rails-ai-context 5.30.2 → 5.32.0

data/lib/rails_ai_context/tools/get_env.rb

@@ -1,12 +1,15 @@
 # frozen_string_literal: true
 
+require "ipaddr"
+require "uri"
+
 module RailsAiContext
   module Tools
     class GetEnv < BaseTool
       tool_name "rails_get_env"
       description "Discover environment variables, external service dependencies, and credentials keys used by the app. " \
         "Use when: setting up a development environment, debugging missing config, or auditing external dependencies. " \
-        "Scans .rb, .rake, ERB views and config YAML for ENV[], plus .env.example, Dockerfile, external HTTP calls, and credentials keys (never values)."
+        "Scans .rb, .rake, ERB views and config YAML for ENV[], plus .env.example, Dockerfile, the env Kamal's config/deploy.yml sets, config gem settings and Anyway::Config keys, external HTTP calls, and credentials keys (never values)."
 
       input_schema(
         properties: {
@@ -35,6 +38,9 @@ module RailsAiContext
         env_vars = scan_env_vars(root)
         env_example = scan_env_example(root)
         dockerfile_vars = scan_dockerfile(root)
+        kamal_env = scan_kamal_env(root)
+        settings = scan_settings(root)
+        anyway_configs = Introspectors::AnywayConfigs.scan(root)
         external_services = detect_external_services(root, env_vars.values.flatten.map { |v| v[:name] }.uniq)
         credentials_keys = detect_credentials_keys
         encrypted_columns = detect_encrypted_columns
@@ -44,19 +50,31 @@ module RailsAiContext
         env_vars.each { |_file, vars| vars.each { |v| all_var_names << v[:name] } }
         env_example.each { |v| all_var_names << v[:name] }
         dockerfile_vars.each { |v| all_var_names << v[:name] if v[:type] == "ENV" }
-
-        if all_var_names.empty? && external_services.empty? && credentials_keys.empty?
-          return text_response("No environment variables, external services, or credentials keys detected.")
+        kamal_env.each { |v| all_var_names << v[:name] if v[:name] }
+
+        anyway_configs.each { |c| c[:attributes].each { |a| all_var_names << a[:env] if a[:env] } }
+        deploy_and_settings = kamal_lines(kamal_env, root) + settings_lines(settings) + anyway_lines(anyway_configs)
+
+        text = if all_var_names.empty? && external_services.empty? && credentials_keys.empty? && deploy_and_settings.empty?
+          "No environment variables, external services, or credentials keys detected."
+        else
+          case detail
+          when "summary"
+            format_summary(all_var_names, external_services, credentials_keys)
+          when "standard"
+            format_standard(env_vars, env_example, deploy_and_settings, external_services, credentials_keys, encrypted_columns)
+          when "full"
+            format_full(env_vars, env_example, deploy_and_settings, dockerfile_vars, external_services, credentials_keys, encrypted_columns, root)
+          end
         end
+        text_response([ text, unread_bundle_note(root) ].compact.join("\n\n"))
+      end
 
-        case detail
-        when "summary"
-          format_summary(all_var_names, external_services, credentials_keys)
-        when "standard"
-          format_standard(env_vars, env_example, external_services, credentials_keys, encrypted_columns)
-        when "full"
-          format_full(env_vars, env_example, dockerfile_vars, external_services, credentials_keys, encrypted_columns, root)
-        end
+      # Without it, an unread bundle reads as an app that declares no service gems.
+      private_class_method def self.unread_bundle_note(root)
+        unread = RailsAiContext::GemLock.for(root).unread_bundle or return nil
+
+        "_Gem-based services and config gem settings not read: #{unread}._"
       end
 
       private_class_method def self.format_summary(all_var_names, external_services, credentials_keys)
@@ -75,16 +93,16 @@ module RailsAiContext
         end
 
         lines << "" << "_Use `detail:\"standard\"` for sources and external services, or `detail:\"full\"` for per-file locations._"
-        text_response(lines.join("\n"))
+        lines.join("\n")
       end
 
