@praneeth_54/agentdoctor 0.1.1-beta → 0.1.3-beta

package/dist/detectors/framework.js

@@ -4,6 +4,9 @@ function hasDep(deps, name) {
 function hasFile(paths, ...names) {
     return names.some((name) => paths.has(name.toLowerCase()));
 }
+function hasPythonDep(names, dep) {
+    return Boolean(names?.includes(dep.toLowerCase()));
+}
 /**
  * Detect frameworks from config markers and dependency names.
  * Does not fail when nothing matches — returns unknown.
@@ -18,6 +21,7 @@ export function detectFrameworks(input) {
         ...(input.packageJsonDependencies ?? {}),
     };
     const composer = input.composerJsonRequire ?? {};
+    const pythonDeps = input.pythonDependencyNames ?? [];
     const detected = [];
     const isNext = hasFile(basenames, "next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs") ||
         hasDep(deps, "next");
@@ -63,15 +67,12 @@ export function detectFrameworks(input) {
         !isVue &&
         !isSvelte &&
         !isReact &&
-        (hasFile(basenames, "package.json") || hasDep(deps, "express") === false) &&
         hasFile(basenames, "package.json")) {
-        // Generic Node.js project with package.json but no web framework
         if (!detected.includes("nodejs")) {
             detected.push("nodejs");
         }
     }
     if (hasFile(basenames, "pubspec.yaml") || input.pubspecName !== undefined) {
-        // Flutter: pubspec presence implies Flutter/Dart project context for detection
         if (hasFile(pathSet, "pubspec.yaml") || basenames.has("pubspec.yaml")) {
             detected.push("flutter");
         }
@@ -79,17 +80,19 @@ export function detectFrameworks(input) {
     if (hasDep(composer, "laravel/framework") || hasFile(basenames, "artisan")) {
         detected.push("laravel");
     }
-    if (hasFile(basenames, "manage.py") ||
-        [...pathSet].some((p) => p.endsWith("/settings.py") || p === "settings.py")) {
+    const isDjango = hasFile(basenames, "manage.py") ||
+        hasPythonDep(pythonDeps, "django") ||
+        [...pathSet].some((p) => p.endsWith("/requirements-django.txt"));
+    if (isDjango) {
         detected.push("django");
     }
-    // FastAPI: path heuristics only (requirements/pyproject often lack a stable marker)
-    if ([...pathSet].some((p) => p.includes("fastapi") || p.endsWith("requirements-fastapi.txt") || p === "app/main.py")) {
+    const hasFastApiDep = hasPythonDep(pythonDeps, "fastapi") ||
+        [...pathSet].some((p) => p.includes("fastapi") || p.endsWith("requirements-fastapi.txt"));
+    const hasFastApiAppLayout = [...pathSet].some((p) => p === "app/main.py" || p.endsWith("/app/main.py"));
+    if (hasFastApiDep && hasFastApiAppLayout) {
         detected.push("fastapi");
     }
-    // Deduplicate while preserving order
     const unique = [...new Set(detected)];
-    // Priority for primary framework
     const priority = [
         "nextjs",
         "nuxt",
@@ -146,3 +149,10 @@ export function formatFramework(framework) {
             return "Unknown";
     }
 }
+export function formatFrameworks(ids) {
+    const unique = [...new Set(ids)].filter((id) => id !== "unknown");
+    if (unique.length === 0) {
+        return "Unknown";
+    }
+    return unique.map((id) => formatFramework(id)).join(", ");
+}

package/dist/detectors/language.d.ts

@@ -12,3 +12,4 @@ export interface LanguageDetectionResult {
  */
 export declare function detectLanguages(input: LanguageDetectionInput): LanguageDetectionResult;
 export declare function formatLanguage(language: LanguageId): string;
+export declare function formatLanguages(ids: LanguageId[]): string;

package/dist/detectors/language.js

@@ -120,3 +120,10 @@ export function formatLanguage(language) {
             return "Unknown";
     }
 }
+export function formatLanguages(ids) {
+    const unique = [...new Set(ids)].filter((id) => id !== "unknown");
+    if (unique.length === 0) {
+        return "Unknown";
+    }
+    return unique.map((id) => formatLanguage(id)).join(", ");
+}

