refactor(runner): ship the flow's import graph for the run

[Atchyut Preetham Pulavarthi (theonly1me)]

Overview of Changes

qawolf runner run read every shippable file under the working directory. On a project of a few thousand files where a flow reaches five, that is a payload refused at the 30 MiB cap before the run ever starts, so the command was unusable anywhere but a directory holding the flow and nothing else. A run from the QA Wolf app does not do this: it walks the flow's import graph. This makes the CLI walk it too, using the resolver from the previous change.

• Replace the whole-directory read with a breadth-first walk of the import graph from the run's entry point
• Glob once for the set of shippable paths without reading them, so a large project costs one directory walk
• Ship package.json and tsconfig.json whatever the flow imports, since the runner reads dependencies from one and the aliases resolve through the other
• Promote typescript to a runtime dependency and load it lazily, so only a command that walks a graph pays for it
• Take the graph's roots from the caller, so runner run starts at the flow file plus any --lines-file and runner exec --file starts at its own file
• Report an import that resolved to nothing rather than dropping it silently
• Fail the run when a file the graph reaches cannot be read, naming the path
• Move the three file-refusal cases to runFlow.files.test.ts, with no change to what they assert
• Say in references/runner.md what now travels and which import forms are followed
• Cover aliases, cycles, multi-level recursion, extension fallback, npm specifiers, unresolved imports, multiple roots, node_modules, dot directories and symbolic links out of the directory

Testing

bun run typecheck
bun run lint --max-warnings 0
bun run format:check
bun run knip
bun run test

bun test gives 1794 pass 0 fail. The other five give exit 0.

Against a synthetic 303-file workspace whose flow reaches five files, with a deliberately invalid API key so the run stops at the launch call, which is after collection:

• node dist/cli.js runner run src/flows/probe.flow.ts collects and reaches the launch, so the bundled compiler loads. dist/cli.js grows from 7.1 MB to 16.1 MB and now contains createSourceFile.
• dist/qawolf runner run src/flows/probe.flow.ts does the same from the standalone binary, which is the artifact a bundled parser could have broken.
• The compiled binary prints a Bun warning about paths without baseUrl when a project's tsconfig.json omits it. It comes from Bun's own tsconfig handling, not from this code, and the npm bundle does not print it.
• Added lines, excluding bun.lock and snapshots: 321.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d6cefb1b-15d4-4782-88f9-6e419fea403b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}