@praneeth_54/agentdoctor 0.1.2-beta → 0.1.4-beta

package/dist/core/rules/security/env-file-exposure.js

@@ -1,7 +1,36 @@
-const ENV_BASENAME = /^\.env(\..+)?$/i;
+const TEMPLATE_BASENAMES = new Set([".env.example", ".env.sample", ".env.template", ".env.dist"]);
+const BACKUP_BASENAMES = new Set([".env_backup", ".env_old", ".env_local"]);
+/**
+ * Classify environment-like filenames. Precision over recall.
+ * Does not inspect file contents.
+ */
+export function classifyEnvBasename(base) {
+    const normalized = base.trim();
+    if (!normalized.toLowerCase().startsWith(".env")) {
+        return null;
+    }
+    const lower = normalized.toLowerCase();
+    if (TEMPLATE_BASENAMES.has(lower)) {
+        return "template";
+    }
+    if (BACKUP_BASENAMES.has(lower)) {
+        return "backup";
+    }
+    if (lower === ".env") {
+        return "runtime";
+    }
+    // .env.<name> but not templates above
+    if (/^\.env\.[A-Za-z0-9_.-]+$/.test(normalized)) {
+        return "runtime";
+    }
+    return null;
+}
 function isEnvFile(relativePath) {
     const base = relativePath.split("/").pop() ?? relativePath;
-    return ENV_BASENAME.test(base);
+    return classifyEnvBasename(base);
+}
+function hasConfiguredOrDetectedAgents(context) {
+    return context.agents.some((a) => a.detected || a.configured);
 }
 function agentsWithoutClearExclusion(context, relativePath) {
     const affected = [];
@@ -50,16 +79,53 @@ async function claudeDeniesRead(context, relativePath) {
 export const envFileExposureRule = {
     id: "security/env-file-exposure",
     title: "Sensitive environment file may enter agent context",
-    description: "Detects repository .env files when configured AI agents may be able to access them.",
+    description: "Detects repository .env files as repository risk and, when agents are configured, possible agent context exposure.",
     category: "security",
     severity: "critical",
     fixability: "review",
-    rationale: "Environment files often contain credentials. If an AI coding agent can read them, secrets may enter model context.",
-    recommendation: "Exclude the file from AI agent context (for example .cursorignore / Claude Code Read deny rules) and ensure it is not committed.",
+    rationale: "Environment files often contain credentials. Repository presence is a risk; agent readability can add exposure.",
+    recommendation: "Keep runtime .env files out of version control, exclude them from AI agent context, and rotate credentials if exposed.",
     async check(context) {
         const findings = [];
-        const candidates = context.discovery.files.filter((f) => isEnvFile(f.relativePath));
-        for (const file of candidates) {
+        const agentsPresent = hasConfiguredOrDetectedAgents(context);
+        for (const file of context.discovery.files) {
+            const kind = isEnvFile(file.relativePath);
+            if (!kind) {
+                continue;
+            }
+            if (kind === "template") {
+                findings.push({
+                    ruleId: "security/env-file-exposure",
+                    category: "security",
+                    severity: "info",
+                    title: "Environment template file present",
+                    message: `Environment template file detected at ${file.relativePath}`,
+                    whyItMatters: "Template env files are usually placeholders, but they can still document secret names. Filename classification only — contents were not inspected.",
+                    recommendation: "Keep templates free of real credentials. Prefer documenting variable names without values.",
+                    affectedAgents: [],
+                    evidence: { path: file.relativePath, detail: "template" },
+                    fixability: "review",
+                });
+                continue;
+            }
+            if (!agentsPresent) {
+                findings.push({
+                    ruleId: "security/env-file-exposure",
+                    category: "security",
+                    severity: kind === "backup" ? "warning" : "critical",
+                    title: "Sensitive environment file present in repository",
+                    message: `Sensitive environment file present in the repository: ${file.relativePath}`,
+                    whyItMatters: "No supported coding-agent configuration was detected, so agent-specific exposure was not asserted. The file is still high-risk repository material if tracked or shared.",
+                    recommendation: "Keep runtime environment files out of version control and rotate credentials if the file may have been shared.",
+                    affectedAgents: [],
+                    evidence: {
+                        path: file.relativePath,
+                        detail: kind === "backup" ? "backup-no-agent" : "runtime-no-agent",
+                    },
+                    fixability: "review",
+                });
+                continue;
+            }
             let affected = agentsWithoutClearExclusion(context, file.relativePath);
             if (affected.includes("claude-code")) {
                 if (await claudeDeniesRead(context, file.relativePath)) {
@@ -72,13 +138,16 @@ export const envFileExposureRule = {
             findings.push({
                 ruleId: "security/env-file-exposure",
                 category: "security",
-                severity: "critical",
+                severity: kind === "backup" ? "warning" : "critical",
                 title: "Sensitive environment file may enter agent context",
                 message: `Sensitive environment file detected and no relevant exclusion was found for: ${file.relativePath}`,
                 whyItMatters: "Environment files frequently hold API keys and credentials. If readable by an AI coding agent, those values may be included in prompts or logs.",
                 recommendation: "Add an agent-specific exclusion (for example .cursorignore or a Claude Code Read deny rule), keep the file out of version control, and rotate any credentials that may have been exposed.",
                 affectedAgents: affected,
-                evidence: { path: file.relativePath },
+                evidence: {
+                    path: file.relativePath,
+                    detail: kind === "backup" ? "backup" : "runtime",
+                },
                 fixability: "review",
             });
         }

