Fix TypeScript Language Detection for Monorepos and Multi-Directory Projects

Four repos (budibase, infisical, tooljet, immich) show "Node.js" when they're clearly TypeScript. The TypeScript override check only looks at root tsconfig.json and allDeps — it misses typescript in root devDependencies (monorepo toolchain deps) and tsconfig.json files in non-workspace subdirectories. This fix expands detection to catch both cases without changing any currently-correct result.

verdict PASSscore 8 / 8findings 4 (0 risk · 1 debt · 3 obs)duration 38mrejection cycles 0shipped May 22, 2026surface cli

Pipeline timeline

Intent to proven code in 38m across Think, Plan, Build, and Verify.

Think
17m
Plan
9m
Build
3m
Verify
4m

Assertion ledger

8 claims, each independently verified.

IDSaysMatcher
A001Monorepo projects with TypeScript as a root toolchain dependency are detected as TypeScriptverifiedok
A002Projects with TypeScript config files in common subdirectories are detected as TypeScriptverifiedok
A003Non-Node projects with subdirectory TypeScript configs are not falsely upgradedverifiedok
A004Root tsconfig detection continues working after the changeverifiedok
A005TypeScript dependency detection continues working after the changeverifiedok
A006Plain Node.js projects without TypeScript signals stay as Node.jsverifiedok
A007Tier 2 alone is sufficient without any subdirectory tsconfigs presentverifiedok
A008Multiple subdirectory tsconfig candidates are handled correctlyverifiedok

Findings 4 total

debtpackages/cli/src/engine/scan-engine.tsmonitor
Hardcoded subdirectory list inline in 900+ line function
obspackages/cli/tests/engine/detectors/detection-overrides.test.tsclosed
A003 asserts not-TypeScript but not what language IS — weaker than necessary
obspackages/cli/tests/engine/detectors/detection-overrides.test.tsclosed
Only server/ and web/ subdirectories exercised — frontend/ and backend/ untested
obsclosed
AC1-3 reference real repos (budibase, infisical, tooljet) but are only verifiable by proxy through unit test fixtures

Integrity seal

scopesha256:77a8ec5a49b96...
contractsha256:ad0231a7e0a60...
plansha256:d2f6f33579787...
specsha256:1ad87e99f232c...
build-reportsha256:ee2c6d605aaa9...
build-datasha256:c8173bb7cd4cd...
verify-reportsha256:b3110f9cf2d61...
verify-datasha256:6911be84f3ba5...
audit cmd$ ana proof audit fix-typescript-language-detection   → all hashes match