@hominis/fireforge 0.16.5 → 0.18.0

package/dist/src/commands/furnace/rename.js

@@ -3,9 +3,9 @@ import { readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { getProjectPaths, loadConfig } from '../../core/config.js';
 import { getFurnacePaths, loadFurnaceConfig, updateFurnaceState, writeFurnaceConfig, } from '../../core/furnace-config.js';
-import { isComponentSourceFile, resolveFtlDir, tagNameToClassName, } from '../../core/furnace-constants.js';
+import { isComponentSourceFile, resolveFtlChromeSubPath, resolveFtlDir, resolveFtlLocaleJarMnPath, tagNameToClassName, } from '../../core/furnace-constants.js';
 import { recordFurnaceRollbackFailure, runFurnaceMutation } from '../../core/furnace-operation.js';
-import { addCustomElementRegistration, addJarMnEntries, removeCustomElementRegistration, removeJarMnEntries, } from '../../core/furnace-registration.js';
+import { addCustomElementRegistration, addJarMnEntries, addLocaleFtlJarMnEntry, removeCustomElementRegistration, removeJarMnEntries, removeLocaleFtlJarMnEntry, } from '../../core/furnace-registration.js';
 import { CUSTOM_ELEMENT_TAG_PATTERN, CUSTOM_ELEMENT_TAG_RULES, } from '../../core/furnace-registration-validate.js';
 import { createRollbackJournal, restoreRollbackJournalOrThrow, snapshotDir, snapshotFile, } from '../../core/furnace-rollback.js';
 import { getStoriesDir } from '../../core/furnace-stories.js';
@@ -122,6 +122,94 @@ async function renameTestFiles(engineDir, projectRoot, oldName, newName, journal
         }
     }
 }
+/**
+ * Removes the deployed custom-widget directory at the old target path so
+ * a subsequent `furnace apply` is the single writer of the new name's
+ * deployment. Best-effort: logs a warning but never blocks the rename.
+ *
+ * 2026-04-21 eval: renaming `ff-chip-row` → `ff-chip-stack` registered
+ * and deployed the new name correctly but left `engine/toolkit/content/
+ * widgets/ff-chip-row/` in place. Subsequent `furnace sync` runs could
+ * not clear the stale widget, and packaging would have pulled in both
+ * copies. The snapshot is taken before the remove so the rollback
+ * journal restores the old directory if any later step in
+ * `performRenameMutations` fails.
+ */
+async function removeStaleDeployedComponentDir(engineDir, oldTargetPath, journal) {
+    const oldDeployed = join(engineDir, oldTargetPath);
+    if (!(await pathExists(oldDeployed)))
+        return;
+    try {
+        await snapshotDir(journal, oldDeployed);
+        await removeDir(oldDeployed);
+        info(`Removed stale deployed widget directory: ${oldTargetPath}`);
+    }
+    catch (error) {
+        warn(`Could not remove stale deployed widget directory at ${oldTargetPath}: ${toError(error).message}. Remove it manually if needed.`);
+    }
+}
+/**
+ * Renames the mochikit test scaffold produced by `furnace create
+ * --with-tests` when the default test style is used. The scaffold lives
+ * at `engine/toolkit/content/tests/widgets/test_<name>.html`, and the
+ * accompanying `chrome.toml` entry names the same file. Neither piece
+ * was handled by the pre-0.16.0 rename, so operators were left with a
+ * `test_<old>.html` file that still imported `chrome://global/content/
+ * elements/<old>.mjs` and referenced `customElements.whenDefined("<old>")`
+ * — the test ran against a component that no longer existed under that
+ * name and either failed or (if the old component was still deployed)
+ * passed for the wrong reason.
+ *
+ * Best-effort: individual failures log a warning. The same journal used
+ * for the rest of the rename snapshots every touched file so a later
+ * failure rolls the pair back together.
+ */
+async function renameMochikitTestFiles(engineDir, oldName, newName, journal) {
+    const testDir = join(engineDir, 'toolkit/content/tests/widgets');
+    if (!(await pathExists(testDir)))
+        return;
