@chappibunny/repolens 1.15.5 → 1.16.0

package/src/github-app/auth.js

@@ -0,0 +1,130 @@
+import { createSign } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { fetchWithRetry } from "../utils/retry.js";
+import { sanitizeSecrets } from "../utils/secrets.js";
+
+function base64url(value) {
+  return Buffer.from(value).toString("base64url");
+}
+
+/**
+ * GitHub App JWT (RS256). `iat` is 60s in the past so a skewed clock still works.
+ * `exp` is 9 minutes ahead (GitHub rejects more than 10).
+ */
+export function createAppJwt({ appId, privateKey, now = Date.now() }) {
+  if (!appId) throw new Error("Missing GitHub App id");
+  if (!privateKey || !String(privateKey).includes("BEGIN")) {
+    throw new Error("GitHub App private key must be a PEM body");
+  }
+  const header = base64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const payload = base64url(JSON.stringify({
+    iat: Math.floor(now / 1000) - 60,
+    exp: Math.floor(now / 1000) + 9 * 60,
+    iss: String(appId),
+  }));
+  const unsigned = `${header}.${payload}`;
+  const signer = createSign("RSA-SHA256");
+  signer.update(unsigned);
+  signer.end();
+  const signature = signer.sign(privateKey).toString("base64url");
+  return `${unsigned}.${signature}`;
+}
+
+export function readAppPrivateKey(env = process.env) {
+  const file = env.REPOLENS_APP_PRIVATE_KEY_PATH;
+  if (file) {
+    return readFileSync(file, "utf8");
+  }
+  const raw = env.REPOLENS_APP_PRIVATE_KEY || "";
+  return raw.includes("\\n") ? raw.replace(/\\n/g, "\n") : raw;
+}
+
+export function redactToken(text, token) {
+  const value = String(text || "");
+  if (!token) return value;
+  return value.split(token).join("[redacted]");
+}
+
+/**
+ * Exchange the app JWT for an installation access token.
+ * `fetchImpl` is injectable in tests. It must return a Response.
+ */
+export async function fetchInstallationToken({
+  appId,
+  privateKey,
+  installationId,
+  fetchImpl,
+  now,
+}) {
+  if (!/^[0-9]+$/.test(String(installationId))) {
+    throw new Error("Invalid installation id");
+  }
+  const jwt = createAppJwt({ appId, privateKey, now });
+  const url = `https://api.github.com/app/installations/${installationId}/access_tokens`;
+  const send = fetchImpl || ((resource, options) => fetchWithRetry(resource, options, {
+    retries: 2,
+    baseDelayMs: 400,
+    maxDelayMs: 2000,
+    label: "GitHub App token",
+  }));
+  const response = await send(url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${jwt}`,
+      Accept: "application/vnd.github+json",
+      "User-Agent": "RepoLens",
+      "X-GitHub-Api-Version": "2022-11-28",
+    },
+  });
+  const text = await response.text();
+  if (!response.ok) {
+    const clipped = sanitizeSecrets(String(text || "").replace(/\s+/g, " ").slice(0, 300));
+    throw Object.assign(new Error(`GitHub App token request failed (${response.status}): ${clipped}`), {
+      status: response.status,
+    });
+  }
+  const json = text ? JSON.parse(text) : {};
+  if (!json.token) throw new Error("GitHub App token response had no token");
+  return json.token;
+}
+
+export function createGitHubRequest(token, fetchImpl) {
+  if (typeof token !== "string" || !/^[A-Za-z0-9_]+$/.test(token)) {
+    throw new Error("Installation token has an unexpected shape");
+  }
+  return async function githubRequest(method, urlPath, body) {
+    const send = fetchImpl || ((resource, options) => fetchWithRetry(resource, options, {
+      retries: 2,
+      baseDelayMs: 400,
+      maxDelayMs: 2000,
+      label: `GitHub ${method}`,
+    }));
+    const response = await send(`https://api.github.com${urlPath}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "Content-Type": "application/json",
+        "User-Agent": "RepoLens",
+        "X-GitHub-Api-Version": "2022-11-28",
+      },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+    const text = await response.text();
+    let json = null;
+    if (text) {
+      try {
+        json = JSON.parse(text);
+      } catch {
+        json = null;
+      }
+    }
+    if (!response.ok) {
+      const clipped = sanitizeSecrets(redactToken(text, token).replace(/\s+/g, " ").slice(0, 300));
+      throw Object.assign(new Error(`GitHub API error ${response.status}: ${clipped}`), {
+        status: response.status,
+      });
+    }
+    return json;
+  };
+}

