devrites 3.0.7 → 3.2.0

package/engine/internal/lib/observability_test.go

@@ -0,0 +1,358 @@
+package lib
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/devrites/devrites/internal/reason"
+	"github.com/devrites/devrites/internal/state"
+)
+
+const observabilityOtherRunID = "drv-run-v1:fedcba9876543210fedcba9876543210"
+
+func makeObservabilityWorkspace(t *testing.T) (string, string) {
+	t.Helper()
+	root := filepath.Join(t.TempDir(), ".devrites")
+	work := filepath.Join(root, "work", "demo")
+	if err := os.MkdirAll(work, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "ACTIVE"), []byte("demo\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return root, work
+}
+
+func appendObservabilityEvent(
+	t *testing.T,
+	root, runID, timestamp, name string,
+	boundary EventBoundary,
+	reasonID reason.ID,
+	outcome EventOutcome,
+	phase state.Phase,
+) EventV1 {
+	t.Helper()
+	event := NewEventV1(boundary, name, reasonID)
+	event.TS = timestamp
+	event.RunID = runID
+	event.RootSource = RootSourceExplicit
+	event.Workspace = ".devrites/work/demo"
+	event.PhaseBefore = phase
+	event.PhaseAfter = phase
+	event.Outcome = outcome
+	event.Host = HostCodex
+	if err := AppendEventV1(root, event); err != nil {
+		t.Fatal(err)
+	}
+	return event
+}
+
+func TestTimelineReportAnswersWorkflowQuestionsWithoutRawText(t *testing.T) {
+	root, _ := makeObservabilityWorkspace(t)
+	legacy := `{"ts":"2026-07-23T11:59:00Z","event":"auq","question":"PRIVATE_QUESTION","answer":"PRIVATE_ANSWER"}` + "\n"
+	if err := os.WriteFile(
+		filepath.Join(root, "timeline.jsonl"),
+		[]byte(legacy+"not-json\n"),
+		0o644,
+	); err != nil {
+		t.Fatal(err)
+	}
+
+	start := appendObservabilityEvent(t, root, testRunID, "2026-07-23T12:00:00Z",
+		"run-started", BoundaryAgentDispatch, reason.RootSelected, OutcomeRecorded, state.PhaseSpec)
+	start.ExecutionMode = ExecutionNamed
+	start.GuardStrength = GuardObserved
+	rewriteLastObservabilityEvent(t, root, start)
+
+	appendObservabilityEvent(t, root, testRunID, "2026-07-23T12:01:00Z",
+		"retry", BoundaryAgentDispatch, reason.AgentResultMalformed, OutcomeWarning, state.PhaseBuild)
+	appendObservabilityEvent(t, root, testRunID, "2026-07-23T12:02:00Z",
+		"readiness", BoundaryLifecycleGate, reason.GateReadinessMissing, OutcomeBlocked, state.PhaseBuild)
+	appendObservabilityEvent(t, root, testRunID, "2026-07-23T12:03:00Z",
+		"run-interrupted", BoundaryHookGuard, reason.HookStopUnsurfacedHumanGate, OutcomeBlocked, state.PhaseBuild)
+	appendObservabilityEvent(t, root, testRunID, "2026-07-23T12:04:00Z",
+		"run-resumed", BoundaryAgentDispatch, reason.HookAllowApproved, OutcomeAllowed, state.PhaseBuild)
+	appendObservabilityEvent(t, root, testRunID, "2026-07-23T12:05:00Z",
+		"evidence-stale", BoundaryLifecycleGate, reason.GateReadinessMissing, OutcomeWarning, state.PhaseProve)
+	degraded := appendObservabilityEvent(t, root, testRunID, "2026-07-23T12:06:00Z",
+		"degraded", BoundaryAgentDispatch, reason.AgentUnavailable, OutcomeUnavailable, state.PhaseProve)
+	degraded.ExecutionMode = ExecutionGeneric
+	degraded.GuardStrength = GuardUnavailable
+	rewriteLastObservabilityEvent(t, root, degraded)
+	appendObservabilityEvent(t, root, testRunID, "2026-07-23T12:07:00Z",
+		"run-finished", BoundaryLifecycleGate, reason.GateSealMissing, OutcomeBlocked, state.PhaseSeal)
+
+	var stdout, stderr bytes.Buffer
+	if code := Timeline(root, []string{"report", "--run", testRunID, "--json"}, &stdout, &stderr); code != 0 {