package/dist/core/rules/security/private-key-file.js

@@ -39,22 +39,24 @@ export const privateKeyFileRule = {
     async check(context) {
         const findings = [];
         const affected = context.agents.filter((a) => a.detected || a.configured).map((a) => a.id);
-        const agents = affected.length > 0 ? affected : ["cursor", "claude-code", "codex"];
         for (const file of context.discovery.files) {
             const base = file.relativePath.split("/").pop() ?? file.relativePath;
             const label = classify(base);
             if (!label) {
                 continue;
             }
+            const agentsPresent = affected.length > 0;
             findings.push({
                 ruleId: "security/private-key-file",
                 category: "security",
                 severity: "critical",
                 title: "Private key or credential file present in repository",
                 message: `Possible ${label} detected at ${file.relativePath}`,
-                whyItMatters: "Credential material in the working tree can be read by AI coding agents and may leak into model context or logs. Filename heuristics only — contents were not inspected.",
+                whyItMatters: agentsPresent
+                    ? "Credential material in the working tree can be read by AI coding agents and may leak into model context or logs. Filename heuristics only — contents were not inspected."
+                    : "Credential material in the working tree is high-risk repository content. No supported coding-agent configuration was detected, so agent-specific exposure was not asserted. Filename heuristics only — contents were not inspected.",
                 recommendation: "Remove the file from the repository, rotate the credential, add ignore rules, and never commit replacements.",
-                affectedAgents: [...agents],
+                affectedAgents: affected,
                 evidence: { path: file.relativePath, detail: label },
                 fixability: "manual",
             });

package/dist/core/scanner/scan.js

@@ -46,6 +46,11 @@ export async function scan(options = {}) {
     for (const error of ruleErrors) {
         warnings.push(sanitizeTerminalText(error));
     }
+    const agentsPresent = agents.some((a) => a.detected || a.configured);
+    const agentSecurityAnalysis = agentsPresent ? "full" : "limited";
+    if (agentSecurityAnalysis === "limited") {
+        warnings.push("No supported coding-agent configuration detected; agent-specific security exposure checks are limited.");
+    }
     return {
         version: PACKAGE_VERSION,
         repository,
@@ -54,6 +59,7 @@ export async function scan(options = {}) {
         summary,
         scores: null,
         scoringAvailable: false,
+        agentSecurityAnalysis,
         timing: {
             discoveryMs: discovery.elapsedMs,
             detectionMs,

package/dist/detectors/framework.d.ts

@@ -3,6 +3,8 @@ export interface FrameworkDetectionInput {
     relativePaths: string[];
     packageJsonDependencies?: Record<string, string>;
     composerJsonRequire?: Record<string, string>;
+    /** Lowercase dependency/package names discovered from Python manifests. */
+    pythonDependencyNames?: string[];
     pubspecName?: string;
 }
 export interface FrameworkDetectionResult {
@@ -15,3 +17,4 @@ export interface FrameworkDetectionResult {
  */
 export declare function detectFrameworks(input: FrameworkDetectionInput): FrameworkDetectionResult;
 export declare function formatFramework(framework: FrameworkId): string;
+export declare function formatFrameworks(ids: FrameworkId[]): string;