+    const oldTestFileName = `test_${oldName}.html`;
+    const newTestFileName = `test_${newName}.html`;
+    const oldTestPath = join(testDir, oldTestFileName);
+    const newTestPath = join(testDir, newTestFileName);
+    if (await pathExists(oldTestPath)) {
+        try {
+            await snapshotFile(journal, oldTestPath);
+            const content = await readText(oldTestPath);
+            const updatedContent = content
+                .replace(new RegExp(`chrome://global/content/elements/${escapeRegex(oldName)}\\.mjs`, 'g'), `chrome://global/content/elements/${newName}.mjs`)
+                .replace(new RegExp(`customElements\\.whenDefined\\("${escapeRegex(oldName)}"\\)`, 'g'), `customElements.whenDefined("${newName}")`)
+                .replace(new RegExp(`Test the ${escapeRegex(oldName)} `, 'g'), `Test the ${newName} `)
+                .replace(new RegExp(`add_task\\(async function test_${escapeRegex(oldName.replace(/-/g, '_'))}_defined\\(`, 'g'), `add_task(async function test_${newName.replace(/-/g, '_')}_defined(`)
+                .replace(new RegExp(`"${escapeRegex(oldName)} custom element`, 'g'), `"${newName} custom element`);
+            await writeText(newTestPath, updatedContent);
+            await removeFile(oldTestPath);
+            info(`Renamed mochikit test: ${oldTestFileName} → ${newTestFileName}`);
+        }
+        catch (error) {
+            warn(`Could not rename mochikit test file — ${toError(error).message}. Rename it manually if needed.`);
+        }
+    }
+    // Update `chrome.toml` entry if present. The file may live in the
+    // same widgets/tests directory as the test file itself; upstream
+    // convention places exactly one `chrome.toml` there for all widget
+    // scaffolds.
+    const chromeTomlPath = join(testDir, 'chrome.toml');
+    if (await pathExists(chromeTomlPath)) {
+        try {
+            const toml = await readText(chromeTomlPath);
+            if (toml.includes(`["${oldTestFileName}"]`)) {
+                await snapshotFile(journal, chromeTomlPath);
+                const updated = toml.replace(`["${oldTestFileName}"]`, `["${newTestFileName}"]`);
+                await writeText(chromeTomlPath, updated);
+                info(`Updated chrome.toml: ${oldTestFileName} → ${newTestFileName}`);
+            }
+        }
+        catch (error) {
+            warn(`Could not update widgets chrome.toml — ${toError(error).message}. Update it manually if needed.`);
+        }
+    }
+}
 /**
  * Performs the transactional rename mutation inside a furnace lock.
  */
@@ -129,6 +217,11 @@ async function performRenameMutations(args) {
     const { projectRoot, oldName, newName, oldDir, newDir, isCustom, componentType, config } = args;
     const oldClassName = tagNameToClassName(oldName);
     const newClassName = tagNameToClassName(newName);
+    // Capture the pre-rename deployed target path so we know what to
+    // clean up in the engine tree. `updateConfigForCustomRename` rewrites
+    // `targetPath` in-place once the mutation enters phase 2, so we read
+    // it here while it still points at the old name's deployment.
+    const oldCustomTargetPath = isCustom ? config.custom[oldName]?.targetPath : undefined;
     await runFurnaceMutation(projectRoot, 'rename-rollback', async (ctx) => {
         const journal = createRollbackJournal();
         ctx.registerJournal(journal);
@@ -179,7 +272,8 @@ async function performRenameMutations(args) {
             // 3. Update engine registrations (custom components only)
             if (isCustom && config.custom[newName]?.register && (await pathExists(args.engineDir))) {
                 const ftlDir = resolveFtlDir(config.ftlBasePath);
-                await updateEngineRegistrations(args.engineDir, oldName, newName, newDir, ftlDir, journal);
+                const isLocalized = config.custom[newName].localized;