+		t.Fatalf("report code=%d stderr=%q", code, stderr.String())
+	}
+	var report observabilityReport
+	if err := json.Unmarshal(stdout.Bytes(), &report); err != nil {
+		t.Fatal(err)
+	}
+	if report.Schema != observabilityReportSchema || report.Events != 8 ||
+		!report.TraceStarted || !report.TraceFinished || report.DurationSeconds != 420 {
+		t.Fatalf("trace summary=%+v", report)
+	}
+	if report.Retries != 1 || report.HumanWaits != 1 ||
+		report.Interruptions != 1 || report.Resumes != 1 ||
+		report.LinkedResumes != 1 || report.OpenInterruptions != 0 {
+		t.Fatalf("recovery summary=%+v", report)
+	}
+	if report.LastFailedGateReason != reason.GateSealMissing ||
+		report.LastFailedGatePhase != state.PhaseSeal ||
+		report.StaleEvidence != 1 || report.Degradations != 1 ||
+		report.FinalOutcome != string(OutcomeBlocked) {
+		t.Fatalf("gate/outcome summary=%+v", report)
+	}
+	if report.PhaseDurations[string(state.PhaseSpec)] != 60 ||
+		report.PhaseDurations[string(state.PhaseBuild)] != 240 ||
+		report.PhaseDurations[string(state.PhaseProve)] != 120 {
+		t.Fatalf("phase durations=%v", report.PhaseDurations)
+	}
+	if report.TelemetryRead.LegacyIgnored != 1 || report.TelemetryRead.CorruptIgnored != 1 {
+		t.Fatalf("compatibility summary=%+v", report.TelemetryRead)
+	}
+	if strings.Contains(stdout.String(), "PRIVATE_QUESTION") ||
+		strings.Contains(stdout.String(), "PRIVATE_ANSWER") {
+		t.Fatalf("report exposed legacy raw text: %s", stdout.String())
+	}
+}
+
+// appendObservabilityEvent writes both telemetry owners. Tests occasionally
+// need to change typed fields after construction, so replace only the final
+// matching row in each owner with another validated v1 row.
+func rewriteLastObservabilityEvent(t *testing.T, root string, event EventV1) {
+	t.Helper()
+	if err := ValidateEventV1(event); err != nil {
+		t.Fatal(err)
+	}
+	encoded, err := json.Marshal(event)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{
+		filepath.Join(root, "timeline.jsonl"),
+		filepath.Join(root, "work", "demo", "events.jsonl"),
+	} {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		lines := bytes.Split(bytes.TrimSuffix(data, []byte("\n")), []byte("\n"))
+		lines[len(lines)-1] = encoded
+		if err := os.WriteFile(path, append(bytes.Join(lines, []byte("\n")), '\n'), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func TestTimelineReportBoundsTailAndDegradesOnOversizedRows(t *testing.T) {
+	root, _ := makeObservabilityWorkspace(t)
+	event := appendObservabilityEvent(t, root, testRunID, "2026-07-23T12:00:00Z",
+		"run-started", BoundaryAgentDispatch, reason.RootSelected, OutcomeRecorded, state.PhaseBuild)
+	encoded, err := json.Marshal(event)
+	if err != nil {
+		t.Fatal(err)
+	}
+	prefix := bytes.Repeat([]byte("PRIVATE_OLD_DATA"), int(telemetryTailBytes/16)+100)
+	data := append(prefix, '\n')
+	data = append(data, encoded...)
+	data = append(data, '\n')
+	if err := os.WriteFile(filepath.Join(root, "timeline.jsonl"), data, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	events, stats := readTelemetryTail(filepath.Join(root, "timeline.jsonl"))
+	if len(events) != 1 || !stats.TailTruncated || stats.ReadDegraded {
+		t.Fatalf("bounded tail events=%d stats=%+v", len(events), stats)
+	}
+
+	data = append(encoded, '\n')
+	data = append(data, bytes.Repeat([]byte("x"), telemetryMaxLineBytes+1)...)
+	data = append(data, '\n')
