@hominis/fireforge 0.18.0 → 0.18.1

package/dist/src/core/git.js

@@ -1,12 +1,12 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { readdir, stat } from 'node:fs/promises';
 import { join } from 'node:path';
-import { GitError, GitIndexLockError, PatchApplyError } from '../errors/git.js';
+import { GitError, GitIndexingTimeoutError, GitIndexLockError, PatchApplyError, } from '../errors/git.js';
 import { toError } from '../utils/errors.js';
 import { pathExists, removeFile } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
 import { exec } from '../utils/process.js';
-import { configureGitPerformance, ensureGit, git, GIT_ADD_CHUNK_TIMEOUT_MS, GIT_ADD_TIMEOUT_MS, } from './git-base.js';
+import { configureGitPerformance, ensureGit, git, GIT_ADD_CHUNK_TIMEOUT_ENV_VAR, GIT_ADD_CHUNK_TIMEOUT_MS, GIT_ADD_TIMEOUT_MS, } from './git-base.js';
 import { getWorkingTreeStatus } from './git-status.js';
 // ── Functions that remain in this file ──
 /**
@@ -38,12 +38,22 @@ export async function ensureOriginRemote(dir) {
 const GIT_ADD_ENV = { GIT_INDEX_THREADS: '0' };
 /**
  * Returns true when the error looks like a process killed by the spawn timeout
- * (SIGTERM → exit code 143).
+ * (SIGTERM → exit code 143) OR an AbortError raised by
+ * `AbortSignal.timeout`. The AbortSignal path is the one observed during
+ * the 2026-04-24 eval (Finding 10): Node's `child_process` layer
+ * rejects with an AbortError when the signal fires, so the timeout
+ * detection here needs to recognise that shape too.
  */
 function isTimeoutError(error) {
+    if (error instanceof Error && error.name === 'AbortError')
+        return true;
     if (!(error instanceof GitError))
         return false;
-    return /SIGTERM|timed out|exit code 143/i.test(error.message);
+    if (/SIGTERM|timed out|exit code 143/i.test(error.message))
+        return true;
+    if (error.cause instanceof Error && error.cause.name === 'AbortError')
+        return true;
+    return false;
 }
 /**
  * Removes `.git/index.lock` left behind by a killed git process.
@@ -59,6 +69,12 @@ async function cleanupIndexLock(dir) {
  * Stages every file by walking top-level directories one at a time.
  * This avoids a single monolithic `git add -A` that may time out on
  * very large (~300 K file) trees like Firefox.
+ *
+ * 2026-04-24 eval Finding 10: a chunked pass that hits its own timeout
+ * now raises a typed {@link GitIndexingTimeoutError} rather than the
+ * opaque `AbortError: The operation was aborted` the caller otherwise
+ * saw. The typed error carries the environment-variable override so the
+ * operator can extend the budget and re-run.
  */
 async function stageAllFilesChunked(dir, options = {}) {
     const entries = await readdir(dir, { withFileTypes: true });
@@ -66,21 +82,30 @@ async function stageAllFilesChunked(dir, options = {}) {
         .filter((e) => e.isDirectory() && e.name !== '.git')
         .map((e) => e.name)
         .sort();
+    async function runChunk(args, label) {
+        try {
+            await git(args, dir, {
+                timeout: GIT_ADD_CHUNK_TIMEOUT_MS,
+                env: GIT_ADD_ENV,
+            });
+        }
+        catch (error) {
+            if (isTimeoutError(error)) {
+                throw new GitIndexingTimeoutError('chunked', GIT_ADD_CHUNK_TIMEOUT_MS, GIT_ADD_CHUNK_TIMEOUT_ENV_VAR, error instanceof Error ? error : undefined);
+            }
+            verbose(`Chunked staging failed on ${label}: ${toError(error).message}`);
+            throw error;
+        }
+    }
     for (const dirName of directories) {
         options.onProgress?.(`Staging directory: ${dirName}/...`);
-        await git(['add', '--', dirName], dir, {
-            timeout: GIT_ADD_CHUNK_TIMEOUT_MS,
-            env: GIT_ADD_ENV,
-        });
+        await runChunk(['add', '--', dirName], dirName);
     }
     // Stage any top-level files
     const topLevelFiles = entries.filter((e) => e.isFile()).map((e) => e.name);
     if (topLevelFiles.length > 0) {
         options.onProgress?.('Staging top-level files...');
-        await git(['add', '--', ...topLevelFiles], dir, {
-            timeout: GIT_ADD_CHUNK_TIMEOUT_MS,
-            env: GIT_ADD_ENV,
-        });
+        await runChunk(['add', '--', ...topLevelFiles], 'top-level files');
     }
 }
 /**
@@ -122,11 +147,25 @@ export async function stageAllFiles(dir, options = {}) {
             if (!isTimeoutError(error)) {
                 throw await maybeWrapIndexLockError(dir, error);
             }
-            options.onProgress?.('Monolithic git add timed out; falling back to chunked staging...');
+            // 2026-04-24 eval Finding 10: the fallback transition used to be
+            // an implementation detail invisible to operators watching the
+            // spinner. Emit a loud, one-line banner so non-TTY log scrapers
+            // and TTY operators both see that the monolithic attempt lost and
+            // the chunked pass is starting. This was the missing signal in
+            // the eval log where the heartbeat went quiet for ~600s between
+            // the monolithic timeout and the chunked-pass failure.
+            options.onProgress?.(`Monolithic git add reached the ${Math.round(timeout / 1000)}s timeout; falling back to chunked staging. This pass may take several more minutes on a large tree.`);
         }
         // The killed process may have left an index lock
         await cleanupIndexLock(dir);
-        await stageAllFilesChunked(dir, options);
+        try {
+            await stageAllFilesChunked(dir, options);
+        }
+        catch (error) {
+            if (error instanceof GitIndexingTimeoutError)
+                throw error;
+            throw error;
+        }
     }
     finally {
         if (heartbeatTimer)

