bandit-cli 1.0.1 → 1.0.4

package/README.md

@@ -1,4 +1,5 @@
-# Bandit CLI 🤠
+# Bandit CLI
+
 > **The Swiss Army Knife for Backend Developers**
 
 `bandit` is an interactive, high-utility terminal workspace helper built for backend developers. Instead of relying on heavy GUI clients or complex shell scripts, `bandit` lets you test APIs, benchmark endpoints, terminate locked ports, validate environment setups, and audit server health directly from your command line.
@@ -7,23 +8,26 @@
 
 ## 🚀 Key Features
 
-* **Interactive API Client**: Auto-scans your codebase (Express, Fastify, Hono, NestJS) to find route definitions, maps parameters, takes JSON payloads, prompts for Bearer Auth tokens, and displays pretty-printed HTTP responses.
-* **High-Speed Load Benchmarker**: Benchmark any local or remote HTTP endpoint with configurable concurrency, calculating throughput (RPS), p50-p99 percentiles, and rendering a beautiful ASCII distribution chart.
-* **Port Inspector & Process Killer**: Scans active ports, identifies the PID and process names (e.g. `node.exe`, `postgres.exe`, `ollama.exe`), and lets you terminate locked processes in one click.
-* **Live Server Doctor**: Probes your running server for security headers, CORS wildcards, stack trace/error leakage, and payload crash handling.
-* **Environment Variable Auditor**: Compares active `.env` files against `.env.example` to flag missing keys, empty values, and placeholder defaults before you boot.
-* **Static Project Auditor**: Evaluates package setup, file organization, safety configs, and dependency scopes.
+- **Interactive API Client**: Auto-scans your codebase (Express, Fastify, Hono, NestJS) to find route definitions, maps parameters, takes JSON payloads, prompts for Bearer Auth tokens, and displays pretty-printed HTTP responses.
+- **High-Speed Load Benchmarker**: Benchmark any local or remote HTTP endpoint with configurable concurrency, calculating throughput (RPS), p50-p99 percentiles, and rendering a beautiful ASCII distribution chart.
+- **Port Inspector & Process Killer**: Scans active ports, identifies the PID and process names (e.g. `node.exe`, `postgres.exe`, `ollama.exe`), and lets you terminate locked processes in one click.
+- **Live Server Doctor**: Probes your running server for security headers, CORS wildcards, stack trace/error leakage, and payload crash handling.
+- **Environment Variable Auditor**: Compares active `.env` files against `.env.example` to flag missing keys, empty values, and placeholder defaults before you boot.
+- **Static Project Auditor**: Evaluates package setup, file organization, safety configs, and dependency scopes.
+- **Monorepo & Microservices Auto-Discovery**: Automatically scans your workspace for nested packages containing `package.json` and interactively prompts you to target specific services.
 
 ---
 
 ## 📦 Installation
 
 Install globally via npm:
+
 ```bash
 npm install -g bandit-cli
 ```
 
 Or run instantly using `npx`:
+
 ```bash
 npx bandit-cli <command>
 ```
@@ -33,37 +37,56 @@ npx bandit-cli <command>
 ## 🛠️ Usage & Commands
 
 ### 1. Interactive API Playfield
-Find and test routes in your codebase:
+
+Find and test routes in your codebase interactively:
+
 ```bash
 bandit api
 ```
 
+Or execute a direct API request immediately (acts like a local curl/HTTPie):
+
+```bash
+bandit api GET /api/v1/products --url http://localhost:8080 --token "jwt-token"
+bandit api POST /api/v1/users --body '{"name":"Raj"}'
+```
+
 ### 2. Endpoint Benchmarking
+
 Run a concurrent load test on an endpoint:
+
 ```bash
 bandit bench http://localhost:3000/api/users --connections 10 --requests 200
 ```
 
 ### 3. Ports Inspector
+
 List processes listening on local ports and terminate them:
+
 ```bash
 bandit ports
 ```
 
 ### 4. Active Server Diagnostics
+
 Audit a running server's security headers and vulnerabilities:
+
 ```bash
 bandit doctor http://localhost:3000
 ```
 
 ### 5. Environment variable check
+
 Validate local environment configurations:
+
 ```bash
 bandit env
 ```
 
 ### 6. Static Project Audit
+
 Audit files, directory structure, and dependencies:
+
 ```bash
 bandit audit
 ```
@@ -71,4 +94,5 @@ bandit audit
 ---
 
 ## 🎨 Under the Hood
+
 Built with TypeScript, [Commander](https://github.com/tj/commander.js), and [@clack/prompts](https://github.com/natemoo-re/clack) for a modern, fluid interactive terminal interface.

