VibeDriftWhat's new in VibeDrift.
A public log of VibeDrift releases, the features, fixes, and calibration changes that shape how drift is measured. Updated on every publish to @vibedrift/cli.
Releasesv0.21.7
Early-stage project.
vibedrift update.Typed functions get duplicate-checked
One of the scan's duplicate detectors could not see TypeScript functions with a return type. It now can, so typed codebases get the same duplicate coverage as everyone else.
- Fix
Return types no longer hide duplicates
The detector's own pattern expected a function's closing parenthesis to sit right before its opening brace, so any function annotated with a return type was skipped. It now uses the same function reader as the rest of VibeDrift, which also covers typed arrow functions, typed Python signatures, methods and generics. On a TypeScript project, expect the duplicate-pair count to rise after upgrading, because functions the detector never saw are now compared.
Tidying up 0.21.5
Two small follow-ups to last release's scan fixes: scans skip build folders when looking for ignore files, and JSON output stays quiet however you ask for it.
- Fix
Build folders stay out of the ignore search
0.21.5 started reading ignore files in subfolders, but its search also walked folders the scan never reads, like target/, venv/, dist/ and vendor/. On a repo with a large build folder that slowed every scan for no benefit. Those folders are now skipped, and which files get scanned is unchanged.
- Fix
--format json matches --json
The excluded-files warning was held back for --json but still printed for --format json. Both spellings now behave the same and print only the JSON report.
The scan says what it skipped
Four fixes to one principle: a check that silently stops is worse than one that says it can't run. Sessions, the scan, and duplicate detection now tell you exactly what they checked, skipped, and why.
- Fix
A repo too large to check says so
Drift Sessions reads your repo's saved patterns inside a strict time budget. A repo whose patterns file crossed it had every edit labeled "no patterns yet", even though it held megabytes of them. Those edits now say too large, and the session tells you once, with the measured size.
- Fix
Monorepo ignore files are honored
Only the root .gitignore used to be read, so a subfolder's own ignore file was invisible and the scan walked into folders git deliberately excludes. Ignore files anywhere in the tree now apply the way git applies them. Each is anchored to its own folder, deeper files win, and nothing leaks outside it.
- Fix
One long line no longer vanishes a file
The rule that skips minified bundles used to drop any file whose longest line passed 2,000 characters, so a component with one inline SVG path was gone. Now only bundle-shaped files drop, and every exclusion the scan makes is printed with its reason, in every interactive report format.
- Fix
Checkout location doesn't matter
The filter that ignores tests and examples matched the absolute path on your disk. Clone a repo under a folder named examples/ and duplicate detection silently turned off. It now judges the path inside the repo, which is the only path that means anything.
Answers that actually arrive
Three fixes to the loop between you and your agent: an answer given mid-task now reaches the running session, answering from the command line works days later, and finding excerpts are masked for secrets before anything is uploaded.
- Fix
A mid-turn answer reaches the agent
Answering a flag from the dashboard while your agent was still working used to vanish: the answer was saved and marked delivered, yet the agent was never told. A running session now hears it within about a minute, the way it was always meant to.
- Fix
Answer when it suits you
Answering from the command line only worked within fifteen minutes of the session's last activity, but a flag parked for a person is usually answered much later. The command now finds the session however long ago it ran, and your call is recorded as yours, so the dashboard no longer shows a person's judgement as the agent's.
- Fix
Secrets are masked before upload
Signed-in scans save findings to your dashboard, and the short excerpts those findings cite used to travel exactly as written, key and all. Excerpts now go through the same masking as everything else: the evidence survives, the credential does not. Reports and help text now state precisely what leaves in each sign-in state.
An answer says which file it is about
Answering a flag from the dashboard worked, but the agent was told only the flag's number. Now it is told the file.
- Fix
The agent knows what you answered about
Flags are numbered within a single session, so the first flag of every session has the same number. An answer travelling back as a number alone could point an agent at a different flag in a different file. Your answer now names the file it was raised on and what the flag said, so the agent acts on the right code.
- Fix
Nothing extra leaves your machine
The file and the description are read from the record already on your own machine, not sent over the network. That record also holds the real path, where the dashboard only ever sees a stand-in, so this is the only place an answer can be made specific.
Your answer reaches the agent
When your agent parked a flag for you to decide, the dashboard said it was waiting on you and gave you nowhere to answer. Now you answer it there, and the agent gets it.
- Feature
Answer a flag from the dashboard
Pick accept, decline or park, and say why if you want to. Your answer is queued, and the next time an agent works in that repository it is written into that repository's own record and put in front of the agent in words it can act on. A session already running picks it up within about a minute; one that starts tomorrow gets it as prior context, so nobody has to remember to repeat a decision that was already made.
- Feature
Your call reads as yours
A person's decision is recorded as a person's, never as the agent's. The dashboard shows it as queued until the agent has actually seen it, because queued and answered are different facts.
Answer a flag, and see the work as it happens
Two gaps in the same loop. A session only sent its work to the dashboard when a turn ended, so a long turn looked like a quiet one. And when your agent parked a flag for you to decide, there was nowhere for you to decide it.
- Feature
You can answer a flag yourself
A flag could only ever be answered by your agent. When it parked one for a person, the dashboard said it was waiting on you and gave you nowhere to answer. Now
vibedrift respond DF-1 accept,parkordeclinerecords your call, in the same place and the same shape as your agent's, with an optional --reason that stays on your machine. - Fix
A long turn no longer goes dark
Sessions shipped their events when a turn finished. On a twenty-minute turn that meant twenty minutes of nothing, so the dashboard showed a session that had gone quiet while the work was still happening. A session that keeps editing now sends what it has about once a minute, alongside the flush at the end of the turn.
One session, many repos
An agent rarely stays in one repository. It moves across a workspace of checkouts, and until now Drift Sessions recorded all of that against whichever folder the agent started in, and judged every file against that folder's patterns. This release gives each repository its own place in a session.
- Feature
An edit belongs to the repository that owns the file
Each edit is now recorded against the repository the edited file lives in, and compared with that repository's own patterns rather than the one your agent happened to start in. The folder you work in becomes the workspace that ties the sitting together.
- Feature
Turn it on once, for a folder
The first question now offers the folder your repositories live in, not just the repository you are standing in. One yes covers every repository under it, including ones you clone next month. An explicit decline in a repository still wins.
- Feature
A repository learns its own patterns
A repository nobody had scanned could never be checked, and could never get a baseline either. Now the first session records its edits, marked honestly as unchecked, and the patterns are learned in the background as the turn ends, so the next session is checked with no scan to remember.
- Fix
A large repository no longer reads as a clean one
Past a certain size the in-loop check went quiet and said nothing about it, so a dashboard showing no flags could mean nothing was looked at. It now narrows to the edited file's own directory, and if even that is too large it says so, in the session, with the numbers.
- Fix
Every repository a session touched reaches your dashboard
Each turn uploaded only the repository your agent happened to be in when it ended, so work in every other repository stayed on your machine with nothing to show it existed. All of them are now sent.
- Feature
Your repositories read as themselves
A repository your agent worked in but nobody scanned used to appear as an opaque id. Each one now sends its own folder name, and two checkouts of the same repository group together instead of reading as strangers. File paths stay opt-in.
- Feature
An unchecked edit says why
"Not checked" covered four different situations. Each edit now carries the reason, so your dashboard can tell a repository with no patterns yet from one whose checks are paused for size.
