PostIdea Drift Detector

(In-editor feature set: Agent Monitor for task tracking + PostIdea Verify for architecture verification.)

This extension helps you keep code aligned with your architectural decisions during AI-assisted development, and track the tasks an agent was asked to do.

What it does

Two capabilities you can use together or separately:

1. Task tracking (Agent Monitor). Paste a plain-English task list (for example, the instructions you gave an AI coding agent). The extension keeps a live checklist in the Explorer sidebar; as files change, each pending task collects the files that changed and evidence — which changed files mention that task's keywords — plus a labeled heuristic hint of whether the task looks covered. The heuristic is a hint, not a verdict: you mark tasks complete. Works with no account.

2. Architecture drift detection + verification (connected mode). With a PostIdea project that has locked architectural decisions (e.g. "primary database is PostgreSQL"), the extension loads those decisions and warns you in the editor when code contradicts them (e.g. an import ... from 'mongodb'). PostIdea Verify additionally runs a deterministic coverage check of your workspace against your locked spec and writes a tamper-evident Markdown report. By default no source code is uploaded — only extracted signals. The one exception is the opt-in deep analysis setting, which sends your pending git diff; see What gets sent.

Getting started

Standalone (no account)

1. Install the extension. A status bar item appears on the right.
2. Command Palette (Ctrl+Shift+P) → Agent Monitor: Start Session.
3. Type your tasks, one per line, and click Start Session — they appear immediately in the Agent Monitor view under "Task Progress".
4. As files change, each pending task shows how many files changed and (for pending tasks) a labeled likely-done? heuristic hint; hover a task to see the evidence.
5. Right-click a task to Mark as Complete, Edit, or Delete. The status bar shows progress (e.g. Agent Monitor: 2/5 tasks).

Connected (PostIdea account)

The fastest way in is the Verify page at postidea.app — click "Open in VS Code" (or Cursor) and the editor connects itself. If that link doesn't fire (a remote/SSH workspace, or a browser that blocks vscode://), the same page shows a connect code you can paste manually:

1. Command Palette → Agent Monitor: Connect or Use Standalone → Connect PostIdea Project.
2. Paste the connect code from the Verify page. It's single-use and expires after 10 minutes.
3. On success the status bar shows your project name and locked decisions load.

There's no password prompt here, by design — connecting is proven by a code minted from your already-signed-in browser session, not by re-entering credentials. That also means it works the same way whether your account uses a password or "Continue with Google/GitHub".

You then also get:

• Inline drift warnings — on save (default), code contradicting a locked decision gets a squiggle, a gutter icon, and a Problems-panel entry quoting the decision it violates.
• Quick fixes (lightbulb): View decision in PostIdea, Open decision detail panel (rationale, metadata, every violating file), Unlock this decision (with confirmation), Ignore this warning (mutes that decision in this workspace).
• Spec Violations section in the sidebar; click a violation to open its detail panel.
• Agent Monitor: Refresh Decisions — re-fetch after changing decisions in PostIdea (otherwise cached 5 minutes).
• Agent Monitor: Disconnect Project — return to standalone; clears token, decisions, and warnings (your task session is kept).

PostIdea Verify (connected mode)

Click PostIdea Verify in the status bar (or run PostIdea: Verify Project (Coverage Report)):

1. The extension scans your workspace locally and extracts only signals — routes, imported package names, declared symbols, frameworks, the file tree.
2. Those signals are checked deterministically against your locked spec (no AI decides pass/fail), a local drift scan runs, and a report (postidea-verify-report-<timestamp>.md) is written to your workspace root with a SHA-256 hash so anyone can verify it wasn't altered.

What gets sent

With the default settings, your source code is not uploaded. Only the extracted signals above leave your machine.

One setting changes that. Turning on deep analysis (postidea.enableDeepAnalysis, off by default) additionally sends your pending git diff for AI advisory commentary. A diff contains real source — the lines you changed, verbatim. It is never full files, the commentary is clearly labeled, and it never affects the verdict or its hash. But if you enable it, code is being uploaded, and the report says so: a run that carried a diff is labelled "Supplied by the client" rather than "Extracted locally", so the artifact never claims a stronger privacy guarantee than the run actually had.

Leave the setting off and the local-only guarantee holds.

Settings

Search "PostIdea" in Settings:

Privacy

• Standalone mode makes no network requests — detection, task tracking, and evidence are entirely local.
• Connected mode talks only to the server you configured (postidea.apiBaseUrl).
• Verify sends signals, hashes, and file paths — never file contents, except the opt-in deep-analysis git diff above.

Development

• Node.js 18+, VS Code 1.80+.
• npm install, then npm run compile (produces out/extension.js), then F5 to launch an Extension Development Host.
• npm run test:unit for fast in-process tests; npm test for integration tests (extension host).
• npm run package bundles with esbuild for publishing.

License

MIT.