thuban 0.3.0 → 0.3.2

package/cli.js

@@ -20,6 +20,7 @@
 
 const path = require('path');
 const fs = require('fs');
+const os = require('os');
 
 // Import engine components
 const CodeScanner = require('./packages/scanner/code-scanner.js');
@@ -75,51 +76,100 @@ function printHelp() {
   banner();
   const lm = new LicenseManager();
   const status = lm.getStatus();
-  console.log(c('gray', `  License: ${status.tierName} tier`) + (status.licensed ? c('green', ' ✓') : ''));
-  console.log('');
-  console.log(c('bold', '  USAGE'));
-  console.log('');
-  console.log(`    ${c('cyan', 'thuban scan')} [path]         Scan for code issues`);
-  console.log(`    ${c('cyan', 'thuban deps')} [path]         Map dependencies`);
-  console.log(`    ${c('cyan', 'thuban drift')} [path]        Detect drift from annotations`);
-  console.log(`    ${c('cyan', 'thuban inject')} [path]       Inject Mother Code DNA`);
-  console.log(`    ${c('cyan', 'thuban health')} [path]       Codebase health check`);
-  console.log(`    ${c('cyan', 'thuban report')} [path]       Full combined report`);
-  console.log(`    ${c('cyan', 'thuban debt')} [path]         Tech debt analysis with scores`);
-  console.log(`    ${c('cyan', 'thuban fix')} [path]          Auto-fix all fixable tech debt`);
-  console.log(`    ${c('cyan', 'thuban hallucinate')} [path]  Detect AI hallucinations`);
-  console.log(`    ${c('cyan', 'thuban watch')} [path]        Live sentinel monitoring`);
-  console.log(`    ${c('cyan', 'thuban dashboard')} [path]    Generate HTML report`);
-  console.log(`    ${c('cyan', 'thuban diff')} [path]         Scan only git-changed files`);
-  console.log(`    ${c('cyan', 'thuban gate')}               Pre-commit hallucination blocker`);
-  console.log(`    ${c('cyan', 'thuban cost')} [path]         Tech debt cost calculator`);
-  console.log(`    ${c('cyan', 'thuban ghosts')} [path]       Find dead AI-pasted code`);
-  console.log(`    ${c('cyan', 'thuban ai-score')} [path]     AI confidence score per function`);
-  console.log(`    ${c('cyan', 'thuban clones')} [path]       Copy-paste drift detection`);
-  console.log(`    ${c('cyan', 'thuban passport')} [path]     Generate codebase identity file`);
-  console.log(`    ${c('cyan', 'thuban executive')} [path]    CTO-ready PDF report (print from browser)`);
-  console.log(`    ${c('cyan', 'thuban baseline')} [path]    Create/check baseline (only fail on NEW issues)`);
+  const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
+  console.log(c('gray', `  v${pkg.version}  ·  ${status.tierName} tier`) + (status.licensed ? c('green', ' ✓') : '') + c('gray', '  ·  https://thuban.dev'));
   console.log('');
+
+  // ─── QUICK START ──────────────────────────────────────────
+  console.log(c('bold', '  QUICK START'));
+  console.log('');
+  console.log(c('gray', '  Run these in order to see what Thuban does:'));
+  console.log('');
+  console.log(`    ${c('cyan', 'npx thuban scan .')}                  Scan your project`);
+  console.log(`    ${c('cyan', 'npx thuban fix .')}                   Preview what can be fixed`);
+  console.log(`    ${c('cyan', 'npx thuban fix . --fix')}             Apply all safe fixes`);
+  console.log(`    ${c('cyan', 'npx thuban dashboard .')}             Open visual HTML report`);
+  console.log('');
+
+  // ─── SCAN & DETECT ───────────────────────────────────────
+  console.log(c('bold', '  SCAN & DETECT'));
+  console.log('');
+  console.log(`    ${c('cyan', 'scan')} [path|url]           Full health scan — score, grade, all issues`);
+  console.log(`    ${c('cyan', 'compare')} [a] [b]          Compare two codebases side by side`);
+  console.log(`    ${c('cyan', 'hallucinate')} [path]       Find phantom APIs and invented imports`);
+  console.log(`    ${c('cyan', 'ghosts')} [path]            Dead functions nobody calls`);
+  console.log(`    ${c('cyan', 'ai-score')} [path]          Probability each function is AI-generated`);
+  console.log(`    ${c('cyan', 'clones')} [path]            Copy-pasted code that has drifted apart`);
+  console.log(`    ${c('cyan', 'drift')} [path]             Files that changed since Mother Code was set`);
+  console.log(`    ${c('cyan', 'deps')} [path]              Dependency map — circular, orphan, critical`);
+  console.log(`    ${c('cyan', 'diff')} [path]              Scan only git-changed files`);
+  console.log(`    ${c('cyan', 'debt')} [path]              Detailed tech debt breakdown`);
+  console.log(`    ${c('cyan', 'cost')} [path]              Tech debt translated to £ and hours`);
+  console.log('');
+
+  // ─── FIX & PROTECT ───────────────────────────────────────
+  console.log(c('bold', '  FIX & PROTECT'));
+  console.log('');
+  console.log(`    ${c('cyan', 'fix')} [path]               Preview fixable issues ${c('gray', '(safe, no changes)')}`);
+  console.log(`    ${c('cyan', 'fix')} [path] ${c('gray', '--fix')}         Apply all safe fixes`);
+  console.log(`    ${c('cyan', 'fix')} [path] ${c('gray', '--fix --commit')}  Each fix = 1 git commit ${c('gray', '(revert any)')}`);
+  console.log(`    ${c('cyan', 'inject')} [path]            Add Mother Code DNA to every file`);
+  console.log(`    ${c('cyan', 'gate')}                     Install pre-commit hook ${c('gray', '(blocks hallucinations)')}`);
+  console.log(`    ${c('cyan', 'watch')} [path]             Live sentinel — scans files as you save`);
+  console.log(`    ${c('cyan', 'baseline')} [path]          Snapshot issues so future scans show only NEW ones`);
+  console.log('');
+
+  // ─── REPORTS ──────────────────────────────────────────────
+  console.log(c('bold', '  REPORTS'));
+  console.log('');
+  console.log(`    ${c('cyan', 'dashboard')} [path]         Interactive HTML report ${c('gray', '(share with your team)')}`);
+  console.log(`    ${c('cyan', 'executive')} [path]         CTO-ready report ${c('gray', '(print to PDF from browser)')}`);
+  console.log(`    ${c('cyan', 'report')} [path]            Combined scan + deps + drift summary`);
+  console.log(`    ${c('cyan', 'passport')} [path]          Codebase identity card ${c('gray', '(for new team members)')}`);
+  console.log('');
+
+  // ─── LICENSE ──────────────────────────────────────────────
   console.log(c('bold', '  LICENSE'));
   console.log('');
-  console.log(`    ${c('cyan', 'thuban activate')} <key>     Activate a license key`);
-  console.log(`    ${c('cyan', 'thuban status')}             Show license and usage status`);
-  console.log(`    ${c('cyan', 'thuban upgrade')}            Get a license key`);
+  console.log(`    ${c('cyan', 'activate')} <key>           Activate a license key`);
+  console.log(`    ${c('cyan', 'status')}                   Show license, usage, and features`);
+  console.log(`    ${c('cyan', 'upgrade')}                  Open pricing page`);
   console.log('');
+
+  // ─── OPTIONS ──────────────────────────────────────────────
   console.log(c('bold', '  OPTIONS'));
   console.log('');
-  console.log(`    ${c('gray', '--json')}                   Output as JSON`);
-  console.log(`    ${c('gray', '--fix')}                    Apply fixes (default: dry-run preview)`);
-  console.log(`    ${c('gray', '--dry-run')}                Preview changes without applying`);
-  console.log(`    ${c('gray', '--unsafe')}                 Allow runtime-changing fixes`);
-  console.log(`    ${c('gray', '--commit')}                 Auto-commit each fix for easy rollback`);
-  console.log(`    ${c('gray', '--baseline')}               Only report NEW issues (vs baseline)`);
-  console.log(`    ${c('gray', '--baseline-create')}        Snapshot current issues as baseline`);
-  console.log(`    ${c('gray', '--verbose')}                Show detailed output`);
-  console.log(`    ${c('gray', '--ignore <pattern>')}       Ignore files matching pattern`);
-  console.log(`    ${c('gray', '--max-issues <n>')}         Limit issues shown (default: 50)`);
+  console.log(`    ${c('gray', '--fix')}              Apply changes ${c('gray', '(default is dry-run preview)')}`);
+  console.log(`    ${c('gray', '--commit')}           Auto-commit each fix for easy rollback`);
+  console.log(`    ${c('gray', '--unsafe')}           Include fixes that change runtime behaviour`);
+  console.log(`    ${c('gray', '--json')}             Machine-readable JSON output`);
+  console.log(`    ${c('gray', '--baseline')}         Only show NEW issues vs saved baseline`);
+  console.log(`    ${c('gray', '--verbose')}          Show detailed output`);
+  console.log(`    ${c('gray', '--ignore <pat>')}     Skip files matching pattern`);
+  console.log(`    ${c('gray', '--max-issues <n>')}   Limit displayed issues ${c('gray', '(default: 50)')}`);
+  console.log('');
+
+  // ─── EXAMPLES ─────────────────────────────────────────────
+  console.log(c('bold', '  EXAMPLES'));
+  console.log('');
+  console.log(c('gray', '  # Scan the current project'));
+  console.log(`    ${c('white', 'npx thuban scan .')}`);
+  console.log('');
+  console.log(c('gray', '  # Find and fix all AI hallucinations'));
+  console.log(`    ${c('white', 'npx thuban hallucinate .')}`);
+  console.log(`    ${c('white', 'npx thuban fix . --fix')}`);
+  console.log('');
+  console.log(c('gray', '  # Generate a report for your CTO'));
+  console.log(`    ${c('white', 'npx thuban executive .')}`);
+  console.log('');
+  console.log(c('gray', '  # Block hallucinated code on every commit'));
+  console.log(`    ${c('white', 'npx thuban gate --fix')}`);
+  console.log('');
+  console.log(c('gray', '  # Scan a specific folder, ignore tests'));
+  console.log(`    ${c('white', 'npx thuban scan ./src --ignore "**/*.test.js"')}`);
   console.log('');
-  console.log(c('gray', '  https://thuban.dev'));
+  console.log(c('gray', '  Report a bug or request a feature:'));
+  console.log(`    ${c('cyan', 'https://github.com/SilverwingsBenefitsGit/thuban/issues')}`);
   console.log('');
 }
 
