symbiot 0.7.0 → 0.9.2

package/README.md

@@ -52,6 +52,24 @@ where no Chromium-family browser is found it opens your default browser instead.
 npm install -g symbiot        # or run without installing:  npx symbiot week
 ```
 
+## What's out of sync? `symbiot drift`
+
+```bash
+symbiot drift          # add --ci to also check GitHub Actions state (needs gh)
+```
+
+A **deterministic** report of what's out of sync, stuck, or at risk across your
+repos — computed from git facts, each line citing the fact behind it (no model
+guessing). It flags: **stale checkouts**, **behind upstream**, **multiple
+worktrees**, **branches with work not on the default**, **PR merges that landed
+off the default branch** (the "merged but main didn't move" trap), and — if you
+configure it — **production running code that isn't on your default branch**.
+
+For the production check, add a per-repo deploy command to
+`~/.config/symbiot/deploys.json` (read only from your own config, never from a
+repo), e.g. `{ "/path/to/repo": "ssh prod cat ~/app/.deployed-sha" }`. Also a
+**Drift** tab in the app.
+
 ## Which model? Ask your machine
 
 ```bash
@@ -105,9 +123,13 @@ Point it somewhere specific with `--dir ~/work`.
 
 - **Reads:** your local git — commit messages and changed-file names, plus
   `TODO`/`FIXME` markers and uncommitted changes for `todo`. All local.
-- **Sends to the AI:** only those commit/TODO summaries, so it can write the
-  update. Not your code, not file contents. With a **local Ollama model,
-  nothing leaves your machine at all.**
+- **Sends to the AI:** commit messages and dates, changed-file **names**, the
+  folder structure, `TODO`/`FIXME` lines, and (for a repo review) an excerpt of
+  the README and any `CLAUDE.md`/`AGENTS.md` conventions. It does **not** send
+  whole source files. With a **local Ollama model, nothing leaves your machine.**
+- **Shows its work:** every report ends with a footer — path, branch, how many
+  commits matched you (e.g. "1090 of 1101"), the README's age, and the
+  working-tree state — so you can see exactly what it read.
 - **Never:** no keylogging, no screen capture, no browsing history, no accounts.
 
 ## Config

package/index.mjs

@@ -21,10 +21,14 @@ import Anthropic from "@anthropic-ai/sdk";
 import { execSync, spawn } from "node:child_process";
 import { homedir, totalmem, cpus as oscpus } from "node:os";
 import { join } from "node:path";
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, statSync } from "node:fs";
 import { createInterface } from "node:readline";
 import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const HERE = fileURLToPath(new URL(".", import.meta.url));
+let VERSION = "0"; try { VERSION = JSON.parse(readFileSync(join(HERE, "package.json"), "utf8")).version; } catch {}
 
 const MAX_REPOS = 14;
 const MAX_COMMITS = 140;
@@ -144,19 +148,128 @@ function ask(question, { secret = false } = {}) {
 
