflag` and `mousetrap` as runtime, and `go-md2man` and `yaml` as doc tooling
+- Flask hubs are `globals.py`, `helpers.py`, `typing.py`, and `signals.py`. The three cycles (`__init__` → `app` → `cli`, and the templating / sansio chains) are real import cycles
+
+### Dependencies
+
+- `js-yaml` 4.3.2 → 5.5.0. Call the named `load` export. The YAML 1.2 Core schema still treats `true`/`false` as booleans and `yes`/`no` as strings. The merge key (`<<`) is enabled. `maxAliases` caps alias expansion. An empty file still returns `undefined`
+- `@sentry/node` 10.76.2 → 11.9.0 (`^11.8.0`). It is still optional. Its own engines exclude Node 18 (`>=20.19` or `>=22.12`). `npm ci` on Node 18 warns and continues, and a failed import still disables telemetry instead of crashing the CLI
+- Vitest 4.1.12 → 5.0.5. Its declared engines are `^22.12 || ^24 || >=26`. The runner starts on Node 20 and does not start on Node 18 (`util.styleText`). CI still runs `npm test` on Node 20 and 22, and `scripts/node18-runtime.js` on Node 18. `engines` stays `>=18`
+- `dotenv` 18.0.8 → 18.0.9 and `@modelcontextprotocol/sdk` 1.32.1 → 1.32.2
+- GitHub Actions: `actions/checkout` pin is the v6.0.3 release commit `df4cb1c`, `actions/setup-node` v7.1.0 (`949feb2`), `softprops/action-gh-release` v3.0.3 (`efb3536`). `npm audit` reports no vulnerabilities
+
+### Docs
+
+- Roadmap item 1 (GitHub App) is shipped in 1.16.0. Java and C# language support is now What's Next item 1
+- The note that a chat answer only covers what someone thought to ask, and that grounded AI Q&A sits on top of the full map, stays in the roadmap, README, known issues, and copilot instructions
+
+## 1.15.5
+
+Fixes twelve output problems found by running 1.15.4 on mattiasw/ExifReader (a plain-JavaScript library with a flat `src/` and a build-helper `bin/`), and the two leftovers from 1.15.4.
+
+### Output accuracy
+
+- A file directly under a module root belongs to that root. A flat `src/` is one module (`src`), not 65 one-file modules. Sub-directories are still their own modules. Go packages follow the same rule, so `middleware/` is one module and not `middleware/compress.go`
+- Module fan-in and fan-out count distinct other modules, not file-to-file edges, so "Orchestrator (coordinates 212 modules)" becomes the real number
+- A package with `main`, `module`, `exports`, or `types` is a **library**, not a command-line tool. A package with only a `bin` is a CLI. A package with both is a library unless its description does not say library, parser, SDK, toolkit, or framework and says CLI or command-line. Libraries get no "CLI tool architecture" pattern, no "Interface: CLI" row, and no "command-line interface" text. The route map note says library. Flows start at the package entry (`Library Flow`), not at `bin/` helpers or `webpack.config`
+- Patterns are described by their name, not by the file names cited as evidence. "Acyclic dependency graph" no longer gets the CLI description. Every pattern has its own explanation and benefit line. The headline names the pattern, not its evidence
+- `build-pages.js` is not a route module. Page, route, and view only count as directory names for files
+- `.d.ts` files, type tests, and a `typescript` devDependency do not make a JavaScript library "TypeScript"
+- `filter`, `parse`, and `constant` no longer pick the Search & Discovery, Analysis & Detection, and Configuration domains
+- Hubs, coupling advice, and the dependency graph ignore tests, examples, docs, and build scripts, and are measured against source files. Hub threshold is 7% of source files (minimum 5)
+- External packages are split into runtime and development and test tooling (`12 (1 runtime, 11 dev/test tooling)`), from the root `package.json`
+- Security: `innerHTML = ''` and other fixed-string assignments are not reported. Findings in examples, docs, scripts, tools, benchmarks, and `build*.js` files are low severity and labeled "(build/example code)". Hardcoded credentials keep their severity
+- Orphan files over 5% of code files are a warning and cost 5 health points (10 over 10%, 20 over 20%). Below 5% they read "within normal range". The old +5 bonus for a cycle-free graph is gone, so 100/100 no longer sits next to an orphan warning
+- Route Map and GraphQL Schema are not written when no routes or GraphQL schema were found. Naming them in `documentation.sections` keeps them
+- Tests, examples, and build helpers are no longer flows. Build configs such as `webpack.config` are not flow entry points
+
+### 1.15.4 leftovers
+
+- `lib/ogg` is typed and grouped by `ogg`, not by sitting under `lib/`. Folders with no keyword of their own join a **Core Source** domain and a "Source Modules" layer instead of "Shared Utilities" and "Shared Libraries". `lib/common` still reads as shared utilities
+- Hub flows skip barrels (`lib/index`), leaf helpers such as error classes, tests, and examples, so there is no "lib Integration Flow"
+
+### Docs
+
+- README, AI.md, MIGRATION.md, KNOWN_ISSUES.md, ROADMAP.md, ARCHITECTURE.md, CONFIGURATION.md, and `.github/copilot-instructions.md` describe the new behavior
+
 ## 1.15.4
 
