@chappibunny/repolens 1.15.4 → 1.16.0

package/src/analyzers/context-builder.js

@@ -1,6 +1,7 @@
 // Build structured AI context from deterministic scan results
 
-import { groupModulesByDomain, pathHasKeyword } from "./domain-inference.js";
+import { groupModulesByDomain, pathHasKeyword, stripContainerSegments, hasContainerSegment } from "./domain-inference.js";
+import { isTestPath } from "../utils/path-roles.js";
 
 /**
  * Compute per-module dependency metrics from the dep graph.
@@ -28,56 +29,100 @@ export function computeModuleDepMetrics(depGraph) {
 }
 
 /**
- * Build a module-level dep metrics map (aggregating file-level metrics).
+ * Find the module a file belongs to: the module with the longest key that is a path
+ * prefix of the file. Files at the repository root belong to the flat module
+ * (the directory name, or the legacy key `root`).
+ */
+function flatModuleKey(modules) {
+  const marked = modules.find((mod) => mod.flat);
+  if (marked) return marked.key;
+  return modules.some((mod) => mod.key === "root") ? "root" : null;
+}
+
+function buildModuleLookup(modules) {
+  const keys = modules.map((m) => m.key).sort((x, y) => y.length - x.length);
+  const flatKey = flatModuleKey(modules);
+  const cache = new Map();
+  return (file) => {
+    const norm = String(file || "").replace(/\\/g, "/");
+    if (cache.has(norm)) return cache.get(norm);
+    let found = null;
+    for (const key of keys) {
+      if (key === flatKey) continue;
+      if (norm === key || norm.startsWith(`${key}/`)) { found = key; break; }
+    }
+    if (!found && !norm.includes("/") && flatKey) found = flatKey;
+    cache.set(norm, found);
+    return found;
+  };
+}
+
+/**
+ * Build a module-level dep metrics map from file-level edges.
  * moduleKey → { fanIn, fanOut, isHub, isOrphan, isLeaf, isOrchestrator }
+ * fanIn and fanOut count distinct other modules, not file-to-file edges, so a folder
+ * of 77 test files that imports one helper 77 times still has a fan-out of 1.
  */
 export function computeModuleLevelMetrics(depGraph, modules) {
-  const fileMetrics = computeModuleDepMetrics(depGraph);
-  if (fileMetrics.size === 0 || !modules) return new Map();
+  if (!depGraph?.nodes || depGraph.nodes.length === 0 || !modules) return new Map();
 
-  const moduleLevelMap = new Map();
+  const moduleOf = buildModuleLookup(modules);
+  const fileToModule = new Map();
+  for (const node of depGraph.nodes) {
+    fileToModule.set(node.key, moduleOf(node.file || node.key));
+  }
 
-  for (const mod of modules) {
-    const moduleKey = mod.key;
-    const lowerKey = moduleKey.toLowerCase();
-
-    // Find all file-level nodes that belong to this module
-    let totalFanIn = 0;
-    let totalFanOut = 0;
-    let fileCount = 0;
-
-    for (const [nodeKey, m] of fileMetrics) {
-      if (nodeKey === lowerKey || nodeKey.startsWith(lowerKey + "/") || nodeKey === moduleKey || nodeKey.startsWith(moduleKey + "/")) {
-        // Count only external edges (crossing module boundary)
-        if (depGraph?.nodes) {
-          const node = depGraph.nodes.find(n => n.key === nodeKey);
-          if (node) {
-            const externalIn = node.importedBy.filter(imp => !imp.startsWith(moduleKey + "/") && imp !== moduleKey).length;
-            const externalOut = node.imports.filter(imp => !imp.startsWith(moduleKey + "/") && imp !== moduleKey).length;
-            totalFanIn += externalIn;
-            totalFanOut += externalOut;
-            fileCount++;
-          }
-        }
-      }
+  const importedFrom = new Map(); // module -> Set of modules it imports
+  const importersOf = new Map();  // module -> Set of modules importing it
+  const fileCounts = new Map();
+  for (const node of depGraph.nodes) {
+    const from = fileToModule.get(node.key);
+    if (!from) continue;
+    fileCounts.set(from, (fileCounts.get(from) || 0) + 1);
+    for (const target of node.imports) {
+      const to = fileToModule.get(target);
+      if (!to || to === from) continue;
+      if (!importedFrom.has(from)) importedFrom.set(from, new Set());
+      if (!importersOf.has(to)) importersOf.set(to, new Set());
+      importedFrom.get(from).add(to);
+      importersOf.get(to).add(from);
     }
+  }
 