package/dist/detectors/framework.js

@@ -4,6 +4,9 @@ function hasDep(deps, name) {
 function hasFile(paths, ...names) {
     return names.some((name) => paths.has(name.toLowerCase()));
 }
+function hasPythonDep(names, dep) {
+    return Boolean(names?.includes(dep.toLowerCase()));
+}
 /**
  * Detect frameworks from config markers and dependency names.
  * Does not fail when nothing matches — returns unknown.
@@ -18,6 +21,7 @@ export function detectFrameworks(input) {
         ...(input.packageJsonDependencies ?? {}),
     };
     const composer = input.composerJsonRequire ?? {};
+    const pythonDeps = input.pythonDependencyNames ?? [];
     const detected = [];
     const isNext = hasFile(basenames, "next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs") ||
         hasDep(deps, "next");
@@ -63,15 +67,12 @@ export function detectFrameworks(input) {
         !isVue &&
         !isSvelte &&
         !isReact &&
-        (hasFile(basenames, "package.json") || hasDep(deps, "express") === false) &&
         hasFile(basenames, "package.json")) {
-        // Generic Node.js project with package.json but no web framework
         if (!detected.includes("nodejs")) {
             detected.push("nodejs");
         }
     }
     if (hasFile(basenames, "pubspec.yaml") || input.pubspecName !== undefined) {
-        // Flutter: pubspec presence implies Flutter/Dart project context for detection
         if (hasFile(pathSet, "pubspec.yaml") || basenames.has("pubspec.yaml")) {
             detected.push("flutter");
         }
@@ -79,17 +80,19 @@ export function detectFrameworks(input) {
     if (hasDep(composer, "laravel/framework") || hasFile(basenames, "artisan")) {
         detected.push("laravel");
     }
-    if (hasFile(basenames, "manage.py") ||
-        [...pathSet].some((p) => p.endsWith("/settings.py") || p === "settings.py")) {
+    const isDjango = hasFile(basenames, "manage.py") ||
+        hasPythonDep(pythonDeps, "django") ||
+        [...pathSet].some((p) => p.endsWith("/requirements-django.txt"));
+    if (isDjango) {
         detected.push("django");
     }
-    // FastAPI: path heuristics only (requirements/pyproject often lack a stable marker)
-    if ([...pathSet].some((p) => p.includes("fastapi") || p.endsWith("requirements-fastapi.txt") || p === "app/main.py")) {
+    const hasFastApiDep = hasPythonDep(pythonDeps, "fastapi") ||
+        [...pathSet].some((p) => p.includes("fastapi") || p.endsWith("requirements-fastapi.txt"));
+    const hasFastApiAppLayout = [...pathSet].some((p) => p === "app/main.py" || p.endsWith("/app/main.py"));
+    if (hasFastApiDep && hasFastApiAppLayout) {
         detected.push("fastapi");
     }
-    // Deduplicate while preserving order
     const unique = [...new Set(detected)];
-    // Priority for primary framework
     const priority = [
         "nextjs",
         "nuxt",
@@ -146,3 +149,10 @@ export function formatFramework(framework) {
             return "Unknown";
     }
 }
+export function formatFrameworks(ids) {
+    const unique = [...new Set(ids)].filter((id) => id !== "unknown");
+    if (unique.length === 0) {
+        return "Unknown";
+    }
+    return unique.map((id) => formatFramework(id)).join(", ");
+}

package/dist/detectors/language.d.ts

@@ -12,3 +12,4 @@ export interface LanguageDetectionResult {
  */
 export declare function detectLanguages(input: LanguageDetectionInput): LanguageDetectionResult;
 export declare function formatLanguage(language: LanguageId): string;
+export declare function formatLanguages(ids: LanguageId[]): string;

package/dist/detectors/language.js

@@ -120,3 +120,10 @@ export function formatLanguage(language) {
             return "Unknown";
     }
 }
+export function formatLanguages(ids) {
+    const unique = [...new Set(ids)].filter((id) => id !== "unknown");
+    if (unique.length === 0) {
+        return "Unknown";
+    }
+    return unique.map((id) => formatLanguage(id)).join(", ");
+}