 Fixes nine output problems found by running 1.15.3 on Borewit/music-metadata (a v12 TypeScript library).

package/README.md

@@ -100,7 +100,7 @@ Run `npx @chappibunny/repolens migrate` to automatically update your workflow fi
 
 ## 📋 What It Generates
 
-**17 document types** for three audiences — no manual writing required:
+**17 document types** for three audiences — no manual writing required. Route Map and GraphQL Schema are skipped when the repository has no routes or GraphQL schema:
 
 | Audience | Documents |
 |---|---|
@@ -119,6 +119,7 @@ Run `npx @chappibunny/repolens migrate` to automatically update your workflow fi
 | 🤖 **Autonomous** | Runs on every push via GitHub Actions — docs stay evergreen |
 | 👥 **Multi-Audience** | Technical docs + stakeholder-readable overviews from one scan |
 | 📤 **Multi-Publisher** | Notion, Confluence, GitHub Wiki, Obsidian, Markdown — together or one at a time |
+| 🗺️ **Shows what you didn't ask** | An LLM only answers the question it is given, and a newcomer doesn't know what to ask. RepoLens publishes the whole map (every module, cycle and hub) on every PR, the same way each time, with no tokens spent per question |
 | 🧠 **AI-Assisted** | Optional AI with zero-hallucination policy (structured context only) |
 | 🔍 **Smart Detection** | Frameworks, domains, data flows, dependencies, drift — all automatic |
 | 🔌 **Extensible** | Plugin system for custom renderers, publishers, and hooks |
@@ -189,6 +190,7 @@ Step-by-step setup for publishers, AI features, Notion, Confluence, GitHub Wiki,
 | `npx @chappibunny/repolens mcp` | Start the stdio MCP server (`repolens-mcp` is the same server) |
 | `npx @chappibunny/repolens badge` | shields.io code-health JSON, SVG, or markdown. Exits 2 when nothing is scored |
 | `npx @chappibunny/repolens comment --base <ref> --head <ref>` | Architecture diff (files, modules, dependencies, health delta, new hotspots) |
+| `npx @chappibunny/repolens app` | Self-host the GitHub App webhook. `--manifest` prints the manifest |
 
 > **Note:** If you installed globally with `npm install -g @chappibunny/repolens`, you can use the shorter `repolens <command>` form. Init's next-steps text uses that shorter form when the command on your PATH is the global install.
 > **Warning:** Do not run bare `npx repolens` — there is an unrelated `repolens@0.0.1` placeholder package on npm. Always use the scoped name `@chappibunny/repolens`.
@@ -199,7 +201,7 @@ Step-by-step setup for publishers, AI features, Notion, Confluence, GitHub Wiki,
 |---|---|
 | `0` | Success, including a cancelled wizard or help with no other work |
 | `1` | Runtime error, or an unknown command |
-| `2` | Invalid flags, missing config, target directory not found, a failed `doctor` check (including 0 files matched), `demo` or `publish` scanned 0 files, `watch` has nothing to watch (missing `module_roots`, or `scan.include` matches no files), `badge` scored 0 source files, `comment` is missing a base or head ref, `publish --strict` is missing publisher credentials, or `feedback` has no terminal |
+| `2` | Invalid flags, missing config, target directory not found, a failed `doctor` check (including 0 files matched), `demo` or `publish` scanned 0 files, `watch` has nothing to watch (missing `module_roots`, or `scan.include` matches no files), `badge` scored 0 source files, `comment` is missing a base or head ref, `publish --strict` is missing publisher credentials, `app` is missing its id, webhook secret, or private key, or `feedback` has no terminal |
 
