What's new in VibeDrift.

The "since last scan" comparison now refuses to diff two scans scored under different methods, in the terminal and in the committed .vibedrift/context.md alike, including when --since targets an older scan. The first scan after an upgrade simply shows no comparison; normal diffs resume from the very next scan.

After a deep scan, the default summary now carries a short AI Deep Analysis block: the coherence grade, the top AI finding, and how many findings the AI validated, with a pointer to the full analysis. No flags to remember, and regular scans are unchanged.

Routes registered through Fiber and Gorilla mux routers now count in the auth-consistency check, so an unauthed state-changing route in those frameworks is flagged like its Gin and Echo peers.

An import mentioned inside a comment or a string no longer shows up as dependency drift, and files with special characters in their names classify correctly.

VibeDrift reads the middleware or hook that guards each route and decides whether it actually authenticates, across Flask, FastAPI, and Django, across Gin and Echo, and across Axum, Actix, and Rocket. It only calls a route protected when the guard verifiably rejects unauthenticated requests, so a route is never marked safe on a name alone.

When a guard is imported from another file, VibeDrift follows the import and reads the real body. When it genuinely cannot tell, because a guard is opaque or third-party, it names the hook and asks you to double check, rather than quietly marking the route authenticated or unprotected.

Import and dependency analysis now parses your real syntax instead of matching text, so an import mentioned in a comment or a string no longer shows up as dependency drift.

Express .all() routes and Flask @app.route(methods=[...]) routes were being skipped by the auth check, so a repo could carry an unauthed state-changing route that produced no finding at all. They're now read by their real method: a mutating route with no guard is flagged, while read-only routes stay clean, so plain GETs never trip a false alarm.

The MCP tools your agent calls in-loop are more accurate about auth. check_file_drift no longer calls a file clean when it has an unauthed route, get_dominant_pattern flags when a convention is drawn from too few routes to trust, and the repo baseline rebuilds itself after an upgrade instead of answering from a stale one.

Exports used only through a dynamic import (const { thing } = await import('./module.js')) are now recognized as used. Lazy-loaded modules, common in CLIs and code-split apps, are no longer flagged as unused, and the files they load are no longer counted as orphaned. The dead-code findings you see are the real ones.

Dependency Health had no drift check yet, so it always showed "N/A" — a permanently-empty category. It's no longer shown as a drift dimension; the dependency signals we do have (unused / phantom packages) still feed the Hygiene score. The Vibe Drift Score now shows four drift dimensions.

Recurring test-fixture helpers, and functions that merely share a control-flow shape rather than real duplicated logic, are no longer flagged as duplicates. The duplicates you see are the ones actually worth consolidating.

A category with nothing to score now tells you why instead of a bare "N/A": Dependency Health reads "not yet measured", and every other category reads "no findings in this repo".

File discovery now skips vendored and minified files, so bundled third-party code doesn't drag on your results.

Inlines VibeDrift's view of your repo's dominant patterns into CLAUDE.md inside an idempotent managed block, so AI agents write code that matches your conventions. Pairs with --write-context to refresh everything in one pass.

On a deep scan, when the same functions are redundantly reimplemented across many files at high density — a hallmark of AI-assisted sprawl — that now lowers your Vibe Drift Score. A stray parallel or legacy implementation in an otherwise well-structured codebase is left alone; only genuine concentration counts, so clean code is never penalized.

The Vibe Drift Score, category breakdown, and Fix Plan print as soon as the scan finishes. The slower steps — AI fix prompts on Pro, and syncing to your dashboard — then run behind clear progress indicators instead of a silent wait.

A signed-in scan links straight to its project on your dashboard, where the full report, score history, and trends live, instead of opening a local HTML file.

Signed-out scans are no longer limited to a summary. You get the complete report — every finding, drift detail, and exact duplicate — served locally and opened in your browser.

The standalone HTML report, both the summary and the detailed view, has been redesigned.

Exported types and helpers used within their own file, symbols re-exported through a barrel (export { x } from './y'), and Web Worker entry files loaded via new Worker() / getURL() are now recognized as live instead of being reported as unused.

Two short functions that differ only by the values they check (e.g. distinct string constants) are no longer called exact duplicates, and unrelated functions that merely share a common shape are no longer flagged as near-duplicates.

Packages used only in build config (e.g. webpack loaders and plugins) are recognized as used instead of being reported as phantom dependencies.

A file is judged by its dominant error-handling style, so a single defensive rethrow no longer flips it to “throws”; state objects with a status field aren’t mislabeled as error returns; and single-word filenames are treated as convention-neutral.

The projected score and its gain are shown on one consistent scale, and categories that weren’t measured are labeled as such instead of folding silently into the grade.

vibedrift . --json now emits only JSON on stdout (status messages go to stderr), so piping into jq or a CI step never breaks on a stray line.