package/dist/src/core/mach.d.ts

@@ -168,9 +168,21 @@ export declare function watch(engineDir: string): Promise<number>;
 /**
  * Runs mach watch while preserving stdin and capturing emitted output.
  * @param engineDir - Path to the engine directory
+ * @param options - Optional environment overrides merged into the mach subprocess env
  * @returns Captured output and exit code
- */
-export declare function watchWithOutput(engineDir: string): Promise<MachCommandResult>;
+ *
+ * 2026-04-24 eval Finding 12: the pre-0.18.1 shape accepted no options
+ * and so never forwarded the detected watchman path into the mach
+ * subprocess env. `fireforge watch` could locate `watchman` via PATH
+ * (the probe's `which` succeeded) but the mach subprocess spawned with
+ * the parent's PATH only — on macOS that typically omits
+ * `/opt/homebrew/bin`, so `mach watch` failed at the `watch-project`
+ * subscription step. Accepting `env` here lets the caller prepend the
+ * resolved watchman directory to PATH in a way mach inherits.
+ */
+export declare function watchWithOutput(engineDir: string, options?: {
+    env?: Record<string, string>;
+}): Promise<MachCommandResult>;
 /**
  * Runs mach test with the given test paths.
  * @param engineDir - Path to the engine directory

package/dist/src/core/mach.js

@@ -280,10 +280,20 @@ export async function watch(engineDir) {
 /**
  * Runs mach watch while preserving stdin and capturing emitted output.
  * @param engineDir - Path to the engine directory
+ * @param options - Optional environment overrides merged into the mach subprocess env
  * @returns Captured output and exit code
+ *
+ * 2026-04-24 eval Finding 12: the pre-0.18.1 shape accepted no options
+ * and so never forwarded the detected watchman path into the mach
+ * subprocess env. `fireforge watch` could locate `watchman` via PATH
+ * (the probe's `which` succeeded) but the mach subprocess spawned with
+ * the parent's PATH only — on macOS that typically omits
+ * `/opt/homebrew/bin`, so `mach watch` failed at the `watch-project`
+ * subscription step. Accepting `env` here lets the caller prepend the
+ * resolved watchman directory to PATH in a way mach inherits.
  */
-export async function watchWithOutput(engineDir) {
-    return runMachInheritCapture(['watch'], engineDir);
+export async function watchWithOutput(engineDir, options = {}) {
+    return runMachInheritCapture(['watch'], engineDir, options.env ? { env: options.env } : {});
 }
 /**
  * Runs mach test with the given test paths.