-    if (fileCount > 0) {
-      const hubThreshold = Math.max(5, Math.floor(modules.length * 0.15));
-      moduleLevelMap.set(moduleKey, {
-        fanIn: totalFanIn,
-        fanOut: totalFanOut,
-        isHub: totalFanIn >= hubThreshold,
-        isOrphan: totalFanIn === 0 && totalFanOut === 0,
-        isLeaf: totalFanOut === 0 && totalFanIn > 0,
-        isOrchestrator: totalFanOut >= 5 && totalFanIn < totalFanOut,
-      });
-    }
+  const moduleLevelMap = new Map();
+  const hubThreshold = Math.max(3, Math.floor(modules.length * 0.15));
+  for (const mod of modules) {
+    if (!fileCounts.has(mod.key)) continue;
+    const fanIn = importersOf.get(mod.key)?.size || 0;
+    const fanOut = importedFrom.get(mod.key)?.size || 0;
+    moduleLevelMap.set(mod.key, {
+      fanIn,
+      fanOut,
+      isHub: fanIn >= hubThreshold,
+      isOrphan: fanIn === 0 && fanOut === 0,
+      isLeaf: fanOut === 0 && fanIn > 0,
+      isOrchestrator: fanOut >= 5 && fanIn < fanOut,
+    });
   }
 
   return moduleLevelMap;
 }
 
+/**
+ * Is this project a command-line tool? Package metadata decides when it is known
+ * (a library with a build helper in `bin/` is a library). Otherwise a CLI pattern does.
+ */
+export function isCliProject(context) {
+  const kind = context?.project?.kind;
+  if (kind === "cli") return true;
+  if (kind === "library") return false;
+  return (context?.patterns || []).some((p) => String(p).toLowerCase().startsWith("cli tool"));
+}
+
+export function isLibraryProject(context) {
+  return context?.project?.kind === "library";
+}
+
 export function buildAIContext(scanResult, config, depGraph = null) {
   const { filesCount, modules, api, pages, metadata } = scanResult;
   
@@ -129,12 +174,13 @@ export function buildAIContext(scanResult, config, depGraph = null) {
   };
   
   // Identify key architectural patterns (verified against dep graph when available)
-  const patterns = inferArchitecturalPatterns(modules, depGraph);
+  const patterns = inferArchitecturalPatterns(modules, depGraph, metadata?.projectKind);
   
   // Build compact context object
   return {
     project: {
       name: config.project.name,
+      kind: metadata?.projectKind || "unknown",
       filesScanned: filesCount,
       modulesDetected: modules.length,
       pagesDetected: pages?.length || 0,
@@ -177,7 +223,15 @@ export function buildAIContext(scanResult, config, depGraph = null) {
 }
 
 function inferModuleType(modulePath) {
-  const has = (keyword) => pathHasKeyword(modulePath, keyword);
+  // `src` and `lib` only say where code lives. `lib/ogg` is typed by `ogg`, and a bare
+  // `lib` is the project's source, not a "shared library" layer.
+  const typedPath = stripContainerSegments(modulePath);
+  const fromContainer = hasContainerSegment(modulePath);
+  const has = (keyword) => pathHasKeyword(typedPath, keyword);
+  // Page, route, and view describe a folder of pages. A build script called
+  // `build-pages.js` is not one.
+  const isFile = /\.[a-z0-9]+$/i.test(String(modulePath).split("/").pop() || "");
+  const hasDirectory = (keyword) => pathHasKeyword(directoryPath(typedPath), keyword);
 
   if (has("test") || has("spec")) return "test";
   if (has("api") || has("endpoint")) return "api";
@@ -185,7 +239,7 @@ function inferModuleType(modulePath) {
   if (has("lib") || has("util") || has("helper") || has("common") || has("shared")) return "library";
   if (has("hook")) return "hooks";
   if (has("store") || has("state") || has("redux") || has("zustand")) return "state";
-  if (has("page") || has("route") || has("view")) return "route";
+  if (isFile ? (hasDirectory("page") || hasDirectory("route") || hasDirectory("view")) : (has("page") || has("route") || has("view"))) return "route";
   if (has("config") || has("setting") || has("env")) return "config";
   if (has("core") || has("kernel") || has("foundation")) return "core";
   if (has("render") || has("template") || has("format")) return "renderer";
@@ -203,19 +257,10 @@ function inferModuleType(modulePath) {
   if (has("service")) return "service";
   if (has("app")) return "app";
 