A guided one-time setup. It detects likely fixtures and generated code, asks which paths to skip, your CI score floor, and your default report format, then writes a committable .vibedriftignore and .vibedrift/config.json so your whole team scans the same way.

Add a .vibedriftignore (gitignore syntax) or run `vibedrift ignore "**/fixtures/**"`. Excluded paths stop counting toward your score, and the rule is honored by both the CLI and the MCP server, so test fixtures and generated code no longer drag your score down.

.vibedrift/config.json now holds your default report format and CI score floor, so you don't repeat flags on every run. An explicit flag always overrides it.

The MCP server adds an init tool, so an AI agent can configure a fresh repo in-loop: detect fixtures, write the config, and apply the exclusions you approve, all without leaving the editor.

A deep scan on a project with no duplicate findings could report an inflated score. Deep-scan results now incorporate every finding, so the headline score matches what the scan actually found.

A small project with no findings used to earn a near-perfect score just for being small. Scores now weigh how much code was analyzed: a tiny project lands near the typical score, while a large genuinely-clean project still scores near the top.

This release refines how the score is computed. Your past scores keep their grade, a one-time notice explains the shift, and delta arrows resume on your next scan.

Run with VIBEDRIFT_DEBUG=1 (or --verbose) to see the scan's stage-by-stage detail — handy when wiring VibeDrift into CI or an agent loop.

The Vibe Drift Score was compressed near the top, so almost everything landed 90+. It now uses the full range and drops on real drift — so the number actually tells you something.

A category's health now reflects how many distinct patterns drift and how badly, not the raw number of findings (which grew with repo size). A large, clean codebase no longer scores lower just for being large.

The deep-scan coherence report — the ranked, codebase-wide consistency audit — is now included in --json output, so CI and tooling can consume it.

get_dominant_pattern, find_similar_function, check_file_drift, validate_change, and get_intent_hints now run for everyone, including signed-out users. They read your code on your machine and never send it, so your agent can match your repo's patterns the first time, on any project, with no account and no setup beyond pointing it at the server. Only the opt-in cloud deep checks draw from a budget.

When a lot has changed since your last deep scan, your agent now offers to run one without leaving your session. Say yes and the deep findings come back inline. If your deep-scan budget is empty, it points you to upgrade or grab a credit pack instead of stopping you cold.

Need deep scans without committing to a plan? Buy a one-time credit pack any time: 25 deep scans for $20, 50 for $35, or 100 for $60. Credits drop straight into your shared scan pool and never expire on a monthly cycle. Anyone can buy them, with or without a subscription, and they stack on top of whatever your plan already gives you.

Add `deep: true` to validate_change or find_similar_function and the agent gets intent-mismatch detection (a name that lies about what the code does) plus Claude-validated semantic duplicates on the single function it's checking, caught while writing, not in a later review.

The five core tools are still 100% local. Deep mode is the one opt-in exception, and it sends only the single function being checked, nothing else leaves your machine.

Each in-loop deep check draws just 1/50 of a deep scan from the same monthly pool you already have, so normal use barely dents it. An hourly cap keeps an agent loop from running away, and if you're out of budget the check quietly falls back to the local result instead of erroring.

Your agent calls these on its own as it works: get_dominant_pattern (the repo's convention for a dimension + examples to copy), find_similar_function (does a near-duplicate already exist?), check_file_drift (does this file match the repo?), validate_change (would this change introduce drift or a duplicate?), and get_intent_hints (the conventions your CLAUDE.md / AGENTS.md declare).

Until now VibeDrift ran after the fact, you scanned, then fixed. Inside the agent loop it answers before the code lands, so new functions match your repo's patterns the first time. Every answer comes back in well under a second because a normal scan caches a drift baseline the server loads once.

The MCP server is included with Pro and Team. The tools read your code on your machine, your code never leaves; only your plan is read from your local sign-in. It's the same engine that powers a normal scan, exposed as agent tools.

On a deep scan, the ambiguous calls, “are these two functions really duplicates?”, “does this name match what the function does?”, are now confirmed or rejected by an AI reviewer before they reach your report. Confirmed findings are kept; false positives are dropped with a recorded reason. The findings that remain are the ones worth your attention.

Two functions that share structure but do different work, for example the same query shape against two different database tables, are no longer mistaken for duplicates. Deep scan now keys on what the code actually references, so genuine copy-paste duplicates still surface while look-alikes don't.

The Vibe Drift Score now incorporates the complete set of cross-file consistency signals, semantic duplication, naming, async patterns, import and export conventions, and phantom scaffolding, not just a subset. On a drifted codebase your score will be lower and more discerning; that's the measurement getting sharper, not your code getting worse overnight.