package/dist/detectors/package-manager.d.ts

@@ -1,6 +1,10 @@
 import type { PackageManagerId } from "../types/index.js";
 export interface PackageManagerDetectionInput {
     relativePaths: string[];
+    /** True when a pyproject.toml contains a [tool.poetry] table. */
+    poetryToolDetected?: boolean;
+    /** True when a non-Poetry pyproject.toml (or similar) indicates a Python project. */
+    genericPyprojectDetected?: boolean;
 }
 export interface PackageManagerDetectionResult {
     packageManagers: PackageManagerId[];
@@ -9,6 +13,7 @@ export interface PackageManagerDetectionResult {
 /**
  * Detect package managers from lockfiles and manifests.
  * Primary selection prefers root-level evidence and avoids inventing certainty for mixed ecosystems.
+ * Poetry requires poetry.lock and/or [tool.poetry] — not bare pyproject.toml.
  */
 export declare function detectPackageManagers(input: PackageManagerDetectionInput): PackageManagerDetectionResult;
 export declare function formatPackageManager(id: PackageManagerId): string;

package/dist/detectors/package-manager.js

@@ -9,7 +9,7 @@ const MARKERS = [
     },
     { id: "composer", files: ["composer.lock", "composer.json"], lockfiles: ["composer.lock"] },
     { id: "pub", files: ["pubspec.yaml", "pubspec.lock"], lockfiles: ["pubspec.lock"] },
-    { id: "poetry", files: ["poetry.lock", "pyproject.toml"], lockfiles: ["poetry.lock"] },
+    { id: "poetry", files: ["poetry.lock"], lockfiles: ["poetry.lock"] },
     {
         id: "pip",
         files: ["requirements.txt", "Pipfile", "Pipfile.lock"],
@@ -33,6 +33,7 @@ function isRootPath(relativePath) {
 /**
  * Detect package managers from lockfiles and manifests.
  * Primary selection prefers root-level evidence and avoids inventing certainty for mixed ecosystems.
+ * Poetry requires poetry.lock and/or [tool.poetry] — not bare pyproject.toml.
  */
 export function detectPackageManagers(input) {
     const paths = input.relativePaths;
@@ -64,6 +65,43 @@ export function detectPackageManagers(input) {
             }
             continue;
         }
+        if (marker.id === "poetry") {
+            const hasLock = basenames.has("poetry.lock");
+            const hasTool = input.poetryToolDetected === true;
+            if (!hasLock && !hasTool) {
+                continue;
+            }
+            found.push("poetry");
+            if (hasLock || (hasTool && rootBasenames.has("pyproject.toml"))) {
+                rootFound.push("poetry");
+            }
+            if (hasLock) {
+                lockFound.push("poetry");
+                if (rootBasenames.has("poetry.lock")) {
+                    rootLockFound.push("poetry");
+                }
+            }
+            continue;
+        }
+        if (marker.id === "pip") {
+            const hasMarker = marker.files.some((f) => basenames.has(f.toLowerCase()));
+            const hasGenericPyproject = input.genericPyprojectDetected === true;
+            if (!hasMarker && !hasGenericPyproject) {
+                continue;
+            }
+            found.push("pip");
+            if (marker.files.some((f) => rootBasenames.has(f.toLowerCase())) ||
+                (hasGenericPyproject && rootBasenames.has("pyproject.toml"))) {
+                rootFound.push("pip");
+            }
+            if (marker.lockfiles.some((f) => basenames.has(f.toLowerCase()))) {
+                lockFound.push("pip");
+            }
+            if (marker.lockfiles.some((f) => rootBasenames.has(f.toLowerCase()))) {
+                rootLockFound.push("pip");
+            }
+            continue;
+        }
         const hasAny = marker.files.some((f) => basenames.has(f.toLowerCase()));
         if (!hasAny) {
             continue;

