Reduce unresolved import blind spots in modern monorepos

[EgemennSahin]

Problem

The agent repo lab showed that large modern JS/TS monorepos can still have many unresolved non-relative imports. This weakens reachability evidence and can make agentdiff under-explain why a surface is or is not agent-relevant.

Evidence from tested repos

From .agentdiff/agent-repo-lab/latest/report.md:

• langchain-ai/langgraphjs: 253 unresolved non-relative imports.

This is a scanner precision issue for agentdiff. It is not a claim that the external repo has a bug or vulnerability.

Proposed fix

Inspect unresolved import samples and add only high-confidence resolver support where the pattern is common and cheap to resolve.

Possible directions:

• Improve reporting around unresolved import samples so users can see what was skipped.
• Handle additional simple workspace/package export patterns if evidence supports it.
• Keep unresolved package imports from becoming high-risk findings by default.

Acceptance criteria

• npm test passes.
• npm run lab:agent-repos still has 0 crashes.
• The lab report shows unresolved import counts and examples clearly enough to drive follow-up work.
• If resolver support is added, it reduces unresolved imports for at least one cited repo without shelling out to tsc or installing dependencies.

Non-goals

• No full TypeScript compiler integration.
• No dependency installs in external repos.
• No universal package resolver.
• No live model calls.
• No claims that the cited external repo is unsafe.

[EgemennSahin]

Implemented in 32b7f97 and now available through agentdiff-ai/agentdiff@v0.

What changed:

• Added unresolved non-relative import buckets in scan/map output:
  • external_dependency_like
  • workspace_package_like
  • alias_like
  • unknown
• Added capped representative samples per bucket with specifier, importing file, reason, and import statement.
• Updated scan stdout and agent-repo lab reports to show bucket counts and examples.
• Updated lab product-fix logic so external dependency imports no longer inflate unresolved-import urgency.
• Added high-confidence resolver support for:
  • root package self-imports when the root package.json has a name
  • simple workspace package subpath exports such as "./public/*": "./src/tools/*.ts"
  • existing tsconfig/jsconfig path alias support remains intact
• Kept the scope narrow: no dependency installs, no tsc, no universal TypeScript resolver.

Verification:

• npm test passed.
• AGENTDIFF_LAB_INCLUDE_SECONDARY=1 AGENTDIFF_LAB_MAX_REPOS=20 npm run lab passed.
• npm run stranger passed.
• CD passed and moved @v0 to 32b7f97.

Lab before/after:

Before this issue, unresolved imports were a flat count, which made external dependencies look like scanner blind spots:

• mastra-ai/mastra: 485 unresolved non-relative imports
• vercel/ai: 398
• VoltAgent/voltagent: 410
• langchain-ai/langchainjs: 331
• i-am-bee/beeai-framework: 315
• langchain-ai/langgraphjs: 253

After this issue, the lab still has:

• 20/20 repos scanned
• 0 crashes
• 55 useful findings
• 2 noisy findings
• 118 missed signals
• 3/3 useful synthetic PR tests

But unresolved imports are now actionable. Examples:

• mastra-ai/mastra: 485 total = 470 external, 0 workspace, 9 alias, 6 unknown
• langchain-ai/langgraphjs: 253 total = 248 external, 0 workspace, 2 alias, 3 unknown
• langchain-ai/langchainjs: 331 total = 328 external, 0 workspace, 2 alias, 1 unknown
• vercel/ai: 398 total = 250 external, 0 workspace, 147 alias, 1 unknown
• i-am-bee/beeai-framework: 315 total = 197 external, 0 workspace, 117 alias, 1 unknown
• VoltAgent/voltagent: 410 total = 351 external, 3 workspace, 56 alias, 0 unknown

Conclusion:

The original issue is complete: unresolved imports are now evidence instead of an opaque number, and the scanner has a few high-confidence resolver improvements without becoming a universal resolver.

Remaining deeper work should be opened as separate, evidence-specific issues, probably around alias-like imports in vercel/ai, i-am-bee/beeai-framework, and VoltAgent/voltagent if those samples block useful reachability.

Closing this issue.

[EgemennSahin]

Closing as complete for the scoped unresolved-import reporting and high-confidence resolver work.