feat(tui): project node describes the target; root node owns the manifest

- The PROJECT node's details pane now describes the scan target only:
  the target info plus a Manifests section listing everything found
  inside it (root manifests with their module nodes nested, subprojects
  with theirs). The root manifest's Manifest/Detector/Dependencies
  sections no longer leak onto the project node.
- The merged project's ROOT component row owns the root manifest: its
  details pane carries the component sections, the full manifest and
  detector metadata, and a Modules section listing the module nodes
  branching out of it.
- Dropped the inaccurate "Press Enter to view components for this
  manifest." hint from manifest details (tree nodes expand with →).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bomly-guy

internal/tui/scan.go

@@ -521,10 +521,6 @@ func (m *ScanModel) buildManifestListModel() *listModel {
 	rootManifests, groups := m.manifestTreeGroups()
 	projectMerged := len(rootManifests) == 1
 	projectDetailLines := projectDetails(m, packageCount(m.graphValue), packageCount(m.graphValue))
-	if projectMerged {
-		projectDetailLines = append(projectDetailLines, "")
-		projectDetailLines = append(projectDetailLines, manifestDetails(m.graphValue, m.manifests[rootManifests[0]])...)
-	}
 	items = append(items, listItem{
 		title:    m.projectNodeTitle(groups),
 		subtitle: "project",
@@ -656,10 +652,6 @@ func (m *ScanModel) buildComponentsTreeListModel() *listModel {
 	projectKey := "project"
 	projectExpanded := expandedValue(m.componentExpanded, projectKey, true)
 	projectDetailLines := projectDetails(m, filteredComponentCount, totalComponents)
-	if projectMerged {
-		projectDetailLines = append(projectDetailLines, "")
-		projectDetailLines = append(projectDetailLines, manifestDetails(m.graphValue, m.manifests[rootManifests[0]])...)
-	}
 	items = append(items, listItem{
 		title:    m.projectNodeTitle(groups),
 		subtitle: "project",
@@ -792,7 +784,7 @@ func (m *ScanModel) buildComponentsTreeListModel() *listModel {
 			title:    row.displayName,
 			subtitle: row.relationship,
 			badges:   badges,
-			details:  componentDetails(m.graphValue, m.registry, row, manifest),
+			details:  m.rootNodeDetails(row, manifest, attached),
 			key:      row.id,
 			tree:     treeLevelPrefix(ancestorsLast) + treeConnector(last),
 			depth:    depth,
@@ -989,7 +981,7 @@ func (m *ScanModel) projectNodeTitle(groups []*manifestTreeGroup) string {
 }
 
 func projectDetails(m *ScanModel, filteredComponents, totalComponents int) []string {
-	return []string{
+	lines := []string{
 		render.Style("Project", render.Bold, render.Cyan),
 		"",
 		render.Style("  Name: ", render.Dim) + valueOrDash(m.project.Name),
@@ -998,6 +990,54 @@ func projectDetails(m *ScanModel, filteredComponents, totalComponents int) []str
 		render.Style("  Manifests: ", render.Dim) + fmt.Sprintf("%d", len(m.manifests)),
 		render.Style("  Components: ", render.Dim) + fmt.Sprintf("%d of %d", filteredComponents, totalComponents),
 	}
+	if contents := m.projectContentsLines(); len(contents) > 0 {
+		lines = append(lines, "", render.Style("Manifests", render.Bold, render.Cyan))
+		lines = append(lines, contents...)
+	}
+	return lines
+}
+
+// projectContentsLines lists what the scan found inside the target: its
+// manifests with the module and subproject nodes nested beneath the manifest
+// that resolves them.
+func (m *ScanModel) projectContentsLines() []string {
+	rootManifests, groups := m.manifestTreeGroups()
+	var lines []string
+	groupLine := func(group *manifestTreeGroup, indent string) string {
+		name := group.label
+		suffix := ""
+		if len(group.manifests) > 0 {
+			manifest := m.manifests[group.manifests[0]]
+			if rootName := m.manifestRootName(manifest); rootName != "" && rootName != manifest.displayName {
+				name = rootName
+			}
+			suffix = " [" + manifest.id + "]"
+		}
+		return render.Style(indent, render.Dim) + name + render.Style(" ("+string(group.kind)+")"+suffix, render.Dim)
+	}
+	attachedByManifest := map[int][]*manifestTreeGroup{}
+	var unattached []*manifestTreeGroup
+	for _, group := range groups {
+		if group.kind == output.ManifestNodeModule && group.attachedTo >= 0 {
+			attachedByManifest[group.attachedTo] = append(attachedByManifest[group.attachedTo], group)
+			continue
+		}
+		unattached = append(unattached, group)
+	}
+	for _, index := range rootManifests {
+		manifest := m.manifests[index]
+		lines = append(lines, render.Style("  ", render.Dim)+manifest.id+render.Style(" ("+valueOrDash(manifest.packageManagers)+")", render.Dim))
+		for _, group := range attachedByManifest[index] {
+			lines = append(lines, groupLine(group, "    "))
+		}
+	}
+	for _, group := range unattached {
+		lines = append(lines, groupLine(group, "  "))
+		for _, child := range group.children {
+			lines = append(lines, groupLine(child, "    "))
+		}
+	}
+	return lines
 }
 
