@praneeth_54/agentdoctor 3.0.1 → 3.0.2

package/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.0.2] — 2026-09-27
+
+Patch release: fix current-directory project discovery for `agentdoctor start`.
+
+Public relationship:
+
+- **3.0.0** and **3.0.1** remain immutable public releases.
+- **3.0.2** does not rewrite prior npm/GitHub history.
+
+### Fixed
+
+- `agentdoctor start` no longer reports `(none found)` for valid software trees that lack classic manifests (e.g. language-only roots without `package.json` / `.git`).
+- Discovery fallback now reuses the same deterministic `detectProject` engine as `dna`, so `start` and `dna` agree on the project root.
+- Clearer discovery UX (`✓ Project detected`) and empty-state guidance.
+- Reject empty trees that only report `unknown` language; do not silently absorb multi-project parents with 2+ child marker projects.
+- Ownership, containment, HOME/broad-root, `.private`, nested-repo, and symlink protections remain enforced.
+
+### Tests
+
+- Added `tests/unit/project/start-discovery.test.ts` regression coverage for markerless cwd, nested roots, multi-project parents, `.private`, and home refusal.
+
 ## [3.0.1] — 2026-09-27
 
 Production-hardening follow-up on the reviewed freeze remediation commit
@@ -601,7 +622,8 @@ First public beta.
 - Not a complete secret scanner
 - Git “tracked secret” detection deferred
 
-[Unreleased]: https://github.com/pranee54/AgentDoctor/compare/v3.0.1...HEAD
+[Unreleased]: https://github.com/pranee54/AgentDoctor/compare/v3.0.2...HEAD
+[3.0.2]: https://github.com/pranee54/AgentDoctor/compare/v3.0.1...v3.0.2
 [3.0.1]: https://github.com/pranee54/AgentDoctor/compare/v3.0.0...v3.0.1
 [3.0.0]: https://github.com/pranee54/AgentDoctor/compare/v2.1.0...v3.0.0
 [2.1.0]: https://github.com/pranee54/AgentDoctor/compare/v2.0.1...v2.1.0

package/README.md

@@ -281,15 +281,15 @@ Student path: `learn` → ask → viva → docs → Build With Me (with `--appro
 Requires **Node.js 20+**.
 
 ```bash
-npm install -g @praneeth_54/agentdoctor@3.0.1
-agentdoctor --version   # 3.0.1
+npm install -g @praneeth_54/agentdoctor@3.0.2
+agentdoctor --version   # 3.0.2
 agentdoctor --help
 ```
 
 Or without global install:
 
 ```bash
-npx @praneeth_54/agentdoctor@3.0.1 --help
+npx @praneeth_54/agentdoctor@3.0.2 --help
 ```
 
 ---
@@ -298,7 +298,7 @@ npx @praneeth_54/agentdoctor@3.0.1 --help
 
 ```bash
 # 1. Install
-npm install -g @praneeth_54/agentdoctor@3.0.1
+npm install -g @praneeth_54/agentdoctor@3.0.2
 
 # 2. Enter YOUR project (not your home folder)
 cd /path/to/my-project
@@ -581,11 +581,12 @@ Post-acceptance ideas for later releases: maintainers see [docs/internal/POST_3_
 
 ## Roadmap
 
-| Track                 | Meaning                                                                   |
-| --------------------- | ------------------------------------------------------------------------- |
-| **3.0.0 (released)**  | Original public release (`v3.0.0` → `c21faf1`)                            |
-| **3.0.1 (candidate)** | Freeze remediation / ownership & security hardening follow-up (`319810a`) |
-| **Coming soon**       | Maturity, language depth, runtime adapters, DX — not promised ship dates  |
+| Track                | Meaning                                                                  |
+| -------------------- | ------------------------------------------------------------------------ |
+| **3.0.0 (released)** | Original public release (`v3.0.0` → `c21faf1`)                           |
+| **3.0.1 (released)** | Freeze remediation / ownership & security hardening follow-up            |