-  return "other";
+  return fromContainer ? "source" : "other";
 }
 
-function isTestEvidence(modulePath) {
-  const norm = String(modulePath || "").replace(/\\/g, "/");
-  if (/(^|\/)__(tests|mocks)__(\/|$)/.test(norm)) return true;
-  if (/(^|\/)(test|tests|spec|specs|fixtures|testdata)(\/|$)/.test(norm)) return true;
-  const base = norm.split("/").pop() || "";
-  if (/^(test_|spec_)/.test(base)) return true;
-  if (/(_test|_spec)\.[a-z0-9]+$/i.test(base)) return true;
-  if (/\.(test|spec)\.[a-z0-9]+$/i.test(base)) return true;
-  return false;
-}
+const isTestEvidence = isTestPath;
 
 const API_DIRECTORY_SEGMENTS = new Set([
   "api", "apis", "route", "routes", "router", "routers",
@@ -235,14 +280,15 @@ function directoryPath(modulePath) {
   return parts.join("/");
 }
 
-function inferArchitecturalPatterns(modules, depGraph = null) {
+function inferArchitecturalPatterns(modules, depGraph = null, projectKind = null) {
   const patterns = [];
   const production = modules.filter((module) => !isTestEvidence(module.key));
   const tests = modules.filter((module) => isTestEvidence(module.key));
   const keys = production.map(m => m.key.toLowerCase());
 
+  // `lib` and `src` only say where code lives, so they never count as evidence for a pattern.
   const has = (keyword) => keys.some((key) => (
-    keyword.includes("/") ? key.includes(keyword) : pathHasKeyword(key, keyword)
+    keyword.includes("/") ? key.includes(keyword) : pathHasKeyword(stripContainerSegments(key), keyword)
   ));
   const matchingKeys = (keywords, source = production) => {
     const found = [];
@@ -251,7 +297,7 @@ function inferArchitecturalPatterns(modules, depGraph = null) {
         const key = module.key;
         const matched = keyword.includes("/")
           ? key.toLowerCase().includes(keyword)
-          : pathHasKeyword(key, keyword);
+          : pathHasKeyword(stripContainerSegments(key), keyword);
         if (matched && !found.includes(key)) found.push(key);
       }
     }
@@ -342,7 +388,8 @@ function inferArchitecturalPatterns(modules, depGraph = null) {
   }
 
   if (has("analyz") || has("detect") || has("inspect")) cite("Analysis pipeline", ["analyz", "detect", "inspect"]);
-  if (has("cli") || has("command") || has("bin")) cite("CLI tool architecture", ["cli", "command", "bin"]);
+  // A library's `bin/` folder is build tooling. Only a CLI package gets this pattern.
+  if (projectKind !== "library" && (has("cli") || has("command") || has("bin"))) cite("CLI tool architecture", ["cli", "command", "bin"]);
 
   if (has("util") || has("helper") || has("lib")) {
     const verified = moduleMetrics.size > 0 && verifyHub("util") || verifyHub("helper") || verifyHub("lib");

package/src/analyzers/dependency-graph.js

@@ -16,6 +16,7 @@ import {
   isGoStdlib,
   parseGoModule,
 } from "./import-parsers.js";
+import { isNonProductPath } from "../utils/path-roles.js";
 
 const JS_EXTENSIONS = new Set([".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs"]);
 const PY_EXTENSIONS = new Set([".py", ".pyw"]);
@@ -70,6 +71,8 @@ function emptyResult() {
     edges: [],
     cycles: [],
     externalDeps: [],
+    externalRuntime: [],
+    externalDev: [],
     stats: null,
     summary: null,
   };
@@ -89,15 +92,19 @@ function goPackageImportPath(file, modulePath) {
   return rel || ".";
 }
 