package/dist/cli/api.js

@@ -3,26 +3,284 @@ import path from "node:path";
 import fg from "fast-glob";
 import * as clack from "@clack/prompts";
 import chalk from "chalk";
-// Scans files for common route definitions
-async function scanForRoutes(projectPath) {
+function normalizePath(filePath) {
+    let normalized = filePath.replace(/\\/g, "/");
+    const winDriveRegex = /^([A-Z]):\//;
+    const match = normalized.match(winDriveRegex);
+    if (match) {
+        normalized = normalized.replace(winDriveRegex, `${match[1].toLowerCase()}:/`);
+    }
+    return normalized;
+}
+function resolveImport(sourceFile, importPath, projectPath) {
+    let absolutePath = "";
+    if (importPath.startsWith("@/") || importPath.startsWith("~/")) {
+        const relativePart = importPath.slice(2);
+        absolutePath = path.resolve(projectPath, "src", relativePart);
+    }
+    else if (importPath.startsWith("src/")) {
+        absolutePath = path.resolve(projectPath, importPath);
+    }
+    else if (importPath.startsWith(".")) {
+        const sourceDir = path.dirname(sourceFile);
+        absolutePath = path.resolve(sourceDir, importPath);
+    }
+    else {
+        return null;
+    }
+    const extensions = [".ts", ".js", ".tsx", ".jsx"];
+    for (const ext of extensions) {
+        const fileWithExt = absolutePath + ext;
+        if (fs.existsSync(fileWithExt)) {
+            return normalizePath(fileWithExt);
+        }
+    }
+    if (fs.existsSync(absolutePath) && fs.statSync(absolutePath).isDirectory()) {
+        for (const ext of extensions) {
+            const indexFile = path.join(absolutePath, "index" + ext);
+            if (fs.existsSync(indexFile)) {
+                return normalizePath(indexFile);
+            }
+            const routerFile = path.join(absolutePath, "router" + ext);
+            if (fs.existsSync(routerFile)) {
+                return normalizePath(routerFile);
+            }
+        }
+    }
+    return null;
+}
+function parseImportNames(importClause) {
+    const names = [];
+    importClause = importClause.trim();
+    const nsMatch = importClause.match(/\*\s+as\s+([a-zA-Z0-9_$]+)/);
+    if (nsMatch) {
+        names.push({ localName: nsMatch[1] });
+        return names;
+    }
+    const destructureMatch = importClause.match(/\{([\s\S]*?)\}/);
+    if (destructureMatch) {
+        const content = destructureMatch[1];
+        const parts = content.split(",");
+        for (const part of parts) {
+            const trimmed = part.trim();
+            if (!trimmed)
+                continue;
+            const aliasMatch = trimmed.match(/([a-zA-Z0-9_$]+)\s+as\s+([a-zA-Z0-9_$]+)/);
+            if (aliasMatch) {
+                names.push({ localName: aliasMatch[2] });
+            }
+            else {
+                const nameMatch = trimmed.match(/^([a-zA-Z0-9_$]+)$/);
+                if (nameMatch) {
+                    names.push({ localName: nameMatch[1] });
+                }
+            }
+        }
+        const beforeDestruct = importClause.split("{")[0].trim().replace(/,$/, "").trim();
+        if (beforeDestruct && !beforeDestruct.startsWith("import")) {
+            names.push({ localName: beforeDestruct });
+        }
+        return names;
+    }
+    if (importClause && !importClause.includes("{") && !importClause.includes("*")) {
+        names.push({ localName: importClause });
+    }
+    return names;
+}
+function resolvePaths(pref, p) {
+    let combined = `${pref}/${p}`.replace(/\/+/g, "/");
+    if (!combined.startsWith("/"))
+        combined = "/" + combined;
+    if (combined.length > 1 && combined.endsWith("/")) {
+        combined = combined.slice(0, -1);
+    }
+    return combined;
+}
+// Scans files for common route definitions and mounts
+export async function scanForRoutes(projectPath) {
+    projectPath = normalizePath(projectPath);
     const routes = [];
-    const files = await fg(["src/**/*.{ts,js}", "*.{ts,js}", "routes/**/*.{ts,js}", "controllers/**/*.{ts,js}"], {
+    const files = (await fg(["src/**/*.{ts,js}", "*.{ts,js}", "routes/**/*.{ts,js}", "controllers/**/*.{ts,js}"], {
         cwd: projectPath,
         absolute: true,
         ignore: ["**/node_modules/**", "**/dist/**", "**/*.test.{ts,js}", "**/*.spec.{ts,js}"],
-    });
-    // Regex patterns
-    // 1. Express/Fastify/Hono: router.get('/path', ...) or app.post('/path', ...)
-    const expressPattern = /\b(app|router|route|fastify|hono|api)\.(get|post|put|delete|patch|options|head)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
-    // 2. NestJS decorators: @Get('/path') or @Post('/path')
+    })).map(normalizePath);
+    const importsByFile = new Map();
+    // Step 1: Scan imports & requires for all files
+    for (const file of files) {
+        const localToTarget = new Map();
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            const esImportRegex = /import\s+([\s\S]*?)\s+from\s+['"`]([^'"`]+)['"`]/g;
+            let match;
+            while ((match = esImportRegex.exec(content)) !== null) {
+                const importClause = match[1];
+                const importPath = match[2];
+                const targetFile = resolveImport(file, importPath, projectPath);
+                if (targetFile) {
+                    const names = parseImportNames(importClause);
+                    for (const name of names) {
+                        localToTarget.set(name.localName, targetFile);
+                    }
+                }
+            }
+            const requireRegex = /(?:const|let|var)\s+([\s\S]*?)\s*=\s*require\s*\(\s*['"`]([^'"`]+)['"`]\s*\)/g;
+            while ((match = requireRegex.exec(content)) !== null) {
+                const varClause = match[1];
+                const importPath = match[2];
+                const targetFile = resolveImport(file, importPath, projectPath);
+                if (targetFile) {
+                    const names = parseImportNames(varClause);
+                    for (const name of names) {
+                        localToTarget.set(name.localName, targetFile);
+                    }
+                }
+            }
+        }
+        catch { }
+        importsByFile.set(file, localToTarget);
+    }
+    // Step 2: Build Dependency Graph Nodes and Edges
+    const nodes = new Map();
+    const edges = [];
+    const ensureNode = (id, type, filePath, varName) => {
+        if (!nodes.has(id)) {
+            nodes.set(id, { id, type, filePath, varName, prefixes: new Set() });
+        }
+    };
+    // Create file nodes
+    for (const file of files) {
+        ensureNode(`file:${file}`, "file", file);
+    }
+    // Pre-populate route variable nodes from route declarations
+    const routeVarPattern = /\b([a-zA-Z0-9_]+)\.(get|post|put|delete|patch|options|head)\s*\(/gi;
+    for (const file of files) {
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            let match;
+            routeVarPattern.lastIndex = 0;
+            while ((match = routeVarPattern.exec(content)) !== null) {
+                const instanceName = match[1];