 `--target` must already exist. A missing path exits 2 with `Target directory not found: <path>` before any scan. `repolens <command> --help` prints that command's flags. The ASCII banner is omitted when stdout is not a terminal or `CI` is set.
 
@@ -241,9 +243,9 @@ If `npx` reports `Unknown command: mcp`, an `.npmrc` with `min-release-age` (or
 
 ## GitHub Action
 
-`action.yml` is a composite action named **RepoLens Architecture Docs**. `publish`, `demo`, and `doctor` run the published npm package (`npx --yes @chappibunny/repolens@1.15.4`). `comment` and `badge` run from the action checkout. Inputs are `command` (`publish`, `demo`, `doctor`, `comment`, or `badge`), `config`, `node-version`, `pr-comment`, `version`, `badge-out`, `badge-url`, and `badge-link`.
+`action.yml` is a composite action named **RepoLens Architecture Docs**. `publish`, `demo`, and `doctor` run the published npm package (`npx --yes @chappibunny/repolens@1.16.0`). `comment` and `badge` run from the action checkout. Inputs are `command` (`publish`, `demo`, `doctor`, `comment`, or `badge`), `config`, `node-version`, `pr-comment`, `version`, `badge-out`, `badge-url`, and `badge-link`.
 
-Publishing docs (the npm package at tag `v1.15.4`):
+Publishing docs (the npm package at tag `v1.16.0`):
 
 ```yaml
 name: Architecture docs
@@ -258,8 +260,8 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
-      - uses: CHAPIBUNNY/repolens@v1.15.4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: CHAPIBUNNY/repolens@v1.16.0
         with:
           command: publish
           config: .repolens.yml
@@ -267,7 +269,7 @@ jobs:
           pr-comment: ${{ github.event_name == 'pull_request' && 'true' || 'false' }}
 ```
 
-On `v1.15.2`, `pr-comment: true` runs the architecture diff from the action checkout and turns the published package's older short summary off. The diff lists modules, files, dependencies, the code-health delta, and new hotspots. It edits one sticky comment (`<!-- repolens:architecture-diff -->`) instead of adding a new comment each push. The footer is "Generated by RepoLens" and links to this repository and the [gallery](https://chapibunny.github.io/repolens/). Tag `v1.15.1` does not contain `command: comment`. Pin `v1.15.4` or a commit SHA in production.
+On `v1.15.2`, `pr-comment: true` runs the architecture diff from the action checkout and turns the published package's older short summary off. The diff lists modules, files, dependencies, the code-health delta, and new hotspots. It edits one sticky comment (`<!-- repolens:architecture-diff -->`) instead of adding a new comment each push. The footer is "Generated by RepoLens" and links to this repository and the [gallery](https://chapibunny.github.io/repolens/). Tag `v1.15.1` does not contain `command: comment`. Pin `v1.16.0` or a commit SHA in production.
 
 ```yaml
 name: RepoLens architecture comment
@@ -280,10 +282,10 @@ jobs:
   architecture:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
-      - uses: CHAPIBUNNY/repolens@v1.15.4
+      - uses: CHAPIBUNNY/repolens@v1.16.0
         with:
           command: comment
 ```
@@ -292,7 +294,7 @@ jobs:
 
 `pr-comment: true` on `publish`, `demo`, or `doctor` (when the action ref contains this change) runs the same comment after the package and turns the package's older comment off, so the pull request still gets one comment.
 