+| **3.0.2 (released)** | `start` discovery aligned with deterministic `detectProject`             |
+| **Coming soon**      | Maturity, language depth, runtime adapters, DX — not promised ship dates |
 
 ---
 

package/dist/agent/chat/deterministic.js

@@ -5,11 +5,29 @@ import { buildIntelligenceGraph } from "../../intelligence/graph/build.js";
 import { resolveRepoRoot } from "../../utils/path.js";
 import { retrieveProjectContext } from "../context/retrieve.js";
 import { buildChatTurnResponse } from "./response.js";
-const ARCH_RE = /architecture|structure|module|layout|how.*(project|repo|codebase)|explain.*(project|repo|codebase|this)|what (is|does) (this|my) project|project overview|understand (my |this )?project/i;
+const ARCH_RE = /architecture|structure|module|layout|what (is|does) (this|my) project|project overview|understand (my |this )?project/i;
 const AUTH_RE = /auth|login|password|session|jwt|oauth/i;
 const DEPS_RE = /depend|package|lockfile|npm|yarn|pnpm/i;
-const START_RE = /where.*(start|entry|boot|main)|application start|entry\s*point/i;
 const DB_RE = /database|db\.|sql|prisma|query\(/i;
+/** ReDoS-safe: avoid `where.*…` / `how.*…` backtracking on uncontrolled chat input. */
+function isStartQuestion(q) {
+    if (/application start|entry\s*point/i.test(q))
+        return true;
+    const lower = q.toLowerCase();
+    if (!lower.includes("where"))
+        return false;
+    return /\b(start|entry|boot|main)\b/i.test(q);
+}
+function isArchitectureQuestion(q) {
+    if (ARCH_RE.test(q))
+        return true;
+    const lower = q.toLowerCase();
+    if (lower.includes("how") && /(?:project|repo|codebase)/i.test(q))
+        return true;
+    if (lower.includes("explain") && /(?:project|repo|codebase|\bthis\b)/i.test(q))
+        return true;
+    return false;
+}
 export async function answerDeterministicProjectQuestion(options) {
     const root = resolveRepoRoot(options.root);
     const q = options.question.trim();
@@ -61,7 +79,7 @@ export async function answerDeterministicProjectQuestion(options) {
         }
         sections.push("");
     }
-    if (START_RE.test(q)) {
+    if (isStartQuestion(q)) {
         const startHits = context.citations
             .filter((c) => c.path && /(server|index|main|app)\.[jt]sx?$/i.test(c.path))
             .slice(0, 6);
@@ -139,7 +157,7 @@ export async function answerDeterministicProjectQuestion(options) {
         sections.push(`Lockfiles: ${deps.lockfilesPresent.join(", ") || "none"}`);
         sections.push("");
     }
-    if (ARCH_RE.test(q)) {
+    if (isArchitectureQuestion(q)) {
         try {
             const graph = await buildIntelligenceGraph({ root, mode: "auto" });
             sections.push(`[INFERRED] Graph: ${graph.nodes.length} nodes, ${graph.edges.length} edges (${graph.builder})`);

package/dist/cli/commands/start.js

@@ -2,16 +2,21 @@ import { EXIT_CODES } from "../../types/index.js";
 import { initBrainStore, rebuildBrain, getBrainStatus } from "../../core/brain-cli/service.js";
 import { discoverProjectRoots } from "../../product/discovery/roots.js";
 import { buildProjectDna, persistProjectDna } from "../../product/dna/build.js";
-import { resolveRepoRoot } from "../../utils/path.js";
 import { resolveCliProjectRoot } from "../safe-root.js";
 function printJson(value) {
     process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
 export async function runStartCommand(options) {
     const prefer = options.select ?? options.root;
+    // Fail closed before discovery walks anything (home/Desktop refusal must be instant).
