replen 0.4.1 → 1.0.1

package/README.md

@@ -1,54 +1,76 @@
 # replen
 
-**Smarter AI Development workflows.** One-command setup for [replen](https://replen.dev) - the AI that asks *"can we do this better?"* on your codebase. Calm cadence: 1-3 actionable matches a month, not a daily feed.
+**Make your AI coding tools aware of the wider OSS ecosystem.** One command, no API keys.
 
 ```bash
 npx replen
 ```
 
-While your AI coding tool waits for prompts, replen reads your code against the ecosystem and surfaces drop-in libraries, ideas to port, and patterns to learn from. A proactive layer for your AI coding workflow.
+Claude Code, Codex, Cursor already know your code. Replen tells them what else is out there — drop-in libraries, ideas worth porting, dead deps to swap. The match decision happens *inside your AI tool's session* on your subscription tokens. Your code stays on your laptop. Replen never sees it.
 
-The single command above:
-1. Opens your browser to sign in / sign up at `app.replen.dev`
+## What `npx replen` does
+
+In 60 seconds, the one-liner:
+
+1. Opens your browser to sign in (Google or GitHub via Firebase)
 2. Captures the auth back into the terminal (browser-callback flow, like `gh auth login`)
-3. Wires the [@replen/mcp](https://www.npmjs.com/package/@replen/mcp) server into your Claude Code / Codex config
+3. Scans your local repos under `~/github/`, `~/code/`, `~/projects/` for git repos
+4. Auto-extracts tags from each (`package.json` deps, `pyproject.toml`, etc.)
+5. Registers them with Replen as your projects (no GitHub PAT needed)
+6. Wires the [@replen/mcp](https://www.npmjs.com/package/@replen/mcp) server into your Claude Code / Codex config
+7. Installs the `/replen-match` skill into `~/.claude/skills/`
+8. Injects a small "Replen integration" section into each project's `CLAUDE.md` + `AGENTS.md`
+
+**What you do not provide:**
+- ❌ OpenAI / Anthropic API key — your AI tool's subscription handles all reasoning
+- ❌ GitHub PAT — optional, only if you want server-side handoff PRs later
+- ❌ Per-project setup — auto-discovered from your local filesystem
 
-Same flow that `claude` itself uses for auth.
+Open Claude Code (or Codex) in any of your tracked repos and start working normally. When Replen has matches, your AI tool mentions them after answering your first message. Silent on quiet days.
 
 ## Subcommands
 
 ```bash
-npx replen              # sign in + setup
-npx replen status       # show current config
-npx replen mcp setup    # re-wire MCP using saved auth
-npx replen logout       # forget saved auth (token stays valid; rotate on /settings to revoke)
+npx replen                 # sign in + setup (the one-liner above)
+npx replen status          # show current config
+npx replen sync-projects   # re-scan local repos for new GitHub remotes;
+                           #   run after cloning a new repo
+npx replen inject [-y]     # re-inject the "Replen integration" section
+                           #   into every CLAUDE.md + AGENTS.md
+npx replen mcp setup       # re-wire MCP using saved auth
+npx replen logout          # forget saved auth (rotate on /settings to revoke)
 ```
 
 ## Plain-shell usage (no Claude Code / Codex needed)
 
 ```bash
-npx replen run                  # trigger a pipeline run
-npx replen progress             # tail the run live; exits when done
-npx replen check-new            # one-shot: any new actionable matches since
-                                # you last engaged? (also runs automatically
-                                # at every Claude Code session start)
+npx replen check-new            # one-shot: any new matches since you last
+                                # engaged? (used by the SessionStart hook)
 npx replen feed                 # show recent matches (default 2 days)
 npx replen watch                # keep a terminal open — rings the bell when
                                 # a new match lands. Default poll 5min.
 npx replen search <query>       # full-text search past matches
 npx replen starred              # starred matches + handoff PR status
 npx replen handoff <matchId>    # open the handoff PR for a starred match
+npx replen run                  # trigger a fresh pipeline run (hosted-tier only)
+npx replen progress             # tail the run live; exits when done
 ```
 
-`watch` is the calm-utility companion: leave it running in a `tmux` pane and forget about it. The first poll establishes a baseline; existing matches don't ring.
+Every data command accepts `--json` for scripting.
 