 // ---- git ------------------------------------------------------------------
 function sh(cmd) {
-  try { return execSync(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 32 * 1024 * 1024 }); }
-  catch { return ""; }
+  try { return execSync(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 32 * 1024 * 1024, timeout: 6000, killSignal: "SIGKILL" }); }
+  catch { return ""; } // timeout or error -> empty, never hang the scan
+}
+// find .git dirs quickly by PRUNING heavy trees (node_modules etc.) instead of
+// crawling into them — this is the big speedup for the map scan.
+function findGitDirs(base, limit) {
+  return sh(
+    `find ${JSON.stringify(base)} -maxdepth 6 ` +
+    `\\( -name node_modules -o -name .cache -o -name .local -o -name .npm -o -name venv -o -name .venv -o -name .git-crypt \\) -prune ` +
+    `-o -name .git -print 2>/dev/null | head -${limit}`,
+  ).split("\n").filter(Boolean);
 }
 function me() {
   return { email: sh("git config --global user.email").trim(), name: sh("git config --global user.name").trim() };
 }
+
+// ---- accurate repo signals (the field-report fixes) -----------------------
+// All author identities in this repo that plausibly belong to the current user,
+// with a fallback when the filter would keep almost nothing of an active repo.
+function authorship(repoPath) {
+  const gName = sh("git config --global user.name 2>/dev/null").trim();
+  const gEmail = sh("git config --global user.email 2>/dev/null").trim();
+  const rEmail = sh(`git -C ${JSON.stringify(repoPath)} config user.email 2>/dev/null`).trim();
+  const rName = sh(`git -C ${JSON.stringify(repoPath)} config user.name 2>/dev/null`).trim();
+  const total = Number(sh(`git -C ${JSON.stringify(repoPath)} rev-list --count HEAD 2>/dev/null`).trim()) || 0;
+  const rows = sh(`git -C ${JSON.stringify(repoPath)} log --format='%ae|%an' 2>/dev/null | sort | uniq -c | sort -rn | head -60`)
+    .split("\n").map((l) => l.trim()).filter(Boolean).map((l) => {
+      const m = l.match(/^(\d+)\s+(.*)$/); if (!m) return null;
+      const parts = m[2].split("|"); return { count: Number(m[1]), email: parts[0], name: parts.slice(1).join("|") };
+    }).filter(Boolean);
+  const myEmails = new Set([rEmail, gEmail].filter(Boolean));
+  const myNames = new Set([gName, rName].filter(Boolean).map((n) => n.toLowerCase()));
+  const nameKeys = new Set([...myNames].map((n) => n.replace(/\s+/g, "")));
+  const mine = new Set();
+  for (const r of rows) {
+    const nore = r.email.match(/^\d+\+(.+)@users\.noreply\.github\.com$/i);
+    const isMine = (r.email && myEmails.has(r.email))
+      || (r.name && myNames.has(r.name.toLowerCase()))
+      || (nore && nameKeys.has(nore[1].toLowerCase().replace(/\s+/g, "")));
+    if (isMine) mine.add(r.email);
+  }
+  if (rEmail) mine.add(rEmail);
+  let mineCount = rows.filter((r) => mine.has(r.email)).reduce((s, r) => s + r.count, 0);
+  const filterDropped = total >= 20 && mineCount / Math.max(total, 1) < 0.10;
+  const emails = filterDropped ? rows.map((r) => r.email) : [...mine];
+  return { emails, mineCount, total, filterDropped, names: [...new Set(rows.filter((r) => mine.has(r.email)).map((r) => r.email))] };
+}
+function authorArgs(emails) { return (emails || []).filter(Boolean).map((e) => `--author=${JSON.stringify(e)}`).join(" "); }
+
+// Working-tree state, incl. detecting a stale/old checkout (not new work).
+function repoState(repoPath) {
+  const branch = sh(`git -C ${JSON.stringify(repoPath)} rev-parse --abbrev-ref HEAD 2>/dev/null`).trim();
+  const porcelain = sh(`git -C ${JSON.stringify(repoPath)} status --porcelain 2>/dev/null`).split("\n").filter(Boolean);
+  let del = 0, mod = 0, add = 0;
+  for (const l of porcelain) { const x = l.slice(0, 2); if (/\?\?/.test(x)) add++; else if (x.includes("D")) del++; else if (x.includes("A")) add++; else mod++; }
+  const dirty = porcelain.length;
+  let stale = false, staleBy = 0;
+  if (dirty) {
+    for (const k of [3, 5, 10, 20, 40, 80, 160, 320]) {
+      if (!sh(`git -C ${JSON.stringify(repoPath)} rev-parse HEAD~${k} 2>/dev/null`).trim()) break;
+      if (sh(`git -C ${JSON.stringify(repoPath)} diff --quiet HEAD~${k} 2>/dev/null && echo EQ`).trim() === "EQ") { stale = true; staleBy = k; break; }
+    }
+    if (!stale && del >= 20 && del > mod && add === 0) stale = true; // mostly deletions = an old snapshot
+  }
+  const behind = Number(sh(`git -C ${JSON.stringify(repoPath)} rev-list --count HEAD..@{u} 2>/dev/null`).trim()) || 0;
+  return { branch, dirty, del, mod, add, stale, staleBy, behind };
+}
+function readmeInfo(repoPath) {
+  for (const f of ["README.md", "README.MD", "Readme.md", "readme.md", "README.txt", "README"]) {
+    try {
+      const p = join(repoPath, f);
+      if (existsSync(p)) {
+        const hash = sh(`git -C ${JSON.stringify(repoPath)} log -1 --format=%H -- ${JSON.stringify(f)} 2>/dev/null`).trim();
+        return {
+          file: f, excerpt: readFileSync(p, "utf8").slice(0, 2500),
+          lastDate: sh(`git -C ${JSON.stringify(repoPath)} log -1 --format=%cd --date=short -- ${JSON.stringify(f)} 2>/dev/null`).trim(),
+          commitsAgo: hash ? (Number(sh(`git -C ${JSON.stringify(repoPath)} rev-list --count ${hash}..HEAD 2>/dev/null`).trim()) || 0) : 0,
+        };
+      }
+    } catch {}
+  }
+  return { file: null, excerpt: "", lastDate: "", commitsAgo: 0 };
+}
+function repoShape(repoPath) {
+  const files = sh(`git -C ${JSON.stringify(repoPath)} ls-files 2>/dev/null | head -4000`).split("\n").filter(Boolean);
+  const top = {}; const docs = []; const manifests = [];
+  for (const f of files) {
+    const seg = f.includes("/") ? f.split("/")[0] : "(root)";
+    top[seg] = (top[seg] || 0) + 1;
+    const base = f.split("/").pop();
+    if (MANIFEST_TOOL[base]) manifests.push(f);
+    if (/^(readme|contributing|claude|agents|changelog|architecture|design)/i.test(base) || /(^|\/)(docs|knowledge)\//i.test(f)) docs.push(f);
+  }
+  return {
+    total: files.length,
+    dirs: Object.entries(top).sort((a, b) => b[1] - a[1]).slice(0, 14).map(([d, n]) => `${d}/ (${n})`),
+    manifests: manifests.slice(0, 12), docs: [...new Set(docs)].slice(0, 16),
+  };
+}
+// House rules the model must respect (e.g. "we commit .env on purpose").
+function houseRules(repoPath) {
+  const out = [];
+  for (const [label, f] of [["Project rules", "CLAUDE.md"], ["Agent rules", "AGENTS.md"], ["Contributing", "CONTRIBUTING.md"]]) {
+    try { const p = join(repoPath, f); if (existsSync(p)) out.push(`## ${label} (${f})\n` + readFileSync(p, "utf8").slice(0, 1500)); } catch {}
+  }
+  try { const g = join(homedir(), ".config", "symbiot", "rules.md"); if (existsSync(g)) out.push("## Your global rules\n" + readFileSync(g, "utf8").slice(0, 1500)); } catch {}
+  return out.join("\n\n");
+}
+// "Show what was read" footer for every report.
+function reportFooter(repoPath, auth, state, rd) {
+  const b = [`symbiot ${VERSION}`, `path ${repoPath}`];
+  if (state.branch) b.push(`branch ${state.branch}`);
+  b.push(`${auth.mineCount} of ${auth.total} commits matched you${auth.filterDropped ? " — filter dropped, counting everyone" : ""}`);
+  if (rd && rd.lastDate) b.push(`README changed ${rd.lastDate}${rd.commitsAgo ? ` (${rd.commitsAgo} commits ago)` : ""}`);
+  if (state.stale) b.push(`⚠ STALE checkout: working tree ≈ ${state.staleBy ? "HEAD~" + state.staleBy : "an older commit"} — not new work`);
+  else if (state.dirty) b.push(`${state.dirty} uncommitted (${state.mod} mod / ${state.del} del / ${state.add} new)`);
+  if (state.behind) b.push(`${state.behind} behind upstream`);
+  return b.join(" · ");
+}
 function findRepos(base, sinceDays) {
-  const out = sh(
-    `find ${JSON.stringify(base)} -maxdepth 5 -name .git \\( -type d -o -type f \\) 2>/dev/null ` +
-    `| grep -vE 'node_modules|/\\.cache/|/\\.local/|/venvs?/|/\\.npm' | head -400`,
-  );
   const repos = [];
-  for (const g of out.split("\n").filter(Boolean)) {
+  for (const g of findGitDirs(base, 200)) {
     const repo = g.replace(/\/\.git$/, "");
     const n = Number(sh(`git -C ${JSON.stringify(repo)} log --since="${sinceDays} days ago" --oneline 2>/dev/null | wc -l`).trim());
     const last = Number(sh(`git -C ${JSON.stringify(repo)} log -1 --format=%ct 2>/dev/null`).trim()) || 0;
@@ -168,10 +281,10 @@ function commits(repos, sinceExpr, mineOnly = true) {
   const all = [];
   const seen = new Set();
   for (const r of repos) {
-    // Filter to the identity you actually commit under IN THIS repo (people use
-    // different emails per project); no filter with --all.
-    const email = mineOnly ? sh(`git -C ${JSON.stringify(r.path)} config user.email`).trim() : "";
-    const authorArg = email ? `--author=${JSON.stringify(email)}` : "";
+    // Match ALL of your identities in this repo (per-repo email, global email,
+    // GitHub noreply login, matching name), with a fallback when almost nothing
+    // matches an active repo. No filter with --all.
+    const authorArg = mineOnly ? authorArgs(authorship(r.path).emails) : "";
     const raw = sh(
       `git -C ${JSON.stringify(r.path)} log --since=${JSON.stringify(sinceExpr)} ${authorArg} ` +
       `--no-merges --date=short --name-only --pretty=format:'@@@%H|%ad|%s' -n 60`,
@@ -202,10 +315,11 @@ function openWork(repos) {
       const m = l.match(/^([^:]+):(\d+):(.*)$/);
       if (m) items.push(`${r.name}: ${m[3].replace(/^[\s/*#-]+/, "").trim().slice(0, 120)} (${m[1]}:${m[2]})`);
     }
-    const dirty = sh(`git -C ${JSON.stringify(r.path)} status --porcelain 2>/dev/null`).split("\n").filter(Boolean);
-    if (dirty.length) {
-      const branch = sh(`git -C ${JSON.stringify(r.path)} rev-parse --abbrev-ref HEAD 2>/dev/null`).trim();
-      items.push(`${r.name}: ${dirty.length} uncommitted file(s) on ${branch || "?"}`);
+    const st = repoState(r.path);
+    if (st.stale) {
+      items.push(`${r.name}: STALE checkout — working tree ≈ ${st.staleBy ? "HEAD~" + st.staleBy : "an older commit"}, NOT new work; do not commit (would revert history)`);
+    } else if (st.dirty) {
+      items.push(`${r.name}: ${st.dirty} uncommitted (${st.mod} mod / ${st.del} del / ${st.add} new) on ${st.branch || "?"}`);
     }
   }
   return items;
@@ -359,6 +473,143 @@ function cmdModels() {
   console.log("");
 }
 