+    const gated = await resolveCliProjectRoot(prefer);
+    if (!gated.ok) {
+        console.error(`Error: ${gated.message}`);
+        return gated.code;
+    }
     const discovery = await discoverProjectRoots({
-        cwd: prefer ? resolveRepoRoot(prefer) : process.cwd(),
-        ...(prefer ? { prefer: resolveRepoRoot(prefer) } : {}),
+        cwd: gated.root,
+        prefer: gated.root,
         ...(options.maxEntries !== undefined ? { maxEntries: options.maxEntries } : {}),
         autoSelect: !options.listOnly,
     });
@@ -26,13 +31,16 @@ export async function runStartCommand(options) {
         }
         process.stdout.write("Project candidates:\n");
         if (discovery.candidates.length === 0) {
-            process.stdout.write("  (none found — navigate into a project or pass a path)\n");
+            process.stdout.write(`  (none found under ${gated.root})\n`);
+            process.stdout.write("  Tip: open a project directory that contains source code or a manifest (package.json, composer.json, pyproject.toml, .git, …),\n");
+            process.stdout.write(`  or run: agentdoctor start ${gated.root}\n`);
+            process.stdout.write("  Related: agentdoctor dna .   # inspect what DNA sees in this folder\n");
             return EXIT_CODES.USAGE_ERROR;
         }
         for (const [i, c] of discovery.candidates.entries()) {
             process.stdout.write(`  [${i + 1}] ${c.root}\n      score=${c.score} markers=${c.markers.join(", ")} (${c.reason})\n`);
         }
-        process.stdout.write("\nRe-run with --select <path> to initialize that project.\n");
+        process.stdout.write("\nMultiple projects detected — re-run with --select <path> (or pass an explicit path).\n");
         return EXIT_CODES.SUCCESS;
     }
     const root = discovery.selected.root;
@@ -50,8 +58,9 @@ export async function runStartCommand(options) {
         printJson(payload);
     }
     else {
+        process.stdout.write(`✓ Project detected: ${dna.name}\n`);
+        process.stdout.write(`  Root: ${root}\n`);
         process.stdout.write(`AgentDoctor start\n`);
-        process.stdout.write(`  root: ${root}\n`);
         process.stdout.write(`  fingerprint: ${dna.fingerprint}\n`);
         process.stdout.write(`  type: ${dna.projectType}\n`);
         process.stdout.write(`  languages: ${dna.languages.join(", ") || "(none)"}\n`);

package/dist/constants.d.ts

@@ -1,5 +1,5 @@
 import type { AgentId } from "./types/index.js";
-export declare const PACKAGE_VERSION = "3.0.1";
+export declare const PACKAGE_VERSION = "3.0.2";
 export declare const DEFAULT_MAX_FILE_SIZE_BYTES: number;
 /** Directories skipped during normal discovery (unless a rule needs them later). */
 export declare const DEFAULT_IGNORE_DIRECTORIES: Set<string>;

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const PACKAGE_VERSION = "3.0.1";
+export const PACKAGE_VERSION = "3.0.2";
 export const DEFAULT_MAX_FILE_SIZE_BYTES = 2 * 1024 * 1024; // 2 MiB
 /** Directories skipped during normal discovery (unless a rule needs them later). */
 export const DEFAULT_IGNORE_DIRECTORIES = new Set([

package/dist/dashboard/server.js

@@ -20,7 +20,6 @@ import { listKnowledge } from "../knowledge/store.js";
 import { CONTRACTS_VERSION } from "../contracts/index.js";
 import { collectOpsHealth } from "../ops/health.js";
 import { listPolicyPacks } from "../policy/packs.js";
-import { sanitizeForOutput } from "../utils/path.js";
 import { createModelProvider, loadAiConfig } from "../ai/index.js";
 import { ChatService } from "../agent/chat/service.js";
 import { formatChatResponseForCli } from "../agent/chat/response.js";
@@ -43,11 +42,15 @@ import { analyzeFeatureIntelligence } from "../product/features/intelligence.js"
 import { buildSoftwareEvolutionTimeline } from "../product/evolution/timeline.js";
 import { queryMemory } from "../product/memory/institutional.js";