+                await updateEngineRegistrations(args.engineDir, oldName, newName, newDir, ftlDir, isLocalized, journal);
             }
             // 4. Re-key furnace-state.json checksums from old name to new name
             await rekeyStateChecksums(args.projectRoot, componentType, oldName, newName);
@@ -197,6 +291,23 @@ async function performRenameMutations(args) {
             // 7. Rename test files created by `furnace create --with-tests` (custom only).
             if (isCustom && (await pathExists(args.engineDir))) {
                 await renameTestFiles(args.engineDir, projectRoot, oldName, newName, journal);
+                // Mochikit scaffold + widgets/chrome.toml live in a different
+                // tree than browser.toml-registered browser-chrome tests, so
+                // renameTestFiles doesn't reach them. 2026-04-21 eval: a rename
+                // left `engine/toolkit/content/tests/widgets/test_<old>.html`
+                // and its `chrome.toml` entry pointing at the old name, which
+                // either failed the test run outright or (worse) passed for the
+                // wrong component.
+                await renameMochikitTestFiles(args.engineDir, oldName, newName, journal);
+                // Clear the stale deployed component directory so the next
+                // `furnace apply` is the single writer of the new name's
+                // deployment. Without this, eval runs showed the old widget
+                // still living at `engine/toolkit/content/widgets/<old>/`
+                // alongside the newly-deployed `engine/toolkit/content/
+                // widgets/<new>/`, with no signal to `status` / `verify`.
+                if (oldCustomTargetPath) {
+                    await removeStaleDeployedComponentDir(args.engineDir, oldCustomTargetPath, journal);
+                }
             }
             info(`Renamed ${componentType} component: ${oldName} → ${newName}`);
         }
@@ -248,7 +359,7 @@ async function rekeyStateChecksums(projectRoot, componentType, oldName, newName)
         return result;
     });
 }
-async function updateEngineRegistrations(engineDir, oldName, newName, newDir, ftlDir, journal) {
+async function updateEngineRegistrations(engineDir, oldName, newName, newDir, ftlDir, isLocalized, journal) {
     const customElementsPath = join(engineDir, 'toolkit/content/customElements.js');
     const jarMnPath = join(engineDir, 'toolkit/content/jar.mn');
     if (await pathExists(customElementsPath)) {
@@ -276,6 +387,24 @@ async function updateEngineRegistrations(engineDir, oldName, newName, newDir, ft
         await writeText(newFtlPath, ftlContent);
         await removeFile(oldFtlPath);
     }
+    // Re-wire the locale jar.mn chrome registration when the component is
+    // localized. Before this, `updateEngineRegistrations` renamed the .ftl
+    // file on disk but left the locale jar.mn pointing at
+    // `locale/.../${oldName}.ftl`, so `furnace validate` passed while the
+    // engine still carried a stale registration for the now-missing file
+    // (eval finding: stale old-name registration after rename).
+    if (isLocalized) {
+        const chromeSubPath = resolveFtlChromeSubPath(ftlDir);
+        const localeJarRel = resolveFtlLocaleJarMnPath(ftlDir);
+        if (chromeSubPath !== undefined && localeJarRel !== undefined) {
+            const localeJarAbs = join(engineDir, localeJarRel);
+            if (await pathExists(localeJarAbs)) {
+                await snapshotFile(journal, localeJarAbs);
+                await removeLocaleFtlJarMnEntry(engineDir, localeJarRel, oldName, chromeSubPath);
+                await addLocaleFtlJarMnEntry(engineDir, localeJarRel, newName, chromeSubPath);
+            }
+        }
+    }
 }
 /**
  * Renames a custom or override component atomically: updates directory name,