+	if err := os.WriteFile(filepath.Join(root, "timeline.jsonl"), data, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if code := Timeline(root, []string{"report", "--run", testRunID, "--json"}, &stdout, &stderr); code != 0 {
+		t.Fatalf("oversized report code=%d stderr=%q", code, stderr.String())
+	}
+	var report observabilityReport
+	if err := json.Unmarshal(stdout.Bytes(), &report); err != nil {
+		t.Fatal(err)
+	}
+	if report.Events != 1 || !report.TelemetryRead.ReadDegraded {
+		t.Fatalf("oversized row did not degrade report only: %+v", report)
+	}
+}
+
+func TestTelemetryAppendStopsAtLocalStorageBound(t *testing.T) {
+	root, _ := makeObservabilityWorkspace(t)
+	path := filepath.Join(root, "timeline.jsonl")
+	if err := os.WriteFile(path, bytes.Repeat([]byte("x"), int(telemetryMaxStorageBytes)), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	before, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	event := NewEventV1(BoundaryAgentDispatch, "run-started", reason.RootSelected)
+	event.TS = "2026-07-23T12:00:00Z"
+	event.RunID = testRunID
+	event.RootSource = RootSourceExplicit
+	event.Workspace = ".devrites/work/demo"
+	event.Outcome = OutcomeRecorded
+	if err := AppendEventV1(root, event); err == nil ||
+		!strings.Contains(err.Error(), "retention bound") {
+		t.Fatalf("bounded append err=%v", err)
+	}
+	after, err := os.Stat(path)
+	if err != nil || after.Size() != before.Size() {
+		t.Fatalf("bounded append changed file: before=%d after=%d err=%v", before.Size(), after.Size(), err)
+	}
+}
+
+func TestTimelinePurgeTouchesOnlySelectedV1Telemetry(t *testing.T) {
+	root, work := makeObservabilityWorkspace(t)
+	appendObservabilityEvent(t, root, testRunID, "2026-07-23T12:00:00Z",
+		"run-started", BoundaryAgentDispatch, reason.RootSelected, OutcomeRecorded, state.PhaseBuild)
+	appendObservabilityEvent(t, root, observabilityOtherRunID, "2026-07-23T13:00:00Z",
+		"run-started", BoundaryAgentDispatch, reason.RootSelected, OutcomeRecorded, state.PhaseBuild)
+	legacy := []byte(`{"ts":"2026-07-23T10:00:00Z","event":"auq","question":"legacy stays"}` + "\n")
+	for _, path := range []string{
+		filepath.Join(root, "timeline.jsonl"),
+		filepath.Join(work, "events.jsonl"),
+	} {
+		f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0o644)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := f.Write(legacy); err != nil {
+			f.Close()
+			t.Fatal(err)
+		}
+		if err := f.Close(); err != nil {
+			t.Fatal(err)
+		}
+	}
+	correctness := map[string][]byte{
+		"state.md":                []byte("state-sentinel\n"),
+		"questions.md":            []byte("questions-sentinel\n"),
+		"evidence.md":             []byte("evidence-sentinel\n"),
+		"recovery-attempts.jsonl": []byte("recovery-sentinel\n"),
+		"decisions.md":            []byte("decisions-sentinel\n"),
+		".wright-allowlist":       []byte("scope-sentinel\n"),
+	}
+	for name, content := range correctness {
+		if err := os.WriteFile(filepath.Join(work, name), content, 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	var stdout, stderr bytes.Buffer
+	if code := Timeline(root, []string{"purge", "--run", testRunID}, &stdout, &stderr); code != 0 {
+		t.Fatalf("purge code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "purged 2 v1 event(s) from 2 telemetry file(s)") {
+		t.Fatalf("purge summary=%q", stdout.String())
+	}
+	for _, path := range []string{
+		filepath.Join(root, "timeline.jsonl"),