package/dist/detectors/monorepo.d.ts

@@ -7,7 +7,8 @@ export interface MonorepoDetectionResult {
     monorepo: MonorepoToolId;
 }
 /**
- * Detect common monorepo tooling from config markers.
+ * Detect common monorepo tooling from config markers, or multi-project layouts
+ * with multiple independently buildable manifests.
  */
 export declare function detectMonorepo(input: MonorepoDetectionInput): MonorepoDetectionResult;
 export declare function formatMonorepo(id: MonorepoToolId): string;

package/dist/detectors/monorepo.js

@@ -1,5 +1,15 @@
+const PROJECT_MANIFESTS = new Set([
+    "package.json",
+    "pubspec.yaml",
+    "composer.json",
+    "cargo.toml",
+    "go.mod",
+    "pyproject.toml",
+    "gemfile",
+]);
 /**
- * Detect common monorepo tooling from config markers.
+ * Detect common monorepo tooling from config markers, or multi-project layouts
+ * with multiple independently buildable manifests.
  */
 export function detectMonorepo(input) {
     const basenames = new Set(input.relativePaths.map((p) => {
@@ -26,6 +36,25 @@ export function detectMonorepo(input) {
             return { monorepo: "npm-workspaces" };
         }
     }
+    const projectRoots = new Set();
+    for (const relativePath of input.relativePaths) {
+        const parts = relativePath.split("/");
+        const base = (parts[parts.length - 1] ?? relativePath).toLowerCase();
+        if (!PROJECT_MANIFESTS.has(base)) {
+            continue;
+        }
+        if (parts.length === 1) {
+            projectRoots.add(".");
+            continue;
+        }
+        // Count only first-level project directories (e.g. mobile-apps/pubspec.yaml)
+        if (parts.length === 2) {
+            projectRoots.add(parts[0] ?? relativePath);
+        }
+    }
+    if (projectRoots.size >= 2) {
+        return { monorepo: "multi-project" };
+    }
     return { monorepo: "none" };
 }
 export function formatMonorepo(id) {
@@ -38,6 +67,8 @@ export function formatMonorepo(id) {
             return "Turborepo";
         case "nx":
             return "Nx";
+        case "multi-project":
+            return "Multi-project";
         default:
             return "None";
     }

package/dist/detectors/package-manager.d.ts

@@ -1,6 +1,10 @@
 import type { PackageManagerId } from "../types/index.js";
 export interface PackageManagerDetectionInput {
     relativePaths: string[];
+    /** True when a pyproject.toml contains a [tool.poetry] table. */
+    poetryToolDetected?: boolean;
+    /** True when a non-Poetry pyproject.toml (or similar) indicates a Python project. */
+    genericPyprojectDetected?: boolean;
 }
 export interface PackageManagerDetectionResult {
     packageManagers: PackageManagerId[];
@@ -8,7 +12,9 @@ export interface PackageManagerDetectionResult {
 }
 /**
  * Detect package managers from lockfiles and manifests.
- * Lockfiles take precedence over generic manifests for primary selection.
+ * Primary selection prefers root-level evidence and avoids inventing certainty for mixed ecosystems.
+ * Poetry requires poetry.lock and/or [tool.poetry] — not bare pyproject.toml.
  */
 export declare function detectPackageManagers(input: PackageManagerDetectionInput): PackageManagerDetectionResult;
 export declare function formatPackageManager(id: PackageManagerId): string;
+export declare function formatPackageManagers(ids: PackageManagerId[]): string;