-The action is listed on the GitHub Marketplace only after a release is published with **Publish this Action to the GitHub Marketplace** checked. Those steps are in [docs/RELEASE.md](docs/RELEASE.md). The tag `v1.15.4` has to exist before `uses: CHAPIBUNNY/repolens@v1.15.4` resolves, and `@chappibunny/repolens@1.15.4` has to be on npm before `publish` can install it. `command: comment` and `command: badge` do not install that package.
+The action is listed on the GitHub Marketplace only after a release is published with **Publish this Action to the GitHub Marketplace** checked. Those steps are in [docs/RELEASE.md](docs/RELEASE.md). The tag `v1.16.0` has to exist before `uses: CHAPIBUNNY/repolens@v1.16.0` resolves, and `@chappibunny/repolens@1.16.0` has to be on npm before `publish` can install it. `command: comment` and `command: badge` do not install that package.
 
 ## Add the badge to your repo
 
@@ -327,8 +329,8 @@ jobs:
   badge:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
-      - uses: CHAPIBUNNY/repolens@v1.15.4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: CHAPIBUNNY/repolens@v1.16.0
         with:
           command: badge
           badge-url: https://USER.github.io/REPO/repolens-badge.json
@@ -357,7 +359,7 @@ Gallery repositories already publish this. Each one has a [score page](https://c
 
 Published system maps are Unicode diagrams drawn from import edges. RepoLens does not emit Mermaid.
 
-The publisher set is Notion, Confluence, GitHub Wiki, Obsidian, and Markdown (`src/publishers`, 7 files). 1.14.0 adds the MCP server, the Marketplace action, and the docs badge. 1.14.1 sets the registry name to `io.github.CHAPIBUNNY/repolens`. 1.14.2 adds the gallery link to the badge line, `glama.json`, and `CITATION.cff`. 1.14.3 adds Cline setup docs and `llms-install.md`. 1.15.0 detects repository languages in `init --quick`, refuses empty scans, and adds per-command help. 1.15.1 makes `watch` exit 2 when those globs match nothing, and scores code health for Python and Go as well as JavaScript and TypeScript. 1.15.2 reads Python and Go imports in the dependency graph, skips comment and type-only imports, adds `repolens badge` and `repolens comment`, and adds gallery explained pages plus `llms.txt`. 1.15.3 skips Python `TYPE_CHECKING` imports, omits Node.js built-ins from external packages, groups Go hubs by package, and ignores test files as architecture-pattern evidence. 1.15.4 names the project from `package.json`, scores maturity from version, history, tests, CI, and docs, reports circular dependencies as findings, drops self-imports and noise data flows, and stops classifying `index` and `core` files by name. Layout and counts are in [ARCHITECTURE.md](docs/ARCHITECTURE.md).
+The publisher set is Notion, Confluence, GitHub Wiki, Obsidian, and Markdown (`src/publishers`, 7 files). 1.14.0 adds the MCP server, the Marketplace action, and the docs badge. 1.14.1 sets the registry name to `io.github.CHAPIBUNNY/repolens`. 1.14.2 adds the gallery link to the badge line, `glama.json`, and `CITATION.cff`. 1.14.3 adds Cline setup docs and `llms-install.md`. 1.15.0 detects repository languages in `init --quick`, refuses empty scans, and adds per-command help. 1.15.1 makes `watch` exit 2 when those globs match nothing, and scores code health for Python and Go as well as JavaScript and TypeScript. 1.15.2 reads Python and Go imports in the dependency graph, skips comment and type-only imports, adds `repolens badge` and `repolens comment`, and adds gallery explained pages plus `llms.txt`. 1.15.3 skips Python `TYPE_CHECKING` imports, omits Node.js built-ins from external packages, groups Go hubs by package, and ignores test files as architecture-pattern evidence. 1.15.4 names the project from `package.json`, scores maturity from version, history, tests, CI, and docs, reports circular dependencies as findings, drops self-imports and noise data flows, and stops classifying `index` and `core` files by name. 1.15.5 reads a flat `src/` as one module, tells a library from a CLI by its `package.json`, splits runtime from development packages, keeps tests, examples, and build scripts out of hubs and security severity, and skips empty Route Map and GraphQL pages. 1.16.0 adds `repolens app` (a self-hosted GitHub App webhook), names a flat package after its directory, treats a framework description as a library when `main` is absent, and keeps test and example routes out of the product API. Layout and counts are in [ARCHITECTURE.md](docs/ARCHITECTURE.md).
 