Drift Sessions notice more, and claim less
Drift Sessions watch your agent work and flag code that drifts from your repo's own patterns. This release closes the gaps that made them quieter than they should have been, and makes what they report harder to overstate.
- Feature
Edits made through the shell are seen
Agents often change files by running a script or a shell command rather than an edit tool, and those changes were invisible to Drift Sessions. They are now checked like any other edit, so a flag is raised when it happens and cleared when you fix it that way.
- Feature
Every flag asks for an answer
An advisory used to state the problem and stop. It now asks the agent to fix it or record a call on it with a reason, so accepting, parking or disagreeing with a flag all leave a trace instead of vanishing into the conversation.
- Fix
Duplicate flags name both functions
A duplicate advisory named only the existing copy, so an agent could remove the wrong function and the flag would never close. It now names the function you just wrote and the one it duplicates, each with its file and line.
- Feature
Duplicates of what the session itself just wrote
The duplicate index was built when you scanned and never grew, so two copies of the same helper written minutes apart in one session went unnoticed. The session now indexes its own work as it goes, and rebuilds the index in the background when it ends.
- Feature
New: vibedrift recheck-session
Re-checks a repository's open session findings against the code as it stands and closes the ones whose flagged code is genuinely gone. Clears are recorded separately from fixes made in the loop, so the two are never confused. Run it with --dry-run first to see what it would close.
- Feature
The Claude Code plugin sets sessions up for you
Install the plugin and Drift Sessions work in any repository you activate, with no per-repository setup. Nothing is recorded until you activate a repository, and a repository you have declined stays off.
- Fix
A re-check will not tell you something is fixed when it is not
Findings recorded by an older version, or checked against a baseline an older version built, can no longer be closed automatically. They are held open and reported as needing a fresh scan, because a wrong all-clear costs more than an extra look.
- Polish
Experimental scope flags stopped interrupting
The experimental check for edits unrelated to your stated task fired far too often on long sessions. It keeps recording quietly while it is calibrated, and no longer messages your agent.
A score that can only move the right way
Adding a problem can no longer raise your Vibe Drift Score, and fixing one can no longer lower it. That sounds obvious, and it was not true: three separate paths in the old scoring let a score improve when the code got worse. Closing them changes most scores, and many letter grades, so this release explains exactly why. It also carries a repository-wide accuracy and privacy pass.
- Breaking
The score moves in one direction only
A finding landing in a category that had none could pull the headline up, a category with one faint finding could outscore the same category with none, and averaging detector confidence meant a weak finding diluted the damage of a strong one. All three are closed. The Fix Plan's projection is affected too: it could previously promise a lower score after a fix.
- Breaking
Most scores go down, and many grades change
Across nine open-source repositories scanned before and after, seven moved, five down and two up, and six changed letter grade. The largest drop was 11.7 points. Nothing about the code changed; the ruler did.
- Fix
Detection got more honest in both directions
Go code that returns a named error is no longer reported as ignoring it, cutting unchecked-error findings on real Go projects by more than half. Python projects are no longer told their convention is camelCase. Request-size limits no longer count as rate limiting. Meanwhile async functions with an inline object return type, previously invisible, are now analysed.
- Fix
Nothing leaves your machine that should not
Deep-scan uploads carry only the short evidence snippet the dashboard displays, never whole function bodies. The local report server listens on your machine alone rather than the whole network. CSV exports cannot smuggle a spreadsheet formula out of your own source. The sign-in token refuses to travel to a plaintext address.
- Fix
A scan no longer hides its own failures
If an analyzer crashes, the scan continues but says so, and the machine-readable output marks the result as incomplete, so a score computed without it is never mistaken for a clean one. Offline scans no longer pause for three seconds waiting on a beacon that cannot send.
Migration notes
- Expect your score to change on the first scan after upgrading, most likely downward, and possibly by a letter grade. Your code did not change. A category that found almost nothing used to be able to lift the overall number above what the categories that did measure something reported, and it no longer can.
- One consequence worth knowing: Intent Clarity and Security Consistency can lower the headline or leave it alone, but they can no longer raise it. Consistent auth avoids a penalty rather than earning credit.
- Stored scores are kept exactly as they were. The new method applies to new scans, and the CLI shows a single one-time note rather than a banner on every run.
- If you gate CI on --fail-on-score, nothing changes for you: scripted runs still exit immediately. Recalibrate your threshold against a fresh scan before trusting the old number.
One install in Claude Code
VibeDrift is now a Claude Code plugin: two commands wire in the MCP server and every skill, and a run-once /vibedrift:setup takes the repo from zero to a working baseline. The same release makes two detectors more honest about what they found.
- Feature
Install as a Claude Code plugin
Run /plugin marketplace add VibeDrift/VibeDrift, then /plugin install vibedrift@vibedrift. That wires in the MCP server and the in-loop drift-check skill in one step, no config editing and no claude mcp add. Every other MCP client keeps the same one-block config as before.
- Feature
/vibedrift:setup sets up the whole repo
A run-once command that checks what is already configured, suggests scan excludes and applies only what you confirm, builds the baseline, writes the repo's dominant patterns into CLAUDE.md, and offers Drift Sessions behind Claude Code's own consent prompt. Re-running it is safe; it only changes what you ask it to.
- Fix
Phantom exports are read from the syntax tree
The unused-export detector was reading code with a text fallback that could mistake example code inside a string or a comment for a real export. It now reads the parsed syntax tree. Measured across eight open-source repositories, 86% of previously reported phantom exports were false and no longer appear.
- Fix
Mixed import style scores by how many files deviate
A project with 3 stray CommonJS files and a project with 800 used to receive the same penalty, because the count was shown in the finding but ignored by the score. The number of deviating files now feeds the score directly, with diminishing returns so it can never dominate.
Migration notes
- Scores move only on repositories the two detector fixes touch, typically by a fraction of a point. Stored scores are kept exactly as they were, the new method applies to new scans, and the CLI shows a one-time note.
- If you previously ran claude mcp add vibedrift, run claude mcp remove vibedrift after installing the plugin, so the server is not wired in twice.
In-loop advice that respects your own conventions
VibeDrift sits in your agent's loop and flags a change the moment it drifts. This release fixes the cases where that advice was wrong: a convention measured in one folder being applied to the whole repository, and test setup, seeds and throwaway scripts being judged as if they were application code.
- Fix
Conventions are judged per folder
A folder's convention now only applies to files in that folder. Previously the repository-wide winner could be handed to code that follows a different, equally deliberate convention, so a folder of server actions could be told to adopt the error-handling shape used by your React components. A folder with no established convention now stays quiet instead of borrowing another's rule.
- Fix
Tests, seeds and scripts are left alone
Test setup files, database seeds, and throwaway scripts are written to different conventions on purpose. They are no longer measured against your application code, so a seed script that throws to protect a real database is no longer told to return a sentinel instead.
- Feature
Duplicate detection sees class and object-literal methods
Methods defined inside classes and object literals were previously invisible to duplicate detection, along with Go generic functions and Rust functions with a where clause. A class-heavy file now contributes the functions it actually has, so repeated logic across sibling files is finally caught.
- Fix
Moving code is no longer called duplicating it
When you lift a helper into a shared module, the original is gone. VibeDrift now checks before telling you to import something, so a move is not reported as a duplicate pointing at a file you just emptied.
- Fix
Queries against different tables stay distinct
Two database queries that shared a shape but touched different tables or columns were being treated as the same code. They are now told apart, while two implementations that differ only in variable names still match as before.