       # Named in the answer, because a name missing from it is otherwise
       # indistinguishable from a name the app does not read.
-      SCAN_NOTE = "_Scanned `app`, `config` and `lib` for `.rb`, `.rake`, `.erb` and config `.yml`. " \
+      SCAN_NOTE = "_Scanned `app`, `config` and `lib` for `.rb`, `.rake`, `.erb` and config `.yml`, plus `config.ru`, `db/seeds` and the Ruby scripts in `bin`. " \
         "Config YAML on `sensitive_patterns` (config/database.yml) is read for the ENV names in its ERB tags only; " \
         "credentials, keys and the rest are never read._"
 
-      private_class_method def self.format_standard(env_vars, env_example, external_services, credentials_keys, encrypted_columns)
+      private_class_method def self.format_standard(env_vars, env_example, deploy_and_settings, external_services, credentials_keys, encrypted_columns)
         lines = [ "# Environment Configuration", "" ]
 
         # ENV vars from code, grouped by purpose
@@ -132,6 +150,8 @@ module RailsAiContext
           end
         end
 
+        lines.concat(deploy_and_settings)
+
         # External services
         if external_services.any?
           lines << "## External Services"
@@ -147,7 +167,7 @@ module RailsAiContext
         lines.concat(credentials_and_encrypted_lines(credentials_keys, encrypted_columns))
 
         lines << SCAN_NOTE
-        text_response(lines.join("\n"))
+        lines.join("\n")
       end
 
       # Both `standard` and `full` end with these two sections, so a wording
@@ -159,6 +179,10 @@ module RailsAiContext
           lines << "## Credentials Keys (values hidden)"
           credentials_keys.each { |k| lines << "- `#{k}`" }
           lines << ""
+        elsif (empty = empty_credentials_file)
+          lines << "## Credentials Keys (values hidden)"
+          lines << "_`#{empty}` decrypts and holds no keys._"
+          lines << ""
         elsif credentials_file_present?
           lines << "## Credentials Keys (values hidden)"
           lines << RailsAiContext::Confidence.unavailable("credentials are encrypted; reading the key names needs a booted app with its master key")
@@ -176,7 +200,7 @@ module RailsAiContext
         lines
       end
 
-      private_class_method def self.format_full(env_vars, env_example, dockerfile_vars, external_services, credentials_keys, encrypted_columns, root)
+      private_class_method def self.format_full(env_vars, env_example, deploy_and_settings, dockerfile_vars, external_services, credentials_keys, encrypted_columns, root)
         lines = [ "# Environment Configuration (Full Detail)", "" ]
 
         # ENV vars grouped by category with file annotations
@@ -248,6 +272,8 @@ module RailsAiContext
           lines << ""
         end
 
+        lines.concat(deploy_and_settings)
+
         # Dockerfile ENV/ARG
         if dockerfile_vars.any?
           lines << "## Dockerfile Variables"
@@ -275,13 +301,130 @@ module RailsAiContext
         lines.concat(credentials_and_encrypted_lines(credentials_keys, encrypted_columns))
 
         lines << SCAN_NOTE
-        text_response(lines.join("\n"))
+        lines.join("\n")
       end
 
       private_class_method def self.scan_env_vars(root)
         Introspectors::EnvReferences.scan(root)
       end
 
