selfguard 0.1.0 → 0.2.0

package/dist/api.js

@@ -5,7 +5,9 @@
  */
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
-import { clampDepth, DEFAULT_DEPTH, isExcluded, loadConfig, normalizeDir, saveConfig, } from "./config.js";
+import { activityOf } from "./activity.js";
+import { announce } from "./announce.js";
+import { clampDepth, DEFAULT_DEPTH, isExcluded, loadConfig, normalizeDir, REMIND_VALUES, saveConfig, } from "./config.js";
 import { discoverAll } from "./discover.js";
 import { tryLock } from "./fsutil.js";
 import { findProject } from "./lockfile/detect.js";
@@ -14,7 +16,8 @@ import { getVulns } from "./osv.js";
 import { countBySeverity, groupByPackage, worstSeverity } from "./report.js";
 import { repoIdentity } from "./repoid.js";
 import { clean } from "./sanitize.js";
-import { scanProjects } from "./scan.js";
+import { lockChanged, scanProjects } from "./scan.js";
+import { loadState, updateState } from "./state.js";
 import { forgetRepo, listRepos, loadRepo, saveRepo } from "./store.js";
 export class ApiError extends Error {
     code;
@@ -25,10 +28,13 @@ export class ApiError extends Error {
 }
 const advisoryUrl = (id) => `https://osv.dev/vulnerability/${encodeURIComponent(id)}`;
 // ---------- helpers ----------
-function summarize(rec) {
+function summarize(rec, activeDays = loadConfig().activeDays) {
+    const exists = existsSync(rec.path);
+    const repo = exists ? repoIdentity(rec.path) : null;
+    const activity = exists ? activityOf(repo, activeDays) : { active: false, lastActivity: null };
     return {
         path: rec.path,
-        exists: existsSync(rec.path),
+        exists,
         lockfile: rec.lockfile,
         lockType: rec.lockType,
         packages: rec.deps.length,
@@ -39,7 +45,9 @@ function summarize(rec) {
         vulnerablePackages: groupByPackage(rec.findings).length,
         advisories: rec.findings.length,
         bySeverity: countBySeverity(rec.findings),
-        repo: existsSync(rec.path) ? repoIdentity(rec.path) : null,
+        repo,
+        active: activity.active,
+        lastActivity: activity.lastActivity,
     };
 }
 export function toReport(rec) {
@@ -78,7 +86,8 @@ function resolveProject(path) {
 export function getStatus(opts = {}) {
     const rank = (w) => (w ? severityRank(w) : 99);
     const records = listRepos();
-    const summaries = records.map(summarize);
+    const activeDays = loadConfig().activeDays;
+    const summaries = records.map((r) => summarize(r, activeDays));
     const groups = new Map();
     summaries.forEach((p, i) => {
         const rec = records[i];
@@ -86,38 +95,114 @@ export function getStatus(opts = {}) {
         let g = groups.get(key);
         if (!g) {
             const label = p.repo?.label ?? (p.path.split("/").pop() || p.path);
-            g = { group: { key, label, worstSeverity: null, vulnerablePackages: 0, checkouts: [] }, pkgs: new Set(), findings: [] };
+            g = {
+                group: { key, label, active: false, worstSeverity: null, vulnerablePackages: 0, inactiveCheckouts: 0, checkouts: [] },
+                active: [],
+                all: [],
+            };
             groups.set(key, g);
         }
         g.group.checkouts.push({
             path: p.path,
             branch: p.repo?.branch ?? null,
             worktree: p.repo?.worktree ?? false,
+            orphaned: p.repo?.orphaned ?? false,
             exists: p.exists,
+            active: p.active,
+            lastActivity: p.lastActivity,
             worstSeverity: p.worstSeverity,
             vulnerablePackages: p.vulnerablePackages,
             advisories: p.advisories,
             error: p.error,
         });
-        for (const f of rec.findings)
-            g.pkgs.add(`${f.name}@${f.version}`);
-        g.findings.push(...rec.findings);
+        if (p.active)
+            g.active.push(...rec.findings);
+        else
+            g.group.inactiveCheckouts++;
+        g.all.push(...rec.findings);
     });
     const repos = [...groups.values()]
-        .map(({ group, pkgs, findings }) => {
-        group.worstSeverity = worstSeverity(findings);
-        group.vulnerablePackages = pkgs.size;
-        // main checkout first, then riskiest worktrees