@@ -159,7 +209,14 @@ function parseArgs(args) {
     else if (arg === '--version' || arg === '-v') { opts.command = 'version'; }
     else if (!opts.command) { opts.command = arg; }
     else if (opts.command === 'activate' && !opts.licenseKey) { opts.licenseKey = arg; }
-    else if (!noPathCommands.includes(opts.command)) { opts.targetPath = path.resolve(arg); }
+    else if (!noPathCommands.includes(opts.command)) {
+      // Don't resolve git URLs as local paths
+      if (arg.match(/^(https?:\/\/|git@)/)) {
+        opts.targetPath = arg;
+      } else {
+        opts.targetPath = path.resolve(arg);
+      }
+    }
     i++;
   }
 
@@ -171,7 +228,7 @@ function parseArgs(args) {
 function collectFiles(dir, ignorePatterns = []) {
   const defaultIgnore = ['node_modules', '.git', 'dist', 'build', '.next', '__pycache__', '.venv', 'venv', 'coverage', '.cache', '.turbo'];
   const allIgnore = [...defaultIgnore, ...ignorePatterns];
-  const extensions = ['.js', '.ts', '.jsx', '.tsx', '.py', '.json', '.mjs', '.cjs'];
+  const extensions = ['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs', '.py', '.pyw', '.go', '.rs', '.java', '.kt', '.cs', '.json'];
   const MAX_FILE_SIZE = 1024 * 1024; // 1MB per file — skip anything larger
   const MAX_FILES = 50000;           // Hard cap to prevent memory issues
   const files = [];
@@ -211,7 +268,34 @@ function collectFiles(dir, ignorePatterns = []) {
 
 async function cmdScan(opts) {
   const startTime = Date.now();
-  const targetPath = path.resolve(opts.targetPath);
+  const gitUrlPattern = /^(https?:\/\/|git@)/;
+  const isGitUrl = gitUrlPattern.test(opts.targetPath);
+  let targetPath = isGitUrl ? opts.targetPath : path.resolve(opts.targetPath);
+  let clonedRepo = null;
+
+  // ─── Git URL detection — clone and scan ─────────────────
+  if (isGitUrl) {
+    if (!opts.json) {
+      console.log('');
+      console.log(c('cyan', '  Cloning repository...'));
+      console.log(c('gray', `  ${opts.targetPath}`));
+    }
+    const tmpDir = path.join(os.tmpdir(), 'thuban-scan-' + Date.now());
+    const { execSync } = require('child_process');
+    try {
+      execSync(`git clone --depth 1 "${opts.targetPath}" "${tmpDir}"`, { stdio: 'pipe', timeout: 60000 });
+      targetPath = tmpDir;
+      clonedRepo = tmpDir;
+      if (!opts.json) {
+        console.log(c('cyan', '  Cloned successfully'));
+        console.log('');
+      }
+    } catch (e) {
+      console.error(c('red', `  Failed to clone repository: ${e.message}`));
+      console.error(c('gray', '  Check the URL is correct and the repo is accessible'));
+      process.exit(1);
+    }
+  }
 
   // ─── License check ───────────────────────────────────────
   const lm = new LicenseManager();
@@ -237,6 +321,23 @@ async function cmdScan(opts) {
 
   if (!opts.json) {
     banner();
+
+    // First-run welcome
+    if (lm.usage.totalScans === 0) {
+      console.log(c('cyan', '  ┌──────────────────────────────────────────────────────┐'));
+      console.log(c('cyan', '  │') + c('bold', '  Welcome to Thuban!                                 ') + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '                                                      ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '  ' + c('gray', 'Thuban scans your codebase for AI hallucinations,') + '   ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '  ' + c('gray', 'dead code, tech debt, and architecture drift.') + '      ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '                                                      ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '  ' + c('gray', 'After this scan, try:') + '                               ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '    ' + c('cyan', 'npx thuban fix .') + '          ' + c('gray', 'Preview fixes') + '           ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '    ' + c('cyan', 'npx thuban dashboard .') + '    ' + c('gray', 'Visual report') + '          ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '    ' + c('cyan', 'npx thuban --help') + '         ' + c('gray', 'All commands') + '           ' + c('cyan', '│'));
+      console.log(c('cyan', '  └──────────────────────────────────────────────────────┘'));
+      console.log('');
+    }
+
     console.log(c('bold', '  SCANNING: ') + c('cyan', targetPath));
     console.log('');
   }
@@ -360,18 +461,24 @@ async function cmdScan(opts) {
   // THE GUT-PUNCH OUTPUT
   // ═══════════════════════════════════════════════════════════
 
+  // ─── Count fixable items ─────────────────────────────────
+  const fixableCount = allIssues.filter(i => i.fixable !== false).length;
+
   console.log(c('cyan', '  ╔══════════════════════════════════════════════════════╗'));
-  console.log(c('cyan', '  ║') + c('bold', '  THUBAN SCAN                                        ') + c('cyan', '║'));
+  console.log(c('cyan', '  ║') + c('bold', '  THUBAN SCAN RESULTS                                ') + c('cyan', '║'));
   console.log(c('cyan', '  ╠══════════════════════════════════════════════════════╣'));
   console.log(c('cyan', '  ║') + `  Files scanned:     ${c('bold', String(files.length).padEnd(6))}` + (isFileCapped ? c('yellow', ` of ${totalFileCount}`) : '              ') + c('cyan', '       ║'));
   console.log(c('cyan', '  ║') + `  Health score:      ${c(scoreColor, (grade + ' (' + Math.round(score) + '/100)').padEnd(20))}` + c('cyan', '           ║'));
+  console.log(c('cyan', '  ║') + `  Issues found:      ${c(allIssues.length > 0 ? 'yellow' : 'green', String(allIssues.length).padEnd(20))}` + c('cyan', '           ║'));
+  console.log(c('cyan', '  ║') + `  Auto-fixable:      ${c('green', String(fixableCount).padEnd(20))}` + c('cyan', '           ║'));
   console.log(c('cyan', '  ║') + `  Scan time:         ${c('gray', (elapsed + 'ms').padEnd(20))}` + c('cyan', '           ║'));
   console.log(c('cyan', '  ╚══════════════════════════════════════════════════════╝'));
   console.log('');
 
