fix: avoid path claims for non-path inline code

[miloquinn]

Summary

• Avoid extracting path claims from inline code values that are not filesystem paths
• Covers IP/CIDR values, file extensions, shell commands with path-like arguments, and dotted annotation/config keys
• Adds regression coverage based on the false-positive categories from checkPaths produces false positives for non-path inline code in markdown #79

Why

checkPaths currently treats many backtick-wrapped values as path claims when they contain / or a known extension. In project docs this creates noisy MISSING_PATH errors for Kubernetes/GitOps notes like 192.168.5.0/24, argocd.argoproj.io/sync-wave, sudo ls /var/lib/kubelet/plugins_registry/, or .yaml.

Those are inline code snippets, not files the scaffold depends on.

Testing

• npm test -- test/claims.test.ts
• npm test -- test/checkers.test.ts
• npm run typecheck
• git diff --check

[theDakshJaitly]

Thanks for the focused hardening here. The overall direction makes sense, especially after #80, since ROUTER.md can still contain inline values that look path-like but are not filesystem paths.

I found one false-negative risk before approving: DOTTED_KEY_WITH_SLASH also matches valid root hidden-directory paths like .github/CODEOWNERS and .github/workflows. Those are realistic scaffold references, and this change would stop extracting them as path claims, so checkPaths would no longer validate them.

Could you tighten that matcher so Kubernetes-style dotted annotation/config keys are skipped without excluding .github/... paths? A regression test for .github/CODEOWNERS or .github/workflows would cover it.

[Yashasvi2229]

Thanks for this, and sorry it sat so long.

Your commit is now in main as e430a8c, with your authorship intact — it went in as the first commit of #170, which builds on it to close #107.

The one review point from @theDakshJaitly is addressed there rather than here. DOTTED_KEY_WITH_SLASH allowed the dotted segment to be empty, so alongside argocd.argoproj.io/sync-wave it also matched .github/CODEOWNERS, .github/workflows and .mex/ROUTER.md — which would have dropped mex's own scaffold paths out of checkPaths entirely. Requiring a real character before the dot keeps the Kubernetes-style keys skipped while leaving hidden directories checked, and the regression test he asked for is included.

The rest of #170 is the other half of #107: with the false positives gone from extraction, path checking could be widened from ROUTER.md to all eleven scaffold files. Your four patterns are load-bearing for that — a populated scaffold that scored 54/100 now scores 100/100 while checking eleven times more surface.

Closing this since the commit is merged. Thanks again.