replen 1.0.12 → 1.0.14

package/dist/discover-projects.js

@@ -169,14 +169,15 @@ export function discoverProjects(roots) {
             if (seenGithub.has(githubFullName))
                 continue;
             seenGithub.add(githubFullName);
-            const { name, tags, primaryLanguage } = extractMetadata(repoPath, dirName);
-            // Slug from the GitHub repo NAME, not the local folder name. The repo
-            // name is the stable identity the server keys on; deriving the slug
-            // from the folder meant a folder rename (or an org rename like
-            // Covelent→nsokin) minted a fresh slug and the server inserted a
-            // duplicate row. `~/code/drone` with remote `nsokin/palisade-website`
-            // now registers as slug `palisade-website`, matching the dashboard.
+            // Slug + display name both anchor on the GitHub repo NAME, not the
+            // local folder name. Deriving from the folder meant a folder rename (or
+            // an org rename like Covelent→nsokin) minted a fresh slug and the server
+            // inserted a duplicate row. `~/code/drone` with remote
+            // `nsokin/palisade-website` now registers as slug `palisade-website`.
+            // The repo name is also the fallback display name, so a generic
+            // package.json name (the Next.js starter's "nextn", etc.) doesn't stick.
             const repoName = githubFullName.split("/").pop() || dirName;
+            const { name, tags, primaryLanguage } = extractMetadata(repoPath, repoName);
             projects.push({
                 localPath: repoPath,
                 slug: normaliseSlug(repoName),
@@ -292,6 +293,17 @@ function readGitRemote(repoPath) {
         return null;
     return `${m[1]}/${m[2]}`;
 }
+// Scaffold/template default package.json names that aren't real project
+// names — repos cloned from the same starter all share one (the Next.js
+// starter's "nextn"). Mirrors the server's GENERIC_NAMES guard.
+const GENERIC_PROJECT_NAMES = new Set([
+    "nextn", "next-app", "create-next-app", "nextjs", "next", "my-app", "myapp",
+    "my-project", "myproject", "app", "web", "webapp", "frontend", "backend",
+    "client", "server", "project", "vite-project", "vite-app", "react-app",
+    "turborepo", "my-turborepo", "monorepo", "example", "template", "starter",
+    "boilerplate", "hello-world", "test", "demo", "untitled",
+]);
+const isGenericProjectName = (n) => GENERIC_PROJECT_NAMES.has(n.trim().toLowerCase());
 function extractMetadata(repoPath, fallbackName) {
     const tags = new Set();
     let name = fallbackName;
@@ -302,7 +314,7 @@ function extractMetadata(repoPath, fallbackName) {
         primaryLanguage = "TypeScript"; // updated below if no TS detected
         try {
             const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-            if (typeof pkg.name === "string" && pkg.name.length > 0)
+            if (typeof pkg.name === "string" && pkg.name.length > 0 && !isGenericProjectName(pkg.name))
                 name = pkg.name;
             if (Array.isArray(pkg.keywords)) {
                 for (const k of pkg.keywords) {

package/extras/skills/replen/SKILL.md

@@ -41,6 +41,40 @@ Parse the JSON response. Note:
 - `filterMode` — `tags`, `zero-knowledge`, or `fingerprint`
 - `scopedTo` — confirms the project context the user has open
 - `candidates[]` — the actual list to triage
+- `candidates[].priorContext` — server-attached MEMORY: the user's earlier
+  verdicts on this repo, and whether the matched capability is already
+  covered by something they adopted/ported. Trust it — fold it into your
+  verdict instead of re-deriving history, and don't push a candidate whose
+  capability is covered unless it's materially better than the incumbent.
+- `candidates[].source === "re-checked"` — a repo the user DEFERRED months
+  ago that is still actively developed. Re-evaluate it against today's
+  state of the project; the original "not now" note is in `priorContext`.
+- `leap` — on quiet days the response may carry ONE portfolio connection
+  (a cross-project / adjacency / cross-user leap) instead of candidates.
+  `displayText` already words it; relay that and offer to explore it.
+- `queuedActions` — work the user queued from their weekly brief / alert
+  emails (or a past session). The footnote offers the oldest one; if the
+  user says yes, DO the work (bump the dep, handle the deprecation,
+  evaluate the repo), then call `replen_queue` with `action: "done"` and
+  the item's id. If they decline for good, `action: "dismiss"`. Never
+  leave a handled item queued — it will keep reminding.
+- `candidates[].alternatives` — on health/security stakes ("your upstream
+  is dying / has a CVE"), maintained catalogue libraries similar to the
+  flagged repo, with cross-user adoption counts. Use them in the writeup:
+  the verdict isn't just "X is risky" but "X is risky; Y is the maintained
+  replacement, N similar projects adopted it".
+
+### Step 2b — Keep the version picture fresh (cheap, do it)
+
+If `git status` shows the lockfile changed since you last reported, or you
+have never reported for this repo, call `replen_set_versions` with the
+resolved DIRECT dependency versions from the lockfile (package-lock.json /
+poetry.lock / uv.lock / Cargo.lock) plus runtimes under canonical keys
+(`node` from .nvmrc/engines/Dockerfile, `python` from .python-version /
+requires-python, `postgres`/`redis` when pinned in docker-compose). Names
+and versions ONLY — never code. This is what turns Replen's deadline and
+security lines from "worth checking your pins" into "affects `aegis`
+(3.10.12)" — and silences alarms for versions this repo verifiably isn't on.
 