+      KAMAL_DEPLOY = "config/deploy.yml"
+
+      private_class_method def self.kamal_lines(kamal_env, root)
+        return [] unless File.file?(File.join(root, KAMAL_DEPLOY))
+
+        destinations = Dir.glob("config/deploy.*.yml", base: root).sort
+        return [] if kamal_env.empty? && destinations.empty?
+
+        lines = [ "## Set by Kamal (`#{KAMAL_DEPLOY}`)" ]
+        kamal_env.each do |v|
+          scope = v[:scope] ? " (#{v[:scope]})" : ""
+          lines << if v[:name].nil?
+            "- a #{v[:secret] ? 'secret' : 'variable'} whose name an ERB tag sets at deploy time#{scope}"
+          elsif v[:secret]
+            alias_note = if v[:secret] == v[:name] then ""
+            elsif RailsAiContext::ConfigYaml.marked?(v[:secret]) then " (a name an ERB tag sets)"
+            else " (`#{v[:secret]}`)"
+            end
+            "- `#{v[:name]}` - secret, from `.kamal/secrets`#{alias_note}#{scope}"
+          elsif v[:value] == :computed
+            "- `#{v[:name]}` - set by ERB at deploy time#{scope}"
+          elsif v[:value] == :hidden
+            "- `#{v[:name]}` - value hidden#{scope}"
+          else
+            "- `#{v[:name]}` = `#{v[:value]}`#{scope}"
+          end
+        end
+        destinations.each { |file| lines << "- `#{file}` merges over this per destination and is not read" }
+        lines << ""
+      end
+
+      # As Kamal's Role#env merges it: top-level env, `servers.<role>.env`, then each `env.tags.<tag>`.
+      private_class_method def self.scan_kamal_env(root)
+        config = RailsAiContext::ConfigYaml.read(root, KAMAL_DEPLOY, label: "Kamal", marker: RailsAiContext::ConfigYaml::ERB_OUTPUT)
+        return [] unless config.is_a?(Hash)
+
+        env = config["env"].is_a?(Hash) ? config["env"] : {}
+        servers = config["servers"].is_a?(Hash) ? config["servers"] : {}
+        roles = servers.filter_map { |role, options| [ "role `#{role}`", options["env"] ] if options.is_a?(Hash) && options["env"].is_a?(Hash) }
+        tags = env["tags"].is_a?(Hash) ? env["tags"].filter_map { |tag, tag_env| [ "tag `#{tag}`", tag_env ] if tag_env.is_a?(Hash) } : []
+        [ [ nil, env ], *roles, *tags ].flat_map { |scope, scoped| kamal_env_entries(scoped, scope) }
+      end
+
+      # Kamal::Configuration::Env's shape: `clear` and `secret` keys, or a bare hash that is all clear values.
+      private_class_method def self.kamal_env_entries(env, scope)
+        clear = env.fetch("clear", env.key?("secret") || env.key?("tags") ? {} : env)
+        clear = {} unless clear.is_a?(Hash)
+        secrets = Array(env["secret"]).filter_map do |key|
+          name, aliased = key.to_s.split(":", 2)
+          { name: kamal_name(name), secret: aliased || name, scope: scope }.compact unless name.to_s.empty?
+        end
+        secrets + clear.map { |name, value| { name: kamal_name(name.to_s), value: kamal_clear_value(name.to_s, value), scope: scope }.compact }
+      end
+
+      # nil for a name an ERB tag writes, so the marker is never printed as a variable.
+      private_class_method def self.kamal_name(name)
+        name unless RailsAiContext::ConfigYaml.marked?(name)
+      end
+
+      SAFE_ENV_NAMES = Introspectors::EnvIntrospector::KNOWN_ENV_VARS.select { |spec| spec[:safe] }.to_set { |spec| spec[:name] }.freeze
+      # A run of letters and digits this long is a key or token, whatever the variable is called;
+      # a hyphen or underscore breaks the run, so a host name such as `myapp-production-db-1` shows.
+      OPAQUE_TOKEN = /(?=[A-Za-z0-9+\/=]*\d)(?=[A-Za-z0-9+\/=]*[A-Za-z])[A-Za-z0-9+\/=]{16,}/
+      # A UUID or a hex key split into groups is still a key once the separators go.
+      GROUPED_HEX = /\A\h{16,}\z/
+
+      # Webhook URLs and DSNs hide their secret in the path or user part, where Redaction does not look.
+      private_class_method def self.kamal_clear_value(name, value)
+        return :computed if RailsAiContext::ConfigYaml.marked?(value)
+
+        text = value.to_s
+        return RailsAiContext::Redaction.value(name, text) if SAFE_ENV_NAMES.include?(name)
+        return :hidden if text.include?("://") || text.match?(OPAQUE_TOKEN) || text.delete("-_").match?(GROUPED_HEX) || RailsAiContext::Redaction.value(name, text) != text
+
+        text
+      end
+
+      # Without the config gem, config/settings.yml is the app's own file and no Settings constant exists.
+      private_class_method def self.scan_settings(root)
+        return [] unless RailsAiContext::GemLock.for(root).present?("config")
+
+        files = [ "config/settings.yml" ] +
+          %w[settings environments].flat_map { |dir| Dir.glob(File.join(root, "config", dir, "*.yml")).sort.map { |path| path.delete_prefix("#{root}/") } }
+        files.filter_map do |file|
+          data = RailsAiContext::ConfigYaml.read(root, file, label: "config gem settings")
+          next unless data.is_a?(Hash) && data.any?
+
+          { file: file, keys: setting_keys(data) }
+        end
+      end
+
+      private_class_method def self.setting_keys(hash, prefix = nil)
+        hash.flat_map do |key, value|
+          path = [ prefix, key ].compact.join(".")
+          value.is_a?(Hash) && value.any? ? setting_keys(value, path) : [ path ]
+        end
+      end
+
+      private_class_method def self.settings_lines(settings)
+        return [] if settings.empty?
+
+        [ "## Settings (config gem, read as `Settings.<key>`; values hidden)" ] +
+          settings.map { |s| "- `#{s[:file]}`: #{s[:keys].map { |k| "`#{k}`" }.join(', ')}" } + [ "" ]
+      end
+
+      private_class_method def self.anyway_lines(configs)
+        return [] if configs.empty?
+
+        [ "## Anyway::Config classes (values hidden)" ] + configs.map do |config|
+          attributes = config[:attributes].map do |a|
+            notes = [ ("`#{a[:env]}`" if a[:env]), ("required" if a[:required]) ].compact
+            notes.any? ? "`#{a[:name]}` (#{notes.join(', ')})" : "`#{a[:name]}`"
+          end
+          "- `#{config[:name]}` (`#{config[:file]}`): #{attributes.join(', ')}"
+        end + [ "" ]
+      end
+
       private_class_method def self.scan_env_example(root)
         # Only read .env.example or .env.sample - NEVER .env or .env.local
         candidates = %w[.env.example .env.sample .env.template]
@@ -444,37 +587,32 @@ module RailsAiContext
         services.uniq { |s| s[:name] }
       end
 
