bandit-cli 1.0.3 → 1.0.4

package/README.md

@@ -14,6 +14,7 @@
 - **Live Server Doctor**: Probes your running server for security headers, CORS wildcards, stack trace/error leakage, and payload crash handling.
 - **Environment Variable Auditor**: Compares active `.env` files against `.env.example` to flag missing keys, empty values, and placeholder defaults before you boot.
 - **Static Project Auditor**: Evaluates package setup, file organization, safety configs, and dependency scopes.
+- **Monorepo & Microservices Auto-Discovery**: Automatically scans your workspace for nested packages containing `package.json` and interactively prompts you to target specific services.
 
 ---
 
@@ -38,11 +39,13 @@ npx bandit-cli <command>
 ### 1. Interactive API Playfield
 
 Find and test routes in your codebase interactively:
+
 ```bash
 bandit api
 ```
 
 Or execute a direct API request immediately (acts like a local curl/HTTPie):
+
 ```bash
 bandit api GET /api/v1/products --url http://localhost:8080 --token "jwt-token"
 bandit api POST /api/v1/users --body '{"name":"Raj"}'

package/dist/cli/api.js

@@ -3,41 +3,278 @@ import path from "node:path";
 import fg from "fast-glob";
 import * as clack from "@clack/prompts";
 import chalk from "chalk";
+function normalizePath(filePath) {
+    let normalized = filePath.replace(/\\/g, "/");
+    const winDriveRegex = /^([A-Z]):\//;
+    const match = normalized.match(winDriveRegex);
+    if (match) {
+        normalized = normalized.replace(winDriveRegex, `${match[1].toLowerCase()}:/`);
+    }
+    return normalized;
+}
+function resolveImport(sourceFile, importPath, projectPath) {
+    let absolutePath = "";
+    if (importPath.startsWith("@/") || importPath.startsWith("~/")) {
+        const relativePart = importPath.slice(2);
+        absolutePath = path.resolve(projectPath, "src", relativePart);
+    }
+    else if (importPath.startsWith("src/")) {
+        absolutePath = path.resolve(projectPath, importPath);
+    }
+    else if (importPath.startsWith(".")) {
+        const sourceDir = path.dirname(sourceFile);
+        absolutePath = path.resolve(sourceDir, importPath);
+    }
+    else {
+        return null;
+    }
+    const extensions = [".ts", ".js", ".tsx", ".jsx"];
+    for (const ext of extensions) {
+        const fileWithExt = absolutePath + ext;
+        if (fs.existsSync(fileWithExt)) {
+            return normalizePath(fileWithExt);
+        }
+    }
+    if (fs.existsSync(absolutePath) && fs.statSync(absolutePath).isDirectory()) {
+        for (const ext of extensions) {
+            const indexFile = path.join(absolutePath, "index" + ext);
+            if (fs.existsSync(indexFile)) {
+                return normalizePath(indexFile);
+            }
+            const routerFile = path.join(absolutePath, "router" + ext);
+            if (fs.existsSync(routerFile)) {
+                return normalizePath(routerFile);
+            }
+        }
+    }
+    return null;
+}
+function parseImportNames(importClause) {
+    const names = [];
+    importClause = importClause.trim();
+    const nsMatch = importClause.match(/\*\s+as\s+([a-zA-Z0-9_$]+)/);
+    if (nsMatch) {
+        names.push({ localName: nsMatch[1] });
+        return names;
+    }
+    const destructureMatch = importClause.match(/\{([\s\S]*?)\}/);
+    if (destructureMatch) {
+        const content = destructureMatch[1];
+        const parts = content.split(",");
+        for (const part of parts) {
+            const trimmed = part.trim();
+            if (!trimmed)
+                continue;
+            const aliasMatch = trimmed.match(/([a-zA-Z0-9_$]+)\s+as\s+([a-zA-Z0-9_$]+)/);
+            if (aliasMatch) {
+                names.push({ localName: aliasMatch[2] });
+            }
+            else {
+                const nameMatch = trimmed.match(/^([a-zA-Z0-9_$]+)$/);
+                if (nameMatch) {
+                    names.push({ localName: nameMatch[1] });
+                }
+            }
+        }
+        const beforeDestruct = importClause.split("{")[0].trim().replace(/,$/, "").trim();
+        if (beforeDestruct && !beforeDestruct.startsWith("import")) {
+            names.push({ localName: beforeDestruct });
+        }
+        return names;
+    }
+    if (importClause && !importClause.includes("{") && !importClause.includes("*")) {
+        names.push({ localName: importClause });
+    }
+    return names;
+}
+function resolvePaths(pref, p) {
+    let combined = `${pref}/${p}`.replace(/\/+/g, "/");
+    if (!combined.startsWith("/"))
+        combined = "/" + combined;
+    if (combined.length > 1 && combined.endsWith("/")) {
+        combined = combined.slice(0, -1);
+    }
+    return combined;
+}
 // Scans files for common route definitions and mounts
