replen 1.0.13 → 1.0.15

package/extras/skills/replen/SKILL.md

@@ -52,6 +52,29 @@ Parse the JSON response. Note:
 - `leap` — on quiet days the response may carry ONE portfolio connection
   (a cross-project / adjacency / cross-user leap) instead of candidates.
   `displayText` already words it; relay that and offer to explore it.
+- `queuedActions` — work the user queued from their weekly brief / alert
+  emails (or a past session). The footnote offers the oldest one; if the
+  user says yes, DO the work (bump the dep, handle the deprecation,
+  evaluate the repo), then call `replen_queue` with `action: "done"` and
+  the item's id. If they decline for good, `action: "dismiss"`. Never
+  leave a handled item queued — it will keep reminding.
+- `candidates[].alternatives` — on health/security stakes ("your upstream
+  is dying / has a CVE"), maintained catalogue libraries similar to the
+  flagged repo, with cross-user adoption counts. Use them in the writeup:
+  the verdict isn't just "X is risky" but "X is risky; Y is the maintained
+  replacement, N similar projects adopted it".
+
+### Step 2b — Keep the version picture fresh (cheap, do it)
+
+If `git status` shows the lockfile changed since you last reported, or you
+have never reported for this repo, call `replen_set_versions` with the
+resolved DIRECT dependency versions from the lockfile (package-lock.json /
+poetry.lock / uv.lock / Cargo.lock) plus runtimes under canonical keys
+(`node` from .nvmrc/engines/Dockerfile, `python` from .python-version /
+requires-python, `postgres`/`redis` when pinned in docker-compose). Names
+and versions ONLY — never code. This is what turns Replen's deadline and
+security lines from "worth checking your pins" into "affects `aegis`
+(3.10.12)" — and silences alarms for versions this repo verifiably isn't on.
 
 If `candidates.length === 0`, tell the user "No new candidates today for
 `<owner/name>`. Calm-cadence working as designed — 1-3 actionable

package/extras/skills/replen-onboard/SKILL.md

@@ -62,6 +62,13 @@ already onboarded (it already has capabilities/facets). Re-running is always
 safe — pushing again just overwrites — so an interrupted sweep resumes cleanly by
 re-running and skipping repos already done.
 
+**"Done" includes a version report.** A repo that has capabilities but has
+never reported versions is NOT done — give it the lightweight backfill pass:
+skip the doc work and re-profiling entirely, just read the lockfile + runtime
+pins and call `replen_set_versions` (Step 2e.4). This is how an existing
+portfolio gets version-aware deadlines/security awareness after upgrading
+Replen — a re-run backfills versions across every repo in minutes.
+
 For each in-scope repo, do this contract:
 
 ### 2a. Read the code (not just the README)
@@ -128,6 +135,14 @@ specific — `cloudflare bypass`/`proxy rotation`, not just `web scraping`.
    grounded `capabilities` array AND the `report` from 2c. The server builds the
    facet vectors immediately and stores the report as grounding for its own
    summarization. Use the MCP tools, not hand-rolled `curl`.
+4. **Report pinned versions** with `replen_set_versions` — the resolved DIRECT
+   dependency versions from the lockfile (package-lock.json / poetry.lock /
+   uv.lock / Cargo.lock), plus runtimes under canonical keys (`node` from
+   .nvmrc/engines/Dockerfile, `python` from .python-version/requires-python,
+   `postgres`/`redis` when pinned in docker-compose). Names + versions ONLY,
+   never code. This makes EOL/deprecation/security awareness name the affected
+   repos with certainty — and suppresses alarms for versions the repo
+   verifiably isn't on.
 
 ## Step 3 — Group multi-repo products
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "Make your AI coding tools smarter. One command, no API keys, free. Replen watches what your projects actually do and surfaces a few things worth bringing in each month. Use one as is, port a piece of another, cherry pick an idea, or build it clean room. The match happens inside your AI tool's session. A few actionable matches a month, by design.",
   "type": "module",
   "bin": {