   // ─── CRITICAL: Hallucinated APIs (will crash) ────────────
   if (hallucinations.length > 0) {
-    console.log(c('bgRed', ' CRITICAL ') + c('red', c('bold', ` ${hallucinations.length} Hallucinated API${hallucinations.length > 1 ? 's' : ''}`)) + c('red', ' (will crash at runtime)'));
+    console.log(c('bgRed', ' CRITICAL ') + c('red', c('bold', ` ${hallucinations.length} Hallucinated API${hallucinations.length > 1 ? 's' : ''}`)));
+    console.log(c('gray', '  These imports or method calls do not exist. Your code WILL crash when it hits them.'));
     console.log('');
 
     const showCount = tier.showFullDetails ? hallucinations.length : Math.min(tier.teaserIssues, hallucinations.length);
@@ -403,7 +510,9 @@ async function cmdScan(opts) {
 
   // ─── HIGH: Deprecated APIs ───────────────────────────────
   if (deprecated.length > 0) {
-    console.log(c('red', c('bold', `  HIGH: ${deprecated.length} Deprecated API${deprecated.length > 1 ? 's' : ''}`)) + c('gray', ' (will break on Node upgrade)'));
+    console.log(c('red', c('bold', `  DEPRECATED: ${deprecated.length} API${deprecated.length > 1 ? 's' : ''} that will break on upgrade`)));
+    console.log(c('gray', '  These work NOW but will stop working when you upgrade Node.js or your dependencies.'));
+    console.log(c('gray', '  Fix: ') + c('cyan', 'npx thuban fix . --fix --unsafe'));
     console.log('');
 
     const showCount = tier.showFullDetails ? deprecated.length : Math.min(tier.teaserIssues, deprecated.length);
@@ -443,17 +552,44 @@ async function cmdScan(opts) {
   }
 
   if (qualityIssues.length > 0) {
+    // Group quality issues by type for clearer output
+    const qualityByType = {};
+    for (const item of qualityIssues) {
+      const key = item.message || item.type || 'other';
+      // Normalize similar messages
+      const normalizedKey = key.replace(/\s*—.*$/, '').trim();
+      if (!qualityByType[normalizedKey]) qualityByType[normalizedKey] = [];
+      qualityByType[normalizedKey].push(item);
+    }
+    const typeEntries = Object.entries(qualityByType).sort((a, b) => b[1].length - a[1].length);
+
     console.log(c('yellow', c('bold', `  CODE QUALITY: ${qualityIssues.length} issue${qualityIssues.length > 1 ? 's' : ''}`)));
-    const showCount = tier.showFullDetails ? Math.min(qualityIssues.length, 10) : Math.min(3, qualityIssues.length);
-    for (const item of qualityIssues.slice(0, showCount)) {
-      const lineRef = item.line ? `:${item.line}` : '';
-      const sevColor = item.severity === 'high' || item.severity === 'error' ? 'red' : 'yellow';
-      console.log(`    ${c(sevColor, '!')} ${c('cyan', item.file + lineRef)} ${c('gray', item.message)}`);
+    console.log(c('gray', '  Patterns that reduce code quality, maintainability, or production readiness.'));
+    console.log('');
+
+    // Show grouped summary
+    const showTypes = tier.showFullDetails ? typeEntries.length : Math.min(3, typeEntries.length);
+    for (let t = 0; t < showTypes; t++) {
+      const [typeName, items] = typeEntries[t];
+      const sevColor = items[0].severity === 'high' || items[0].severity === 'error' ? 'red' : 'yellow';
+      console.log(`    ${c(sevColor, '!')} ${c('bold', String(items.length))} x ${typeName}`);
+      // Show first example file
+      if (items[0].file) {
+        const lineRef = items[0].line ? `:${items[0].line}` : '';
+        console.log(`      ${c('gray', 'e.g.')} ${c('cyan', items[0].file + lineRef)}`);
+      }
     }
-    if (qualityIssues.length > showCount) {
-      console.log(c('gray', `    ... ${qualityIssues.length - showCount} more`));
+    if (typeEntries.length > showTypes) {
+      console.log(c('gray', `    ... ${typeEntries.length - showTypes} more issue types`));
     }
     console.log('');
+
+    // Show fix command if fixable
+    const fixableQuality = qualityIssues.filter(i => i.fixable !== false).length;
+    if (fixableQuality > 0) {
+      console.log(c('gray', `  ${fixableQuality} of these can be auto-fixed: `) + c('cyan', 'npx thuban fix . --fix --unsafe'));
+      console.log('');
+    }
   }
 
   // ─── THE VERDICT ─────────────────────────────────────────
@@ -501,10 +637,36 @@ async function cmdScan(opts) {
     console.log(c('gray', `  Free scans remaining this month: ${remaining}/${scanStatus.limit}`));
     console.log('');
   } else {
-    // Pro/Team: show fix command
+    // Pro/Team: show clear next steps
     if (allIssues.length > 0) {
-      console.log(`  ${c('cyan', 'thuban fix . --fix')}     Auto-fix all fixable issues`);
-      console.log(`  ${c('cyan', 'thuban dashboard .')}    Generate full HTML report`);
+      const fixable = allIssues.filter(i => i.fixable !== false).length;
+      console.log(c('cyan', '  ┌──────────────────────────────────────────────────────┐'));
+      console.log(c('cyan', '  │') + c('bold', '  WHAT TO DO NEXT                                    ') + c('cyan', '│'));
+      console.log(c('cyan', '  ├──────────────────────────────────────────────────────┤'));
+      console.log(c('cyan', '  │') + '                                                      ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '  ' + c('bold', '1. See what would be fixed (safe preview):') + '         ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '     ' + c('cyan', 'npx thuban fix . ') + '                                ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '                                                      ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '  ' + c('bold', '2. Apply all safe fixes:') + '                            ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '     ' + c('cyan', 'npx thuban fix . --fix') + '                           ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '                                                      ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '  ' + c('bold', '3. Apply fixes with git rollback:') + '                   ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '     ' + c('cyan', 'npx thuban fix . --fix --commit') + '                  ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '     ' + c('gray', 'Each fix = 1 git commit. Undo any with git revert.') + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '                                                      ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '  ' + c('bold', '4. Generate visual report (HTML):') + '                   ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '     ' + c('cyan', 'npx thuban dashboard .') + '                           ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '     ' + c('gray', 'Opens a dashboard you can share with your team.') + '  ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '                                                      ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '  ' + c('bold', '5. Show tech debt cost in £:') + '                        ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '     ' + c('cyan', 'npx thuban cost .') + '                                ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '                                                      ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '  ' + c('bold', '6. Block bad code on every commit:') + '                  ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '     ' + c('cyan', 'npx thuban gate') + '                                  ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '     ' + c('gray', 'Installs a pre-commit hook. Set once, forget.') + '    ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '                                                      ' + c('cyan', '│'));
+      console.log(c('cyan', '  │') + '  ' + c('gray', 'All commands: npx thuban --help') + '                     ' + c('cyan', '│'));
+      console.log(c('cyan', '  └──────────────────────────────────────────────────────┘'));
       console.log('');
     }
   }
@@ -514,6 +676,19 @@ async function cmdScan(opts) {
     console.log(c('gray', `  Your actual score may be worse. Upgrade to scan everything.`));
     console.log('');
   }
+
+  // ─── Continuous monitoring pitch ────────────────────────
+  if (allIssues.length > 0 && !isFileCapped) {
+    console.log(c('gray', '  ─────────────────────────────────────────────────────'));
+    console.log(c('gray', '  Thuban runs 100% on your machine. No data leaves.'));
+    console.log(c('gray', '  No cloud costs. As your codebase grows, Thuban grows with it.'));
+    console.log('');
+    console.log(c('gray', '  Keep your codebase healthy continuously:'));
+    console.log(c('gray', '    ') + c('cyan', 'npx thuban gate --fix') + c('gray', '   Block bad code on every commit'));
+    console.log(c('gray', '    ') + c('cyan', 'npx thuban watch .') + c('gray', '      Scan files as you save them'));
+    console.log(c('gray', '    ') + c('cyan', 'npx thuban baseline .') + c('gray', '   Only alert on NEW issues'));
+    console.log('');
+  }
 }
 
 async function cmdDeps(opts) {
@@ -830,6 +1005,11 @@ async function cmdReport(opts) {
     if (orphans.length > 5) console.log(`  ${c('gray', '→')} Consider removing ${orphans.length} orphan files`);
     console.log('');
   }
+
+  // Clean up cloned repo
+  if (clonedRepo) {
+    try { fs.rmSync(clonedRepo, { recursive: true, force: true }); } catch {}
+  }
 }
 