+		filepath.Join(work, "events.jsonl"),
+	} {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if strings.Contains(string(data), testRunID) ||
+			!strings.Contains(string(data), observabilityOtherRunID) ||
+			!strings.Contains(string(data), "legacy stays") {
+			t.Fatalf("purge scope wrong for %s: %s", path, data)
+		}
+	}
+	for name, content := range correctness {
+		got, err := os.ReadFile(filepath.Join(work, name))
+		if err != nil || !bytes.Equal(got, content) {
+			t.Fatalf("purge changed correctness file %s: got=%q err=%v", name, got, err)
+		}
+	}
+
+	stdout.Reset()
+	stderr.Reset()
+	if code := Timeline(root, []string{"purge", "--before", "2026-07-23T14:00:00Z"}, &stdout, &stderr); code != 0 {
+		t.Fatalf("time purge code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+	for _, path := range []string{
+		filepath.Join(root, "timeline.jsonl"),
+		filepath.Join(work, "events.jsonl"),
+	} {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if strings.Contains(string(data), observabilityOtherRunID) ||
+			!strings.Contains(string(data), "legacy stays") {
+			t.Fatalf("time purge interpreted legacy or kept old v1 row in %s: %s", path, data)
+		}
+	}
+}
+
+func TestTimelinePurgeSelectorsAndSymlinkSafety(t *testing.T) {
+	root, _ := makeObservabilityWorkspace(t)
+	var stdout, stderr bytes.Buffer
+	if code := Timeline(root, []string{"purge"}, &stdout, &stderr); code != 2 {
+		t.Fatalf("selector-free purge code=%d", code)
+	}
+
+	outside := filepath.Join(t.TempDir(), "outside.jsonl")
+	if err := os.WriteFile(outside, []byte("outside-sentinel\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(root, "timeline.jsonl")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	stdout.Reset()
+	stderr.Reset()
+	if code := Timeline(root, []string{"purge", "--before", "2026-07-24T00:00:00Z"}, &stdout, &stderr); code != 1 {
+		t.Fatalf("symlink purge code=%d stderr=%q", code, stderr.String())
+	}
+	got, err := os.ReadFile(outside)
+	if err != nil || string(got) != "outside-sentinel\n" {
+		t.Fatalf("purge followed telemetry symlink: got=%q err=%v", got, err)
+	}
+}
+
+func TestProgressShowsV1FactsWithoutChangingLifecycle(t *testing.T) {
+	root, work := makeObservabilityWorkspace(t)
+	stateText := "| Key | Value |\n| --- | --- |\n| phase | build |\n| status | running |\n"
+	if err := os.WriteFile(filepath.Join(work, "state.md"), []byte(stateText), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	event := appendObservabilityEvent(t, root, testRunID, time.Now().UTC().Format(time.RFC3339),
+		"readiness", BoundaryLifecycleGate, reason.GateReadinessMissing, OutcomeBlocked, state.PhaseBuild)
+	event.ExecutionMode = ExecutionGeneric
+	rewriteLastObservabilityEvent(t, root, event)
+
+	before, err := os.ReadFile(filepath.Join(work, "state.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var stdout bytes.Buffer
+	if code := Progress(root, []string{"demo"}, &stdout, &bytes.Buffer{}); code != 0 {
+		t.Fatalf("progress code=%d", code)
+	}
+	for _, want := range []string{"rite-build", "Obs   obs mode:generic", "gate:DRV-GATE-READINESS-MISSING", "degraded:1"} {
+		if !strings.Contains(stdout.String(), want) {
+			t.Fatalf("progress missing %q:\n%s", want, stdout.String())
+		}
+	}
+	after, err := os.ReadFile(filepath.Join(work, "state.md"))
+	if err != nil || !bytes.Equal(before, after) {
+		t.Fatalf("observability display changed lifecycle state: err=%v", err)
+	}
+}

