replen 1.0.3 → 1.0.5

package/dist/commands.js

@@ -1,6 +1,7 @@
 // Plain-shell subcommands. Each one mirrors an MCP tool but renders for the
 // terminal rather than returning JSON to an agent. `--json` flag on every
 // command dumps raw JSON for piping/scripting.
+import { readdirSync, existsSync } from "node:fs";
 import { apiGet, apiPost, loadConfigOrExit } from "./api.js";
 import { configPath } from "./config.js";
 function hasFlag(argv, flag) {
@@ -206,8 +207,16 @@ export async function runCheckNew(argv) {
     // it verbatim (final surfacing is still the model's call).
     if (hookMode && !json) {
         const cwdRepo = await detectCwdRepo();
-        if (!cwdRepo)
-            return; // not in a GitHub repo with a remote — silent
+        if (!cwdRepo) {
+            // No git remote → Replen can't scope this project. If the cwd looks like
+            // a real project (has source / a manifest), nudge the user to set it up;
+            // otherwise stay silent (don't nag in /tmp or a random dir). Surfacing is
+            // the model's call, but the explicit framing maximises it.
+            if (looksLikeProject()) {
+                console.log("[Replen] This project has no git remote, so Replen can't scope or match against it. Mention to the user, briefly, as a footnote: 'By the way — this project isn't set up with Replen yet (no git remote), so I can't surface matches for it. Want me to scope it — init git, create the repo, write the docs, and add tags?'");
+            }
+            return;
+        }
         const inv = await fetchInventoryStatus(cfg, cwdRepo);
         if (inv?.displayText) {
             console.log("[Replen] Relay the following line to the user, verbatim, as a footnote at the very end of your first reply:");
@@ -474,6 +483,31 @@ async function detectCwdRepo() {
         return null;
     }
 }
+// Cheap heuristic: does the cwd look like a real project worth nudging the user
+// to scope with Replen? True when there's a recognised manifest, a src/lib/app
+// dir, or a couple of source files. Keeps the "no git — want to scope?" prompt
+// from firing in /tmp, $HOME, or an empty directory.
+function looksLikeProject() {
+    try {
+        const manifests = ["package.json", "pyproject.toml", "requirements.txt", "Cargo.toml", "go.mod", "pom.xml", "build.gradle", "Gemfile", "composer.json", "pubspec.yaml"];
+        if (manifests.some((m) => existsSync(m)))
+            return true;
+        if (["src", "lib", "app", "cmd", "pkg"].some((d) => existsSync(d)))
+            return true;
+        const codeExt = /\.(ts|tsx|js|jsx|py|rs|go|java|rb|php|c|cc|cpp|h|hpp|swift|kt|scala|sol|ex|clj)$/i;
+        let codeFiles = 0;
+        for (const e of readdirSync(".", { withFileTypes: true })) {
+            if (e.isFile() && codeExt.test(e.name))
+                codeFiles++;
+            if (codeFiles >= 2)
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
 async function fetchInventoryStatus(cfg, repo) {
     // Hook mode is on the session-open critical path; cap latency hard.
     const ctrl = new AbortController();

package/extras/skills/replen-match/SKILL.md

@@ -181,11 +181,51 @@ fresh candidate shows up at session start via the hook).
 **Inventory call returns 401.** User's token expired or got rotated.
 Tell them to run `npx replen` to re-auth.
 
-**Inventory returns `scopedTo: null` with a `note` about "repo not in
-your project list"**. The cwd isn't a known project. Ask the user:
-"This repo isn't in your Replen projects yet. Add it via /projects?"
-Then either stop or re-run with `?repo=` (empty) to see the global
-firehose.
+**The project isn't scoped — `scopedTo: null`, a `note` about "repo not in
+your project list", OR the cwd has no git remote.** Replen can only match
+against a repo it has registered, and it scopes by the git remote. When it's
+unscoped you'll get the global trending firehose — which is noise for this
+codebase. **Do NOT triage the firehose** (manufacturing reasons to care about
+random trending repos is exactly what this skill must not do).
+
+Instead, **offer to onboard the project.** Lead with ONE line, not the whole
+checklist: *"This project isn't set up with Replen yet, so I can only see the
+global firehose (not matches for your code). Want me to scope it — init git,
+create the repo, write the docs, and add tags? Then Replen can surface things
+that actually fit."* If the user agrees, run this checklist:
+
+1. **Git + GitHub.** If there's no git repo, `git init`. Create the GitHub
+   repo using the user's existing `gh` auth — ask for owner/name or suggest a
+   sensible default from the folder name, and confirm public vs private:
+   `gh repo create <owner>/<name> --private --source=. --remote=origin --push`.
+   If a repo exists locally but has no remote, just add + push the remote.
+2. **Docs Replen can read.** Replen's scorer reads your `README.md` +
+   `CLAUDE.md` to understand the project — that's the difference between
+   useful matches and noise. Write a concrete `README.md` (what it is, stack,
+   domain) if missing, and a `CLAUDE.md` optimised for Replen (run the
+   `/replen-project-init` protocol, or draft the seven sections directly:
+   what it is · stack · niche/domain · active areas · constraints/non-goals ·
+   anti-patterns · integration preferences). Use the project's real domain
+   vocabulary, not abstractions.
+3. **Register + tag.** Register the repo: `npx replen sync-projects` (scans the
+   local repos and pushes them to Replen). Then **set the domain tags yourself
+   with the `replen_set_tags` tool** — derive them from the code you just read
+   (e.g. for a Python CCXT market-making engine:
+   `["crypto","trading","market-making","ccxt","quant","backtesting"]`).
+   **Do NOT tell the user to set tags on the web** — that's the sticky step this
+   replaces; set them with the tool. (They can still fine-tune later at
+   app.replen.dev/projects.) Tags matter most right after onboarding, before the
+   project has an embedding — without them a fresh project falls back to
+   language-only matching and surfaces noise.
+4. **Re-run.** Once it has a remote + docs + tags, call `replen_match` again —
+   now it scopes to the project and matches against the real code. (Its embedding
+   lands on the next pipeline run; until then, tags carry the relevance.)
+
+Note on recording actions: always use the MCP tools — `replen_state` (star /
+hide / handoff), `replen_record_triage` (your verdict), `replen_set_tags` — for
+any write back to Replen. Don't hand-roll `curl` to the API for these; the MCP
+path is the intended mechanism and avoids tripping host permission classifiers
+on the candidate repo name in a curl payload.
 
 **Candidate's README is unreachable (WebFetch 404)**. Note it in the
 writeup (`Caveats: README unreachable; verdict based on description

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Make your AI coding tools smarter. One command, no API keys. Replen scouts the OSS firehose against your projects and surfaces drop-in libraries, ideas to port, and dead deps to swap — the match decision happens inside your AI tool's session on your subscription tokens. 1-3 actionable matches a month, by design.",
   "type": "module",
   "bin": {