Search by name only when asked, and only when nothing else answered

[oscarvalenzuelab]

Closes #59.

The bug

$ src2purl /src/package --output-format json     # no --enable-fuzzy
Strategies: Hash Search, Web Search, SCANOSS

exact  0.85  pkg:npm/express@4.18.2  express
fuzzy  0.83  None                    senam5jari-975
fuzzy  0.83  None                    voiti-1xbet-rech-idet-urxfhkrm
fuzzy  0.83  None                    john-wick-4-izle-full-filmis-4khd-izle-...
... seven more

Two hundredths of confidence separate express from npm spam, which is close
enough that --confidence-threshold cannot tell them apart. The spam carries
purl: null, so nothing downstream can act on it either.

Cause

Keyword search matches on the project name, so it answers with whatever else
shares that name. There were two call sites:

• the fuzzy fallback in _find_matches — checked enable_fuzzy_matching
• phase 1 of identify_packages — checked nothing

The second also ran before phase 2's manifest parsing, which is what produces
the exact express match. With --use-swh off (the default) phase 1 finds
nothing, so the search fired on every run, and phase 2 then found express beside
its results.

The flag's help says fuzzy runs "when exact matches fail". Whether they had
failed was not known at that point.

The fix

Both call sites are gone. identify_packages runs the search once, after
everything else has had its turn, when nothing was identified and the flag was
passed — which is what the help already described.

The _find_matches fallback is removed rather than gated, so --use-swh goes
through the same single path. It was calling the same _find_keyword_matches
into the same _process_matches; nothing is lost but the position.

Measured

input	flag	before	after
express	none	1 exact + 10 fuzzy	1 exact
express	--enable-fuzzy	1 exact + 10 fuzzy	1 exact
unidentifiable dir	none	10 fuzzy	0
unidentifiable dir	--enable-fuzzy	10 fuzzy	10 fuzzy

The flag now does what it says in all four.

Tests

122 pass, 7 new, covering both the default and --use-swh routes. No new ruff
findings. orchestrator.py was already unformatted before this change and black
is non-blocking here.

Not in scope

The issue also notes express coming back with "official": false.
is_official_organization checks a hardcoded ~30-entry allowlist in
extractor.py that does not include expressjs, so the field means "in our
known-official list" rather than "is the canonical repository". That is a narrow
definition rather than a defect in this path; widening or replacing that list is
a separate decision.

One behaviour note: the removed inner fallback seeded the search from
dir_candidates[0].path while the single one uses the invocation path. For a
normal project-root run these are the same; they could differ if someone ran
--use-swh --enable-fuzzy on a wrapper directory and relied on the scanner's
top candidate to pick the search term.

[github-actions]

License Check Report

ℹ️ No licenses detected in changed files.