package/dist/detectors/project.js

@@ -5,8 +5,13 @@ import { detectFrameworks } from "./framework.js";
 import { detectLanguages } from "./language.js";
 import { detectMonorepo } from "./monorepo.js";
 import { detectPackageManagers } from "./package-manager.js";
-import { isDirectory, pathExists, readJsonFile } from "../utils/fs.js";
+import { extractPythonDependencyNames, pyprojectHasPoetryTool } from "./python-deps.js";
+import { isDirectory, readJsonFile, readTextFile } from "../utils/fs.js";
 import { resolveRepoRoot } from "../utils/path.js";
+function basename(relativePath) {
+    const parts = relativePath.split("/");
+    return parts[parts.length - 1] ?? relativePath;
+}
 /**
  * Discover files and detect repository characteristics.
  */
@@ -28,32 +33,77 @@ export async function detectProject(cwd, maxFileSizeBytes = DEFAULT_MAX_FILE_SIZ
         }
         diagnostics.push(`Permission/read issue: ${err}`);
     }
-    let packageJson;
-    const packageJsonPath = path.join(root, "package.json");
-    const rootPackageExists = await pathExists(packageJsonPath);
-    if (rootPackageExists) {
-        const packageResult = await readJsonFile(packageJsonPath, maxFileSizeBytes);
-        if (packageResult.ok) {
-            packageJson = packageResult.data;
+    const mergedPackageDeps = {};
+    let rootWorkspaces;
+    const packageJsonPaths = relativePaths.filter((p) => basename(p).toLowerCase() === "package.json");
+    for (const relative of packageJsonPaths) {
+        const absolute = path.join(root, relative);
+        const packageResult = await readJsonFile(absolute, maxFileSizeBytes);
+        if (!packageResult.ok) {
+            if (relative === "package.json") {
+                diagnostics.push(`Malformed package.json: ${packageResult.error}`);
+            }
+            continue;
         }
-        else {
-            diagnostics.push(`Malformed package.json: ${packageResult.error}`);
+        Object.assign(mergedPackageDeps, packageResult.data.dependencies ?? {}, packageResult.data.devDependencies ?? {}, packageResult.data.peerDependencies ?? {});
+        if (relative === "package.json") {
+            rootWorkspaces = packageResult.data.workspaces;
         }
     }
-    const deps = {
-        ...(packageJson?.dependencies ?? {}),
-        ...(packageJson?.devDependencies ?? {}),
-        ...(packageJson?.peerDependencies ?? {}),
-    };
+    const composerRequire = {};
+    const composerPaths = relativePaths.filter((p) => basename(p).toLowerCase() === "composer.json");
+    for (const relative of composerPaths) {
+        const absolute = path.join(root, relative);
+        const result = await readJsonFile(absolute, maxFileSizeBytes);
+        if (!result.ok) {
+            continue;
+        }
+        Object.assign(composerRequire, result.data.require ?? {}, result.data["require-dev"] ?? {});
+    }
+    const pythonDependencyNames = new Set();
+    let poetryToolDetected = false;
+    let genericPyprojectDetected = false;
+    for (const relative of relativePaths) {
+        const base = basename(relative).toLowerCase();
+        if (base !== "pyproject.toml" &&
+            base !== "requirements.txt" &&
+            !/^requirements(-[a-z0-9_-]+)?\.txt$/i.test(base)) {
+            continue;
+        }
+        const text = await readTextFile(path.join(root, relative), maxFileSizeBytes);
+        if (!text) {
+            continue;
+        }
+        for (const name of extractPythonDependencyNames(text)) {
+            pythonDependencyNames.add(name);
+        }
+        if (base === "pyproject.toml") {
+            if (pyprojectHasPoetryTool(text)) {
+                poetryToolDetected = true;
+            }
+            else {
+                genericPyprojectDetected = true;
+            }
+        }
+    }
+    if (relativePaths.some((p) => basename(p).toLowerCase() === "pipfile")) {
+        genericPyprojectDetected = true;
+    }
     const languages = detectLanguages({ relativePaths });
     const frameworks = detectFrameworks({
         relativePaths,
-        packageJsonDependencies: deps,
+        packageJsonDependencies: mergedPackageDeps,
+        composerJsonRequire: composerRequire,
+        pythonDependencyNames: [...pythonDependencyNames],
+    });
+    const packageManagers = detectPackageManagers({
+        relativePaths,
+        poetryToolDetected,
+        genericPyprojectDetected,
     });
-    const packageManagers = detectPackageManagers({ relativePaths });
     const monorepo = detectMonorepo({
         relativePaths,
-        packageJsonWorkspaces: packageJson?.workspaces,
+        packageJsonWorkspaces: rootWorkspaces,
     });
     const repository = {
         root,

package/dist/detectors/python-deps.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Lightweight Python dependency name extraction from manifests.
+ * Filename/table semantics only — does not evaluate environments.
+ */
+export declare function pyprojectHasPoetryTool(text: string): boolean;
+export declare function extractPythonDependencyNames(text: string): string[];