-`check-new` is wired into Claude Code automatically by `npx replen` setup — it installs a SessionStart hook that runs `npx replen check-new --hook` whenever you open Claude Code. The hook is silent unless there's something new since you last engaged (across dashboard, email, or a prior session); when there is, the new matches show up in the agent's opening context without you having to ask. Calm-cadence by design.
+## How matches surface in Claude Code / Codex
 
-Every data command accepts `--json` for scripting.
+Three layers, defence-in-depth — at least one will fire:
+
+1. **SessionStart hook** runs `npx replen check-new --hook` at the start of every Claude Code session. If there's anything new, the JSON output appears in the agent's opening context.
+2. **MCP tool** `replen_check_new` is exposed to the agent at all times. The instructions in `CLAUDE.md` tell it to call this tool early in each session.
+3. **CLAUDE.md / AGENTS.md instruction** (idempotent, marker-versioned) is injected into every tracked repo on setup. This is the most reliable layer — survives Claude Code version churn.
+
+Calm-cadence by design: most days are silent. 1-3 actionable matches a month per project.
 
 ## Self-host
 
-Pointing at your own replen instance:
+Pointing at your own Replen instance:
 
 ```bash
 REPLEN_BASE=https://replen.mydomain.dev npx replen
@@ -64,7 +86,7 @@ REPLEN_BASE=https://replen.mydomain.dev npx replen
 6. CLI validates state, saves the token to `~/.replen/config.json` (mode 0600)
 7. CLI continues and writes the MCP config into `~/.claude.json`
 
-The token never transits anything other than your browser ↔ localhost ↔ disk. The replen backend only sees it on subsequent MCP / API requests.
+The token never transits anything other than your browser ↔ localhost ↔ disk. The Replen backend only sees it on subsequent MCP / API requests.
 
 ## Revoke
 

package/dist/commands.js

@@ -254,6 +254,31 @@ export async function runCheckNew(argv) {
             // correct response (calm-cadence principle).
             const scope = r.scopedTo ? ` for ${r.scopedTo}` : "";
             console.log(`No new actionable matches${scope} since you last engaged.`);
+            return;
+        }
+        // Hook mode + hasNew=false: fall back to inventory state. check-new
+        // is cursor-based and goes silent the moment ANY prior call (including
+        // our own validation probes or a previous session) bumped the cursor
+        // past existing matches. That's right behaviour for "did anything
+        // change?", wrong for "should I tell the agent there's a queue worth
+        // surfacing?" — the user might never have seen these candidates.
+        //
+        // Resolve the cwd's GitHub remote, query the inventory scoped to it,
+        // and print a one-line status if anything's there. Output goes
+        // verbatim into the agent's opening context via Claude Code's
+        // SessionStart-hook stdout injection.
+        const cwdRepo = await detectCwdRepo();
+        if (!cwdRepo)
+            return; // not in a git repo, or no GitHub remote — silent
+        try {
+            const inv = await fetchInventoryStatus(cfg, cwdRepo);
+            if (inv && inv.count > 0) {
+                const top = inv.topRepo ? ` Top: ${inv.topRepo}${inv.topSimilarity ? ` (~${inv.topSimilarity}% match)` : ""}.` : "";
+                console.log(`Replen has ${inv.count} candidate${inv.count === 1 ? "" : "s"} queued for ${cwdRepo}.${top} Run /replen-match for full triage.`);
+            }
+        }
+        catch {
+            // Inventory query failed — silent, never disrupt a session.
         }
         return;
     }
@@ -408,3 +433,61 @@ function handleApiError(e) {
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
+// Resolve the cwd's git origin remote into a GitHub owner/name, if the
+// remote is a GitHub URL (HTTPS, standard SSH, or a multi-account SSH
+// alias like github-personal). Returns null if not in a git repo or the
+// remote isn't GitHub. Used by the SessionStart hook to scope inventory
+// queries to the project the user just opened Claude Code in.
+async function detectCwdRepo() {
+    try {
+        const { execSync } = await import("node:child_process");