+// ---- drift: what's out of sync / stuck / at risk (deterministic git facts) -
+function gitDefaultBranch(repo) {
+  const d = sh(`git -C ${JSON.stringify(repo)} symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null`).trim();
+  if (d) return d.replace(/^origin\//, "");
+  for (const b of ["main", "master", "develop"]) if (sh(`git -C ${JSON.stringify(repo)} rev-parse --verify -q refs/remotes/origin/${b} 2>/dev/null`).trim()) return b;
+  return sh(`git -C ${JSON.stringify(repo)} rev-parse --abbrev-ref HEAD 2>/dev/null`).trim() || "main";
+}
+function fetchAgeDays(repo) {
+  const gd = sh(`git -C ${JSON.stringify(repo)} rev-parse --git-common-dir 2>/dev/null`).trim();
+  if (!gd) return null;
+  const p = gd.startsWith("/") ? join(gd, "FETCH_HEAD") : join(repo, gd, "FETCH_HEAD");
+  try { return Math.floor((Date.now() - statSync(p).mtimeMs) / 86400000); } catch { return null; }
+}
+function worktreeCount(repo) { return sh(`git -C ${JSON.stringify(repo)} worktree list 2>/dev/null`).split("\n").filter(Boolean).length; }
+// Deployed-sha commands are read ONLY from the user's own config (never from a
+// repo file, which could be attacker-controlled): ~/.config/symbiot/deploys.json
+function loadDeploys() { try { return JSON.parse(readFileSync(join(CONFIG_DIR, "deploys.json"), "utf8")); } catch { return {}; } }
+function ciState(repo, def) {
+  if (!sh("command -v gh 2>/dev/null").trim()) return null;
+  if (!/github\.com/i.test(sh(`git -C ${JSON.stringify(repo)} remote get-url origin 2>/dev/null`))) return null;
+  const j = sh(`cd ${JSON.stringify(repo)} && gh run list --branch ${def} --limit 1 --json databaseId,conclusion,status 2>/dev/null`).trim();
+  if (!j) return null;
+  try {
+    const a = JSON.parse(j); if (!a.length) return null; const r = a[0];
+    if (r.status && r.status !== "completed") return { level: "info", text: `CI on ${def}: ${r.status}` };
+    if (r.conclusion === "success") return { level: "info", text: `CI on ${def}: passing` };
+    if (r.conclusion === "failure") {
+      // Deterministic "not running" signal: every job has 0 steps (never started).
+      let notRun = false, reason = "";
+      try {
+        const jobs = (JSON.parse(sh(`cd ${JSON.stringify(repo)} && gh run view ${r.databaseId} --json jobs 2>/dev/null`)).jobs) || [];
+        notRun = jobs.length > 0 && jobs.every((x) => ((x.steps || []).length === 0));
+        if (notRun && jobs[0] && jobs[0].databaseId) {
+          // Only on the not-running path: fetch the one job's annotation to quote
+          // GitHub's exact reason (billing / spending limit / runner / disabled).
+          const cru = sh(`cd ${JSON.stringify(repo)} && gh api repos/{owner}/{repo}/actions/jobs/${jobs[0].databaseId} --jq .check_run_url 2>/dev/null`).trim();
+          const crid = (cru.match(/check-runs\/(\d+)/) || [])[1];
+          if (crid) { const m = sh(`cd ${JSON.stringify(repo)} && gh api repos/{owner}/{repo}/check-runs/${crid}/annotations --jq '.[0].message' 2>/dev/null`).trim(); if (m) reason = m.slice(0, 240); }
+        }
+      } catch {}
+      if (notRun) return { level: "warn", text: reason ? `CI is NOT running on ${def}: "${reason}"` : `CI is NOT running on ${def} — jobs never started (reason unavailable; usually a billing/spending-limit stop), not failing tests` };
+      return { level: "warn", text: `CI's last run on ${def} failed (a real failure — jobs ran)` };
+    }
+    if (r.conclusion) return { level: "warn", text: `CI on ${def}: ${r.conclusion}` };
+    return null;
+  } catch { return null; }
+}
+// For merges that aren't on the default branch, tell "likely never landed"
+// (added files missing from default) from "merged another way" (all present).
+function mergedOffDefault(p, defRef) {
+  const raw = sh(`git -C ${JSON.stringify(p)} log --merges --all --not ${defRef} --format='%H|%s' 2>/dev/null`)
+    .split("\n").filter((l) => /merge pull request/i.test(l));
+  if (!raw.length) return [];
+  const defFiles = new Set(sh(`git -C ${JSON.stringify(p)} ls-tree -r --name-only ${defRef} 2>/dev/null`).split("\n").filter(Boolean));
+  const hits = [];
+  for (const line of raw.slice(0, 12)) {
+    const [sha, subj] = line.split("|");
+    const prNum = (subj.match(/#(\d+)/) || [])[1] || "?";
+    const parents = sh(`git -C ${JSON.stringify(p)} rev-list --parents -n1 ${sha} 2>/dev/null`).trim().split(/\s+/);
+    const head = parents[2]; // 2nd parent = the merged branch head
+    let added = 0, missing = 0;
+    if (head) {
+      const mb = sh(`git -C ${JSON.stringify(p)} merge-base ${head} ${defRef} 2>/dev/null`).trim();
+      const files = sh(`git -C ${JSON.stringify(p)} diff --name-status ${mb || defRef} ${head} 2>/dev/null`)
+        .split("\n").map((l) => l.trim()).filter((l) => /^A\b|^A\t/.test(l)).map((l) => l.split(/\s+/).pop());
+      added = files.length;
+      for (const f of files) if (f && !defFiles.has(f)) missing++;
+    }
+    hits.push({ prNum, sha: sha.slice(0, 9), added, missing });
+  }
+  return hits;
+}
+// Drift facts for ONE repo. Compares against origin/<default> when a remote
+// exists, else the local default branch (so it also works on local-only repos).
+function driftRepo(p, opts = {}) {
+  const name = p.split("/").pop();
+  const def = gitDefaultBranch(p), st = repoState(p), flags = [];
+  const originDef = sh(`git -C ${JSON.stringify(p)} rev-parse --verify -q refs/remotes/origin/${def} 2>/dev/null`).trim();
+  const localDef = sh(`git -C ${JSON.stringify(p)} rev-parse --verify -q refs/heads/${def} 2>/dev/null`).trim();
+  const defRef = originDef ? `origin/${def}` : (localDef ? def : "");
+  const cmd = opts.deploys && (opts.deploys[p] || opts.deploys[name]);
+  // Fetch only when asked, or for a deploy-configured repo (comparing a live
+  // deployed sha against a stale origin gives a confidently wrong answer).
+  if (originDef && (opts.fetch || cmd)) sh(`git -C ${JSON.stringify(p)} fetch -q origin 2>/dev/null`);
+  const fa = fetchAgeDays(p);
+  const stale = fa != null && fa > 1 ? ` (as of ${fa}d ago)` : "";
+
+  if (st.stale) flags.push({ level: "warn", text: `checkout is stale — working tree ≈ ${st.staleBy ? "HEAD~" + st.staleBy : "an older commit"}, not new work` });
+  else if (st.dirty) flags.push({ level: "info", text: `${st.dirty} uncommitted (${st.mod} mod / ${st.del} del / ${st.add} new)` });
+  if (st.behind) flags.push({ level: "warn", text: `${st.behind} behind upstream on ${st.branch}${stale}` });
+  const wc = worktreeCount(p); if (wc > 1) flags.push({ level: "info", text: `${wc} checkouts of this repo` });
+  if (originDef) {
+    const unmerged = sh(`git -C ${JSON.stringify(p)} branch -r --no-merged origin/${def} 2>/dev/null`).split("\n").map((s) => s.trim()).filter((b) => b && !b.startsWith("origin/HEAD"));
+    if (unmerged.length) flags.push({ level: "info", text: `${unmerged.length} branch(es) with work not on ${def}` });
+  }
+  if (defRef) {
+    const hits = mergedOffDefault(p, defRef);
+    const gone = hits.filter((h) => h.added > 0 && h.missing > 0);
+    const other = hits.length - gone.length;
+    if (gone.length) flags.push({ level: "warn", text: `${gone.length} PR(s) merged off ${def} with added files MISSING from ${def} — likely never landed`, evidence: gone.slice(0, 5).map((h) => `#${h.prNum} (${h.missing}/${h.added} files missing)`).join(" | ") });
+    if (other > 0) flags.push({ level: "info", text: `${other} other PR merge(s) off ${def} (files present — probably re-done/squashed)` });
+  }
+  if (cmd && defRef) {
+    const sha = sh(cmd).trim().split(/\s+/)[0];
+    if (sha) {
+      const onDef = sh(`git -C ${JSON.stringify(p)} merge-base --is-ancestor ${sha} ${defRef} 2>/dev/null && echo Y`).trim() === "Y";
+      const behind = Number(sh(`git -C ${JSON.stringify(p)} rev-list --count ${sha}..${defRef} 2>/dev/null`).trim()) || 0;
+      const ahead = Number(sh(`git -C ${JSON.stringify(p)} rev-list --count ${defRef}..${sha} 2>/dev/null`).trim()) || 0;
+      if (!onDef) flags.push({ level: "warn", text: `production runs code NOT on ${def}${ahead ? ` (${ahead} commits ahead of it)` : ""}`, evidence: sha.slice(0, 9) });
+      else if (behind) flags.push({ level: "warn", text: `production is ${behind} behind ${def}`, evidence: sha.slice(0, 9) });
+      else flags.push({ level: "info", text: `production in sync with ${def}`, evidence: sha.slice(0, 9) });
+    }
+  }
+  if (opts.ci) { const ci = ciState(p, def); if (ci) flags.push(ci); }
+  return { name, path: p, def, flags, fetchAgeDays: fa };
+}
+function computeDrift(opts = {}) {
+  const deploys = loadDeploys();
+  const repos = findAllRepos(BASE).slice(0, 20).map((r) => driftRepo(r.path, { deploys, ci: opts.ci, fetch: opts.fetch }));
+  return { repos, ci: !!opts.ci };
+}
+function cmdDrift() {
+  const d = computeDrift({ ci: has("ci"), fetch: has("fetch") });
+  const warn = d.repos.filter((r) => r.flags.some((f) => f.level === "warn"));
+  console.log(`\n${c.g("●")} ${c.b("Symbiot drift")} ${c.d("· " + d.repos.length + " repos · " + warn.length + " with risks")}\n`);
+  for (const r of d.repos) {
+    if (!r.flags.length) continue;
+    const risky = r.flags.some((f) => f.level === "warn");
+    console.log(`${risky ? c.y("●") : c.d("○")} ${c.b(r.name)} ${c.d(r.def + (r.fetchAgeDays != null && r.fetchAgeDays > 3 ? " · fetch " + r.fetchAgeDays + "d old" : ""))}`);