+      # Prefilter: the AST decides, on the files that name a client at all.
+      HTTP_CLIENT_NAME = /(?:#{Regexp.union(Introspectors::Listeners::HttpClientCallListener::CLIENTS).source})\.|URI\.open/
+      BARE_HOST = /\A[a-z0-9-]+(?:\.[a-z0-9-]+)*\.[a-z]{2,}\z/i
+
       private_class_method def self.detect_http_clients(root)
         services = []
-        app_dir = File.join(root, "app")
-        return services unless Dir.exist?(app_dir)
-
         real_root = File.realpath(root).to_s
-        safe_glob(app_dir, "**/*.rb", real_root).each do |file|
-          source = safe_read(file)
-          next unless source
 
-          relative = file.sub("#{real_root}/", "")
+        %w[app config lib].each do |dir|
+          scan_dir = File.join(root, dir)
+          next unless Dir.exist?(scan_dir)
 
-          # Faraday connections
-          source.scan(/Faraday\.new\s*\(?\s*(?:url:\s*)?["']([^"']+)["']/).each do |match|
-            url = match[0]
-            name = extract_service_name_from_url(url)
-            services << { name: name, detection: "Faraday.new", file: relative } if name
-          end
-
-          # Net::HTTP
-          source.scan(/Net::HTTP\.\w+\s*\(?\s*(?:URI\.parse\s*\(?\s*)?["']([^"']+)["']/).each do |match|
-            url = match[0]
-            name = extract_service_name_from_url(url)
-            services << { name: name, detection: "Net::HTTP", file: relative } if name
-          end
+          safe_glob(scan_dir, "**/*.rb", real_root).each do |file|
+            source = safe_read(file)
+            next unless source&.match?(HTTP_CLIENT_NAME)
 