package/dist/src/core/marionette-preflight.d.ts

@@ -44,3 +44,19 @@ export interface MarionettePreflightOptions {
 export declare function runMarionettePreflight(engineDir: string, options?: MarionettePreflightOptions): Promise<MarionettePreflightResult>;
 /** Renders a PASS/FAIL banner to the CLI using the shared logger helpers. */
 export declare function reportMarionettePreflight(result: MarionettePreflightResult): void;
+/**
+ * Formats the PASS/FAIL banner as a plain string for direct
+ * `process.stdout.write` use — bypasses the clack logger entirely so
+ * operators running `fireforge test --doctor` under a non-TTY (pipe,
+ * CI, `tee`-wrapped capture) always see the final line even when the
+ * clack renderer swallows trailing log output just before process exit.
+ *
+ * 2026-04-24 eval Finding 7 reproducibly captured only the `"Running
+ * marionette preflight..."` intro and no PASS line at all — the
+ * `success()` + `outro()` + direct `stdout.write` belt-and-suspenders
+ * we used to ship still lost the summary under some non-TTY flush
+ * races. Returning the raw string here lets the caller compose a single
+ * authoritative write without any clack layer between the probe and
+ * the captured log.
+ */
+export declare function formatMarionettePreflightLine(result: MarionettePreflightResult): string;

package/dist/src/core/marionette-preflight.js

@@ -288,4 +288,23 @@ export function reportMarionettePreflight(result) {
         warn(`Marionette preflight: FAIL (${result.durationMs}ms) — ${result.detail}`);
     }
 }
+/**
+ * Formats the PASS/FAIL banner as a plain string for direct
+ * `process.stdout.write` use — bypasses the clack logger entirely so
+ * operators running `fireforge test --doctor` under a non-TTY (pipe,
+ * CI, `tee`-wrapped capture) always see the final line even when the
+ * clack renderer swallows trailing log output just before process exit.
+ *
+ * 2026-04-24 eval Finding 7 reproducibly captured only the `"Running
+ * marionette preflight..."` intro and no PASS line at all — the
+ * `success()` + `outro()` + direct `stdout.write` belt-and-suspenders
+ * we used to ship still lost the summary under some non-TTY flush
+ * races. Returning the raw string here lets the caller compose a single
+ * authoritative write without any clack layer between the probe and
+ * the captured log.
+ */
+export function formatMarionettePreflightLine(result) {
+    const status = result.ok ? 'PASS' : 'FAIL';
+    return `Marionette preflight: ${status} (${result.durationMs}ms) — ${result.detail}`;
+}
 //# sourceMappingURL=marionette-preflight.js.map