+    for (const f of r.flags) console.log(`  ${f.level === "warn" ? c.y("⚠") : c.d("·")} ${f.text}${f.evidence ? c.d("  [" + f.evidence + "]") : ""}`);
+    console.log("");
+  }
+  const clean = d.repos.filter((r) => !r.flags.length).map((r) => r.name);
+  if (clean.length) console.log(c.d(`clean: ${clean.join(", ")}`));
+  console.log(c.d(`\nsymbiot ${VERSION} · local git facts only${d.ci ? " + CI" : " (add --ci for CI status)"}${loadDeploys() && Object.keys(loadDeploys()).length ? "" : " · set ~/.config/symbiot/deploys.json for production-sha checks"}`));
+}
+
 // ---- work map: a node graph of your repos, languages, and tools -----------
 const EXT_LANG = {
   ts: "TypeScript", tsx: "TypeScript", js: "JavaScript", jsx: "JavaScript", mjs: "JavaScript",
@@ -373,20 +624,23 @@ const MANIFEST_TOOL = {
   "terraform.tf": "Terraform", "kubernetes.yml": "Kubernetes", ".github": "GitHub Actions",
 };
 function findAllRepos(base) {
-  const out = sh(
-    `find ${JSON.stringify(base)} -maxdepth 5 -name .git \\( -type d -o -type f \\) 2>/dev/null ` +
-    `| grep -vE 'node_modules|/\\.cache/|/\\.local/|/venvs?/|/\\.npm' | head -300`,
-  );
   const repos = [];
-  for (const g of out.split("\n").filter(Boolean)) {
+  for (const g of findGitDirs(base, 120)) {
     const repo = g.replace(/\/\.git$/, "");
     const last = Number(sh(`git -C ${JSON.stringify(repo)} log -1 --format=%ct 2>/dev/null`).trim()) || 0;
     if (last) repos.push({ path: repo, name: repo.split("/").pop(), recency: last });
   }
-  return repos.sort((a, b) => b.recency - a.recency).slice(0, 36);
+  // Group worktrees by shared git dir; keep only the freshest checkout of each.
+  const byCommon = {};
+  for (const r of repos) {
+    const cd = sh(`git -C ${JSON.stringify(r.path)} rev-parse --git-common-dir 2>/dev/null`).trim() || r.path;
+    const key = cd.startsWith("/") ? cd : join(r.path, cd);
+    if (!byCommon[key] || byCommon[key].recency < r.recency) byCommon[key] = r;
+  }
+  return Object.values(byCommon).sort((a, b) => b.recency - a.recency).slice(0, 30);
 }
 function detectRepo(r) {
-  const files = sh(`git -C ${JSON.stringify(r.path)} ls-files 2>/dev/null | head -5000`).split("\n").filter(Boolean);
+  const files = sh(`git -C ${JSON.stringify(r.path)} ls-files 2>/dev/null | head -3000`).split("\n").filter(Boolean);
   const count = {}; const tools = new Set();
   for (const f of files) {
     const base = f.split("/").pop();
@@ -452,26 +706,29 @@ async function repoReview(path) {
   if (!resolveProvider()) return { error: "not-connected" };
   if (!path) return { error: "no repo" };
   const name = path.split("/").pop();
-  let readme = "";
-  for (const f of ["README.md", "README.MD", "Readme.md", "readme.md", "README.txt", "README"]) {
-    try { const p = join(path, f); if (existsSync(p)) { readme = readFileSync(p, "utf8").slice(0, 2500); break; } } catch {}
-  }
-  const files = sh(`git -C ${JSON.stringify(path)} ls-files 2>/dev/null | head -60`).trim();
-  const recent = sh(`git -C ${JSON.stringify(path)} log --oneline -12 2>/dev/null`).trim();
+  const auth = authorship(path), state = repoState(path), rd = readmeInfo(path), shape = repoShape(path), rules = houseRules(path);
+  const commits = sh(`git -C ${JSON.stringify(path)} log ${authorArgs(auth.emails)} --format='%ad %s' --date=short -50 2>/dev/null`).trim()
+    || sh(`git -C ${JSON.stringify(path)} log --format='%ad %s' --date=short -50 2>/dev/null`).trim();
+  const footer = reportFooter(path, auth, state, rd);
   const system =
-    `You are reviewing one software project for its owner. Respond with ONLY a JSON object, no markdown fences, no prose outside it, shaped exactly: ` +
-    `{"review": string, "ideas": string[]}. "review" is 3-6 sentences covering what it does and what it's meant for (who'd use it, why). ` +
-    `"ideas" is 3-6 short, concrete upgrade or next-feature items, each a single actionable phrase (something you could put on a to-do list). ` +
-    `Be specific and grounded in the README, files, and commits — infer from real evidence, don't invent.`;
+    `You are reviewing one software project for its owner. Respond with ONLY a JSON object (no fences, no prose outside it): {"review": string, "ideas": string[]}. ` +
+    `"review": 3-6 sentences on what it does and who it's for. "ideas": 3-6 short, concrete upgrade items, each a single actionable phrase. ` +
+    `Ground every claim in the evidence below and tie it to real files/commits. Recent commits are MORE current than the README — when they disagree, trust the commits. ` +
+    `Never propose building something that already appears in the structure. Never advise against anything the conventions call intentional. ` +
+    (state.stale ? `CRITICAL: the working tree is a STALE/old checkout, not new work — never suggest committing it (it would revert history). ` : ``);
   const prompt =
-    `Project: ${name}\nPath: ${path}\n\n` +
-    (readme ? `README (excerpt):\n${readme}\n\n` : "(no README found)\n\n") +
-    `Files:\n${files || "(none)"}\n\nRecent commits:\n${recent || "(none)"}\n\nReturn the JSON.`;
+    `Project: ${name}\nBranch ${state.branch} · ${auth.total} commits total (${auth.mineCount} yours${auth.filterDropped ? ", filter dropped so counting everyone" : ""})\n\n` +
+    (rd.file ? `README (last changed ${rd.lastDate || "?"}, ${rd.commitsAgo} commits ago — may be out of date):\n${rd.excerpt}\n\n` : "(no README)\n\n") +
+    `Structure (top folders · file counts): ${shape.dirs.join(", ")}\nManifests: ${shape.manifests.join(", ") || "none"}\nDocs present: ${shape.docs.join(", ") || "none"}\n\n` +
+    `Recent commits (newest first):\n${commits || "(none)"}\n\n` +
+    (rules ? `Conventions this team has chosen — do NOT advise against these:\n${rules}\n\n` : "") +
+    (state.stale ? `Working tree: STALE (≈ ${state.staleBy ? "HEAD~" + state.staleBy : "older"}); its "changes" are the gap to an old snapshot, not new work.\n\n` : "") +
+    `Return the JSON.`;
   const raw = await write(system, prompt);
-  if (!raw) return { text: "(couldn't reach the model)", ideas: [] };
+  if (!raw) return { text: "(couldn't reach the model)", ideas: [], footer };
   const j = extractJson(raw);
-  if (j && (j.review || j.ideas)) return { text: String(j.review || "").trim() || raw, ideas: Array.isArray(j.ideas) ? j.ideas.map((x) => String(x).trim()).filter(Boolean).slice(0, 8) : [] };
-  return { text: raw, ideas: [] }; // model didn't return clean JSON — show prose, no checkboxes
+  if (j && (j.review || j.ideas)) return { text: String(j.review || "").trim() || raw, ideas: Array.isArray(j.ideas) ? j.ideas.map((x) => String(x).trim()).filter(Boolean).slice(0, 8) : [], footer };
+  return { text: raw, ideas: [], footer };
 }
 function extractJson(s) {
   if (!s) return null;
@@ -485,17 +742,23 @@ async function repoSuggest(path) {
   if (!resolveProvider()) return { error: "not-connected" };
   if (!path) return { error: "no repo" };
   const name = path.split("/").pop();
-  const email = sh(`git -C ${JSON.stringify(path)} config user.email`).trim();
-  const recent = sh(`git -C ${JSON.stringify(path)} log --oneline -30 ${email ? `--author=${JSON.stringify(email)}` : ""} 2>/dev/null`).trim();
+  const auth = authorship(path), state = repoState(path), rd = readmeInfo(path), rules = houseRules(path);
+  const recent = sh(`git -C ${JSON.stringify(path)} log ${authorArgs(auth.emails)} --format='%ad %s' --date=short -50 2>/dev/null`).trim()
+    || sh(`git -C ${JSON.stringify(path)} log --format='%ad %s' --date=short -50 2>/dev/null`).trim();
   const open = openWork([{ path, name }]);
+  const footer = reportFooter(path, auth, state, rd);
   const system =
-    `You are a pragmatic senior engineer advising on one project. From its recent commits and open items, write exactly three short sections with these headings: ` +
-    `"In flight" (what's clearly underway), "Next steps" (3-5 concrete, specific actions), and "Ideas" (2-3 that fit where this build is heading). ` +
-    `Be specific to the actual work shown — no filler, no preamble, no restating the commits verbatim.`;
+    `You are a pragmatic senior engineer advising on one project. Write exactly three short sections with headings: ` +
+    `"In flight" (what's clearly underway), "Next steps" (3-5 concrete actions), "Ideas" (2-3 that fit where this is heading). ` +
+    `Ground each point in the evidence; recent commits beat the README. Do not advise against the stated conventions. ` +
+    (state.stale ? `CRITICAL: the working tree is a STALE checkout — never suggest committing it (would revert history). ` : ``) +
+    `No filler, no preamble.`;
   const prompt =
-    `Project: ${name}.\n\nRecent commits:\n${recent || "(none)"}\n\nOpen / unfinished:\n${open.length ? open.map((o) => "- " + o).join("\n") : "(none found)"}\n\nGive the advice.`;
+    `Project: ${name} (branch ${state.branch}, ${auth.total} commits, ${auth.mineCount} yours${auth.filterDropped ? " — filter dropped" : ""}).\n\n` +
+    `Recent commits:\n${recent || "(none)"}\n\nOpen / unfinished:\n${open.length ? open.map((o) => "- " + o).join("\n") : "(none found)"}\n\n` +
+    (rules ? `Conventions — do NOT advise against these:\n${rules}\n\n` : "") + `Give the advice.`;
   const text = await write(system, prompt);
-  return { text: text || "(couldn't reach the model)" };
+  return { text: text || "(couldn't reach the model)", footer };
 }
 
