replen 1.0.1 → 1.0.3

package/README.md

@@ -1,12 +1,21 @@
 # replen
 
-**Make your AI coding tools aware of the wider OSS ecosystem.** One command, no API keys.
+**Make your AI coding tools aware of everything your code depends on, implements, and builds on.** One command, no API keys.
 
 ```bash
 npx replen
 ```
 
-Claude Code, Codex, Cursor already know your code. Replen tells them what else is out there — drop-in libraries, ideas worth porting, dead deps to swap. The match decision happens *inside your AI tool's session* on your subscription tokens. Your code stays on your laptop. Replen never sees it.
+Claude Code, Codex, Cursor already know your code. Replen tells them what's happening *outside* it. The match decision happens *inside your AI tool's session* on your subscription tokens. Your code stays on your laptop. Replen never sees it.
+
+Four lenses, all surfaced the same calm way — quietly, in your AI tool's next reply, only when there's something real:
+
+- **🔭 OSS repos** — a new library that replaces code you maintain, a pattern worth porting, a dead dep to swap.
+- **📦 Your stack** — a release in a dependency you actually use (`next`, `openai`, `prisma`, `viem`, … matched against your manifest).
+- **📜 Standards you implement** — EIP/ERC, TC39, and Chrome-deprecation changes matched to what your code touches.
+- **🩺 Upstream health** — a dep gone stale/archived, a hot bug others hit in your deps, or an incident on a service you use.
+
+One discipline throughout: **silence beats a weak match** — if nothing clears the bar, Replen says nothing.
 
 ## What `npx replen` does
 

package/dist/commands.js

@@ -196,6 +196,25 @@ export async function runCheckNew(argv) {
         console.error("Not signed in. Run `npx replen` first.");
         process.exit(1);
     }
+    // Hook mode surfaces the repo-scoped SKILL inventory directly — the good data
+    // (semantic + dependency / spec / health matches, with the relevance floor +
+    // cool-off applied server-side), using the server's pre-formatted footnote.
+    // It deliberately skips the legacy hosted `check-new` below, which returns
+    // generic, un-scoped, high-star matches that aren't useful to skill-tier
+    // users. Output is injected into the agent's opening context by Claude Code's
+    // SessionStart-hook stdout injection; the framing nudges the agent to relay
+    // it verbatim (final surfacing is still the model's call).
+    if (hookMode && !json) {
+        const cwdRepo = await detectCwdRepo();
+        if (!cwdRepo)
+            return; // not in a GitHub repo with a remote — silent
+        const inv = await fetchInventoryStatus(cfg, cwdRepo);
+        if (inv?.displayText) {
+            console.log("[Replen] Relay the following line to the user, verbatim, as a footnote at the very end of your first reply:");
+            console.log(inv.displayText);
+        }
+        return;
+    }
     const query = {};
     if (repo !== undefined)
         query.repo = repo;
@@ -482,6 +501,9 @@ async function fetchInventoryStatus(cfg, repo) {
             count: cands.length,
             topRepo: top.repo ?? null,
             topSimilarity: simMatch ? Number(simMatch[1]) : null,
+            // The server's pre-formatted, pattern-aware footnote ("By the way — a
+            // dependency you use just shipped: …" / "… N candidates queued …").
+            displayText: (typeof data.displayText === "string" && data.displayText) ? data.displayText : null,
         };
     }
     catch {