package/src/github-app/checkout.js

@@ -0,0 +1,70 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { isSafeGitRef } from "../core/diff.js";
+import { assertGitHubRepo } from "../utils/github-repo.js";
+import { redactToken } from "./auth.js";
+
+function assertToken(token) {
+  if (typeof token !== "string" || !/^[A-Za-z0-9_]+$/.test(token)) {
+    throw new Error("Installation token has an unexpected shape");
+  }
+}
+
+function git(args, cwd, token) {
+  try {
+    execFileSync("git", [
+      "-c", "safe.directory=*",
+      "-c", `http.extraheader=AUTHORIZATION: bearer ${token}`,
+      ...args,
+    ], {
+      cwd,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+      stdio: ["ignore", "pipe", "pipe"],
+      maxBuffer: 10 * 1024 * 1024,
+    });
+  } catch (error) {
+    const stderr = redactToken(error.stderr || error.message || error, token)
+      .replace(/\s+/g, " ")
+      .slice(0, 300);
+    throw new Error(`git failed: ${stderr}`);
+  }
+}
+
+/**
+ * Clone the base repository and fetch the pull request head plus the base SHA.
+ * The token is passed as an HTTP header, not in the remote URL, and is stripped
+ * from git's error text. It can still appear in the process list on the host.
+ */
+export async function checkoutPullRequest({ token, owner, repo, pullNumber, baseSha, headSha }) {
+  assertToken(token);
+  assertGitHubRepo(`${owner}/${repo}`);
+  if (!/^[0-9]+$/.test(String(pullNumber))) {
+    throw new Error("Invalid pull request number");
+  }
+  if (!isSafeGitRef(baseSha) || !isSafeGitRef(headSha)) {
+    throw new Error("Invalid base or head commit");
+  }
+
+  const parent = await fs.mkdtemp(path.join(os.tmpdir(), "repolens-app-"));
+  const dir = path.join(parent, "repo");
+  const remote = `https://github.com/${owner}/${repo}.git`;
+  try {
+    await fs.mkdir(dir);
+    git(["init", "--quiet"], dir, token);
+    git(["remote", "add", "origin", remote], dir, token);
+    git(["fetch", "--quiet", "--depth", "1", "origin", baseSha], dir, token);
+    git(["fetch", "--quiet", "--depth", "1", "origin", `pull/${pullNumber}/head`], dir, token);
+    git(["checkout", "--quiet", "--detach", headSha], dir, token);
+    return {
+      dir,
+      async cleanup() {
+        await fs.rm(parent, { recursive: true, force: true });
+      },
+    };
+  } catch (error) {
+    await fs.rm(parent, { recursive: true, force: true });
+    throw error;
+  }
+}