Migration notes
- Scores move in this release and your baseline rebuilds on the first scan. There is nothing to do, and the comparison against your previous scan is suppressed once so an upgrade never reads as a code change.
- Across a sample of 160 open-source repositories in all five supported languages, the median repository scored the same before and after, and 42% were identical. Movement concentrates in class-heavy codebases, where methods that were previously invisible are now counted.
A finding clears only when the code is gone
Drift Sessions exist to keep an honest ledger of what drifted and what got fixed. This release closes the ways that ledger could be talked out of a finding: disguising a flagged clone no longer resolves it, missing evidence no longer resolves it, and the duplicate tools now recognize a function pasted whole.
- Fix
Disguised clones stay flagged
Moving a flagged clone into a class, renaming it, or nudging a single token used to clear the finding while the duplicated logic sat untouched. The re-check now demands the code be genuinely gone, two independent ways, before anything resolves.
- Fix
No resolution without evidence
If the file can't be read after an edit, the session leaves its findings open instead of guessing from the edit itself. A finding you never fixed can no longer resolve because of an unrelated one-line change.
- Fix
Paste the whole function, get the right answer
validate_change and find_similar_function used to under-score a clone pasted with its signature line, and could miss short duplicates entirely. Both tools now accept the whole function or just its body and catch the duplicate either way.
- Fix
Session start can't hang on a stray file
A non-regular file in the sessions directory could stall the start-of-session recap indefinitely. It is skipped now, and the recap says when it saw less than everything.
- Polish
Clearer message on unsupported machines
A machine without a supported coding agent now hears that before any sign-in prompt, instead of being asked to create an account for a feature that can't run there.
Stops reporting an ORM that isn't there
Three classifier defects could make a repo with no ORM at all read as ORM-majority, flagging the one genuine HTTP client as the deviation. All three are fixed, and repos that really use an ORM keep their detection.
- Fix
No more phantom ORM majorities
Identifiers that merely end in "ent", route registrations like r.Delete("/orders", handler), and files that only have "route" somewhere in their name no longer count as ORM evidence.
- Fix
Advisories stop citing conventions you don't have
The same label feeds validate_change, so an agent editing a router could be told its change conflicts with an ORM the repo does not use. That advisory now only appears when the ORM actually exists.
Migration notes
- The first scan after upgrading rebuilds the local baseline once to re-derive the data-access vote.
- Removing false findings can move a composite score slightly on affected repos.
Real file names, for the repos you choose
Sessions show file 77aa11bb where a file was flagged, because only a salted pseudonym ever leaves your machine. You can now opt a repo in so your dashboard names it properly, and opt back out whenever you like.
- Feature
One command, per repo
vibedrift watch-session --names on shares repo-relative paths for that repo only. Off by default, and the disclosure prints before anything is saved.
- Feature
Paths only, and never outside the repo
Never file contents, never absolute paths. Whether a file counts as inside the repo is decided when the edit is recorded, not guessed from the path afterwards, and anything unmarked is left out rather than assumed safe.
- Feature
Reversible for real
Turning it off deletes the names already uploaded, including for a repo that has moved on disk, and it applies to every clone of that repo. If the delete cannot reach the server, nothing claims success and it retries later.
- Fix
File paths on Windows
Paths recorded during a session used backslashes, which broke matching against your repo's own patterns. They are recorded portably now.
The most important catch leads
When one edit trips several checks, only one advisory reaches your agent. That pick used to follow a fixed category order, so a near-exact duplicate of code you already have could sit behind a debatable style note and never get mentioned.
- Feature
Duplicates lead when they are near-exact
A duplicate at 90% similarity or higher is now the advisory your agent hears first. Everything is still recorded either way; this only changes which one reaches the agent while it works.
- Fix
Advisories say what they actually measured
A learned convention now reads "Dominant pattern in this repo's sampled files" instead of "Repo uses", because the vote comes from the files the check indexed, not every file you have. Conventions you declared yourself keep the direct wording and cite the line that declares them.
- Fix
Your agent can always record its call
Recording a decision used to time out after 10 minutes while the dashboard still showed the session live for 15. Both now use the same window. In headless runs where the tool is unavailable, the agent states its decision in its reply instead of dropping it.
Honest drift density, quieter docs
Sessions now record whether the inline drift check actually ran on each edit. That single fact powers the dashboard's drift density reading (flags per 100 checked edits) with an honest denominator: edits the check skipped never count.
- Fix
Docs and config no longer flag
Non-code files are now a proper skip. A code snippet quoted inside a markdown file was previously checked as if it were source, which could flag example code in your docs. It no longer does.
- Fix
A huge pattern cache can't slow your session start
The baseline read is size-capped on the hook path; an oversized cache counts as no baseline instead of being parsed while your agent waits.
- Fix
Times on the sessions dashboard are yours now
Session detail timestamps render in your timezone instead of the server's, and relative times keep ticking in a tab left open overnight.
Migration notes
- No change to advisories, decisions, or exit behavior. Hooks still fail open, and older session records without the new field are unaffected.
See where your free trial stands
Drift Sessions gives every free account 5 watched sessions. Until now, the only way to find out how many you had left was to run out. This release makes the trial visible, and the notice at the end honest.
- Feature
A quiet count at session start
Every new session on the trial opens with one line: VibeDrift trial: 2 of 5 sessions used. It shows once, never interrupts your work, and paid accounts never see it. Your last free session says so up front.
- Feature
An honest recap at the wall
When the trial is spent, the notice shows what VibeDrift actually caught on your machine, like flagged 2 drifts; your agent fixed 1 on the spot, re-verified. If your local records show nothing, or there are none, it claims nothing. No estimates, no invented numbers.
- Fix
Your last session finishes recording
Once a session starts recording, it finishes recording, even if the trial runs out mid-session. The next session locks normally.
Migration notes
- The dashboard shipped the matching upgrades this week: the same trial meter, fixed-and-re-verified counts on every session, all three agent calls, and your agent's pre-write checks on the session timeline.
Your agent now cleans up after itself
You let an AI write a lot of your code. It is fast, but it does not know your codebase the way you do: it re-invents helpers you already have, drifts off the patterns your team settled on, and leaves all of it for you to catch in review. Drift Sessions puts VibeDrift inside the agent's decision loop, so most of that gets fixed while the agent works. You see the diff after it has already been corrected.
- Feature
One command, then forget it
vibedrift enable, once per repo. No terminal to keep open, no tool call the agent might skip (the MCP waits to be asked; this does not wait), nothing to remember before each session. vibedrift decline turns it off, reversible anytime.
- Feature
Fewer bad diffs in review
Off-pattern code is caught and corrected while the agent works, not days later in a pull request. The agent fixes it, parks it for you, or pushes back with a reason, on the record.
- Feature
An honest record on your dashboard
Every catch, every fix, every pushback. A fix only counts when the same check re-runs over the new code and passes. Nothing is taken on the agent's word, and only findings and outcomes ever leave your machine, never your code or your prompts.
Migration notes
- Drift Sessions runs inside Claude Code today. More agents are on the way.
- Drift Sessions is a Pro feature. The first five sessions are free.
- Hooks fail open: an error or timeout never interrupts your agent.
Signed-in scans no longer upload file contents
A privacy fix worth reading. When you are signed in, each scan syncs its result to your dashboard so your history and score trend appear on vibedrift.ai. That sync was carrying more than it should have been.
- Fix
File contents stay on your machine
The dashboard sync was including the full text of every file it scanned, along with the parsed syntax tree, rather than just the summary it needs. Only per-file metadata is uploaded now: the repo-relative path, the line count, and the language. Nothing about how the dashboard looks or works changes, because it never used the rest.