package/dist/src/core/patch-lint-diff-tag.d.ts

@@ -18,6 +18,13 @@ import type { PatchLintIssue } from '../types/commands/index.js';
  * @param rev Git revision to diff against (e.g. `HEAD`, a branch, a SHA).
  */
 export declare function collectDiffFilePaths(engineDir: string, rev: string): Promise<Set<string>>;
+/**
+ * Synthetic "file" value used by aggregate patch-size rules
+ * (`large-patch-files` / `large-patch-lines`) to flag that a finding
+ * describes the whole diff rather than a single path. Exported so callers
+ * can keep the tagging contract visible in one place.
+ */
+export declare const AGGREGATE_PATCH_FILE = "(patch)";
 /**
  * Annotates a list of lint issues with `introduced` / `cumulative` tags
  * based on whether the issue's file is part of the supplied diff set.
@@ -27,6 +34,19 @@ export declare function collectDiffFilePaths(engineDir: string, rev: string): Pr
  * describe queue-wide state — are always `cumulative` under `--since`
  * because they describe drift accumulated across many commits, not a
  * single current-task edit.
+ *
+ * Aggregate patch-size rules emit `issue.file === AGGREGATE_PATCH_FILE`,
+ * which is a synthetic placeholder that will never appear in a real
+ * `diffFiles` set. Without special-casing, `large-patch-files` /
+ * `large-patch-lines` were always tagged `[cumulative]` under
+ * `--only-introduced` even when the diff WAS the aggregate the rules
+ * measured — the eval (Finding #4) reported a stack of 20+ imported
+ * patches whose aggregate-size warnings printed as `[cumulative]` under
+ * `lint --since HEAD --only-introduced`, which reads as "this pre-existed"
+ * to an operator asking "what did this diff introduce?" We promote the
+ * aggregate tag to `introduced` whenever the diff set has any content —
+ * non-empty `diffFiles` means the operator asked about a specific diff
+ * scope and the aggregate-rule finding describes exactly that scope.
  * @param issues Issues returned by the lint orchestrator.
  * @param diffFiles File paths touched since the user's revision.
  */

package/dist/src/core/patch-lint-diff-tag.js

@@ -58,6 +58,13 @@ export async function collectDiffFilePaths(engineDir, rev) {
     }
     return files;
 }
+/**
+ * Synthetic "file" value used by aggregate patch-size rules
+ * (`large-patch-files` / `large-patch-lines`) to flag that a finding
+ * describes the whole diff rather than a single path. Exported so callers
+ * can keep the tagging contract visible in one place.
+ */
+export const AGGREGATE_PATCH_FILE = '(patch)';
 /**
  * Annotates a list of lint issues with `introduced` / `cumulative` tags
  * based on whether the issue's file is part of the supplied diff set.
@@ -67,15 +74,33 @@ export async function collectDiffFilePaths(engineDir, rev) {
  * describe queue-wide state — are always `cumulative` under `--since`
  * because they describe drift accumulated across many commits, not a
  * single current-task edit.
+ *
+ * Aggregate patch-size rules emit `issue.file === AGGREGATE_PATCH_FILE`,
+ * which is a synthetic placeholder that will never appear in a real
+ * `diffFiles` set. Without special-casing, `large-patch-files` /
+ * `large-patch-lines` were always tagged `[cumulative]` under
+ * `--only-introduced` even when the diff WAS the aggregate the rules
+ * measured — the eval (Finding #4) reported a stack of 20+ imported
+ * patches whose aggregate-size warnings printed as `[cumulative]` under
+ * `lint --since HEAD --only-introduced`, which reads as "this pre-existed"
+ * to an operator asking "what did this diff introduce?" We promote the
+ * aggregate tag to `introduced` whenever the diff set has any content —
+ * non-empty `diffFiles` means the operator asked about a specific diff
+ * scope and the aggregate-rule finding describes exactly that scope.
  * @param issues Issues returned by the lint orchestrator.
  * @param diffFiles File paths touched since the user's revision.
  */
 export function tagLintIssues(issues, diffFiles) {
+    const hasDiffContent = diffFiles.size > 0;
     for (const issue of issues) {
         if (!issue.file) {
             issue.tag = 'cumulative';
             continue;
         }
+        if (issue.file === AGGREGATE_PATCH_FILE) {
+            issue.tag = hasDiffContent ? 'introduced' : 'cumulative';
+            continue;
+        }
         issue.tag = diffFiles.has(issue.file) ? 'introduced' : 'cumulative';
     }
     return issues;