package/engine/internal/lib/packageexistence.go

@@ -1,14 +1,12 @@
 package lib
 
 import (
-	"bytes"
 	"encoding/json"
 	"fmt"
 	"go/parser"
 	"go/token"
 	"io"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"regexp"
 	"sort"
@@ -20,6 +18,8 @@ import (
 // the standard parser, and Python/Rust use their import declaration syntax.
 var (
 	quotedModule  = regexp.MustCompile(`\b(?:from|import|require)[[:space:]]*(?:\([[:space:]]*)?['"]([^'"]+)['"]`)
+	cssImport     = regexp.MustCompile(`(?i)@import[[:space:]]+(?:url\([[:space:]]*)?(?:['"]([^'"]+)['"]|([^[:space:]);]+))`)
+	remoteImport  = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9+.-]*:`)
 	pythonImport  = regexp.MustCompile(`^\+?[[:space:]]*import[[:space:]]+([A-Za-z0-9_./-]+)`)
 	pythonFrom    = regexp.MustCompile(`^\+?[[:space:]]*from[[:space:]]+([A-Za-z0-9_./-]+)[[:space:]]+import\b`)
 	rustUse       = regexp.MustCompile(`^[[:space:]]*(?:pub(?:\([^)]*\))?[[:space:]]+)?use[[:space:]]+(?:::)?(?:r#)?([A-Za-z_][A-Za-z0-9_]*)(?:::|[[:space:]]+as\b|[[:space:]]*;)`)
@@ -56,6 +56,7 @@ type packageResolver struct {
 
 var packageResolvers = []packageResolver{
 	{extensions: " .js .jsx .mjs .cjs .ts .tsx .mts .cts .svelte .vue ", extract: quotedModulesFromAddedLines, resolve: resolveJavaScriptImport},
+	{extensions: " .css ", extract: cssModulesFromAddedLines, resolve: resolveCSSImport},
 	{extensions: " .go ", extract: goModulesFromAddedLinesForSource, resolve: resolveGoImport},
 	{extensions: " .py .pyi ", extract: pythonModulesFromAddedLines, resolve: resolvePythonImport},
 	{extensions: " .rs ", extract: rustModulesFromAddedLines, resolve: resolveRustImport},
@@ -63,13 +64,12 @@ var packageResolvers = []packageResolver{
 
 var fallbackPackageResolver = packageResolver{extract: quotedModulesFromAddedLines, resolve: resolveGenericImport}
 
-// PackageExistence catches hallucinated or typo-squatted dependencies: every new
-// third-party import in the slice diff must be DECLARED in a project manifest, not
-// merely imported. It is deterministic and offline: it checks the manifest, not a
-// package registry. The workspace is <root>/features/<slug>.
+// PackageExistence checks that every new third-party import in the slice diff is
+// declared in a project manifest. It works offline and does not query a package
+// registry. The workspace is <root>/features/<slug>.
 //
 //	0  clean, nothing to check, or skipped (not a git repo / no manifest)
-//	2  no active workspace
+//	2  no active workspace or missing/corrupt baseline state
 //	3  an imported package is not declared in any manifest
 func PackageExistence(root string, args []string, stdout, stderr io.Writer) int {
 	slug := slugOrActive(root, args)
@@ -89,12 +89,12 @@ func PackageExistence(root string, args []string, stdout, stderr io.Writer) int
 		fmt.Fprintln(stderr, "package-existence: not a git repo: skipped.")
 		return 0
 	}
-	ref := "HEAD"
-	if b, err := os.ReadFile(filepath.Join(d, ".reconcile-base")); err == nil {
-		if t := strings.TrimSpace(string(b)); t != "" {
-			ref = t
-		}
+	trees, err := captureSliceTreeRange(gitRoot, root, d)
+	if err != nil {
+		fmt.Fprintf(stderr, "package-existence: cannot capture slice range: %v\n", err)
+		return 2
 	}
+	defer trees.cleanup()
 
 	var rootManifests []string
 	for _, m := range manifestFiles {
@@ -104,7 +104,11 @@ func PackageExistence(root string, args []string, stdout, stderr io.Writer) int
 		}
 	}
 