+                ensureNode(`var:${file}:${instanceName}`, "var", file, instanceName);
+            }
+        }
+        catch { }
+    }
+    const mountPattern = /\b([a-zA-Z0-9_]+)\.(use|route|group)\s*\(\s*(?:['"`]([^'"`]+)['"`]\s*,\s*)?(?:require\s*\(\s*['"`]([^'"`]+)['"`]\s*\)|([a-zA-Z0-9_]+))/gi;
+    for (const file of files) {
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            let match;
+            mountPattern.lastIndex = 0;
+            while ((match = mountPattern.exec(content)) !== null) {
+                const parentVar = match[1];
+                const mountPath = match[3] || "/";
+                const inlineRequire = match[4];
+                const childVar = match[5];
+                const parentId = `var:${file}:${parentVar}`;
+                ensureNode(parentId, "var", file, parentVar);
+                if (inlineRequire) {
+                    const targetFile = resolveImport(file, inlineRequire, projectPath);
+                    if (targetFile) {
+                        const targetFileId = `file:${targetFile}`;
+                        ensureNode(targetFileId, "file", targetFile);
+                        edges.push({ from: parentId, to: targetFileId, path: mountPath });
+                    }
+                }
+                else if (childVar) {
+                    const childId = `var:${file}:${childVar}`;
+                    ensureNode(childId, "var", file, childVar);
+                    edges.push({ from: parentId, to: childId, path: mountPath });
+                    // Check if childVar is imported
+                    const targetFile = importsByFile.get(file)?.get(childVar);
+                    if (targetFile) {
+                        const targetFileId = `file:${targetFile}`;
+                        ensureNode(targetFileId, "file", targetFile);
+                        edges.push({ from: childId, to: targetFileId, path: "/" });
+                    }
+                }
+            }
+        }
+        catch { }
+    }
+    // Step 3: Link file nodes to their root variables within that file
+    for (const file of files) {
+        const fileId = `file:${file}`;
+        // Find all variable nodes in this file
+        const varNodesInFile = Array.from(nodes.values()).filter((n) => n.type === "var" && n.filePath === file);
+        for (const vNode of varNodesInFile) {
+            // Is there an incoming edge to this variable from another variable/file in the same file?
+            const hasIncomingLocal = edges.some((e) => e.to === vNode.id && e.from.startsWith(`var:${file}:`));
+            if (!hasIncomingLocal) {
+                // It is a root variable in this file, link the file node to it
+                edges.push({ from: fileId, to: vNode.id, path: "/" });
+            }
+        }
+    }
+    // Step 4: Identify entry points and initialize their prefixes
+    // Entry points are file nodes that have no incoming edges from OTHER files
+    const fileIncomingFromOthers = new Set();
+    for (const edge of edges) {
+        if (edge.to.startsWith("file:")) {
+            const fromFile = nodes.get(edge.from)?.filePath;
+            const toFile = nodes.get(edge.to)?.filePath;
+            if (fromFile && toFile && fromFile !== toFile) {
+                fileIncomingFromOthers.add(edge.to);
+            }
+        }
+    }
+    for (const file of files) {
+        const fileId = `file:${file}`;
+        if (!fileIncomingFromOthers.has(fileId)) {
+            const fNode = nodes.get(fileId);
+            if (fNode) {
+                fNode.prefixes.add("/");
+            }
+        }
+    }
+    // Step 5: Propagate prefixes using BFS
+    const queue = [];
+    for (const node of nodes.values()) {
+        if (node.prefixes.size > 0) {
+            queue.push(node.id);
+        }
+    }
+    const inQueue = new Set(queue);
+    while (queue.length > 0) {
+        const currId = queue.shift();
+        inQueue.delete(currId);
+        const currNode = nodes.get(currId);
+        if (!currNode)
+            continue;
+        // Find outgoing edges
+        const outgoing = edges.filter((e) => e.from === currId);
+        for (const edge of outgoing) {
+            const targetNode = nodes.get(edge.to);
+            if (!targetNode)
+                continue;
+            let changed = false;
+            for (const pref of currNode.prefixes) {
+                const combined = resolvePaths(pref, edge.path);
+                if (!targetNode.prefixes.has(combined)) {
+                    targetNode.prefixes.add(combined);
+                    changed = true;
+                }
+            }
+            if (changed && !inQueue.has(edge.to)) {
+                queue.push(edge.to);
+                inQueue.add(edge.to);
+            }
+        }
+    }
+    // Step 6: Scan files for actual routes and use propagated prefixes
+    const expressPattern = /\b([a-zA-Z0-9_]+)\.(get|post|put|delete|patch|options|head)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
     const nestPattern = /@(Get|Post|Put|Delete|Patch)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
-    // 3. NestJS controllers to prefix: @Controller('/prefix')
     const controllerPattern = /@Controller\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
     for (const file of files) {
         try {
             const content = fs.readFileSync(file, "utf-8");
             const relativePath = path.relative(projectPath, file);
-            // Check NestJS Controller prefix if any
+            // NestJS controller prefix
             let controllerPrefix = "";
             const cMatch = [...content.matchAll(controllerPattern)];
             if (cMatch.length > 0) {
@@ -30,20 +288,28 @@ async function scanForRoutes(projectPath) {
                 if (controllerPrefix === "/")
                     controllerPrefix = "";
             }
-            // 1. Check Express-style matches
+            // 1. Express-style
             let match;
             expressPattern.lastIndex = 0;
             while ((match = expressPattern.exec(content)) !== null) {
+                const instanceName = match[1];
                 const method = match[2].toUpperCase();
-                let rPath = match[3];
-                // Sanitize path variable names if necessary
-                routes.push({
-                    method,
-                    routePath: rPath,
-                    sourceFile: relativePath,
-                });
+                const subPath = match[3];
+                const varNodeId = `var:${file}:${instanceName}`;
+                const varNode = nodes.get(varNodeId);
+                const targetPrefixes = (varNode && varNode.prefixes.size > 0)
+                    ? Array.from(varNode.prefixes)
+                    : ["/"];
+                for (const prefix of targetPrefixes) {
+                    const rPath = resolvePaths(prefix, subPath);
+                    routes.push({
+                        method,
+                        routePath: rPath,
+                        sourceFile: relativePath,
+                    });