 import { loadDecisionLedger } from "../product/decisions/ledger.js";
+import { ProjectOwnershipError } from "../project/ownership.js";
+import { PathEscapeError } from "../security/paths.js";
 import { htmlPage } from "./page.js";
-function safeJsonError(error) {
-    const raw = error instanceof Error ? error.message : String(error);
-    const { text } = redactSecrets(sanitizeForOutput(raw));
-    return text.slice(0, 240);
+/** HTTP-safe client error — never returns Error.message/stack (CodeQL js/stack-trace-exposure). */
+function clientErrorMessage(error) {
+    if (error instanceof ProjectOwnershipError || error instanceof PathEscapeError) {
+        return "path outside project ownership";
+    }
+    return "internal error";
 }
 function pathnameLooksHostile(pathname) {
     const lower = pathname.toLowerCase();
@@ -386,11 +389,9 @@ export async function startDashboardServer(options) {
                     sendJson(res, 200, await analyzeWhatIf(root, target));
                 }
                 catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    const ownershipDenied = /ownership|escapes|path escape|PROJECT_OWNERSHIP/i.test(message) ||
-                        (error instanceof Error && error.name === "ProjectOwnershipError");
+                    const ownershipDenied = error instanceof ProjectOwnershipError || error instanceof PathEscapeError;
                     sendJson(res, ownershipDenied ? 400 : 500, {
-                        error: ownershipDenied ? "path outside project ownership" : message,
+                        error: ownershipDenied ? "path outside project ownership" : "what-if analysis failed",
                     });
                 }
                 return;
@@ -439,7 +440,7 @@ export async function startDashboardServer(options) {
             sendJson(res, 404, { error: "not found" });
         }
         catch (error) {
-            sendJson(res, 500, { error: safeJsonError(error) });
+            sendJson(res, 500, { error: clientErrorMessage(error) });
         }
     });
     await new Promise((resolve, reject) => {

package/dist/product/discovery/roots.js

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { DEFAULT_IGNORE_DIRECTORIES } from "../../constants.js";
+import { detectProject } from "../../detectors/project.js";
 import { isDirectory, pathExists } from "../../utils/fs.js";
 import { resolveRepoRoot } from "../../utils/path.js";
 /** Markers that strongly suggest a software project root. */
@@ -19,6 +20,8 @@ const PROJECT_MARKERS = [
     "pubspec.yaml",
     ".git",
 ];
+/** Directory basenames that must never be treated as a project root candidate. */
+const FORBIDDEN_ROOT_BASENAMES = new Set([".private", "agentdoctoros"]);
 const SUSPICIOUS_DIR_NAMES = new Set([
     "desktop",
     "downloads",
@@ -32,9 +35,19 @@ const SUSPICIOUS_DIR_NAMES = new Set([
 function normalizeHome(home) {
     return path.resolve(home);
 }
+function pathsEqual(a, b) {
+    const left = path.resolve(a);
+    const right = path.resolve(b);
+    return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
 function isUnderHomeSubtree(abs, home, leaf) {
     const target = path.resolve(home, leaf);
     const resolved = path.resolve(abs);
+    if (process.platform === "win32") {
+        const t = target.toLowerCase();
+        const r = resolved.toLowerCase();
+        return r === t || r.startsWith(t + "\\");
+    }
     return resolved === target || resolved.startsWith(target + path.sep);
 }
 async function countEntriesShallow(dir, budget) {
@@ -92,7 +105,7 @@ export function classifyBroadUserScanRoot(cwdInput, homeInput) {
     const cwd = path.resolve(cwdInput);
     const home = normalizeHome(homeInput ?? os.homedir());
     const baselower = path.basename(cwd).toLowerCase();
-    if (cwd === home ||
+    if (pathsEqual(cwd, home) ||
         SUSPICIOUS_DIR_NAMES.has(baselower) ||