 // Build a write-up for a command; returns { text, sub, error? } without printing.
@@ -511,7 +774,7 @@ async function produce(cmd) {
       `Group by project, lead with what looks most in-flight (uncommitted work) then the to-dos. ` +
       `Be concise and concrete. No preamble.`;
     const text = await write(system, `Open work:\n${open.map((o) => `- ${o}`).join("\n")}\n\nWhat's still on my plate?`);
-    return { text: text || "(couldn't reach the model)", sub: `${open.length} open items · todo` };
+    return { text: text || "(couldn't reach the model)", sub: `${open.length} open items · todo`, footer: `symbiot ${VERSION} · ${repos.length} repos scanned · ${open.length} open items` };
   }
   const label = cmd === "standup" ? "standup" : "week";
   const days = cmd === "standup" ? 2 : SINCE_WEEK;
@@ -536,7 +799,7 @@ async function produce(cmd) {
     `Write the ${label === "standup" ? "standup" : "update"}.`;
 
   const text = await write(system, prompt);
-  return { text: text || "(couldn't reach the model)", sub: `${cs.length} commits across ${new Set(cs.map((x) => x.repo)).size} repos · ${label}` };
+  return { text: text || "(couldn't reach the model)", sub: `${cs.length} commits across ${new Set(cs.map((x) => x.repo)).size} repos · ${label}`, footer: `symbiot ${VERSION} · ${repos.length} repos scanned · ${cs.length} commits (yours) in last ${days}d` };
 }
 
 async function cmdRun(cmd) {
@@ -544,6 +807,7 @@ async function cmdRun(cmd) {
   const r = await produce(cmd);
   header(r.sub || cmd);
   if (r.text) console.log(r.text + "\n");
+  if (r.footer) console.log(c.d(r.footer) + "\n");
 }
 