package/dist/detectors/package-manager.js

@@ -1,32 +1,121 @@
 const MARKERS = [
-    { id: "pnpm", files: ["pnpm-lock.yaml", "pnpm-workspace.yaml"] },
-    { id: "yarn", files: ["yarn.lock", ".yarnrc.yml"] },
-    { id: "bun", files: ["bun.lockb", "bun.lock"] },
-    { id: "npm", files: ["package-lock.json", "npm-shrinkwrap.json"] },
-    { id: "composer", files: ["composer.lock", "composer.json"] },
-    { id: "poetry", files: ["poetry.lock", "pyproject.toml"] },
-    { id: "pip", files: ["requirements.txt", "Pipfile", "Pipfile.lock"] },
-    { id: "cargo", files: ["Cargo.lock", "Cargo.toml"] },
-    { id: "gradle", files: ["gradlew", "build.gradle", "build.gradle.kts", "settings.gradle"] },
+    { id: "pnpm", files: ["pnpm-lock.yaml", "pnpm-workspace.yaml"], lockfiles: ["pnpm-lock.yaml"] },
+    { id: "yarn", files: ["yarn.lock", ".yarnrc.yml"], lockfiles: ["yarn.lock"] },
+    { id: "bun", files: ["bun.lockb", "bun.lock"], lockfiles: ["bun.lockb", "bun.lock"] },
+    {
+        id: "npm",
+        files: ["package-lock.json", "npm-shrinkwrap.json", "package.json"],
+        lockfiles: ["package-lock.json", "npm-shrinkwrap.json"],
+    },
+    { id: "composer", files: ["composer.lock", "composer.json"], lockfiles: ["composer.lock"] },
+    { id: "pub", files: ["pubspec.yaml", "pubspec.lock"], lockfiles: ["pubspec.lock"] },
+    { id: "poetry", files: ["poetry.lock"], lockfiles: ["poetry.lock"] },
+    {
+        id: "pip",
+        files: ["requirements.txt", "Pipfile", "Pipfile.lock"],
+        lockfiles: ["Pipfile.lock"],
+    },
+    { id: "cargo", files: ["Cargo.lock", "Cargo.toml"], lockfiles: ["Cargo.lock"] },
+    {
+        id: "gradle",
+        files: ["gradlew", "build.gradle", "build.gradle.kts", "settings.gradle"],
+        lockfiles: [],
+    },
 ];
+const NODE_IDS = new Set(["npm", "pnpm", "yarn", "bun"]);
+function basename(relativePath) {
+    const parts = relativePath.split("/");
+    return (parts[parts.length - 1] ?? relativePath).toLowerCase();
+}
+function isRootPath(relativePath) {
+    return !relativePath.includes("/");
+}
 /**
  * Detect package managers from lockfiles and manifests.
- * Lockfiles take precedence over generic manifests for primary selection.
+ * Primary selection prefers root-level evidence and avoids inventing certainty for mixed ecosystems.
+ * Poetry requires poetry.lock and/or [tool.poetry] — not bare pyproject.toml.
  */
 export function detectPackageManagers(input) {
-    const basenames = new Set(input.relativePaths.map((p) => {
-        const parts = p.split("/");
-        return (parts[parts.length - 1] ?? p).toLowerCase();
-    }));
+    const paths = input.relativePaths;
+    const basenames = new Set(paths.map(basename));
+    const rootBasenames = new Set(paths.filter(isRootPath).map(basename));
     const found = [];
+    const rootFound = [];
+    const lockFound = [];
+    const rootLockFound = [];
     for (const marker of MARKERS) {
-        if (marker.files.some((f) => basenames.has(f.toLowerCase()))) {
-            found.push(marker.id);
+        if (marker.id === "npm") {
+            const hasNpmLock = marker.lockfiles.some((f) => basenames.has(f.toLowerCase()));
+            const hasRootPackage = rootBasenames.has("package.json");
+            const hasAnyPackage = paths.some((p) => basename(p) === "package.json");
+            if (!hasNpmLock && !hasAnyPackage) {
+                continue;
+            }
+            found.push("npm");
+            if (hasRootPackage || hasNpmLock) {
+                if (hasRootPackage) {
+                    rootFound.push("npm");
+                }
+                if (hasNpmLock) {
+                    lockFound.push("npm");
+                }
+                if (marker.lockfiles.some((f) => rootBasenames.has(f.toLowerCase()))) {
+                    rootLockFound.push("npm");
+                }
+            }
+            continue;
+        }
+        if (marker.id === "poetry") {
+            const hasLock = basenames.has("poetry.lock");
+            const hasTool = input.poetryToolDetected === true;
+            if (!hasLock && !hasTool) {