-async function scanForRoutes(projectPath) {
+export async function scanForRoutes(projectPath) {
+    projectPath = normalizePath(projectPath);
     const routes = [];
-    const files = await fg(["src/**/*.{ts,js}", "*.{ts,js}", "routes/**/*.{ts,js}", "controllers/**/*.{ts,js}"], {
+    const files = (await fg(["src/**/*.{ts,js}", "*.{ts,js}", "routes/**/*.{ts,js}", "controllers/**/*.{ts,js}"], {
         cwd: projectPath,
         absolute: true,
         ignore: ["**/node_modules/**", "**/dist/**", "**/*.test.{ts,js}", "**/*.spec.{ts,js}"],
-    });
-    const prefixMap = new Map();
-    // Regex to detect router mounts, e.g. app.use('/api/v1/auth', authRouter) or router.use('/auth', authRouter)
-    // Group 3 matches the path prefix, Group 4 matches the router variable name
-    const mountPattern = /\b([a-zA-Z0-9_]+)\.(use|route|group)\s*\(\s*['"`]([^'"`]+)['"`]\s*,\s*([a-zA-Z0-9_]+)/gi;
-    // Read files first to construct prefixMap
+    })).map(normalizePath);
+    const importsByFile = new Map();
+    // Step 1: Scan imports & requires for all files
+    for (const file of files) {
+        const localToTarget = new Map();
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            const esImportRegex = /import\s+([\s\S]*?)\s+from\s+['"`]([^'"`]+)['"`]/g;
+            let match;
+            while ((match = esImportRegex.exec(content)) !== null) {
+                const importClause = match[1];
+                const importPath = match[2];
+                const targetFile = resolveImport(file, importPath, projectPath);
+                if (targetFile) {
+                    const names = parseImportNames(importClause);
+                    for (const name of names) {
+                        localToTarget.set(name.localName, targetFile);
+                    }
+                }
+            }
+            const requireRegex = /(?:const|let|var)\s+([\s\S]*?)\s*=\s*require\s*\(\s*['"`]([^'"`]+)['"`]\s*\)/g;
+            while ((match = requireRegex.exec(content)) !== null) {
+                const varClause = match[1];
+                const importPath = match[2];
+                const targetFile = resolveImport(file, importPath, projectPath);
+                if (targetFile) {
+                    const names = parseImportNames(varClause);
+                    for (const name of names) {
+                        localToTarget.set(name.localName, targetFile);
+                    }
+                }
+            }
+        }
+        catch { }
+        importsByFile.set(file, localToTarget);
+    }
+    // Step 2: Build Dependency Graph Nodes and Edges
+    const nodes = new Map();
+    const edges = [];
+    const ensureNode = (id, type, filePath, varName) => {
+        if (!nodes.has(id)) {
+            nodes.set(id, { id, type, filePath, varName, prefixes: new Set() });
+        }
+    };
+    // Create file nodes
+    for (const file of files) {
+        ensureNode(`file:${file}`, "file", file);
+    }
+    // Pre-populate route variable nodes from route declarations
+    const routeVarPattern = /\b([a-zA-Z0-9_]+)\.(get|post|put|delete|patch|options|head)\s*\(/gi;
+    for (const file of files) {
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            let match;
+            routeVarPattern.lastIndex = 0;
+            while ((match = routeVarPattern.exec(content)) !== null) {
+                const instanceName = match[1];
+                ensureNode(`var:${file}:${instanceName}`, "var", file, instanceName);
+            }
+        }
+        catch { }
+    }
+    const mountPattern = /\b([a-zA-Z0-9_]+)\.(use|route|group)\s*\(\s*(?:['"`]([^'"`]+)['"`]\s*,\s*)?(?:require\s*\(\s*['"`]([^'"`]+)['"`]\s*\)|([a-zA-Z0-9_]+))/gi;
     for (const file of files) {
         try {
             const content = fs.readFileSync(file, "utf-8");
             let match;
             mountPattern.lastIndex = 0;
             while ((match = mountPattern.exec(content)) !== null) {
-                const prefix = match[3];
-                const routerName = match[4];
-                if (prefix && routerName && routerName !== "express" && routerName !== "cors" && routerName !== "helmet") {
-                    prefixMap.set(routerName, prefix);
+                const parentVar = match[1];
+                const mountPath = match[3] || "/";
+                const inlineRequire = match[4];
+                const childVar = match[5];
+                const parentId = `var:${file}:${parentVar}`;
+                ensureNode(parentId, "var", file, parentVar);
+                if (inlineRequire) {
+                    const targetFile = resolveImport(file, inlineRequire, projectPath);
+                    if (targetFile) {
+                        const targetFileId = `file:${targetFile}`;