+        const url = execSync("git remote get-url origin", {
+            stdio: ["ignore", "pipe", "ignore"],
+            encoding: "utf8",
+            timeout: 1500,
+        }).trim();
+        const m = url.match(/(?:github\.com|github-[a-z0-9_-]+)[:/]([^/]+)\/([^/?#]+?)(?:\.git)?$/i);
+        if (!m)
+            return null;
+        return `${m[1]}/${m[2]}`;
+    }
+    catch {
+        return null;
+    }
+}
+async function fetchInventoryStatus(cfg, repo) {
+    // Hook mode is on the session-open critical path; cap latency hard.
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 3000);
+    try {
+        const url = new URL(cfg.base + "/api/inventory/today");
+        url.searchParams.set("repo", repo);
+        url.searchParams.set("limit", "5");
+        url.searchParams.set("days", "14");
+        const res = await fetch(url, {
+            headers: { "x-digest-token": cfg.token, accept: "application/json" },
+            signal: ctrl.signal,
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        const cands = data.candidates ?? [];
+        if (cands.length === 0)
+            return null;
+        const top = cands[0];
+        // Pull the cosine % out of whyShortlisted if present
+        // (format: "...; semantic similarity: 58%").
+        const simMatch = top.whyShortlisted?.match(/semantic similarity:\s*(\d+)%/);
+        return {
+            count: cands.length,
+            topRepo: top.repo ?? null,
+            topSimilarity: simMatch ? Number(simMatch[1]) : null,
+        };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/discover-projects.js

@@ -0,0 +1,391 @@
+// Local-filesystem project discovery for day-1 onboarding.
+//
+// Recursively walks a list of root dirs (provided by discover-roots.ts),
+// finds every git repo, and for each one extracts:
+//   - The repo's `owner/name` from `git remote get-url origin`
+//   - A slug derived from the GITHUB repo name (so a local folder named
+//     "drone" whose remote is acme/aegis registers with slug "aegis",
+//     matching what shows on GitHub). Falls back to dirname for repos
+//     without a GitHub remote.
+//   - A name (from package.json's `name` field if present, else slug)
+//   - Auto-suggested tags from the project's manifests
+//   - The primary language (best-effort, from manifest type)
+//
+// Output is shaped for POST /api/projects/bulk on the server. No
+// network or LLM calls — pure local filesystem.
+//
+// Why local-FS instead of asking GitHub via PAT: the whole pitch is
+// "no API keys to share with us." Auto-detect via GitHub API requires
+// a PAT; auto-detect via local git remotes requires nothing the user
+// doesn't already have. PAT becomes optional, only needed if/when the
+// user wants server-side handoff PRs.
+import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
+import { execSync } from "node:child_process";
+import { join, basename } from "node:path";
+// Hard maximum directory depth to walk from each root. depth=0 is the
+// root itself, depth=1 its immediate children, etc. 4 covers the
+// "workspace dir with sibling repos" pattern (e.g. ~/projects/drone/
+// containing ~/projects/drone/flight-controller/.git, where the
+// flight-controller dir is at depth 2 from ~/projects).
+const MAX_DEPTH = 4;
+// Directory names to skip outright during the walk. Mix of: build
+// artifacts that pollute repo-counting, package caches that can be
+// huge, and macOS / Linux home subdirs that never contain user code.
+const EXCLUDE_NAMES = new Set([
+    "node_modules",
+    ".next",
+    "dist",
+    "build",
+    "target",
+    "vendor",
+    ".cache",
+    ".npm",
+    ".yarn",
+    ".pnpm-store",
+    ".turbo",
+    ".terraform",
+    ".venv",
+    "venv",
+    "__pycache__",
+    // macOS system / media dirs
+    "Library",
+    "Applications",
+    "System",
+    "Pictures",
+    "Movies",
+    "Music",
+    "Downloads",
+    "Public",
+    "Desktop",
+    // Linux equivalents
+    ".local",
+    ".config",
+    "snap",
+]);
+// Manifest-derived tag mappings. Each pattern matches a dep name (or
+// a substring) and yields one or more tags. Ordered by specificity:
+// more-specific patterns first so e.g. "next" doesn't accidentally
+// tag a "next-auth-only" project as "next.js".