+                continue;
+            }
+            found.push("poetry");
+            if (hasLock || (hasTool && rootBasenames.has("pyproject.toml"))) {
+                rootFound.push("poetry");
+            }
+            if (hasLock) {
+                lockFound.push("poetry");
+                if (rootBasenames.has("poetry.lock")) {
+                    rootLockFound.push("poetry");
+                }
+            }
+            continue;
+        }
+        if (marker.id === "pip") {
+            const hasMarker = marker.files.some((f) => basenames.has(f.toLowerCase()));
+            const hasGenericPyproject = input.genericPyprojectDetected === true;
+            if (!hasMarker && !hasGenericPyproject) {
+                continue;
+            }
+            found.push("pip");
+            if (marker.files.some((f) => rootBasenames.has(f.toLowerCase())) ||
+                (hasGenericPyproject && rootBasenames.has("pyproject.toml"))) {
+                rootFound.push("pip");
+            }
+            if (marker.lockfiles.some((f) => basenames.has(f.toLowerCase()))) {
+                lockFound.push("pip");
+            }
+            if (marker.lockfiles.some((f) => rootBasenames.has(f.toLowerCase()))) {
+                rootLockFound.push("pip");
+            }
+            continue;
+        }
+        const hasAny = marker.files.some((f) => basenames.has(f.toLowerCase()));
+        if (!hasAny) {
+            continue;
+        }
+        found.push(marker.id);
+        if (marker.files.some((f) => rootBasenames.has(f.toLowerCase()))) {
+            rootFound.push(marker.id);
+        }
+        if (marker.lockfiles.some((f) => basenames.has(f.toLowerCase()))) {
+            lockFound.push(marker.id);
+        }
+        if (marker.lockfiles.some((f) => rootBasenames.has(f.toLowerCase()))) {
+            rootLockFound.push(marker.id);
         }
-    }
-    if (basenames.has("package.json") &&
-        !found.some((id) => ["npm", "pnpm", "yarn", "bun"].includes(id))) {
-        found.push("npm");
     }
     const unique = [...new Set(found)];
     const lockPriority = [
@@ -34,19 +123,43 @@ export function detectPackageManagers(input) {
         "yarn",
         "bun",
         "npm",
-        "poetry",
         "composer",
+        "pub",
+        "poetry",
         "cargo",
         "gradle",
         "pip",
     ];
     let primary = "unknown";
     for (const id of lockPriority) {
-        if (unique.includes(id)) {
+        if (rootLockFound.includes(id)) {
             primary = id;
             break;
         }
     }
+    if (primary === "unknown") {
+        for (const id of lockPriority) {
+            if (rootFound.includes(id)) {
+                primary = id;
+                break;
+            }
+        }
+    }
+    if (primary === "unknown") {
+        const ecosystems = new Set(unique.map((id) => (NODE_IDS.has(id) ? "node" : id === "unknown" ? "unknown" : id)));
+        ecosystems.delete("unknown");
+        if (ecosystems.size > 1) {
+            primary = "unknown";
+        }
+        else {
+            for (const id of lockPriority) {
+                if (lockFound.includes(id) || unique.includes(id)) {
+                    primary = id;
+                    break;
+                }
+            }
+        }
+    }
     return {
         packageManagers: unique.length > 0 ? unique : ["unknown"],
         primaryPackageManager: primary,
@@ -64,6 +177,8 @@ export function formatPackageManager(id) {
             return "Bun";
         case "composer":
             return "Composer";
+        case "pub":
+            return "Pub";
         case "pip":
             return "pip";
         case "poetry":
@@ -76,3 +191,13 @@ export function formatPackageManager(id) {
             return "Unknown";
     }
 }
+export function formatPackageManagers(ids) {
+    const unique = [...new Set(ids)];
+    if (unique.length === 0 || (unique.length === 1 && unique[0] === "unknown")) {
+        return "Unknown";
+    }
+    return unique
+        .filter((id) => id !== "unknown")
+        .map((id) => formatPackageManager(id))
+        .join(", ");
+}

