@hominis/fireforge 0.18.11 → 0.19.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.19.0
+
+### Features
+
+- **`patchLint.checkJsStrict` and `patchLint.checkJsCompilerOptions`.** The patch-lint `checkJs` pass now defaults to the historical loose preset (`strict: false`, `noImplicitAny: false`). Set `"patchLint": { "checkJs": true, "checkJsStrict": true }` to enforce `strict` and `noImplicitAny` on patch-owned `.sys.mjs` so implicit-any parameters surface as `checkjs-type-error`, aligning with strict whole-project checkJs without changing module resolution (`noResolve` and `resource://` suppression unchanged). Optional `checkJsCompilerOptions` (requires `checkJsStrict`) merges allowlisted boolean compiler overrides — for example `{ "strictNullChecks": false }` — after the strict preset for gradual adoption. The Firefox globals shim and `SUPPRESSED_DIAGNOSTIC_CODES` remain shared with `fireforge typecheck` via `typecheck-shim.ts`.
+
+### Hardening
+
+- **`modified-file-missing-header` — standard Mozilla MPL-2.0 block headers with wrapped line breaks.** The upstream fallback scan required a contiguous `Mozilla Public License` substring in the first few lines, so files that follow Mozilla’s usual `/* … Mozilla Public` / ` * License, v. 2.0 … */` wrap (including after Emacs/vim directive blocks) were warned despite a valid notice. `containsUpstreamLicenseText` in `src/core/license-headers.ts` now normalizes common block-comment continuation prefixes before matching, so forks need not add SPDX solely to satisfy patch lint.
+
 ## 0.18.0
 
 ### Compatibility

package/README.md

@@ -230,34 +230,34 @@ If the manifest drifts after an interrupted export or manual edits, `fireforge i
 
 By default, a standalone `fireforge lint` (no arguments) lints the **aggregate** `git diff HEAD` — i.e. every applied patch summed — with tool-managed branding paths (`browser/branding/<binaryName>/`) excluded. A fresh-setup workspace carries a large generated branding diff that operators did not author directly, and letting it through tripped the patch-size and license-header rules on content that matches the `branding` bucket in `fireforge status`. When the exclusion fires the command prints a one-line note naming the excluded count so the filter is visible. On a repo where `fireforge import` or `fireforge rebase` has just applied the full queue, the patch-size rules (`large-patch-lines`, `large-patch-files`) fire against the sum, which reads as "my queue is broken" when it is really an artefact of aggregation. Use `fireforge lint --per-patch` to rescope the diff to each patch's own `filesAffected`, honouring the patch's own `lintIgnore`. Cross-patch rules (`duplicate-new-file-creation`, `forward-import`) still run once over the whole queue either way. Pass explicit file paths to narrow the scope further — explicit-path mode does lint branding files (the operator's explicit request wins over the branding exclusion); the three modes (aggregate, file-scoped, per-patch) are mutually exclusive.
 
-| Check                                | Scope                                                                                            | Severity                 |
-| ------------------------------------ | ------------------------------------------------------------------------------------------------ | ------------------------ |
-| `missing-license-header`             | New files (JS/CSS/FTL)                                                                           | error                    |
-| `relative-import`                    | JS/MJS files                                                                                     | error                    |
-| `token-prefix-violation`             | CSS files (with furnace)                                                                         | error                    |
-| `raw-color-value`                    | Introduced CSS color values (allowlist via `patchLint.rawColorAllowlist`)                        | error                    |
-| `duplicate-new-file-creation`        | Same path created by multiple patches                                                            | error                    |
-| `forward-import`                     | Patch imports from a later-patch file                                                            | error                    |
-| `missing-jsdoc`                      | Exports in patch-owned `.sys.mjs`                                                                | error                    |
-| `jsdoc-param-mismatch`               | Exports in patch-owned `.sys.mjs`                                                                | error                    |
-| `jsdoc-missing-returns`              | Exports in patch-owned `.sys.mjs`                                                                | error                    |
-| `checkjs-type-error`                 | Patch-owned `.sys.mjs` (opt-in)                                                                  | error                    |
-| `missing-jsdoc-class-method`         | Class-method exports in patch-owned `.sys.mjs` (opt-in)                                          | configurable             |
-| `jsdoc-class-method-param-mismatch`  | Class-method exports in patch-owned `.sys.mjs` (opt-in)                                          | configurable             |