Migration notes
- This affected scans run while signed in, on any plan, whether or not you used --deep. Scans run signed out, or with --local-only, were never affected because they upload nothing.
- Upgrade with npm i -g @vibedrift/cli, or just run npx @vibedrift/cli, which always fetches the latest. Running a fresh scan replaces the previously synced result for that project.
Import drift, now in Go, Python and Rust
How a codebase writes its imports is one of the first conventions it settles on, and one of the first a fresh agent session forgets. VibeDrift has always caught import drift in JavaScript and TypeScript. It now reads Go, Python and Rust the same way.
- Feature
Go, Python and Rust import conventions
VibeDrift now learns each language's import habits from your own code and flags the files that break them: import grouping and gofmt ordering in Go, absolute versus relative paths and wildcard imports in Python, and globs, crate-internal paths, and use grouping in Rust. As always it is measured against your repo, never an external style guide.
- Feature
Each convention judged on its own
Import style is not one decision, so it is no longer one verdict. Every dimension is voted separately and scoped to the directory it lives in, which means a file can be perfectly consistent on one axis and drift on another, and you see exactly which. Idiomatic patterns that only look inconsistent, like a glob import inside a Rust test module, are left alone.
- Polish
JavaScript and TypeScript pick up require()
Existing JS and TS behavior is unchanged, and the detector now reads CommonJS require() calls alongside ES imports, so mixed-module projects are judged on everything they actually import rather than half of it.
Migration notes
- Go, Python and Rust projects may see their score move on the first scan after upgrading. Import style has always counted toward the score for every language, but until now only JS and TS could produce findings for it, so those projects scored it clean by default. The formula did not change, the coverage did. JavaScript and TypeScript scores are unaffected.
- Because the numbers on either side of this release were produced under different coverage, VibeDrift will not draw a trend across it rather than report a drop your code did not cause. Your first scan after upgrading sets the new baseline and trends resume from there. If you gate CI on a score threshold, re-check your floor against that first scan.
npx installs work again
A packaging fix: npx @vibedrift/cli — the one-line install used in the docs and MCP registrations — failed on 0.17.0 with "could not determine executable to run". This release restores it.
- Fix
npx auto-run restored
0.17.0 briefly declared a second executable, which stops npx from auto-selecting the CLI on npm 9 and newer. The package declares a single vibedrift executable again, so npx runs, MCP registrations, and copy-pasted install commands work as documented. Installed Drift Sessions hooks were never affected.
VibeDrift rides along while your agent codes
Drift Sessions is a preview of VibeDrift working inside your Claude Code session instead of after it. It watches edits as they happen, tells the agent the moment one drifts from your repo's own patterns, and keeps an honest local record of what got caught and what the agent did about it.
- Feature
Watch a session live
Run vibedrift watch-session and VibeDrift installs consent-gated Claude Code hooks, then follows the session in real time. Prompts, edits, and drift flags stream into a live tape with a running count and an end-of-session summary, all recorded to a local append-only ledger on your machine. It is local-first and fail-open, and secrets in prompts are masked.
- Feature
Advice in the loop
When an edit diverges from the repo's dominant pattern, the agent gets a one-line advisory that uses the same drift checks as a full scan, so it can course-correct before the drift spreads. A finding resolves only when that same check re-runs on the re-edited file and passes, so the resolved and open counts stay honest.
- Feature
The agent's calls, on the record
The agent can accept, park, or decline a flag with a reason, and each decision is recorded next to the finding it answers. Accepting a flag is not the same as resolving it, so you can see both what the agent chose and what actually got fixed.
- Feature
A hosted session dashboard
Opt in with --sync on and VibeDrift uploads a derived-only view of the session to your dashboard at vibedrift.ai/dashboard/sessions: findings, scores, outcomes, and decisions only, never your code or prompts, with file paths reduced to opaque hashes. It stays off unless you turn it on.
Migration notes
- Drift Sessions is a Pro feature with a five-session free trial. The first five sessions on a free account are full-featured; after that the live tape locks behind a summary of what the trial caught. Your local ledgers always remain yours.
Truthful results on multi-module Go repos
A correctness release: accurate dependency checks on Go monorepos, and honest wording when a category has nothing to measure.
- Fix
Go multi-module repos scan correctly
Dependency checks now resolve each Go file against its nearest enclosing go.mod instead of the repo root, so nested modules, workspace services, sibling in-repo modules, and /vN import paths are recognized as declared rather than flagged as missing. Fixes the false errors reported on real multi-module repos (issue #48). Single-module repos are unchanged.
- Polish
Honest wording when nothing was measured
A category with no score now says why: nothing to measure in this repo, or not scored because evidence was below the peer floor (findings kept as advisory) — instead of a blank "no findings" that read as a clean bill for a check that never ran. Terminal and HTML reports alike.
A scoring upgrade never reads as a code change
When a new VibeDrift release refines how the score is computed, the first scan afterward no longer compares itself against numbers from the old method. Your scan-over-scan story stays about your code.
- Fix
Cross-version deltas fully suppressed
The "since last scan" comparison now refuses to diff two scans scored under different methods, in the terminal and in the committed .vibedrift/context.md alike, including when --since targets an older scan. The first scan after an upgrade simply shows no comparison; normal diffs resume from the very next scan.
Your deep-scan results, right in the terminal
A deep scan runs real AI analysis, but until now the default output kept the results a click away. The terminal summary now shows what the AI found the moment the scan finishes.
- Feature
AI results inline in the default output
After a deep scan, the default summary now carries a short AI Deep Analysis block: the coherence grade, the top AI finding, and how many findings the AI validated, with a pointer to the full analysis. No flags to remember, and regular scans are unchanged.
- Fix
Go auth checks cover Fiber and Gorilla
Routes registered through Fiber and Gorilla mux routers now count in the auth-consistency check, so an unauthed state-changing route in those frameworks is flagged like its Gin and Echo peers.
- Fix
Sharper dependency and file classification
An import mentioned inside a comment or a string no longer shows up as dependency drift, and files with special characters in their names classify correctly.
Migration notes
- A Go repo using Fiber or Gorilla with real auth inconsistency may see its Vibe Drift Score move to reflect drift that was always there, and repos that were catching the dependency or filename false positives may see their score improve. Every other repo is unchanged. Saved scores are kept as-is, cross-version deltas are suppressed, and the CLI shows a one-time notice. If you gate CI on the score, re-check your threshold.
Security Consistency now speaks Python, Go, and Rust
The auth-consistency check used to understand only JavaScript and TypeScript. It now reads routes and their guards in Python, Go, and Rust too, and tells you plainly when it cannot be sure instead of guessing.
- Feature
Auth drift detection for Python, Go, and Rust
VibeDrift reads the middleware or hook that guards each route and decides whether it actually authenticates, across Flask, FastAPI, and Django, across Gin and Echo, and across Axum, Actix, and Rocket. It only calls a route protected when the guard verifiably rejects unauthenticated requests, so a route is never marked safe on a name alone.
- Feature
Unsure guards are named, not guessed
When a guard is imported from another file, VibeDrift follows the import and reads the real body. When it genuinely cannot tell, because a guard is opaque or third-party, it names the hook and asks you to double check, rather than quietly marking the route authenticated or unprotected.
- Fix
Fewer false import-drift findings
Import and dependency analysis now parses your real syntax instead of matching text, so an import mentioned in a comment or a string no longer shows up as dependency drift.
