replen 1.0.32 → 1.0.34

package/dist/auto-register.js

@@ -0,0 +1,163 @@
+// Zero-touch repo auto-registration, run from the SessionStart hook.
+//
+// The problem this closes: registration used to happen ONLY when the user ran
+// `npx replen sync-projects` by hand. A repo they cloned/created and never
+// manually synced was invisible to Replen — so it never got matched, and the
+// user had to remember a step. This folds discovery into the hook that
+// already runs every session, so a repo's *identity* registers itself the
+// first time the user opens Claude Code anywhere near it.
+//
+// Two triggers, both bounded and silent (this is on the session-open critical
+// path; it must never prompt, log to the user, slow things down, or throw):
+//   1. cwd fast-path — the repo the user just opened. Cheap (a single-repo
+//      walk), runs every session, catches the "I just made this repo" case
+//      immediately.
+//   2. throttled full walk — the whole portfolio, at most once per
+//      FULL_SCAN_INTERVAL. Belt-and-suspenders for repos cloned but not yet
+//      opened in Claude Code.
+//
+// Identity only: this registers owner/name (+ manifest-derived tags) via the
+// same local-FS `discoverProjects` the manual sync uses. No code is read, no
+// LLM is called. Capability/facet profiling is Part 2 (onboard-on-first-visit).
+import { execSync } from "node:child_process";
+import { discoverProjects } from "./discover-projects.js";
+import { readKnownRepos, mergeKnownRepos } from "./known-repos.js";
+import { rootsFromClaudeJson, rootsFromConfig, rootsFromEnv, rootsFromHardcoded, } from "./discover-roots.js";
+// How often the full-portfolio filesystem walk may run. The walk is local-FS
+// only but still touches every repo under the user's roots, so we don't want
+// it on every session — the cwd fast-path covers the common case in between.
+const FULL_SCAN_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6h
+// Hard ceiling on the bulk POST. The hook is blocking session open; a slow or
+// unreachable server must not stall it. Errors / timeouts just defer
+// registration to a future session (the repo stays "unknown" in the cache).
+const POST_TIMEOUT_MS = 4000;
+/**
+ * Discover repos that aren't yet known to Replen and register their identity.
+ * Best-effort and silent: every failure path returns quietly. Designed to be
+ * awaited in parallel with the inventory fetch so it adds ~no wall-clock when
+ * there's nothing new (the common case: cwd repo already known, no scan due).
+ */
+export async function autoRegisterNewRepos(opts) {
+    const known = await readKnownRepos();
+    const knownSet = new Set(known.repos.map((r) => r.toLowerCase()));
+    const scanDue = isFullScanDue(known.lastFullScanAt);
+    // Gather discovered projects, deduped by githubFullName across both triggers.
+    const byFullName = new Map();
+    // 1. cwd fast-path: walk just the repo the user opened (resolved to its
+    //    git toplevel so subdir cwds still work).
+    const cwdRoot = repoRootForCwd();
+    if (cwdRoot) {
+        for (const p of safeDiscover([cwdRoot])) {
+            if (p.githubFullName)
+                byFullName.set(p.githubFullName, p);
+        }
+    }
+    // 2. throttled full walk.
+    if (scanDue) {
+        const roots = await resolveScanRoots();
+        if (roots.length > 0) {
+            for (const p of safeDiscover(roots)) {
+                if (p.githubFullName)
+                    byFullName.set(p.githubFullName, p);
+            }
+        }
+    }
+    const fresh = Array.from(byFullName.values()).filter((p) => p.githubFullName && !knownSet.has(p.githubFullName.toLowerCase()));
+    if (fresh.length === 0) {
+        // Nothing new — but if a scan was due, record that it ran so we don't
+        // re-walk the filesystem every session.
+        if (scanDue)
+            await mergeKnownRepos([], true);
+        return;
+    }
+    const ok = await postProjectsBulk(opts.base, opts.token, fresh);
+    if (ok) {
+        // Cache the now-registered repos so we don't re-POST them next session.
+        await mergeKnownRepos(fresh.map((p) => p.githubFullName), scanDue);
+    }
+    else if (scanDue) {
+        // POST failed: don't mark these repos known (a later session retries
+        // them), but do stamp the scan time so we don't re-walk on every session
+        // while the server is unreachable. The cwd fast-path still retries.
+        await mergeKnownRepos([], true);
+    }
+}
+function isFullScanDue(lastFullScanAt) {
+    if (!lastFullScanAt)
+        return true;
+    const t = Date.parse(lastFullScanAt);
+    if (Number.isNaN(t))
+        return true;
+    return Date.now() - t > FULL_SCAN_INTERVAL_MS;
+}
+// Resolve the cwd to its git repo root so a subdir cwd still discovers the
+// repo. Returns null when not in a git repo.
+function repoRootForCwd() {
+    try {
+        const top = execSync("git rev-parse --show-toplevel", {
+            stdio: ["ignore", "pipe", "ignore"],
+            encoding: "utf8",
+            timeout: 1500,
+        }).trim();
+        return top || null;
+    }
+    catch {
+        return null;
+    }
+}
+// Non-interactive root resolution for the full walk. Mirrors sync-projects'
+// inference order but NEVER prompts (the hook has no TTY contract) — config
+// and env first, then the high-signal Claude-tracked dirs and conventional
+// layout. discoverProjects dedups by path + githubFullName, so the union is
+// safe even when roots overlap.
+async function resolveScanRoots() {
+    const fromConfig = await rootsFromConfig();
+    return Array.from(new Set([
+        ...fromConfig,
+        ...rootsFromEnv(),
+        ...rootsFromClaudeJson(),
+        ...rootsFromHardcoded(),
+    ]));
+}
+// discoverProjects shells out to git per repo; guard the whole walk so a
+// transient FS/git error can't bubble out of the hook.
+function safeDiscover(roots) {
+    try {
+        return discoverProjects(roots).projects;
+    }
+    catch {
+        return [];
+    }
+}
+// Silent, bounded POST to the same bulk-upsert endpoint the manual sync uses.
+// Returns whether the registration succeeded.
+async function postProjectsBulk(base, token, projects) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), POST_TIMEOUT_MS);
+    try {
+        const res = await fetch(`${base}/api/projects/bulk`, {
+            method: "POST",
+            headers: {
+                "x-digest-token": token,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                projects: projects.map((p) => ({
+                    slug: p.slug,
+                    githubFullName: p.githubFullName,
+                    name: p.name,
+                    tags: p.tags,
+                    primaryLanguage: p.primaryLanguage ?? undefined,
+                })),
+            }),
+            signal: ctrl.signal,
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/commands.js