 // ─── Tech Debt & Fix Commands ────────────────────────────
@@ -882,7 +1062,7 @@ async function cmdFix(opts) {
 
       const grouped = {};
       const safeActions = ['inject_widget', 'regenerate_widget', 'remove_console_log', 'flag_for_removal'];
-      const unsafeActions = ['break_circular', 'extract_to_env', 'update_deprecated_api'];
+      const unsafeActions = ['break_circular', 'extract_to_env', 'update_deprecated_api', 'wrap_localhost_url'];
       let safeCount = 0;
       let unsafeCount = 0;
 
@@ -914,7 +1094,8 @@ async function cmdFix(opts) {
           const label = {
             'break_circular': 'Restructure circular dependencies',
             'extract_to_env': 'Extract hardcoded secrets to env vars',
-            'update_deprecated_api': 'Replace deprecated API calls',
+            'update_deprecated_api': 'Replace deprecated API calls with modern equivalents',
+            'wrap_localhost_url': 'Wrap hardcoded localhost URLs in env var fallback',
           }[action] || action;
           console.log(`    ${c('yellow', '!')} ${label}: ${c('bold', count)}`);
         }
@@ -973,18 +1154,43 @@ async function cmdFix(opts) {
   if (opts.json) {
     console.log(JSON.stringify(result, null, 2));
   } else {
-    console.log(c('green', `  ✓ Fixed ${result.fixed} items`));
-    console.log(c('yellow', `  ⚠ Flagged ${result.flagged} items for manual review`));
-    if (result.failed > 0) console.log(c('red', `  ✗ Failed: ${result.failed}`));
+    console.log(c('cyan', '  ╔══════════════════════════════════════════════════════╗'));
+    console.log(c('cyan', '  ║') + c('bold', '  FIX RESULTS                                        ') + c('cyan', '║'));
+    console.log(c('cyan', '  ╠══════════════════════════════════════════════════════╣'));
+    console.log(c('cyan', '  ║') + `  Fixed:             ${c('green', String(result.fixed).padEnd(20))}` + c('cyan', '           ║'));
+    console.log(c('cyan', '  ║') + `  Flagged for review: ${c('yellow', String(result.flagged).padEnd(19))}` + c('cyan', '           ║'));
+    if (result.failed > 0) {
+      console.log(c('cyan', '  ║') + `  Failed:            ${c('red', String(result.failed).padEnd(20))}` + c('cyan', '           ║'));
+    }
     if (result.skippedUnsafe > 0) {
-      console.log(c('gray', `  ○ Skipped ${result.skippedUnsafe} unsafe fixes (use --unsafe to apply)`));
+      console.log(c('cyan', '  ║') + `  Skipped (unsafe):  ${c('gray', String(result.skippedUnsafe).padEnd(20))}` + c('cyan', '           ║'));
     }
+    console.log(c('cyan', '  ╚══════════════════════════════════════════════════════╝'));
     console.log('');
-    console.log(c('gray', `  Run 'thuban report' to see updated scores`));
-    if (!opts.gitCommit) {
-      console.log(c('gray', `  Tip: use --commit to auto-commit fixes for easy rollback`));
+
+    if (result.fixed > 0) {
+      console.log(c('green', '  Your files have been updated. Changes are saved to disk.'));
+      if (!opts.gitCommit) {
+        console.log(c('gray', '  Tip: use --commit next time to auto-commit each fix for easy rollback.'));
+      }
+      console.log('');
+      console.log(c('gray', '  Verify the changes:'));
+      console.log(c('gray', '    ') + c('cyan', 'npx thuban scan .') + c('gray', '        Re-scan to see your new score'));
+      console.log(c('gray', '    ') + c('cyan', 'npx thuban dashboard .') + c('gray', '   Generate updated report'));
+      console.log('');
+    }
+
+    if (result.skippedUnsafe > 0) {
+      console.log(c('gray', `  ${result.skippedUnsafe} unsafe fixes were skipped. These change runtime behaviour.`));
+      console.log(c('gray', '  Review them with: ') + c('cyan', 'npx thuban fix . --fix --unsafe'));
+      console.log('');
+    }
+
+    if (result.flagged > 0) {
+      console.log(c('gray', `  ${result.flagged} items need human review (secrets, orphan files, complex patterns).`));
+      console.log(c('gray', '  See details: ') + c('cyan', 'npx thuban dashboard .'));
+      console.log('');
     }
-    console.log('');
   }
 }
 
