fix(scanner): aliased Python imports resolve; declared npm packages and "*" paths keys are not unresolved project imports

[JordanCoin]

Pre-release smoke on main 30b89d7 found two wrong answers in the unresolved-project-import tally (#204, surfaced as Coverage.Issues since #211). Both flipped a clean repo to partial and listed imports as missing that are not.

Before / after on real repositories

repo	before	after
openclaw (TS)	TypeScript: 3732 of 14595 project-relative imports did not resolve to a file; ... (.pi/extensions/diff.ts -> @mariozechner/pi-coding-agent, ...)	TypeScript: 2 of 10615 project-relative imports did not resolve to a file; ... (src/auto-reply/...security.test.ts -> ../templating.js, src/telegram/draft-chunking.test.ts -> ../../config/config.js)
docling (Python)	Python: 3 of 1215 ... (tests/test_backend_msword.py -> docling.backend.msword_backend as msword_backend_module, ...), 1184 deps	no note, coverage complete, 1185 deps
gumroad (TS)	TypeScript: 10 of 3671 ...	unchanged (see below)

The two openclaw remainders are genuine: src/auto-reply/*.test.ts -> ../templating.js names src/templating.ts, which does not exist (the file is src/auto-reply/templating.ts); src/telegram/*.test.ts -> ../../config/config.js names a repo-root config/config.js, which does not exist (the file is src/config/config.ts).

Causes

1. openclaw's tsconfig.json has paths: {"*": [...]}. The alias test did a prefix match on paths keys, and the empty prefix matched every bare specifier, so declared npm packages were "project-looking". Now a paths key with no literal prefix before * is never an alias, and a specifier whose package name (@scope/name or first segment) is in the nearest package.json's dependencies/devDependencies/peerDependencies/optionalDependencies is external. The JS workspace resolver already parses every package.json; it now keeps those names.
2. ast-grep's import $PATH captures pkg.mod as alias whole, so the resolver looked up the aliased text and found nothing: every aliased Python import was a missing edge, and the tally echoed the alias text. The alias is stripped once, at extraction, so resolver and tally cannot diverge.

gumroad: not this bug

$app/* is a real tsconfig alias there. Of the 10 misses, 7 target app/javascript/json_schemas/*, which is git-ignored generated output absent on disk (genuine), and 3 are resolver gaps outside this change: $app/types/user names types/user.d.ts (declaration file, no .d.ts candidate in the extension list) and ./inertia from packs/base.ts names tracked packs/inertia.js (TS importer, JS sibling). Both deserve their own issue.

Tests

TestDeclaredPackagesAreNotUnresolvedProjectImports and TestPythonImportAsAliasResolves in scanner/unresolved_false_positive_test.go; both failed before the fix (3 issues instead of 1; imports = [], want pkg/mod.py). go build ./... && go test ./... && gofmt -l . clean.

Not changed: node_modules on disk is not consulted (package.json is the declaration; a package installed but undeclared stays a reported miss); import a, b multi-module Python imports; the two gumroad resolver gaps.

Refs #183
Refs #137

🤖 Generated with Claude Code

https://claude.ai/code/session_01NRaBgKRAZMX9hjbkkefA7T

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.