@@ -217,7 +217,16 @@ export async function runCheckNew(argv) {
             }
             return;
         }
-        const inv = await fetchInventoryStatus(cfg, cwdRepo);
+        // Auto-register newly-appeared repos (identity only — owner/name +
+        // manifest tags, no code, no LLM) in parallel with the inventory fetch.
+        // Both are bounded and best-effort; neither may slow or disrupt session
+        // open. When there's nothing new (the common case) auto-register returns
+        // near-instantly, adding no wall-clock over the inventory call alone.
+        const { autoRegisterNewRepos } = await import("./auto-register.js");
+        const [, inv] = await Promise.all([
+            autoRegisterNewRepos({ token: cfg.token, base: cfg.base }).catch(() => undefined),
+            fetchInventoryStatus(cfg, cwdRepo),
+        ]);
         if (inv?.displayText) {
             console.log("[Replen] Relay the following line to the user, verbatim, as a footnote at the very end of your first reply:");
             console.log(inv.displayText);

package/dist/known-repos.js

@@ -0,0 +1,55 @@
+// Local cache of repos Replen has already seen, plus the timestamp of the
+// last full-portfolio scan. Lives next to the auth config in ~/.replen/.
+//
+// Purpose: the SessionStart hook (auto-register.ts) needs to answer "is this
+// repo new?" without POSTing the user's whole portfolio to the server on
+// every single session. We cache the set of githubFullNames we've registered
+// and only send the diff. The server upsert is idempotent, so a stale cache
+// is harmless (worst case: a redundant POST); the cache is a latency
+// optimisation, not a source of truth.
+//
+// Identity only — this file never stores code, paths, or capabilities, just
+// the owner/name strings already public on GitHub.
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+const KNOWN_FILE = join(homedir(), ".replen", "known-repos.json");
+const EMPTY = { repos: [], lastFullScanAt: null };
+export async function readKnownRepos() {
+    try {
+        const parsed = JSON.parse(await readFile(KNOWN_FILE, "utf8"));
+        return {
+            repos: Array.isArray(parsed.repos)
+                ? parsed.repos.filter((r) => typeof r === "string")
+                : [],
+            lastFullScanAt: typeof parsed.lastFullScanAt === "string" ? parsed.lastFullScanAt : null,
+        };
+    }
+    catch {
+        // Missing or malformed cache — treat as "nothing known yet".
+        return { ...EMPTY };
+    }
+}
+/**
+ * Merge newly-registered repos into the cache. When `didFullScan` is true,
+ * also stamp `lastFullScanAt` so the throttled full walk doesn't re-run for
+ * the configured interval. Best-effort: a write failure is swallowed (the
+ * cache only ever costs a redundant idempotent POST next session).
+ */
+export async function mergeKnownRepos(newRepos, didFullScan) {
+    const cur = await readKnownRepos();
+    const set = new Set(cur.repos);
+    for (const r of newRepos)
+        set.add(r);
+    const next = {
+        repos: Array.from(set).sort(),
+        lastFullScanAt: didFullScan ? new Date().toISOString() : cur.lastFullScanAt,
+    };
+    try {
+        await mkdir(dirname(KNOWN_FILE), { recursive: true, mode: 0o700 });
+        await writeFile(KNOWN_FILE, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
+    }
+    catch {
+        // intentionally ignore — cache write must never disrupt a session
+    }
+}