-        group.checkouts.sort((a, b) => Number(a.worktree) - Number(b.worktree) || rank(a.worstSeverity) - rank(b.worstSeverity) || a.path.localeCompare(b.path));
+        .map(({ group, active, all }) => {
+        group.active = group.checkouts.some((k) => k.active);
+        const counted = group.active ? active : all;
+        group.worstSeverity = worstSeverity(counted);
+        group.vulnerablePackages = new Set(counted.map((f) => `${f.name}@${f.version}`)).size;
+        // active first, main checkout first, then riskiest
+        group.checkouts.sort((a, b) => Number(b.active) - Number(a.active) ||
+            Number(a.worktree) - Number(b.worktree) ||
+            rank(a.worstSeverity) - rank(b.worstSeverity) ||
+            a.path.localeCompare(b.path));
         return group;
     })
-        .filter((g) => !opts.onlyVulnerable || g.vulnerablePackages > 0)
-        .sort((a, b) => rank(a.worstSeverity) - rank(b.worstSeverity) || b.vulnerablePackages - a.vulnerablePackages || a.label.localeCompare(b.label));
+        .filter((g) => !opts.onlyVulnerable || g.checkouts.some((k) => k.vulnerablePackages > 0))
+        .sort((a, b) => Number(b.active) - Number(a.active) ||
+        rank(a.worstSeverity) - rank(b.worstSeverity) ||
+        b.vulnerablePackages - a.vulnerablePackages ||
+        a.label.localeCompare(b.label));
     const projects = summaries
         .filter((p) => !opts.onlyVulnerable || p.advisories > 0)
         .sort((a, b) => rank(a.worstSeverity) - rank(b.worstSeverity) || b.advisories - a.advisories || a.path.localeCompare(b.path));
     return { repos, projects };
 }
+/**
+ * Input for reminders: per repo, the findings of the checkout that represents it — the main
+ * clone if it is active, otherwise the most recently active checkout. Feature worktrees
+ * branched from an old base get fixed when they merge, so they don't count twice.
+ */
+export function getAttention() {
+    const activeDays = loadConfig().activeDays;
+    const best = new Map();
+    for (const rec of listRepos()) {
+        if (!existsSync(rec.path))
+            continue;
+        const repo = repoIdentity(rec.path);
+        const act = activityOf(repo, activeDays);
+        if (!act.active)
+            continue;
+        const key = repo?.key ?? `path:${rec.path}`;
+        const cand = { rec, repo, main: !(repo?.worktree ?? false), at: act.lastActivity ? Date.parse(act.lastActivity) : 0 };
+        const cur = best.get(key);
+        if (!cur || (cand.main && !cur.main) || (cand.main === cur.main && cand.at > cur.at))
+            best.set(key, cand);
+    }
+    return [...best.entries()]
+        .filter(([, b]) => b.rec.findings.length > 0)
+        .map(([key, b]) => ({
+        key,
+        label: b.repo?.label ?? (b.rec.path.split("/").pop() || b.rec.path),
+        path: b.rec.path,
+        branch: b.repo?.branch ?? null,
+        findings: b.rec.findings,
+    }));
+}
+/** All vulnerable packages of one repo group, merged across its checkouts (no network). */
+export function getRepoDetail(key) {
+    const group = getStatus().repos.find((g) => g.key === key);
+    if (!group)
+        throw new ApiError("not_found", "unknown repo");
+    const byPkg = new Map();
+    for (const k of group.checkouts) {
+        const rec = loadRepo(k.path);
+        if (!rec)
+            continue;
+        for (const p of toReport(rec).vulnerable) {
+            const id = `${p.name}@${p.version}`;
+            let entry = byPkg.get(id);
+            if (!entry) {
+                entry = { ...p, checkouts: [] };
+                byPkg.set(id, entry);
+            }
+            entry.checkouts.push({ path: k.path, branch: k.branch, active: k.active });
+        }
+    }
+    const rank = (p) => (p.checkouts.some((c) => c.active) ? 0 : 1);
+    const packages = [...byPkg.values()].sort((a, b) => rank(a) - rank(b) ||
+        severityRank(a.worstSeverity) - severityRank(b.worstSeverity) ||
+        Number(a.dev) - Number(b.dev) ||
+        Number(b.direct) - Number(a.direct) ||
+        a.name.localeCompare(b.name));
+    return { key: group.key, label: group.label, checkouts: group.checkouts, packages };
+}
 /** Last stored report for a project (no network). */
 export function getReport(path) {
