Fix TypeScript Language Detection for Monorepos and Multi-Directory Projects
Four repos (budibase, infisical, tooljet, immich) show "Node.js" when they're clearly TypeScript. The TypeScript override check only looks at root tsconfig.json and allDeps — it misses typescript in root devDependencies (monorepo toolchain deps) and tsconfig.json files in non-workspace subdirectories. This fix expands detection to catch both cases without changing any currently-correct result.
verdict PASSscore 8 / 8findings 4 (0 risk · 1 debt · 3 obs)duration 38mrejection cycles 0shipped May 22, 2026surface cli
Pipeline timeline
Intent to proven code in 38m across Think, Plan, Build, and Verify.
Think17m
Plan9m
Build3m
Verify4m
Assertion ledger
8 claims, each independently verified.
| ID | Says | Matcher | |
|---|---|---|---|
| A001 | Monorepo projects with TypeScript as a root toolchain dependency are detected as TypeScript | verified | ok |
| A002 | Projects with TypeScript config files in common subdirectories are detected as TypeScript | verified | ok |
| A003 | Non-Node projects with subdirectory TypeScript configs are not falsely upgraded | verified | ok |
| A004 | Root tsconfig detection continues working after the change | verified | ok |
| A005 | TypeScript dependency detection continues working after the change | verified | ok |
| A006 | Plain Node.js projects without TypeScript signals stay as Node.js | verified | ok |
| A007 | Tier 2 alone is sufficient without any subdirectory tsconfigs present | verified | ok |
| A008 | Multiple subdirectory tsconfig candidates are handled correctly | verified | ok |
Findings 4 total
debtpackages/cli/src/engine/scan-engine.ts→ monitor
Hardcoded subdirectory list inline in 900+ line function
obspackages/cli/tests/engine/detectors/detection-overrides.test.ts→ closed
A003 asserts not-TypeScript but not what language IS — weaker than necessary
obspackages/cli/tests/engine/detectors/detection-overrides.test.ts→ closed
Only server/ and web/ subdirectories exercised — frontend/ and backend/ untested
obs→ closed
AC1-3 reference real repos (budibase, infisical, tooljet) but are only verifiable by proxy through unit test fixtures
Integrity seal
scopesha256:77a8ec5a49b96...
contractsha256:ad0231a7e0a60...
plansha256:d2f6f33579787...
specsha256:1ad87e99f232c...
build-reportsha256:ee2c6d605aaa9...
build-datasha256:c8173bb7cd4cd...
verify-reportsha256:b3110f9cf2d61...
verify-datasha256:6911be84f3ba5...
audit cmd$ ana proof audit fix-typescript-language-detection → all hashes match