@@ -1786,6 +1992,292 @@ async function cmdBaseline(opts) {
   }
 }
 
+// ─── Telemetry (opt-in anonymous usage stats) ───────────────
+
+function getTelemetryConfigPath() {
+  const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+  return path.join(home, '.thuban-telemetry.json');
+}
+
+function isTelemetryEnabled() {
+  try {
+    const config = JSON.parse(fs.readFileSync(getTelemetryConfigPath(), 'utf-8'));
+    return config.enabled === true;
+  } catch { return false; }
+}
+
+function sendAnonymousTelemetry(data) {
+  if (!isTelemetryEnabled()) return;
+  try {
+    const payload = JSON.stringify({
+      v: data.version || '0.3.1',
+      cmd: data.command,
+      files: data.fileCount,
+      score: data.score,
+      grade: data.grade,
+      langs: data.languages,
+      issues: data.issueCount,
+      duration: data.duration,
+      os: process.platform,
+      node: process.version,
+      ts: new Date().toISOString()
+    });
+    // Fire and forget — never blocks the CLI
+    const https = require('https');
+    const req = https.request({
+      hostname: 'thuban-telemetry.silverwingsbenefits.workers.dev',
+      path: '/report',
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+      timeout: 3000
+    });
+    req.on('error', () => {}); // silently ignore
+    req.write(payload);
+    req.end();
+  } catch { /* never fail the CLI for telemetry */ }
+}
+
+async function cmdTelemetry(opts) {
+  const configPath = getTelemetryConfigPath();
+  const args = process.argv.slice(2);
+
+  if (args.includes('--on')) {
+    fs.writeFileSync(configPath, JSON.stringify({ enabled: true, updated: new Date().toISOString() }));
+    console.log('');
+    console.log(c('cyan', '  Telemetry enabled'));
+    console.log(c('gray', '  Anonymous usage stats will be sent (no code, no paths, no PII)'));
+    console.log(c('gray', '  Turn off anytime: npx thuban telemetry --off'));
+    console.log('');
+  } else if (args.includes('--off')) {
+    fs.writeFileSync(configPath, JSON.stringify({ enabled: false, updated: new Date().toISOString() }));
+    console.log('');
+    console.log(c('cyan', '  Telemetry disabled'));
+    console.log(c('gray', '  No data will be collected'));
+    console.log('');
+  } else {
+    const enabled = isTelemetryEnabled();
+    console.log('');
+    console.log(c('bold', '  TELEMETRY STATUS'));
+    console.log('');
+    console.log(`  Status:   ${enabled ? c('cyan', 'Enabled') : c('gray', 'Disabled (default)')}`);
+    console.log('');
+    console.log(c('gray', '  Thuban telemetry is 100% opt-in and anonymous.'));
+    console.log(c('gray', '  We collect: file count, score, grade, languages, OS, scan duration.'));
+    console.log(c('gray', '  We never collect: code, file names, paths, project names, or PII.'));
+    console.log('');
+    console.log(`  Enable:   ${c('cyan', 'npx thuban telemetry --on')}`);
+    console.log(`  Disable:  ${c('cyan', 'npx thuban telemetry --off')}`);
+    console.log('');
+  }
+}
+
+// ─── Internal scan (returns data without printing) ──────────
+
+async function runScanSilent(targetInput) {
+  const gitUrlPattern = /^(https?:\/\/|git@)/;
+  const isGitUrl = gitUrlPattern.test(targetInput);
+  let targetPath = isGitUrl ? targetInput : path.resolve(targetInput);
+  let clonedRepo = null;
+  let label = targetInput;
+
+  if (isGitUrl) {
+    const tmpDir = path.join(os.tmpdir(), 'thuban-compare-' + Date.now() + '-' + Math.random().toString(36).slice(2,6));
+    const { execSync } = require('child_process');
+    execSync(`git clone --depth 1 "${targetInput}" "${tmpDir}"`, { stdio: 'pipe', timeout: 60000 });
+    targetPath = tmpDir;
+    clonedRepo = tmpDir;
+    // Extract repo name for label
+    const parts = targetInput.replace(/\.git$/, '').split('/');
+    label = parts[parts.length - 1] || targetInput;
+  } else {
+    label = path.basename(path.resolve(targetInput)) || targetInput;
+  }
+
+  const startTime = Date.now();
+  const scanner = new CodeScanner();
+  const graph = new DependencyGraph();
+  const hallDetector = new HallucinationDetector({ rootPath: targetPath });
+
+  const files = collectFiles(targetPath, []);
+  const scanResults = {};
+  let annotated = 0;
+  let driftCount = 0;
+
+  for (const file of files) {
+    try {
+      const result = scanner.scanFile(file);
+      const relPath = path.relative(targetPath, file);
+      scanResults[file] = result;
+      graph.addFile(file, targetPath);
+      if (result.motherCode && result.motherCode.hasDNA) annotated++;
+      if (result.drifts && result.drifts.length > 0) driftCount++;
+    } catch (e) { /* skip */ }
+  }
+
+  // Run hallucination detection (same as main scan)
+  const hallResults = hallDetector.scan(files, targetPath);
+
+  const elapsed = Date.now() - startTime;
+  let totalIssues = 0, criticalCount = 0, highCount = 0;
+  const issueByCat = {};
+
+  // Count code scanner issues
+  for (const [, r] of Object.entries(scanResults)) {
+    if (r.issues) {
+      totalIssues += r.issues.length;
+      for (const iss of r.issues) {
+        if (iss.severity === 'critical') criticalCount++;
+        if (iss.severity === 'high') highCount++;
+        const cat = iss.category || iss.type || 'other';
+        issueByCat[cat] = (issueByCat[cat] || 0) + 1;
+      }
+    }
+  }
+
+  // Count hallucination issues
+  const hallIssueCount = (hallResults.phantomAPIs || []).length
+    + (hallResults.phantomImports || []).length
+    + (hallResults.deprecatedAPIs || []).length;
+  totalIssues += hallIssueCount;
+  criticalCount += (hallResults.phantomAPIs || []).length + (hallResults.phantomImports || []).length;
+  highCount += (hallResults.deprecatedAPIs || []).length;
+  if (hallIssueCount > 0) issueByCat['hallucination'] = hallIssueCount;
+
+  const orphans = graph.getOrphanFiles();
+  const circular = graph.circularDeps || [];
+  const coverage = files.length > 0 ? Math.round((annotated / files.length) * 100) : 0;
+
+  const score = Math.max(0, Math.round(
+    100 - (criticalCount * 15) - (highCount * 5) - (circular.length * 10)
+    - (orphans.length * 1) - ((100 - coverage) * 0.1) - (driftCount * 3)
+  ));
+
+  const grade = score >= 90 ? 'A' : score >= 80 ? 'B' : score >= 70 ? 'C' : score >= 60 ? 'D' : 'F';
+
+  if (clonedRepo) {
+    try { fs.rmSync(clonedRepo, { recursive: true, force: true }); } catch {}
+  }
+
+  return {
+    label,
+    files: files.length,
+    score,
+    grade,
+    elapsed,
+    issues: { total: totalIssues, critical: criticalCount, high: highCount },
+    categories: issueByCat,
+    dependencies: { circular: circular.length, orphans: orphans.length },
+    motherCode: { annotated, coverage, drifted: driftCount }
+  };
+}
+
+// ─── Compare Command ────────────────────────────────────────
+
+async function cmdCompare(opts) {
+  const args = process.argv.slice(2);
+  // Find the two paths after 'compare'
+  const paths = args.filter(a => a !== 'compare' && !a.startsWith('--'));
+
+  if (paths.length < 2) {
+    console.log('');
+    console.log(c('red', '  Compare requires two paths or URLs'));
+    console.log('');
+    console.log(c('gray', '  Usage:'));
+    console.log(`    ${c('cyan', 'npx thuban compare ./project-a ./project-b')}`);
+    console.log(`    ${c('cyan', 'npx thuban compare . https://github.com/user/repo')}`);
+    console.log(`    ${c('cyan', 'npx thuban compare https://github.com/a/repo https://github.com/b/repo')}`);
+    console.log('');
+    process.exit(1);
+  }
+
+  console.log('');
+  console.log(c('bold', '  ╔══════════════════════════════════════╗'));
+  console.log(c('bold', '  ║     THUBAN — Codebase Comparison     ║'));
+  console.log(c('bold', '  ╚══════════════════════════════════════╝'));
+  console.log('');
+
+  console.log(c('cyan', `  Scanning: ${paths[0]}`));
+  const resultA = await runScanSilent(paths[0]);
+  console.log(c('cyan', `  Scanning: ${paths[1]}`));
+  const resultB = await runScanSilent(paths[1]);
+
+  console.log('');
+
+  // ─── Side by side comparison ────────────────────────────
+  const pad = (str, len) => String(str).padEnd(len);
+  const padL = (str, len) => String(str).padStart(len);
+  const colW = 20;
+  const labelA = resultA.label.length > colW ? resultA.label.slice(0, colW - 2) + '..' : resultA.label;
+  const labelB = resultB.label.length > colW ? resultB.label.slice(0, colW - 2) + '..' : resultB.label;
+
+  const scoreColorA = resultA.score >= 80 ? 'green' : resultA.score >= 60 ? 'yellow' : 'red';
+  const scoreColorB = resultB.score >= 80 ? 'green' : resultB.score >= 60 ? 'yellow' : 'red';
+
+  const arrow = (a, b) => {
+    if (a === b) return c('gray', '  =');
+    return a > b ? c('green', '  ↑') : c('red', '  ↓');
+  };
+
+  const better = (a, b, lowerIsBetter) => {
+    if (a === b) return c('gray', ' draw');
+    if (lowerIsBetter) return a < b ? c('green', ' ← winner') : c('red', '');
+    return a > b ? c('green', ' ← winner') : c('red', '');
+  };
+
+  console.log(c('bold', '  ┌──────────────────────┬──────────────────────┬──────────────────────┐'));
+  console.log(c('bold', `  │ ${pad('METRIC', colW)} │ ${pad(labelA, colW)} │ ${pad(labelB, colW)} │`));
+  console.log(c('bold', '  ├──────────────────────┼──────────────────────┼──────────────────────┤'));
+
+  const row = (label, valA, valB) => {
+    console.log(`  │ ${c('gray', pad(label, colW))} │ ${pad(valA, colW)} │ ${pad(valB, colW)} │`);
+  };
+
+  row('Health Score', `${c(scoreColorA, resultA.score + '/100')}`, `${c(scoreColorB, resultB.score + '/100')}`);
+  row('Grade', `${c(scoreColorA, resultA.grade)}`, `${c(scoreColorB, resultB.grade)}`);
+  row('Files Scanned', String(resultA.files), String(resultB.files));
+  row('Total Issues', String(resultA.issues.total), String(resultB.issues.total));
+  row('Critical Issues', String(resultA.issues.critical), String(resultB.issues.critical));
+  row('High Issues', String(resultA.issues.high), String(resultB.issues.high));
+  row('Circular Deps', String(resultA.dependencies.circular), String(resultB.dependencies.circular));
+  row('Orphan Files', String(resultA.dependencies.orphans), String(resultB.dependencies.orphans));
+  row('Mother Code DNA', `${resultA.motherCode.coverage}%`, `${resultB.motherCode.coverage}%`);
+  row('Drift Issues', String(resultA.motherCode.drifted), String(resultB.motherCode.drifted));
+  row('Scan Time', `${resultA.elapsed}ms`, `${resultB.elapsed}ms`);
+
+  console.log(c('bold', '  └──────────────────────┴──────────────────────┴──────────────────────┘'));
+  console.log('');
+
+  // ─── Verdict ────────────────────────────────────────────
+  const diff = resultA.score - resultB.score;
+  if (diff === 0) {
+    console.log(c('cyan', `  VERDICT: Both codebases score identically (${resultA.score}/100)`));
+  } else {
+    const winner = diff > 0 ? resultA : resultB;
+    const loser = diff > 0 ? resultB : resultA;
+    console.log(c('cyan', `  VERDICT: ${winner.label} is healthier`));
+    console.log(c('gray', `  ${winner.label} scores ${winner.score}/100 (${winner.grade}) vs ${loser.label} at ${loser.score}/100 (${loser.grade})`));
+    console.log(c('gray', `  ${Math.abs(diff)} point difference — ${Math.abs(diff) > 20 ? 'significant gap' : Math.abs(diff) > 10 ? 'moderate gap' : 'close race'}`));
+  }
+
+  // ─── Issue breakdown comparison ─────────────────────────
+  const allCats = new Set([...Object.keys(resultA.categories), ...Object.keys(resultB.categories)]);
+  if (allCats.size > 0) {
+    console.log('');
+    console.log(c('bold', '  ISSUE BREAKDOWN'));
+    for (const cat of allCats) {
+      const countA = resultA.categories[cat] || 0;
+      const countB = resultB.categories[cat] || 0;
+      const catLabel = cat.charAt(0).toUpperCase() + cat.slice(1);
+      console.log(c('gray', `    ${pad(catLabel, 22)} ${padL(countA, 5)} vs ${padL(countB, 5)}  ${countA < countB ? c('green', `← ${labelA}`) : countA > countB ? c('green', `→ ${labelB}`) : c('gray', 'tied')}`));
+    }
+  }
+
+  console.log('');
+  console.log(c('gray', `  Full scan: npx thuban scan ${paths[0]}`));
+  console.log(c('gray', `  Full scan: npx thuban scan ${paths[1]}`));
+  console.log('');
+}
+
 async function main() {
   const args = process.argv.slice(2);
   const opts = parseArgs(args);
@@ -1802,9 +2294,9 @@ async function main() {
   }
 