     const project = resolveProject(path);
@@ -126,7 +211,7 @@ export function getReport(path) {
         throw new ApiError("not_tracked", `${project.root} is not tracked yet; scan it first`);
     return toReport(rec);
 }
-export async function scanPath(path) {
+export async function scanPath(path, opts = {}) {
     const project = resolveProject(path);
     const release = tryLock(`scan:${project.root}`);
     if (!release)
@@ -134,13 +219,14 @@ export async function scanPath(path) {
     try {
         const [o] = await scanProjects([project]);
         saveRepo(o.record);
+        await announce([o], { notify: opts.notify ?? false });
         return { project: toReport(o.record), firstScan: o.firstScan, newAdvisories: o.newFindings.length };
     }
     finally {
         release();
     }
 }
-export async function sync() {
+export async function sync(opts = {}) {
     const release = tryLock("sync");
     if (!release)
         throw new ApiError("busy", "a sync is already running");
@@ -169,6 +255,8 @@ export async function sync() {
         const outcomes = await scanProjects(projects);
         for (const o of outcomes)
             saveRepo(o.record);
+        await announce(outcomes, { notify: opts.notify ?? false });
+        updateState({ lastSync: new Date().toISOString() });
         return {
             projects: projects.length,
             discovered: discovered.map((p) => p.root),
@@ -204,6 +292,7 @@ export async function discoverNew(opts = {}) {
     const outcomes = await scanProjects(fresh);
     for (const o of outcomes)
         saveRepo(o.record);
+    await announce(outcomes, { notify: false });
     return {
         dryRun: false,
         found,
@@ -282,6 +371,84 @@ export function unexclude(path) {
     saveConfig(cfg);
     return { roots: cfg.roots, exclude: cfg.exclude, removed: cfg.exclude.length < before };
 }
+/**
+ * Re-scan only tracked projects whose lockfile changed (cheap stat first). Run by the
+ * lockfile watcher after `git pull`, installs or branch switches.
+ */
+export async function check(opts = {}) {
+    const release = tryLock("check");
+    if (!release)
+        throw new ApiError("busy", "a check is already running");
+    try {
+        const cfg = loadConfig();
+        const changed = [];
+        for (const r of listRepos()) {
+            if (!existsSync(r.path) || isExcluded(r.path, cfg.exclude))
+                continue;
+            const p = findProject(r.path);
+            if (p && p.root === r.path && p.lockfile && lockChanged(r, p))
+                changed.push(p);
+        }
+        updateState({ lastCheck: new Date().toISOString() });
+        if (changed.length === 0)
+            return { rescanned: [], errors: [] };
+        const outcomes = await scanProjects(changed);
+        for (const o of outcomes)
+            saveRepo(o.record);
+        await announce(outcomes, { notify: opts.notify ?? false });
+        return {
+            rescanned: outcomes.map((o) => o.record.path),
+            errors: outcomes.filter((o) => o.record.error).map((o) => ({ path: o.record.path, error: o.record.error })),
+        };
+    }
+    finally {
+        release();
+    }
+}
+/** Paths for the lockfile watcher: lockfile + folder of active checkouts, most recent first. */
+export function watchTargets() {
+    const cfg = loadConfig();
+    const items = [];
+    for (const r of listRepos()) {
+        if (!existsSync(r.path) || isExcluded(r.path, cfg.exclude))
+            continue;
+        const act = activityOf(repoIdentity(r.path), cfg.activeDays);
+        if (!act.active)
+            continue;
+        const paths = [r.path];
+        if (r.lockfile && existsSync(r.lockfile))
+            paths.push(r.lockfile);
+        items.push({ paths, at: act.lastActivity ? Date.parse(act.lastActivity) : 0 });
+    }
+    return items.sort((a, b) => b.at - a.at).flatMap((i) => i.paths);
+}
+export function getSettings() {
+    const cfg = loadConfig();
+    const st = loadState();
+    return {
+        remind: cfg.remind,
+        activeDays: cfg.activeDays,
+        lastReminder: st.lastReminder ?? null,
+        lastSync: st.lastSync ?? null,
+        lastCheck: st.lastCheck ?? null,
+    };
+}
+export function updateSettings(patch) {