Migration notes
- A Python, Go, or Rust web repo with real auth inconsistency may see its Security Consistency score move to reflect drift that was always there. Repos with uniform auth, and repos without those routes, are unchanged. Saved scores are kept as-is, cross-version deltas are suppressed, and the CLI shows a one-time notice. If you gate CI on the score, re-check your threshold.
Security Consistency stops missing the routes that matter
The auth-consistency check now sees the catch-all and Flask routes it used to skip, so an endpoint that changes state without the auth the rest of your code applies gets flagged, in your reports and in your agent's in-loop checks alike.
- Fix
Catch-all and Flask routes now count toward auth consistency
Express .all() routes and Flask @app.route(methods=[...]) routes were being skipped by the auth check, so a repo could carry an unauthed state-changing route that produced no finding at all. They're now read by their real method: a mutating route with no guard is flagged, while read-only routes stay clean, so plain GETs never trip a false alarm.
- Fix
Sharper security answers while your agent writes
The MCP tools your agent calls in-loop are more accurate about auth. check_file_drift no longer calls a file clean when it has an unauthed route, get_dominant_pattern flags when a convention is drawn from too few routes to trust, and the repo baseline rebuilds itself after an upgrade instead of answering from a stale one.
Migration notes
- Repos with Express .all() or Flask methods=[...] routes may see their Vibe Drift Score move, because the auth check now counts routes it previously missed, reflecting security drift that was already there. Your saved scores are kept as-is; the new method applies to new scans, and every other repo is unchanged.
Fewer false alarms on lazy-loaded code
Dead-code detection now understands dynamically imported modules, so lazy-loaded code stops showing up as unused.
- Fix
Lazy-loaded code no longer flagged as unused
Exports used only through a dynamic import (const { thing } = await import('./module.js')) are now recognized as used. Lazy-loaded modules, common in CLIs and code-split apps, are no longer flagged as unused, and the files they load are no longer counted as orphaned. The dead-code findings you see are the real ones.
Cleaner category view
The Vibe Drift Score now shows only the drift dimensions it actually measures.
- Polish
Dependency Health removed from the score view
Dependency Health had no drift check yet, so it always showed "N/A" — a permanently-empty category. It's no longer shown as a drift dimension; the dependency signals we do have (unused / phantom packages) still feed the Hygiene score. The Vibe Drift Score now shows four drift dimensions.
Fewer false alarms, clearer results
A cleanup release: the duplicates a scan surfaces are the ones worth fixing, categories with nothing to score explain themselves, and vendored code no longer skews your results.
- Fix
Fewer false-positive duplicates
Recurring test-fixture helpers, and functions that merely share a control-flow shape rather than real duplicated logic, are no longer flagged as duplicates. The duplicates you see are the ones actually worth consolidating.
- Polish
Clearer messaging for empty categories
A category with nothing to score now tells you why instead of a bare "N/A": Dependency Health reads "not yet measured", and every other category reads "no findings in this repo".
- Fix
Cleaner scans of repos with vendored code
File discovery now skips vendored and minified files, so bundled third-party code doesn't drag on your results.
- Feature
New --inject-context flag
Inlines VibeDrift's view of your repo's dominant patterns into CLAUDE.md inside an idempotent managed block, so AI agents write code that matches your conventions. Pairs with --write-context to refresh everything in one pass.
Reimplementation counts on deep scans
Deep scans now factor in redundant reimplementation. When the same logic is rewritten densely across many files, your Vibe Drift Score reflects it.
- Feature
Concentrated reimplementation affects the score
On a deep scan, when the same functions are redundantly reimplemented across many files at high density — a hallmark of AI-assisted sprawl — that now lowers your Vibe Drift Score. A stray parallel or legacy implementation in an otherwise well-structured codebase is left alone; only genuine concentration counts, so clean code is never penalized.
Migration notes
- Scoring update: this release refines how the Vibe Drift Score is calculated. Your existing scores are kept as they were, and the change applies to new scans. Score comparisons across the change are suppressed so you never see a misleading delta.
- Local and signed-out scans are unaffected — this only changes deep scans.
Instant results, and the full report for everyone
Scans now show their results the moment they finish, the full report is open to everyone, and signed-in scans link straight to your dashboard.
- Perf
Results appear immediately
The Vibe Drift Score, category breakdown, and Fix Plan print as soon as the scan finishes. The slower steps — AI fix prompts on Pro, and syncing to your dashboard — then run behind clear progress indicators instead of a silent wait.
- Feature
Signed-in scans link to your dashboard
A signed-in scan links straight to its project on your dashboard, where the full report, score history, and trends live, instead of opening a local HTML file.
- Feature
The full report, for everyone
Signed-out scans are no longer limited to a summary. You get the complete report — every finding, drift detail, and exact duplicate — served locally and opened in your browser.
- Polish
Redesigned HTML report
The standalone HTML report, both the summary and the detailed view, has been redesigned.
Sharper findings, fewer false positives
An accuracy pass across the analyzers, so the findings and the Fix Plan you act on are ones you can trust. The scan does a better job telling real drift from noise.
- Fix
No more phantom “dead code”
Exported types and helpers used within their own file, symbols re-exported through a barrel (export { x } from './y'), and Web Worker entry files loaded via new Worker() / getURL() are now recognized as live instead of being reported as unused.
- Fix
More accurate duplicate detection
Two short functions that differ only by the values they check (e.g. distinct string constants) are no longer called exact duplicates, and unrelated functions that merely share a common shape are no longer flagged as near-duplicates.
- Fix
Build-tool dependencies aren’t “unused”
Packages used only in build config (e.g. webpack loaders and plugins) are recognized as used instead of being reported as phantom dependencies.
- Fix
Truer return-shape and naming drift
A file is judged by its dominant error-handling style, so a single defensive rethrow no longer flips it to “throws”; state objects with a status field aren’t mislabeled as error returns; and single-word filenames are treated as convention-neutral.
- Fix
Honest Fix Plan projection
The projected score and its gain are shown on one consistent scale, and categories that weren’t measured are labeled as such instead of folding silently into the grade.
- Fix
Valid JSON from --json
vibedrift . --json now emits only JSON on stdout (status messages go to stderr), so piping into jq or a CI step never breaks on a stray line.
Tell VibeDrift what to scan
Set up a project once: skip the files that aren't really yours (fixtures, generated code, vendored deps) and pin your defaults, so the Vibe Drift Score reflects the code you actually own. It works the same whether you scan from the CLI or let your agent configure the repo through the MCP.
- Feature
vibedrift init
A guided one-time setup. It detects likely fixtures and generated code, asks which paths to skip, your CI score floor, and your default report format, then writes a committable .vibedriftignore and .vibedrift/config.json so your whole team scans the same way.
- Feature
Exclude paths from a scan
Add a .vibedriftignore (gitignore syntax) or run
vibedrift ignore "**/fixtures/**". Excluded paths stop counting toward your score, and the rule is honored by both the CLI and the MCP server, so test fixtures and generated code no longer drag your score down. - Feature
Project config for defaults
.vibedrift/config.json now holds your default report format and CI score floor, so you don't repeat flags on every run. An explicit flag always overrides it.
- Feature
Set up a repo from your agent
The MCP server adds an init tool, so an AI agent can configure a fresh repo in-loop: detect fixtures, write the config, and apply the exclusions you approve, all without leaving the editor.