   // Verify target path exists
-  const noPathCommands2 = ['activate', 'status', 'upgrade'];
+  const noPathCommands2 = ['activate', 'status', 'upgrade', 'telemetry', 'compare'];
 
-  if (!noPathCommands2.includes(opts.command) && !fs.existsSync(opts.targetPath)) {
+  if (!noPathCommands2.includes(opts.command) && !opts.targetPath.match(/^(https?:\/\/|git@)/) && !fs.existsSync(opts.targetPath)) {
     console.error(c('red', `  Error: Path not found: ${opts.targetPath}`));
     process.exit(1);
   }
@@ -1887,9 +2379,27 @@ async function main() {
       case 'baseline':
         await cmdBaseline(opts);
         break;
+      case 'telemetry':
+        await cmdTelemetry(opts);
+        break;
+      case 'compare':
+        await cmdCompare(opts);
+        break;
       default:
+        console.error('');
         console.error(c('red', `  Unknown command: ${opts.command}`));
-        console.error(c('gray', `  Run 'thuban --help' for usage`));
+        console.error('');
+        // Suggest closest match
+        const allCmds = ['scan','compare','deps','drift','inject','health','report','debt','fix','hallucinate','watch','dashboard','diff','gate','cost','ghosts','ai-score','clones','passport','executive','baseline','activate','status','upgrade','telemetry'];
+        const suggestions = allCmds.filter(cmd => cmd.startsWith(opts.command.slice(0,2)) || cmd.includes(opts.command));
+        if (suggestions.length > 0) {
+          console.error(c('gray', `  Did you mean: `) + c('cyan', suggestions.join(', ')) + c('gray', '?'));
+          console.error('');
+        }
+        console.error(c('gray', '  Quick start:'));
+        console.error(`    ${c('cyan', 'npx thuban scan .')}       Scan your project`);
+        console.error(`    ${c('cyan', 'npx thuban --help')}       See all commands`);
+        console.error('');
         process.exit(1);
     }
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thuban",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "The safety layer for AI-coded software. Detect hallucinated APIs, ghost code, tech debt, and architecture drift. One command. Zero dependencies.",
   "bin": {
     "thuban": "./cli.js"

package/packages/scanner/code-scanner.js

@@ -333,9 +333,10 @@ class CodeScanner extends EventEmitter {
       const content = fs.readFileSync(filePath, 'utf8');
       const lines = content.split('\n');
       const ext = path.extname(filePath).toLowerCase();
+      const supportedExts = ['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs', '.py', '.pyw', '.go', '.rs', '.java', '.kt', '.cs'];
 
-      // Only scan JS/TS files with pattern matching
-      if (['.js', '.ts', '.jsx', '.tsx'].includes(ext)) {
+      // Scan supported source files with pattern matching
+      if (supportedExts.includes(ext)) {
         // Security scan
         issues.push(...this._runPatternScan(filePath, content, lines, this.securityPatterns, 'security'));
 

package/packages/scanner/dependency-graph.js

@@ -47,7 +47,7 @@ class DependencyGraph extends EventEmitter {
    * Build the full dependency graph
    */
   async build() {
-    console.log('[DEPENDENCY-GRAPH] Building dependency graph...');
+    // debug logging silenced for clean output
     const startTime = Date.now();
 
     // Clear existing graph
@@ -62,7 +62,6 @@ class DependencyGraph extends EventEmitter {
 
     // Discover all files
     const files = await this._discoverFiles(this.config.rootPath);
-    console.log(`[DEPENDENCY-GRAPH] Found ${files.length} files to analyze`);
 
     // First pass: extract all imports
     for (const file of files) {
@@ -76,8 +75,6 @@ class DependencyGraph extends EventEmitter {
     this._detectCircularDependencies();
 
     const duration = Date.now() - startTime;
-    console.log(`[DEPENDENCY-GRAPH] Graph built in ${duration}ms`);
-    console.log(`[DEPENDENCY-GRAPH] ${this.stats.filesAnalyzed} files, ${this.stats.totalImports} imports, ${this.stats.unresolvedImports} unresolved`);
 
     return this.getStats();
   }

package/packages/scanner/drift-detector.js

@@ -36,7 +36,6 @@ class DriftDetector extends EventEmitter {
    * Detect drift across all files
    */
   async detectAll() {
-    console.log('[DRIFT-DETECTOR] Starting drift detection...');
     const startTime = Date.now();
 
     const result = {
@@ -86,7 +85,6 @@ class DriftDetector extends EventEmitter {
       result.issues.push(...this._analyzeCrossFile(result.moduleMap));
 
       result.duration = Date.now() - startTime;
-      console.log(`[DRIFT-DETECTOR] Detection complete: ${result.filesAnalyzed} files, ${result.issues.length} drift issues`);
 
       return result;
     } catch (error) {

package/packages/scanner/hallucination-detector.js

@@ -69,6 +69,81 @@ class HallucinationDetector {
       { pattern: /process\.exit\s*\(\s*['"]/, suggestion: 'process.exit() takes a number, not a string', name: 'process.exit(string)', id: 'HALL_API018' },
     ];
 
