codeprobe-scanner 1.0.14 → 1.0.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeprobe-scanner",
-  "version": "1.0.14",
+  "version": "1.0.15",
   "description": "Automated vulnerability scanner with exploit verification and video evidence",
   "type": "module",
   "bin": {

package/src/cli/commands/scan.ts

@@ -110,8 +110,8 @@ export async function scanCommand(args: string[]): Promise<void> {
   try {
     const engine = createEngine();
 
-    // Run the actual engine scan (not mocked)
-    const report = await engine.scan(repoPath);
+    // Run recursive scan to find all package.json files
+    const report = await engine.scanRecursive(repoPath);
 
     const duration = Date.now() - startTime;
 

package/src/engine/index.ts

@@ -4,7 +4,8 @@ import { createSandbox } from "./sandbox";
 import { createMatcher } from "./matcher";
 import { createPatcher } from "./patcher";
 import { createReportBuilder } from "./report";
-import { Report } from "../shared/types";
+import { Report, ScanCVE } from "../shared/types";
+import { findAllPackageJsons } from "../shared/file-scanner";
 
 export class CodeProbeEngine {
   private parser = createParser();
@@ -18,6 +19,66 @@ export class CodeProbeEngine {
     return this.sandbox.getVideoRecorder();
   }
 
+  async scanRecursive(rootPath: string): Promise<Report> {
+    const startTime = Date.now();
+
+    try {
+      // Find all package.json files
+      console.log("🔍 Searching for package.json files...");
+      const packageJsonLocations = await findAllPackageJsons(rootPath);
+      console.log(`   Found ${packageJsonLocations.length} package.json file(s)`);
+
+      if (packageJsonLocations.length === 0) {
+        throw new Error("No package.json files found in the repository");
+      }
+
+      // Scan each location
+      const allCves: ScanCVE[] = [];
+      const allDependencies: number[] = [];
+      const scannedLocations: string[] = [];
+
+      for (const location of packageJsonLocations) {
+        console.log(`\n📂 Scanning: ${location.path}`);
+        try {
+          const report = await this.scan(location.path);
+          allCves.push(...report.scan.cves);
+          allDependencies.push(report.scan.total_dependencies);
+          scannedLocations.push(location.path);
+        } catch (error) {
+          console.warn(
+            `   ⚠️  Skipped: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+      }
+
+      // Aggregate results
+      const riskScore = this.matcher.calculateRiskScore(allCves);
+      const scanDuration = Date.now() - startTime;
+      const totalDependencies = allDependencies.reduce((a, b) => a + b, 0);
+
+      const report = await this.reportBuilder.buildReport(
+        rootPath,
+        allCves,
+        riskScore,
+        scanDuration,
+        totalDependencies
+      );
+
+      // Add metadata about scanned locations
+      (report as any).scanned_locations = scannedLocations;
+
+      await this.reportBuilder.saveReport(report);
+
+      return report;
+    } catch (error) {
+      throw new Error(
+        `Recursive scan failed: ${
+          error instanceof Error ? error.message : String(error)
+        }`
+      );
+    }
+  }
+
   async scan(repoPath: string): Promise<Report> {
     const startTime = Date.now();
 

package/src/shared/file-scanner.ts

@@ -0,0 +1,50 @@
+import { readdir } from "fs/promises";
+import { join } from "path";
+
+export interface PackageJsonLocation {
+  path: string;
+  depth: number;
+}
+
+export async function findAllPackageJsons(
+  rootPath: string,
+  maxDepth: number = 3,
+  currentDepth: number = 0,
+  results: PackageJsonLocation[] = []
+): Promise<PackageJsonLocation[]> {
+  if (currentDepth > maxDepth) {
+    return results;
+  }
+
+  try {
+    const entries = await readdir(rootPath, { withFileTypes: true });
+
+    for (const entry of entries) {
+      // Skip node_modules, .git, and other common folders
+      if (
+        entry.name.startsWith(".") ||
+        entry.name === "node_modules" ||
+        entry.name === "dist" ||
+        entry.name === "build" ||
+        entry.name === "coverage"
+      ) {
+        continue;
+      }
+
+      const fullPath = join(rootPath, entry.name);
+
+      if (entry.isFile() && entry.name === "package.json") {
+        results.push({
+          path: rootPath,
+          depth: currentDepth,
+        });
+      } else if (entry.isDirectory()) {
+        await findAllPackageJsons(fullPath, maxDepth, currentDepth + 1, results);
+      }
+    }
+  } catch {
+    // Permission denied or other errors - skip
+  }
+
+  return results;
+}