package/dist/src/commands/lint.js

@@ -1,12 +1,13 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { stat } from 'node:fs/promises';
 import { join } from 'node:path';
+import { isBrandingManagedPath } from '../core/branding.js';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { getStatusWithCodes, hasChanges, isGitRepository } from '../core/git.js';
 import { getAllDiff, getDiffForFilesAgainstHead } from '../core/git-diff.js';
-import { getModifiedFilesInDir, getUntrackedFiles, getUntrackedFilesInDir, } from '../core/git-status.js';
+import { expandUntrackedDirectoryEntries, getModifiedFilesInDir, getUntrackedFiles, getUntrackedFilesInDir, getWorkingTreeStatus, } from '../core/git-status.js';
 import { extractAffectedFiles } from '../core/patch-apply.js';
-import { buildPatchQueueContext, lintExportedPatch, lintPatchQueue } from '../core/patch-lint.js';
+import { buildPatchQueueContext, lintExportedPatch, lintPatchQueue, resolvePatchSizeTier, } from '../core/patch-lint.js';
 import { collectDiffFilePaths, tagLintIssues } from '../core/patch-lint-diff-tag.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { GeneralError } from '../errors/base.js';
@@ -22,8 +23,19 @@ import { stripEnginePrefix } from '../utils/paths.js';
  * per-function LOC budget as the command grows; the two file-mode and
  * aggregate-mode branches share no state with the post-lint reporting
  * pipeline, so the split is a pure rename rather than a refactor.
+ *
+ * When `binaryName` is provided, the aggregate-mode branch (no
+ * explicit file list) excludes paths under `browser/branding/<binaryName>/`
+ * from the diff. `status` classifies those paths as `branding` —
+ * tool-managed material the operator did not author directly — and
+ * the 2026-04-21 eval (Finding #2) reported that `fireforge lint` on
+ * a fresh project immediately failed `large-patch-lines` /
+ * `large-patch-files` / `missing-license-header` on the generated
+ * branding tree. File-list mode (explicit paths) preserves the
+ * previous behaviour: passing a branding file explicitly still lints
+ * it, so operators who need to audit branding content can do so.
  */
-async function resolveLintDiff(engineDir, files) {
+async function resolveLintDiff(engineDir, files, binaryName) {
     if (files.length > 0) {
         const collectedFiles = new Set();
         let fileStatuses;
@@ -83,6 +95,47 @@ async function resolveLintDiff(engineDir, files) {
         outro('Nothing to lint');
         return null;
     }
+    // Aggregate-mode branding exclusion. A fresh-setup workspace (after
+    // `fireforge setup` + `download` + `bootstrap` + `build`) carries a
+    // large tool-managed branding diff that the operator did not
+    // author; running the default lint against it fires size and
+    // license-header rules on content that was never intended to
+    // survive in the patch queue as-is. The exclusion mirrors the
+    // `branding` bucket in `fireforge status` so the two views stay
+    // consistent.
+    //
+    // `expandUntrackedDirectoryEntries` promotes collapsed `?? dir/`
+    // status rows to individual file entries before the diff pass.
+    // Without it, a patch that introduces a new directory shows up as
+    // `?? browser/modules/<fork>/` and `getDiffForFilesAgainstHead`
+    // crashed with EISDIR reading the directory as if it were a file
+    // (eval finding: aggregate lint unusable on a real imported queue).
+    if (binaryName) {
+        const rawStatus = await getWorkingTreeStatus(engineDir);
+        const expanded = await expandUntrackedDirectoryEntries(engineDir, rawStatus);
+        const allPaths = [...new Set(expanded.map((entry) => entry.file))];
+        const nonBrandingPaths = allPaths.filter((path) => !isBrandingManagedPath(path, binaryName));
+        const excludedCount = allPaths.length - nonBrandingPaths.length;
+        if (excludedCount > 0) {
+            info(`Excluded ${excludedCount} tool-managed branding file${excludedCount === 1 ? '' : 's'} from lint. Pass the path explicitly or use \`fireforge lint <path>\` to include them.`);
+        }
+        if (nonBrandingPaths.length === 0) {
+            info('No non-branding changes to lint.');
+            outro('Nothing to lint');
+            return null;
+        }
+        const diff = await getDiffForFilesAgainstHead(engineDir, nonBrandingPaths.sort());
+        if (!diff.trim()) {
+            info('No diff content to lint.');
+            outro('Nothing to lint');
+            return null;
+        }
+        return diff;
+    }
+    // Fallback path: no binaryName available (e.g. a legacy caller
+    // without a loaded config). Retain the pre-0.16.0 behaviour of
+    // linting the full diff so the lint surface is at least as broad
+    // as before.
     const diff = await getAllDiff(engineDir);
     if (!diff.trim()) {
         info('No diff content to lint.');
@@ -126,10 +179,15 @@ export async function lintCommand(projectRoot, files, options = {}) {
         await lintPerPatch(projectRoot, paths);
         return;
     }
-    const diff = await resolveLintDiff(paths.engine, files);
+    // Load the config before resolving the diff so we can pass
+    // `binaryName` into the aggregate-mode branding exclusion in
+    // `resolveLintDiff`. The config was previously loaded only after
+    // the diff was resolved; hoisting it is cheap and keeps the two
+    // call sites close together.
+    const config = await loadConfig(projectRoot);
+    const diff = await resolveLintDiff(paths.engine, files, config.binaryName);
     if (diff === null)
         return;
-    const config = await loadConfig(projectRoot);
     const filesAffected = extractAffectedFiles(diff);
     // Build patch queue context once so it can be shared between the
     // per-patch ownership resolver and the cross-patch rules.
@@ -264,7 +322,13 @@ async function lintPerPatch(projectRoot, paths) {
         if (!diff.trim())
             continue;
         const ignore = patch.lintIgnore?.length ? new Set(patch.lintIgnore) : undefined;
-        const patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, ctx, ignore);
+        const decision = resolvePatchSizeTier(existing, patch.tier);
+        if (decision.tier === 'branding') {
+            info(decision.source === 'explicit'
+                ? `${patch.filename}: branding threshold tier applied via patches.json \`tier: "branding"\` opt-in.`
+                : `${patch.filename}: branding threshold tier applied (all files under browser/branding/ plus registration siblings).`);
+        }
+        const patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, ctx, ignore, patch.tier);
         for (const issue of patchIssues) {
             issues.push({ ...issue, file: `${patch.filename} :: ${issue.file}` });
         }