+    const cfg = loadConfig();
+    if (patch.remind !== undefined) {
+        if (!REMIND_VALUES.includes(patch.remind))
+            throw new ApiError("invalid", "remind must be daily, weekly or off");
+        cfg.remind = patch.remind;
+    }
+    if (patch.activeDays !== undefined) {
+        const n = patch.activeDays;
+        if (typeof n !== "number" || !Number.isInteger(n) || n < 1 || n > 365)
+            throw new ApiError("invalid", "activeDays must be an integer between 1 and 365");
+        cfg.activeDays = n;
+    }
+    saveConfig(cfg);
+    return getSettings();
+}
 export async function getVulnerability(id) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(id))
         throw new ApiError("invalid", "invalid advisory id");

package/dist/cli.js

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
 import { parseArgs } from "node:util";
-import { buildAlert, deliver } from "./alerts.js";
+import { buildReminder, needsAttention } from "./alerts.js";
+import { maybeRemind } from "./announce.js";
 import * as api from "./api.js";
 import { GUIDE } from "./guide.js";
 import { hookEnter, ZSH_HOOK } from "./hook.js";
 import { findProject } from "./lockfile/detect.js";
 import { runMcpServer } from "./mcp.js";
-import { paint, renderFindings, severityLabel, tildify, worstSeverity } from "./report.js";
-import { repoIdentity } from "./repoid.js";
+import { groupByPackage, paint, renderFindings, severityLabel, tildify } from "./report.js";
 import { clean } from "./sanitize.js";
-import { parseInterval, scheduleOff, scheduleOn, scheduleStatus } from "./schedule.js";
+import { parseInterval, scheduleOff, scheduleOn, scheduleStatus, updateWatcher } from "./schedule.js";
 import { runSetup } from "./setup.js";
-import { findingKey, loadRepo } from "./store.js";
+import { loadRepo } from "./store.js";
 import { isInteractive } from "./tui.js";
+import { runUi } from "./ui/server.js";
 import { VERSION } from "./version.js";
 const HELP = `selfguard ${VERSION} — keeps an eye on the dependencies of every repo you work on
 
@@ -20,14 +21,25 @@ Setup:
   selfguard setup                    interactive: choose the folders where your repos live
   selfguard init zsh                 print the shell hook (eval "$(selfguard init zsh)" in ~/.zshrc)
   selfguard schedule on [--every 6h] | off | status
-                                     periodic sync with macOS notifications (launchd)
+                                     background watching with macOS notifications (launchd):
+                                     lockfile changes right away, full sync every 6h
+
+Dashboard and alerts:
+  selfguard ui [--no-open] [--port N]
+                                     local dashboard in your browser (127.0.0.1 only)
+  selfguard remind                   send the reminder of serious open issues now
+  selfguard settings [--remind daily|weekly|off] [--active-days N]
+                                     reminder frequency; days of git inactivity before a
+                                     checkout stops alerting (default 30)
 
 Projects:
-  selfguard status [--vulnerable] [--flat]
-                                     tracked repos, riskiest first (worktrees/clones grouped)
+  selfguard status [--vulnerable] [--flat] [--all]
+                                     tracked repos, riskiest first (worktrees/clones grouped;
+                                     inactive checkouts hidden unless --all)
   selfguard scan [dir] [-v]          scan a project now (exit 1 if vulnerable) and track it
   selfguard report [dir] [-v]        last scan results, no network
   selfguard sync                     find new repos in your folders + re-check everything
+  selfguard check                    re-scan only projects whose lockfile changed
   selfguard where <package>          which projects use <package>, which versions
   selfguard vuln <id>                details of an advisory and which projects it affects
 
@@ -59,20 +71,11 @@ function emit(data) {
 function usage(message) {
     throw new UsageError(message);
 }
-function notifyNew(outcomes) {
-    return deliver(buildAlert(outcomes
-        .filter((o) => o.newFindings.length > 0)
-        .map((o) => ({ path: o.record.path, newFindings: o.newFindings, repo: repoIdentity(o.record.path) }))));