-          # HTTParty
-          source.scan(/HTTParty\.\w+\s*\(?\s*["']([^"']+)["']/).each do |match|
-            url = match[0]
-            name = extract_service_name_from_url(url)
-            services << { name: name, detection: "HTTParty", file: relative } if name
+            relative = file.sub("#{real_root}/", "")
+            calls = Introspectors::SourceIntrospector.walk_source(source, { http: Introspectors::Listeners::HttpClientCallListener })[:http]
+            calls.each do |call|
+              name = if call[:url]
+                extract_service_name_from_url(call[:url])
+              else
+                call[:host].match?(BARE_HOST) && service_name_from_host(call[:host])
+              end
+              services << { name: name, detection: call[:client], file: relative } if name
+            end
           end
         end
 
@@ -487,20 +625,25 @@ module RailsAiContext
         return nil if url.start_with?("ENV") || url.include?("#" + "{")
 
         begin
-          uri = URI.parse(url)
-          return nil unless uri&.host
-          # Extract meaningful service name from hostname
-          host = uri.host
-          # Remove common TLDs and subdomains
-          parts = host.split(".")
-          return nil if parts.size < 2
-          # Use the main domain part
-          parts[-2]&.capitalize
+          host = URI.parse(url).host
+          host && service_name_from_host(host)
         rescue => e
           RailsAiContext.debug_fail(e, nil, label: "extract_service_name_from_url")
         end
       end
 
+      private_class_method def self.service_name_from_host(host)
+        # An address names no service; a loopback, private or unspecified one is not external at all.
+        if (ip = (IPAddr.new(host.delete("[]")) rescue nil))
+          return ip.loopback? || ip.private? || ip.link_local? || ip.to_i.zero? ? nil : host
+        end
+
+        parts = host.split(".")
+        return nil if parts.size < 2
+
+        parts[-2]&.capitalize
+      end
+
       # An encrypted credentials file the tool could not open is a different
       # fact from an app with no credentials, and only one of them is true here.
       private_class_method def self.credentials_file_present?
@@ -513,6 +656,20 @@ module RailsAiContext
         false
       end
 
+      # Rails answers {} both for a file it decrypted and found empty and for
+      # one it had no key to open, so only a key plus the file tells them apart.
+      private_class_method def self.empty_credentials_file
+        return nil if RailsAiContext.static_tier?
+
+        creds = Rails.application&.credentials
+        return nil unless creds.respond_to?(:key) && creds.respond_to?(:content_path) && creds.respond_to?(:config)
+        return nil unless creds.key && creds.content_path.exist? && creds.config.empty?
+
+        creds.content_path.to_s.delete_prefix("#{rails_app.root}/")
+      rescue StandardError
+        nil
+      end
+
       private_class_method def self.detect_credentials_keys
         keys = []
 

data/lib/rails_ai_context/tools/get_env_config.rb

@@ -4,7 +4,8 @@ module RailsAiContext
   module Tools
     class GetEnvConfig < BaseTool
       tool_name "rails_get_env_config"
-      description "Get per-environment configuration from config/environments/*.rb: notable toggles (force_ssl, eager_load, caching, log level, queue adapter, mailer delivery) and every config key each environment sets. " \
+      description "Get per-environment configuration from config/environments/*.rb: notable toggles (force_ssl, eager_load, caching, log level, queue adapter, mailer delivery) and every config key each environment sets, " \
+        "plus the keys config/application.rb sets for every environment (config.x included) and the keys each config_for YAML file gives. " \
         "Use when: comparing development vs production behavior, debugging env-specific bugs, or checking what a custom environment changes. " \
         "Filter with environment:\"production\". Omit for all environments. " \
         "For environment variables and ENV[] usage, use rails_get_env instead."
@@ -51,6 +52,7 @@ module RailsAiContext
           lines << ""
           lines << "_Current: **#{envs[:current]}** - #{count_phrase(envs[:count], "environment file")} under config/environments/_"
 