 ### System Overview (Technical Profile)
 
@@ -419,6 +421,7 @@ When you open a pull request, RepoLens posts:
 | [Migration](docs/MIGRATION.md) | Upgrading from v0.3.0 or earlier |
 | [Stability](docs/STABILITY.md) | API contract and semver guarantees |
 | [MCP server](docs/MCP.md) | stdio server for Cursor, Claude, and VS Code |
+| [GitHub App](docs/GITHUB_APP.md) | Self-host the webhook: manifest, env vars, check run |
 
 ---
 
@@ -445,11 +448,11 @@ v1.0+ features complete — CLI, config schema, and plugin interface are frozen.
 - [x] MCP server (`repolens mcp`) for Cursor, Claude, and VS Code
 - [x] GitHub Action `RepoLens Architecture Docs` (`action.yml`)
 - [x] Docs by RepoLens badge on generated Markdown
+- [x] GitHub App webhook (`repolens app`) for a check run and the architecture comment
 
 **Next:**
-- [ ] GitHub App for automated setup and status checks
 - [ ] Java and C# language support
-- [ ] Grounded AI explanations and Q&A (`repolens ask`, PR comment, MCP, VS Code hover)
+- [ ] Grounded AI explanations and Q&A (`repolens ask`, PR comment, MCP, VS Code hover), layered on the always-published map and not a replacement for it
 - [ ] Slack notifications
 - [ ] Custom webhook support
 - [ ] Cross-repository architecture analysis

package/app.yml

@@ -0,0 +1,23 @@
+# GitHub App manifest for RepoLens.
+# Register from github-app-manifest.json (same fields) after you replace
+# hook_attributes.url with the public URL of `repolens app`.
+# Permissions stay minimal: checks write, pull requests write, contents read,
+# metadata read. This file does not create the app.
+
+name: RepoLens
+description: Posts an architecture diff as a check run and one sticky pull request comment.
+url: https://github.com/CHAPIBUNNY/repolens
+hook_attributes:
+  url: https://example.com/api/github/webhooks
+  active: true
+redirect_url: https://github.com/CHAPIBUNNY/repolens
+public: false
+default_permissions:
+  checks: write
+  pull_requests: write
+  contents: read
+  metadata: read
+default_events:
+  - installation
+  - installation_repositories
+  - pull_request

package/github-app-manifest.json

@@ -0,0 +1,22 @@
+{
+  "name": "RepoLens",
+  "description": "Posts an architecture diff as a check run and one sticky pull request comment.",
+  "url": "https://github.com/CHAPIBUNNY/repolens",
+  "hook_attributes": {
+    "url": "https://example.com/api/github/webhooks",
+    "active": true
+  },
+  "redirect_url": "https://github.com/CHAPIBUNNY/repolens",
+  "public": false,
+  "default_permissions": {
+    "checks": "write",
+    "pull_requests": "write",
+    "contents": "read",
+    "metadata": "read"
+  },
+  "default_events": [
+    "installation",
+    "installation_repositories",
+    "pull_request"
+  ]
+}

package/llms-full.txt

@@ -24,6 +24,7 @@ Agent-oriented install steps, including the Cline MCP snippet, are in llms-insta
 - `repolens watch` regenerates docs on change and exits 2 when nothing matches.
 - `repolens badge` prints a shields.io endpoint JSON document for the code-health score (0–100). `--format svg` prints a square SVG. `--format markdown --url https://host/repolens-badge.json` prints a README snippet. `--format all --out repolens-badge.json` writes JSON and SVG. Exit 2 when no JavaScript, TypeScript, Python, or Go files were scored. The score is not reported as 100 when zero files match.
 - `repolens comment --base <ref> --head <ref>` compares those commits. It prints markdown locally. In GitHub Actions, with `GITHUB_TOKEN`, `GITHUB_REPOSITORY`, and a pull_request event, it creates or updates one comment.
+- `repolens app` self-hosts a GitHub App webhook. It verifies `X-Hub-Signature-256`, posts a Check Run named RepoLens, and updates the sticky architecture comment. `repolens app --manifest` prints the manifest and needs no secrets. Listening needs `REPOLENS_APP_ID`, `REPOLENS_WEBHOOK_SECRET`, and a private key. See docs/GITHUB_APP.md.
 - `repolens mcp` starts the stdio MCP server. `repolens-mcp` is the same entry.
 