+                        ensureNode(targetFileId, "file", targetFile);
+                        edges.push({ from: parentId, to: targetFileId, path: mountPath });
+                    }
+                }
+                else if (childVar) {
+                    const childId = `var:${file}:${childVar}`;
+                    ensureNode(childId, "var", file, childVar);
+                    edges.push({ from: parentId, to: childId, path: mountPath });
+                    // Check if childVar is imported
+                    const targetFile = importsByFile.get(file)?.get(childVar);
+                    if (targetFile) {
+                        const targetFileId = `file:${targetFile}`;
+                        ensureNode(targetFileId, "file", targetFile);
+                        edges.push({ from: childId, to: targetFileId, path: "/" });
+                    }
                 }
             }
         }
         catch { }
     }
-    // Regex patterns
-    // 1. Generic Router paths: authRouter.post('/login', ...)
-    // Group 1 matches the router variable, Group 2 matches method, Group 3 matches endpoint path
+    // Step 3: Link file nodes to their root variables within that file
+    for (const file of files) {
+        const fileId = `file:${file}`;
+        // Find all variable nodes in this file
+        const varNodesInFile = Array.from(nodes.values()).filter((n) => n.type === "var" && n.filePath === file);
+        for (const vNode of varNodesInFile) {
+            // Is there an incoming edge to this variable from another variable/file in the same file?
+            const hasIncomingLocal = edges.some((e) => e.to === vNode.id && e.from.startsWith(`var:${file}:`));
+            if (!hasIncomingLocal) {
+                // It is a root variable in this file, link the file node to it
+                edges.push({ from: fileId, to: vNode.id, path: "/" });
+            }
+        }
+    }
+    // Step 4: Identify entry points and initialize their prefixes
+    // Entry points are file nodes that have no incoming edges from OTHER files
+    const fileIncomingFromOthers = new Set();
+    for (const edge of edges) {
+        if (edge.to.startsWith("file:")) {
+            const fromFile = nodes.get(edge.from)?.filePath;
+            const toFile = nodes.get(edge.to)?.filePath;
+            if (fromFile && toFile && fromFile !== toFile) {
+                fileIncomingFromOthers.add(edge.to);
+            }
+        }
+    }
+    for (const file of files) {
+        const fileId = `file:${file}`;
+        if (!fileIncomingFromOthers.has(fileId)) {
+            const fNode = nodes.get(fileId);
+            if (fNode) {
+                fNode.prefixes.add("/");
+            }
+        }
+    }
+    // Step 5: Propagate prefixes using BFS
+    const queue = [];
+    for (const node of nodes.values()) {
+        if (node.prefixes.size > 0) {
+            queue.push(node.id);
+        }
+    }
+    const inQueue = new Set(queue);
+    while (queue.length > 0) {
+        const currId = queue.shift();
+        inQueue.delete(currId);
+        const currNode = nodes.get(currId);
+        if (!currNode)
+            continue;
+        // Find outgoing edges
+        const outgoing = edges.filter((e) => e.from === currId);
+        for (const edge of outgoing) {
+            const targetNode = nodes.get(edge.to);
+            if (!targetNode)
+                continue;
+            let changed = false;
+            for (const pref of currNode.prefixes) {
+                const combined = resolvePaths(pref, edge.path);
+                if (!targetNode.prefixes.has(combined)) {
+                    targetNode.prefixes.add(combined);
+                    changed = true;
+                }
+            }
+            if (changed && !inQueue.has(edge.to)) {
+                queue.push(edge.to);
+                inQueue.add(edge.to);
+            }
+        }
+    }
+    // Step 6: Scan files for actual routes and use propagated prefixes
     const expressPattern = /\b([a-zA-Z0-9_]+)\.(get|post|put|delete|patch|options|head)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
-    // 2. NestJS decorators: @Get('/path')
     const nestPattern = /@(Get|Post|Put|Delete|Patch)\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
-    // 3. NestJS controllers: @Controller('/prefix')
     const controllerPattern = /@Controller\s*\(\s*['"`]([^'"`\s]+)['"`]/gi;
     for (const file of files) {
         try {
@@ -58,21 +295,19 @@ async function scanForRoutes(projectPath) {
                 const instanceName = match[1];
                 const method = match[2].toUpperCase();
                 const subPath = match[3];
-                let rPath = subPath;
-                // If the instanceName has a registered mount prefix, prepend it!