package/src/github-app/handler.js

@@ -0,0 +1,170 @@
+import { compareArchitecture, renderArchitectureComment, upsertArchitectureComment } from "../delivery/architecture-comment.js";
+import { assertGitHubRepo } from "../utils/github-repo.js";
+import { sanitizeSecrets } from "../utils/secrets.js";
+import { createGitHubRequest, fetchInstallationToken } from "./auth.js";
+import { checkoutPullRequest } from "./checkout.js";
+
+const CHECK_NAME = "RepoLens";
+const ANALYZE_ACTIONS = new Set(["opened", "synchronize", "reopened", "ready_for_review"]);
+const SUMMARY_LIMIT = 65000;
+
+export function checkRunBody(headSha, summary, conclusion = "success") {
+  const text = String(summary || "RepoLens completed with no summary.").slice(0, SUMMARY_LIMIT);
+  return {
+    name: CHECK_NAME,
+    head_sha: headSha,
+    status: "completed",
+    conclusion,
+    output: {
+      title: conclusion === "success" ? "Architecture diff" : "Architecture diff failed",
+      summary: text,
+    },
+  };
+}
+
+async function defaultAnalyze(dir, base, head) {
+  const report = await compareArchitecture(dir, base, head);
+  return { summary: renderArchitectureComment(report), report };
+}
+
+function installationIdOf(payload) {
+  const id = payload?.installation?.id;
+  return id == null ? "" : String(id);
+}
+
+/**
+ * Handle one verified GitHub App webhook.
+ *
+ * installation and installation_repositories are acknowledged.
+ * pull_request opened / synchronize / reopened / ready_for_review runs the
+ * existing architecture diff, then posts a Check Run and the sticky comment.
+ *
+ * Inject `prepareRepo`, `analyze`, `request`, or `getInstallationToken` in tests.
+ * Returns `{ status, body }`.
+ */
+export async function handleGitHubAppEvent({
+  eventName,
+  payload,
+  appId,
+  privateKey,
+  prepareRepo = checkoutPullRequest,
+  analyze = defaultAnalyze,
+  request,
+  getInstallationToken = fetchInstallationToken,
+  fetchImpl,
+  now,
+} = {}) {
+  if (!eventName) {
+    return { status: 400, body: { ok: false, error: "Missing X-GitHub-Event" } };
+  }
+  if (eventName === "ping") {
+    return { status: 200, body: { ok: true, handled: "ping" } };
+  }
+  if (eventName === "installation" || eventName === "installation_repositories") {
+    return {
+      status: 200,
+      body: {
+        ok: true,
+        handled: eventName,
+        action: payload?.action || "",
+        installationId: installationIdOf(payload),
+      },
+    };
+  }
+  if (eventName !== "pull_request") {
+    return { status: 200, body: { ok: true, ignored: eventName } };
+  }
+
+  const action = payload?.action || "";
+  if (!ANALYZE_ACTIONS.has(action)) {
+    return { status: 200, body: { ok: true, ignored: "pull_request", action } };
+  }
+
+  const pull = payload?.pull_request;
+  const repository = payload?.repository?.full_name;
+  const installationId = installationIdOf(payload);
+  const baseSha = pull?.base?.sha;
+  const headSha = pull?.head?.sha;
+  const pullNumber = pull?.number;
+  if (!pull || !repository || !installationId || !baseSha || !headSha || pullNumber == null) {
+    return { status: 422, body: { ok: false, error: "Pull request payload is missing repository, installation, or commits" } };
+  }
+
+  let owner;
+  let repo;
+  try {
+    assertGitHubRepo(repository);
+    [owner, repo] = repository.split("/");
+  } catch (error) {
+    return { status: 422, body: { ok: false, error: error.message } };
+  }
+
+  let call = request;
+  let token = "";
+  if (!call) {
+    try {
+      token = await getInstallationToken({
+        appId,
+        privateKey,
+        installationId,
+        fetchImpl,
+        now,
+      });
+      call = createGitHubRequest(token, fetchImpl);
+    } catch (error) {
+      return { status: 502, body: { ok: false, error: sanitizeSecrets(error.message || String(error)) } };
+    }
+  }
+
+  let workspace;
+  try {
+    workspace = await prepareRepo({
+      token,
+      owner,
+      repo,
+      pullNumber,
+      baseSha,
+      headSha,
+    });
+    const analyzed = await analyze(workspace.dir, baseSha, headSha);
+    const summary = analyzed?.summary || "";
+    const check = await call(
+      "POST",
+      `/repos/${owner}/${repo}/check-runs`,
+      checkRunBody(headSha, summary, "success"),
+    );
+    const comment = await upsertArchitectureComment({
+      owner,
+      repo,
+      issueNumber: pullNumber,
+      body: summary,
+      request: call,
+    });
+    return {
+      status: 200,
+      body: {
+        ok: true,
+        handled: "pull_request",
+        action,
+        checkRunId: check?.id ?? null,
+        comment: comment?.action || null,
+      },
+    };
+  } catch (error) {
+    const message = sanitizeSecrets(error.message || String(error));
+    try {
+      await call(
+        "POST",
+        `/repos/${owner}/${repo}/check-runs`,
+        checkRunBody(headSha, message, "failure"),
+      );
+    } catch {
+      // The failed check is best-effort. The caller still sees the error.
+    }
+    return { status: 500, body: { ok: false, error: message } };
+  } finally {
+    if (workspace?.cleanup) {
+      await workspace.cleanup();
+    }
+  }
+}