+          render_application(lines, envs[:application], current: envs[:current], offset: offset, limit: limit) if envs[:application]
           if list.any?
             list.each { |entry| render_environment(lines, entry, offset: offset, limit: limit) }
           else
@@ -67,6 +69,40 @@ module RailsAiContext
       class << self
         private
 
+        def render_application(lines, app, current:, offset:, limit:)
+          lines << "" << "## Every environment" << "_#{app[:file]}_"
+          render_keys(lines, app[:config_keys] || [], offset: offset, limit: limit)
+          config_for = Array(app[:config_for])
+          return if config_for.empty?
+
+          lines << "" << "**config_for:**"
+          config_for.each do |entry|
+            found = if entry[:path_unread] then "keys not read: its path is not a literal"
+            elsif entry[:missing] then "does not exist"
+            elsif entry[:outside] then "outside the app, not read"
+            elsif entry[:withheld] then "on sensitive_patterns, keys not read"
+            elsif entry[:too_large] then "over max_file_size, keys not read"
+            elsif entry[:unreadable] then "could not be read as YAML"
+            elsif entry[:environment_unread] then "keys not read: its env: is not a literal"
+            end
+            call = "- `#{entry[:key]}` = config_for(#{entry[:call]})#{entry[:read]},"
+            named = [ Array(entry[:keys]).join(", ").presence, ("#{entry[:erb_keys]} named by an ERB tag" if entry[:erb_keys]) ].compact
+            keys = "keys for #{entry[:environment] || current}: #{named.join(', and ').presence || 'none'}"
+            lines << if found then "#{call}#{" `#{entry[:file]}`" if entry[:file]} #{found}"
+            elsif entry[:read] then "#{call} one value from `#{entry[:file]}` (#{keys})"
+            else "#{call} `#{entry[:file]}` #{keys}"
+            end
+          end
+        end
+
+        def render_keys(lines, keys, offset:, limit:)
+          return if keys.empty?
+
+          page = paginate(keys, offset: offset, limit: limit, default_limit: 50)
+          lines << "" << "**Config keys set (#{page[:total]}):** #{page[:items].map { |k| "`#{k}`" }.join(', ')}"
+          lines << page[:hint] unless page[:hint].empty?
+        end
+
         # Paging is per environment, so one offset/limit reads the same slice
         # of every environment listed - which is what makes comparing the same
         # page across development and production useful.
@@ -81,12 +117,7 @@ module RailsAiContext
             lines << "- _No notable toggles set_"
           end
 
-          keys = entry[:config_keys] || []
-          return if keys.empty?
-
-          page = paginate(keys, offset: offset, limit: limit, default_limit: 50)
-          lines << "" << "**Config keys set (#{page[:total]}):** #{page[:items].map { |k| "`#{k}`" }.join(', ')}"
-          lines << page[:hint] unless page[:hint].empty?
+          render_keys(lines, entry[:config_keys] || [], offset: offset, limit: limit)
         end
       end
     end

data/lib/rails_ai_context/tools/get_frontend_stack.rb

@@ -63,12 +63,15 @@ module RailsAiContext
           parts << "(#{count_phrase(total, "component")})" if total > 0
 
           # If no JS framework data, try building a Hotwire summary from cached context
+          pipeline = asset_pipeline
+          css = css_framework
           if parts.empty?
             hotwire = build_hotwire_summary
-            return hotwire if hotwire
+            return [ hotwire, css, pipeline ].compact.join(", ") if hotwire
+            return [ "#{pipeline} (no JavaScript build)", css ].compact.join(", ") if pipeline
           end
 
-          return parts.join(" + ") if parts.any?
+          return [ *parts, css ].compact.join(" + ") if parts.any?
 
           api_only_note("a frontend") || "No frontend framework detected."
         end
@@ -79,7 +82,6 @@ module RailsAiContext
           has_turbo = notable.any? { |g| g[:name] == "turbo-rails" }
           has_stimulus = notable.any? { |g| g[:name] == "stimulus-rails" }
           has_importmap = notable.any? { |g| g[:name] == "importmap-rails" }
-          has_tailwind = notable.any? { |g| g[:name] == "tailwindcss-rails" }
 
           return nil unless has_turbo || has_stimulus
 
@@ -95,8 +97,6 @@ module RailsAiContext
             parts << count_phrase(count, "Stimulus controller") if count > 0
           end
 