package/dist/detectors/project.js

@@ -1,12 +1,17 @@
 import path from "node:path";
-import { DEFAULT_MAX_FILE_SIZE_BYTES } from "../constants.js";
+import { DEFAULT_IGNORE_DIRECTORIES, DEFAULT_MAX_FILE_SIZE_BYTES } from "../constants.js";
 import { discoverFiles } from "../discovery/files.js";
 import { detectFrameworks } from "./framework.js";
 import { detectLanguages } from "./language.js";
 import { detectMonorepo } from "./monorepo.js";
 import { detectPackageManagers } from "./package-manager.js";
-import { isDirectory, readJsonFile } from "../utils/fs.js";
+import { extractPythonDependencyNames, pyprojectHasPoetryTool } from "./python-deps.js";
+import { isDirectory, readJsonFile, readTextFile } from "../utils/fs.js";
 import { resolveRepoRoot } from "../utils/path.js";
+function basename(relativePath) {
+    const parts = relativePath.split("/");
+    return parts[parts.length - 1] ?? relativePath;
+}
 /**
  * Discover files and detect repository characteristics.
  */
@@ -19,31 +24,86 @@ export async function detectProject(cwd, maxFileSizeBytes = DEFAULT_MAX_FILE_SIZ
     const discovery = await discoverFiles({ root, maxFileSizeBytes });
     const relativePaths = discovery.files.map((f) => f.relativePath);
     for (const err of discovery.permissionErrors) {
+        const relative = err.split(":")[0] ?? err;
+        const underIgnored = relative
+            .split("/")
+            .some((segment) => segment.length > 0 && DEFAULT_IGNORE_DIRECTORIES.has(segment));
+        if (underIgnored) {
+            continue;
+        }
         diagnostics.push(`Permission/read issue: ${err}`);
     }
-    let packageJson;
-    const packageJsonPath = path.join(root, "package.json");
-    const packageResult = await readJsonFile(packageJsonPath, maxFileSizeBytes);
-    if (packageResult.ok) {
-        packageJson = packageResult.data;
+    const mergedPackageDeps = {};
+    let rootWorkspaces;
+    const packageJsonPaths = relativePaths.filter((p) => basename(p).toLowerCase() === "package.json");
+    for (const relative of packageJsonPaths) {
+        const absolute = path.join(root, relative);
+        const packageResult = await readJsonFile(absolute, maxFileSizeBytes);
+        if (!packageResult.ok) {
+            if (relative === "package.json") {
+                diagnostics.push(`Malformed package.json: ${packageResult.error}`);
+            }
+            continue;
+        }
+        Object.assign(mergedPackageDeps, packageResult.data.dependencies ?? {}, packageResult.data.devDependencies ?? {}, packageResult.data.peerDependencies ?? {});
+        if (relative === "package.json") {
+            rootWorkspaces = packageResult.data.workspaces;
+        }
     }
-    else if (relativePaths.some((p) => p === "package.json" || p.endsWith("/package.json"))) {
-        diagnostics.push(`Malformed package.json: ${packageResult.error}`);
+    const composerRequire = {};
+    const composerPaths = relativePaths.filter((p) => basename(p).toLowerCase() === "composer.json");
+    for (const relative of composerPaths) {
+        const absolute = path.join(root, relative);
+        const result = await readJsonFile(absolute, maxFileSizeBytes);
+        if (!result.ok) {
+            continue;
+        }
+        Object.assign(composerRequire, result.data.require ?? {}, result.data["require-dev"] ?? {});
+    }
+    const pythonDependencyNames = new Set();
+    let poetryToolDetected = false;
+    let genericPyprojectDetected = false;
+    for (const relative of relativePaths) {
+        const base = basename(relative).toLowerCase();
+        if (base !== "pyproject.toml" &&
+            base !== "requirements.txt" &&
+            !/^requirements(-[a-z0-9_-]+)?\.txt$/i.test(base)) {
+            continue;
+        }
+        const text = await readTextFile(path.join(root, relative), maxFileSizeBytes);
+        if (!text) {
+            continue;
+        }
+        for (const name of extractPythonDependencyNames(text)) {
+            pythonDependencyNames.add(name);
+        }
+        if (base === "pyproject.toml") {
+            if (pyprojectHasPoetryTool(text)) {
+                poetryToolDetected = true;
+            }
+            else {
+                genericPyprojectDetected = true;
+            }
+        }
+    }
+    if (relativePaths.some((p) => basename(p).toLowerCase() === "pipfile")) {
+        genericPyprojectDetected = true;
     }
-    const deps = {
-        ...(packageJson?.dependencies ?? {}),
-        ...(packageJson?.devDependencies ?? {}),
-        ...(packageJson?.peerDependencies ?? {}),
-    };
     const languages = detectLanguages({ relativePaths });
     const frameworks = detectFrameworks({
         relativePaths,
-        packageJsonDependencies: deps,
+        packageJsonDependencies: mergedPackageDeps,
+        composerJsonRequire: composerRequire,
+        pythonDependencyNames: [...pythonDependencyNames],
+    });
+    const packageManagers = detectPackageManagers({
+        relativePaths,
+        poetryToolDetected,
+        genericPyprojectDetected,
     });
-    const packageManagers = detectPackageManagers({ relativePaths });
     const monorepo = detectMonorepo({
         relativePaths,
-        packageJsonWorkspaces: packageJson?.workspaces,
+        packageJsonWorkspaces: rootWorkspaces,
     });
     const repository = {
         root,