 If `candidates.length === 0`, tell the user "No new candidates today for
 `<owner/name>`. Calm-cadence working as designed — 1-3 actionable
@@ -85,6 +119,10 @@ Verdicts:
   candidate's runtime is incompatible, or the candidate's not actively
   maintained. Honest skips are valuable signal; don't manufacture
   reasons to keep something.
+- **defer** — genuinely interesting but not NOW (too early / v0.x churn /
+  blocked on a milestone the project hasn't hit). Defer is a real promise,
+  not a soft skip: Replen automatically re-surfaces a deferred repo after
+  ~3 months if it's still actively developed (`source: "re-checked"`).
 
 **Watch for word-collisions** — the most common bad match. The candidate
 shares a *word* with the matched capability but its real domain diverges:
@@ -296,6 +334,21 @@ The user hasn't set up filter-mode B's tag list. Mention it once: "Heads
 up — you'd get sharper matches if you set project tags at /settings.
 Continuing with unfiltered for now."
 
+## The Atlas vault — local memory for any agent
+
+Replen keeps an agent-readable markdown vault at `~/.replen/atlas/` — the
+user's whole portfolio as linked notes: every project and what it does,
+every capability (with how it's known: `grounded`/`extracted`/`inferred`),
+every past decision with its reason code, plus themes and blind spots.
+The MCP server refreshes it in the background (at most twice a day);
+`replen atlas` forces a rewrite.
+
+Use it whenever you need CROSS-PROJECT context: "what else does this user
+build?", "have we solved X in another repo?", "what did we decide about
+Y last quarter?". Start at `MAP.md`, or call `replen_recall` for a direct
+query. Reading the vault beats re-deriving the portfolio from scratch —
+it's the memory layer, and it's already on disk.
+
 ## When NOT to run this skill
 
 - The user is mid-task and just wants help with the current thing. The

package/extras/skills/replen-onboard/SKILL.md

@@ -128,6 +128,14 @@ specific — `cloudflare bypass`/`proxy rotation`, not just `web scraping`.
    grounded `capabilities` array AND the `report` from 2c. The server builds the
    facet vectors immediately and stores the report as grounding for its own
    summarization. Use the MCP tools, not hand-rolled `curl`.
+4. **Report pinned versions** with `replen_set_versions` — the resolved DIRECT
+   dependency versions from the lockfile (package-lock.json / poetry.lock /
+   uv.lock / Cargo.lock), plus runtimes under canonical keys (`node` from
+   .nvmrc/engines/Dockerfile, `python` from .python-version/requires-python,
+   `postgres`/`redis` when pinned in docker-compose). Names + versions ONLY,
+   never code. This makes EOL/deprecation/security awareness name the affected
+   repos with certainty — and suppresses alarms for versions the repo
+   verifiably isn't on.
 
 ## Step 3 — Group multi-repo products
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "description": "Make your AI coding tools smarter. One command, no API keys, free. Replen watches what your projects actually do and surfaces a few things worth bringing in each month. Use one as is, port a piece of another, cherry pick an idea, or build it clean room. The match happens inside your AI tool's session. A few actionable matches a month, by design.",
   "type": "module",
   "bin": {