-| `jsdoc-class-method-missing-returns` | Class-method exports in patch-owned `.sys.mjs` (opt-in)                                          | configurable             |
-| `test-needs-assertion`               | Patch-introduced `browser_*.js` test files (opt-in)                                              | configurable             |
-| `missing-modification-comment`       | Modified upstream JS/MJS                                                                         | warning                  |
-| `modified-file-missing-header`       | Modified upstream files (JS/CSS/FTL)                                                             | warning                  |
-| `file-too-large`                     | New files (tiered: 500/750/900 general, 1200/1400/1600 test)                                     | notice / warning / error |
-| `observer-topic-naming`              | Observer topics with binaryName                                                                  | warning                  |
-| `large-patch-files`                  | Patches affecting many files (tiered: >5 general, >5 test, >60 branding)                         | warning                  |
-| `large-patch-lines`                  | Patch line count (tiered: 800/1500/3000 general, 1500/3000/6000 test, 8000/18000/30000 branding) | notice / warning / error |
+| Check                                | Scope                                                                                                   | Severity                 |
+| ------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------------------------ |
+| `missing-license-header`             | New files (JS/CSS/FTL)                                                                                  | error                    |
+| `relative-import`                    | JS/MJS files                                                                                            | error                    |
+| `token-prefix-violation`             | CSS files (with furnace)                                                                                | error                    |
+| `raw-color-value`                    | Introduced CSS color values (allowlist via `patchLint.rawColorAllowlist`)                               | error                    |
+| `duplicate-new-file-creation`        | Same path created by multiple patches                                                                   | error                    |
+| `forward-import`                     | Patch imports from a later-patch file                                                                   | error                    |
+| `missing-jsdoc`                      | Exports in patch-owned `.sys.mjs`                                                                       | error                    |
+| `jsdoc-param-mismatch`               | Exports in patch-owned `.sys.mjs`                                                                       | error                    |
+| `jsdoc-missing-returns`              | Exports in patch-owned `.sys.mjs`                                                                       | error                    |
+| `checkjs-type-error`                 | Patch-owned `.sys.mjs` (opt-in `patchLint.checkJs`)                                                     | error                    |
+| `missing-jsdoc-class-method`         | Class-method exports in patch-owned `.sys.mjs` (opt-in)                                                 | configurable             |
+| `jsdoc-class-method-param-mismatch`  | Class-method exports in patch-owned `.sys.mjs` (opt-in)                                                 | configurable             |
+| `jsdoc-class-method-missing-returns` | Class-method exports in patch-owned `.sys.mjs` (opt-in)                                                 | configurable             |
+| `test-needs-assertion`               | Patch-introduced `browser_*.js` test files (opt-in)                                                     | configurable             |
+| `missing-modification-comment`       | Modified upstream JS/MJS                                                                                | warning                  |
+| `modified-file-missing-header`       | Modified upstream files (JS/CSS/FTL); Mozilla MPL-2.0 `/* */` headers with wrapped lines are recognized | warning                  |
+| `file-too-large`                     | New files (tiered: 500/750/900 general, 1200/1400/1600 test)                                            | notice / warning / error |
+| `observer-topic-naming`              | Observer topics with binaryName                                                                         | warning                  |
+| `large-patch-files`                  | Patches affecting many files (tiered: >5 general, >5 test, >60 branding)                                | warning                  |
+| `large-patch-lines`                  | Patch line count (tiered: 800/1500/3000 general, 1500/3000/6000 test, 8000/18000/30000 branding)        | notice / warning / error |
 
 **JSDoc validation** uses AST-based analysis (Acorn) to validate exported APIs in patch-owned `.sys.mjs` files. A file is "patch-owned" if it was newly created by the current diff or by an existing patch in the queue. Functions must document every `@param` (names must match) and include `@returns` when the function returns a value. Exported constants and classes require a JSDoc block.
