replen 1.0.36 → 1.0.38

package/dist/mcp-setup.js

@@ -26,14 +26,29 @@ import { fileURLToPath } from "node:url";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { installSkills } from "./skill-install.js";
 const SERVER_NAME = "replen";
-// Launch the MCP via a SEMVER RANGE, not a tag-less spec. Bare `npx @replen/mcp`
-// resolves once and reuses the cached build forever, so users silently run stale
-// builds and miss new tools (the paths/mode regression came from exactly this).
-// `@^1` makes npx re-resolve the newest 1.x on every session spawn — auto-updates
-// minors/patches, never jumps a breaking major — so a fresh agent session = latest
-// features with no manual `@latest` step to remember. Each setup run REWRITES this
-// entry, so returning users are migrated off the old tag-less spec automatically.
-const MCP_PKG = "@replen/mcp@^1";
+// Launch the MCP via an EXACT pinned version, resolved from the npm registry at
+// setup time — mirrors how the SessionStart hook pins replen@<version>. We used
+// `@^1` for "auto-update each session", but npx caches per-spec and happily
+// reuses a stale `@^1` resolution even after `npx @latest` — so the auto-update
+// was illusory AND users got spurious "newer Replen available" nudges right after
+// updating (the server sees the still-stale client version). Pinning the exact
+// version makes each release a distinct, correctly-cached npx entry; re-running
+// `npx replen mcp setup` re-resolves + re-pins to ship an update. Falls back to
+// the `@^1` range only if the registry is unreachable at setup time.
+let MCP_PKG = "@replen/mcp@^1";
+// Resolve the exact latest @replen/mcp version to pin (fail-open to the range).
+async function resolveMcpPkg() {
+    try {
+        const res = await fetch("https://registry.npmjs.org/@replen/mcp/latest", { signal: AbortSignal.timeout(3000) });
+        if (res.ok) {
+            const j = (await res.json());
+            if (typeof j.version === "string" && j.version)
+                return `@replen/mcp@${j.version}`;
+        }
+    }
+    catch { /* registry unreachable — keep the range fallback */ }
+    return "@replen/mcp@^1";
+}
 const CLAUDE_CONFIG = join(homedir(), ".claude.json");
 const CLAUDE_SETTINGS = join(homedir(), ".claude", "settings.json");
 const CODEX_CONFIG = join(homedir(), ".codex", "config.toml");
@@ -60,6 +75,10 @@ const REPLEN_AUTO_ALLOW = [
 // ============================================================================
 export async function setupMcp(token, base) {
     console.log(`  Wiring replen MCP into agent configs…`);
+    // Pin the exact latest MCP version (deterministic; avoids npx serving a stale
+    // `@^1` build and the spurious upgrade nudge that follows).
+    MCP_PKG = await resolveMcpPkg();
+    console.log(`  MCP version pinned to ${MCP_PKG}`);
     const results = [];
     results.push(setupClaude(token, base));
     results.push(setupCodex(token, base));

package/extras/skills/replen/SKILL.md

@@ -187,23 +187,39 @@ mcp__replen__replen_capture_insight(
 )
 ```
 
-### Step 4 — Present + capture actions
+### Step 4 — Present ONLY the wins (record everything, surface what works)
 
-After all writeups, summarise:
+You already RECORDED every verdict in Step 3d, including skips — those are
+load-bearing (relevance-floor calibration, repo_quality, modality suppression,
+the Activity feed). But **do NOT narrate the skips to the user.** A wall of
+"skip, skip, skip, but…" makes Replen look like it's grasping. Present like an
+Apple keynote: lead with what's good, stay quiet about the rest.
+
+**Surface ONLY the wins** — `adopt` / `port` / `cherry-pick` / `clean-room` /
+`upgrade` + any `lesson` / `boundary`. Skips and defers are recorded silently and
+never listed. Lead with the strongest (an `upgrade` to something they already
+have usually beats a new `adopt`).
+
+If there are wins:
 
 ```
-4 candidates triaged for tech-news-site:
-  ✓ adopt:   kribblo/node-ffmpeg-installer (high · quick) — ffmpeg-static swap
-  ⏭ port:    tj/n (medium · moderate) — version-manager pattern
-  ⬆ upgrade: someorg/fast-og (high · moderate) — beats our og-image render (streams + caches vs our sync redraw)
-  ✗ skip:    vercel/turbo (deep) — wrong runtime, already on Vite
+For tech-news-site:
+  ⬆ upgrade: someorg/fast-og — beats your og-image render (streams + caches vs your sync redraw) · moderate
+  ✓ adopt:   kribblo/node-ffmpeg-installer — drop-in ffmpeg-static swap · quick
+  💡 lesson:  borrow graph-as-memory premise, link repos not files (→ Atlas)   [via graphify/graphify]
 
-  💡 lesson (via graphify/graphify): borrow graph-as-memory premise, link repos not files (→ Atlas)
-     — captured to Atlas; shown only when a Pass-3/4 insight actually fired
+(Triaged 9 candidates; surfacing the 2 worth acting on + 1 idea worth keeping.)
 
-For each verdict, what would you like to do? (star / hide / handoff / skip)
+What would you like to do with each? (star / hide / handoff)
 ```
 
+The one-line "(Triaged N…)" footer is the *only* acknowledgement that skips
+happened — honest, but it doesn't parade them.
+
+**If there are NO wins, say nothing** — or at most one calm line ("Nothing
+actionable for `<repo>` today — N triaged."). Never list the skips. Silence on a
+quiet day IS the calm-cadence contract, not a failure.
+
 Then, for each candidate, capture the user's choice. For each action,
 POST to `/api/state`:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replen",
-  "version": "1.0.36",
+  "version": "1.0.38",
   "description": "Make your AI coding tools smarter. One command, no API keys, free. Replen watches what your projects actually do and surfaces a few things worth bringing in each month. Use one as is, port a piece of another, cherry pick an idea, or build it clean room. The match happens inside your AI tool's session. A few actionable matches a month, by design.",
   "type": "module",
   "bin": {