From a464824535aedf942bdd646a548033f62d55e790 Mon Sep 17 00:00:00 2001
From: alex <53851759+alxxjohn@users.noreply.github.com>
Date: Tue, 18 Aug 2026 21:09:03 -0400
Subject: [PATCH] fix: prevent tsconfig from narrowing security scans

---
 .../support/typescript_semantic_runner_core.js     | 11 +----------
 .../checks/support/typescript_semantic_test.go     | 14 +++++---------
 2 files changed, 6 insertions(+), 19 deletions(-)

diff --git a/internal/codeguard/checks/support/typescript_semantic_runner_core.js b/internal/codeguard/checks/support/typescript_semantic_runner_core.js
index 3b90e6b..ebe84f9 100644
--- a/internal/codeguard/checks/support/typescript_semantic_runner_core.js
+++ b/internal/codeguard/checks/support/typescript_semantic_runner_core.js
@@ -60,7 +60,7 @@ function loadProgram() {
       configPath,
     );
     return ts.createProgram({
-      rootNames: configuredRootNames(parsed.fileNames, rootNames),
+      rootNames: rootNames || parsed.fileNames.filter((name) => isWithinTarget(path.resolve(name))),
       options: parsed.options,
     });
   }
@@ -71,15 +71,6 @@ function loadProgram() {
   });
 }
 
-function configuredRootNames(configuredFiles, corpusFiles) {
-  const withinTarget = configuredFiles.filter((name) => isWithinTarget(path.resolve(name)));
-  if (!Array.isArray(corpusFiles)) {
-    return withinTarget;
-  }
-  const corpus = new Set(corpusFiles.map((name) => path.resolve(name)));
-  return withinTarget.filter((name) => corpus.has(path.resolve(name)));
-}
-
 function findConfigPath() {
   return ts.findConfigFile(targetPath, ts.sys.fileExists, "tsconfig.json") ||
     ts.findConfigFile(targetPath, ts.sys.fileExists, "jsconfig.json");
diff --git a/internal/codeguard/checks/support/typescript_semantic_test.go b/internal/codeguard/checks/support/typescript_semantic_test.go
index f61cb47..945b24f 100644
--- a/internal/codeguard/checks/support/typescript_semantic_test.go
+++ b/internal/codeguard/checks/support/typescript_semantic_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/devr-tools/codeguard/internal/codeguard/core"
 )
 
-func TestTypeScriptSemanticRunnerIntersectsCorpusWithConfiguredFiles(t *testing.T) {
+func TestTypeScriptSemanticRunnerUsesCorpusDespiteConfiguredFiles(t *testing.T) {
 	if _, err := exec.LookPath("node"); err != nil {
 		t.Skip("node is required for the embedded semantic runner test")
 	}
@@ -41,8 +41,7 @@ module.exports = {
 		TargetPath:        root,
 		SourceFiles: []string{
 			filepath.Join(root, "src/app.ts"),
-			filepath.Join(root, "vendor/excluded.ts"),
-			filepath.Join(root, "node_modules/pkg/index.ts"),
+			filepath.Join(root, "src/tsconfig-excluded.ts"),
 		},
 	}
 	_, err := runTypeScriptSemanticRunner(context.Background(), input)
@@ -50,12 +49,9 @@ module.exports = {
 		t.Fatal("semantic runner succeeded; want fake compiler root report")
 	}
 	message := err.Error()
-	if !strings.Contains(message, filepath.Join(root, "src/app.ts")) {
-		t.Fatalf("configured corpus root missing from compiler roots: %s", message)
-	}
-	for _, excluded := range []string{"vendor/excluded.ts", "node_modules/pkg/index.ts"} {
-		if strings.Contains(message, excluded) {
-			t.Fatalf("tsconfig-excluded corpus file %q reached compiler roots: %s", excluded, message)
+	for _, sourceFile := range input.SourceFiles {
+		if !strings.Contains(message, sourceFile) {
+			t.Fatalf("corpus root %q missing from compiler roots: %s", sourceFile, message)
 		}
 	}
 }