package/src/github-app/manifest.js

@@ -0,0 +1,36 @@
+/**
+ * GitHub App manifest. Minimal permissions for architecture check runs
+ * and the existing pull request comment. `metadata: read` is required by
+ * GitHub on every app.
+ *
+ * `hook_attributes.url` is a placeholder. Replace it with the public URL of
+ * `repolens app` before registering. This repository does not register the app.
+ */
+export const GITHUB_APP_WEBHOOK_PATH = "/api/github/webhooks";
+
+export const GITHUB_APP_MANIFEST = {
+  name: "RepoLens",
+  description: "Posts an architecture diff as a check run and one sticky pull request comment.",
+  url: "https://github.com/CHAPIBUNNY/repolens",
+  hook_attributes: {
+    url: `https://example.com${GITHUB_APP_WEBHOOK_PATH}`,
+    active: true,
+  },
+  redirect_url: "https://github.com/CHAPIBUNNY/repolens",
+  public: false,
+  default_permissions: {
+    checks: "write",
+    pull_requests: "write",
+    contents: "read",
+    metadata: "read",
+  },
+  default_events: [
+    "installation",
+    "installation_repositories",
+    "pull_request",
+  ],
+};
+
+export function manifestDocument() {
+  return JSON.stringify(GITHUB_APP_MANIFEST, null, 2);
+}

package/src/github-app/run.js

@@ -0,0 +1,67 @@
+import { manifestDocument } from "./manifest.js";
+import { readAppPrivateKey } from "./auth.js";
+import { createGitHubAppServer, listenGitHubApp } from "./server.js";
+import { GITHUB_APP_WEBHOOK_PATH } from "./manifest.js";
+
+function positiveInteger(value, fallback) {
+  if (value == null || value === "") return fallback;
+  if (!/^[0-9]+$/.test(String(value))) return null;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 0 || parsed > 65535) return null;
+  return parsed;
+}
+
+/**
+ * `repolens app` self-hosts the webhook.
+ * `--manifest` prints the manifest JSON and does not need credentials.
+ * Returns a process exit code. The server process stays up on success.
+ */
+export async function runGitHubApp({
+  manifest = false,
+  port,
+  host,
+  webhookPath,
+  env = process.env,
+  stdout = console.log,
+  stderr = console.error,
+} = {}) {
+  if (manifest) {
+    stdout(`${manifestDocument()}\n`);
+    return 0;
+  }
+
+  const appId = env.REPOLENS_APP_ID || "";
+  const webhookSecret = env.REPOLENS_WEBHOOK_SECRET || "";
+  let privateKey = "";
+  try {
+    privateKey = readAppPrivateKey(env);
+  } catch (error) {
+    stderr(`Could not read REPOLENS_APP_PRIVATE_KEY_PATH: ${error.message}`);
+    return 2;
+  }
+  if (!appId || !webhookSecret || !privateKey) {
+    stderr("repolens app needs REPOLENS_APP_ID, REPOLENS_WEBHOOK_SECRET, and REPOLENS_APP_PRIVATE_KEY or REPOLENS_APP_PRIVATE_KEY_PATH.");
+    stderr("Print the manifest with: repolens app --manifest");
+    return 2;
+  }
+
+  const chosenPort = positiveInteger(port ?? env.REPOLENS_APP_PORT, 8787);
+  if (chosenPort == null) {
+    stderr("--port must be an integer from 0 to 65535");
+    return 2;
+  }
+  const chosenHost = host || env.REPOLENS_APP_HOST || "127.0.0.1";
+  const chosenPath = webhookPath || env.REPOLENS_APP_WEBHOOK_PATH || GITHUB_APP_WEBHOOK_PATH;
+
+  const server = createGitHubAppServer({
+    webhookSecret,
+    webhookPath: chosenPath,
+    appId,
+    privateKey,
+  });
+  const bound = await listenGitHubApp(server, { port: chosenPort, host: chosenHost });
+  stderr(`RepoLens GitHub App listening on http://${chosenHost}:${bound}${chosenPath}`);
+  stderr("GitHub must reach that URL over HTTPS. The process stays running until you stop it.");
+  await new Promise(() => {});
+  return 0;
+}