package/dist/detectors/python-deps.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Lightweight Python dependency name extraction from manifests.
+ * Filename/table semantics only — does not evaluate environments.
+ */
+export declare function pyprojectHasPoetryTool(text: string): boolean;
+export declare function extractPythonDependencyNames(text: string): string[];

package/dist/detectors/python-deps.js

@@ -0,0 +1,55 @@
+/**
+ * Lightweight Python dependency name extraction from manifests.
+ * Filename/table semantics only — does not evaluate environments.
+ */
+const SKIP_KEYS = new Set([
+    "python",
+    "package-mode",
+    "packages",
+    "include",
+    "exclude",
+    "readme",
+    "homepage",
+    "repository",
+    "documentation",
+    "keywords",
+    "classifiers",
+    "license",
+    "authors",
+    "maintainers",
+    "dependencies",
+    "dev-dependencies",
+    "group",
+]);
+export function pyprojectHasPoetryTool(text) {
+    return /\[tool\.poetry(?:\.|\])/m.test(text);
+}
+export function extractPythonDependencyNames(text) {
+    const names = new Set();
+    for (const match of text.matchAll(/^\s*([A-Za-z0-9][A-Za-z0-9._-]*)\s*=\s*["'{[]/gm)) {
+        const name = (match[1] ?? "").toLowerCase().replace(/_/g, "-");
+        if (name && !SKIP_KEYS.has(name) && !name.startsWith("tool.")) {
+            names.add(name);
+        }
+    }
+    for (const match of text.matchAll(/["']([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?(?:\s*[><=! ~^,;]|["'])/g)) {
+        const name = (match[1] ?? "").toLowerCase().replace(/_/g, "-");
+        if (name && !SKIP_KEYS.has(name)) {
+            names.add(name);
+        }
+    }
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#") || line.startsWith("-")) {
+            continue;
+        }
+        const name = line
+            .split(/[><=![;@\s]/)[0]
+            ?.toLowerCase()
+            .replace(/_/g, "-");
+        if (name && /^[a-z0-9][a-z0-9._-]*$/.test(name) && !SKIP_KEYS.has(name)) {
+            names.add(name);
+        }
+    }
+    return [...names];
+}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { scan } from "./core/scanner/scan.js";
 export { PACKAGE_VERSION } from "./constants.js";
-export type { ScanOptions, ScanResult, RepositoryInfo, Finding, FindingsSummary, Scores, AgentPresence, AgentDetectionResult, CliOptions, ExitCode, } from "./types/index.js";
+export type { ScanOptions, ScanResult, RepositoryInfo, Finding, FindingsSummary, Scores, AgentPresence, AgentDetectionResult, AgentSecurityAnalysisMode, CliOptions, ExitCode, } from "./types/index.js";
 export { EXIT_CODES } from "./types/index.js";
 export { agentRegistry } from "./agents/registry.js";
 export { detectAgents } from "./agents/detect-agents.js";

package/dist/reporters/json/report.js

@@ -74,6 +74,7 @@ export function renderJsonReport(result) {
         summary: result.summary,
         scoringAvailable: result.scoringAvailable,
         scores: result.scores,
+        agentSecurityAnalysis: result.agentSecurityAnalysis,
         timing: result.timing,
         diagnostics: {
             warnings: result.diagnostics.warnings.map(sanitizeForOutput),