package/dist/src/core/patch-lint.js

@@ -8,6 +8,7 @@ import { loadFurnaceConfig } from './furnace-config.js';
 import { containsUpstreamLicenseText, getLicenseHeader, hasAnyLicenseHeader, hasAnyLicenseHeaderAnyStyle, } from './license-headers.js';
 import { runCheckJs } from './patch-lint-checkjs.js';
 import { detectNewFilesInDiff, extractAddedLinesPerFile } from './patch-lint-diff.js';
+import { AGGREGATE_PATCH_FILE } from './patch-lint-diff-tag.js';
 import { validateExportJsDoc } from './patch-lint-jsdoc.js';
 import { resolvePatchOwnedSysMjs } from './patch-lint-ownership.js';
 // ---------------------------------------------------------------------------
@@ -503,7 +504,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
     const issues = [];
     if (filesAffected.length > 5) {
         issues.push({
-            file: '(patch)',
+            file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-files',
             message: `Patch affects ${filesAffected.length} files (recommended: ≤5). Consider splitting into smaller, focused patches.`,
             severity: 'warning',
@@ -526,7 +527,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
             : PATCH_LINE_THRESHOLDS.general;
     if (lineCount >= thresholds.error) {
         issues.push({
-            file: '(patch)',
+            file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
             message: `Patch is ${lineCount} lines (hard limit: ${thresholds.error}). Consider splitting into smaller, focused patches.`,
             severity: 'error',
@@ -534,7 +535,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
     }
     else if (lineCount >= thresholds.warning) {
         issues.push({
-            file: '(patch)',
+            file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
             message: `Patch is ${lineCount} lines (soft limit: ${thresholds.warning}, hard limit: ${thresholds.error}). Consider splitting into smaller, focused patches.`,
             severity: 'warning',
@@ -542,7 +543,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
     }
     else if (lineCount >= thresholds.notice) {
         issues.push({
-            file: '(patch)',
+            file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
             message: `Patch is ${lineCount} lines (soft limit: ${thresholds.warning}, hard limit: ${thresholds.error}). Consider splitting into smaller, focused patches.`,
             severity: 'notice',

package/dist/src/core/patch-registration-refs.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Extracts furnace-shaped registration references from a patch body.
+ *
+ * 2026-04-24 eval Finding 1: `export-all --exclude-furnace` can land a
+ * patch that registers a furnace component (via edits to
+ * `toolkit/content/customElements.js`, `toolkit/content/jar.mn`, or
+ * `toolkit/locales/jar.mn`) without including the component's source
+ * files in the patch. `fireforge verify` then reports "Verify clean" for
+ * the broken queue. This module provides a pattern-scoped scan so
+ * `verify` can cross-check registrations against available file bodies.
+ *
+ * The scan is deliberately narrow: it only matches component-shaped
+ * references (widget tag names, locale fluent names). Unrelated jar.mn
+ * or customElements.js edits pass through without spurious warnings.
+ */
+/**
+ * A referenced engine path extracted from a registration hunk, together
+ * with where it came from. The `source` field lets `verify` point
+ * operators at the specific consequence file whose hunk introduced the
+ * reference.
+ */
+export interface PatchRegistrationReference {
+    /** Engine-relative path that the registration hunk adds a reference to. */
+    targetPath: string;
+    /** The registration file that contained the added hunk. */
+    source: string;
+    /** Raw hunk line that produced the reference, for diagnostic context. */
+    lineText: string;
+}
+/**
+ * Walks a unified-diff patch body and returns the set of
+ * component-shaped engine paths that the patch ADDS a registration for.
+ *
+ * Returns the empty array when no registration hunks are present OR
+ * when the registration hunks do not mention any component-shaped
+ * paths — that leaves the scan silent on the vast majority of patches
+ * (branding tweaks, behavioural fixes, module additions) so it only
+ * fires when a furnace-managed component is being newly registered.
+ *
+ * @param patchBody - Full unified-diff body of the patch file.
+ */
+export declare function collectPatchRegistrationReferences(patchBody: string): PatchRegistrationReference[];