 
-**Optional `checkJs` pass.** Enable a TypeScript-esque bastardization of type checking for patch-owned `.sys.mjs` files by adding `"patchLint": { "checkJs": true }` to `fireforge.json`. This uses the TypeScript compiler API with `allowJs + checkJs + noEmit`, scoped only to patch-owned files. Firefox globals (`Services`, `ChromeUtils`, `lazy`, etc.) are shimmed automatically. Module-resolution errors from Firefox's `resource://` and `chrome://` URL schemes are suppressed since TypeScript cannot follow these. This pass solely focuses on type errors within the patch-owned code itself (mismatched JSDoc types, wrong argument counts, unreachable code, etc.). Projects that need to extend the built-in shim (e.g. for `MozLitElement`, `MozXULElement`, or fork-specific component bases) can point at an additional `.d.ts` via `"patchLint": { "checkJsExtraShim": "tools/types/<fork>-globals.d.ts" }`; the file is concatenated to the built-in shim — augment, don't redeclare.
+**Optional `checkJs` pass.** Enable a TypeScript-esque bastardization of type checking for patch-owned `.sys.mjs` files by adding `"patchLint": { "checkJs": true }` to `fireforge.json`. This uses the TypeScript compiler API with `allowJs + checkJs + noEmit`, scoped only to patch-owned files. Firefox globals (`Services`, `ChromeUtils`, `lazy`, etc.) are shimmed automatically. Module-resolution errors from Firefox's `resource://` and `chrome://` URL schemes are suppressed since TypeScript cannot follow these. By default the pass uses a **loose** compiler preset (`strict: false`, `noImplicitAny: false`) so implicit `any` from untyped parameters does not flood the output. Set `"patchLint": { "checkJsStrict": true }` (requires `checkJs: true`) to enable `strict` and `noImplicitAny` for parity with strict whole-project checkJs — implicit-any parameters then surface as `checkjs-type-error`. Optional `"patchLint": { "checkJsCompilerOptions": { "strictNullChecks": false } }` (requires `checkJsStrict: true`) merges **allowlisted boolean** strict flags after that preset so forks can tighten `noImplicitAny` while relaxing e.g. null checks. The same built-in shim and the same eight suppressed diagnostic codes as `fireforge typecheck` apply; only explicit strictness differs. Projects that need to extend the built-in shim (e.g. for `MozLitElement`, `MozXULElement`, or fork-specific component bases) can point at an additional `.d.ts` via `"patchLint": { "checkJsExtraShim": "tools/types/<fork>-globals.d.ts" }`; the file is concatenated to the built-in shim — augment, don't redeclare.
 
-**Whole-project type checking — `fireforge typecheck`.** `patchLint.checkJs` is patch-hygiene: scoped to patch-owned `.sys.mjs`, suppresses module-resolution noise, and runs every time `fireforge lint` runs. `fireforge typecheck` is the CI-grade complement: it runs whole projects you point at via `typecheck.projects` in `fireforge.json`, honours each jsconfig's strictness/include/exclude/`paths`, and is intended as a CI gate. The two are complementary; the recommended setup is `fireforge lint` on every patch export and `fireforge typecheck` on CI for the project-level baseline.
+**Whole-project type checking — `fireforge typecheck`.** `patchLint.checkJs` is patch-hygiene: scoped to patch-owned `.sys.mjs`, suppresses module-resolution noise, and runs every time `fireforge lint` runs. With `checkJsStrict`, that pass can match a strict jsconfig's `noImplicitAny` behaviour without replacing full-project resolution. `fireforge typecheck` remains the CI-grade complement: it runs whole projects you point at via `typecheck.projects` in `fireforge.json`, honours each jsconfig's strictness/include/exclude/`paths`, and is intended as a CI gate. The two are complementary; the recommended setup is `fireforge lint` on every patch export and `fireforge typecheck` on CI for the project-level baseline.
 
 ```jsonc
 {

package/dist/src/core/config-paths.d.ts

@@ -19,7 +19,7 @@ export declare const SRC_DIR = "src";
 /** Supported top-level fireforge.json keys backed by the current schema. */
 export declare const SUPPORTED_CONFIG_ROOT_KEYS: readonly ["name", "vendor", "appId", "binaryName", "firefox", "build", "license", "wire", "patchLint", "typecheck", "markerComment"];
 /** Supported config paths that can be read or set without --force. */
-export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "build", "build.jobs", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsExtraShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
+export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "build", "build.jobs", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
 /**
  * Gets all project paths based on a root directory.