+const DEP_TO_TAGS = [
+    // Frontend frameworks (Node)
+    { match: /^next$/, tags: ["next.js"] },
+    { match: /^react$/, tags: ["react"] },
+    { match: /^vue$/, tags: ["vue"] },
+    { match: /^svelte$/, tags: ["svelte"] },
+    { match: /^solid-js$/, tags: ["solid"] },
+    { match: /^astro$/, tags: ["astro"] },
+    { match: /^remix-run\//, tags: ["remix"] },
+    // Backend / runtime
+    { match: /^express$/, tags: ["express"] },
+    { match: /^fastify$/, tags: ["fastify"] },
+    { match: /^hono$/, tags: ["hono"] },
+    { match: /^nestjs\//, tags: ["nestjs"] },
+    // Database / ORM
+    { match: /^prisma$/, tags: ["prisma"] },
+    { match: /^@prisma\/client$/, tags: ["prisma"] },
+    { match: /^drizzle-orm/, tags: ["drizzle"] },
+    { match: /^kysely$/, tags: ["kysely"] },
+    { match: /^typeorm$/, tags: ["typeorm"] },
+    { match: /^mongoose$/, tags: ["mongoose"] },
+    { match: /postgres|pg$/, tags: ["postgres"] },
+    { match: /^mysql/, tags: ["mysql"] },
+    { match: /^redis|^ioredis$/, tags: ["redis"] },
+    // Queue / async
+    { match: /^bullmq$/, tags: ["bullmq", "queue"] },
+    { match: /^bee-queue$/, tags: ["bee-queue", "queue"] },
+    { match: /^node-cron$/, tags: ["cron"] },
+    // LLM / AI
+    { match: /^openai$/, tags: ["openai"] },
+    { match: /^@anthropic-ai\//, tags: ["anthropic"] },
+    { match: /^langchain/, tags: ["langchain"] },
+    // Auth
+    { match: /^next-auth$/, tags: ["next-auth"] },
+    { match: /^@auth\//, tags: ["next-auth"] },
+    { match: /firebase/, tags: ["firebase"] },
+    // Cloud / hosting
+    { match: /^@aws-sdk\//, tags: ["aws"] },
+    { match: /^@vercel\//, tags: ["vercel"] },
+    { match: /^@cloudflare\//, tags: ["cloudflare"] },
+    // Web3
+    { match: /^viem$/, tags: ["viem", "web3"] },
+    { match: /^ethers$/, tags: ["ethers", "web3"] },
+    { match: /^wagmi$/, tags: ["wagmi", "web3"] },
+    { match: /^@matterlabs\//, tags: ["zksync"] },
+    // Image / media
+    { match: /^sharp$/, tags: ["images"] },
+    { match: /^@napi-rs\/canvas$/, tags: ["canvas", "images"] },
+    { match: /ffmpeg/, tags: ["ffmpeg"] },
+    // Python (matches go through the same loop on requirements.txt)
+    { match: /^torch$/, tags: ["pytorch"] },
+    { match: /^tensorflow$/, tags: ["tensorflow"] },
+    { match: /^fastapi$/, tags: ["fastapi"] },
+    { match: /^flask$/, tags: ["flask"] },
+    { match: /^django$/, tags: ["django"] },
+    { match: /^segmentation-models-pytorch$/, tags: ["pytorch", "segmentation"] },
+    { match: /^albumentations$/, tags: ["augmentation"] },
+    { match: /^scikit-learn$/, tags: ["ml"] },
+];
+/**
+ * Walk the given roots recursively (depth-capped, excluded dirs skipped)
+ * and return every git repo found, partitioned by whether it has a
+ * GitHub origin remote. Repos without a GitHub remote are counted but
+ * not registered — they're surfaced to the user as transparency rather
+ * than silently dropped.
+ *
+ * Deduplicates by absolute `localPath` (so overlapping roots like
+ * `~/projects` and `~/projects/drone` don't double-register the inner
+ * repos) and by `githubFullName` (so cloning the same repo to two
+ * paths doesn't create two project rows).
+ *
+ * Slug = the local directory basename (normalised). When two repos in
+ * the discovery result would share a slug (e.g. `flight-controller`
+ * under both `~/projects/drone/` and `~/work/sandbox/`), the second+
+ * gets `-<owner>` appended to disambiguate. Keeps slugs short for the
+ * common case while preventing server-side `uniq_profile_user_slug`
+ * collisions.
+ *
+ * Identity is `githubFullName` on the server side; slug is just the
+ * URL-safe display label. So a local `~/projects/drone/` whose remote
+ * is `acme/aegis` keeps slug `drone` (matching how you think of it
+ * locally) while still registering correctly against `acme/aegis` on
+ * the dashboard.
+ */
+export function discoverProjects(roots) {
+    const seenPaths = new Set();
+    const seenGithub = new Set();
+    const projects = [];
+    let nonGithubSkipped = 0;
+    const scannedRoots = Array.from(new Set(roots.filter(existsAndIsDir)));
+    for (const root of scannedRoots) {
+        for (const repoPath of walkForGitRepos(root, 0)) {