+    // ─── Python phantom APIs ────────────────────────────────
+    this.pythonPhantomAPIs = [
+      { pattern: /os\.path\.exists_sync\s*\(/, suggestion: 'Use os.path.exists() — exists_sync does not exist in Python', name: 'os.path.exists_sync', id: 'PY_HALL001' },
+      { pattern: /json\.tryParse\s*\(/, suggestion: 'Use json.loads() with try/except', name: 'json.tryParse', id: 'PY_HALL002' },
+      { pattern: /list\.flatMap\s*\(/, suggestion: 'Python lists have no flatMap — use list comprehension', name: 'list.flatMap', id: 'PY_HALL003' },
+      { pattern: /dict\.merge\s*\(/, suggestion: 'Use {**dict1, **dict2} or dict1 | dict2 (3.9+)', name: 'dict.merge', id: 'PY_HALL004' },
+      { pattern: /string\.format_map\s*\((?!.*\bself\b)/, suggestion: 'str.format_map exists but is rarely correct — did you mean .format()?', name: 'string.format_map misuse', id: 'PY_HALL005' },
+      { pattern: /from\s+collections\s+import\s+OrderedDict.*#.*maintain\s+order/i, suggestion: 'Regular dict maintains order since Python 3.7 — OrderedDict is unnecessary', name: 'Unnecessary OrderedDict', id: 'PY_HALL006' },
+      { pattern: /async\s+def\s+\w+.*asyncio\.sleep\s*\(\s*0\s*\)\s*#.*yield/i, suggestion: 'asyncio.sleep(0) to yield is a code smell — review async design', name: 'asyncio.sleep(0) hack', id: 'PY_HALL007' },
+      { pattern: /import\s+tensorflow\.v2/, suggestion: 'tensorflow.v2 is not a real module — use import tensorflow', name: 'tensorflow.v2', id: 'PY_HALL008' },
+      { pattern: /from\s+sklearn\.model_selection\s+import\s+train_test_split_v2/, suggestion: 'train_test_split_v2 does not exist — use train_test_split', name: 'sklearn v2 hallucination', id: 'PY_HALL009' },
+      { pattern: /requests\.async_get\s*\(/, suggestion: 'requests has no async_get — use aiohttp or httpx', name: 'requests.async_get', id: 'PY_HALL010' },
+    ];
+
+    this.pythonDeprecated = [
+      { pattern: /from\s+distutils/, suggestion: 'distutils removed in Python 3.12 — use setuptools', since: 'Python 3.12', name: 'distutils', id: 'PY_DEPR001' },
+      { pattern: /from\s+imp\s+import/, suggestion: 'imp removed in Python 3.12 — use importlib', since: 'Python 3.12', name: 'imp module', id: 'PY_DEPR002' },
+      { pattern: /asyncio\.get_event_loop\(\)/, suggestion: 'Deprecated in 3.10+ — use asyncio.run() or get_running_loop()', since: 'Python 3.10', name: 'asyncio.get_event_loop()', id: 'PY_DEPR003' },
+      { pattern: /collections\.MutableMapping/, suggestion: 'Moved to collections.abc.MutableMapping in Python 3.3+', since: 'Python 3.9', name: 'collections.MutableMapping', id: 'PY_DEPR004' },
+      { pattern: /optparse\.OptionParser/, suggestion: 'optparse deprecated since Python 3.2 — use argparse', since: 'Python 3.2', name: 'optparse', id: 'PY_DEPR005' },
+      { pattern: /cgi\.parse_header\s*\(/, suggestion: 'cgi module deprecated in Python 3.11, removed in 3.13', since: 'Python 3.11', name: 'cgi module', id: 'PY_DEPR006' },
+      { pattern: /from\s+typing\s+import\s+(List|Dict|Tuple|Set)\b/, suggestion: 'Use built-in list, dict, tuple, set for type hints (Python 3.9+)', since: 'Python 3.9', name: 'typing.List/Dict/Tuple', id: 'PY_DEPR007' },
+      { pattern: /unittest\.makeSuite\s*\(/, suggestion: 'makeSuite deprecated — use TestLoader.loadTestsFromTestCase', since: 'Python 3.11', name: 'unittest.makeSuite', id: 'PY_DEPR008' },
+    ];
+
+    this.pythonSmells = [
+      { pattern: /print\s*\(\s*f?['"]\s*debug/i, id: 'PY_SMELL001', name: 'Debug Print', message: 'Debug print statement left in code' },
+      { pattern: /except\s*:\s*$|except\s+Exception\s*:\s*\n\s*pass/m, id: 'PY_SMELL002', name: 'Bare Except', message: 'Bare except or swallowed exception — hides real errors' },
+      { pattern: /#\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'PY_SMELL003', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
+      { pattern: /raise\s+NotImplementedError\s*\(?\s*\)?/, id: 'PY_SMELL004', name: 'Not Implemented', message: 'Stub implementation — function body was not generated' },
+      { pattern: /['"]your.api.key.here['"]|['"]sk-[.]{3,}['"]/i, id: 'PY_SMELL005', name: 'Dummy Credential', message: 'Placeholder credential — will fail at runtime' },
+      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'PY_SMELL006', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
+      { pattern: /import\s+\*/, id: 'PY_SMELL007', name: 'Wildcard Import', message: 'Wildcard import — pollutes namespace, hides dependencies' },
+    ];
+
+    // ─── Go phantom APIs ────────────────────────────────────
+    this.goPhantomAPIs = [
+      { pattern: /ioutil\.ReadFile\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.ReadFile()', name: 'ioutil.ReadFile', id: 'GO_HALL001' },
+      { pattern: /ioutil\.WriteFile\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.WriteFile()', name: 'ioutil.WriteFile', id: 'GO_HALL002' },
+      { pattern: /ioutil\.TempDir\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use os.MkdirTemp()', name: 'ioutil.TempDir', id: 'GO_HALL003' },
+      { pattern: /ioutil\.ReadAll\s*\(/, suggestion: 'ioutil removed in Go 1.16 — use io.ReadAll()', name: 'ioutil.ReadAll', id: 'GO_HALL004' },
+      { pattern: /strings\.Title\s*\(/, suggestion: 'strings.Title deprecated in Go 1.18 — use cases.Title from golang.org/x/text', name: 'strings.Title', id: 'GO_HALL005' },
+    ];
+
+    this.goSmells = [
+      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'GO_SMELL001', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
+      { pattern: /panic\s*\(\s*["']not implemented["']\s*\)/, id: 'GO_SMELL002', name: 'Panic Not Implemented', message: 'Stub implementation — will panic at runtime' },
+      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'GO_SMELL003', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
+    ];
+
+    // ─── Rust phantom APIs ──────────────────────────────────
+    this.rustSmells = [
+      { pattern: /todo!\s*\(\s*\)/, id: 'RS_SMELL001', name: 'todo! macro', message: 'todo!() macro — will panic at runtime' },
+      { pattern: /unimplemented!\s*\(\s*\)/, id: 'RS_SMELL002', name: 'unimplemented! macro', message: 'unimplemented!() macro — will panic at runtime' },
+      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'RS_SMELL003', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
+      { pattern: /unwrap\(\).*unwrap\(\)/, id: 'RS_SMELL004', name: 'Double Unwrap', message: 'Chained unwrap() — will panic on None/Err' },
+      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'RS_SMELL005', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
+    ];
+
+    // ─── Java/C# common issues ──────────────────────────────
+    this.javaSmells = [
+      { pattern: /System\.out\.println\s*\(.*debug/i, id: 'JAVA_SMELL001', name: 'Debug Println', message: 'Debug System.out.println — use a logger' },
+      { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)/i, id: 'JAVA_SMELL002', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished' },
+      { pattern: /throw\s+new\s+(?:Runtime)?Exception\s*\(\s*["']Not\s+implemented["']/i, id: 'JAVA_SMELL003', name: 'Not Implemented', message: 'Stub implementation — will throw at runtime' },
+      { pattern: /catch\s*\(\s*Exception\s+\w+\s*\)\s*\{\s*\}/, id: 'JAVA_SMELL004', name: 'Empty Catch', message: 'Empty catch block — swallows all exceptions' },
+      { pattern: /localhost:\d{4}(?!.*(?:dev|test|local|development))/i, id: 'JAVA_SMELL005', name: 'Hardcoded Localhost', message: 'Hardcoded localhost URL — will fail in production' },
+    ];
+
+    // Language extensions mapping
+    this.jsExtensions = new Set(['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs']);
+    this.pyExtensions = new Set(['.py', '.pyw']);
+    this.goExtensions = new Set(['.go']);
+    this.rustExtensions = new Set(['.rs']);
+    this.javaExtensions = new Set(['.java', '.kt', '.cs']);
+
     // Patterns suggesting AI-generated code with common issues
     this.aiCodeSmells = [
       { pattern: /\/\/\s*TODO:?\s*(implement|add|fix|complete|finish)\s*(this|here|later)/i, id: 'AI_SMELL001', name: 'Placeholder TODO', message: 'AI-generated placeholder — likely unfinished implementation' },
@@ -122,7 +197,13 @@ class HallucinationDetector {
     for (const file of files) {
       try {
         const ext = path.extname(file).toLowerCase();
-        if (!['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs'].includes(ext)) continue;
+        const isJS = this.jsExtensions.has(ext);
+        const isPython = this.pyExtensions.has(ext);
+        const isGo = this.goExtensions.has(ext);
+        const isRust = this.rustExtensions.has(ext);
+        const isJava = this.javaExtensions.has(ext);
+
+        if (!isJS && !isPython && !isGo && !isRust && !isJava) continue;
 
         const relPath = path.relative(this.config.rootPath, file);
 