+// Hubs describe the product. Test helpers, examples, and build scripts are neither hubs
+// nor reasons for a product file to count as one.
 function aggregateHubs(nodes, fileKeyToFile, modulePath, hubThreshold) {
   const groups = new Map();
   for (const node of nodes) {
+    if (isNonProductPath(node.file || node.key)) continue;
     const pkg = goPackageImportPath(node.file, modulePath);
     const key = pkg || node.key;
     if (!groups.has(key)) groups.set(key, new Set());
     const importers = groups.get(key);
     for (const importer of node.importedBy || []) {
       const importerFile = fileKeyToFile.get(importer) || importer;
+      if (isNonProductPath(importerFile)) continue;
       if (pkg && goPackageImportPath(importerFile, modulePath) === pkg) continue;
       importers.add(importer);
     }
@@ -271,13 +278,22 @@ export async function analyzeDependencyGraph(files, repoRoot) {
   // Stats
   const totalImports = result.edges.length;
   const orphans = result.nodes.filter(n => n.imports.length === 0 && n.importedBy.length === 0);
-  const hubThreshold = Math.max(5, Math.floor(result.nodes.length * 0.1));
+  const sourceNodeCount = result.nodes.filter((n) => !isNonProductPath(n.file || n.key)).length;
+  const hubThreshold = Math.max(5, Math.round(sourceNodeCount * 0.07));
   const hubs = aggregateHubs(result.nodes, fileKeyToFile, goModulePath, hubThreshold);
 
+  // Runtime vs development packages, from the nearest package.json.
+  const { runtime: externalRuntime, dev: externalDev } = await splitExternalDeps(result, repoRoot);
+  result.externalRuntime = externalRuntime;
+  result.externalDev = externalDev;
+
   result.stats = {
     totalFiles: codeFiles.length,
+    sourceFiles: codeFiles.filter((file) => !isNonProductPath(file)).length,
     totalEdges: totalImports,
     externalDeps: result.externalDeps.length,
+    externalRuntime: externalRuntime.length,
+    externalDev: externalDev.length,
     cycles: result.cycles.length,
     orphanFiles: orphans.length,
     hubs,
@@ -294,6 +310,48 @@ export async function analyzeDependencyGraph(files, repoRoot) {
   return result;
 }
 
+/**
+ * Split external packages into runtime dependencies and development tooling.
+ * A package declared in `devDependencies` is development tooling. One declared in
+ * `dependencies`, `optionalDependencies`, or `peerDependencies` is runtime. An undeclared
+ * package is runtime when a product file (not a test, example, or build script) imports it,
+ * and development tooling when only tests or examples import it. Python and Go have no
+ * package.json, so that import split is the whole decision.
+ */
+async function splitExternalDeps(result, repoRoot) {
+  const raw = await readFileSafe(path.join(repoRoot, "package.json"));
+  let pkg = null;
+  try { pkg = raw ? JSON.parse(raw) : null; } catch { pkg = null; }
+
+  const declaredRuntime = new Set(pkg ? [
+    ...Object.keys(pkg.dependencies || {}),
+    ...Object.keys(pkg.optionalDependencies || {}),
+    ...Object.keys(pkg.peerDependencies || {}),
+  ] : []);
+  const declaredDev = new Set(pkg ? Object.keys(pkg.devDependencies || {}) : []);
+
+  const productImports = new Set();
+  for (const node of result.nodes) {
+    if (isNonProductPath(node.file || node.key) || isBuildScript(node.file || node.key)) continue;
+    for (const name of node.externalImports || []) productImports.add(name);
+  }
+
+  const runtime = [];
+  const dev = [];
+  for (const name of result.externalDeps) {
+    if (declaredRuntime.has(name)) runtime.push(name);
+    else if (declaredDev.has(name)) dev.push(name);
+    else if (productImports.has(name)) runtime.push(name);
+    else dev.push(name);
+  }
+  return { runtime, dev };
+}
+
+function isBuildScript(file) {
+  const base = String(file || "").replace(/\\/g, "/").split("/").pop() || "";
+  return /^build([-_.]|$)/i.test(base) || /\.config\.[cm]?[jt]s$/i.test(base);
+}
+
 /**
  * Detect all cycles in a directed graph using DFS with 3-color marking.
  * Returns an array of cycle paths (each path ends where it started).