+                }
             }
-            // 2. Check NestJS matches
+            // 2. NestJS
             nestPattern.lastIndex = 0;
             while ((match = nestPattern.exec(content)) !== null) {
                 const method = match[1].toUpperCase();
@@ -51,17 +317,16 @@ async function scanForRoutes(projectPath) {
                 if (subPath === "/")
                     subPath = "";
                 const fullPath = `${controllerPrefix.replace(/\/$/, "")}/${subPath.replace(/^\//, "")}`;
-                const sanitizedFullPath = fullPath.startsWith("/") ? fullPath : `/${fullPath}`;
+                let rPath = fullPath.startsWith("/") ? fullPath : `/${fullPath}`;
+                rPath = rPath.replace(/\/+/g, "/");
                 routes.push({
                     method: method === "DELETE" ? "DELETE" : method,
-                    routePath: sanitizedFullPath,
+                    routePath: rPath,
                     sourceFile: relativePath,
                 });
             }
         }
-        catch (err) {
-            // Ignore reading errors
-        }
+        catch { }
     }
     // Deduplicate routes by method + routePath
     const seen = new Set();
@@ -90,9 +355,90 @@ function detectLocalPort(projectPath) {
     catch { }
     return 3000;
 }
-export async function runApiCommand(projectPath = ".") {
+export async function runApiCommand(methodOrPath = ".", routePath, opts = {}) {
+    const httpMethods = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"];
+    const isDirectMode = routePath !== undefined && httpMethods.includes(methodOrPath.toUpperCase());
+    if (isDirectMode) {
+        const finalMethod = methodOrPath.toUpperCase();
+        const finalPath = routePath;
+        // Resolve base URL
+        const absoluteProjectPath = path.resolve(".");
+        const port = detectLocalPort(absoluteProjectPath);
+        let baseUrl = opts.url || `http://localhost:${port}`;
+        baseUrl = baseUrl.replace(/\/$/, "");
+        // Resolve Headers
+        const headers = {
+            Accept: "application/json, text/plain, */*",
+        };
+        if (opts.token) {
+            headers["Authorization"] = `Bearer ${opts.token}`;
+        }
+        if (opts.body) {
+            headers["Content-Type"] = "application/json";
+        }
+        // Parse custom headers -H "Key: Val"
+        if (opts.header) {
+            const hList = Array.isArray(opts.header) ? opts.header : [opts.header];
+            for (const h of hList) {
+                const colonIdx = h.indexOf(":");
+                if (colonIdx !== -1) {
+                    const key = h.slice(0, colonIdx).trim();
+                    const val = h.slice(colonIdx + 1).trim();
+                    headers[key] = val;
+                }
+            }
+        }
+        const finalUrl = `${baseUrl}${finalPath}`;
+        clack.intro(chalk.bold.bgBlue.white(" Bandit Direct API Request "));
+        clack.log.info(`Sending ${chalk.bold.green(finalMethod)} request to ${chalk.cyan(finalUrl)}...`);
+        const s = clack.spinner();
+        s.start("Executing request...");
+        try {
+            const start = performance.now();
+            const res = await fetch(finalUrl, {
+                method: finalMethod,
+                headers,
+                ...(opts.body ? { body: opts.body } : {}),
+            });
+            const end = performance.now();
+            const duration = end - start;
+            s.stop(`Request completed in ${duration.toFixed(1)}ms.`);
+            const contentType = res.headers.get("content-type") || "";
+            const resText = await res.text();
+            console.log("\n" + chalk.bold.cyan("📬 RESPONSE"));
+            console.log(chalk.gray("──────────────────────────────────────────────────"));
+            console.log(`Status:  ${res.status >= 200 && res.status < 300 ? chalk.bold.green(res.status) : chalk.bold.red(res.status)} ${res.statusText}`);
+            console.log(`Time:    ${duration.toFixed(1)} ms`);
+            console.log(chalk.gray("──────────────────────────────────────────────────"));
+            console.log(chalk.bold.cyan("Headers:"));
+            res.headers.forEach((val, key) => {
+                console.log(`  ${chalk.gray(key)}: ${val}`);
+            });
+            console.log(chalk.gray("──────────────────────────────────────────────────"));
+            console.log(chalk.bold.cyan("Body:"));
+            if (contentType.includes("application/json")) {
+                try {
+                    const parsed = JSON.parse(resText);
+                    console.log(chalk.green(JSON.stringify(parsed, null, 2)));
+                }
+                catch {
+                    console.log(resText);
+                }
+            }
+            else {
+                console.log(resText || chalk.italic.gray("<empty body>"));
+            }
+            console.log(chalk.gray("──────────────────────────────────────────────────"));
+        }
+        catch (err) {
+            s.stop("Request failed.");
+            clack.log.error(`Fetch execution error: ${err.message}`);
+        }
+        clack.outro(chalk.bold.green("Direct API call complete."));
+        return;
+    }
     clack.intro(chalk.bold.bgBlue.white(" Bandit Interactive API Client "));
-    const absoluteProjectPath = path.resolve(projectPath);
+    const absoluteProjectPath = path.resolve(methodOrPath);
     const s = clack.spinner();
     s.start("Scanning codebase for API endpoints...");
     const discoveredRoutes = await scanForRoutes(absoluteProjectPath);
@@ -190,10 +536,20 @@ export async function runApiCommand(projectPath = ".") {
     }
     else {
         finalMethod = selectedRoute.method;
-        finalPath = selectedRoute.routePath;
+        // Let the developer confirm and edit the path (highly convenient for prefix additions!)
+        const editPath = await clack.text({
+            message: "Confirm or edit the route path:",
+            defaultValue: selectedRoute.routePath,
+            placeholder: selectedRoute.routePath,
+            validate: (v) => (!v || !v.startsWith("/") ? "Route path must start with a slash '/'" : undefined),
+        });
+        if (clack.isCancel(editPath)) {
+            clack.outro("Execution stopped.");
+            return;
+        }
+        finalPath = editPath;
     }
     // 1. Process Path Parameters if any (e.g. /users/:id or /users/{id})
-    // We look for :name or {name}
     const pathParamPattern = /:([a-zA-Z0-9_]+)|\{([a-zA-Z0-9_]+)\}/g;
     let matches;
     const pathParams = [];
@@ -213,7 +569,6 @@ export async function runApiCommand(projectPath = ".") {
             clack.outro("Execution stopped.");
             return;
         }
-        // Replace :param or {param}
         resolvedPath = resolvedPath
             .replace(`:${param}`, val)
             .replace(`{${param}}`, val);
@@ -242,7 +597,7 @@ export async function runApiCommand(projectPath = ".") {
             queryStr = trimmed.startsWith("?") ? trimmed : `?${trimmed}`;
         }