-                if (prefixMap.has(instanceName)) {
-                    const prefix = prefixMap.get(instanceName).replace(/\/$/, "");
-                    rPath = `${prefix}/${subPath.replace(/^\//, "")}`;
+                const varNodeId = `var:${file}:${instanceName}`;
+                const varNode = nodes.get(varNodeId);
+                const targetPrefixes = (varNode && varNode.prefixes.size > 0)
+                    ? Array.from(varNode.prefixes)
+                    : ["/"];
+                for (const prefix of targetPrefixes) {
+                    const rPath = resolvePaths(prefix, subPath);
+                    routes.push({
+                        method,
+                        routePath: rPath,
+                        sourceFile: relativePath,
+                    });
                 }
-                // Clean up double slashes
-                rPath = rPath.replace(/\/+/g, "/");
-                if (!rPath.startsWith("/"))
-                    rPath = `/${rPath}`;
-                routes.push({
-                    method,
-                    routePath: rPath,
-                    sourceFile: relativePath,
-                });
             }
             // 2. NestJS
             nestPattern.lastIndex = 0;

package/dist/cli/doctor.js

@@ -16,6 +16,26 @@ async function fetchWithTimeout(url, options = {}, timeoutMs = 4000) {
         throw err;
     }
 }
+function findSensitiveKeys(obj) {
+    const sensitiveKeywords = [
+        "password", "hashed_password", "salt", "secret", "ssn",
+        "credit_card", "creditcard", "passwd", "token", "auth_token"
+    ];
+    const found = [];
+    function search(current) {
+        if (!current || typeof current !== "object")
+            return;
+        for (const key of Object.keys(current)) {
+            const lowerKey = key.toLowerCase();
+            if (sensitiveKeywords.includes(lowerKey)) {
+                found.push(key);
+            }
+            search(current[key]);
+        }
+    }
+    search(obj);
+    return found;
+}
 export async function runDoctorCommand(targetUrl = "http://localhost:3000") {
     clack.intro(chalk.bold.bgBlue.white(" Bandit Live Server Doctor "));
     clack.log.info(`Target URL: ${chalk.bold.cyan(targetUrl)}`);
@@ -205,6 +225,155 @@ export async function runDoctorCommand(targetUrl = "http://localhost:3000") {
         }
     }
     s.stop("Oversized payload probe complete.");
+    // 4. Sensitive Data Leak Scanner
+    s.start("Scanning response for sensitive data leakage...");
+    try {
+        const rootText = await rootResponse.text();
+        let rootJson = null;
+        try {
+            rootJson = JSON.parse(rootText);
+        }
+        catch { }
+        if (rootJson) {
+            const leaked = findSensitiveKeys(rootJson);
+            if (leaked.length > 0) {
+                reports.push({
+                    title: "Sensitive Data Leak Check",
+                    status: "fail",
+                    details: `Root JSON response exposed sensitive field(s): [${leaked.join(", ")}]`,
+                    suggestion: "Remove database columns like password/salt/secret from response serializers/DTOs.",
+                });
+            }
+            else {
+                reports.push({
+                    title: "Sensitive Data Leak Check",
+                    status: "pass",
+                    details: "No sensitive fields leaked in root JSON response.",
+                });
+            }
+        }
+        else {
+            reports.push({
+                title: "Sensitive Data Leak Check",
+                status: "pass",
+                details: "Root response did not return JSON (no leaks scanned).",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "Sensitive Data Leak Check",
+            status: "warn",
+            details: `Failed to audit sensitive data leaks: ${err.message}`,
+        });
+    }
+    s.stop("Sensitive data scan complete.");
+    // 5. Active Security Penetration Probes (SQLi, NoSQLi, XSS)
+    s.start("Executing active security penetration probes...");
+    // SQLi Probe
+    try {
+        const sqliUrl = `${targetUrl.replace(/\/$/, "")}/?id=%27%20OR%20%271%27%3D%271`;
+        const sqliRes = await fetchWithTimeout(sqliUrl, {}, 3000);