package/src/analyzers/domain-inference.js

@@ -17,7 +17,7 @@ const DEFAULT_DOMAIN_HINTS = [
     description: "Content publishing, management, and delivery"
   },
   { 
-    match: ["search", "filter", "query", "index", "catalog", "browse"], 
+    match: ["search", "query", "index", "catalog", "browse"], 
     domain: "Search & Discovery",
     description: "Search functionality, filtering, and content discovery"
   },
@@ -62,7 +62,7 @@ const DEFAULT_DOMAIN_HINTS = [
     description: "Database access, models, and data persistence"
   },
   {
-    match: ["config", "setting", "env", "constant"],
+    match: ["config", "setting", "env"],
     domain: "Configuration",
     description: "Application configuration and environment settings"
   },
@@ -92,7 +92,7 @@ const DEFAULT_DOMAIN_HINTS = [
     description: "Content and artifact publishing, deployment, and distribution"
   },
   {
-    match: ["analyz", "inspect", "detect", "lint", "scan", "parse"],
+    match: ["analyz", "inspect", "detect", "lint", "scan"],
     domain: "Analysis & Detection",
     description: "Code analysis, pattern detection, and static inspection"
   },
@@ -187,10 +187,31 @@ export function stripEntryFileName(modulePath) {
   return parts.join("/");
 }
 
+// Folder names that only say "code lives here". `lib/ogg` is about ogg, not about being a lib.
+export const GENERIC_CONTAINER_SEGMENTS = new Set(["src", "lib", "libs", "source", "sources", "packages", "pkg", "internal"]);
+
+/**
+ * Drop generic container folders (`src`, `lib`, ...) from a path so they do not pick a
+ * domain on their own. Returns "" when nothing else is left (`lib`, `src/lib`).
+ */
+export function stripContainerSegments(modulePath) {
+  return String(modulePath)
+    .replace(/\\/g, "/")
+    .split("/")
+    .filter((segment) => segment && !GENERIC_CONTAINER_SEGMENTS.has(segment.toLowerCase()))
+    .join("/");
+}
+
+/** True when the path has a generic container folder (`lib/ogg`, `src`). */
+export function hasContainerSegment(modulePath) {
+  return String(modulePath).replace(/\\/g, "/").split("/").some((segment) => GENERIC_CONTAINER_SEGMENTS.has(segment.toLowerCase()));
+}
+
 export function inferDomain(modulePath, customHints = [], evidence = {}) {
   const customSet = new Set(customHints);
   const hints = [...customHints, ...DEFAULT_DOMAIN_HINTS];
-  const defaultPath = stripEntryFileName(modulePath);
+  const entryStripped = stripEntryFileName(modulePath);
+  const defaultPath = stripContainerSegments(entryStripped);
 
   for (const hint of hints) {
     // User-defined hints see the full path. Built-in guesses ignore entry file names.
@@ -208,6 +229,16 @@ export function inferDomain(modulePath, customHints = [], evidence = {}) {
     }
   }
   
+  // A source folder with no keyword of its own is core code, not "uncategorized".
+  if (hasContainerSegment(entryStripped)) {
+    return {
+      domain: "Core Source",
+      description: "The project's own source code, grouped by folder",
+      confidence: "none",
+      matchedKeyword: null
+    };
+  }
+
   return {
     domain: "Other",
     description: "Uncategorized module",

package/src/analyzers/flow-inference.js

@@ -1,30 +1,19 @@
+import { isToolingPath, isTestPath } from "../utils/path-roles.js";
+
 // Infer data flows through the application using import graph analysis + heuristics
 
 /**
  * Primary flow inference: uses dep graph when available for real import-chain flows,
  * falls back to keyword heuristics for repos without dep graph data.
  */
-// Directories holding tooling, samples, and docs. An import chain from a file in
-// here describes a build script or an example, not how data moves through the product.
-const TOOLING_DIRECTORIES = new Set([
-  "doc", "docs", "doc-gen", "docgen", "scripts", "script", "tools", "tooling",
-  "example", "examples", "demo", "demos", "sample", "samples",
-  "benchmark", "benchmarks", "bench", "fixtures", "tasks",
-]);
-
 // File names too generic to name a flow ("gen Request Flow", "util Integration Flow").
 const GENERIC_FLOW_NAMES = new Set([
   "gen", "generate", "util", "utils", "helper", "helpers", "misc", "common", "types", "constants",
 ]);
 