     }
-    // 3. Process Request Body if POST/PUT/PATCH
+    // 3. Process Request Body if POST/PUT/PATCH (Interactive Key-Value Editor!)
     let requestBody;
     if (["POST", "PUT", "PATCH"].includes(finalMethod)) {
         const enterBody = await clack.confirm({
@@ -254,32 +609,119 @@ export async function runApiCommand(projectPath = ".") {
             return;
         }
         if (enterBody) {
-            const bodyInput = await clack.text({
-                message: "Enter JSON payload:",
-                placeholder: '{"name": "Alice", "email": "alice@gmail.com"}',
-                validate: (v) => {
-                    if (!v || !v.trim())
-                        return undefined;
-                    try {
-                        JSON.parse(v);
-                        return undefined;
-                    }
-                    catch {
-                        return "Invalid JSON syntax. Please enter valid JSON.";
-                    }
-                },
+            const bodyInputType = await clack.select({
+                message: "How would you like to enter the JSON body?",
+                options: [
+                    { value: "kv", label: "Interactive Key-Value builder (Easy/Convenient)" },
+                    { value: "raw", label: "Paste raw JSON string" },
+                ],
             });
-            if (clack.isCancel(bodyInput)) {
+            if (clack.isCancel(bodyInputType)) {
                 clack.outro("Execution stopped.");
                 return;
             }
-            const val = bodyInput.trim();
-            if (val) {
-                requestBody = val;
+            if (bodyInputType === "kv") {
+                const bodyObj = {};
+                let addingFields = true;
+                while (addingFields) {
+                    const fieldKey = await clack.text({
+                        message: "Enter field key:",
+                        placeholder: "e.g. email",
+                    });
+                    if (clack.isCancel(fieldKey) || !fieldKey || !fieldKey.trim())
+                        break;
+                    const fieldVal = await clack.text({
+                        message: `Enter value for '${fieldKey.trim()}':`,
+                        placeholder: "e.g. raj@example.com",
+                    });
+                    if (clack.isCancel(fieldVal))
+                        break;
+                    const trimmedVal = fieldVal.trim();
+                    let parsedVal = trimmedVal;
+                    // Smart casting
+                    if (trimmedVal.toLowerCase() === "true")
+                        parsedVal = true;
+                    else if (trimmedVal.toLowerCase() === "false")
+                        parsedVal = false;
+                    else if (trimmedVal.toLowerCase() === "null")
+                        parsedVal = null;
+                    else if (!isNaN(Number(trimmedVal)) && trimmedVal !== "")
+                        parsedVal = Number(trimmedVal);
+                    bodyObj[fieldKey.trim()] = parsedVal;
+                    const addMore = await clack.confirm({
+                        message: "Add another field to the request body?",
+                        initialValue: false,
+                    });
+                    if (clack.isCancel(addMore) || !addMore) {
+                        addingFields = false;
+                    }
+                }
+                requestBody = JSON.stringify(bodyObj);
+            }
+            else {
+                // Raw JSON input
+                const bodyInput = await clack.text({
+                    message: "Enter JSON payload:",
+                    placeholder: '{"name": "Alice", "email": "alice@gmail.com"}',
+                    validate: (v) => {
+                        if (!v || !v.trim())
+                            return undefined;
+                        try {
+                            JSON.parse(v);
+                            return undefined;
+                        }
+                        catch {
+                            return "Invalid JSON syntax. Please enter valid JSON.";
+                        }
+                    },
+                });
+                if (clack.isCancel(bodyInput)) {
+                    clack.outro("Execution stopped.");
+                    return;
+                }
+                const val = bodyInput.trim();
+                if (val) {
+                    requestBody = val;
+                }
+            }
+        }
+    }
+    // 4. Custom Headers Editor
+    const customHeaders = {};
+    const addHeaders = await clack.confirm({
+        message: "Do you want to add custom request headers?",
+        initialValue: false,
+    });
+    if (clack.isCancel(addHeaders)) {
+        clack.outro("Execution stopped.");
+        return;
+    }
+    if (addHeaders) {
+        let addingHeaders = true;
+        while (addingHeaders) {
+            const headerKey = await clack.text({
+                message: "Enter Header Name:",
+                placeholder: "e.g. X-Custom-Key",
+            });
+            if (clack.isCancel(headerKey) || !headerKey || !headerKey.trim())
+                break;
+            const headerVal = await clack.text({
+                message: `Enter value for '${headerKey.trim()}':`,
+                placeholder: "e.g. test-value",
+            });
+            if (clack.isCancel(headerVal))
+                break;
+            customHeaders[headerKey.trim()] = headerVal.trim();
+            const addMoreHeaders = await clack.confirm({
+                message: "Add another custom header?",
+                initialValue: false,
+            });
+            if (clack.isCancel(addMoreHeaders) || !addMoreHeaders) {
+                addingHeaders = false;
             }
         }
     }
-    // 4. Prompt for Authorization Header (Bearer token)
+    // 5. Prompt for Authorization Header (Bearer token)
     const addAuth = await clack.confirm({
         message: "Do you want to add an Authorization Bearer token?",
         initialValue: false,
@@ -304,6 +746,9 @@ export async function runApiCommand(projectPath = ".") {
     // Confirm and Execute Request
     const finalUrl = `${baseUrl}${resolvedPath}${queryStr}`;
     clack.log.info(`Ready to request: ${chalk.bold.green(finalMethod)} ${chalk.cyan(finalUrl)}`);
+    if (Object.keys(customHeaders).length > 0) {
+        clack.log.info(`Headers:\n${chalk.gray(JSON.stringify(customHeaders, null, 2))}`);
+    }
     if (bearerToken) {
         const preview = bearerToken.length > 12 ? `${bearerToken.slice(0, 8)}...` : bearerToken;
         clack.log.info(`Auth: Bearer ${preview} (masked)`);
@@ -325,6 +770,7 @@ export async function runApiCommand(projectPath = ".") {
         const headers = {
             Accept: "application/json, text/plain, */*",
             ...(requestBody ? { "Content-Type": "application/json" } : {}),
+            ...customHeaders,
         };
         if (bearerToken) {
             headers["Authorization"] = `Bearer ${bearerToken}`;