-	imports := extractImportedPackages(gitRoot, ref)
+	imports, err := extractImportedPackages(gitRoot, trees.base, trees.current, trees.env)
+	if err != nil {
+		fmt.Fprintf(stderr, "package-existence: cannot inspect slice imports: %v\n", err)
+		return 2
+	}
 	hasManifest := len(rootManifests) > 0
 	findings := map[string]struct{}{}
 	for _, imported := range imports {
@@ -136,7 +140,7 @@ func PackageExistence(root string, args []string, stdout, stderr io.Writer) int
 		for _, pkg := range packages {
 			fmt.Fprintf(stderr, "  - %s: imported but not declared in any manifest\n", pkg)
 		}
-		fmt.Fprintln(stderr, "An undeclared import is how hallucinated/typo-squatted packages slip in. Confirm the name on the registry before trusting it.")
+		fmt.Fprintln(stderr, "Check each package name in its registry before trusting it. Undeclared imports may be misspelled, typo-squatted, or nonexistent.")
 		return 3
 	}
 	fmt.Fprintln(stdout, "package-existence: OK: every new third-party import is declared in a manifest.")
@@ -144,35 +148,54 @@ func PackageExistence(root string, args []string, stdout, stderr io.Writer) int
 }
 
 // extractImportedPackages retains the source file and raw specifier for each
-// import added by the diff so workspace and alias resolution can use that
-// provenance before the specifier is reduced to a top-level package name.
-func extractImportedPackages(gitRoot, ref string) []importedModule {
-	out, err := exec.Command("git", "-C", gitRoot, "diff", "--name-only", "-z", ref, "--").Output()
+// import introduced between two immutable trees. CSS is parsed from complete
+// baseline/current files so block-comment state from unchanged lines is
+// preserved; other languages retain the established added-line extraction.
+func extractImportedPackages(gitRoot, baseTree, currentTree string, env []string) ([]importedModule, error) {
+	paths, err := changedTreePaths(gitRoot, env, baseTree, currentTree)
 	if err != nil {
-		return nil
+		return nil, err
 	}
+
 	var imports []importedModule
-	for rawPath := range bytes.SplitSeq(out, []byte{0}) {
-		if len(rawPath) == 0 {
-			continue
-		}
-		sourcePath := filepath.Clean(string(rawPath))
-		diff, err := exec.Command("git", "-C", gitRoot, "diff", "--unified=0", ref, "--", sourcePath).Output()
+	for _, sourcePath := range paths {
+		currentSource, currentExists, err := treeFileContent(gitRoot, env, currentTree, sourcePath)
 		if err != nil {
+			return nil, err
+		}
+		if !currentExists {
 			continue
 		}
-		var addedLines []string
-		for _, line := range splitLinesNoTrailing(diff) {
-			if !strings.HasPrefix(line, "+") || strings.HasPrefix(line, "+++") {
-				continue
+
+		var specifiers []string
+		if strings.EqualFold(filepath.Ext(sourcePath), ".css") {
+			baselineSource, _, err := treeFileContent(gitRoot, env, baseTree, sourcePath)
+			if err != nil {
+				return nil, err
+			}
+			specifiers = addedCSSModules(baselineSource, currentSource)
+		} else {
+			diff, err := reconcileGitOutput(
+				gitRoot,
+				env,
+				"diff", "--unified=0", "--no-renames", baseTree, currentTree, "--", sourcePath,
+			)
+			if err != nil {
+				return nil, err
+			}
+			var addedLines []string
+			for _, line := range splitLinesNoTrailing(diff) {
+				if strings.HasPrefix(line, "+") && !strings.HasPrefix(line, "+++") {
+					addedLines = append(addedLines, strings.TrimPrefix(line, "+"))
+				}
 			}
-			addedLines = append(addedLines, strings.TrimPrefix(line, "+"))
+			specifiers = importedModulesFromAddedLines(gitRoot, sourcePath, addedLines)
 		}
-		for _, specifier := range importedModulesFromAddedLines(gitRoot, sourcePath, addedLines) {
+		for _, specifier := range specifiers {
 			imports = append(imports, importedModule{sourcePath: sourcePath, specifier: specifier})
 		}
 	}
-	return imports
+	return imports, nil
 }
 
 func importedModulesFromAddedLines(gitRoot, sourcePath string, lines []string) []string {
@@ -202,6 +225,17 @@ func resolveJavaScriptImport(gitRoot, sourcePath, specifier string) packageResol
 	}
 }
 