package/dist/src/core/patch-registration-refs.js

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Extracts furnace-shaped registration references from a patch body.
+ *
+ * 2026-04-24 eval Finding 1: `export-all --exclude-furnace` can land a
+ * patch that registers a furnace component (via edits to
+ * `toolkit/content/customElements.js`, `toolkit/content/jar.mn`, or
+ * `toolkit/locales/jar.mn`) without including the component's source
+ * files in the patch. `fireforge verify` then reports "Verify clean" for
+ * the broken queue. This module provides a pattern-scoped scan so
+ * `verify` can cross-check registrations against available file bodies.
+ *
+ * The scan is deliberately narrow: it only matches component-shaped
+ * references (widget tag names, locale fluent names). Unrelated jar.mn
+ * or customElements.js edits pass through without spurious warnings.
+ */
+/** Canonical file paths that registration-shaped diffs touch. */
+const REGISTRATION_FILE_PATHS = new Set([
+    'toolkit/content/customElements.js',
+    'toolkit/content/jar.mn',
+    'toolkit/locales/jar.mn',
+]);
+/**
+ * Walks a unified-diff patch body and returns the set of
+ * component-shaped engine paths that the patch ADDS a registration for.
+ *
+ * Returns the empty array when no registration hunks are present OR
+ * when the registration hunks do not mention any component-shaped
+ * paths — that leaves the scan silent on the vast majority of patches
+ * (branding tweaks, behavioural fixes, module additions) so it only
+ * fires when a furnace-managed component is being newly registered.
+ *
+ * @param patchBody - Full unified-diff body of the patch file.
+ */
+export function collectPatchRegistrationReferences(patchBody) {
+    if (!patchBody)
+        return [];
+    const refs = [];
+    let currentFile;
+    // Walk line-by-line. The canonical unified-diff header line is
+    // `diff --git a/<path> b/<path>` — we key the file state off the `b/`
+    // path because that names the target side and is stable against
+    // renames. Additional diff metadata lines (index/---/+++/@@) are
+    // ignored for the purposes of tracking the current file.
+    const lines = patchBody.split(/\r?\n/);
+    for (const line of lines) {
+        const diffHeader = /^diff --git a\/(.+?) b\/(.+)$/.exec(line);
+        if (diffHeader?.[2]) {
+            currentFile = diffHeader[2];
+            continue;
+        }
+        if (!currentFile)
+            continue;
+        if (!REGISTRATION_FILE_PATHS.has(currentFile))
+            continue;
+        if (!line.startsWith('+'))
+            continue;
+        // Skip the `+++ b/<path>` header line — only real hunk adds count.
+        if (line.startsWith('+++'))
+            continue;
+        const added = line.slice(1);
+        const extracted = extractTargetPathsFromRegistrationLine(currentFile, added);
+        for (const target of extracted) {
+            refs.push({ targetPath: target, source: currentFile, lineText: added });
+        }
+    }
+    return refs;
+}
+/**
+ * Per-source extractor. Each registration file has a distinct syntactic
+ * shape; we scope the match to that file so a jar.mn regex does not
+ * accidentally match a customElements.js line.
+ */
+function extractTargetPathsFromRegistrationLine(sourceFile, added) {
+    if (sourceFile === 'toolkit/content/jar.mn') {
+        // Example (added line, leading `+` already stripped):
+        //   `   content/global/elements/moz-qa-panel.mjs  (widgets/moz-qa-panel/moz-qa-panel.mjs)`
+        // The parenthesised second half is the repo-relative path Firefox's
+        // packaging system reads. Widget registrations always live under
+        // `widgets/<tag>/<file>` — the enclosing tree is
+        // `toolkit/content/widgets/`. Reconstruct the engine-relative
+        // target path so callers can check it against patch bodies.
+        const widgetMatch = /\(\s*(widgets\/[^\s)]+)\s*\)/.exec(added);
+        if (widgetMatch?.[1]) {
+            return [`toolkit/content/${widgetMatch[1]}`];
+        }
+        return [];
+    }
+    if (sourceFile === 'toolkit/locales/jar.mn') {
+        // Example:
+        //   `  locale/@AB_CD@/toolkit/global/moz-qa-panel.ftl (%toolkit/global/moz-qa-panel.ftl)`
+        // The `%`-prefixed repo-relative reference points at
+        // `toolkit/locales/en-US/<rel>`, which is the canonical FTL path.
+        const localeMatch = /\(%\s*([^\s)]+\.ftl)\s*\)/.exec(added);
+        if (localeMatch?.[1]) {
+            return [`toolkit/locales/en-US/${localeMatch[1]}`];
+        }
+        return [];
+    }
+    if (sourceFile === 'toolkit/content/customElements.js') {
+        // Example:
+        //   `          ["moz-qa-panel", "chrome://global/content/elements/moz-qa-panel.mjs"],`
+        // The chrome URL maps back to
+        // `toolkit/content/widgets/<tag>/<tag>.mjs` by convention: the
+        // packager rewrites `chrome://global/content/elements/<file>` to the
+        // widget tree root. The tag name is the identifier we key off.
+        const elementMatch = /\[\s*"([a-z][a-z0-9-]*)"\s*,\s*"chrome:\/\/global\/content\/elements\/([a-zA-Z0-9_-]+)\.mjs"\s*\]/.exec(added);
+        if (elementMatch?.[1] && elementMatch[2]) {
+            const tag = elementMatch[1];
+            const fileStem = elementMatch[2];
+            return [`toolkit/content/widgets/${tag}/${fileStem}.mjs`];
+        }
+        return [];
+    }
+    return [];
+}
+//# sourceMappingURL=patch-registration-refs.js.map