package/dist/cli/doctor.js

@@ -16,6 +16,26 @@ async function fetchWithTimeout(url, options = {}, timeoutMs = 4000) {
         throw err;
     }
 }
+function findSensitiveKeys(obj) {
+    const sensitiveKeywords = [
+        "password", "hashed_password", "salt", "secret", "ssn",
+        "credit_card", "creditcard", "passwd", "token", "auth_token"
+    ];
+    const found = [];
+    function search(current) {
+        if (!current || typeof current !== "object")
+            return;
+        for (const key of Object.keys(current)) {
+            const lowerKey = key.toLowerCase();
+            if (sensitiveKeywords.includes(lowerKey)) {
+                found.push(key);
+            }
+            search(current[key]);
+        }
+    }
+    search(obj);
+    return found;
+}
 export async function runDoctorCommand(targetUrl = "http://localhost:3000") {
     clack.intro(chalk.bold.bgBlue.white(" Bandit Live Server Doctor "));
     clack.log.info(`Target URL: ${chalk.bold.cyan(targetUrl)}`);
@@ -205,6 +225,155 @@ export async function runDoctorCommand(targetUrl = "http://localhost:3000") {
         }
     }
     s.stop("Oversized payload probe complete.");
+    // 4. Sensitive Data Leak Scanner
+    s.start("Scanning response for sensitive data leakage...");
+    try {
+        const rootText = await rootResponse.text();
+        let rootJson = null;
+        try {
+            rootJson = JSON.parse(rootText);
+        }
+        catch { }
+        if (rootJson) {
+            const leaked = findSensitiveKeys(rootJson);
+            if (leaked.length > 0) {
+                reports.push({
+                    title: "Sensitive Data Leak Check",
+                    status: "fail",
+                    details: `Root JSON response exposed sensitive field(s): [${leaked.join(", ")}]`,
+                    suggestion: "Remove database columns like password/salt/secret from response serializers/DTOs.",
+                });
+            }
+            else {
+                reports.push({
+                    title: "Sensitive Data Leak Check",
+                    status: "pass",
+                    details: "No sensitive fields leaked in root JSON response.",
+                });
+            }
+        }
+        else {
+            reports.push({
+                title: "Sensitive Data Leak Check",
+                status: "pass",
+                details: "Root response did not return JSON (no leaks scanned).",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "Sensitive Data Leak Check",
+            status: "warn",
+            details: `Failed to audit sensitive data leaks: ${err.message}`,
+        });
+    }
+    s.stop("Sensitive data scan complete.");
+    // 5. Active Security Penetration Probes (SQLi, NoSQLi, XSS)
+    s.start("Executing active security penetration probes...");
+    // SQLi Probe
+    try {
+        const sqliUrl = `${targetUrl.replace(/\/$/, "")}/?id=%27%20OR%20%271%27%3D%271`;
+        const sqliRes = await fetchWithTimeout(sqliUrl, {}, 3000);
+        const sqliText = await sqliRes.text();
+        const sqlErrors = [
+            "SQLITE_ERROR",
+            "syntax error near",
+            "PostgreSQL query failed",
+            "mysql server version",
+            "MariaDB server version",
+            "You have an error in your SQL syntax",
+            "pg_query",
+        ];
+        const leakedSqlError = sqlErrors.find(err => sqliText.toLowerCase().includes(err.toLowerCase()));
+        if (leakedSqlError) {
+            reports.push({
+                title: "SQL Injection (SQLi) Vulnerability Probe",
+                status: "fail",
+                details: `Server exposed SQL error token [${leakedSqlError}] when queried with SQL injection payload.`,
+                suggestion: "Use parameterized queries or ORMs (Prisma/Drizzle) and never concatenate raw inputs into SQL.",
+            });
+        }
+        else {
+            reports.push({
+                title: "SQL Injection (SQLi) Vulnerability Probe",
+                status: "pass",
+                details: "No raw SQL exceptions leaked in response to injection payload.",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "SQL Injection (SQLi) Vulnerability Probe",
+            status: "warn",
+            details: `Failed to execute SQLi probe: ${err.message}`,
+        });
+    }
+    // XSS Probe
+    try {
+        const xssPayload = "<script>alert(1)</script>";
+        const xssUrl = `${targetUrl.replace(/\/$/, "")}/?search=${encodeURIComponent(xssPayload)}`;
+        const xssRes = await fetchWithTimeout(xssUrl, {}, 3000);
+        const xssText = await xssRes.text();
+        if (xssRes.ok && xssText.includes(xssPayload)) {
+            reports.push({
+                title: "Cross-Site Scripting (XSS) Vulnerability Probe",
+                status: "fail",
+                details: "Server reflected unescaped HTML script tags in the response body.",
+                suggestion: "Sanitize user inputs and HTML-encode reflected outputs to prevent script execution.",
+            });
+        }
+        else {
+            reports.push({
+                title: "Cross-Site Scripting (XSS) Vulnerability Probe",
+                status: "pass",
+                details: "Input reflected HTML script tags are properly escaped or omitted by the server.",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "Cross-Site Scripting (XSS) Vulnerability Probe",
+            status: "warn",
+            details: `Failed to execute XSS probe: ${err.message}`,
+        });
+    }
+    // NoSQLi Probe
+    try {
+        const nosqliUrl = `${targetUrl.replace(/\/$/, "")}/?username[%24ne]=admin`;
+        const nosqliRes = await fetchWithTimeout(nosqliUrl, {}, 3000);
+        const nosqliText = await nosqliRes.text();
+        const nosqlErrors = [
+            "MongoError",
+            "MongoServerError",
+            "CastError",
+            "ObjectParameterError",
+            "MongooseError",
+        ];
+        const leakedNoSqlError = nosqlErrors.find(err => nosqliText.toLowerCase().includes(err.toLowerCase()));
+        if (leakedNoSqlError) {
+            reports.push({
+                title: "NoSQL Injection Vulnerability Probe",
+                status: "fail",
+                details: `Server exposed NoSQL error token [${leakedNoSqlError}] in response to query parameters.`,
+                suggestion: "Sanitize input parameters and sanitize mongo operator prefixes ($) using tools like 'mongo-sanitize'.",
+            });
+        }
+        else {
+            reports.push({
+                title: "NoSQL Injection Vulnerability Probe",
+                status: "pass",
+                details: "No NoSQL database exceptions leaked in response to query payload.",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "NoSQL Injection Vulnerability Probe",
+            status: "warn",
+            details: `Failed to execute NoSQLi probe: ${err.message}`,
+        });
+    }
+    s.stop("Active penetration probes complete.");
     // Print results
     console.log("\n" + chalk.bold("Diagnostic Results:"));
     for (const report of reports) {