+        const sqliText = await sqliRes.text();
+        const sqlErrors = [
+            "SQLITE_ERROR",
+            "syntax error near",
+            "PostgreSQL query failed",
+            "mysql server version",
+            "MariaDB server version",
+            "You have an error in your SQL syntax",
+            "pg_query",
+        ];
+        const leakedSqlError = sqlErrors.find(err => sqliText.toLowerCase().includes(err.toLowerCase()));
+        if (leakedSqlError) {
+            reports.push({
+                title: "SQL Injection (SQLi) Vulnerability Probe",
+                status: "fail",
+                details: `Server exposed SQL error token [${leakedSqlError}] when queried with SQL injection payload.`,
+                suggestion: "Use parameterized queries or ORMs (Prisma/Drizzle) and never concatenate raw inputs into SQL.",
+            });
+        }
+        else {
+            reports.push({
+                title: "SQL Injection (SQLi) Vulnerability Probe",
+                status: "pass",
+                details: "No raw SQL exceptions leaked in response to injection payload.",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "SQL Injection (SQLi) Vulnerability Probe",
+            status: "warn",
+            details: `Failed to execute SQLi probe: ${err.message}`,
+        });
+    }
+    // XSS Probe
+    try {
+        const xssPayload = "<script>alert(1)</script>";
+        const xssUrl = `${targetUrl.replace(/\/$/, "")}/?search=${encodeURIComponent(xssPayload)}`;
+        const xssRes = await fetchWithTimeout(xssUrl, {}, 3000);
+        const xssText = await xssRes.text();
+        if (xssRes.ok && xssText.includes(xssPayload)) {
+            reports.push({
+                title: "Cross-Site Scripting (XSS) Vulnerability Probe",
+                status: "fail",
+                details: "Server reflected unescaped HTML script tags in the response body.",
+                suggestion: "Sanitize user inputs and HTML-encode reflected outputs to prevent script execution.",
+            });
+        }
+        else {
+            reports.push({
+                title: "Cross-Site Scripting (XSS) Vulnerability Probe",
+                status: "pass",
+                details: "Input reflected HTML script tags are properly escaped or omitted by the server.",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "Cross-Site Scripting (XSS) Vulnerability Probe",
+            status: "warn",
+            details: `Failed to execute XSS probe: ${err.message}`,
+        });
+    }
+    // NoSQLi Probe
+    try {
+        const nosqliUrl = `${targetUrl.replace(/\/$/, "")}/?username[%24ne]=admin`;
+        const nosqliRes = await fetchWithTimeout(nosqliUrl, {}, 3000);
+        const nosqliText = await nosqliRes.text();
+        const nosqlErrors = [
+            "MongoError",
+            "MongoServerError",
+            "CastError",
+            "ObjectParameterError",
+            "MongooseError",
+        ];
+        const leakedNoSqlError = nosqlErrors.find(err => nosqliText.toLowerCase().includes(err.toLowerCase()));
+        if (leakedNoSqlError) {
+            reports.push({
+                title: "NoSQL Injection Vulnerability Probe",
+                status: "fail",
+                details: `Server exposed NoSQL error token [${leakedNoSqlError}] in response to query parameters.`,
+                suggestion: "Sanitize input parameters and sanitize mongo operator prefixes ($) using tools like 'mongo-sanitize'.",
+            });
+        }
+        else {
+            reports.push({
+                title: "NoSQL Injection Vulnerability Probe",
+                status: "pass",
+                details: "No NoSQL database exceptions leaked in response to query payload.",
+            });
+        }
+    }
+    catch (err) {
+        reports.push({
+            title: "NoSQL Injection Vulnerability Probe",
+            status: "warn",
+            details: `Failed to execute NoSQLi probe: ${err.message}`,
+        });
+    }
+    s.stop("Active penetration probes complete.");
     // Print results
     console.log("\n" + chalk.bold("Diagnostic Results:"));
     for (const report of reports) {

package/dist/cli/output.js

@@ -6,71 +6,54 @@ function icon(status) {