package/dist/mcp-setup.js

@@ -26,6 +26,14 @@ import { fileURLToPath } from "node:url";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { installSkills } from "./skill-install.js";
 const SERVER_NAME = "replen";
+// Launch the MCP via a SEMVER RANGE, not a tag-less spec. Bare `npx @replen/mcp`
+// resolves once and reuses the cached build forever, so users silently run stale
+// builds and miss new tools (the paths/mode regression came from exactly this).
+// `@^1` makes npx re-resolve the newest 1.x on every session spawn — auto-updates
+// minors/patches, never jumps a breaking major — so a fresh agent session = latest
+// features with no manual `@latest` step to remember. Each setup run REWRITES this
+// entry, so returning users are migrated off the old tag-less spec automatically.
+const MCP_PKG = "@replen/mcp@^1";
 const CLAUDE_CONFIG = join(homedir(), ".claude.json");
 const CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
 const CODEX_CONFIG = join(homedir(), ".codex", "config.toml");
@@ -99,7 +107,7 @@ function setupClaude(token, base) {
         mcpServers[SERVER_NAME] = {
             type: "stdio",
             command: "npx",
-            args: ["-y", "@replen/mcp"],
+            args: ["-y", MCP_PKG],
             env: { DIGEST_BASE_URL: base, DIGEST_TOKEN: token },
         };
         const hooks = installSessionStartHook(config.hooks ?? {});
@@ -146,7 +154,7 @@ function setupGemini(token, base) {
         // docs/tools/mcp-server.md): command, args, env. No `type` field.
         mcpServers[SERVER_NAME] = {
             command: "npx",
-            args: ["-y", "@replen/mcp"],
+            args: ["-y", MCP_PKG],
             env: { DIGEST_BASE_URL: base, DIGEST_TOKEN: token },
         };
         writeJsonAtomic(path, { ...config, mcpServers });
@@ -168,7 +176,7 @@ function setupCodex(token, base) {
         // handles automatically for small objects.
         mcpServers[SERVER_NAME] = {
             command: "npx",
-            args: ["-y", "@replen/mcp"],
+            args: ["-y", MCP_PKG],
             env: { DIGEST_BASE_URL: base, DIGEST_TOKEN: token },
         };
         writeTomlAtomic(path, { ...config, mcp_servers: mcpServers });

package/extras/skills/replen/SKILL.md

@@ -239,6 +239,28 @@ A triage that isn't recorded never happened.
 Only the user-judgment actions (star / hide / handoff / queue work) wait
 for the user. Verdicts never do.
 
+#### 3e. Write back what you LEARNED from the code — not just the verdict
+
+Triage is the one moment you actually read the source, so feed what you
+learned back into Replen's model of the project (it's non-destructive and
+makes every future match sharper). Two cheap write-backs, both optional,
+both additive:
+
+- **Capability paths.** When you confirm which file(s) implement the
+  capability a candidate matched — especially if the candidate's
+  `matchedFacet` has no paths yet — call `replen_set_capabilities` with
+  **`mode:"merge"`** and just that one capability:
+  `{ tag: "<matchedFacet>", paths: ["src/…", "lib/…"] }`. Merge mode adds
+  the paths without touching the project's other capabilities. This is what
+  makes "port THIS exact file" possible in later sessions and populates the
+  Atlas dossier + cross-project leaps. Paths only, never code.
+- **Dep corrections.** When the code shows a listed dependency is unused or
+  superseded (e.g. a stale `ethers` in a repo that's actually on `viem`),
+  pass `depsSuperseded: ["ethers"]` on the `replen_record_triage` call —
+  it's marked migrate-off (reversible) so its release/pricing/upgrade noise
+  stops. Pass `depsConfirmed: [...]` for deps you verified are genuinely
+  used that Replen didn't already know. Names only.
+
 No marketing voice. No hype. The user is a working engineer; talk to
 them like a peer. Concrete > clever.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.32",
+  "version": "1.0.34",
   "description": "Make your AI coding tools smarter. One command, no API keys, free. Replen watches what your projects actually do and surfaces a few things worth bringing in each month. Use one as is, port a piece of another, cherry pick an idea, or build it clean room. The match happens inside your AI tool's session. A few actionable matches a month, by design.",
   "type": "module",
   "bin": {