package/dist/cli/output.js

@@ -6,71 +6,54 @@ function icon(status) {
         return chalk.red("✖");
     return chalk.gray("-");
 }
-function sevColor(sev, text) {
-    if (sev === "error")
-        return chalk.red(text);
-    if (sev === "warn")
-        return chalk.yellow(text);
-    return chalk.blue(text);
-}
-function sevLabel(sev) {
-    if (sev === "error")
-        return "ERROR";
-    if (sev === "warn")
-        return "WARN";
-    return "INFO";
-}
 function printSeparator() {
-    console.log(chalk.gray("─".repeat(80)));
+    console.log(chalk.gray("  " + "─".repeat(70)));
 }
 function printItem(item) {
     const statusIcon = icon(item.status);
-    const line = `${statusIcon} ${chalk.bold(item.title)}`;
-    console.log(line);
-    // Show details for pass/fail/skip
+    let titleText = chalk.bold(item.title);
+    if (item.status === "fail") {
+        if (item.severity === "error")
+            titleText += chalk.red.bold(" (ERROR)");
+        else if (item.severity === "warn")
+            titleText += chalk.yellow.bold(" (WARN)");
+        else
+            titleText += chalk.blue.bold(" (INFO)");
+    }
+    console.log(`  ${statusIcon}  ${titleText}`);
+    // Show details
     if (item.details) {
-        console.log(chalk.gray(`  ↳ ${item.details}`));
+        console.log(chalk.gray(`     ↳ ${item.details}`));
     }
     // Show suggestion only for failures
     if (item.status === "fail" && item.suggestion) {
-        console.log(chalk.gray(`  ↳ Suggestion: ${item.suggestion}`));
-    }
-}
-function printSection(title, items, color) {
-    if (items.length === 0)
-        return;
-    console.log("");
-    console.log(color(chalk.bold(`● ${title}`)));
-    printSeparator();
-    for (const item of items) {
-        printItem(item);
+        console.log(chalk.cyan(`     ↳ Suggestion: ${item.suggestion}`));
     }
 }
 export function printHuman(report) {
-    // Header
+    // Header Box
     console.log("");
-    console.log(chalk.bold.blue(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`));
-    console.log(chalk.bold.white(`                           Backend Audit Report`));
-    console.log(chalk.bold.blue(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`));
-    console.log(chalk.gray(`Project: ${report.projectPath}`));
-    console.log(chalk.gray(`Summary: ${chalk.green(`pass=${report.summary.pass}`)} ${chalk.red(`fail=${report.summary.fail}`)} ${chalk.gray(`skip=${report.summary.skip}`)}`));
+    console.log(chalk.cyan(`  ┌${"─".repeat(70)}┐`));
+    console.log(chalk.cyan(`  │`) + chalk.bold.white("                    BACKEND PROJECT AUDIT SUMMARY                     ") + chalk.cyan(`│`));
+    console.log(chalk.cyan(`  └${"─".repeat(70)}┘`));
+    console.log(`    ${chalk.gray("Project:")} ${chalk.bold(report.projectPath)}`);
+    console.log(`    ${chalk.gray("Results:")} ${chalk.green(`${report.summary.pass} Passed`)}, ` +
+        `${chalk.red(`${report.summary.fail} Failed`)}, ` +
+        `${chalk.gray(`${report.summary.skip} Skipped`)}`);
     // Severity Legend
     console.log("");
-    console.log(chalk.bold("Severity Legend:"));
-    console.log(chalk.red("  ● ERROR  ") +
-        chalk.gray("- Critical issues that must be fixed"));
-    console.log(chalk.yellow("  ● WARN   ") +
-        chalk.gray("- Important issues that should be addressed"));
-    console.log(chalk.blue("  ● INFO   ") +
-        chalk.gray("- Informational items or best practices"));
-    // Group items by status first
+    console.log(`    ${chalk.bold.gray("Severity Legend:")}  ` +
+        `${chalk.red("● ERROR")} (Critical)   ` +
+        `${chalk.yellow("● WARN")} (Important)   ` +
+        `${chalk.blue("● INFO")} (Best Practice)`);
+    // Group items
     const passedItems = report.items.filter((item) => item.status === "pass");
     const failedItems = report.items.filter((item) => item.status === "fail");
     const skippedItems = report.items.filter((item) => item.status === "skip");
     // Print PASSED section
     if (passedItems.length > 0) {
         console.log("");
-        console.log(chalk.bold.green(`✓ PASSED CHECKS (${passedItems.length})`));
+        console.log(chalk.bold.green(`  ✔ PASSED CHECKS (${passedItems.length})`));
         printSeparator();
         for (const item of passedItems) {
             printItem(item);
@@ -79,16 +62,15 @@ export function printHuman(report) {
     // Print FAILED sections grouped by severity
     if (failedItems.length > 0) {
         console.log("");
-        console.log(chalk.bold.red(`✖ FAILED CHECKS (${failedItems.length})`));
+        console.log(chalk.bold.red(`  ✖ FAILED CHECKS (${failedItems.length})`));
         printSeparator();
-        // Group failed items by severity
         const failedErrors = failedItems.filter((item) => item.severity === "error");
         const failedWarns = failedItems.filter((item) => item.severity === "warn");
         const failedInfos = failedItems.filter((item) => item.severity === "info");
         // Print failed ERRORS
         if (failedErrors.length > 0) {
             console.log("");
-            console.log(chalk.red(chalk.bold(`  ● ERRORS (${failedErrors.length})`)));
+            console.log(chalk.red(chalk.bold(`    ● ERRORS (${failedErrors.length})`)));
             for (const item of failedErrors) {
                 console.log("");
                 printItem(item);
@@ -97,7 +79,7 @@ export function printHuman(report) {
         // Print failed WARNINGS
         if (failedWarns.length > 0) {
             console.log("");
-            console.log(chalk.yellow(chalk.bold(`  ● WARNINGS (${failedWarns.length})`)));
+            console.log(chalk.yellow(chalk.bold(`    ● WARNINGS (${failedWarns.length})`)));
             for (const item of failedWarns) {
                 console.log("");
                 printItem(item);
@@ -106,7 +88,7 @@ export function printHuman(report) {
         // Print failed INFO
         if (failedInfos.length > 0) {
             console.log("");
-            console.log(chalk.blue(chalk.bold(`  ● INFO (${failedInfos.length})`)));
+            console.log(chalk.blue(chalk.bold(`    ● INFO (${failedInfos.length})`)));
             for (const item of failedInfos) {
                 console.log("");
                 printItem(item);
@@ -116,23 +98,24 @@ export function printHuman(report) {
     // Print SKIPPED section (if any)
     if (skippedItems.length > 0) {
         console.log("");
-        console.log(chalk.bold.gray(`- SKIPPED CHECKS (${skippedItems.length})`));
+        console.log(chalk.bold.gray(`  - SKIPPED CHECKS (${skippedItems.length})`));
         printSeparator();
         for (const item of skippedItems) {
             printItem(item);
         }
     }
-    // Footer
-    console.log("");
-    console.log(chalk.bold.blue(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`));
-    // Summary message
+    // Footer Box
     const failCount = report.summary.fail;
+    console.log("");
     if (failCount === 0) {
-        console.log(chalk.green.bold(`✓ All checks passed!`));
+        console.log(chalk.green(`  ┌${"─".repeat(70)}┐`));
+        console.log(chalk.green(`  │`) + chalk.bold.green("  ✔ All audits passed successfully!                                   ") + chalk.green(`│`));
+        console.log(chalk.green(`  └${"─".repeat(70)}┘`));
     }
     else {
-        console.log(chalk.yellow(`                         ⚠ ${failCount} check${failCount > 1 ? "s" : ""} need${failCount === 1 ? "s" : ""} attention.`));
+        console.log(chalk.yellow(`  ┌${"─".repeat(70)}┐`));
+        console.log(chalk.yellow(`  │`) + chalk.bold.yellow("  ⚠ Audit completed with warnings/errors. Check issues above.         ") + chalk.yellow(`│`));
+        console.log(chalk.yellow(`  └${"─".repeat(70)}┘`));
     }
-    console.log(chalk.bold.blue(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`));
     console.log("");
 }