         return chalk.red("✖");
     return chalk.gray("-");
 }
-function sevColor(sev, text) {
-    if (sev === "error")
-        return chalk.red(text);
-    if (sev === "warn")
-        return chalk.yellow(text);
-    return chalk.blue(text);
-}
-function sevLabel(sev) {
-    if (sev === "error")
-        return "ERROR";
-    if (sev === "warn")
-        return "WARN";
-    return "INFO";
-}
 function printSeparator() {
-    console.log(chalk.gray("─".repeat(80)));
+    console.log(chalk.gray("  " + "─".repeat(70)));
 }
 function printItem(item) {
     const statusIcon = icon(item.status);
-    const line = `${statusIcon} ${chalk.bold(item.title)}`;
-    console.log(line);
-    // Show details for pass/fail/skip
+    let titleText = chalk.bold(item.title);
+    if (item.status === "fail") {
+        if (item.severity === "error")
+            titleText += chalk.red.bold(" (ERROR)");
+        else if (item.severity === "warn")
+            titleText += chalk.yellow.bold(" (WARN)");
+        else
+            titleText += chalk.blue.bold(" (INFO)");
+    }
+    console.log(`  ${statusIcon}  ${titleText}`);
+    // Show details
     if (item.details) {
-        console.log(chalk.gray(`  ↳ ${item.details}`));
+        console.log(chalk.gray(`     ↳ ${item.details}`));
     }
     // Show suggestion only for failures
     if (item.status === "fail" && item.suggestion) {
-        console.log(chalk.gray(`  ↳ Suggestion: ${item.suggestion}`));
-    }
-}
-function printSection(title, items, color) {
-    if (items.length === 0)
-        return;
-    console.log("");
-    console.log(color(chalk.bold(`● ${title}`)));
-    printSeparator();
-    for (const item of items) {
-        printItem(item);
+        console.log(chalk.cyan(`     ↳ Suggestion: ${item.suggestion}`));
     }
 }
 export function printHuman(report) {
-    // Header
+    // Header Box
     console.log("");
-    console.log(chalk.bold.blue(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`));
-    console.log(chalk.bold.white(`                           Backend Audit Report`));
-    console.log(chalk.bold.blue(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`));
-    console.log(chalk.gray(`Project: ${report.projectPath}`));
-    console.log(chalk.gray(`Summary: ${chalk.green(`pass=${report.summary.pass}`)} ${chalk.red(`fail=${report.summary.fail}`)} ${chalk.gray(`skip=${report.summary.skip}`)}`));
+    console.log(chalk.cyan(`  ┌${"─".repeat(70)}┐`));
+    console.log(chalk.cyan(`  │`) + chalk.bold.white("                    BACKEND PROJECT AUDIT SUMMARY                     ") + chalk.cyan(`│`));
+    console.log(chalk.cyan(`  └${"─".repeat(70)}┘`));
+    console.log(`    ${chalk.gray("Project:")} ${chalk.bold(report.projectPath)}`);
+    console.log(`    ${chalk.gray("Results:")} ${chalk.green(`${report.summary.pass} Passed`)}, ` +
+        `${chalk.red(`${report.summary.fail} Failed`)}, ` +
+        `${chalk.gray(`${report.summary.skip} Skipped`)}`);
     // Severity Legend
     console.log("");
-    console.log(chalk.bold("Severity Legend:"));
-    console.log(chalk.red("  ● ERROR  ") +
-        chalk.gray("- Critical issues that must be fixed"));
-    console.log(chalk.yellow("  ● WARN   ") +
-        chalk.gray("- Important issues that should be addressed"));
-    console.log(chalk.blue("  ● INFO   ") +
-        chalk.gray("- Informational items or best practices"));
-    // Group items by status first
+    console.log(`    ${chalk.bold.gray("Severity Legend:")}  ` +
+        `${chalk.red("● ERROR")} (Critical)   ` +
+        `${chalk.yellow("● WARN")} (Important)   ` +
+        `${chalk.blue("● INFO")} (Best Practice)`);
+    // Group items
     const passedItems = report.items.filter((item) => item.status === "pass");
     const failedItems = report.items.filter((item) => item.status === "fail");
     const skippedItems = report.items.filter((item) => item.status === "skip");
     // Print PASSED section
     if (passedItems.length > 0) {
         console.log("");
-        console.log(chalk.bold.green(`✓ PASSED CHECKS (${passedItems.length})`));
+        console.log(chalk.bold.green(`  ✔ PASSED CHECKS (${passedItems.length})`));
         printSeparator();
         for (const item of passedItems) {
             printItem(item);