When our scoring changes, we recompute your past scans under the new scoring automatically, so trend lines and 'since last scan' deltas compare like-with-like instead of jumping at the upgrade. You'll see a single one-time note pointing at these release notes, no version numbers, nothing to re-run on your part.

Scans are now fully deterministic: the same commit produces a byte-identical report and names the same 'worst drifting file' on your laptop and in CI, regardless of operating system or locale.

When your CLAUDE.md or AGENTS.md declares a convention your codebase hasn't actually converged on, VibeDrift now flags the gap instead of treating the declaration as proof you already follow it.

Drift composite is now /100 instead of /80. The internal math is unchanged (4 applicable categories × 20 = 80 raw); the engine normalizes at the boundary so the headline matches user expectations from SonarQube, Lighthouse, etc. Hygiene was already /100. Grades come from the percentage so they're identical to prior versions.

Deep scans on monorepos like shadcn-ui (3,500+ files) used to silently fail to upload because the result blob exceeded the API's body-size cap. The CLI now compacts the payload progressively before uploading, stripping heavy bookkeeping fields in priority order until it fits, and surfaces any remaining failure with a visible warning instead of swallowing it.

Previously you had to run with `--verbose` to see if your scan made it to the dashboard. Now any upload failure shows a clear `⚠ Couldn't upload to dashboard` line at the end of the scan, with the reason and payload size. Successful uploads with trimming print a `ⓘ Result trimmed for upload: 39MB → 8MB` note so you know what happened.

A semantic-duplicate group spanning 60+ files (common in registry-style codebases with theme variants) used to produce a single 30–40 KB finding with the entire member list inline. The finding now caps the displayed names and locations and surfaces the total count separately, keeping the report scannable while preserving every piece of scoring signal.

VibeDrift now flags functions whose bodies are placeholder returns: `return "unvalidated"`, `return "not implemented"`, `raise NotImplementedError`, `panic("not implemented")`, `unimplemented!()`. Works across JavaScript, TypeScript, Python, Go, and Rust. Catches half-finished code that ships to production.

A TODO within five lines of a placeholder return or NotImplementedError is now a warning, not a buried info line. One TODO sitting next to a stub is orders of magnitude more actionable than ten scattered TODOs in a messy module.

VibeDrift now runs on every PR to the VibeDrift API repo itself. If a stub ever slips into review again, the drift detector will point at it before merge. Same GitHub Action any team can add in two minutes.

Run `vibedrift . --write-context` and VibeDrift writes a .vibedrift/ folder with context.md, fix-plan.md, fix-prompts.md, and patterns.json. Commit it alongside your CLAUDE.md. Your AI coding agent reads it on every new turn and knows which pattern to match, no more cold starts, no more drift across sessions.

`vibedrift watch` runs alongside your Cursor or Claude Code session and refreshes the context files on every file save. Zero network calls. The next AI turn always sees up-to-date peer patterns, even mid-refactor.

--write-context and watch mode both now require a free vibedrift login. The .vibedrift/ files carry the full finding surface, same gate as the one-shot HTML report. Sign up once (no card, 30 seconds), and both work everywhere.

When a newer @vibedrift/cli is available, the scan output now shows a dim one-liner at the end pointing at `vibedrift update`. Cached for 24 hours so it never slows a scan. Respects --local-only and telemetry opt-out.

vibedrift watch now checks for a local auth token before starting. This closes a gate that let an unsigned user get continuous full-finding output, which the one-shot scan gates behind a free account.

The headline score now measures cross-file pattern consistency, the thing VibeDrift was built to detect, and nothing else. Generic hygiene signals still render in a clearly labeled separate pane and get their own score, so nothing is hidden. If you gate CI on --fail-on-score, recalibrate after upgrading: the drift composite's max shifted from 100 to 80.

New vibedrift watch subcommand rescans on every file change and refreshes .vibedrift/context.md, fix-plan.md, and patterns.json. Point it at your project while your AI agent is working, every new turn, the agent sees up-to-date peer patterns and fix prompts. Local only, zero network calls, debounced so a burst of edits triggers one scan.

Every scan now compares to the previous one: ✓ Resolved, ✗ New, and score delta, right in the header. Finding identity survives small line shifts so moving code doesn't produce phantom 'new' findings. Use --since <scanId> to compare against any earlier saved scan.

New drift signal that reads your git history. Flags files written in a single burst by a single author when the rest of the directory was cultivated across time and contributors. It's a shape-of-authorship signal no linter has access to, useful for catching AI-generated files that shipped without human review.

When you run a free local scan, the upsell for deep scan used to be generic marketing copy. Now it names the exact near-duplicate function pairs, opaque function names, and mixed-pattern files that deep scan would confirm. You see what you're missing, not a banner.