         isUnderHomeSubtree(cwd, home, "Desktop") ||
         isUnderHomeSubtree(cwd, home, "Downloads") ||
@@ -113,12 +126,11 @@ export async function discoverProjectRoots(options = {}) {
     const home = normalizeHome(os.homedir());
     const maxEntries = options.maxEntries ?? 25_000;
     const limitations = [
-        "Discovery uses shallow marker probes and bounded entry counts — not a full repository index.",
-        "Candidates are VERIFIED only when marker files/directories exist on disk.",
+        "Discovery uses shallow marker probes, bounded entry counts, and detectProject for cwd/prefer when classic markers are absent.",
+        "Candidates are VERIFIED only when marker files exist or detectProject finds languages/source under that root.",
     ];
     const broad = classifyBroadUserScanRoot(cwd, home);
     if (broad.blocked) {
-        const estimatedEntries = await countEntriesShallow(cwd, Math.min(maxEntries, 5_000));
         return {
             cwd,
             home,
@@ -126,7 +138,8 @@ export async function discoverProjectRoots(options = {}) {
             selected: null,
             blocked: true,
             blockReason: broad.reason,
-            estimatedEntries,
+            // Do not walk the tree — counting home/Desktop can hang CI (esp. Windows).
+            estimatedEntries: 0,
             limitations,
         };
     }
@@ -145,13 +158,19 @@ export async function discoverProjectRoots(options = {}) {
     }
     const candidates = [];
     const seen = new Set();
+    function rejectForbiddenRoot(resolved) {
+        const base = path.basename(resolved).toLowerCase();
+        return FORBIDDEN_ROOT_BASENAMES.has(base);
+    }
     async function consider(dir, reason) {
         const resolved = path.resolve(dir);
         if (seen.has(resolved))
             return;
         if (!(await isDirectory(resolved)))
             return;
-        if (resolved === home)
+        if (pathsEqual(resolved, home))
+            return;
+        if (rejectForbiddenRoot(resolved))
             return;
         const markers = await markersAt(resolved);
         if (markers.length === 0)
@@ -165,6 +184,46 @@ export async function discoverProjectRoots(options = {}) {
             reason,
         });
     }
+    /**
+     * When classic manifests/.git are absent, reuse the same detectProject path as DNA
+     * so `start` agrees with `dna` for valid software trees (e.g. language-only roots).
+     * Only applied to prefer/cwd — never to unbounded parent/child walks.
+     */
+    async function considerDetectProject(dir, reason) {
+        const resolved = path.resolve(dir);
+        if (seen.has(resolved))
+            return;
+        if (!(await isDirectory(resolved)))
+            return;
+        if (pathsEqual(resolved, home))
+            return;
+        if (rejectForbiddenRoot(resolved))
+            return;
+        if (classifyBroadUserScanRoot(resolved, home).blocked)
+            return;
+        let detection;
+        try {
+            detection = await detectProject(resolved);
+        }
+        catch {
+            return;
+        }
+        // detectProject returns ["unknown"] for empty trees — that is not a project signal.
+        const languages = detection.repository.languages.filter((l) => l !== "unknown");
+        const sourceFiles = detection.discovery.files.filter((f) => /\.(ts|tsx|js|jsx|mjs|cjs|py|php|go|rs|java|kt|kts|dart|rb|cs)$/i.test(f.relativePath)).length;
+        if (languages.length === 0 && sourceFiles === 0)
+            return;
+        seen.add(resolved);
+        const markers = languages.length > 0 ? languages.map((l) => `lang:${l}`) : [`source-files:${sourceFiles}`];
+        candidates.push({
+            root: resolved,
+            // Match strong marker score so a lone detectProject hit auto-selects like package.json.