-}
 /** Detached scan started by the shell hook: log + notify, never print to a terminal. */
 async function backgroundScan(path) {
     const stamp = new Date().toISOString();
     try {
-        const project = findProject(path);
-        const before = new Set((project ? loadRepo(project.root)?.findings ?? [] : []).map(findingKey));
-        const r = await api.scanPath(path);
-        const rec = loadRepo(r.project.path);
-        await notifyNew([{ record: rec, newFindings: rec.findings.filter((f) => !before.has(findingKey(f))), firstScan: r.firstScan }]);
+        const r = await api.scanPath(path, { notify: true });
         out.write(`${stamp} scan ${r.project.path}: ${r.project.advisories} finding(s)${r.project.error ? ` (${r.project.error})` : ""}\n`);
     }
     catch (e) {
@@ -111,7 +114,10 @@ function cmdReport(args) {
     return report.advisories > 0 ? 1 : 0;
 }
 function cmdStatus(args) {
-    const { values } = parseArgs({ args, options: { ...JSON_OPT, vulnerable: { type: "boolean" }, flat: { type: "boolean" } } });
+    const { values } = parseArgs({
+        args,
+        options: { ...JSON_OPT, vulnerable: { type: "boolean" }, flat: { type: "boolean" }, all: { type: "boolean" } },
+    });
     const status = api.getStatus({ onlyVulnerable: values.vulnerable ?? false });
     if (values.json) {
         emit(status);
@@ -135,7 +141,16 @@ function cmdStatus(args) {
         }
         return 0;
     }
-    for (const g of status.repos) {
+    const showAll = values.all ?? false;
+    let hiddenRepos = 0;
+    for (const g0 of status.repos) {
+        if (!g0.active && !showAll) {
+            hiddenRepos++;
+            continue;
+        }
+        const visible = showAll ? g0.checkouts : g0.checkouts.filter((k) => k.active);
+        const hiddenCheckouts = g0.checkouts.length - visible.length;
+        const g = { ...g0, checkouts: visible };
         const many = g.checkouts.length > 1;
         const firstError = g.checkouts.find((k) => k.error)?.error ?? null;
         // Headline: the main checkout; mention a branch that is worse than it.
@@ -152,31 +167,46 @@ function cmdStatus(args) {
                     : c.dim("clean");
         const head = worse ? `${mainText} ${c.yellow(`· ${worse.vulnerablePackages} on ${clean(worse.branch ?? "another checkout", 40)}`)}` : mainText;
         const where = many ? c.dim(`${g.checkouts.length} checkouts`) : c.dim(tildify(g.checkouts[0].path));
-        out.write(`${badge(g.worstSeverity, firstError)} ${c.bold(clean(g.label, 80))}  ${head}  ${where}\n`);
+        const more = hiddenCheckouts ? c.dim(` +${hiddenCheckouts} inactive`) : "";
+        const dimIf = (s) => (g.active ? s : c.dim(s));
+        out.write(`${badge(g.worstSeverity, firstError)} ${c.bold(dimIf(clean(g.label, 80)))}  ${head}  ${where}${more}\n`);
         if (!many)
             continue;
         g.checkouts.forEach((k, i) => {
             const branch = k.branch ? c.cyan(clean(k.branch, 50)) : c.dim("(no branch)");
-            const kind = k.worktree ? c.dim(" worktree") : "";
+            const kind = (k.worktree ? c.dim(" worktree") : "") + (k.active ? "" : c.dim(` inactive${k.lastActivity ? ` ${ago(k.lastActivity)}` : ""}`));
             const detail = k.advisories ? `${k.vulnerablePackages} vulnerable` : k.error ? c.dim(clean(k.error, 60)) : c.dim("clean");
             const tree = i === g.checkouts.length - 1 ? "└" : "├";
             out.write(`   ${c.dim(tree)} ${branch}${kind}  ${detail}  ${c.dim(tildify(k.path))}${k.exists ? "" : c.dim(" (missing)")}\n`);
         });
     }
+    if (hiddenRepos)
+        out.write(c.dim(`${hiddenRepos} inactive repo(s) hidden (no git activity in ${api.getSettings().activeDays} days). Show them with --all.\n`));
     return 0;
 }
+function ago(iso) {
+    const days = Math.floor((Date.now() - Date.parse(iso)) / 86_400_000);
+    return days < 1 ? "today" : days < 60 ? `${days}d ago` : `${Math.floor(days / 30)}mo ago`;
+}
 async function cmdSync(args) {
     const { values } = parseArgs({ args, options: { ...JSON_OPT, background: { type: "boolean" } } });
     let r;
     try {
-        r = await api.sync();
+        r = await api.sync({ notify: true });
     }
