Report unresolvable imports so completeness never certifies a blind spot

[patchstackdave]

coverage.importsComplete is the one field in the map that licenses a negative conclusion — "the package is not imported, so this vulnerability does not apply". It was computed only from environmental failures (unreadable files, unscannable files, unwalked paths), so a source tree the scanner structurally could not enumerate still reported as complete.

Neither import scanner can see an import whose module is not a literal:

• scanFileImports reads ts.preProcessFile(...).importedFiles, which reports resolved literal specifiers only
• collectFileImports requires a string-literal specifier

So a computed specifier produces no entry at all — the import is not recorded as unresolved, it is simply absent — while every read-and-scan check still passes.

What is now reported

countComputedSpecifiers() tokenises rather than parses. It runs on files deliberately kept out of the AST pass, so it must stay at scanner cost; and a text match would count require inside a comment, which would hold the flag false forever and turn it into noise.

Computed specifiers — require(REGISTRY[kind]), import(name), a template with substitutions, and require("a" + b), which opens with a string literal and is still computed.

Escaped loaders — const r = require, (require)(x), module.exports = require. Once the loader is behind another name, following it needs dataflow this scan does not do, so the gap is reported at the escape rather than at the later call.

Three call forms are distinguished, because the deciding token sits somewhere different in each:

form	callee	qualifier
require(x)	−1	−2
require?.(x)	−2	−3
loader.require(x)	−1	−2 (a dot)

The two mistakes fail in opposite directions and both end in an unchecked negative: missing the optional form leaves the flag true over an import nobody can resolve, while counting a member method makes the flag permanently false for an app that named a method require — and a flag that is always false stops being read.

Deliberate conservatism

An escaped loader counts even when every call through it passes a literal, so a UMD-style wrapper reads as incomplete. This is the accepted direction: it withholds a negative conclusion rather than granting a wrong one. Asked about require only — import legitimately appears without a following paren in every ESM file (import qs from "qs", import.meta.url), and applying the rule there would report a gap for ordinary static imports.

Diagnostics

coverage.importCoverageGaps splits environmental gaps (a re-run in a different context may resolve them) from inherent ones (a permanent property of the source). Collapsed into one number, a reviewer re-runs the scan against something no re-run can change and reads the identical result as a flake.

importsComplete remains the single gate a consumer reads, and any non-zero count makes it false — so the diagnostic can be ignored entirely without ever licensing a wrong negative.

Tests

35 cases in tests/map/computed-specifiers.test.ts, covering both directions: computed and aliased forms detected, and literal/comment/string/member-method/static-import controls not counted.

Mutation-tested rather than assumed — each rule was removed in turn to confirm the tests fail without it: dropping the optional-call shift fails 3, dropping the qualifier check fails 6, removing the escape check fails 6, and extending the escape rule to import fails the static-import controls.

Full suite green; npm run typecheck clean.

[coderbuds]

The extractor now reports inherently unresolvable imports separately from environmental gaps.

🎯 Quality: 99% Elite · 📦 Size: Large — consider splitting if possible

📈 This month: Your 76th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review