replen 0.2.1 → 0.3.0

package/README.md

@@ -1,6 +1,6 @@
 # replen
 
-**Smart AI Development workflows.** One-command setup for [replen](https://replen.dev) - the AI that asks *"can we do this better?"* on your codebase, every morning.
+**Smarter AI Development workflows.** One-command setup for [replen](https://replen.dev) - the AI that asks *"can we do this better?"* on your codebase. Calm cadence: 1-3 actionable matches a month, not a daily feed.
 
 ```bash
 npx replen
@@ -24,6 +24,23 @@ npx replen mcp setup    # re-wire MCP using saved auth
 npx replen logout       # forget saved auth (token stays valid; rotate on /settings to revoke)
 ```
 
+## Plain-shell usage (no Claude Code / Codex needed)
+
+```bash
+npx replen run                  # trigger a pipeline run
+npx replen progress             # tail the run live; exits when done
+npx replen feed                 # show recent matches (default 2 days)
+npx replen watch                # keep a terminal open — rings the bell when
+                                # a new match lands. Default poll 5min.
+npx replen search <query>       # full-text search past matches
+npx replen starred              # starred matches + handoff PR status
+npx replen handoff <matchId>    # open the handoff PR for a starred match
+```
+
+`watch` is the calm-utility companion: leave it running in a `tmux` pane and forget about it. The first poll establishes a baseline; existing matches don't ring. Pair with `--no-bell` for a silent log feed, or `--json` to pipe into anything.
+
+Every data command accepts `--json` for scripting.
+
 ## Self-host
 
 Pointing at your own replen instance:

package/dist/commands.js

@@ -169,6 +169,67 @@ export async function runStarred(argv) {
         handleApiError(e);
     }
 }
+// Watch for new matches in the background. Polls /api/mcp/today, diffs against
+// the matchIds seen on the previous poll, prints anything new, and rings the
+// terminal bell (\x07). First poll establishes a baseline — existing matches
+// don't ring. Default interval 5 minutes (the pipeline runs daily by default,
+// so polling tighter is pure overhead).
+export async function runWatch(argv) {
+    const cfg = await loadConfigOrExit();
+    const json = hasFlag(argv, "--json");
+    const noBell = hasFlag(argv, "--no-bell");
+    const intervalSec = Math.max(30, Number(getFlag(argv, "--interval") ?? 300));
+    const days = Number(getFlag(argv, "--days") ?? 2);
+    const project = getFlag(argv, "--project");
+    const relevance = getFlag(argv, "--relevance") ?? "high,medium";
+    const seen = new Set();
+    let firstPass = true;
+    if (!json) {
+        const target = project ? ` · project=${project}` : "";
+        console.log(`Watching for new ${relevance} matches${target} · poll every ${intervalSec}s · Ctrl-C to stop.`);
+    }
+    while (true) {
+        let r;
+        try {
+            r = await apiGet(cfg, "/api/mcp/today", {
+                days,
+                relevance,
+                project,
+            });
+        }
+        catch (e) {
+            // Don't kill the watcher on a transient network blip — just log + retry.
+            console.error(`✗ ${e.message ?? String(e)} (retrying in ${intervalSec}s)`);
+            await sleep(intervalSec * 1000);
+            continue;
+        }
+        const fresh = [];
+        for (const m of r.matches) {
+            if (!seen.has(m.matchId)) {
+                if (!firstPass)
+                    fresh.push(m);
+                seen.add(m.matchId);
+            }
+        }
+        if (json) {
+            // Emit one JSON line per poll, regardless of new/no-new — easy to pipe.
+            console.log(JSON.stringify({ ts: new Date().toISOString(), new: fresh.length, matches: fresh }));
+        }
+        else if (fresh.length > 0) {
+            const stamp = new Date().toISOString().slice(11, 19);
+            console.log(`\n[${stamp}] ${fresh.length} new:`);
+            for (const m of fresh)
+                renderMatchLine(m);
+            if (!noBell)
+                process.stdout.write("\x07");
+        }
+        else if (firstPass) {
+            console.log(`Baseline: ${seen.size} match(es) already in feed; will alert on anything new.`);
+        }
+        firstPass = false;
+        await sleep(intervalSec * 1000);
+    }
+}
 // Open a handoff PR for a starred match in the matched project's own repo.
 export async function runHandoff(argv) {
     const cfg = await loadConfigOrExit();

package/dist/index.js

@@ -3,8 +3,8 @@ import { runInit } from "./init.js";
 import { setupMcp } from "./mcp-setup.js";
 import { readConfig, configPath } from "./config.js";
 import { runProjectInit } from "./project-init.js";
-import { runFeed, runHandoff, runProgress, runRun, runSearch, runStarred } from "./commands.js";
-const HELP = `replen: Smart AI Development workflows
+import { runFeed, runHandoff, runProgress, runRun, runSearch, runStarred, runWatch } from "./commands.js";
+const HELP = `replen: Smarter AI Development workflows
 
 Usage:
   npx replen                 Sign up / sign in + wire MCP into Claude Code
@@ -21,6 +21,12 @@ Use replen from a plain shell (no Claude Code / Codex needed):
   npx replen feed [--days N]           Today's matches (default 2 days)
                   [--project SLUG]     Limit to one project
                   [--relevance high,medium]
+  npx replen watch                     Long-running poll: rings the terminal bell
+                  [--interval SEC]     when a new match lands (default 300s).
+                  [--days N]           First poll establishes baseline; existing
+                  [--project SLUG]     matches don't ring. Ctrl-C to stop.
+                  [--relevance high,medium]
+                  [--no-bell]
   npx replen search <query>            Full-text search across past matches
   npx replen starred                   Starred matches + handoff PR status
   npx replen handoff <matchId>         Open the handoff PR for a starred match
@@ -88,6 +94,8 @@ async function main() {
         return runProgress(argv);
     if (cmd === "feed")
         return runFeed(argv);
+    if (cmd === "watch")
+        return runWatch(argv);
     if (cmd === "search")
         return runSearch(argv);
     if (cmd === "starred")

package/dist/init.js

@@ -55,7 +55,15 @@ function waitForCallback(port, expectedState) {
                 res.end("state mismatch");
                 return;
             }
-            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            // Referrer-Policy: no-referrer means anything rendered in SUCCESS_HTML
+            // (even if a future maintainer adds an external <img>, <link>, or fetch)
+            // cannot leak the callback URL — which carries the exchange code in
+            // its query string — via an outbound Referer header.
+            res.writeHead(200, {
+                "content-type": "text/html; charset=utf-8",
+                "referrer-policy": "no-referrer",
+                "cache-control": "no-store",
+            });
             res.end(SUCCESS_HTML);
             // Give the response a tick to flush before we shut down the listener.
             setTimeout(() => server.close(), 100);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "replen",
-  "version": "0.2.1",
-  "description": "Smart AI Development workflows. The AI that asks 'can we do this better?' - replen reads your codebase against the live ecosystem every morning, surfaces drop-in libraries, ideas to port, and patterns to learn from. A proactive layer for your AI coding workflow. One-command setup: opens a browser to sign in, then wires the MCP server into Claude Code / Codex.",
+  "version": "0.3.0",
+  "description": "Smarter AI Development workflows. The AI that asks 'can we do this better?' - replen reads your codebase against the live ecosystem and surfaces drop-in libraries, ideas to port, and patterns to learn from. Calm cadence: 1-3 actionable matches a month. One-command setup: opens a browser to sign in, then wires the MCP server into Claude Code / Codex.",
   "type": "module",
   "bin": {
     "replen": "dist/index.js"