-function isToolingPath(key) {
-  const parts = String(key || "").replace(/\\/g, "/").toLowerCase().split("/");
-  return parts.slice(0, -1).some((segment) => TOOLING_DIRECTORIES.has(segment));
-}
-
 /**
  * Drop flows that are noise: no steps, nothing beyond the starting file, a name that is only
- * a generic helper word, or a chain that starts in tooling, examples, or docs.
+ * a generic helper word, or a chain that starts in tests, tooling, examples, or docs.
  */
 export function filterNoiseFlows(flows) {
   return (flows || []).filter((flow) => {
@@ -32,7 +21,7 @@ export function filterNoiseFlows(flows) {
     const steps = Array.isArray(flow.steps) ? flow.steps : [];
     if (steps.length < 2) return false;
     const origin = flow.modules?.[0];
-    if (origin && isToolingPath(origin)) return false;
+    if (origin && (isToolingPath(origin) || isTestPath(origin))) return false;
     const stem = String(flow.name || "").split(" ")[0].toLowerCase();
     if (GENERIC_FLOW_NAMES.has(stem)) return false;
     return true;
@@ -66,6 +55,11 @@ export function inferDataFlows(scanResult, config, depGraph = null) {
   return filterNoiseFlows(flows);
 }
 
+/** Same key the dependency graph gives a file: no extension, no trailing /index. */
+function fileKey(file) {
+  return String(file).replace(/\\/g, "/").replace(/\.(js|ts|jsx|tsx|mjs|cjs)$/, "").replace(/\/index$/, "");
+}
+
 /**
  * Trace real import chains from entry points through the dep graph.
  * Entry points: CLI/bin files, page components, API route handlers, index files.
@@ -74,12 +68,22 @@ function inferFlowsFromEntryPoints(scanResult, depGraph) {
   const flows = [];
   if (!depGraph?.nodes) return flows;
 
+  const isLibrary = scanResult?.metadata?.projectKind === "library";
+  const packageEntryKeys = new Set(
+    (scanResult?.metadata?.packageEntryFiles || []).map((file) => fileKey(file)),
+  );
+
   // Find entry points (files with high fan-out and low/zero fan-in)
   const entryPoints = depGraph.nodes.filter(n => {
     const key = n.key.toLowerCase();
+    // Build configs (`webpack.config`) wire up tooling. They are not how data moves.
+    if (/\.config$/.test(key)) return false;
+    // In a library, `bin/` holds build helpers. The package entry is what callers use.
+    if (isLibrary && /(^|\/)bin\//.test(key)) return false;
     const isEntry = (
-      key.includes("bin/") || 
-      key.includes("cli") ||
+      packageEntryKeys.has(n.key) ||
+      (!isLibrary && key.includes("bin/")) ||
+      (!isLibrary && key.includes("cli")) ||
       key.endsWith("/index") ||
       key.includes("pages/") ||
       key.includes("app/") ||
@@ -88,15 +92,15 @@ function inferFlowsFromEntryPoints(scanResult, depGraph) {
     return isEntry && n.imports.length >= 2;
   }).sort((a, b) => {
     // Prioritize src/ entry points over tests/
-    const aIsTest = a.key.toLowerCase().includes("test");
-    const bIsTest = b.key.toLowerCase().includes("test");
+    const aIsTest = isTestPath(a.key);
+    const bIsTest = isTestPath(b.key);
     if (aIsTest !== bIsTest) return aIsTest ? 1 : -1;
     return b.imports.length - a.imports.length;
   });
 
   // Limit: all src entries + max 2 test entries
-  const srcEntries = entryPoints.filter(n => !n.key.toLowerCase().includes("test"));
-  const testEntries = entryPoints.filter(n => n.key.toLowerCase().includes("test")).slice(0, 2);
+  const srcEntries = entryPoints.filter(n => !isTestPath(n.key));
+  const testEntries = entryPoints.filter(n => isTestPath(n.key)).slice(0, 2);
   const selectedEntries = [...srcEntries, ...testEntries].slice(0, 5);
 
   for (const entry of selectedEntries) {
@@ -104,8 +108,8 @@ function inferFlowsFromEntryPoints(scanResult, depGraph) {
     if (chain.length < 2) continue;
 
     const shortName = entry.key.split("/").pop();
-    const isCliEntry = entry.key.toLowerCase().includes("cli") || entry.key.toLowerCase().includes("bin/");
-    const flowType = isCliEntry ? "Command" : "Request";
+    const isCliEntry = !isLibrary && (entry.key.toLowerCase().includes("cli") || entry.key.toLowerCase().includes("bin/"));
+    const flowType = isCliEntry ? "Command" : isLibrary && packageEntryKeys.has(entry.key) ? "Library" : "Request";
     