@@ -79,16 +62,15 @@ export function printHuman(report) {
     // Print FAILED sections grouped by severity
     if (failedItems.length > 0) {
         console.log("");
-        console.log(chalk.bold.red(`✖ FAILED CHECKS (${failedItems.length})`));
+        console.log(chalk.bold.red(`  ✖ FAILED CHECKS (${failedItems.length})`));
         printSeparator();
-        // Group failed items by severity
         const failedErrors = failedItems.filter((item) => item.severity === "error");
         const failedWarns = failedItems.filter((item) => item.severity === "warn");
         const failedInfos = failedItems.filter((item) => item.severity === "info");
         // Print failed ERRORS
         if (failedErrors.length > 0) {
             console.log("");
-            console.log(chalk.red(chalk.bold(`  ● ERRORS (${failedErrors.length})`)));
+            console.log(chalk.red(chalk.bold(`    ● ERRORS (${failedErrors.length})`)));
             for (const item of failedErrors) {
                 console.log("");
                 printItem(item);
@@ -97,7 +79,7 @@ export function printHuman(report) {
         // Print failed WARNINGS
         if (failedWarns.length > 0) {
             console.log("");
-            console.log(chalk.yellow(chalk.bold(`  ● WARNINGS (${failedWarns.length})`)));
+            console.log(chalk.yellow(chalk.bold(`    ● WARNINGS (${failedWarns.length})`)));
             for (const item of failedWarns) {
                 console.log("");
                 printItem(item);
@@ -106,7 +88,7 @@ export function printHuman(report) {
         // Print failed INFO
         if (failedInfos.length > 0) {
             console.log("");
-            console.log(chalk.blue(chalk.bold(`  ● INFO (${failedInfos.length})`)));
+            console.log(chalk.blue(chalk.bold(`    ● INFO (${failedInfos.length})`)));
             for (const item of failedInfos) {
                 console.log("");
                 printItem(item);
@@ -116,23 +98,24 @@ export function printHuman(report) {
     // Print SKIPPED section (if any)
     if (skippedItems.length > 0) {
         console.log("");
-        console.log(chalk.bold.gray(`- SKIPPED CHECKS (${skippedItems.length})`));
+        console.log(chalk.bold.gray(`  - SKIPPED CHECKS (${skippedItems.length})`));
         printSeparator();
         for (const item of skippedItems) {
             printItem(item);
         }
     }
-    // Footer
-    console.log("");
-    console.log(chalk.bold.blue(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`));
-    // Summary message
+    // Footer Box
     const failCount = report.summary.fail;
+    console.log("");
     if (failCount === 0) {
-        console.log(chalk.green.bold(`✓ All checks passed!`));
+        console.log(chalk.green(`  ┌${"─".repeat(70)}┐`));
+        console.log(chalk.green(`  │`) + chalk.bold.green("  ✔ All audits passed successfully!                                   ") + chalk.green(`│`));
+        console.log(chalk.green(`  └${"─".repeat(70)}┘`));
     }
     else {
-        console.log(chalk.yellow(`                         ⚠ ${failCount} check${failCount > 1 ? "s" : ""} need${failCount === 1 ? "s" : ""} attention.`));
+        console.log(chalk.yellow(`  ┌${"─".repeat(70)}┐`));
+        console.log(chalk.yellow(`  │`) + chalk.bold.yellow("  ⚠ Audit completed with warnings/errors. Check issues above.         ") + chalk.yellow(`│`));
+        console.log(chalk.yellow(`  └${"─".repeat(70)}┘`));
     }
-    console.log(chalk.bold.blue(`━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━`));
     console.log("");
 }

package/dist/index.js

@@ -14,7 +14,9 @@ program
     .option("--json", "Print results as JSON")
     .option("--fail-on-warn", "Exit with code 1 if warnings exist")
     .action(async (projectPath, opts) => {
-    const results = await runAudit(projectPath);
+    const { resolveProjectPath } = await import("./utils/monorepo.js");
+    const resolvedPath = await resolveProjectPath(projectPath || ".");
+    const results = await runAudit(resolvedPath);
     if (opts.json) {
         process.stdout.write(JSON.stringify(results, null, 2) + "\n");
     }
@@ -42,8 +44,10 @@ program
     .description("Audit local .env configurations against .env.example")
     .argument("[path]", "Path to the project", ".")
