replen 1.0.27 → 1.0.28

package/extras/skills/replen/SKILL.md

@@ -67,6 +67,28 @@ Parse the JSON response. Note:
   the verdict isn't just "X is risky" but "X is risky; Y is the maintained
   replacement, N similar projects adopted it".
 
+### Step 2a — JIT grounding: profile this repo if onboarding hasn't yet
+
+A large-portfolio `/replen-onboard` grounds the most-active repos fully and
+gives the long tail a cheap version-only pass — so a registered repo can have
+versions but **no capability profile yet**. Triaging it would fall back to
+coarse tag matching (you'll see `filterMode: "tags"` and few/no facet-led
+candidates). When that happens, ground it inline FIRST — it's just-in-time
+onboarding, and it's why the user opening this repo is the right moment:
+
+1. Confirm the gap: call `replen_onboard_state` and find this repo — if
+   `hasCapabilities` is false, it needs grounding.
+2. Run the grounding contract (same as `/replen-onboard` step 2a–2e, condensed):
+   read the code, derive 8–15 grounded `{tag, descriptor, modality, paths}`
+   capabilities + a technical report, and push via `replen_set_capabilities`
+   (+ `replen_set_tags`, + `replen_set_versions` if not already reported).
+   Respect the cover — describe the tech, never de-sanitize the application.
+3. Re-pull the inventory (Step 2) — now it returns real facet-led matches.
+
+Skip this when `hasCapabilities` is already true (the common case). One quiet
+line to the user is enough: *"This repo wasn't fully profiled yet — grounding
+it now so the matches actually fit."*
+
 ### Step 2b — Keep the version picture fresh (cheap, do it)
 
 If `git status` shows the lockfile changed since you last reported, or you

package/extras/skills/replen-onboard/SKILL.md

@@ -93,12 +93,18 @@ must not block on a 3-hour read. Tier the work so value lands fast:
    are what the user is actively working on and will see footnotes for soonest.
 2. **Cap concurrency** to what the host sustains (Claude Code parallel subagents
    are capped automatically; don't try to launch 200 at once — launch in waves).
-3. **Version-first option for the long tail** — for repos beyond the active set,
-   a version-only backfill (cheap, no code read) still turns on EOL/security/
-   dependency-exclusion awareness. Full capability grounding can follow lazily
-   (next /replen-onboard, or on first /replen in that repo). Tell the user:
-   "Grounding your N most-active repos now; the rest get version-aware coverage
-   immediately and full profiles as you work in them." Don't silently drop the tail.
+3. **Version-first is the DEFAULT for the long tail** (not a fallback). Pick a
+   full-ground budget N (the most-recently-committed repos — say the active ~20–
+   30, or what the user confirms). Everything BEYOND N gets a version-only
+   backfill: cheap, no code read, and it turns on EOL/security/dependency-
+   exclusion awareness immediately. Full capability grounding for the tail then
+   happens **just-in-time on first `/replen` in that repo** — the `/replen`
+   skill grounds a `hasVersions && !hasCapabilities` repo inline before triaging
+   (its Step 2a). This is the key to a hundreds-of-repos cold start staying
+   minutes, not hours: you never speculatively read 170 repos the user may never
+   open. Tell the user: "Grounding your N most-active repos now; the rest get
+   version-aware coverage immediately and a full profile the first time you open
+   them." Don't silently drop the tail — it's covered, just lazily.
 
 **"Done" includes a version report** — covered by the VERSION-ONLY bucket above.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.27",
+  "version": "1.0.28",
   "description": "Make your AI coding tools smarter. One command, no API keys, free. Replen watches what your projects actually do and surfaces a few things worth bringing in each month. Use one as is, port a piece of another, cherry pick an idea, or build it clean room. The match happens inside your AI tool's session. A few actionable matches a month, by design.",
   "type": "module",
   "bin": {