  * @param root - Root directory of the project

package/dist/src/core/config-paths.js

@@ -47,6 +47,8 @@ export const SUPPORTED_CONFIG_PATHS = [
     'wire.subscriptDir',
     'patchLint',
     'patchLint.checkJs',
+    'patchLint.checkJsStrict',
+    'patchLint.checkJsCompilerOptions',
     'patchLint.checkJsExtraShim',
     'patchLint.rawColorAllowlist',
     'patchLint.jsdocClassMethods',

package/dist/src/core/config-validate.js

@@ -201,6 +201,36 @@ function optionalConfigObject(rec, key) {
     }
 }
 const SEVERITY_GATE_VALUES = ['off', 'warning', 'error'];
+/** Allowlisted keys for `patchLint.checkJsCompilerOptions` (boolean overrides only). */
+const PATCH_LINT_CHECKJS_COMPILER_OPTION_KEYS = [
+    'strictNullChecks',
+    'strictFunctionTypes',
+    'strictBindCallApply',
+    'noImplicitThis',
+    'useUnknownInCatchVariables',
+    'strictPropertyInitialization',
+    'noUnusedLocals',
+    'noUnusedParameters',
+];
+function parsePatchLintCheckJsCompilerOptions(raw) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        throw new ConfigError('Config field "patchLint.checkJsCompilerOptions" must be a plain object');
+    }
+    const rec = raw;
+    const allowed = new Set(PATCH_LINT_CHECKJS_COMPILER_OPTION_KEYS);
+    const out = {};
+    for (const key of Object.keys(rec)) {
+        if (!allowed.has(key)) {
+            throw new ConfigError(`Config field "patchLint.checkJsCompilerOptions" has unknown key "${key}"`);
+        }
+        const val = rec[key];
+        if (typeof val !== 'boolean') {
+            throw new ConfigError(`Config field "patchLint.checkJsCompilerOptions.${key}" must be a boolean`);
+        }
+        out[key] = val;
+    }
+    return out;
+}
 function parseSeverityGate(raw, label) {
     if (raw === undefined)
         return undefined;
@@ -218,6 +248,17 @@ function parsePatchLintBlock(rec) {
         }
         out.checkJs = checkJs;
     }
+    const checkJsStrict = rec.raw('checkJsStrict');
+    if (checkJsStrict !== undefined) {
+        if (typeof checkJsStrict !== 'boolean') {
+            throw new ConfigError('Config field "patchLint.checkJsStrict" must be a boolean');
+        }
+        out.checkJsStrict = checkJsStrict;
+    }
+    const checkJsCompilerOptionsRaw = rec.raw('checkJsCompilerOptions');
+    if (checkJsCompilerOptionsRaw !== undefined) {
+        out.checkJsCompilerOptions = parsePatchLintCheckJsCompilerOptions(checkJsCompilerOptionsRaw);
+    }
     const checkJsExtraShim = rec.raw('checkJsExtraShim');
     if (checkJsExtraShim !== undefined) {
         out.checkJsExtraShim = parseShimPath(checkJsExtraShim, 'patchLint.checkJsExtraShim');
@@ -242,6 +283,12 @@ function parsePatchLintBlock(rec) {
     if (chromeScriptJsDoc !== undefined) {
         out.chromeScriptJsDoc = chromeScriptJsDoc;
     }
+    if (out.checkJsStrict === true && out.checkJs !== true) {
+        throw new ConfigError('Config field "patchLint.checkJsStrict" requires "patchLint.checkJs": true');
+    }
+    if (out.checkJsCompilerOptions !== undefined && out.checkJsStrict !== true) {
+        throw new ConfigError('Config field "patchLint.checkJsCompilerOptions" requires "patchLint.checkJsStrict": true');
+    }
     return out;
 }
 /**

package/dist/src/core/license-headers.js

@@ -129,6 +129,16 @@ export function hasAnyLicenseHeaderAnyStyle(content) {
     const styles = ['js', 'css', 'hash'];
     return styles.some((style) => hasAnyLicenseHeader(content, style));
 }
+/**
+ * Collapses block-comment continuation lines (`\n` + ` * ` prefixes) so
+ * substring markers like `Mozilla Public License` match Mozilla's wrapped
+ * MPL boilerplate.