package/dist/src/core/xpcshell-appdir.d.ts

@@ -96,11 +96,25 @@ export declare function readMozinfoAppname(objDirPath: string): Promise<string>;
  * (which fails with a different error than the original `firefox-appdir`
  * symptom and confuses triage).
  *
- * Probe order matches the on-disk layouts FireForge supports today:
- *  1. `<objDir>/dist/bin/<value>` — Linux primary, also macOS via the
- *     `dist/bin -> dist/<App>.app/Contents/MacOS/` symlink.
- *  2. `<objDir>/dist/<bundle>.app/Contents/Resources/<value>` — macOS
- *     packaged layout, where `dist/bin/` may not exist as a directory.
+ * Probe order differs by host platform:
+ *
+ * - **macOS (`darwin`)**: prefer `<objDir>/dist/<App>.app/Contents/Resources/
+ *   <value>` FIRST, then fall back to `<objDir>/dist/bin/<value>`.
+ *   2026-04-24 eval Finding 8: on macOS `dist/bin` is symlinked to
+ *   `dist/<App>.app/Contents/MacOS/` (the *binaries* directory), so
+ *   `dist/bin/browser` actually resolves to `<App>.app/Contents/MacOS/
+ *   browser/`. That is NOT where `resource:///modules/` is rooted — on
+ *   macOS, `-a` for xpcshell must point at the `.app/Contents/Resources/
+ *   <value>` subtree where modules / chrome.manifest live. Returning
+ *   `dist/bin/browser` caused the injected `--app-path` to look
+ *   successful (the info log showed it) but pointed at a directory
+ *   without the modules tree, so every `resource:///modules/…` import
+ *   still threw.
+ * - **non-macOS**: keep the historical order — `dist/bin/<value>` first,
+ *   `.app/Contents/Resources/<value>` as fallback.
+ *
+ * On both platforms the final `.app` fallback iterates every `*.app`
+ * entry because a rebranded fork may pick an arbitrary app name.
  */
 export declare function resolveAbsoluteAppPath(objDirAbs: string, relativeAppdir: string): Promise<string | null>;
 /**