+            if (seenPaths.has(repoPath))
+                continue;
+            seenPaths.add(repoPath);
+            const githubFullName = readGitRemote(repoPath);
+            const dirName = basename(repoPath);
+            if (!githubFullName) {
+                nonGithubSkipped++;
+                continue;
+            }
+            if (seenGithub.has(githubFullName))
+                continue;
+            seenGithub.add(githubFullName);
+            const { name, tags, primaryLanguage } = extractMetadata(repoPath, dirName);
+            projects.push({
+                localPath: repoPath,
+                slug: normaliseSlug(dirName),
+                name,
+                githubFullName,
+                tags,
+                primaryLanguage,
+            });
+        }
+    }
+    // In-discovery slug disambiguation. Same-name dirs under different
+    // parents (e.g. `~/projects/drone/flight-controller` +
+    // `~/work/flight-controller`) would otherwise collide on the server's
+    // `uniq_profile_user_slug` index. Suffix the second+ occurrence with
+    // the GitHub owner so it remains unique per user.
+    disambiguateSlugs(projects);
+    return { projects, nonGithubSkipped, scannedRoots };
+}
+function disambiguateSlugs(projects) {
+    const counts = new Map();
+    for (const p of projects)
+        counts.set(p.slug, (counts.get(p.slug) ?? 0) + 1);
+    const used = new Set();
+    for (const p of projects) {
+        if ((counts.get(p.slug) ?? 0) <= 1 && !used.has(p.slug)) {
+            used.add(p.slug);
+            continue;
+        }
+        const owner = (p.githubFullName ?? "").split("/")[0] ?? "";
+        let candidate = normaliseSlug(`${p.slug}-${owner}`);
+        let n = 2;
+        while (used.has(candidate)) {
+            candidate = normaliseSlug(`${p.slug}-${owner}-${n++}`);
+        }
+        p.slug = candidate;
+        used.add(candidate);
+    }
+}
+/**
+ * Generator: yields the absolute path of every git repo found under
+ * `dir`, up to `MAX_DEPTH`. Stops recursing into a directory once a
+ * `.git/` is found there (treats it as a repo boundary — submodules
+ * and nested-clone edge cases aren't worth complicating the walker).
+ */
+function* walkForGitRepos(dir, depth) {
+    if (depth > MAX_DEPTH)
+        return;
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    // Is this dir itself a repo? Yield + stop recursing.
+    if (entries.some((e) => e.name === ".git" && (e.isDirectory() || e.isSymbolicLink()))) {
+        yield dir;
+        return;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() && !entry.isSymbolicLink())
+            continue;
+        if (entry.name.startsWith("."))
+            continue;
+        if (EXCLUDE_NAMES.has(entry.name))
+            continue;
+        yield* walkForGitRepos(join(dir, entry.name), depth + 1);
+    }
+}
+function existsAndIsDir(p) {
+    try {
+        return statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function normaliseSlug(name) {
+    return name
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 80) || "project";
+}
+// Run `git remote get-url origin` in the repo. Returns owner/name on
+// success, null otherwise. Tolerates non-GitHub remotes (returns null
+// so the repo is skipped).
+function readGitRemote(repoPath) {
+    let url;
+    try {
+        url = execSync("git remote get-url origin", {
+            cwd: repoPath,
+            stdio: ["ignore", "pipe", "ignore"],
+            encoding: "utf8",
+            timeout: 3000,
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+    // Match three URL shapes that all resolve to GitHub:
+    //   1. HTTPS:                      https://github.com/owner/name[.git]
+    //   2. Standard SSH:               git@github.com:owner/name[.git]
+    //   3. SSH config alias for github: git@github-<alias>:owner/name[.git]
+    // Case (3) is a common multi-account-GitHub pattern (one ssh alias
+    // per identity, e.g. `github-personal`, `github-work`); the host
+    // portion is opaque to git, the ssh layer resolves it to github.com.
+    // Without this branch, those repos register as "non-GitHub" and get
+    // silently skipped — a confusing failure mode for users with that