When your repo root has a CLAUDE.md, AGENTS.md, or .cursorrules that declares 'use the repository pattern,' 'named exports only,' 'structured logging with winston,' or similar, VibeDrift now uses those declarations to bias the dominance vote across nine drift detectors. If your docs say one thing and your code does another, the divergence is flagged with a citation back to the source line.

Every PR gets an auto-updating comment showing the score delta vs main, new drifts introduced, and a consequence line for each. Updates on each push, no comment spam.

Set fail-on-score to block merges when the drift score drops below your threshold. Keeps the codebase consistent without manual review overhead.

Add a 10-line workflow file + your VIBEDRIFT_TOKEN secret. Free scans are unlimited in CI, deep scans use your monthly budget.

The premium feature, AI-authored prose describing how peer files implement the dominant pattern, was silently broken since launch. Now works on every logged-in scan. The 'How the peers do this' section appears in Copy AI Prompt blocks for findings with reference files.

Every finding in the Fix Plan shows a one-line consequence: what happens if you don't fix it. Security flaws, architectural drift, duplicates, missing deps, each has a concrete 'why this matters' annotation.

Security findings surface first, architectural contradictions second, semantic duplicates third. The Fix Plan shows the highest-stakes cross-file drift, not linter-grade complexity warnings.

VibeDrift sends a lightweight anonymous ping per scan (language, file count, scan time, CLI version), on by default for everyone whether you are signed in or not. No code, no file paths, no identifiers. Opt out anytime with `vibedrift telemetry disable` (or set VIBEDRIFT_TELEMETRY_DISABLED=1), or run `--local-only` for a fully offline scan.

Skip ALL network calls even when logged in, no scan log, no beacon, no deep analysis. Use this in air-gapped environments, on sensitive codebases, or when you want a pure offline scan.

New subcommand to manage telemetry preferences. Persisted in config. First-run notice shown once on first scan explaining what's collected and how to opt out.

Every file's vote is now multiplied by a recency factor, newer code outvotes older code with a 90-day half-life. Three fresh handlers adopting the repository pattern can now correctly outweigh ten old raw-SQL handlers the team is migrating away from.

When recent files lean toward a new pattern while legacy files hold the old one, VibeDrift now recognizes the migration and reclassifies old files as legacy (not drift). Old code you're planning to migrate is no longer treated as urgent drift.

Each deviating file is now aligned, legacy, or drift, with different copy-paste fix prompts for each. Legacy files get 'consider migrating' framing; true drift gets 'fix now.'

VibeDrift parses CLAUDE.md, AGENTS.md, .cursorrules, and AGENT.md in your repo root. When your declared convention disagrees with your actual code, that divergence is surfaced prominently in findings with a direct citation to the source file and line.

The secret-detection scanner no longer flags deliberate test strings (e.g. hardcoded 'AKIA...' in security.test.ts) as real credential leaks. Test paths and *.test.* / *.spec.* files are now excluded from secret scanning, eliminating a common source of false-positive findings.

Scale is $30/mo for 100 deep scans, a honest single-user power tier. Real multi-seat team billing is reserved for Enterprise where we can actually build it right (SSO, per-seat invoicing, admin dashboard).

Re-calibrated the scoring formula so one noisy category can't single-handedly tank your overall score. Projects with 100+ files now receive proportionally fair weighting instead of being over-penalized.

New hero section at the top of every report: score + grade, 5-category mini-cards, and quick links to the Fix Plan and detailed report. What used to take 10 minutes to read now takes 30 seconds to scan.

Every finding has a button that copies a drift-first Markdown block ready to paste into any AI coding assistant. The prompt names the peer baseline, lists reference files, and asks for a re-alignment refactor.

A top-of-report checklist of the 3–5 highest-impact drifts, with projected score gain if all are fixed. Includes a 'Copy full fix plan as AI context' bundler for one-shot multi-finding refactors.

Per-type visualizations, pattern-consensus bars for architectural drift, route-matrix grids for security, similarity bars for duplicates. Each card communicates its finding in under two seconds.

New --write-context flag emits a living context file (plus fix-plan.md, fix-prompts.md, patterns.json) into your repo that AI agents can read alongside CLAUDE.md. Safe to commit.

The full 2000-line lab report is preserved, but now lives behind a clear CTA rather than scrolling below the summary. Keeps the default view fast without hiding anything.

Architectural consistency, naming conventions, security posture, semantic duplication, phantom scaffolding, import/export style, async patterns, return shapes, logging, comments, state management, and test structure.

Semantic fingerprinting via MinHash + LSH, operation-sequence hashing, and taint-flow analysis. Catches near-duplicate functions that look completely different but behave identically.

On --deep scans, Claude Haiku synthesizes 'How the peers do this' prose from actual peer-file snippets. The AI prompt embeds real code from the files that follow the dominant pattern, grounded context instead of guesses.