+            score: languages.length > 0 ? 5 : 3,
+            markers,
+            truth: "VERIFIED",
+            reason,
+        });
+    }
     if (options.prefer) {
         await consider(options.prefer, "explicit prefer path");
     }
@@ -172,7 +231,7 @@ export async function discoverProjectRoots(options = {}) {
     // Walk up a few parents looking for markers (bounded).
     let parent = path.dirname(cwd);
     for (let i = 0; i < 4; i++) {
-        if (parent === home || parent === path.dirname(parent))
+        if (pathsEqual(parent, home) || parent === path.dirname(parent))
             break;
         await consider(parent, "parent directory with project markers");
         parent = path.dirname(parent);
@@ -185,16 +244,63 @@ export async function discoverProjectRoots(options = {}) {
                 continue;
             if (DEFAULT_IGNORE_DIRECTORIES.has(entry.name) || entry.name.startsWith("."))
                 continue;
+            if (FORBIDDEN_ROOT_BASENAMES.has(entry.name.toLowerCase()))
+                continue;
             await consider(path.join(cwd, entry.name), "child directory with project markers");
         }
     }
     catch {
         limitations.push("Could not list child directories for candidate discovery.");
     }
+    // detectProject fallback (same engine as DNA) for prefer/cwd when no classic markers
+    // apply to that path AND no ancestor marker candidate already covers it (nested Case B).
+    // Also skip when child classic-marker projects already exist — otherwise detectProject
+    // would absorb sibling packages into a multi-project parent (start always passes prefer=cwd).
+    const preferAbs = options.prefer ? path.resolve(options.prefer) : null;
+    function ancestorMarkerCovers(target) {
+        return candidates.find((c) => {
+            if (pathsEqual(c.root, target))
+                return true;
+            const rootWithSep = c.root.endsWith(path.sep) ? c.root : c.root + path.sep;
+            if (process.platform === "win32") {
+                return target.toLowerCase().startsWith(rootWithSep.toLowerCase());
+            }
+            return target.startsWith(rootWithSep);
+        });
+    }
+    function descendantMarkerCandidates(target) {
+        const targetWithSep = target.endsWith(path.sep) ? target : target + path.sep;
+        return candidates.filter((c) => {
+            if (pathsEqual(c.root, target))
+                return false;
+            if (process.platform === "win32") {
+                return c.root.toLowerCase().startsWith(targetWithSep.toLowerCase());
+            }
+            return c.root.startsWith(targetWithSep);
+        });
+    }
+    if (preferAbs) {
+        // Skip detectProject absorption when 2+ classic child projects exist (multi-project
+        // parent). A single nested foreign repo must not block prefer's own language tree.
+        if (!ancestorMarkerCovers(preferAbs) && descendantMarkerCandidates(preferAbs).length < 2) {
+            await considerDetectProject(preferAbs, "explicit prefer path (detectProject)");
+        }
+    }
+    else if (candidates.length === 0) {
+        await considerDetectProject(cwd, "current working directory (detectProject)");
+    }
     candidates.sort((a, b) => b.score - a.score || a.root.localeCompare(b.root));
     let selected = null;
-    if (options.prefer) {
-        selected = candidates.find((c) => c.root === path.resolve(options.prefer)) ?? null;
+    if (preferAbs) {
+        const exact = candidates.find((c) => pathsEqual(c.root, preferAbs));
+        const covered = ancestorMarkerCovers(preferAbs);
+        // Nested dir under a marker project → select the marker root, not the nested leaf.
+        if (covered && !pathsEqual(covered.root, preferAbs)) {
+            selected = covered;
+        }
+        else {
+            selected = exact ?? covered ?? null;
+        }
     }
     else if (options.autoSelect !== false) {
         const strong = candidates.filter((c) => c.score >= 5);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@praneeth_54/agentdoctor",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "Engineering assurance for AI coding agents — repository intelligence, change evidence, safety controls, and MCP tools.",
   "type": "module",
   "bin": {