replen 1.0.2 → 1.0.4

package/README.md

@@ -1,12 +1,21 @@
 # replen
 
-**Make your AI coding tools aware of the wider OSS ecosystem.** One command, no API keys.
+**Make your AI coding tools aware of everything your code depends on, implements, and builds on.** One command, no API keys.
 
 ```bash
 npx replen
 ```
 
-Claude Code, Codex, Cursor already know your code. Replen tells them what else is out there — drop-in libraries, ideas worth porting, dead deps to swap. The match decision happens *inside your AI tool's session* on your subscription tokens. Your code stays on your laptop. Replen never sees it.
+Claude Code, Codex, Cursor already know your code. Replen tells them what's happening *outside* it. The match decision happens *inside your AI tool's session* on your subscription tokens. Your code stays on your laptop. Replen never sees it.
+
+Four lenses, all surfaced the same calm way — quietly, in your AI tool's next reply, only when there's something real:
+
+- **🔭 OSS repos** — a new library that replaces code you maintain, a pattern worth porting, a dead dep to swap.
+- **📦 Your stack** — a release in a dependency you actually use (`next`, `openai`, `prisma`, `viem`, … matched against your manifest).
+- **📜 Standards you implement** — EIP/ERC, TC39, and Chrome-deprecation changes matched to what your code touches.
+- **🩺 Upstream health** — a dep gone stale/archived, a hot bug others hit in your deps, or an incident on a service you use.
+
+One discipline throughout: **silence beats a weak match** — if nothing clears the bar, Replen says nothing.
 
 ## What `npx replen` does
 

package/dist/commands.js

@@ -1,6 +1,7 @@
 // Plain-shell subcommands. Each one mirrors an MCP tool but renders for the
 // terminal rather than returning JSON to an agent. `--json` flag on every
 // command dumps raw JSON for piping/scripting.
+import { readdirSync, existsSync } from "node:fs";
 import { apiGet, apiPost, loadConfigOrExit } from "./api.js";
 import { configPath } from "./config.js";
 function hasFlag(argv, flag) {
@@ -196,6 +197,33 @@ export async function runCheckNew(argv) {
         console.error("Not signed in. Run `npx replen` first.");
         process.exit(1);
     }
+    // Hook mode surfaces the repo-scoped SKILL inventory directly — the good data
+    // (semantic + dependency / spec / health matches, with the relevance floor +
+    // cool-off applied server-side), using the server's pre-formatted footnote.
+    // It deliberately skips the legacy hosted `check-new` below, which returns
+    // generic, un-scoped, high-star matches that aren't useful to skill-tier
+    // users. Output is injected into the agent's opening context by Claude Code's
+    // SessionStart-hook stdout injection; the framing nudges the agent to relay
+    // it verbatim (final surfacing is still the model's call).
+    if (hookMode && !json) {
+        const cwdRepo = await detectCwdRepo();
+        if (!cwdRepo) {
+            // No git remote → Replen can't scope this project. If the cwd looks like
+            // a real project (has source / a manifest), nudge the user to set it up;
+            // otherwise stay silent (don't nag in /tmp or a random dir). Surfacing is
+            // the model's call, but the explicit framing maximises it.
+            if (looksLikeProject()) {
+                console.log("[Replen] This project has no git remote, so Replen can't scope or match against it. Mention to the user, briefly, as a footnote: 'By the way — this project isn't set up with Replen yet (no git remote), so I can't surface matches for it. Want me to scope it — init git, create the repo, write the docs, and add tags?'");
+            }
+            return;
+        }
+        const inv = await fetchInventoryStatus(cfg, cwdRepo);
+        if (inv?.displayText) {
+            console.log("[Replen] Relay the following line to the user, verbatim, as a footnote at the very end of your first reply:");
+            console.log(inv.displayText);
+        }
+        return;
+    }
     const query = {};
     if (repo !== undefined)
         query.repo = repo;
@@ -455,6 +483,31 @@ async function detectCwdRepo() {
         return null;
     }
 }
+// Cheap heuristic: does the cwd look like a real project worth nudging the user
+// to scope with Replen? True when there's a recognised manifest, a src/lib/app
+// dir, or a couple of source files. Keeps the "no git — want to scope?" prompt
+// from firing in /tmp, $HOME, or an empty directory.
+function looksLikeProject() {
+    try {
+        const manifests = ["package.json", "pyproject.toml", "requirements.txt", "Cargo.toml", "go.mod", "pom.xml", "build.gradle", "Gemfile", "composer.json", "pubspec.yaml"];
+        if (manifests.some((m) => existsSync(m)))
+            return true;
+        if (["src", "lib", "app", "cmd", "pkg"].some((d) => existsSync(d)))
+            return true;
+        const codeExt = /\.(ts|tsx|js|jsx|py|rs|go|java|rb|php|c|cc|cpp|h|hpp|swift|kt|scala|sol|ex|clj)$/i;
+        let codeFiles = 0;
+        for (const e of readdirSync(".", { withFileTypes: true })) {
+            if (e.isFile() && codeExt.test(e.name))
+                codeFiles++;
+            if (codeFiles >= 2)
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
 async function fetchInventoryStatus(cfg, repo) {
     // Hook mode is on the session-open critical path; cap latency hard.
     const ctrl = new AbortController();
@@ -482,6 +535,9 @@ async function fetchInventoryStatus(cfg, repo) {
             count: cands.length,
             topRepo: top.repo ?? null,
             topSimilarity: simMatch ? Number(simMatch[1]) : null,
+            // The server's pre-formatted, pattern-aware footnote ("By the way — a
+            // dependency you use just shipped: …" / "… N candidates queued …").
+            displayText: (typeof data.displayText === "string" && data.displayText) ? data.displayText : null,
         };
     }
     catch {