+func resolveCSSImport(gitRoot, sourcePath, specifier string) packageResolution {
+	specifier = strings.TrimSpace(specifier)
+	if remoteImport.MatchString(specifier) || strings.HasPrefix(specifier, "//") {
+		return packageResolution{ignored: true}
+	}
+	if cssSourceRelativePathExists(gitRoot, sourcePath, specifier) {
+		return packageResolution{resolved: true}
+	}
+	return resolveJavaScriptImport(gitRoot, sourcePath, specifier)
+}
+
 func resolveGoImport(gitRoot, sourcePath, specifier string) packageResolution {
 	if isGoStandardLibrary(specifier) {
 		return packageResolution{ignored: true}
@@ -228,9 +262,9 @@ func resolveRustImport(gitRoot, sourcePath, specifier string) packageResolution
 	return packageResolution{name: crate, resolved: resolved, manifestFound: manifestFound}
 }
 
-// resolveGenericImport keeps quoted imports in unregistered source types in the
-// shared pipeline. It deliberately fails closed: without ecosystem semantics,
-// text in an unrelated manifest cannot safely prove that an import is declared.
+// resolveGenericImport sends quoted imports from unregistered source types
+// through the shared pipeline. Without ecosystem rules, a nearby manifest is
+// recorded but cannot prove that the import is declared.
 func resolveGenericImport(gitRoot, sourcePath, specifier string) packageResolution {
 	pkg := normalizeImportedPackage(specifier)
 	if pkg == "" {
@@ -250,6 +284,88 @@ func quotedModulesFromAddedLines(_, _ string, lines []string) []string {
 	return modules
 }
 
+func cssModulesFromAddedLines(_, _ string, lines []string) []string {
+	return cssModulesFromSource([]byte(strings.Join(lines, "\n")))
+}
+
+func addedCSSModules(baseline, current []byte) []string {
+	baselineCounts := map[string]int{}
+	for _, module := range cssModulesFromSource(baseline) {
+		baselineCounts[module]++
+	}
+	var added []string
+	for _, module := range cssModulesFromSource(current) {
+		if baselineCounts[module] > 0 {
+			baselineCounts[module]--
+			continue
+		}
+		added = append(added, module)
+	}
+	return added
+}
+
+func cssModulesFromSource(source []byte) []string {
+	activeSource := stripCSSComments(string(source))
+	var modules []string
+	for _, match := range cssImport.FindAllStringSubmatch(activeSource, -1) {
+		if len(match) < 3 {
+			continue
+		}
+		module := match[1]
+		if module == "" {
+			module = match[2]
+		}
+		modules = append(modules, module)
+	}
+	return modules
+}
+
+func stripCSSComments(source string) string {
+	var active strings.Builder
+	active.Grow(len(source))
+	inComment := false
+	for i := 0; i < len(source); {
+		switch {
+		case !inComment && i+1 < len(source) && source[i] == '/' && source[i+1] == '*':
+			inComment = true
+			active.WriteString("  ")
+			i += 2
+		case inComment && i+1 < len(source) && source[i] == '*' && source[i+1] == '/':
+			inComment = false
+			active.WriteString("  ")
+			i += 2
+		case inComment:
+			if source[i] == '\n' {
+				active.WriteByte('\n')
+			} else {
+				active.WriteByte(' ')
+			}
+			i++
+		default:
+			active.WriteByte(source[i])
+			i++
+		}
+	}
+	return active.String()
+}
+
+func cssSourceRelativePathExists(gitRoot, sourcePath, specifier string) bool {
+	localSpecifier := specifier
+	if index := strings.IndexAny(localSpecifier, "?#"); index >= 0 {
+		localSpecifier = localSpecifier[:index]
+	}
+	if localSpecifier == "" {
+		return false
+	}
+	candidate := filepath.Join(
+		gitRoot,
+		filepath.Dir(filepath.FromSlash(sourcePath)),
+		filepath.FromSlash(localSpecifier),
+	)
+	info, err := os.Stat(candidate)
+	return err == nil && !info.IsDir()
+}
+
 func goModulesFromAddedLinesForSource(gitRoot, sourcePath string, lines []string) []string {
 	return goModulesFromAddedLines(filepath.Join(gitRoot, sourcePath), lines)
 }