package/dist/mcp-setup.js

@@ -22,12 +22,31 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, chmodSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { installSkills } from "./skill-install.js";
 const SERVER_NAME = "replen";
 const CLAUDE_CONFIG = join(homedir(), ".claude.json");
+const CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
 const CODEX_CONFIG = join(homedir(), ".codex", "config.toml");
 const GEMINI_CONFIG = join(homedir(), ".gemini", "settings.json");
+// Read/triage replen MCP tools that are safe to auto-allow so the proactive
+// footnote (replen_match) and in-session triage don't trigger a permission
+// prompt every session. Deliberately EXCLUDES replen_run / replen_handoff /
+// replen_feedback — those trigger pipeline runs / open PRs and should keep
+// prompting for explicit consent.
+const REPLEN_AUTO_ALLOW = [
+    "mcp__replen__replen_match",
+    "mcp__replen__replen_check_new",
+    "mcp__replen__replen_analyze",
+    "mcp__replen__replen_state",
+    "mcp__replen__replen_record_triage",
+    "mcp__replen__replen_today",
+    "mcp__replen__replen_search",
+    "mcp__replen__replen_starred",
+    "mcp__replen__replen_status",
+    "mcp__replen__replen_help",
+];
 // ============================================================================
 // Public entry point
 // ============================================================================
@@ -76,12 +95,37 @@ function setupClaude(token, base) {
         };
         const hooks = installSessionStartHook(config.hooks ?? {});
         writeJsonAtomic(path, { ...config, mcpServers, hooks });
+        // Auto-allow the read/triage tools so the proactive footnote doesn't
+        // prompt every session. Best-effort: a failure here mustn't fail MCP setup.
+        try {
+            allowlistClaudeTools();
+        }
+        catch (e) {
+            console.warn(`  ⚠ Claude Code allowlist skipped — ${e.message}`);
+        }
         return { ok: true, label: "Claude Code", path, action: existed ? "updated" : "added" };
     }
     catch (e) {
         return { ok: false, label: "Claude Code", path, error: e.message };
     }
 }
+// Merge the replen read/triage tools into Claude Code's permission allowlist
+// (~/.claude/settings.json → permissions.allow) so the proactive footnote +
+// in-session triage run without a per-session permission prompt. Non-
+// destructive: preserves existing allow entries and every other setting.
+function allowlistClaudeTools() {
+    const path = CLAUDE_SETTINGS;
+    mkdirSync(dirname(path), { recursive: true });
+    const config = existsSync(path) ? readJson(path) : {};
+    const permissions = config.permissions ?? {};
+    const existingAllow = Array.isArray(permissions.allow) ? permissions.allow : [];
+    const allow = Array.from(new Set([...existingAllow, ...REPLEN_AUTO_ALLOW]));
+    if (allow.length === existingAllow.length)
+        return; // already fully allowlisted
+    backupIfExists(path);
+    writeJsonAtomic(path, { ...config, permissions: { ...permissions, allow } });
+    console.log(`  ✓ Claude Code: allowlisted replen read tools (no more per-session prompts)`);
+}
 function setupGemini(token, base) {
     const path = GEMINI_CONFIG;
     try {
@@ -196,8 +240,27 @@ function backupIfExists(path) {
 // their current docs). Both rely on the AGENTS.md / GEMINI.md project-
 // context file being read at session start, which our inject step
 // covers.
-const HOOK_COMMAND = "npx --quiet replen check-new --hook";
-const HOOK_MARKER = "replen check-new --hook";
+// Version-PIN the hook command. A bare `npx replen` resolves a LOCAL package
+// named "replen" when one exists in cwd (e.g. the replen repo itself, whose
+// server package is also "replen" and has no bin) → "could not determine
+// executable to run", and the hook silently dies every session there. Pinning
+// to the published version forces npx to the registry (collision-proof) and,
+// because the exact version is cached, avoids the per-session `@latest`
+// registry round-trip. Re-running setup refreshes the pin.
+const HOOK_COMMAND = `npx --quiet replen@${cliVersion()} check-new --hook`;
+// Match on the stable substring so we find/replace our hook regardless of the
+// pinned version in any previously-written command.
+const HOOK_MARKER = "check-new --hook";
+function cliVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url)); // cli/dist
+        const pkg = JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8"));
+        return typeof pkg.version === "string" && pkg.version ? pkg.version : "latest";
+    }
+    catch {
+        return "latest";
+    }
+}
 function installSessionStartHook(existing) {
     const sessionStart = (existing.SessionStart ?? []).slice();
     const ours = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Make your AI coding tools smarter. One command, no API keys. Replen scouts the OSS firehose against your projects and surfaces drop-in libraries, ideas to port, and dead deps to swap — the match decision happens inside your AI tool's session on your subscription tokens. 1-3 actionable matches a month, by design.",
   "type": "module",
   "bin": {