replen 0.4.0 → 0.4.1

package/dist/commands.js

@@ -173,11 +173,14 @@ export async function runStarred(argv) {
 // One-shot "is there anything new" check. Used in two modes:
 //   1. interactive (`replen check-new`): always prints — useful for ad-hoc
 //      "did anything land?" before opening Claude Code.
-//   2. hook (`replen check-new --hook`): SILENT when nothing's new. Tight
-//      timeout so a slow API can't stall every Claude Code session opening.
-//      Errors are swallowed and never fail the session. Output is shaped
-//      so Claude Code's SessionStart-hook stdout injection naturally
-//      surfaces the matches in the agent's opening context.
+//   2. hook (`replen check-new --hook`): SILENT when nothing's new. Bounded
+//      timeout (5s) so a slow API can't stall every Claude Code session
+//      opening. Uses AbortController to actually cancel the in-flight fetch
+//      on timeout — without that, an aborted hook would still let the server
+//      finish + bump the cursor, "consuming" the matches without ever
+//      surfacing them. Errors are swallowed and never fail the session.
+//      Output is shaped so Claude Code's SessionStart-hook stdout injection
+//      naturally surfaces the matches in the agent's opening context.
 export async function runCheckNew(argv) {
     const hookMode = hasFlag(argv, "--hook");
     const json = hasFlag(argv, "--json");
@@ -199,12 +202,27 @@ export async function runCheckNew(argv) {
     let r;
     try {
         if (hookMode) {
-            // Tight timeout so a slow API never blocks a session open. AbortSignal
-            // would be cleaner but apiGet doesn't surface it; race a manual timer.
-            r = await Promise.race([
-                apiGet(cfg, "/api/mcp/check-new", query),
-                new Promise((_, reject) => setTimeout(() => reject(new Error("hook-timeout")), 2000)),
-            ]);
+            // Direct fetch with AbortController so the timeout actually cancels
+            // the request (apiGet has no signal). Without this, a "timed out"
+            // hook would still let the server complete the call and bump the
+            // cursor, silently consuming the matches.
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), 5000);
+            try {
+                const url = new URL(cfg.base + "/api/mcp/check-new");
+                if (query.repo !== undefined)
+                    url.searchParams.set("repo", query.repo);
+                const res = await fetch(url, {
+                    headers: { "x-digest-token": cfg.token, accept: "application/json" },
+                    signal: ctrl.signal,
+                });
+                if (!res.ok)
+                    throw new Error(`HTTP ${res.status}`);
+                r = (await res.json());
+            }
+            finally {
+                clearTimeout(timer);
+            }
         }
         else {
             r = await apiGet(cfg, "/api/mcp/check-new", query);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Smarter AI Development workflows. The AI that asks 'can we do this better?' - replen reads your codebase against the live ecosystem and surfaces drop-in libraries, ideas to port, and patterns to learn from. Calm cadence: 1-3 actionable matches a month. One-command setup: opens a browser to sign in, then wires the MCP server into Claude Code / Codex.",
   "type": "module",
   "bin": {