 Exit codes: 0 success, 1 runtime error or unknown command, 2 validation failure (bad flags, missing config, empty scan, and the other cases in the README).

package/llms-install.md

@@ -20,3 +20,5 @@
 11. CLI (1.15.2): the dependency graph includes Python and Go imports. Comments, strings, and TypeScript type-only imports are not edges. Go `*_test.go` files are not separate modules. Pattern text cites the matching path or import. "Custom React hooks" requires a `react` import.
 12. CLI (1.15.3): Python imports under `if TYPE_CHECKING:` (including `typing.TYPE_CHECKING` and `import typing as t`) are not cycle edges. Node.js built-ins are not external packages. Go hub rows are packages. Test files are not architecture-pattern evidence, and "API route pattern" requires a route directory.
 13. CLI (1.15.4): the project name comes from `package.json` or the real directory (never `.`). Maturity uses version, history, tests, CI, and docs. Circular dependencies are findings, not architectural patterns. A package's own name is not an external dependency. `index` and `main` files are not classified by name. Noise data flows are dropped.
+14. CLI (1.15.5): a flat `src/` is one module. A package with `main`, `module`, or `exports` is a library, not a CLI. Hubs and security severity ignore tests, examples, and build scripts. External packages are split into runtime and development tooling. Route Map and GraphQL Schema are skipped when empty.
+15. CLI (1.16.0): `repolens app` self-hosts a GitHub App webhook (manifest in `app.yml`, check run plus the sticky architecture comment). A framework description is a library even without `main`. A flat package is named after its directory. Test and example routes are not the product API. Test-only imports are dev tooling on Python and Go.

package/llms.txt

@@ -17,6 +17,7 @@ RepoLens is the npm package `@chappibunny/repolens` (Node.js 18+). It is a CLI,
 - [publish](https://github.com/CHAPIBUNNY/repolens/blob/main/docs/INSTALLATION.md): `npx @chappibunny/repolens publish` scans and publishes
 - [badge](https://github.com/CHAPIBUNNY/repolens/blob/main/README.md): `npx @chappibunny/repolens badge` prints shields.io code-health JSON, SVG, or markdown
 - [comment](https://github.com/CHAPIBUNNY/repolens/blob/main/README.md): `npx @chappibunny/repolens comment --base <ref> --head <ref>` prints an architecture diff
+- [app](https://github.com/CHAPIBUNNY/repolens/blob/main/docs/GITHUB_APP.md): `npx @chappibunny/repolens app` self-hosts the GitHub App webhook. `--manifest` prints the manifest. No credentials are required to print it
 - [doctor](https://github.com/CHAPIBUNNY/repolens/blob/main/docs/INSTALLATION.md): `npx @chappibunny/repolens doctor` validates setup
 - [mcp](https://github.com/CHAPIBUNNY/repolens/blob/main/docs/MCP.md): `npx -y @chappibunny/repolens mcp` starts the stdio server
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chappibunny/repolens",
-  "version": "1.15.4",
+  "version": "1.16.0",
   "mcpName": "io.github.CHAPIBUNNY/repolens",
   "description": "AI-assisted documentation intelligence system for technical and non-technical audiences",
   "license": "MIT",
@@ -18,7 +18,9 @@
     "repolens-mcp": "bin/repolens-mcp.js"
   },
   "files": [
+    "app.yml",
     "bin",
+    "github-app-manifest.json",
     "src",
     "package.json",
     "README.md",
@@ -86,18 +88,18 @@
     "release:major": "npm version major"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.32.1",
-    "dotenv": "^18.0.8",
+    "@modelcontextprotocol/sdk": "^1.32.2",
+    "dotenv": "^18.0.9",
     "fast-glob": "^3.3.3",
-    "js-yaml": "^4.3.2",
+    "js-yaml": "^5.5.0",
     "zod": "4.6.7"
   },
   "optionalDependencies": {
-    "@sentry/node": "^10.42.0"
+    "@sentry/node": "^11.8.0"
   },
   "devDependencies": {
     "tinyexec": "^1.3.1",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.5"
   },
   "overrides": {
     "yauzl": ">=3.2.1",