+ */
+function normalizeLicenseHeadForScan(head) {
+    let s = head.replace(/\r\n?/g, '\n');
+    s = s.replace(/\n[ \t]*\*[ \t]*/g, ' ');
+    return s.replace(/\s+/g, ' ').trim();
+}
 /**
  * Returns true if the first few lines of `content` contain a recognized
  * upstream license identifier string.
@@ -138,6 +148,7 @@ export function hasAnyLicenseHeaderAnyStyle(content) {
  */
 export function containsUpstreamLicenseText(content, maxLines = 10) {
     const head = content.split('\n').slice(0, maxLines).join('\n');
+    const scanText = normalizeLicenseHeadForScan(head);
     const markers = [
         'Mozilla Public License',
         'SPDX-License-Identifier',
@@ -145,7 +156,7 @@ export function containsUpstreamLicenseText(content, maxLines = 10) {
         'MIT License',
         'GNU General Public License',
     ];
-    return markers.some((marker) => head.includes(marker));
+    return markers.some((marker) => scanText.includes(marker));
 }
 /**
  * Prepends the license header to a file on disk if it is not already present.

package/dist/src/core/patch-lint-checkjs.d.ts

@@ -12,8 +12,12 @@
  * diagnostic code list now live in `typecheck-shim.ts` and are shared
  * with the whole-project `fireforge typecheck` command — keeping a
  * single source of truth for the Firefox-globals coverage.
+ * `patchLint.checkJsStrict` only tightens `strict` / `noImplicitAny`
+ * and optional allowlisted `checkJsCompilerOptions`; it does not change
+ * shim composition or suppressed diagnostic codes.
  */
 import type { PatchLintIssue } from '../types/commands/index.js';
+import type { PatchLintCheckJsCompilerOptions, PatchLintConfig } from '../types/config.js';
 /**
  * Runs TypeScript's checkJs pass on patch-owned `.sys.mjs` files.
  *
@@ -28,6 +32,18 @@ import type { PatchLintIssue } from '../types/commands/index.js';
  * @param projectRoot - Absolute project root for resolving `extraShimPath`.
  *   Defaults to `repoDir` for back-compat with callers that don't
  *   pass an extra shim (no resolution actually happens in that case).
+ * @param mode - When `strict` is true, enables `strict` and `noImplicitAny`
+ *   (CI-style). Optional `compilerOptions` merges allowlisted boolean
+ *   overrides after that preset (from `patchLint.checkJsCompilerOptions`).
+ *   Omitted or `{ strict: false }` preserves the historical loose preset.
  * @returns Array of lint issues from TS diagnostics
  */
-export declare function runCheckJs(repoDir: string, patchOwnedFiles: Set<string>, extraShimPath?: string, projectRoot?: string): Promise<PatchLintIssue[]>;
+export declare function runCheckJs(repoDir: string, patchOwnedFiles: Set<string>, extraShimPath?: string, projectRoot?: string, mode?: {
+    strict: boolean;
+    compilerOptions?: PatchLintCheckJsCompilerOptions;
+}): Promise<PatchLintIssue[]>;
+/**
+ * Invokes {@link runCheckJs} for a `patchLint` block with `checkJs: true`.
+ * `projectRoot` is the FireForge project root (`dirname(engine)`).
+ */
+export declare function invokePatchLintCheckJs(repoDir: string, patchOwnedFiles: Set<string>, patchLint: PatchLintConfig, projectRoot: string): Promise<PatchLintIssue[]>;

package/dist/src/core/patch-lint-checkjs.js

@@ -13,6 +13,9 @@
  * diagnostic code list now live in `typecheck-shim.ts` and are shared
  * with the whole-project `fireforge typecheck` command — keeping a
  * single source of truth for the Firefox-globals coverage.
+ * `patchLint.checkJsStrict` only tightens `strict` / `noImplicitAny`
+ * and optional allowlisted `checkJsCompilerOptions`; it does not change
+ * shim composition or suppressed diagnostic codes.
  */
 import { resolve } from 'node:path';
 import { pathExists } from '../utils/fs.js';
@@ -35,9 +38,13 @@ import { composeShimSource, SHIM_FILENAME, SUPPRESSED_DIAGNOSTIC_CODES } from '.