 // Save a provider connection (used by the web Settings panel); mirrors cmdLogin.
@@ -694,6 +958,7 @@ footer{padding:10px 18px;border-top:1px solid var(--line);display:flex}
 .review h4{margin:0 0 8px;color:var(--green);font-size:11px;letter-spacing:.15em;text-transform:uppercase;font-weight:700}
 .review .body{color:var(--text);line-height:1.65;font-size:14px;white-space:pre-wrap}
 .review .rname{color:var(--bone);font-weight:600}
+.rfoot{margin-top:12px;font-size:11px;color:var(--faint);font-family:ui-monospace,Menlo,Consolas,monospace;border-top:1px solid var(--line);padding-top:8px;line-height:1.5}
 .ideas{margin-top:14px}
 .ideas h4{margin:0 0 6px;color:var(--amber);font-size:11px;letter-spacing:.14em;text-transform:uppercase;font-weight:700}
 .idea{display:flex;align-items:flex-start;gap:9px;padding:5px 0;font-size:13.5px;color:var(--text)}
@@ -704,6 +969,16 @@ footer{padding:10px 18px;border-top:1px solid var(--line);display:flex}
 .task .rp{font-size:11px;color:var(--faint);background:var(--ink3);border:1px solid var(--line);border-radius:999px;padding:2px 8px}
 .task .rm{background:none;border:0;color:var(--faint);cursor:pointer;font-size:18px;line-height:1}
 .task .rm:hover{color:var(--amber)}
+.drift{border:1px solid var(--line);border-radius:10px;margin-top:10px;padding:12px 14px;background:var(--ink2)}
+.drift .dh{display:flex;gap:8px;align-items:center}
+.drift .dn{color:var(--bone);font-weight:600}
+.drift .dd{color:var(--faint);font-size:12px}
+.drift ul{margin:8px 0 0;padding:0;list-style:none}
+.drift li{padding:3px 0;font-size:13.5px}
+.drift li.warn{color:var(--amber)}
+.drift .ev{color:var(--faint);font-family:ui-monospace,Menlo,monospace;font-size:11px}
+.dot-w{width:9px;height:9px;border-radius:50%;background:var(--amber);display:inline-block}
+.dot-c{width:9px;height:9px;border-radius:50%;background:var(--green);display:inline-block}
 .out2{white-space:pre-wrap;background:var(--ink);border:1px solid var(--line);border-radius:9px;padding:10px;margin-top:10px;font-size:13px;line-height:1.55;color:var(--bone)}
 .legend{display:flex;gap:14px;align-items:center;margin-top:10px;font-size:12px;color:var(--faint);flex-wrap:wrap}
 .lg{display:inline-flex;gap:6px;align-items:center}
@@ -713,6 +988,7 @@ footer{padding:10px 18px;border-top:1px solid var(--line);display:flex}
 <header><span class="dot"></span><span class="brand">Symbiot</span><span class="status" id="status">...</span></header>
 <div class="tabs">
 <button class="tab active" data-tab="map">Map</button>
+<button class="tab" data-tab="drift">Drift</button>
 <button class="tab" data-tab="week">Week</button>
 <button class="tab" data-tab="standup">Standup</button>
 <button class="tab" data-tab="todo">Todo</button>
@@ -742,11 +1018,19 @@ footer{padding:10px 18px;border-top:1px solid var(--line);display:flex}
 <button class="ghost hidden" id="copy">Copy</button>
 <span class="muted">Reads your local git and writes it up.</span></div>
 <div class="out muted" id="out">Nothing yet - hit the button.</div>
+<div class="rfoot" id="outfoot" style="display:none"></div>
 </section>
 <section id="panel-tasks" class="hidden">
 <div class="row"><input id="newtask" placeholder="Add a task..." style="flex:1"><button class="act" id="addtask">Add</button></div>
 <div id="tasklist"></div>
 </section>
+<section id="panel-drift" class="hidden">
+<div class="row"><span class="muted">What's out of sync, stuck or at risk across your repos — local git facts.</span>
+<label class="muted" style="margin-left:auto"><input type="checkbox" id="driftfetch"> fetch latest</label>
+<label class="muted"><input type="checkbox" id="driftci"> check CI (needs gh)</label>
+<button class="ghost" id="driftrun">Rescan</button></div>
+<div id="driftout"></div>
+</section>
 <section id="panel-settings" class="hidden">
 <label>Which AI should Symbiot write with?</label>
 <select id="provider">
@@ -776,23 +1060,25 @@ function api(path,body){return fetch(path,{method:body?'POST':'GET',headers:{'x-
 var KEYURL={anthropic:'https://console.anthropic.com/settings/keys',openai:'https://platform.openai.com/api-keys',gemini:'https://aistudio.google.com/apikey',ollama:'https://ollama.com'};
 var DEFMODEL={anthropic:'claude-opus-5-5',openai:'gpt-4o-mini',gemini:'gemini-1.5-flash',ollama:'llama3.1'};
 function $(id){return document.getElementById(id);}
-var current='map';var mapLoaded=false;
+var current='map';var mapLoaded=false;var driftLoaded=false;
 var COLORS={person:'#3DDC97',repo:'#F4F1EA',lang:'#F2A541',tool:'#6bb3ff'};
 function tabs(){return document.querySelectorAll('.tab');}
 function setTab(tab){current=tab;tabs().forEach(function(t){t.classList.toggle('active',t.dataset.tab===tab);});
-var isMap=tab==='map',isSet=tab==='settings',isTasks=tab==='tasks',isRun=(tab==='week'||tab==='standup'||tab==='todo');
+var isMap=tab==='map',isSet=tab==='settings',isTasks=tab==='tasks',isDrift=tab==='drift',isRun=(tab==='week'||tab==='standup'||tab==='todo');
 $('panel-map').classList.toggle('hidden',!isMap);
 $('panel-run').classList.toggle('hidden',!isRun);
 $('panel-settings').classList.toggle('hidden',!isSet);
 $('panel-tasks').classList.toggle('hidden',!isTasks);
+$('panel-drift').classList.toggle('hidden',!isDrift);
 if(isRun){$('what').textContent=tab;$('out').textContent='Nothing yet - hit the button.';$('out').classList.add('muted');$('copy').classList.add('hidden');}
 if(isMap&&!mapLoaded)loadMap();
-if(isTasks)loadTasks();}
+if(isTasks)loadTasks();
+if(isDrift&&!driftLoaded)loadDrift();}
 tabs().forEach(function(t){t.addEventListener('click',function(){setTab(t.dataset.tab);});});
 function refresh(){api('/api/status').then(function(s){$('status').textContent=s.connected?s.line:'Not connected - open Settings';});}
 $('write').addEventListener('click',function(){$('out').textContent='Writing...';$('out').classList.add('muted');$('copy').classList.add('hidden');
-api('/api/run',{cmd:current}).then(function(r){if(r.error==='not-connected'){$('out').textContent='Not connected yet - open Settings and pick an AI.';return;}
-$('out').textContent=r.text||'(no output)';$('out').classList.remove('muted');$('copy').classList.remove('hidden');});});
+api('/api/run',{cmd:current}).then(function(r){var f=$('outfoot');if(r.error==='not-connected'){$('out').textContent='Not connected yet - open Settings and pick an AI.';f.style.display='none';return;}
+$('out').textContent=r.text||'(no output)';$('out').classList.remove('muted');$('copy').classList.remove('hidden');if(r.footer){f.textContent=r.footer;f.style.display='block';}else{f.style.display='none';}});});
 $('copy').addEventListener('click',function(){navigator.clipboard.writeText($('out').textContent);$('copy').textContent='Copied';setTimeout(function(){$('copy').textContent='Copy';},1400);});
 function syncP(){var p=$('provider').value;var local=p==='ollama';$('keyWrap').classList.toggle('hidden',local);$('baseWrap').classList.toggle('hidden',!local);
 $('getkey').textContent=local?'About Ollama':'Where do I get a key?';$('modelHint').textContent='(default '+DEFMODEL[p]+')';$('model').placeholder='(blank = '+DEFMODEL[p]+')';}
@@ -825,27 +1111,28 @@ function showDetail(d){var el=document.getElementById('detail');el.classList.rem
 if(d.error){el.innerHTML="<h3>&mdash;</h3><div class='k'>"+esc(d.error)+"</div>";return;}
 if(d.type==='repo'){var chips="";['branch: '+(d.branch||'?'),d.commits+' commits',(d.dirty?d.dirty+' uncommitted':'clean'),(d.last?'last '+d.last:'')].concat(d.langs||[]).concat(d.tools||[]).forEach(function(x){if(x)chips+="<span class='tag'>"+esc(x)+"</span>";});
 el.innerHTML="<h3>"+esc(d.label)+"</h3><div class='chips'>"+chips+"</div><button class='act' id='suggest' style='margin-top:12px'>Suggest next steps</button><div id='sugout'></div>";
-document.getElementById('suggest').addEventListener('click',function(){var o=document.getElementById('sugout');o.innerHTML="<div class='out2'>Thinking...</div>";api('/api/suggest',{path:d.path}).then(function(r){if(r.error==='not-connected'){o.innerHTML="<div class='out2'>Connect a model in Settings to get suggestions - Ollama is free and runs locally.</div>";return;}o.innerHTML="<div class='out2'>"+esc(r.text||'(no output)')+"</div>";});});return;}
+document.getElementById('suggest').addEventListener('click',function(){var o=document.getElementById('sugout');o.innerHTML="<div class='out2'>Thinking...</div>";api('/api/suggest',{path:d.path}).then(function(r){if(r.error==='not-connected'){o.innerHTML="<div class='out2'>Connect a model in Settings to get suggestions - Ollama is free and runs locally.</div>";return;}o.innerHTML="<div class='out2'>"+esc(r.text||'(no output)')+"</div>"+(r.footer?"<div class='rfoot'>"+esc(r.footer)+"</div>":"");});});return;}
