Fix usage scanner fixture false positives

[MANOJ-80]

Closes #861

Summary

• Exclude example/test/fixture directories from usage scanning.
• Prevent PD001/PD002 from treating fixture/demo imports as root project source usage.
• Add regression coverage at scanner and override context levels.

Verification

npm test -- tests/usage.test.ts tests/overrides/context-builder.test.ts tests/overrides/detectors/pd001.test.ts tests/overrides/detectors/pd002.test.ts --runInBand
npm run build

[Copilot]

Pull request overview

This PR addresses false-positive phantom-dependency findings (notably PD001/PD002 under --check-overrides) by ensuring the usage scanner ignores imports that appear only in example/test/fixture directories, and adds regression tests to lock the behavior in.

Changes:

• Add a usage-scanner–specific exclusion set that extends the shared EXCLUDED_DIRS with examples/, tests/, fixtures/, __tests__/, and __fixtures__/ (plus singular forms).
• Update both scanProjectForPackageUsage and scanAllImports to apply the new usage-specific directory exclusions.
• Add regression tests covering scanner behavior and buildOverrideContext integration to ensure excluded directories don’t influence importedPackageNames.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/usage/scanner.ts	Introduces USAGE_EXCLUDED_DIRS and applies it to directory traversal for both usage-scan entrypoints.
tests/usage.test.ts	Adds regression tests verifying example/test/fixture directories are excluded for both targeted and full import scans.
tests/overrides/context-builder.test.ts	Adds integration coverage ensuring override context import collection ignores excluded directories.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonukapoor]

Thanks @MANOJ-80 - I confirmed the false positive (js-yaml showing as "imported" from example/test files) and your fix clears it. I especially like that you extended EXCLUDED_DIRS into a new local set instead of mutating the shared constant - that shared one also drives multi-folder lockfile discovery, so mutating it would have broken scanning our own examples/nest and examples/analog subprojects. Good instinct.

One thing to sort before merge: the new USAGE_EXCLUDED_DIRS is applied to both scanAllImports() (which feeds PD001/PD002, the target of #861) and scanProjectForPackageUsage() (which feeds --usage/--only-used). #861 was only about the phantom-dependency rules, but this now also affects reachability filtering - so a vulnerable package whose only import lives in a directory named test/example/fixture would report imported: false and get silently dropped under --only-used. In a security tool, silently dropping a real CVE finding is a worse failure than the false positive we are fixing.

There is also a concrete case where it suppresses a legitimate signal: @jest/globals is a real undeclared transitive dependency imported across ~20 of our own test files (a genuine PD002 phantom finding), and excluding tests/ now hides it - exactly the "some of these are real, verify case by case" caution from #861.

Could you either (a) scope the new exclusions to scanAllImports() only, leaving --usage/--only-used untouched, or (b) if extending to usage is intentional, call it out explicitly and add a test through the --only-used path so the tradeoff is deliberate and covered? Everything else - the scoping care, the two tests, the clearer comment - is in good shape. Thanks!

[MANOJ-80]

Thanks, that makes sense. I scoped the new exclusions to scanAllImports() only so the PD001/PD002 path is fixed without changing --usage / --only-used reachability behavior. I also adjusted the usage scanner regression to assert targeted usage scanning still sees imports under example/test/fixture directories.

Verification after rebasing on upstream/main:

npm test -- tests/usage.test.ts tests/overrides/context-builder.test.ts tests/overrides/detectors/pd001.test.ts tests/overrides/detectors/pd002.test.ts --runInBand
npm run build

[sonukapoor]

Confirmed the scoping fix on the re-review: ALL_IMPORTS_EXCLUDED_DIRS is limited to scanAllImports(), the --usage/--only-used path stays on the original EXCLUDED_DIRS, and the new tests prove both sides explicitly. CI is green. Thanks @MANOJ-80.

[sonukapoor]

Merged - thank you @MANOJ-80!