fix(scanner): reject invalid scan paths

src/scanner/index.ts

@@ -23,6 +23,20 @@ interface OpkConfig {
   exclude?: string[];
 }
 
+function validateRootDirectory(rootDir: string): void {
+  let rootStats: fs.Stats;
+
+  try {
+    rootStats = fs.statSync(rootDir);
+  } catch {
+    throw new Error(`Scan path does not exist or cannot be accessed: ${rootDir}`);
+  }
+
+  if (!rootStats.isDirectory()) {
+    throw new Error(`Scan path is not a directory: ${rootDir}`);
+  }
+}
+
 function loadConfig(rootDir: string): OpkConfig | null {
   const configPath = path.join(rootDir, 'opk.config.json');
   try {
@@ -84,6 +98,8 @@ export async function scan(
   const startTime = Date.now();
   const absoluteRoot = path.resolve(rootDir);
 
+  validateRootDirectory(absoluteRoot);
+
   const config = loadConfig(absoluteRoot);
   const excludePatterns = config?.exclude || [];
 

tests/cli/cli-commands.test.ts

@@ -6,6 +6,15 @@ import * as path from 'node:path';
 
 const CLI_PATH = path.resolve(__dirname, '..', '..', '..', 'bin', 'opk');
 const PACKAGE_JSON_PATH = path.resolve(__dirname, '..', '..', '..', 'package.json');
+const MISSING_SCAN_PATH = path.resolve(
+  __dirname,
+  '..',
+  '..',
+  '..',
+  'tests',
+  'fixtures',
+  'missing-scan-path',
+);
 
 interface CliResult {
   stdout: string;
@@ -71,4 +80,22 @@ test('CLI commands', async (t) => {
     assert.match(result.stderr, /Unknown command: unknown/);
     assert.match(result.stderr, /Run "opk --help" for usage information\./);
   });
+
+  await t.test('should exit with 2 when the scan path does not exist', () => {
+    const result = runCli(['scan', MISSING_SCAN_PATH]);
+
+    assert.strictEqual(result.status, 2);
+    assert.strictEqual(result.stdout, '');
+    assert.match(result.stderr, /Scan path does not exist or cannot be accessed:/);
+    assert.match(result.stderr, /missing-scan-path/);
+  });
+
+  await t.test('should exit with 2 when the scan path is not a directory', () => {
+    const result = runCli(['scan', PACKAGE_JSON_PATH]);
+
+    assert.strictEqual(result.status, 2);
+    assert.strictEqual(result.stdout, '');
+    assert.match(result.stderr, /Scan path is not a directory:/);
+    assert.match(result.stderr, /package\.json/);
+  });
 });