Deep-scan scores you can trust
Deep scans now reflect every finding, and the Vibe Drift Score weighs how much code it actually saw before calling a project clean — so a tiny repo no longer earns a perfect score just for being small.
- Fix
Deep scans reflect all findings
A deep scan on a project with no duplicate findings could report an inflated score. Deep-scan results now incorporate every finding, so the headline score matches what the scan actually found.
- Fix
Evidence-weighted scoring
A small project with no findings used to earn a near-perfect score just for being small. Scores now weigh how much code was analyzed: a tiny project lands near the typical score, while a large genuinely-clean project still scores near the top.
- Polish
Scoring refined — your grade is preserved
This release refines how the score is computed. Your past scores keep their grade, a one-time notice explains the shift, and delta arrows resume on your next scan.
- Feature
Opt-in debug logging
Run with VIBEDRIFT_DEBUG=1 (or --verbose) to see the scan's stage-by-stage detail — handy when wiring VibeDrift into CI or an agent loop.
Migration notes
- Gating CI on --fail-on-score? Re-baseline your threshold this release: scores shift slightly (deep scans reflect all findings; small clean projects regress toward the typical score). Run a scan on your main branch to capture the new baseline.
Decompressed Vibe Drift Score (v4)
The Vibe Drift Score now spans a real 0–100 range and moves on actual drift. Previously most repos bunched near the top; now clean code and drifting code get visibly different scores.
- Fix
A score that discriminates
The Vibe Drift Score was compressed near the top, so almost everything landed 90+. It now uses the full range and drops on real drift — so the number actually tells you something.
- Fix
Size-independent scoring
A category's health now reflects how many distinct patterns drift and how badly, not the raw number of findings (which grew with repo size). A large, clean codebase no longer scores lower just for being large.
- Feature
Coherence audit in --json
The deep-scan coherence report — the ranked, codebase-wide consistency audit — is now included in --json output, so CI and tooling can consume it.
Migration notes
- Scores were recalibrated, so they shift versus earlier versions. Past scores keep their grade and a one-time notice explains the shift; re-baseline any CI --fail-on-score threshold.
MCP tools free for everyone, plus credit packs
The five local MCP tools are now free for everyone, signed in or not. Your AI agent can consult your repo's own conventions while it writes, get the dominant pattern, find a near-duplicate, check a file for drift, and your code never leaves your machine. The cloud deep checks are the only metered part, and now anyone can top up their deep-scan pool with a one-time credit pack, no subscription required.
- Feature
Local MCP tools, free for all
get_dominant_pattern, find_similar_function, check_file_drift, validate_change, and get_intent_hints now run for everyone, including signed-out users. They read your code on your machine and never send it, so your agent can match your repo's patterns the first time, on any project, with no account and no setup beyond pointing it at the server. Only the opt-in cloud deep checks draw from a budget.
- Feature
A deep-scan nudge, right in your editor
When a lot has changed since your last deep scan, your agent now offers to run one without leaving your session. Say yes and the deep findings come back inline. If your deep-scan budget is empty, it points you to upgrade or grab a credit pack instead of stopping you cold.
- Feature
Credit packs, top up without subscribing
Need deep scans without committing to a plan? Buy a one-time credit pack any time: 25 deep scans for $20, 50 for $35, or 100 for $60. Credits drop straight into your shared scan pool and never expire on a monthly cycle. Anyone can buy them, with or without a subscription, and they stack on top of whatever your plan already gives you.
Migration notes
- Already using the MCP server? Nothing to change, your local tools just stopped asking who you are. Out of deep-scan budget mid-session? Grab a credit pack at vibedrift.ai/pricing and keep going; everyday local checks stay free regardless.
Deep scans, in-loop (MCP deep mode)
The MCP server can now run a full deep scan on the function your agent is writing, not just the local pattern checks. validate_change and find_similar_function take an opt-in
deep: truethat detects misleading names and Claude-validated semantic duplicates before the code lands. It's the same deep engine asvibedrift . --deep, now available the moment a function is written.- Feature
The full deep scan, in-loop
Add
deep: trueto validate_change or find_similar_function and the agent gets intent-mismatch detection (a name that lies about what the code does) plus Claude-validated semantic duplicates on the single function it's checking, caught while writing, not in a later review. - Feature
Local-first stays the default
The five core tools are still 100% local. Deep mode is the one opt-in exception, and it sends only the single function being checked, nothing else leaves your machine.
- Feature
One shared pool, no surprises
Each in-loop deep check draws just 1/50 of a deep scan from the same monthly pool you already have, so normal use barely dents it. An hourly cap keeps an agent loop from running away, and if you're out of budget the check quietly falls back to the local result instead of erroring.
Migration notes
- Deep mode is Pro/Team. Have your agent pass
deep: trueto validate_change or find_similar_function when finalizing a non-trivial function, keep everyday checks local. Out of budget? Buy more at vibedrift.ai/pricing; checks degrade gracefully until you do.
VibeDrift runs inside your AI coding agent (MCP)
VibeDrift now ships an MCP server, so Claude Code and Cursor can consult your repo's own conventions WHILE they write code, turning drift detection into drift prevention. A Pro feature: install once with
claude mcp add vibedrift -- npx -y @vibedrift/cli mcp, sign in withvibedrift login, runvibedrift .to build the baseline, and your agent does the rest. The tools run locally, your code never leaves your machine.- Feature
Five in-loop tools
Your agent calls these on its own as it works: get_dominant_pattern (the repo's convention for a dimension + examples to copy), find_similar_function (does a near-duplicate already exist?), check_file_drift (does this file match the repo?), validate_change (would this change introduce drift or a duplicate?), and get_intent_hints (the conventions your CLAUDE.md / AGENTS.md declare).
- Feature
Prevention, not just detection
Until now VibeDrift ran after the fact, you scanned, then fixed. Inside the agent loop it answers before the code lands, so new functions match your repo's patterns the first time. Every answer comes back in well under a second because a normal scan caches a drift baseline the server loads once.
- Feature
A Pro feature, run locally
The MCP server is included with Pro and Team. The tools read your code on your machine, your code never leaves; only your plan is read from your local sign-in. It's the same engine that powers a normal scan, exposed as agent tools.
Migration notes
- Setup:
claude mcp add vibedrift -- npx -y @vibedrift/cli mcp(Claude Code), or add it to.cursor/mcp.jsonfor Cursor with args ["-y", "@vibedrift/cli", "mcp"]. Sign in withvibedrift login(Pro/Team), then runvibedrift .once so the tools have a baseline.
Deep scan gets sharper
Deep scan now validates its borderline findings with an AI reviewer before they reach you, and it no longer mistakes structurally-similar code for true duplicates. Fewer false alarms, higher-trust findings. Because deep-scan findings changed, deep-scan Vibe Drift Scores may move slightly, local scans are unaffected, and there's nothing to re-run.
- Feature
AI-validated findings
On a deep scan, the ambiguous calls, “are these two functions really duplicates?”, “does this name match what the function does?”, are now confirmed or rejected by an AI reviewer before they reach your report. Confirmed findings are kept; false positives are dropped with a recorded reason. The findings that remain are the ones worth your attention.
- Fix
No more same-shape, different-thing false duplicates
Two functions that share structure but do different work, for example the same query shape against two different database tables, are no longer mistaken for duplicates. Deep scan now keys on what the code actually references, so genuine copy-paste duplicates still surface while look-alikes don't.
Migration notes
- Deep scan only: because deep-scan findings are now more precise, deep-scan Vibe Drift Scores may shift slightly (usually a touch higher). Local scans are unchanged, and there's nothing to re-run.