 if(d.type==='lang'||d.type==='tool'){var lis=(d.repos||[]).map(function(r){return "<li>"+esc(r)+"</li>";}).join("");el.innerHTML="<h3>"+esc(d.label)+"</h3><div class='k'>Used in "+((d.repos||[]).length)+" repos</div><ul>"+lis+"</ul>";return;}
 if(d.type==='person'){var st=d.stats||{};el.innerHTML="<h3>"+esc(d.label)+"</h3><div class='k'>"+st.repos+" repos &middot; "+st.commits+" commits &middot; "+st.languages+" languages &middot; "+st.tools+" tools</div>";return;}}
 var reviewCache={};
 function hideReview(){var el=document.getElementById('review');el.classList.add('hidden');el.innerHTML='';}
-function reviewHtml(name,body,ideas,tasks){
+function reviewHtml(name,body,ideas,tasks,footer){
 var h="<h4>AI review &middot; <span class='rname'>"+esc(name)+"</span></h4><div class='body'>"+esc(body)+"</div>";
 if(ideas&&ideas.length){h+="<div class='ideas'><h4>Upgrade ideas &middot; tick to add to Tasks</h4>";
 ideas.forEach(function(idea){var t=(tasks||[]).filter(function(x){return x.text===idea&&x.repo===name;})[0];var tid=t?t.id:"";
 h+="<label class='idea'><input type='checkbox' class='ideachk' data-text=\""+esc(idea)+"\" data-repo=\""+esc(name)+"\" data-tid='"+tid+"'"+(t?" checked":"")+"><span>"+esc(idea)+"</span></label>";});
 h+="</div>";}
+if(footer)h+="<div class='rfoot'>"+esc(footer)+"</div>";
 return h;}
 function wireIdeas(){document.querySelectorAll('.ideachk').forEach(function(cb){cb.addEventListener('change',function(){
 if(cb.checked){api('/api/tasks/add',{text:cb.getAttribute('data-text'),repo:cb.getAttribute('data-repo')}).then(function(it){if(it&&it.id)cb.setAttribute('data-tid',it.id);});}
 else{var id=cb.getAttribute('data-tid');if(id){api('/api/tasks/remove',{id:id}).then(function(){cb.setAttribute('data-tid','');});}}});});}
 function loadReview(name,path){var el=document.getElementById('review');el.classList.remove('hidden');
-if(reviewCache[path]){var c=reviewCache[path];api('/api/tasks').then(function(tasks){el.innerHTML=reviewHtml(name,c.text,c.ideas,tasks);wireIdeas();});return;}
+if(reviewCache[path]){var c=reviewCache[path];api('/api/tasks').then(function(tasks){el.innerHTML=reviewHtml(name,c.text,c.ideas,tasks,c.footer);wireIdeas();});return;}
 el.innerHTML="<h4>AI review &middot; <span class='rname'>"+esc(name)+"</span></h4><div class='body'>Reading the project&hellip;</div>";
 Promise.all([api('/api/review',{path:path}),api('/api/tasks')]).then(function(res){var r=res[0]||{},tasks=res[1]||[];
-if(r.error==='not-connected'){el.innerHTML="<h4>AI review &middot; <span class='rname'>"+esc(name)+"</span></h4><div class='body'>Connect a model in Settings to get a review - Ollama is free and runs locally.</div>";return;}
-var body=r.text||'(no output)';reviewCache[path]={text:body,ideas:r.ideas||[]};el.innerHTML=reviewHtml(name,body,r.ideas||[],tasks);wireIdeas();});}
+if(r.error==='not-connected'){el.innerHTML="<h4>AI review &middot; <span class='rname'>"+esc(name)+"</span></h4><div class='body'>Connect a model in Settings to get a review - Ollama is free and runs locally.</div>"+(r.footer?"<div class='rfoot'>"+esc(r.footer)+"</div>":"");return;}
+var body=r.text||'(no output)';reviewCache[path]={text:body,ideas:r.ideas||[],footer:r.footer};el.innerHTML=reviewHtml(name,body,r.ideas||[],tasks,r.footer);wireIdeas();});}
 function renderTasks(list){var el=document.getElementById('tasklist');if(!list||!list.length){el.innerHTML="<div class='muted' style='margin-top:12px'>No tasks yet. Tick an idea in a repo's review, or add one above.</div>";return;}
 var h="";list.forEach(function(t){h+="<div class='task"+(t.done?" done":"")+"' data-id='"+esc(t.id)+"'><input type='checkbox' class='taskchk'"+(t.done?" checked":"")+"><span class='t'>"+esc(t.text)+"</span>"+(t.repo?"<span class='rp'>"+esc(t.repo)+"</span>":"")+"<button class='rm' title='remove'>&times;</button></div>";});
 el.innerHTML=h;
@@ -853,6 +1140,18 @@ el.querySelectorAll('.task').forEach(function(row){var id=row.getAttribute('data
 row.querySelector('.taskchk').addEventListener('change',function(){api('/api/tasks/toggle',{id:id}).then(function(){row.classList.toggle('done');});});
 row.querySelector('.rm').addEventListener('click',function(){api('/api/tasks/remove',{id:id}).then(function(){row.remove();if(!el.querySelector('.task'))renderTasks([]);});});});}
 function loadTasks(){api('/api/tasks').then(renderTasks);}
+function loadDrift(){var out=document.getElementById('driftout');out.innerHTML="<div class='muted' style='margin-top:12px'>Reading your repos&hellip;</div>";
+var ci=document.getElementById('driftci').checked?'1':'0';var ft=document.getElementById('driftfetch').checked?'1':'0';
+api('/api/drift?ci='+ci+'&fetch='+ft).then(function(d){driftLoaded=true;var repos=d.repos||[];var risky=repos.filter(function(r){return r.flags.some(function(f){return f.level==='warn';});});
+var h="<div class='k' style='margin:10px 0'><b>"+repos.length+"</b> repos &middot; <b>"+risky.length+"</b> with risks</div>";
+repos.forEach(function(r){if(!r.flags.length)return;var warn=r.flags.some(function(f){return f.level==='warn';});
+h+="<div class='drift'><div class='dh'><span class='"+(warn?'dot-w':'dot-c')+"'></span><span class='dn'>"+esc(r.name)+"</span><span class='dd'>"+esc(r.def)+(r.fetchAgeDays!=null&&r.fetchAgeDays>3?" &middot; fetch "+r.fetchAgeDays+"d old":"")+"</span></div><ul>";
+r.flags.forEach(function(f){h+="<li class='"+esc(f.level)+"'>"+(f.level==='warn'?'&#9888; ':'&middot; ')+esc(f.text)+(f.evidence?" <span class='ev'>["+esc(f.evidence)+"]</span>":"")+"</li>";});
+h+="</ul></div>";});
+var clean=repos.filter(function(r){return !r.flags.length;}).map(function(r){return r.name;});
+if(clean.length)h+="<div class='muted' style='margin-top:10px'>clean: "+esc(clean.join(", "))+"</div>";
+if(!repos.length)h+="<div class='muted'>No repos found under your home folder.</div>";
+out.innerHTML=h;});}
 function addTaskUI(){var i=document.getElementById('newtask');var v=(i.value||'').trim();if(!v)return;api('/api/tasks/add',{text:v,repo:''}).then(function(){i.value='';loadTasks();});}
 function selectNode(id){sel=id;render();updateBar(id);var n=nodeById(id);api('/api/node?id='+encodeURIComponent(id)).then(showDetail);
 if(n&&n.type==='repo'&&n.meta&&n.meta.path){loadReview(n.label,n.meta.path);}else{hideReview();}}
@@ -882,6 +1181,7 @@ rec.paid.forEach(function(p){h+="<div class='idea'><span><b>"+esc(p.provider)+"<
 h+="</div>";out.innerHTML=h;});}
 document.getElementById('remap').addEventListener('click',loadMap);
 document.getElementById('recbtn').addEventListener('click',loadRec);
+document.getElementById('driftrun').addEventListener('click',function(){driftLoaded=false;loadDrift();});
 document.getElementById('addtask').addEventListener('click',addTaskUI);
 document.getElementById('newtask').addEventListener('keydown',function(e){if(e.key==='Enter')addTaskUI();});
 initGraphEvents();syncP();refresh();loadMap();
@@ -939,6 +1239,7 @@ async function cmdApp() {
       if (u.pathname === "/api/status") { const r = resolveProvider(); return json(res, r ? { connected: true, line: `${PROVIDERS[r.provider].label} · ${r.model}` } : { connected: false }); }
       if (u.pathname === "/api/map") return json(res, buildMap()); // local git only — no AI key needed
       if (u.pathname === "/api/models") { const hw = detectHardware(); return json(res, { hardware: hw, rec: recommendModels(hw) }); }
+      if (u.pathname === "/api/drift") return json(res, computeDrift({ ci: u.searchParams.get("ci") === "1", fetch: u.searchParams.get("fetch") === "1" }));
       if (u.pathname === "/api/node") return json(res, nodeDetail(u.searchParams.get("id") || "")); // local
       if (u.pathname === "/api/suggest" && req.method === "POST") { const b = await readBody(req); return json(res, await repoSuggest(String(b.path || ""))); }
       if (u.pathname === "/api/review" && req.method === "POST") { const b = await readBody(req); return json(res, await repoReview(String(b.path || ""))); }
@@ -968,6 +1269,7 @@ ${c.b("Usage")}
   symbiot standup                   yesterday + today, for standup
   symbiot todo                      what's still on your plate
   symbiot app                       open the visual app in your browser
+  symbiot drift                     what's out of sync / at risk across repos
   symbiot models                    recommend AI models for your hardware
   symbiot login                     connect it to an AI (once)
   symbiot whoami                    show how it's connected
@@ -991,15 +1293,23 @@ ${c.d("commit summaries sent to the AI to write your update (nothing leaves at a
 ${c.d("with a local Ollama model).")}`;
 