package/dist/src/commands/patch/delete.js

@@ -39,7 +39,10 @@ export async function patchDeleteCommand(projectRoot, identifier, options = {})
     }
     const target = resolvePatchIdentifier(identifier, manifest.patches);
     if (!target) {
-        throw new InvalidArgumentError(`Patch "${identifier}" not found. Available: ${manifest.patches.map((p) => p.filename).join(', ')}`, identifier);
+        const available = manifest.patches
+            .map((p) => p.name && p.name !== p.filename ? `${p.filename} (name: ${p.name})` : p.filename)
+            .join(', ');
+        throw new InvalidArgumentError(`Patch "${identifier}" not found. Accepted identifiers: ordinal (e.g. 2), filename (e.g. 002-ui-foo.patch), or manifest name (e.g. ui-foo). Available: ${available}`, identifier);
     }
     // Build the full queue context once so we can scan each patch's newFiles
     // without re-parsing for the dependency check below.

package/dist/src/commands/patch/reorder.js

@@ -270,7 +270,10 @@ export async function patchReorderCommand(projectRoot, identifier, options = {})
     }
     const target = resolvePatchIdentifier(identifier, manifest.patches);
     if (!target) {
-        throw new InvalidArgumentError(`Patch "${identifier}" not found. Available: ${manifest.patches.map((p) => p.filename).join(', ')}`, identifier);
+        const available = manifest.patches
+            .map((p) => p.name && p.name !== p.filename ? `${p.filename} (name: ${p.name})` : p.filename)
+            .join(', ');
+        throw new InvalidArgumentError(`Patch "${identifier}" not found. Accepted identifiers: ordinal (e.g. 2), filename (e.g. 002-ui-foo.patch), or manifest name (e.g. ui-foo). Available: ${available}`, identifier);
     }
     const { destinationOrder, anchorFilename } = resolveDestination(target, manifest.patches, options);
     const renameMap = computeRenameMap(manifest.patches, target, destinationOrder);