-          parts << "Tailwind CSS" if has_tailwind
-
           parts.join(", ")
         end
 
@@ -113,7 +113,16 @@ module RailsAiContext
           state_management = data[:state_management]
           state_management = state_management.join(", ") if state_management.is_a?(Array)
           lines << "- **State management:** #{state_management}" if state_management.present?
-          lines << "- **Package manager:** #{data[:package_manager]}" if data[:package_manager]
+          if data[:package_manager]
+            where = " (lockfile in `#{data[:package_manager_dir]}`)" if data[:package_manager_dir]
+            lines << "- **Package manager:** #{data[:package_manager]}#{where}"
+          end
+          pipeline_lines = asset_pipeline_lines
+          pipeline_lines << "- **CSS framework:** #{css_framework}" if css_framework
+          outside = Array(data[:outside_frontend_roots])
+          outside_line = "- **Outside the app root (manifests only):** #{outside.map { |p| "`#{p}`" }.join(', ')}" if outside.any?
+          lines << outside_line if outside_line
+          lines.concat(pipeline_lines)
 
           # TypeScript
           ts_enabled = data[:typescript].is_a?(Hash) && data[:typescript][:enabled]
@@ -151,7 +160,12 @@ module RailsAiContext
             !has_testing && !has_hotwire && !has_frontend_roots
 
           if no_frontend_evidence
-            return "# Frontend Stack\n\nNo frontend stack detected (API-only app / no app/javascript, no package.json)."
+            if pipeline_lines.any?
+              return [ "# Frontend Stack", "", *outside_line, *pipeline_lines, "- **JavaScript build:** none (no app/javascript, no package.json)" ].join("\n")
+            end
+
+            note = api_only_note("a frontend") || no_frontend_note
+            return [ "# Frontend Stack", "", note, *([ "", outside_line ] if outside_line) ].join("\n")
           end
 
           lines.concat(hotwire_lines)
@@ -218,6 +232,41 @@ module RailsAiContext
           lines.join("\n")
         end
 
+        # Gems that could not be read deny no asset pipeline.
+        def no_frontend_note
+          gems = cached_context[:gems]
+          unread = gems[:unavailable] || gems[:error] if gems.is_a?(Hash)
+          return "No frontend stack detected (no app/javascript, no package.json, no asset pipeline)." unless unread
+
+          "No frontend stack detected (no app/javascript, no package.json). Asset pipeline not known: #{unread}."
+        end
+
+        # Read from the gems, as rails_get_config does: the :assets section is
+        # in the full preset only.
+        def asset_pipeline
+          return "Propshaft" if Payload.gem?(cached_context, "propshaft")
+
+          "Sprockets" if Payload.gem?(cached_context, "sprockets-rails") || Payload.gem?(cached_context, "sprockets")
+        end
+
+        def css_framework
+          Introspectors::AssetPipelineIntrospector.css_framework_label(rails_app.root) ||
+            ("Tailwind CSS" if Payload.gem?(cached_context, "tailwindcss-rails"))
+        end
+
+        def asset_pipeline_lines
+          pipeline = asset_pipeline
+          return [] unless pipeline
+
+          lines = [ "- **Asset pipeline:** #{pipeline}, serving app/assets" ]
+          return lines unless pipeline == "Sprockets"
+
+          content, = RailsAiContext::SafePath.read("app/assets/config/manifest.js", under: rails_app.root.to_s)
+          links = content.to_s.scrub.scan(%r{^\s*//=\s*(link\w*\s+\S.*?)\s*$}).flatten
+          lines << "- **Sprockets manifest:** #{links.map { |l| "`#{l}`" }.join(', ')}" if links.any?
+          lines
+        end
+
         # The introspector emits frameworks as a hash of framework symbol =>
         # package.json version requirement (e.g. { react: "^19.0.0" }), not a
         # singular framework/version pair. Render the primary (first) entry,