replen 1.0.31 → 1.0.33

package/dist/mcp-setup.js

@@ -26,6 +26,14 @@ import { fileURLToPath } from "node:url";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { installSkills } from "./skill-install.js";
 const SERVER_NAME = "replen";
+// Launch the MCP via a SEMVER RANGE, not a tag-less spec. Bare `npx @replen/mcp`
+// resolves once and reuses the cached build forever, so users silently run stale
+// builds and miss new tools (the paths/mode regression came from exactly this).
+// `@^1` makes npx re-resolve the newest 1.x on every session spawn — auto-updates
+// minors/patches, never jumps a breaking major — so a fresh agent session = latest
+// features with no manual `@latest` step to remember. Each setup run REWRITES this
+// entry, so returning users are migrated off the old tag-less spec automatically.
+const MCP_PKG = "@replen/mcp@^1";
 const CLAUDE_CONFIG = join(homedir(), ".claude.json");
 const CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
 const CODEX_CONFIG = join(homedir(), ".codex", "config.toml");
@@ -99,7 +107,7 @@ function setupClaude(token, base) {
         mcpServers[SERVER_NAME] = {
             type: "stdio",
             command: "npx",
-            args: ["-y", "@replen/mcp"],
+            args: ["-y", MCP_PKG],
             env: { DIGEST_BASE_URL: base, DIGEST_TOKEN: token },
         };
         const hooks = installSessionStartHook(config.hooks ?? {});
@@ -146,7 +154,7 @@ function setupGemini(token, base) {
         // docs/tools/mcp-server.md): command, args, env. No `type` field.
         mcpServers[SERVER_NAME] = {
             command: "npx",
-            args: ["-y", "@replen/mcp"],
+            args: ["-y", MCP_PKG],
             env: { DIGEST_BASE_URL: base, DIGEST_TOKEN: token },
         };
         writeJsonAtomic(path, { ...config, mcpServers });
@@ -168,7 +176,7 @@ function setupCodex(token, base) {
         // handles automatically for small objects.
         mcpServers[SERVER_NAME] = {
             command: "npx",
-            args: ["-y", "@replen/mcp"],
+            args: ["-y", MCP_PKG],
             env: { DIGEST_BASE_URL: base, DIGEST_TOKEN: token },
         };
         writeTomlAtomic(path, { ...config, mcp_servers: mcpServers });

package/extras/skills/replen/SKILL.md

@@ -239,6 +239,28 @@ A triage that isn't recorded never happened.
 Only the user-judgment actions (star / hide / handoff / queue work) wait
 for the user. Verdicts never do.
 
+#### 3e. Write back what you LEARNED from the code — not just the verdict
+
+Triage is the one moment you actually read the source, so feed what you
+learned back into Replen's model of the project (it's non-destructive and
+makes every future match sharper). Two cheap write-backs, both optional,
+both additive:
+
+- **Capability paths.** When you confirm which file(s) implement the
+  capability a candidate matched — especially if the candidate's
+  `matchedFacet` has no paths yet — call `replen_set_capabilities` with
+  **`mode:"merge"`** and just that one capability:
+  `{ tag: "<matchedFacet>", paths: ["src/…", "lib/…"] }`. Merge mode adds
+  the paths without touching the project's other capabilities. This is what
+  makes "port THIS exact file" possible in later sessions and populates the
+  Atlas dossier + cross-project leaps. Paths only, never code.
+- **Dep corrections.** When the code shows a listed dependency is unused or
+  superseded (e.g. a stale `ethers` in a repo that's actually on `viem`),
+  pass `depsSuperseded: ["ethers"]` on the `replen_record_triage` call —
+  it's marked migrate-off (reversible) so its release/pricing/upgrade noise
+  stops. Pass `depsConfirmed: [...]` for deps you verified are genuinely
+  used that Replen didn't already know. Names only.
+
 No marketing voice. No hype. The user is a working engineer; talk to
 them like a peer. Concrete > clever.
 

package/extras/skills/replen-onboard/SKILL.md

@@ -255,6 +255,19 @@ strings. Each is `{tag, descriptor, modality}`:
 Break broad capabilities into the concrete techniques the code uses. Be
 specific — `cloudflare bypass`/`proxy rotation`, not just `web scraping`.
 
+**Also capture architectural PRACTICES as capabilities.** Beyond what the code
+*does*, note the distinctive structural *moves* it makes — these are what let
+Replen suggest a pattern to your OTHER projects ("Aegis made its domain model
+data-driven; this data-heavy project should consider it"). Include a capability
+for any deliberate practice you find: a **data-driven domain ontology** (entity
+types/relationships stored as DATA/rows, not hardcoded — configurable without a
+redeploy), **event sourcing**, **outbox pattern**, **CQRS**, **pgvector
+semantic search**, **feature store**, etc. Use the standard practice name as the
+`tag` (so it matches Keystone's practice registry). Respect the cover — describe
+the practice's STRUCTURE, never the sensitive entity names it models (for a
+covered repo, "a configurable Postgres-backed domain ontology — entity types,
+typed properties, computed properties as rows", never the entity names).
+
 ### 2e. Push to Replen
 
 1. **Register** the repo if it isn't already. The per-repo `replen_set_tags` /

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.31",
+  "version": "1.0.33",
   "description": "Make your AI coding tools smarter. One command, no API keys, free. Replen watches what your projects actually do and surfaces a few things worth bringing in each month. Use one as is, port a piece of another, cherry pick an idea, or build it clean room. The match happens inside your AI tool's session. A few actionable matches a month, by design.",
   "type": "module",
   "bin": {