feat(drift): filter non-package dependency claims - #186
Merged
theyashasvipandey merged 4 commits intoSep 18, 2026
Merged
Conversation
Every bold word in a stack/tech section became a dependency claim, so AWS, REST API, and Database Layer were checked against package.json and reported DEPENDENCY_MISSING — warnings the author cannot act on. Three structural filters now run after the existing name-shape check: all-caps words (acronyms), multi-word phrases (descriptive labels — scoped names like @mex/core keep their spacing exemption), and a curated architectural-label blocklist (frontend, middleware, auth...). Structural rules first, blocklist as the complement — real packages never collide with the labels because npm names like 'api' are far rarer in stack docs than the false positives they prevent. Resolves mex-memory#4
Contributor
Author
|
@theDakshJaitly @theyashasvipandey — done and green; requesting review. Follows the direction settled on the issue: smarter heuristics, zero-config, no structured-output file. Three pattern filters run after the existing name-shape check in the bold-declaration extractor:
Real packages ( |
Contributor
Author
|
hi this filters non package dependency claims from drift results framework level mentions no longer show up as false dependency claims let me know if the filter needs tightening |
Two of the three extractor rules did not hold up. The multi-word rule could not fire: PACKAGE_NAME rejects whitespace and runs three lines above it, so "REST API" and "Database Layer" were already dropped before this branch. Its test passed on main too, and four entries in the label list -- "database layer", "api layer", "service layer", "storage layer" -- could never be looked up for the same reason. The acronym rule read as "contains no lowercase letter", which is wider than an acronym. It dropped PINO-HTTP, GRAPHQL-WS, YOUTUBE.JS and @SCOPE/PKG -- the last contradicting the rule's own comment about scoped names -- and, because it deleted the claim in the extractor, a package written in capitals stopped being checked at all: with cors and ajv gone from the manifest, main reported both and this branch reported neither. The filtering now runs in the dependency checker, beside KNOWN_RUNTIMES, which is the layer that already suppresses this kind of name and the only one that knows what the project declares. A label that is also a real package (`server`, `client`, `queue`, `middleware`) stays checked when the manifest carries it, the set of dependency claims that `mex check` uses to keep a package name from being reported as a broken path stays intact, and a version claim on a capitalized name is still compared. The acronym pattern is narrowed to one unseparated word, so capitalized package spellings survive. What remains, deliberately: a name pattern cannot separate "CORS the acronym" from "cors was removed from the manifest", so drift on a package short enough to be written in capitals goes unreported. That trade is the point of the issue; it is written down in the code and the CHANGELOG rather than left to be discovered. Measured on a stack section mixing labels, acronyms and real packages: eight warnings before, one after -- the only claim naming a package the manifest does not carry. Tests moved to the checker and extended with the capitalized-package and declared-label cases; each fails without its fix, including against the original rule.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #4.
Problem
The claim extractor treated every bold word in a stack/tech section as a dependency claim, so AWS, REST API, and Database Layer were checked against
package.jsonand reportedDEPENDENCY_MISSING— fewer false positives wanted, per the issue.What
Three filters, layered after the existing
PACKAGE_NAMEshape check:AWS,REST,JWT) — no package is styled that way.REST API,Database Layer); scoped names (@scope/pkg) keep an explicit exemption since npm scopes contain a slash but never spaces.frontend,backend,middleware,auth,gateway, ...) as the complement the issue describes — the patterns cannot catch a single-word label like "Frontend".Design note per the issue's framing: this stays pattern-based (zero-config), not structured output; the maintainer's earlier comment on this issue settled that direction.
Tests
Four new cases in
test/claims.test.ts: acronyms dropped, multi-word phrases dropped, architectural labels dropped while real packages (Express,@scope/pkg) and mixed-case names (pino-http) survive. All 30 claims tests pass;npm run typecheckgreen.