check false positives on clean scaffolds not covered by #201-#203

[theyashasvipandey]

A follow-up to #201, #202 and #203: mex check false positives on clean, freshly set-up
scaffolds that none of those issues cover. Each was observed on a real scaffold. A freshly
populated Hono scaffold scores 8/100, and 10 of its 12 issues are false.

1. Scoped packages declared in package.json but not installed

✗ MISSING_PATH Referenced path does not exist: @hono/node-server
✗ MISSING_PATH Referenced path does not exist: @typescript/native-preview
✗ MISSING_PATH Referenced path does not exist: @types/node

All three are in the repository's devDependencies. pathExists
(src/drift/checkers/path.ts:225) confirms a scoped package only through Node module resolution
or a workspace name, so every clone that hasn't run npm install reports every scoped package it
documents. The declared manifests should count, which loadAllDependencies already reads. (This
is separate from #202 bullet 5, which is about installed packages with a strict exports map.)

2. A package's JSR name

✗ MISSING_PATH Referenced path does not exist: @hono/hono      (×3)

The npm package is hono; @hono/hono is its JSR name, documented in the prose. A scoped name
matching the project's own package or jsr.json / deno.json name should not be a path claim.

3. Brace-expanded script names

✗ DEAD_COMMAND Script "test:{node,workerd,fastly,lambda,lambda-edge}" not found in package.json scripts

From bun run test:{node,workerd,…}. Expand the braces and check each script, or skip values
containing {…} (the path checker already treats braces as template placeholders).

4. Tool commands read as dependencies

⚠ DEPENDENCY_MISSING Claimed dependency "bun test" not found in any manifest
⚠ DEPENDENCY_MISSING Claimed dependency "deno test" not found in any manifest

A bullet like - **`bun test` / `deno test`** — used only for runtime-tests/… under a heading
that matches DEPENDENCY_SECTION_PATTERNS (src/drift/claims.ts:14) becomes a dependency claim.
A value containing whitespace is a command, not a package name.

5. Bare runtime filenames

✗ MISSING_PATH Referenced path does not exist: hub-onboarding.json   (×2, on mex's own scaffold)

The file is .mex/local/hub-onboarding.json, created at runtime and gitignored. The prose names
it bare, so neither the path nor the gitignore exemption matches.

6. Import-specifier examples

✗ MISSING_PATH Referenced path does not exist: ./parse.js

From "ESM TypeScript imports use emitted .js specifiers, including relative imports such as
./parse.js." A relative ./x.js specifier in a sentence about imports describes a convention,
not a file at the repository root.

Expected behavior

None of these are drift. Happy to split into separate issues if that suits contributors better.
Items 1, 3 and 4 are small and self-contained.

[Otto-Deviant1904]

Hey — I'd like to pick this up if nobody's working on it yet.

Planning to tackle the clean-clone false positives: scoped packages listed in package.json/devDependencies that shouldn't need node_modules, the project's own JSR name (@hono/hono vs npm hono), hub-onboarding.json living under .mex/local/, and the ./parse.js-in-prose import example thing.

#249 already covers brace-expanded script names and the bun test / deno test whitespace case — I'll stay out of that and rebase around it (or pick those up if that PR stalls).

Quick sanity check before I start: does that scope look right? And for declared deps — root package.json only, or should nested workspace manifests count too?

[theyashasvipandey]

@Otto-Deviant1904 yes, go ahead, #249 (items 3 and 4) is merged, so please build on the latest main.

A few pointers:

• Declared deps: use what loadAllDependencies already returns rather than a new root-only reader. fix: discover nested dependency manifests #250 is adding nested manifests there, so workspaces will be covered for free.
• Scoped packages: match names against the manifests. An earlier bare-specifier attempt (fix(drift): resolve scoped packages by bare specifier #217) broke every @types/* package, so please include an @types/* test.
• Item 2: exempt only the project's own name (from package.json, jsr.json or deno.json).
• Items 5 and 6: keep them narrow. Exempt only files that really live under .mex/local/, and only ./x.js specifiers in prose about imports. A real missing path must still be reported.

Thanks for picking this up!

[Otto-Deviant1904]

Thanks a lot for the detailed pointers! I'll pick this up on latest main and keep the scope tight like you described. Really appreciate the guidance on this one.