     // Classify each step in the chain
     const steps = chain.map((nodeKey, i) => {

package/src/analyzers/security-patterns.js

@@ -5,6 +5,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { info, warn } from "../utils/logger.js";
+import { isBuildOrExamplePath } from "../utils/path-roles.js";
 
 const JS_EXTENSIONS = [".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx"];
 
@@ -205,6 +206,27 @@ const SKIP_PATTERNS = [
   /\.repolens\//,
 ];
 
+const HTML_ASSIGNMENT_IDS = new Set(["innerhtml-assignment", "outerhtml-assignment"]);
+
+/**
+ * Is the right-hand side of an innerHTML/outerHTML assignment a fixed string?
+ * `el.innerHTML = ''` clears an element and `el.innerHTML = '<b>ok</b>'` writes a constant.
+ * Neither can carry injected markup, so neither is an XSS finding. A template literal
+ * with `${...}` or any concatenation still is.
+ */
+export function isStaticHtmlAssignment(restOfSource) {
+  const rest = String(restOfSource || "");
+  const quoted = rest.match(/^\s*(['"])((?:(?!\1)[^\\\n]|\\.)*)\1\s*(?=[;,)}\n]|$)/);
+  if (quoted) return true;
+  const template = rest.match(/^\s*`([^`]*)`\s*(?=[;,)}\n]|$)/);
+  if (template && !template[1].includes("${")) return true;
+  return false;
+}
+
+// Build scripts and example pages run on a maintainer's machine or in a demo page. They are
+// listed, but never as high severity.
+const SEVERITY_CAPPED_IDS_EXEMPT = new Set(["hardcoded-password"]);
+
 function shouldSkipFile(filePath) {
   return SKIP_PATTERNS.some(pattern => pattern.test(filePath));
 }
@@ -255,7 +277,11 @@ export async function analyzeSecurityPatterns(files, repoRoot) {
       
       while ((match = regex.exec(stripped)) !== null) {
         // Get line number
+        if (HTML_ASSIGNMENT_IDS.has(pattern.id) && isStaticHtmlAssignment(stripped.slice(match.index + match[0].length))) continue;
+
         const lineNumber = stripped.slice(0, match.index).split("\n").length;
+        const capped = isBuildOrExamplePath(file) && !SEVERITY_CAPPED_IDS_EXEMPT.has(pattern.id);
+        const severity = capped ? "low" : pattern.severity;
         
         // Get the surrounding code snippet
         const lines = stripped.split("\n");
@@ -267,8 +293,8 @@ export async function analyzeSecurityPatterns(files, repoRoot) {
         result.findings.push({
           id: pattern.id,
           category: pattern.category,
-          name: pattern.name,
-          severity: pattern.severity,
+          name: capped ? `${pattern.name} (build/example code)` : pattern.name,
+          severity,
           file,
           line: lineNumber,
           snippet: snippet.length > 200 ? snippet.slice(0, 200) + "..." : snippet,
@@ -276,7 +302,7 @@ export async function analyzeSecurityPatterns(files, repoRoot) {
           cwe: pattern.cwe,
         });
 
-        result.bySeverity[pattern.severity]++;
+        result.bySeverity[severity]++;
         result.filesWithFindings.add(file);
         
         if (!result.byCategory[pattern.category]) {

package/src/cli-args.js

@@ -8,6 +8,9 @@ const FLAGS_WITH_VALUE = new Set([
   "--url",
   "--link",
   "--label",
+  "--port",
+  "--host",
+  "--webhook-path",
 ]);
 const BOOLEAN_FLAGS = new Set([
   "--quick",
@@ -16,6 +19,7 @@ const BOOLEAN_FLAGS = new Set([
   "--force",
   "--strict",
   "--verbose",
+  "--manifest",
   "--help",
   "-h",
   "--version",

package/src/cli.js

@@ -311,6 +311,17 @@ async function main() {
     process.exit(code);
   }
 
+  if (command === "app") {
+    const { runGitHubApp } = await import("./github-app/run.js");
+    const code = await runGitHubApp({
+      manifest: Boolean(parsed.flags["--manifest"]),
+      port: parsed.flags["--port"],
+      host: parsed.flags["--host"],
+      webhookPath: parsed.flags["--webhook-path"],
+    });
+    process.exit(code);
+  }
+
   if (command === "mcp") {
     process.env.REPOLENS_LOG_STDERR = "1";
     const { startMcpServer } = await import("./mcp/server.js");