package/dist/src/commands/re-export-files.js

@@ -75,8 +75,10 @@ export async function reExportFilesInPlace(paths, selectedPatches, options, conf
     // `lintIgnore` threads through so a shrink of an advisory-noisy-but-
     // intentional patch (branding bundle, localised-resource pack) does not
     // have to choose between `--skip-lint` (blunt) and the full rebase path.
+    // `target.tier` threads the explicit branding-threshold opt-in for
+    // the branding patch that also touches a non-allowlisted sibling.
     const ignoreChecks = target.lintIgnore?.length ? new Set(target.lintIgnore) : undefined;
-    await runPatchLint(paths.engine, actualProjectedFiles, projectedDiff, config, options.skipLint, undefined, ignoreChecks);
+    await runPatchLint(paths.engine, actualProjectedFiles, projectedDiff, config, options.skipLint, undefined, ignoreChecks, target.tier);
     // Project the cross-patch context: replace the target entry with its
     // would-be shrunken self (new diff + new newFiles + new
     // modifiedFileAdditions). The projected entry must repopulate both

package/dist/src/commands/re-export.js

@@ -201,8 +201,11 @@ async function reExportSinglePatch(patch, paths, manifest, options, isDryRun, co
     // intentional patch (a cohesive branding bundle, a localised-resource
     // pack) without either `--skip-lint` (too blunt) or falling through to
     // the full `rebase` flow (which internally skips the lint pipeline).
+    // The paired `patch.tier` threads the explicit branding-threshold
+    // opt-in the same way, for the branding patch that also touches a
+    // non-allowlisted registration sibling.
     const ignoreChecks = patch.lintIgnore?.length ? new Set(patch.lintIgnore) : undefined;
-    await runPatchLint(paths.engine, existingFiles, diffContent, config, options.skipLint, undefined, ignoreChecks);
+    await runPatchLint(paths.engine, existingFiles, diffContent, config, options.skipLint, undefined, ignoreChecks, patch.tier);
     if (isDryRun) {
         info(`[dry-run] ${patch.filename}: ${existingFiles.length} file(s)`);
     }

package/dist/src/commands/register.js

@@ -45,6 +45,17 @@ export async function registerCommand(projectRoot, filePath, options = {}) {
     }
     const result = await registerFile(projectRoot, engineRelativePath, options.dryRun, options.after);
     if (options.dryRun) {
+        // 2026-04-21 eval (Finding #8): dry-run always said "Would
+        // register" even when the rule's idempotency check already knew
+        // the entry was present, so automation read the plan as "work to
+        // do" and the following real run then reported "Already
+        // registered". Surface the idempotency decision in dry-run too so
+        // the plan mirrors the real command's outcome.
+        if (result.skipped) {
+            info(`[dry-run] Already registered: ${engineRelativePath} in ${result.manifest}`);
+            outro('Dry run complete');
+            return;
+        }
         info(`[dry-run] Would register ${engineRelativePath}`);
         info(`  manifest: ${result.manifest}`);
         info(`  entry: ${result.entry}`);

package/dist/src/commands/resolve.d.ts

@@ -1,9 +1,33 @@
 import { Command } from 'commander';
 import type { CommandContext } from '../types/cli.js';
+/**
+ * Options accepted by {@link resolveCommand}.
+ */
+export interface ResolveCommandOptions {
+    /**
+     * Skip the interactive "Have you finished fixing the files?"
+     * confirmation prompt and treat the resolution as complete.
+     *
+     * Motivating case (2026-04-21 eval, Finding #18): a scripted or
+     * CI-assisted recovery flow that has already completed the manual
+     * merge step cannot advance through `fireforge resolve` because the
+     * TTY guard refuses non-interactive invocations outright. `--yes`
+     * is the explicit opt-in for those flows: the operator is asserting
+     * they have already done the merge, and the command proceeds
+     * straight to the patch-refresh + state-clear path.
+     *
+     * The guard without `--yes` is preserved — running `resolve` with
+     * no TTY and no `--yes` still refuses so an accidental pipe-into
+     * invocation doesn't silently commit whatever the engine happens
+     * to contain.
+     */
+    yes?: boolean;
+}
 /**
  * Runs the resolve command to fix broken patches.
  * @param projectRoot - Root directory of the project
+ * @param options - Optional flags; see {@link ResolveCommandOptions}.
  */
-export declare function resolveCommand(projectRoot: string): Promise<void>;
+export declare function resolveCommand(projectRoot: string, options?: ResolveCommandOptions): Promise<void>;
 /** Registers the resolve command on the CLI program. */
 export declare function registerResolve(program: Command, { getProjectRoot, withErrorHandling }: CommandContext): void;