package/dist/src/core/xpcshell-appdir.js

@@ -164,34 +164,60 @@ export async function readMozinfoAppname(objDirPath) {
  * (which fails with a different error than the original `firefox-appdir`
  * symptom and confuses triage).
  *
- * Probe order matches the on-disk layouts FireForge supports today:
- *  1. `<objDir>/dist/bin/<value>` — Linux primary, also macOS via the
- *     `dist/bin -> dist/<App>.app/Contents/MacOS/` symlink.
- *  2. `<objDir>/dist/<bundle>.app/Contents/Resources/<value>` — macOS
- *     packaged layout, where `dist/bin/` may not exist as a directory.
+ * Probe order differs by host platform:
+ *
+ * - **macOS (`darwin`)**: prefer `<objDir>/dist/<App>.app/Contents/Resources/
+ *   <value>` FIRST, then fall back to `<objDir>/dist/bin/<value>`.
+ *   2026-04-24 eval Finding 8: on macOS `dist/bin` is symlinked to
+ *   `dist/<App>.app/Contents/MacOS/` (the *binaries* directory), so
+ *   `dist/bin/browser` actually resolves to `<App>.app/Contents/MacOS/
+ *   browser/`. That is NOT where `resource:///modules/` is rooted — on
+ *   macOS, `-a` for xpcshell must point at the `.app/Contents/Resources/
+ *   <value>` subtree where modules / chrome.manifest live. Returning
+ *   `dist/bin/browser` caused the injected `--app-path` to look
+ *   successful (the info log showed it) but pointed at a directory
+ *   without the modules tree, so every `resource:///modules/…` import
+ *   still threw.
+ * - **non-macOS**: keep the historical order — `dist/bin/<value>` first,
+ *   `.app/Contents/Resources/<value>` as fallback.
+ *
+ * On both platforms the final `.app` fallback iterates every `*.app`
+ * entry because a rebranded fork may pick an arbitrary app name.
  */
 export async function resolveAbsoluteAppPath(objDirAbs, relativeAppdir) {
     const distBinCandidate = join(objDirAbs, 'dist', 'bin', relativeAppdir);
-    if (await pathExists(distBinCandidate))
-        return distBinCandidate;
     const distDir = join(objDirAbs, 'dist');
-    if (!(await pathExists(distDir)))
+    const isMacos = process.platform === 'darwin';
+    async function probeMacAppBundle() {
+        if (!(await pathExists(distDir)))
+            return null;
+        let entries;
+        try {
+            entries = await readdir(distDir);
+        }
+        catch {
+            return null;
+        }
+        for (const entry of entries) {
+            if (!entry.endsWith('.app'))
+                continue;
+            const candidate = join(distDir, entry, 'Contents', 'Resources', relativeAppdir);
+            if (await pathExists(candidate))
+                return candidate;
+        }
         return null;
-    let entries;
-    try {
-        entries = await readdir(distDir);
     }
-    catch {
+    if (isMacos) {
+        const appBundle = await probeMacAppBundle();
+        if (appBundle)
+            return appBundle;
+        if (await pathExists(distBinCandidate))
+            return distBinCandidate;
         return null;
     }
-    for (const entry of entries) {
-        if (!entry.endsWith('.app'))
-            continue;
-        const candidate = join(distDir, entry, 'Contents', 'Resources', relativeAppdir);
-        if (await pathExists(candidate))
-            return candidate;
-    }
-    return null;
+    if (await pathExists(distBinCandidate))
+        return distBinCandidate;
+    return probeMacAppBundle();
 }
 /**
  * Top-level resolver. Walks every test path, reads the nearest

package/dist/src/errors/git.d.ts

@@ -39,3 +39,23 @@ export declare class GitIndexLockError extends GitError {
     constructor(lockPath: string, ageMs?: number | undefined);
     get userMessage(): string;
 }
+/**
+ * Error thrown when `git add` (monolithic or chunked) exceeds the
+ * configured timeout while indexing the Firefox source tree.
+ *
+ * 2026-04-24 eval Finding 10: a 140.10.0esr bump on a previously-working
+ * 140.9.0esr workspace aborted after ~854s with a generic
+ * `AbortError: The operation was aborted`. The root cause was the
+ * `git add` timeout firing, but the surfaced error was indistinguishable
+ * from any other AbortError and gave the operator no actionable
+ * direction. This typed error carries the elapsed budget and the
+ * environment-variable override so the recovery path is
+ * self-documenting.
+ */
+export declare class GitIndexingTimeoutError extends GitError {
+    readonly phase: 'monolithic' | 'chunked';
+    readonly timeoutMs: number;
+    readonly envVar: string;
+    constructor(phase: 'monolithic' | 'chunked', timeoutMs: number, envVar: string, cause?: Error);
+    get userMessage(): string;
+}