     catch (e) {
         if (values.background && e instanceof api.ApiError && e.code === "busy")
             return 0;
         throw e;
     }
-    await notifyNew(r.outcomes);
+    try {
+        updateWatcher(api.watchTargets());
+    }
+    catch (e) {
+        err.write(`selfguard: could not update the lockfile watcher: ${clean(e.message, 200)}\n`);
+    }
+    if (values.background)
+        await maybeRemind(api.getAttention);
     const { outcomes: _o, ...data } = r;
     const total = data.news.reduce((n, p) => n + p.packages.length, 0);
     if (values.json)
@@ -200,6 +230,93 @@ async function cmdSync(args) {
     }
     return 0;
 }
+async function cmdCheck(args) {
+    const { values } = parseArgs({ args, options: { ...JSON_OPT, background: { type: "boolean" } } });
+    let r;
+    try {
+        r = await api.check({ notify: true });
+    }
+    catch (e) {
+        if (values.background && e instanceof api.ApiError && e.code === "busy")
+            return 0;
+        throw e;
+    }
+    if (values.background) {
+        if (r.rescanned.length)
+            out.write(`${new Date().toISOString()} check: re-scanned ${r.rescanned.join(", ")}\n`);
+        await maybeRemind(api.getAttention);
+    }
+    else if (values.json)
+        emit(r);
+    else
+        out.write(r.rescanned.length ? `Re-scanned ${r.rescanned.length} project(s) with changed lockfiles.\n` : "No lockfile changed.\n");
+    return 0;
+}
+async function cmdRemind(args) {
+    const { values } = parseArgs({ args, options: { ...JSON_OPT, "dry-run": { type: "boolean" } } });
+    const repos = api.getAttention();
+    const alert = buildReminder(repos);
+    const sent = values["dry-run"] ? false : await maybeRemind(repos, { force: true });
+    const serious = repos
+        .map((r) => ({ repo: r.label, packages: groupByPackage(r.findings.filter(needsAttention)) }))
+        .filter((r) => r.packages.length > 0);
+    if (values.json) {
+        emit({
+            sent,
+            notification: alert.kind === "none" ? null : { title: alert.title, subtitle: alert.subtitle, body: alert.body },
+            repos: serious.map((r) => ({
+                repo: r.repo,
+                packages: r.packages.map((g) => ({ name: g.name, version: g.version, worstSeverity: g.worst, upgradeTo: g.upgradeTo ?? null, direct: g.direct })),
+            })),
+        });
+        return 0;
+    }
+    const c = paint(out);
+    if (serious.length === 0) {
+        out.write(`${c.green("✓")} Nothing serious open in your active repos (malicious packages, critical vulnerabilities, or high ones in direct dependencies).\n`);
+        return 0;
+    }
+    for (const r of serious) {
+        out.write(`${c.bold(clean(r.repo, 80))}\n`);
+        for (const g of r.packages.slice(0, 6)) {
+            const fix = g.worst === "malicious" ? c.red("remove it") : g.upgradeTo ? c.green(`→ ${clean(g.upgradeTo, 40)}`) : c.yellow("no fix yet");
+            out.write(`  ${severityLabel(g.worst, c)} ${clean(g.name, 100)}@${clean(g.version, 40)} ${c.dim(g.direct ? "direct" : "transitive")} ${fix}\n`);
+        }
+        if (r.packages.length > 6)
+            out.write(c.dim(`  …and ${r.packages.length - 6} more (selfguard ui)\n`));
+    }
+    out.write(c.dim(sent ? "\nNotification sent.\n" : "\n"));
+    return 0;
+}
+function cmdSettings(args) {
+    const { values } = parseArgs({ args, options: { ...JSON_OPT, remind: { type: "string" }, "active-days": { type: "string" } } });
+    const patch = {};
+    if (values.remind !== undefined)
+        patch.remind = values.remind;
+    if (values["active-days"] !== undefined)
+        patch.activeDays = Number(values["active-days"]);
+    const s = Object.keys(patch).length ? api.updateSettings(patch) : api.getSettings();
+    if (values.json)
+        emit(s);
+    else {
+        out.write(`remind        ${s.remind}${s.lastReminder ? paint(out).dim(`  (last ${s.lastReminder})`) : ""}\n`);
+        out.write(`active-days   ${s.activeDays}\n`);
+        if (s.lastSync)
+            out.write(paint(out).dim(`last sync     ${s.lastSync}\n`));
+    }
+    return 0;
+}
+async function cmdUi(args) {
+    const { values } = parseArgs({
+        args,