+    // convention. Owner/name parsing is identical across all three shapes.
+    const m = url.match(/(?:github\.com|github-[a-z0-9_-]+)[:/]([^/]+)\/([^/?#]+?)(?:\.git)?$/i);
+    if (!m)
+        return null;
+    return `${m[1]}/${m[2]}`;
+}
+function extractMetadata(repoPath, fallbackName) {
+    const tags = new Set();
+    let name = fallbackName;
+    let primaryLanguage = null;
+    // Node: package.json
+    const pkgPath = join(repoPath, "package.json");
+    if (existsSync(pkgPath)) {
+        primaryLanguage = "TypeScript"; // updated below if no TS detected
+        try {
+            const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+            if (typeof pkg.name === "string" && pkg.name.length > 0)
+                name = pkg.name;
+            if (Array.isArray(pkg.keywords)) {
+                for (const k of pkg.keywords) {
+                    if (typeof k === "string" && k.length > 0 && k.length <= 40) {
+                        tags.add(k.toLowerCase());
+                    }
+                }
+            }
+            const deps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
+            // Detect TS vs JS from presence of typescript in deps.
+            if (deps["typescript"] !== undefined) {
+                tags.add("typescript");
+                primaryLanguage = "TypeScript";
+            }
+            else {
+                // Look for *.ts files at top level to decide TS vs JS.
+                try {
+                    const top = readdirSync(repoPath);
+                    if (top.some((f) => f.endsWith(".ts") || f.endsWith(".tsx"))) {
+                        tags.add("typescript");
+                        primaryLanguage = "TypeScript";
+                    }
+                    else {
+                        tags.add("javascript");
+                        primaryLanguage = "JavaScript";
+                    }
+                }
+                catch { /* ignore */ }
+            }
+            // Match deps against the tag mapping.
+            for (const depName of Object.keys(deps)) {
+                for (const { match, tags: ts } of DEP_TO_TAGS) {
+                    if (match.test(depName)) {
+                        for (const t of ts)
+                            tags.add(t);
+                    }
+                }
+            }
+        }
+        catch { /* malformed package.json — skip */ }
+    }
+    // Python: pyproject.toml / requirements.txt
+    const pyprojectPath = join(repoPath, "pyproject.toml");
+    const requirementsPath = join(repoPath, "requirements.txt");
+    if (existsSync(pyprojectPath) || existsSync(requirementsPath)) {
+        primaryLanguage = "Python";
+        tags.add("python");
+        const text = [pyprojectPath, requirementsPath]
+            .filter((p) => existsSync(p))
+            .map((p) => { try {
+            return readFileSync(p, "utf8");
+        }
+        catch {
+            return "";
+        } })
+            .join("\n");
+        // Pull dep names from "<name>>=<ver>" / "<name>==<ver>" / quoted strings.
+        const depMatches = text.matchAll(/^\s*["']?([a-zA-Z0-9][\w.-]*)["']?\s*[><=!~]/gm);
+        for (const dm of depMatches) {
+            const depName = dm[1].toLowerCase();
+            for (const { match, tags: ts } of DEP_TO_TAGS) {
+                if (match.test(depName)) {
+                    for (const t of ts)
+                        tags.add(t);
+                }
+            }
+        }
+    }
+    // Rust: Cargo.toml
+    if (existsSync(join(repoPath, "Cargo.toml"))) {
+        primaryLanguage = primaryLanguage ?? "Rust";
+        tags.add("rust");
+    }
+    // Go: go.mod
+    if (existsSync(join(repoPath, "go.mod"))) {
+        primaryLanguage = primaryLanguage ?? "Go";
+        tags.add("go");
+    }
+    // Solidity (web3 contracts under hardhat/foundry)
+    if (existsSync(join(repoPath, "hardhat.config.js")) ||
+        existsSync(join(repoPath, "hardhat.config.ts")) ||
+        existsSync(join(repoPath, "foundry.toml"))) {
+        tags.add("solidity");
+        tags.add("web3");
+    }
+    // Cap total tags so a kitchen-sink monorepo doesn't blow up the row.
+    return {
+        name,
+        tags: Array.from(tags).slice(0, 25),
+        primaryLanguage,
+    };
+}