  * @param projectRoot - Absolute project root for resolving `extraShimPath`.
  *   Defaults to `repoDir` for back-compat with callers that don't
  *   pass an extra shim (no resolution actually happens in that case).
+ * @param mode - When `strict` is true, enables `strict` and `noImplicitAny`
+ *   (CI-style). Optional `compilerOptions` merges allowlisted boolean
+ *   overrides after that preset (from `patchLint.checkJsCompilerOptions`).
+ *   Omitted or `{ strict: false }` preserves the historical loose preset.
  * @returns Array of lint issues from TS diagnostics
  */
-export async function runCheckJs(repoDir, patchOwnedFiles, extraShimPath, projectRoot) {
+export async function runCheckJs(repoDir, patchOwnedFiles, extraShimPath, projectRoot, mode) {
     if (patchOwnedFiles.size === 0)
         return [];
     // Dynamic import — typescript stays as a dev dependency
@@ -93,11 +100,28 @@ export async function runCheckJs(repoDir, patchOwnedFiles, extraShimPath, projec
     }
     const shimPath = resolve(repoDir, SHIM_FILENAME);
     rootFiles.push(shimPath);
+    const strict = mode?.strict === true;
+    const strictness = strict
+        ? { strict: true, noImplicitAny: true }
+        : {
+            // Loose default — implicit `any` is allowed unless `patchLint.checkJsStrict`.
+            strict: false,
+            noImplicitAny: false,
+        };
+    const overrides = {};
+    const co = mode?.compilerOptions;
+    if (co) {
+        for (const key of Object.keys(co)) {
+            const v = co[key];
+            if (v !== undefined) {
+                overrides[key] = v;
+            }
+        }
+    }
     const options = {
         allowJs: true,
         checkJs: true,
         noEmit: true,
-        strict: false,
         target: ts.ScriptTarget.ESNext,
         module: ts.ModuleKind.ESNext,
         moduleResolution: ts.ModuleResolutionKind.Bundler,
@@ -108,10 +132,8 @@ export async function runCheckJs(repoDir, patchOwnedFiles, extraShimPath, projec
         // resource:// and chrome:// import, flooding the output with
         // "Cannot find module" errors for upstream Firefox modules.
         noResolve: true,
-        // Suppress implicit-any noise — Firefox code rarely has full type
-        // annotations and drowning users in thousands of implicit-any
-        // errors defeats the purpose of a focused check.
-        noImplicitAny: false,
+        ...strictness,
+        ...overrides,
     };
     // Custom compiler host: reads patch-owned files from disk, returns
     // the shim for the shim path, and returns empty content for
@@ -189,4 +211,15 @@ export async function runCheckJs(repoDir, patchOwnedFiles, extraShimPath, projec
     verbose(`checkJs: analyzed ${rootFiles.length - 1} file(s), found ${issues.length} issue(s)`);
     return issues;
 }
+/**
+ * Invokes {@link runCheckJs} for a `patchLint` block with `checkJs: true`.
+ * `projectRoot` is the FireForge project root (`dirname(engine)`).
+ */
+export async function invokePatchLintCheckJs(repoDir, patchOwnedFiles, patchLint, projectRoot) {
+    const strict = patchLint.checkJsStrict === true;
+    const mode = strict && patchLint.checkJsCompilerOptions
+        ? { strict, compilerOptions: patchLint.checkJsCompilerOptions }
+        : { strict };
+    return runCheckJs(repoDir, patchOwnedFiles, patchLint.checkJsExtraShim, projectRoot, mode);
+}
 //# sourceMappingURL=patch-lint-checkjs.js.map

package/dist/src/core/patch-lint-reexports.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Public re-exports for {@link ./patch-lint.ts}. Split out so the
+ * orchestrator stays within the ESLint `max-lines` budget.