package/dist/mcp-setup.js

@@ -22,6 +22,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, chmodSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { installSkills } from "./skill-install.js";
 const SERVER_NAME = "replen";
@@ -239,8 +240,27 @@ function backupIfExists(path) {
 // their current docs). Both rely on the AGENTS.md / GEMINI.md project-
 // context file being read at session start, which our inject step
 // covers.
-const HOOK_COMMAND = "npx --quiet replen check-new --hook";
-const HOOK_MARKER = "replen check-new --hook";
+// Version-PIN the hook command. A bare `npx replen` resolves a LOCAL package
+// named "replen" when one exists in cwd (e.g. the replen repo itself, whose
+// server package is also "replen" and has no bin) → "could not determine
+// executable to run", and the hook silently dies every session there. Pinning
+// to the published version forces npx to the registry (collision-proof) and,
+// because the exact version is cached, avoids the per-session `@latest`
+// registry round-trip. Re-running setup refreshes the pin.
+const HOOK_COMMAND = `npx --quiet replen@${cliVersion()} check-new --hook`;
+// Match on the stable substring so we find/replace our hook regardless of the
+// pinned version in any previously-written command.
+const HOOK_MARKER = "check-new --hook";
+function cliVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url)); // cli/dist
+        const pkg = JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8"));
+        return typeof pkg.version === "string" && pkg.version ? pkg.version : "latest";
+    }
+    catch {
+        return "latest";
+    }
+}
 function installSessionStartHook(existing) {
     const sessionStart = (existing.SessionStart ?? []).slice();
     const ours = {

package/extras/skills/replen-match/SKILL.md

@@ -181,11 +181,40 @@ fresh candidate shows up at session start via the hook).
 **Inventory call returns 401.** User's token expired or got rotated.
 Tell them to run `npx replen` to re-auth.
 
-**Inventory returns `scopedTo: null` with a `note` about "repo not in
-your project list"**. The cwd isn't a known project. Ask the user:
-"This repo isn't in your Replen projects yet. Add it via /projects?"
-Then either stop or re-run with `?repo=` (empty) to see the global
-firehose.
+**The project isn't scoped — `scopedTo: null`, a `note` about "repo not in
+your project list", OR the cwd has no git remote.** Replen can only match
+against a repo it has registered, and it scopes by the git remote. When it's
+unscoped you'll get the global trending firehose — which is noise for this
+codebase. **Do NOT triage the firehose** (manufacturing reasons to care about
+random trending repos is exactly what this skill must not do).
+
+Instead, **offer to onboard the project.** Lead with ONE line, not the whole
+checklist: *"This project isn't set up with Replen yet, so I can only see the
+global firehose (not matches for your code). Want me to scope it — init git,
+create the repo, write the docs, and add tags? Then Replen can surface things
+that actually fit."* If the user agrees, run this checklist:
+
+1. **Git + GitHub.** If there's no git repo, `git init`. Create the GitHub
+   repo using the user's existing `gh` auth — ask for owner/name or suggest a
+   sensible default from the folder name, and confirm public vs private:
+   `gh repo create <owner>/<name> --private --source=. --remote=origin --push`.
+   If a repo exists locally but has no remote, just add + push the remote.
+2. **Docs Replen can read.** Replen's scorer reads your `README.md` +
+   `CLAUDE.md` to understand the project — that's the difference between
+   useful matches and noise. Write a concrete `README.md` (what it is, stack,
+   domain) if missing, and a `CLAUDE.md` optimised for Replen (run the
+   `/replen-project-init` protocol, or draft the seven sections directly:
+   what it is · stack · niche/domain · active areas · constraints/non-goals ·
+   anti-patterns · integration preferences). Use the project's real domain
+   vocabulary, not abstractions.
+3. **Register + tag.** Add the repo to Replen at **app.replen.dev/projects**
+   (toggle it watched), or it auto-registers on the next
+   `npx replen sync-projects`. Set **tags** that narrow the firehose to the
+   project's domain — derive them from the code (e.g. for a Python CCXT
+   trading engine: `crypto, trading, ccxt, python, quant, backtesting`) — at
+   /projects.
+4. **Re-run.** Once it has a remote + docs + tags, call `replen_match` again —
+   now it scopes to the project and matches against the real code.
 
 **Candidate's README is unreachable (WebFetch 404)**. Note it in the
 writeup (`Caveats: README unreachable; verdict based on description

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Make your AI coding tools smarter. One command, no API keys. Replen scouts the OSS firehose against your projects and surfaces drop-in libraries, ideas to port, and dead deps to swap — the match decision happens inside your AI tool's session on your subscription tokens. 1-3 actionable matches a month, by design.",
   "type": "module",
   "bin": {