package/dist/detectors/python-deps.js

@@ -0,0 +1,55 @@
+/**
+ * Lightweight Python dependency name extraction from manifests.
+ * Filename/table semantics only — does not evaluate environments.
+ */
+const SKIP_KEYS = new Set([
+    "python",
+    "package-mode",
+    "packages",
+    "include",
+    "exclude",
+    "readme",
+    "homepage",
+    "repository",
+    "documentation",
+    "keywords",
+    "classifiers",
+    "license",
+    "authors",
+    "maintainers",
+    "dependencies",
+    "dev-dependencies",
+    "group",
+]);
+export function pyprojectHasPoetryTool(text) {
+    return /\[tool\.poetry(?:\.|\])/m.test(text);
+}
+export function extractPythonDependencyNames(text) {
+    const names = new Set();
+    for (const match of text.matchAll(/^\s*([A-Za-z0-9][A-Za-z0-9._-]*)\s*=\s*["'{[]/gm)) {
+        const name = (match[1] ?? "").toLowerCase().replace(/_/g, "-");
+        if (name && !SKIP_KEYS.has(name) && !name.startsWith("tool.")) {
+            names.add(name);
+        }
+    }
+    for (const match of text.matchAll(/["']([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?(?:\s*[><=! ~^,;]|["'])/g)) {
+        const name = (match[1] ?? "").toLowerCase().replace(/_/g, "-");
+        if (name && !SKIP_KEYS.has(name)) {
+            names.add(name);
+        }
+    }
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#") || line.startsWith("-")) {
+            continue;
+        }
+        const name = line
+            .split(/[><=![;@\s]/)[0]
+            ?.toLowerCase()
+            .replace(/_/g, "-");
+        if (name && /^[a-z0-9][a-z0-9._-]*$/.test(name) && !SKIP_KEYS.has(name)) {
+            names.add(name);
+        }
+    }
+    return [...names];
+}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { scan } from "./core/scanner/scan.js";
 export { PACKAGE_VERSION } from "./constants.js";
-export type { ScanOptions, ScanResult, RepositoryInfo, Finding, FindingsSummary, Scores, AgentPresence, AgentDetectionResult, CliOptions, ExitCode, } from "./types/index.js";
+export type { ScanOptions, ScanResult, RepositoryInfo, Finding, FindingsSummary, Scores, AgentPresence, AgentDetectionResult, AgentSecurityAnalysisMode, CliOptions, ExitCode, } from "./types/index.js";
 export { EXIT_CODES } from "./types/index.js";
 export { agentRegistry } from "./agents/registry.js";
 export { detectAgents } from "./agents/detect-agents.js";

package/dist/reporters/json/report.js

@@ -74,6 +74,7 @@ export function renderJsonReport(result) {
         summary: result.summary,
         scoringAvailable: result.scoringAvailable,
         scores: result.scores,
+        agentSecurityAnalysis: result.agentSecurityAnalysis,
         timing: result.timing,
         diagnostics: {
             warnings: result.diagnostics.warnings.map(sanitizeForOutput),