package/dist/src/commands/resolve.js

@@ -15,8 +15,9 @@ import { error as logError, info, intro, isCancel, outro, spinner, success, } fr
 /**
  * Runs the resolve command to fix broken patches.
  * @param projectRoot - Root directory of the project
+ * @param options - Optional flags; see {@link ResolveCommandOptions}.
  */
-export async function resolveCommand(projectRoot) {
+export async function resolveCommand(projectRoot, options = {}) {
     intro('FireForge Resolve');
     const paths = getProjectPaths(projectRoot);
     const state = await loadState(projectRoot);
@@ -35,17 +36,25 @@ export async function resolveCommand(projectRoot) {
     if (!(await isGitRepository(paths.engine))) {
         throw new GeneralError('Engine directory is not a git repository. Run "fireforge download" to initialize.');
     }
-    if (!process.stdin.isTTY) {
-        throw new GeneralError('Cannot run "fireforge resolve" in non-interactive mode. Use a terminal with TTY support.');
+    // Non-interactive mode requires an explicit `--yes` to proceed: the
+    // operator is asserting the manual merge is complete and the
+    // refreshed diff is the one to record. Without `--yes`, an accidental
+    // pipe / CI shell could otherwise commit whatever the engine
+    // currently contains. 2026-04-21 eval (Finding #18): a scripted
+    // recovery flow was dead-ended by the unconditional TTY refusal.
+    if (!process.stdin.isTTY && !options.yes) {
+        throw new GeneralError('Cannot run "fireforge resolve" in non-interactive mode. Use a terminal with TTY support, or pass "--yes" to skip the interactive confirmation once the manual merge is complete.');
     }
-    const finished = await confirm({
-        message: 'Have you finished manually fixing the files in engine/?',
-        initialValue: true,
-    });
-    if (isCancel(finished) || !finished) {
-        info('Please fix the conflicts and run "fireforge resolve" again.');
-        outro('Resolution paused');
-        return;
+    if (!options.yes) {
+        const finished = await confirm({
+            message: 'Have you finished manually fixing the files in engine/?',
+            initialValue: true,
+        });
+        if (isCancel(finished) || !finished) {
+            info('Please fix the conflicts and run "fireforge resolve" again.');
+            outro('Resolution paused');
+            return;
+        }
     }
     const manifest = await loadPatchesManifest(paths.patches);
     if (!manifest) {
@@ -138,7 +147,7 @@ export async function resolveCommand(projectRoot) {
         });
         s.stop(`Updated ${patchFilename}`);
         success('Patch updated successfully and resolution state cleared.');
-        info('Run "fireforge import" to apply the remaining patches.');
+        info('Patch updated. Run "fireforge import" next to resume the queue from this point — resolve only refreshes the one broken patch, it does not continue applying the remaining patches itself.');
         outro('Resolution complete');
     }
     catch (error) {
@@ -151,9 +160,10 @@ export async function resolveCommand(projectRoot) {
 export function registerResolve(program, { getProjectRoot, withErrorHandling }) {
     program
         .command('resolve')
-        .description('Update a broken patch with manual fixes and continue')
-        .action(withErrorHandling(async () => {
-        await resolveCommand(getProjectRoot());
+        .description('Update a broken patch with manual fixes (then run "fireforge import" to resume the queue)')
+        .option('-y, --yes', 'Skip the interactive confirmation prompt. Use for non-interactive automation flows (CI, scripted recovery) after the manual merge is complete.')
+        .action(withErrorHandling(async (options) => {
+        await resolveCommand(getProjectRoot(), options);
     }));
 }
 //# sourceMappingURL=resolve.js.map