@@ -147,20 +228,31 @@ class HallucinationDetector {
 
         results.stats.filesScanned++;
 
-        // 1. Phantom imports — packages that don't exist
-        this._checkPhantomImports(relPath, content, lines, declaredDeps, results, ignoredLines);
-
-        // 2. Phantom APIs — methods that don't exist on known objects
-        if (!isPatternFile) {
-          this._checkPhantomAPIs(relPath, content, lines, results, ignoredLines);
-        }
-
-        // 3. AI code smells — patterns typical of AI-generated code
-        this._checkAISmells(relPath, content, lines, results, ignoredLines);
-
-        // 4. Deprecated APIs — APIs that LLMs still suggest
-        if (!isPatternFile) {
-          this._checkDeprecatedAPIs(relPath, content, lines, results, ignoredLines);
+        // ─── Language-specific checks ──────────────────────
+        if (isJS) {
+          // 1. Phantom imports — packages that don't exist
+          this._checkPhantomImports(relPath, content, lines, declaredDeps, results, ignoredLines);
+          // 2. Phantom APIs — methods that don't exist on known objects
+          if (!isPatternFile) {
+            this._checkPhantomAPIs(relPath, content, lines, results, ignoredLines);
+          }
+          // 3. AI code smells
+          this._checkAISmells(relPath, content, lines, results, ignoredLines);
+          // 4. Deprecated APIs
+          if (!isPatternFile) {
+            this._checkDeprecatedAPIs(relPath, content, lines, results, ignoredLines);
+          }
+        } else if (isPython) {
+          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.pythonPhantomAPIs, 'phantomAPIs');
+          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.pythonDeprecated, 'deprecatedAPIs');
+          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.pythonSmells);
+        } else if (isGo) {
+          this._checkLanguagePatterns(relPath, content, lines, results, ignoredLines, this.goPhantomAPIs, 'phantomAPIs');
+          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.goSmells);
+        } else if (isRust) {
+          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.rustSmells);
+        } else if (isJava) {
+          this._checkLanguageSmells(relPath, content, lines, results, ignoredLines, this.javaSmells);
         }
 
       } catch (e) { /* skip unreadable */ }
@@ -178,6 +270,59 @@ class HallucinationDetector {
     return results;
   }
 
+  /**
+   * Generic language pattern checker (for phantom APIs and deprecated APIs)
+   */
+  _checkLanguagePatterns(relPath, content, lines, results, ignoredLines, patterns, resultKey) {
+    for (let i = 0; i < lines.length; i++) {
+      if (ignoredLines.has(i + 1)) continue;
+      const line = lines[i];
+      for (const check of patterns) {
+        if (check.pattern.test(line)) {
+          const entry = {
+            file: relPath,
+            line: i + 1,
+            name: check.name,
+            id: check.id,
+          };
+          if (check.suggestion) entry.suggestion = check.suggestion;
+          if (check.since) {
+            entry.since = check.since;
+            entry.fix = check.suggestion;
+          }
+          if (resultKey === 'deprecatedAPIs') {
+            results.deprecatedAPIs.push(entry);
+          } else {
+            results.phantomAPIs.push(entry);
+          }
+        }
+      }
+    }
+  }
+
+  /**
+   * Generic language smell checker
+   */
+  _checkLanguageSmells(relPath, content, lines, results, ignoredLines, smells) {
+    for (let i = 0; i < lines.length; i++) {
+      if (ignoredLines.has(i + 1)) continue;
+      const line = lines[i];
+      for (const smell of smells) {
+        if (smell.pattern.test(line)) {
+          results.aiSmells.push({
+            file: relPath,
+            line: i + 1,
+            id: smell.id,
+            name: smell.name,
+            message: smell.message,
+            type: 'ai_smell',
+            severity: 'medium',
+          });
+        }
+      }
+    }
+  }
+
   /**
    * Format results for terminal output
    */

package/packages/scanner/tech-debt-analyzer.js

@@ -150,6 +150,38 @@ class TechDebtAnalyzer {
 
     // ─── 3. Code Quality Debt ───────────────────────────────
     const qualityIssues = [];
+    const HallucinationDetector = require('./hallucination-detector');
+    const hallDetector = new HallucinationDetector(this.config);
+    const hallResults = await hallDetector.scan(files);
+
+    // Add deprecated APIs as fixable items
+    for (const item of (hallResults.deprecatedAPIs || [])) {
+      qualityIssues.push({
+        file: path.relative(this.config.rootPath, item.file),
+        type: 'deprecated_api',
+        severity: 'high',
+        message: `${item.name} — deprecated since ${item.since}`,
+        fixable: true,
+        fixAction: 'update_deprecated_api',
+        suggestion: item.fix,
+      });
+    }
+
+    // Add hardcoded localhost URLs as fixable items
+    for (const item of (hallResults.aiSmells || [])) {
+      if (item.message && item.message.includes('localhost')) {
+        qualityIssues.push({
+          file: path.relative(this.config.rootPath, item.file),
+          type: 'hardcoded_localhost',
+          severity: 'medium',
+          message: item.message,
+          fixable: true,
+          fixAction: 'wrap_localhost_url',
+          suggestion: 'Use environment variable with localhost fallback',
+        });
+      }
+    }
+
     for (const [file, result] of Object.entries(scanResults)) {
       if (result.issues) {
         for (const issue of result.issues) {
@@ -320,6 +352,56 @@ class TechDebtAnalyzer {
             break;
           }
 
+          case 'update_deprecated_api': {
+            const fullPath = path.resolve(this.config.rootPath, item.file);
+            let content = fs.readFileSync(fullPath, 'utf-8');
+            const before = content;
+            // url.parse() → new URL()
+            content = content.replace(/url\.parse\(([^)]+)\)/g, 'new URL($1)');
+            // new Buffer() → Buffer.from()
+            content = content.replace(/new Buffer\(([^)]+)\)/g, 'Buffer.from($1)');
+            // require('sys') → require('util')
+            content = content.replace(/require\(['"]sys['"]\)/g, "require('util')");
+            // util.isArray() → Array.isArray()
+            content = content.replace(/util\.isArray\(/g, 'Array.isArray(');
+            // util.isFunction() → typeof x === 'function'
+            content = content.replace(/util\.isFunction\(([^)]+)\)/g, "typeof $1 === 'function'");
+            // fs.exists() callback → fs.existsSync or fs.access
+            content = content.replace(/fs\.exists\(([^,]+),\s*/g, 'fs.access($1, ');
+            if (content !== before) {
+              fs.writeFileSync(fullPath, content, 'utf-8');
+              fixes.push({ ...item, status: 'fixed', detail: 'Replaced deprecated API with modern equivalent' });
+            } else {
+              fixes.push({ ...item, status: 'skipped', reason: 'Pattern not matched for auto-replacement' });
+            }
+            break;
+          }
+
+          case 'wrap_localhost_url': {
+            const fullPath = path.resolve(this.config.rootPath, item.file);
+            let content = fs.readFileSync(fullPath, 'utf-8');
+            const before = content;
+            // Wrap hardcoded localhost URLs in env var fallback
+            // Match: 'http://localhost:NNNN' or "http://localhost:NNNN" or `http://localhost:NNNN`
+            content = content.replace(
+              /(['"`])(https?:\/\/localhost:\d{2,5}(?:\/[^'"`]*)?)\1/g,
+              (match, quote, url) => {
+                // Generate an env var name from the URL
+                const portMatch = url.match(/:(\d+)/);
+                const port = portMatch ? portMatch[1] : 'PORT';
+                const envVar = `SERVICE_URL_${port}`;
+                return `(process.env.${envVar} || ${quote}${url}${quote})`;
+              }
+            );
+            if (content !== before) {
+              fs.writeFileSync(fullPath, content, 'utf-8');
+              fixes.push({ ...item, status: 'fixed', detail: 'Wrapped localhost URL in env var fallback' });
+            } else {
+              fixes.push({ ...item, status: 'skipped', reason: 'Pattern not matched for auto-replacement' });
+            }
+            break;
+          }
+
           case 'extract_to_env': {
             // Don't auto-fix secrets — too risky. Flag for manual review.
             fixes.push({ ...item, status: 'flagged_for_review', reason: 'Secrets require manual extraction to .env' });