+        options: { "no-open": { type: "boolean" }, port: { type: "string" }, serve: { type: "boolean" } },
+    });
+    const port = values.port === undefined ? 0 : Number(values.port);
+    if (!Number.isInteger(port) || port < 0 || port > 65535)
+        usage("--port must be a port number");
+    await runUi({ port, open: !values["no-open"], foreground: values.serve ?? false, log: (line) => out.write(`${line}\n`) });
+    return 0;
+}
 async function cmdDiscover(args) {
     const { values } = parseArgs({ args, options: { ...JSON_OPT, "dry-run": { type: "boolean" } } });
     const r = await api.discoverNew({ dryRun: values["dry-run"] ?? false });
@@ -347,11 +464,12 @@ function cmdSchedule(args) {
     switch (positionals[0]) {
         case "on": {
             const seconds = parseInterval(values.every ?? "6h");
-            const plist = scheduleOn(seconds);
+            const targets = api.watchTargets();
+            const plist = scheduleOn(seconds, targets);
             if (values.json)
-                emit({ enabled: true, intervalSeconds: seconds, plist, node: process.execPath });
+                emit({ enabled: true, intervalSeconds: seconds, plist, node: process.execPath, watchedPaths: targets.length });
             else {
-                out.write(`Background sync every ${values.every}. (${tildify(plist)})\n`);
+                out.write(`Background sync every ${values.every}, plus instant checks when a lockfile changes. (${tildify(plist)})\n`);
                 out.write(`Note: it runs with ${process.execPath}; re-run this if you change Node versions.\n`);
             }
             return 0;
@@ -361,7 +479,7 @@ function cmdSchedule(args) {
             if (values.json)
                 emit({ enabled: false, wasEnabled: was });
             else
-                out.write(was ? "Background sync disabled.\n" : "Background sync was not enabled.\n");
+                out.write(was ? "Background sync and lockfile watcher disabled.\n" : "Background sync was not enabled.\n");
             return 0;
         }
         case "status":
@@ -369,8 +487,11 @@ function cmdSchedule(args) {
             const s = scheduleStatus();
             if (values.json)
                 emit(s);
-            else
+            else {
                 out.write(s.loaded ? `enabled (${tildify(s.plist)})\n` : s.installed ? "installed but not loaded\n" : "disabled\n");
+                if (s.loaded)
+                    out.write(s.watcher.loaded ? `lockfile watcher: ${s.watcher.paths} path(s)\n` : "lockfile watcher: not running (run selfguard sync)\n");
+            }
             return 0;
         }
         default:
@@ -402,6 +523,14 @@ async function main(argv) {
             return cmdStatus(rest);
         case "sync":
             return cmdSync(rest);
+        case "check":
+            return cmdCheck(rest);
+        case "remind":
+            return cmdRemind(rest);
+        case "settings":
+            return cmdSettings(rest);
+        case "ui":
+            return cmdUi(rest);
         case "discover":
             return cmdDiscover(rest);
         case "roots":

package/dist/config.js

@@ -5,6 +5,8 @@ import { atomicWrite, isObject, readJsonFile } from "./fsutil.js";
 import { stateRoot } from "./paths.js";
 export const DEFAULT_DEPTH = 5;
 export const MAX_DEPTH = 10;
+export const DEFAULT_ACTIVE_DAYS = 30;
+export const REMIND_VALUES = ["daily", "weekly", "off"];
 const configFile = () => join(stateRoot(), "config.json");
 export function loadConfig() {
     const raw = readJsonFile(configFile());
@@ -18,7 +20,11 @@ export function loadConfig() {
         }
     }
     const exclude = raw && isObject(raw) && Array.isArray(raw.exclude) ? raw.exclude.filter((e) => typeof e === "string") : [];
-    return { schema: 1, roots, exclude };
+    const remind = raw && isObject(raw) && REMIND_VALUES.includes(raw.remind) ? raw.remind : "daily";
+    const activeDays = raw && isObject(raw) && typeof raw.activeDays === "number" && raw.activeDays >= 1
+        ? Math.min(365, Math.trunc(raw.activeDays))
+        : DEFAULT_ACTIVE_DAYS;
+    return { schema: 1, roots, exclude, remind, activeDays };
 }
 export function isExcluded(path, exclude) {
     return exclude.some((e) => path === e || path.startsWith(e.endsWith("/") ? e : `${e}/`));