package/src/github-app/server.js

@@ -0,0 +1,120 @@
+import http from "node:http";
+import { GITHUB_APP_WEBHOOK_PATH } from "./manifest.js";
+import { verifyHubSignature256 } from "./signature.js";
+import { handleGitHubAppEvent } from "./handler.js";
+
+const MAX_BODY_BYTES = 2_000_000;
+
+function sendJson(res, status, body) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "Content-Type": "application/json; charset=utf-8",
+    "Content-Length": Buffer.byteLength(payload),
+  });
+  res.end(payload);
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        reject(Object.assign(new Error("Payload too large"), { status: 413 }));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+    req.on("error", reject);
+  });
+}
+
+/**
+ * HTTP server for the GitHub App webhook.
+ *
+ * GitHub gives a webhook about 10 seconds. Analysis can take longer, so the
+ * default response is 202 and the check run is posted afterwards. Tests pass
+ * `inline: true` and wait for the handler before the response is sent.
+ */
+export function createGitHubAppServer(options) {
+  const webhookPath = options.webhookPath || GITHUB_APP_WEBHOOK_PATH;
+  const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url || "/", "http://127.0.0.1");
+    if (req.method === "GET" && (url.pathname === "/health" || url.pathname === "/")) {
+      sendJson(res, 200, { ok: true, service: "repolens-github-app" });
+      return;
+    }
+    if (req.method !== "POST" || url.pathname !== webhookPath) {
+      sendJson(res, 404, { ok: false, error: "Not found" });
+      return;
+    }
+
+    let raw;
+    try {
+      raw = await readBody(req);
+    } catch (error) {
+      sendJson(res, error.status || 400, { ok: false, error: error.message || "Could not read the body" });
+      return;
+    }
+
+    if (!verifyHubSignature256(raw, req.headers["x-hub-signature-256"], options.webhookSecret)) {
+      sendJson(res, 401, { ok: false, error: "Invalid signature" });
+      return;
+    }
+
+    let payload;
+    try {
+      payload = JSON.parse(raw.toString("utf8") || "null");
+    } catch {
+      sendJson(res, 400, { ok: false, error: "Invalid JSON" });
+      return;
+    }
+
+    const eventName = req.headers["x-github-event"];
+    const run = () => handleGitHubAppEvent({
+      eventName: typeof eventName === "string" ? eventName : "",
+      payload,
+      appId: options.appId,
+      privateKey: options.privateKey,
+      prepareRepo: options.prepareRepo,
+      analyze: options.analyze,
+      request: options.request,
+      getInstallationToken: options.getInstallationToken,
+      fetchImpl: options.fetchImpl,
+    });
+
+    if (options.inline) {
+      try {
+        const result = await run();
+        sendJson(res, result.status, result.body);
+      } catch (error) {
+        sendJson(res, 500, { ok: false, error: error.message || "Webhook failed" });
+      }
+      return;
+    }
+
+    sendJson(res, 202, { ok: true, accepted: true });
+    run().then((result) => {
+      if (result?.body?.ok === false) {
+        console.error(`RepoLens GitHub App: ${result.body.error || "event failed"}`);
+      }
+    }).catch((error) => {
+      console.error(`RepoLens GitHub App: ${error.message || error}`);
+    });
+  });
+  return server;
+}
+
+export function listenGitHubApp(server, { port, host }) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, host, () => {
+      server.removeListener("error", reject);
+      const address = server.address();
+      resolve(typeof address === "object" && address ? address.port : port);
+    });
+  });
+}

