From 728e527810d22d8b382430d80888eeac7b26cd31 Mon Sep 17 00:00:00 2001
From: alex <53851759+alxxjohn@users.noreply.github.com>
Date: Tue, 18 Aug 2026 21:11:33 -0400
Subject: [PATCH] fix(security): scan targeted node modules semantically

---
 .../typescript_semantic_runner_core.js        |  7 +-----
 tests/checks/typescript_semantic_test.go      | 24 +++++++++++++++++++
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/internal/codeguard/checks/support/typescript_semantic_runner_core.js b/internal/codeguard/checks/support/typescript_semantic_runner_core.js
index ebe84f9..866c8aa 100644
--- a/internal/codeguard/checks/support/typescript_semantic_runner_core.js
+++ b/internal/codeguard/checks/support/typescript_semantic_runner_core.js
@@ -95,12 +95,7 @@ function scriptExtensions() {
 function isAnalyzableSourceFile(sourceFile) {
   return !sourceFile.isDeclarationFile &&
     scriptFlavor(sourceFile.fileName) &&
-    isWithinTarget(sourceFile.fileName) &&
-    !isNodeModulesPath(sourceFile.fileName);
-}
-
-function isNodeModulesPath(fileName) {
-  return normalizePath(path.resolve(fileName)).split("/").includes("node_modules");
+    isWithinTarget(sourceFile.fileName);
 }
 
 function isWithinTarget(fileName) {
diff --git a/tests/checks/typescript_semantic_test.go b/tests/checks/typescript_semantic_test.go
index ccba64b..134cf70 100644
--- a/tests/checks/typescript_semantic_test.go
+++ b/tests/checks/typescript_semantic_test.go
@@ -159,6 +159,30 @@ func TestSecurityCheckUsesSemanticTypeScriptAnalyzerForRequirePropertyAlias(t *t
 	assertFindingRulePresent(t, report, "Security", "security.typescript.shell-execution")
 }
 
+func TestSecuritySemanticAnalyzerScansNodeModulesWithinTarget(t *testing.T) {
+	requireTypeScriptSemanticRuntime(t)
+
+	dir := t.TempDir()
+	writeFile(t, filepath.Join(dir, "node_modules", "local-package", "index.ts"), "const agent = { rejectUnauthorized: false };\n")
+
+	cfg := codeguard.ExampleConfig()
+	cfg.Name = "security-typescript-semantic-node-modules"
+	cfg.Targets = []codeguard.TargetConfig{{Name: "web", Path: dir, Language: "typescript"}}
+	cfg.Checks.Security = true
+	cfg.Checks.Design = false
+	cfg.Checks.Quality = false
+	cfg.Checks.Prompts = false
+	cfg.Checks.CI = false
+
+	report, err := codeguard.Run(context.Background(), cfg)
+	if err != nil {
+		t.Fatalf("run: %v", err)
+	}
+
+	assertSectionStatus(t, report, "Security", "fail")
+	assertFindingRulePresent(t, report, "Security", "security.typescript.insecure-tls")
+}
+
 func requireTypeScriptSemanticRuntime(t *testing.T) {
 	t.Helper()