     .action(async (projectPath) => {
+    const { resolveProjectPath } = await import("./utils/monorepo.js");
+    const resolvedPath = await resolveProjectPath(projectPath || ".");
     const { runEnvCommand } = await import("./cli/env.js");
-    await runEnvCommand(projectPath);
+    await runEnvCommand(resolvedPath);
 });
 // Subcommand: doctor
 program
@@ -65,8 +69,15 @@ program
     .option("-t, --token <token>", "Bearer Auth token")
     .option("-H, --header <headers...>", "Custom headers in Key:Value format")
     .action(async (methodOrPath, routePath, opts) => {
+    const httpMethods = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"];
+    const isDirectMode = routePath !== undefined && httpMethods.includes(methodOrPath.toUpperCase());
+    let targetPath = methodOrPath;
+    if (!isDirectMode) {
+        const { resolveProjectPath } = await import("./utils/monorepo.js");
+        targetPath = await resolveProjectPath(methodOrPath || ".");
+    }
     const { runApiCommand } = await import("./cli/api.js");
-    await runApiCommand(methodOrPath, routePath, opts);
+    await runApiCommand(targetPath, routePath, opts);
 });
 // Subcommand: bench
 program

package/dist/utils/monorepo.js

@@ -0,0 +1,56 @@
+import fs from "node:fs";
+import path from "node:path";
+import fg from "fast-glob";
+import * as clack from "@clack/prompts";
+import chalk from "chalk";
+export async function resolveProjectPath(inputPath = ".") {
+    const absoluteRoot = path.resolve(inputPath);
+    // Find all package.json files, ignoring dependency and output directories
+    const packageFiles = await fg(["**/package.json"], {
+        cwd: absoluteRoot,
+        absolute: true,
+        ignore: ["**/node_modules/**", "**/dist/**", "**/build/**", "**/coverage/**"],
+    });
+    if (packageFiles.length <= 1) {
+        // If only one package.json (or none) is found, bypass selection
+        return inputPath;
+    }
+    const services = [];
+    for (const file of packageFiles) {
+        try {
+            const content = fs.readFileSync(file, "utf-8");
+            const pkg = JSON.parse(content);
+            const dir = path.dirname(file);
+            services.push({
+                name: pkg.name || path.basename(dir),
+                path: dir,
+            });
+        }
+        catch { }
+    }
+    // Sort services by name alphabetically
+    services.sort((a, b) => a.name.localeCompare(b.name));
+    clack.log.info(`${chalk.bold.yellow("Monorepo detected!")} Found ${chalk.bold.cyan(services.length)} nested packages.`);
+    const options = services.map((s) => {
+        const relPath = path.relative(absoluteRoot, s.path) || ".";
+        return {
+            value: s.path,
+            label: `${chalk.bold.green(s.name)} ${chalk.gray(`(${relPath})`)}`,
+        };
+    });
+    const selectedPath = await clack.select({
+        message: "Select a microservice to target:",
+        options: [
+            ...options,
+            { value: "cancel", label: chalk.gray("Cancel / Exit") },
+        ],
+    });
+    if (clack.isCancel(selectedPath) || selectedPath === "cancel") {
+        clack.outro("Execution stopped.");
+        process.exit(0);
+    }
+    const relSelected = path.relative(absoluteRoot, selectedPath) || ".";
+    clack.log.step(`Target set to: ${chalk.bold.magenta(relSelected)}`);
+    console.log(""); // Empty line for spacing
+    return selectedPath;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bandit-cli",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "",
   "main": "index.js",
   "scripts": {
@@ -18,7 +18,7 @@
   "license": "ISC",
   "type": "module",
   "bin": {
-    "bandit": "./dist/index.js"
+    "bandit": "dist/index.js"
   },
   "dependencies": {
     "@clack/prompts": "^1.5.1",