A sharper, steadier Vibe Drift Score
The Vibe Drift Score now reflects every cross-file drift signal VibeDrift tracks, duplication, naming, async, import and export consistency, and structural scaffolding, so the headline number is a fuller picture of how consistent your codebase is with itself. Your past scans were automatically recomputed under the new scoring so your trend lines compare apples to apples.
- Breaking
The full drift picture
The Vibe Drift Score now incorporates the complete set of cross-file consistency signals, semantic duplication, naming, async patterns, import and export conventions, and phantom scaffolding, not just a subset. On a drifted codebase your score will be lower and more discerning; that's the measurement getting sharper, not your code getting worse overnight.
- Polish
Your history stays comparable
When our scoring changes, we recompute your past scans under the new scoring automatically, so trend lines and 'since last scan' deltas compare like-with-like instead of jumping at the upgrade. You'll see a single one-time note pointing at these release notes, no version numbers, nothing to re-run on your part.
- Fix
Same repo, same score, every machine
Scans are now fully deterministic: the same commit produces a byte-identical report and names the same 'worst drifting file' on your laptop and in CI, regardless of operating system or locale.
- Fix
Declared conventions are checked honestly
When your CLAUDE.md or AGENTS.md declares a convention your codebase hasn't actually converged on, VibeDrift now flags the gap instead of treating the declaration as proof you already follow it.
Migration notes
- CI: if you gate on --fail-on-score, re-baseline once. The score now counts more drift signals, so a healthy repo may land a few points lower than on 0.7.x. Run one scan to read your new baseline, then set your threshold from it.
Score out of 100 + scans that actually upload
The Vibe Drift Score is now displayed out of 100, matching what every code-quality tool you've ever used does. Same math, same grades, conventional denominator. Plus a series of fixes so deep scans on large repos actually land on your dashboard.
- Breaking
Score out of 100
Drift composite is now /100 instead of /80. The internal math is unchanged (4 applicable categories × 20 = 80 raw); the engine normalizes at the boundary so the headline matches user expectations from SonarQube, Lighthouse, etc. Hygiene was already /100. Grades come from the percentage so they're identical to prior versions.
- Fix
Large-repo uploads finally land
Deep scans on monorepos like shadcn-ui (3,500+ files) used to silently fail to upload because the result blob exceeded the API's body-size cap. The CLI now compacts the payload progressively before uploading, stripping heavy bookkeeping fields in priority order until it fits, and surfaces any remaining failure with a visible warning instead of swallowing it.
- Fix
Visible upload status
Previously you had to run with
--verboseto see if your scan made it to the dashboard. Now any upload failure shows a clear⚠ Couldn't upload to dashboardline at the end of the scan, with the reason and payload size. Successful uploads with trimming print aⓘ Result trimmed for upload: 39MB → 8MBnote so you know what happened. - Fix
Duplicate-group findings stay readable
A semantic-duplicate group spanning 60+ files (common in registry-style codebases with theme variants) used to produce a single 30–40 KB finding with the entire member list inline. The finding now caps the displayed names and locations and surfaces the total count separately, keeping the report scannable while preserving every piece of scoring signal.
Migration notes
- CI users with
--fail-on-score: multiply your threshold by 1.25 (e.g. 60 → 75) to keep the same gate after the /80 → /100 normalization.
Catches stubs before they ship
New detector for a class of bug VibeDrift was missing: functions that return hardcoded placeholder strings instead of real computed values. The same class of bug that let a stub slip into production for months undetected.
- Feature
Implementation-gap detector
VibeDrift now flags functions whose bodies are placeholder returns:
return "unvalidated",return "not implemented",raise NotImplementedError,panic("not implemented"),unimplemented!(). Works across JavaScript, TypeScript, Python, Go, and Rust. Catches half-finished code that ships to production. - Feature
TODO severity escalation
A TODO within five lines of a placeholder return or NotImplementedError is now a warning, not a buried info line. One TODO sitting next to a stub is orders of magnitude more actionable than ten scattered TODOs in a messy module.
- Polish
Dogfood in CI
VibeDrift now runs on every PR to the VibeDrift API repo itself. If a stub ever slips into review again, the drift detector will point at it before merge. Same GitHub Action any team can add in two minutes.
AI agent context, properly gated
The .vibedrift/ context pipeline, the feature that turns VibeDrift into a live participant in your AI coding sessions instead of a one-shot scanner, is now a first-class, clearly-gated offering. Free to use with a one-time sign-in.
- Feature
AI agent context pipeline
Run
vibedrift . --write-contextand VibeDrift writes a .vibedrift/ folder with context.md, fix-plan.md, fix-prompts.md, and patterns.json. Commit it alongside your CLAUDE.md. Your AI coding agent reads it on every new turn and knows which pattern to match, no more cold starts, no more drift across sessions. - Feature
Watch mode keeps it fresh
vibedrift watchruns alongside your Cursor or Claude Code session and refreshes the context files on every file save. Zero network calls. The next AI turn always sees up-to-date peer patterns, even mid-refactor. - Fix
Consistent sign-in gate on both
--write-context and watch mode both now require a free vibedrift login. The .vibedrift/ files carry the full finding surface, same gate as the one-shot HTML report. Sign up once (no card, 30 seconds), and both work everywhere.
Update nudges, watch-mode gate
Two small but important fixes between the 0.6.0 and 0.6.3 ships.
- Feature
Passive update notice
When a newer @vibedrift/cli is available, the scan output now shows a dim one-liner at the end pointing at
vibedrift update. Cached for 24 hours so it never slows a scan. Respects --local-only and telemetry opt-out. - Fix
Watch mode now requires sign-in
vibedrift watch now checks for a local auth token before starting. This closes a gate that let an unsigned user get continuous full-finding output, which the one-shot scan gates behind a free account.
Drift-only score, watch mode, scan-over-scan diff
The headline score now measures drift, and only drift. Generic quality findings (complexity, dead code, TODOs, outdated deps, empty catches) live in a separate Hygiene Score that renders alongside but does not affect the Vibe Drift Score. Plus a new watch mode for AI coding sessions, a scan-over-scan diff banner, and a detector that catches AI-generated files by their git-history shape.
- Feature
Drift-only Vibe Drift Score
The headline score now measures cross-file pattern consistency, the thing VibeDrift was built to detect, and nothing else. Generic hygiene signals still render in a clearly labeled separate pane and get their own score, so nothing is hidden. If you gate CI on --fail-on-score, recalibrate after upgrading: the drift composite's max shifted from 100 to 80.
- Feature
Watch mode for AI sessions
New vibedrift watch subcommand rescans on every file change and refreshes .vibedrift/context.md, fix-plan.md, and patterns.json. Point it at your project while your AI agent is working, every new turn, the agent sees up-to-date peer patterns and fix prompts. Local only, zero network calls, debounced so a burst of edits triggers one scan.
- Feature
Scan-over-scan diff
Every scan now compares to the previous one: ✓ Resolved, ✗ New, and score delta, right in the header. Finding identity survives small line shifts so moving code doesn't produce phantom 'new' findings. Use --since <scanId> to compare against any earlier saved scan.
- Feature
Commit archaeology
New drift signal that reads your git history. Flags files written in a single burst by a single author when the rest of the directory was cultivated across time and contributors. It's a shape-of-authorship signal no linter has access to, useful for catching AI-generated files that shipped without human review.
