[medium] Nested monorepo packages are never scanned

[EdmundHee]

Nested monorepo packages are never scanned

Severity	medium
Kind	logic-bug
Location	src/frameworks/detector.ts → detectFrameworks
Module	src/frameworks
Finding ID	f-26f483

Failure scenario

For a common layout such as packages/api/package.json with Express declared only in that package, the root scan finds nothing and line 149 skips packages because that immediate directory has no dependency file. The function never descends to packages/api, so it returns no express framework and Express synthetic handling remains disabled.

Suggested test

Create packages/api/package.json with an Express dependency and no root or packages/package.json, then expect detectFrameworks(root) to contain express.

---

How to work this issue

Open a Claude Code session in this repo and say
"work the dev-cli finding f-26f483 in src/frameworks/detector.ts".

If this is not a real defect, close the issue with the false-positive label — dev-cli
records the fingerprint and will never raise it again. Closing it without that label marks the
finding fixed instead.

_{Raised by dev-cli · repo codemap-cli · scan 2026-08-15T05-17-40 · fingerprint 26f4837b2faf}