replen 1.0.2 → 1.0.3

package/README.md

@@ -1,12 +1,21 @@
 # replen
 
-**Make your AI coding tools aware of the wider OSS ecosystem.** One command, no API keys.
+**Make your AI coding tools aware of everything your code depends on, implements, and builds on.** One command, no API keys.
 
 ```bash
 npx replen
 ```
 
-Claude Code, Codex, Cursor already know your code. Replen tells them what else is out there — drop-in libraries, ideas worth porting, dead deps to swap. The match decision happens *inside your AI tool's session* on your subscription tokens. Your code stays on your laptop. Replen never sees it.
+Claude Code, Codex, Cursor already know your code. Replen tells them what's happening *outside* it. The match decision happens *inside your AI tool's session* on your subscription tokens. Your code stays on your laptop. Replen never sees it.
+
+Four lenses, all surfaced the same calm way — quietly, in your AI tool's next reply, only when there's something real:
+
+- **🔭 OSS repos** — a new library that replaces code you maintain, a pattern worth porting, a dead dep to swap.
+- **📦 Your stack** — a release in a dependency you actually use (`next`, `openai`, `prisma`, `viem`, … matched against your manifest).
+- **📜 Standards you implement** — EIP/ERC, TC39, and Chrome-deprecation changes matched to what your code touches.
+- **🩺 Upstream health** — a dep gone stale/archived, a hot bug others hit in your deps, or an incident on a service you use.
+
+One discipline throughout: **silence beats a weak match** — if nothing clears the bar, Replen says nothing.
 
 ## What `npx replen` does
 

package/dist/commands.js

@@ -196,6 +196,25 @@ export async function runCheckNew(argv) {
         console.error("Not signed in. Run `npx replen` first.");
         process.exit(1);
     }
+    // Hook mode surfaces the repo-scoped SKILL inventory directly — the good data
+    // (semantic + dependency / spec / health matches, with the relevance floor +
+    // cool-off applied server-side), using the server's pre-formatted footnote.
+    // It deliberately skips the legacy hosted `check-new` below, which returns
+    // generic, un-scoped, high-star matches that aren't useful to skill-tier
+    // users. Output is injected into the agent's opening context by Claude Code's
+    // SessionStart-hook stdout injection; the framing nudges the agent to relay
+    // it verbatim (final surfacing is still the model's call).
+    if (hookMode && !json) {
+        const cwdRepo = await detectCwdRepo();
+        if (!cwdRepo)
+            return; // not in a GitHub repo with a remote — silent
+        const inv = await fetchInventoryStatus(cfg, cwdRepo);
+        if (inv?.displayText) {
+            console.log("[Replen] Relay the following line to the user, verbatim, as a footnote at the very end of your first reply:");
+            console.log(inv.displayText);
+        }
+        return;
+    }
     const query = {};
     if (repo !== undefined)
         query.repo = repo;
@@ -482,6 +501,9 @@ async function fetchInventoryStatus(cfg, repo) {
             count: cands.length,
             topRepo: top.repo ?? null,
             topSimilarity: simMatch ? Number(simMatch[1]) : null,
+            // The server's pre-formatted, pattern-aware footnote ("By the way — a
+            // dependency you use just shipped: …" / "… N candidates queued …").
+            displayText: (typeof data.displayText === "string" && data.displayText) ? data.displayText : null,
         };
     }
     catch {

package/dist/mcp-setup.js

@@ -22,6 +22,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, chmodSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { installSkills } from "./skill-install.js";
 const SERVER_NAME = "replen";
@@ -239,8 +240,27 @@ function backupIfExists(path) {
 // their current docs). Both rely on the AGENTS.md / GEMINI.md project-
 // context file being read at session start, which our inject step
 // covers.
-const HOOK_COMMAND = "npx --quiet replen check-new --hook";
-const HOOK_MARKER = "replen check-new --hook";
+// Version-PIN the hook command. A bare `npx replen` resolves a LOCAL package
+// named "replen" when one exists in cwd (e.g. the replen repo itself, whose
+// server package is also "replen" and has no bin) → "could not determine
+// executable to run", and the hook silently dies every session there. Pinning
+// to the published version forces npx to the registry (collision-proof) and,
+// because the exact version is cached, avoids the per-session `@latest`
+// registry round-trip. Re-running setup refreshes the pin.
+const HOOK_COMMAND = `npx --quiet replen@${cliVersion()} check-new --hook`;
+// Match on the stable substring so we find/replace our hook regardless of the
+// pinned version in any previously-written command.
+const HOOK_MARKER = "check-new --hook";
+function cliVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url)); // cli/dist
+        const pkg = JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8"));
+        return typeof pkg.version === "string" && pkg.version ? pkg.version : "latest";
+    }
+    catch {
+        return "latest";
+    }
+}
 function installSessionStartHook(existing) {
     const sessionStart = (existing.SessionStart ?? []).slice();
     const ours = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Make your AI coding tools smarter. One command, no API keys. Replen scouts the OSS firehose against your projects and surfaces drop-in libraries, ideas to port, and dead deps to swap — the match decision happens inside your AI tool's session on your subscription tokens. 1-3 actionable matches a month, by design.",
   "type": "module",
   "bin": {