package/src/github-app/signature.js

@@ -0,0 +1,22 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+/**
+ * Verify a GitHub `X-Hub-Signature-256` header against the raw request body.
+ * The comparison is constant-time when the header has the expected length.
+ */
+export function verifyHubSignature256(rawBody, signatureHeader, secret) {
+  if (!secret || typeof secret !== "string") return false;
+  if (typeof signatureHeader !== "string" || !signatureHeader.startsWith("sha256=")) return false;
+  const body = Buffer.isBuffer(rawBody) ? rawBody : Buffer.from(String(rawBody));
+  const digest = createHmac("sha256", secret).update(body).digest("hex");
+  const expected = Buffer.from(`sha256=${digest}`, "utf8");
+  const actual = Buffer.from(signatureHeader, "utf8");
+  if (actual.length !== expected.length) return false;
+  return timingSafeEqual(actual, expected);
+}
+
+export function signHubBody(rawBody, secret) {
+  const body = Buffer.isBuffer(rawBody) ? rawBody : Buffer.from(String(rawBody));
+  const digest = createHmac("sha256", secret).update(body).digest("hex");
+  return `sha256=${digest}`;
+}

package/src/help.js

@@ -8,6 +8,7 @@ const EXIT_CODES = `Exit codes:
      badge scored 0 source files,
      comment is missing a base or head ref,
      publish --strict is missing publisher credentials,
+     app is missing its id, webhook secret, or private key,
      or feedback has no terminal`;
 
 const COMMAND_HELP = {
@@ -283,6 +284,42 @@ ${EXIT_CODES}
 Examples:
   repolens comment --base origin/main --head HEAD
 `,
+
+  app: `
+RepoLens app — self-host the GitHub App webhook
+
+Usage:
+  repolens app [--port <n>] [--host <address>] [--webhook-path <path>]
+  repolens app --manifest
+
+Options:
+  --port <n>            Listen port (default 8787, or REPOLENS_APP_PORT)
+  --host <address>      Listen address (default 127.0.0.1, or REPOLENS_APP_HOST)
+  --webhook-path <path> Path GitHub posts to (default /api/github/webhooks)
+  --manifest            Print the GitHub App manifest JSON and exit
+  --help, -h            Show this help
+
+Verifies X-Hub-Signature-256, acknowledges installation events, and on
+pull_request opened, synchronize, reopened, and ready_for_review runs the
+architecture diff. It posts a Check Run named RepoLens and updates the
+sticky pull request comment. The check is informational: a completed diff
+is success, and a failed analysis is a failed check.
+
+\`--manifest\` needs no credentials. Running the server needs
+REPOLENS_APP_ID, REPOLENS_WEBHOOK_SECRET, and either
+REPOLENS_APP_PRIVATE_KEY or REPOLENS_APP_PRIVATE_KEY_PATH.
+Replace hook_attributes.url in the manifest before you register the app.
+This command does not register an app on GitHub.
+
+GitHub allows about 10 seconds for the HTTP response. The server answers
+202 and posts the check after the analysis finishes.
+
+${EXIT_CODES}
+
+Examples:
+  repolens app --manifest
+  repolens app --port 8787
+`,
 };
 
 const GLOBAL_HELP = `
@@ -306,6 +343,7 @@ Commands:
   mcp         Start the stdio MCP server (also available as repolens-mcp)
   badge       Print a shields.io code-health badge (JSON, SVG, or markdown)
   comment     Print or post an architecture diff for a pull request
+  app         Self-host the GitHub App webhook (check run and PR comment)
   version     Print the current RepoLens version
   help        Show this help message
 
@@ -320,6 +358,10 @@ Options:
   --label <text>    badge: shields.io label (default: code health)
   --base <ref>      comment: base commit or ref
   --head <ref>      comment: head commit or ref
+  --port <n>        app: listen port (default 8787)
+  --host <address>  app: listen address (default 127.0.0.1)
+  --webhook-path    app: webhook path (default /api/github/webhooks)
+  --manifest        app: print the GitHub App manifest JSON and exit
   --quick           Scaffold without the wizard (also --non-interactive).
                     Markdown only; globs follow the detected language.
   --strict          publish: exit 2 when publisher credentials are missing
@@ -356,6 +398,8 @@ Examples:
   repolens badge
   repolens badge --format markdown --url https://example.github.io/repo/repolens-badge.json
   repolens comment --base origin/main --head HEAD
+  repolens app --manifest
+  repolens app --port 8787
   repolens --version
 `;