Keep namespaces in dependency source labels

[John-David Dalton (jdalton)]

LLM Description written by Codex:GPT-6

Show npm scopes and Maven groups when identifying which dependency introduced a package or alert.

Root Cause

Ancestor labels omitted the stored namespace. Distinct dependencies such as @one/widget and @two/widget appeared under the same label and could collapse in rendered reports.

Fix

• Build labels from the ancestor's ecosystem, namespace, name, and version.
• Preserve manifest paths, source order, and existing traversal behavior.
• Carry the corrected labels into package and alert JSON and existing report renderers.

Builds on #404. No schema or release changes.

Validation

30 focused tests pass, including real model tests and actual Core/SDK requests against the approved localhost fixture. Scoped lint, test formatting, and diff checks pass. Independent source review found no blockers.

Public Changelog

Preserve package scopes and groups in dependency source labels.

---

Note

Low Risk
Single-path string formatting in provenance labeling with broad test coverage; no API or schema changes.

Overview
Fixes “introduced by” labels for transitive dependencies and alerts so top-level ancestors are identified with their namespace/scope (e.g. npm/@one/widget@1.0.0 vs npm/@two/widget@1.0.0), not bare package names that could collide.

Core.get_source_data now builds ancestor labels from ecosystem, optional namespace, name, and version; manifest paths and traversal order are unchanged. The corrected tuples flow through alert issues, Messages.create_sources, and JSON introduced_by on new_packages / new_alerts.

Adds unit tests for get_source_data and an integration test (diff-scan and streaming fallback) that scoped roots and multi-ancestor transitives serialize correctly.

^{Reviewed by Cursor Bugbot for commit 313bcc1. Configure here.}