- Feature
Deep-scan preview now names specific files
When you run a free local scan, the upsell for deep scan used to be generic marketing copy. Now it names the exact near-duplicate function pairs, opaque function names, and mixed-pattern files that deep scan would confirm. You see what you're missing, not a banner.
- Feature
Team conventions, enforced across more detectors
When your repo root has a CLAUDE.md, AGENTS.md, or .cursorrules that declares 'use the repository pattern,' 'named exports only,' 'structured logging with winston,' or similar, VibeDrift now uses those declarations to bias the dominance vote across nine drift detectors. If your docs say one thing and your code does another, the divergence is flagged with a citation back to the source line.
GitHub Action, catch drift before merge
VibeDrift now runs on every PR via a reusable GitHub Action. Posts a comment with the score delta, new drifts introduced, and a link to the full report. Optionally fails the check if the score drops below your threshold.
- Feature
PR drift report
Every PR gets an auto-updating comment showing the score delta vs main, new drifts introduced, and a consequence line for each. Updates on each push, no comment spam.
- Feature
Merge gate
Set fail-on-score to block merges when the drift score drops below your threshold. Keeps the codebase consistent without manual review overhead.
- Feature
Two-minute setup
Add a 10-line workflow file + your VIBEDRIFT_TOKEN secret. Free scans are unlimited in CI, deep scans use your monthly budget.
AI fix prompts + smarter Fix Plan
The AI-synthesized 'How the peers do this' prose now works reliably on every logged-in scan. The Fix Plan prioritizes security and architectural drift over linter-grade noise, and every finding explains why it matters.
- Fix
AI fix-prompt synthesis fixed
The premium feature, AI-authored prose describing how peer files implement the dominant pattern, was silently broken since launch. Now works on every logged-in scan. The 'How the peers do this' section appears in Copy AI Prompt blocks for findings with reference files.
- Feature
"Why it matters" consequence lines
Every finding in the Fix Plan shows a one-line consequence: what happens if you don't fix it. Security flaws, architectural drift, duplicates, missing deps, each has a concrete 'why this matters' annotation.
- Feature
Priority-sorted Fix Plan
Security findings surface first, architectural contradictions second, semantic duplicates third. The Fix Plan shows the highest-stakes cross-file drift, not linter-grade complexity warnings.
Telemetry + local-only mode
New anonymous scan beacon, on by default for everyone whether signed in or not (language, file count, scan time, no code, no file paths, no identifiers). New --local-only flag skips ALL network calls for air-gapped environments.
- Feature
Anonymous scan beacon
VibeDrift sends a lightweight anonymous ping per scan (language, file count, scan time, CLI version), on by default for everyone whether you are signed in or not. No code, no file paths, no identifiers. Opt out anytime with
vibedrift telemetry disable(or set VIBEDRIFT_TELEMETRY_DISABLED=1), or run--local-onlyfor a fully offline scan. - Feature
--local-only flag
Skip ALL network calls even when logged in, no scan log, no beacon, no deep analysis. Use this in air-gapped environments, on sensitive codebases, or when you want a pure offline scan.
- Feature
vibedrift telemetry enable/disable
New subcommand to manage telemetry preferences. Persisted in config. First-run notice shown once on first scan explaining what's collected and how to opt out.
Temporal awareness
VibeDrift now reads your git history. Recent code carries more weight in the dominance vote, so migrating to a new pattern is rewarded instead of punished. Built in response to feedback on Hacker News.
- Feature
Recency-weighted voting
Every file's vote is now multiplied by a recency factor, newer code outvotes older code with a 90-day half-life. Three fresh handlers adopting the repository pattern can now correctly outweigh ten old raw-SQL handlers the team is migrating away from.
- Feature
Pivot detection
When recent files lean toward a new pattern while legacy files hold the old one, VibeDrift now recognizes the migration and reclassifies old files as legacy (not drift). Old code you're planning to migrate is no longer treated as urgent drift.
- Feature
Three-state classification
Each deviating file is now aligned, legacy, or drift, with different copy-paste fix prompts for each. Legacy files get 'consider migrating' framing; true drift gets 'fix now.'
- Feature
Team-declared intent
VibeDrift parses CLAUDE.md, AGENTS.md, .cursorrules, and AGENT.md in your repo root. When your declared convention disagrees with your actual code, that divergence is surfaced prominently in findings with a direct citation to the source file and line.
- Fix
Security analyzer skips test files
The secret-detection scanner no longer flags deliberate test strings (e.g. hardcoded 'AKIA...' in security.test.ts) as real credential leaks. Test paths and *.test.* / *.spec.* files are now excluded from secret scanning, eliminating a common source of false-positive findings.
Scale plan + fair scoring
Renamed the Team plan to Scale (we weren't actually doing per-seat billing, so the name was misleading) and re-calibrated the scoring formula so large codebases score fairly.
- Feature
Plan rename: Team → Scale
Scale is $30/mo for 100 deep scans, a honest single-user power tier. Real multi-seat team billing is reserved for Enterprise where we can actually build it right (SSO, per-seat invoicing, admin dashboard).
- Fix
Fairer scoring on large codebases
Re-calibrated the scoring formula so one noisy category can't single-handedly tank your overall score. Projects with 100+ files now receive proportionally fair weighting instead of being over-penalized.
Actionable reports
The scan report used to be a one-shot diagnosis. Now every finding comes with a one-click prompt you can paste into Cursor or Claude Code, and the report opens with a scannable summary instead of a wall of text.
- Feature
Glanceable summary
New hero section at the top of every report: score + grade, 5-category mini-cards, and quick links to the Fix Plan and detailed report. What used to take 10 minutes to read now takes 30 seconds to scan.
- Feature
Copy AI Prompt on every finding
Every finding has a button that copies a drift-first Markdown block ready to paste into any AI coding assistant. The prompt names the peer baseline, lists reference files, and asks for a re-alignment refactor.
- Feature
Fix Plan widget
A top-of-report checklist of the 3–5 highest-impact drifts, with projected score gain if all are fixed. Includes a 'Copy full fix plan as AI context' bundler for one-shot multi-finding refactors.
- Feature
Visual finding cards
Per-type visualizations, pattern-consensus bars for architectural drift, route-matrix grids for security, similarity bars for duplicates. Each card communicates its finding in under two seconds.
- Feature
.vibedrift/context.md generation
New --write-context flag emits a living context file (plus fix-plan.md, fix-prompts.md, patterns.json) into your repo that AI agents can read alongside CLAUDE.md. Safe to commit.
- Polish
Detailed report opens in a new tab
The full 2000-line lab report is preserved, but now lives behind a clear CTA rather than scrolling below the summary. Keeps the default view fast without hiding anything.
Drift detection foundation
Earlier releases established the drift-detection engine, 13 cross-file detectors, dominance voting, Code DNA (semantic fingerprinting), and the paid deep-scan tier.
- Feature
13 drift detectors
Architectural consistency, naming conventions, security posture, semantic duplication, phantom scaffolding, import/export style, async patterns, return shapes, logging, comments, state management, and test structure.
- Feature
Code DNA engine
Semantic fingerprinting via MinHash + LSH, operation-sequence hashing, and taint-flow analysis. Catches near-duplicate functions that look completely different but behave identically.
- Feature
AI-synthesized fix prompts (deep tier)
On --deep scans, Claude Haiku synthesizes 'How the peers do this' prose from actual peer-file snippets. The AI prompt embeds real code from the files that follow the dominant pattern, grounded context instead of guesses.
Notes are public-facing, they describe user-visible changes, not internal implementation details. For the complete git log, see the npm release history.