 func packageCount(graphValue *sdk.Graph) int {
@@ -2715,9 +2755,6 @@ func manifestDetails(graphValue *sdk.Graph, row listPackageRow) []string {
 		render.Style("  Root (project package): ", render.Dim) + packageDisplayName(rootPkg),
 		render.Style("  Direct dependencies: ", render.Dim) + fmt.Sprintf("%d", len(groups.direct)),
 		render.Style("  Transitive dependencies: ", render.Dim) + fmt.Sprintf("%d", len(groups.transitive)),
-		"",
-		render.Style("Press Enter to view components for this manifest.", render.Dim),
-		"",
 	}
 	return lines
 }

internal/tui/scan_hierarchy.go

@@ -253,6 +253,31 @@ func (m *ScanModel) mergedGroupDetails(group *manifestTreeGroup, manifest listPa
 	return append(lines, manifestDetails(m.graphValue, manifest)...)
 }
 
+// rootNodeDetails renders the details pane for the merged project's ROOT
+// component row: the root component itself, the root manifest it stands on,
+// and the module nodes branching out of it.
+func (m *ScanModel) rootNodeDetails(row listPackageRow, manifest listPackageRow, attached []*manifestTreeGroup) []string {
+	lines := componentDetails(m.graphValue, m.registry, row, manifest)
+	lines = append(lines, "")
+	lines = append(lines, manifestDetails(m.graphValue, manifest)...)
+	if len(attached) > 0 {
+		lines = append(lines, "", render.Style("Modules", render.Bold, render.Cyan))
+		for _, group := range attached {
+			name := group.label
+			suffix := ""
+			if len(group.manifests) > 0 {
+				moduleManifest := m.manifests[group.manifests[0]]
+				if rootName := m.manifestRootName(moduleManifest); rootName != "" && rootName != moduleManifest.displayName {
+					name = rootName
+				}
+				suffix = " [" + moduleManifest.id + "]"
+			}
+			lines = append(lines, render.Style("  ", render.Dim)+name+render.Style(suffix, render.Dim))
+		}
+	}
+	return lines
+}
+
 func sortedKeyList(values map[string]struct{}) string {
 	keys := make([]string, 0, len(values))
 	for key := range values {

internal/tui/tui_test.go

@@ -751,12 +751,27 @@ func TestScanInteractiveModel_ManifestDetailsIncludeDetectorMetadata(t *testing.
 	model := NewScan(output.ProjectDescriptor{Name: "demo-app", Path: "/tmp/demo-app"}, consolidated, graphValue, nil)
 	model.SelectView(2)
 
-	// The single root manifest is merged into the project node, so the
-	// project details pane carries the manifest and detector metadata.
+	// The project node describes the scan target and lists its manifests;
+	// manifest and detector metadata belong to the ROOT component's details.
 	plain := render.StripANSI(model.View(110, 40))
+	for _, want := range []string{"Manifests", "package-lock.json (npm)"} {
+		if !strings.Contains(plain, want) {
+			t.Fatalf("expected project details to list manifests, got:\n%s", want+"\n"+plain)
+		}
+	}
+	if strings.Contains(plain, "Planned chain:") {
+		t.Fatalf("project details must not carry detector metadata, got:\n%s", plain)
+	}
+
+	// Selecting the ROOT component row surfaces the manifest + detector
+	// sections.
+	wrapper := &teaModel{inner: model, width: 130, height: 60}
+	updated, _ := wrapper.Update(tea.KeyMsg{Type: tea.KeyDown})
+	wrapper = updated.(*teaModel)
+	plain = render.StripANSI(wrapper.View())
 	for _, want := range []string{"Detector", "Name: npm-detector", "Package managers: npm", "Planned chain: npm-detector, syft-detector"} {
 		if !strings.Contains(plain, want) {
-			t.Fatalf("expected manifest details to contain %q, got:\n%s", want, plain)
+			t.Fatalf("expected root component details to contain %q, got:\n%s", want, plain)
 		}
 	}
 }
@@ -1910,7 +1925,9 @@ func TestScanInteractiveModel_ModulesBranchFromParentRoot(t *testing.T) {
 	model.componentExpanded[model.manifests[0].rootID] = false
 	model.Rebuild()
 	plain = render.StripANSI(model.View(190, 40))
-	if strings.Contains(plain, "core (") {
+	// The module tree node ("core (maven, ...)") disappears; the project
+	// details pane still lists the module as content.
+	if strings.Contains(plain, "core (maven") {
 		t.Fatalf("expected collapsed parent root to hide module nodes, got:\n%s", plain)
 	}
 }