package/dist/reporters/terminal/report.js

@@ -1,12 +1,13 @@
 import { PACKAGE_VERSION } from "../../constants.js";
 import { AGENT_DISPLAY_NAMES } from "../../constants.js";
-import { formatFramework } from "../../detectors/framework.js";
-import { formatLanguage } from "../../detectors/language.js";
+import { formatFramework, formatFrameworks } from "../../detectors/framework.js";
+import { formatLanguage, formatLanguages } from "../../detectors/language.js";
 import { formatMonorepo } from "../../detectors/monorepo.js";
-import { formatPackageManager } from "../../detectors/package-manager.js";
+import { formatPackageManager, formatPackageManagers } from "../../detectors/package-manager.js";
 import { colors, symbolFail, symbolInfo, symbolOk, symbolWarn } from "../../utils/colors.js";
 import { sanitizeTerminalText } from "../../security/redaction.js";
 const DEFAULT_FINDING_LIMIT = 12;
+const LIMITED_ANALYSIS_NOTE = "No supported coding-agent configuration detected; agent-specific security exposure checks are limited.";
 function groupFindings(findings) {
     return {
         critical: findings.filter((f) => f.severity === "critical"),
@@ -26,6 +27,14 @@ function agentGlyph(configured, detected) {
 function formatAgents(agents) {
     return agents.map((id) => AGENT_DISPLAY_NAMES[id] ?? id).join(", ");
 }
+function isMultiStack(result) {
+    if (result.repository.monorepo === "multi-project") {
+        return true;
+    }
+    const frameworks = result.repository.frameworks.filter((id) => id !== "unknown");
+    const managers = result.repository.packageManagers.filter((id) => id !== "unknown");
+    return frameworks.length > 1 || managers.length > 1;
+}
 function renderFindingBlock(finding, verbose) {
     const lines = [];
     const icon = finding.severity === "critical"
@@ -62,9 +71,20 @@ export function renderTerminalReport(result, options = {}) {
     lines.push(colors.dim("Scanning repository..."));
     lines.push("");
     lines.push(colors.bold("Repository"));
-    lines.push(`  Framework: ${sanitizeTerminalText(formatFramework(result.repository.primaryFramework))}`);
-    lines.push(`  Language: ${sanitizeTerminalText(formatLanguage(result.repository.primaryLanguage))}`);
-    lines.push(`  Package manager: ${sanitizeTerminalText(formatPackageManager(result.repository.primaryPackageManager))}`);
+    if (isMultiStack(result)) {
+        lines.push(`  Languages: ${sanitizeTerminalText(formatLanguages(result.repository.languages))}`);
+        lines.push(`  Frameworks: ${sanitizeTerminalText(formatFrameworks(result.repository.frameworks))}`);
+        lines.push(`  Package managers: ${sanitizeTerminalText(formatPackageManagers(result.repository.packageManagers))}`);
+    }
+    else {
+        lines.push(`  Framework: ${sanitizeTerminalText(formatFramework(result.repository.primaryFramework))}`);
+        lines.push(`  Language: ${sanitizeTerminalText(formatLanguage(result.repository.primaryLanguage))}`);
+        const packageManagerLabel = result.repository.packageManagers.length > 1 ||
+            result.repository.primaryPackageManager === "unknown"
+            ? formatPackageManagers(result.repository.packageManagers)
+            : formatPackageManager(result.repository.primaryPackageManager);
+        lines.push(`  Package manager: ${sanitizeTerminalText(packageManagerLabel)}`);
+    }
     if (result.repository.monorepo !== "none") {
         lines.push(`  Monorepo: ${sanitizeTerminalText(formatMonorepo(result.repository.monorepo))}`);
     }
@@ -86,10 +106,20 @@ export function renderTerminalReport(result, options = {}) {
     lines.push("");
     const grouped = groupFindings(result.findings);
     const total = result.summary.total;
+    const limited = result.agentSecurityAnalysis === "limited";
     lines.push(colors.bold("Findings"));
     lines.push("");
+    if (limited) {
+        lines.push(`  ${symbolWarn()} ${sanitizeTerminalText(LIMITED_ANALYSIS_NOTE)}`);
+        lines.push("");
+    }
     if (total === 0) {
-        lines.push(`  ${symbolOk()} No findings`);
+        if (limited) {
+            lines.push(`  ${symbolOk()} No agent-configuration findings`);
+        }
+        else {
+            lines.push(`  ${symbolOk()} No findings`);
+        }
         lines.push("");
     }
     else {