package/dist/reporters/terminal/report.js

@@ -1,12 +1,13 @@
 import { PACKAGE_VERSION } from "../../constants.js";
 import { AGENT_DISPLAY_NAMES } from "../../constants.js";
-import { formatFramework } from "../../detectors/framework.js";
-import { formatLanguage } from "../../detectors/language.js";
+import { formatFramework, formatFrameworks } from "../../detectors/framework.js";
+import { formatLanguage, formatLanguages } from "../../detectors/language.js";
 import { formatMonorepo } from "../../detectors/monorepo.js";
 import { formatPackageManager, formatPackageManagers } from "../../detectors/package-manager.js";
 import { colors, symbolFail, symbolInfo, symbolOk, symbolWarn } from "../../utils/colors.js";
 import { sanitizeTerminalText } from "../../security/redaction.js";
 const DEFAULT_FINDING_LIMIT = 12;
+const LIMITED_ANALYSIS_NOTE = "No supported coding-agent configuration detected; agent-specific security exposure checks are limited.";
 function groupFindings(findings) {
     return {
         critical: findings.filter((f) => f.severity === "critical"),
@@ -26,6 +27,14 @@ function agentGlyph(configured, detected) {
 function formatAgents(agents) {
     return agents.map((id) => AGENT_DISPLAY_NAMES[id] ?? id).join(", ");
 }
+function isMultiStack(result) {
+    if (result.repository.monorepo === "multi-project") {
+        return true;
+    }
+    const frameworks = result.repository.frameworks.filter((id) => id !== "unknown");
+    const managers = result.repository.packageManagers.filter((id) => id !== "unknown");
+    return frameworks.length > 1 || managers.length > 1;
+}
 function renderFindingBlock(finding, verbose) {
     const lines = [];
     const icon = finding.severity === "critical"
@@ -62,13 +71,20 @@ export function renderTerminalReport(result, options = {}) {
     lines.push(colors.dim("Scanning repository..."));
     lines.push("");
     lines.push(colors.bold("Repository"));
-    lines.push(`  Framework: ${sanitizeTerminalText(formatFramework(result.repository.primaryFramework))}`);
-    lines.push(`  Language: ${sanitizeTerminalText(formatLanguage(result.repository.primaryLanguage))}`);
-    const packageManagerLabel = result.repository.packageManagers.length > 1 ||
-        result.repository.primaryPackageManager === "unknown"
-        ? formatPackageManagers(result.repository.packageManagers)
-        : formatPackageManager(result.repository.primaryPackageManager);
-    lines.push(`  Package manager: ${sanitizeTerminalText(packageManagerLabel)}`);
+    if (isMultiStack(result)) {
+        lines.push(`  Languages: ${sanitizeTerminalText(formatLanguages(result.repository.languages))}`);
+        lines.push(`  Frameworks: ${sanitizeTerminalText(formatFrameworks(result.repository.frameworks))}`);
+        lines.push(`  Package managers: ${sanitizeTerminalText(formatPackageManagers(result.repository.packageManagers))}`);
+    }
+    else {
+        lines.push(`  Framework: ${sanitizeTerminalText(formatFramework(result.repository.primaryFramework))}`);
+        lines.push(`  Language: ${sanitizeTerminalText(formatLanguage(result.repository.primaryLanguage))}`);
+        const packageManagerLabel = result.repository.packageManagers.length > 1 ||
+            result.repository.primaryPackageManager === "unknown"
+            ? formatPackageManagers(result.repository.packageManagers)
+            : formatPackageManager(result.repository.primaryPackageManager);
+        lines.push(`  Package manager: ${sanitizeTerminalText(packageManagerLabel)}`);
+    }
     if (result.repository.monorepo !== "none") {
         lines.push(`  Monorepo: ${sanitizeTerminalText(formatMonorepo(result.repository.monorepo))}`);
     }
@@ -90,10 +106,20 @@ export function renderTerminalReport(result, options = {}) {
     lines.push("");
     const grouped = groupFindings(result.findings);
     const total = result.summary.total;
+    const limited = result.agentSecurityAnalysis === "limited";
     lines.push(colors.bold("Findings"));
     lines.push("");
+    if (limited) {
+        lines.push(`  ${symbolWarn()} ${sanitizeTerminalText(LIMITED_ANALYSIS_NOTE)}`);
+        lines.push("");
+    }
     if (total === 0) {
-        lines.push(`  ${symbolOk()} No findings`);
+        if (limited) {
+            lines.push(`  ${symbolOk()} No agent-configuration findings`);
+        }
+        else {
+            lines.push(`  ${symbolOk()} No findings`);
+        }
         lines.push("");
     }
     else {

package/dist/types/index.d.ts

@@ -94,6 +94,11 @@ export interface ScanDiagnostics {
     warnings: string[];
     errors: string[];
 }
+/**
+ * Whether agent-specific security exposure checks had enough agent configuration
+ * to run meaningfully. Additive field — absent consumers may ignore it.
+ */
+export type AgentSecurityAnalysisMode = "full" | "limited";
 export interface ScanResult {
     version: string;
     repository: RepositoryInfo;
@@ -107,6 +112,11 @@ export interface ScanResult {
     scores: Scores | null;
     /** False until the readiness scoring model ships. */
     scoringAvailable: boolean;
+    /**
+     * `limited` when no supported coding agent is detected/configured.
+     * Repository-risk checks may still run; agent exposure claims are not asserted.
+     */
+    agentSecurityAnalysis: AgentSecurityAnalysisMode;
     timing: TimingInfo;
     diagnostics: ScanDiagnostics;
 }