 // ---- main -----------------------------------------------------------------
-(async () => {
+async function main() {
   if (cmd === "help" || cmd === "--help" || cmd === "-h") { console.log(HELP); return; }
   if (cmd === "login" || cmd === "auth") return cmdLogin();
   if (cmd === "logout") return cmdLogout();
   if (cmd === "whoami" || cmd === "status") return cmdWhoami();
   if (cmd === "app" || cmd === "ui") return cmdApp();
   if (cmd === "models" || cmd === "hardware") return cmdModels();
+  if (cmd === "drift") return cmdDrift();
   if (cmd === "week") return cmdRun("week");
   if (cmd === "standup") return cmdRun("standup");
   if (cmd === "todo") return cmdRun("todo");
   console.log(c.y(`Unknown command: ${cmd}`) + "\n"); console.log(HELP);
-})();
+}
+
+// Run the CLI only when invoked directly; when imported (e.g. by tests) just
+// expose the pure functions.
+const isMain = import.meta.url === pathToFileURL(process.argv[1] || "\0none").href;
+if (isMain) main();
+
+export { authorship, repoState, readmeInfo, repoShape, houseRules, findAllRepos, buildMap, reportFooter, detectHardware, recommendModels, computeDrift, driftRepo, gitDefaultBranch };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "symbiot",
-  "version": "0.7.0",
+  "version": "0.9.2",
   "description": "Your week, written from your real work. Reads your local git and writes it up with the AI of your choice — Claude, OpenAI, Gemini, or a local model.",
   "type": "module",
   "bin": {
@@ -40,5 +40,8 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.128.0"
+  },
+  "scripts": {
+    "test": "node test/fixtures.mjs"
   }
 }