package/dist/index.js

@@ -14,7 +14,9 @@ program
     .option("--json", "Print results as JSON")
     .option("--fail-on-warn", "Exit with code 1 if warnings exist")
     .action(async (projectPath, opts) => {
-    const results = await runAudit(projectPath);
+    const { resolveProjectPath } = await import("./utils/monorepo.js");
+    const resolvedPath = await resolveProjectPath(projectPath || ".");
+    const results = await runAudit(resolvedPath);
     if (opts.json) {
         process.stdout.write(JSON.stringify(results, null, 2) + "\n");
     }
@@ -42,8 +44,10 @@ program
     .description("Audit local .env configurations against .env.example")
     .argument("[path]", "Path to the project", ".")
     .action(async (projectPath) => {
+    const { resolveProjectPath } = await import("./utils/monorepo.js");
+    const resolvedPath = await resolveProjectPath(projectPath || ".");
     const { runEnvCommand } = await import("./cli/env.js");
-    await runEnvCommand(projectPath);
+    await runEnvCommand(resolvedPath);
 });
 // Subcommand: doctor
 program
@@ -57,11 +61,23 @@ program
 // Subcommand: api
 program
     .command("api")
-    .description("Interactive API playfield: scan codebase routes and send test requests")
-    .argument("[path]", "Path to the project", ".")
-    .action(async (projectPath) => {
+    .description("API playfield: scan codebase routes (interactive) or send direct requests")
+    .argument("[method_or_path]", "HTTP Method or project path", ".")
+    .argument("[route_path]", "Route path (only when method is provided)")
+    .option("-u, --url <url>", "Server base URL")
+    .option("-b, --body <body>", "JSON request body")
+    .option("-t, --token <token>", "Bearer Auth token")
+    .option("-H, --header <headers...>", "Custom headers in Key:Value format")
+    .action(async (methodOrPath, routePath, opts) => {
+    const httpMethods = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"];
+    const isDirectMode = routePath !== undefined && httpMethods.includes(methodOrPath.toUpperCase());
+    let targetPath = methodOrPath;
+    if (!isDirectMode) {
+        const { resolveProjectPath } = await import("./utils/monorepo.js");
+        targetPath = await resolveProjectPath(methodOrPath || ".");
+    }
     const { runApiCommand } = await import("./cli/api.js");
-    await runApiCommand(projectPath);
+    await runApiCommand(targetPath, routePath, opts);
 });
 // Subcommand: bench
 program

package/dist/utils/monorepo.js

@@ -0,0 +1,56 @@
+import fs from "node:fs";
+import path from "node:path";
+import fg from "fast-glob";
+import * as clack from "@clack/prompts";
+import chalk from "chalk";
+export async function resolveProjectPath(inputPath = ".") {
+    const absoluteRoot = path.resolve(inputPath);
+    // Find all package.json files, ignoring dependency and output directories
+    const packageFiles = await fg(["**/package.json"], {
+        cwd: absoluteRoot,
+        absolute: true,
+        ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", "**/coverage/**"],
+    });
+    if (packageFiles.length <= 1) {
+        // If only one package.json (or none) is found, bypass selection
+        return inputPath;
+    }
+    const services = [];
+    for (const file of packageFiles) {
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            const pkg = JSON.parse(content);
+            const dir = path.dirname(file);
+            services.push({
+                name: pkg.name || path.basename(dir),
+                path: dir,
+            });
+        }
+        catch { }
+    }
+    // Sort services by name alphabetically
+    services.sort((a, b) => a.name.localeCompare(b.name));
+    clack.log.info(`${chalk.bold.yellow("Monorepo detected!")} Found ${chalk.bold.cyan(services.length)} nested packages.`);
+    const options = services.map((s) => {
+        const relPath = path.relative(absoluteRoot, s.path) || ".";
+        return {
+            value: s.path,
+            label: `${chalk.bold.green(s.name)} ${chalk.gray(`(${relPath})`)}`,
+        };
+    });
+    const selectedPath = await clack.select({
+        message: "Select a microservice to target:",
+        options: [
+            ...options,
+            { value: "cancel", label: chalk.gray("Cancel / Exit") },
+        ],
+    });
+    if (clack.isCancel(selectedPath) || selectedPath === "cancel") {
+        clack.outro("Execution stopped.");
+        process.exit(0);
+    }
+    const relSelected = path.relative(absoluteRoot, selectedPath) || ".";
+    clack.log.step(`Target set to: ${chalk.bold.magenta(relSelected)}`);
+    console.log(""); // Empty line for spacing
+    return selectedPath;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bandit-cli",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "description": "",
   "main": "index.js",
   "scripts": {
@@ -18,7 +18,7 @@
   "license": "ISC",
   "type": "module",
   "bin": {
-    "bandit": "./dist/index.js"
+    "bandit": "dist/index.js"
   },
   "dependencies": {
     "@clack/prompts": "^1.5.1",