fix(security): round-5o scope descents count toward depth cap

Author: ogabasseyy

apps/web/security-integrity-find-installed-roots.test.ts

@@ -134,6 +134,27 @@ describe('security-integrity-find-installed-roots', () => {
     });
   });
 
+  it('throws when a scope chain exceeds the depth cap', () => {
+    // Scope descents count toward depth-8 like every other descent.
+    let dir = join(fixture, 'node_modules');
+    for (let level = 0; level < 10; level += 1) {
+      dir = join(dir, `@deep${level}`);
+      mkdirSync(dir, { recursive: true });
+    }
+    mkdirSync(join(dir, 'dup'), { recursive: true });
+    writeFileSync(
+      join(dir, 'dup', 'package.json'),
+      JSON.stringify({ name: 'dup', version: '0.0.0' })
+    );
+    expect(() => findInstalledRoots('@deep9/dup', fixture)).toThrow(
+      /depth-8 recursion cap/
+    );
+    rmSync(join(fixture, 'node_modules', '@deep0'), {
+      recursive: true,
+      force: true,
+    });
+  });
+
   it('throws when the upward walk hits the 12-level cap', () => {
     // A nonexistent 12-deep start dir never reaches the workspace
     // marker, so the walk exhausts its level budget.

apps/web/security-integrity-find-installed-roots.ts

@@ -192,7 +192,9 @@ export function findInstalledRoots(
         }
       }
       if (entry.name.startsWith('@')) {
-        scan(full, depth, true);
+        // Depth increments here too, so the depth-8 cap bounds every
+        // descent shape, not just node_modules nesting.
+        scan(full, depth + 1, true);
       } else {
         const nested = join(full, 'node_modules');
         if (existsSync(nested)) {