+ */
+export { runCheckJs } from './patch-lint-checkjs.js';
+export { buildPatchQueueContext, collectNewFileCreatorsByPath, type ExtractedSpecifier, extractImportSpecifiers, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, FORWARD_IMPORT_IGNORE_MARKER, isForwardImportableFile, lintPatchQueue, lintPatchQueueDuplicateCreations, lintPatchQueueForwardImports, type PatchQueueContext, type PatchQueueEntry, } from './patch-lint-cross.js';
+export { buildModifiedFileAdditionsFromDiff, detectNewFilesInDiff } from './patch-lint-diff.js';
+export { type JsDocCheck, type JsDocIssue, validateExportJsDoc } from './patch-lint-jsdoc.js';
+export { resolvePatchOwnedChromeScripts, resolvePatchOwnedSysMjs } from './patch-lint-ownership.js';

package/dist/src/core/patch-lint-reexports.js

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Public re-exports for {@link ./patch-lint.ts}. Split out so the
+ * orchestrator stays within the ESLint `max-lines` budget.
+ */
+export { runCheckJs } from './patch-lint-checkjs.js';
+export { buildPatchQueueContext, collectNewFileCreatorsByPath, extractImportSpecifiers, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, FORWARD_IMPORT_IGNORE_MARKER, isForwardImportableFile, lintPatchQueue, lintPatchQueueDuplicateCreations, lintPatchQueueForwardImports, } from './patch-lint-cross.js';
+export { buildModifiedFileAdditionsFromDiff, detectNewFilesInDiff } from './patch-lint-diff.js';
+export { validateExportJsDoc } from './patch-lint-jsdoc.js';
+export { resolvePatchOwnedChromeScripts, resolvePatchOwnedSysMjs } from './patch-lint-ownership.js';
+//# sourceMappingURL=patch-lint-reexports.js.map

package/dist/src/core/patch-lint.d.ts

@@ -1,11 +1,7 @@
 import type { PatchLintIssue } from '../types/commands/index.js';
 import type { FireForgeConfig } from '../types/config.js';
 import { type CommentStyle } from './license-headers.js';
-export { runCheckJs } from './patch-lint-checkjs.js';
-export { buildPatchQueueContext, collectNewFileCreatorsByPath, type ExtractedSpecifier, extractImportSpecifiers, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, FORWARD_IMPORT_IGNORE_MARKER, isForwardImportableFile, lintPatchQueue, lintPatchQueueDuplicateCreations, lintPatchQueueForwardImports, type PatchQueueContext, type PatchQueueEntry, } from './patch-lint-cross.js';
-export { buildModifiedFileAdditionsFromDiff, detectNewFilesInDiff } from './patch-lint-diff.js';
-export { type JsDocCheck, type JsDocIssue, validateExportJsDoc } from './patch-lint-jsdoc.js';
-export { resolvePatchOwnedChromeScripts, resolvePatchOwnedSysMjs } from './patch-lint-ownership.js';
+export * from './patch-lint-reexports.js';
 /**
  * Counts the total lines in a unified diff and the number of non-binary
  * text lines, so binary hunks do not inflate patch size checks.

package/dist/src/core/patch-lint.js

@@ -6,7 +6,7 @@ import { verbose } from '../utils/logger.js';
 import { hasRawCssColors, stripJsComments } from '../utils/regex.js';
 import { loadFurnaceConfig } from './furnace-config.js';
 import { containsUpstreamLicenseText, getLicenseHeader, hasAnyLicenseHeader, hasAnyLicenseHeaderAnyStyle, } from './license-headers.js';
-import { runCheckJs } from './patch-lint-checkjs.js';
+import { invokePatchLintCheckJs } from './patch-lint-checkjs.js';
 import { lintChromeScriptJsDocForFile } from './patch-lint-chrome-jsdoc.js';
 import { detectNewFilesInDiff, extractAddedLinesPerFile } from './patch-lint-diff.js';
 import { AGGREGATE_PATCH_FILE } from './patch-lint-diff-tag.js';
@@ -20,12 +20,9 @@ import { resolvePatchOwnedChromeScripts, resolvePatchOwnedSysMjs } from './patch
 // creation and forward-import rules, ignore marker) lives in
 // `patch-lint-cross.ts` so the per-patch and cross-patch rule bodies can
 // each stay within the project's per-file line budget. Re-export the
-// public surface so callers continue to import from a single module.
-export { runCheckJs } from './patch-lint-checkjs.js';
-export { buildPatchQueueContext, collectNewFileCreatorsByPath, extractImportSpecifiers, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, FORWARD_IMPORT_IGNORE_MARKER, isForwardImportableFile, lintPatchQueue, lintPatchQueueDuplicateCreations, lintPatchQueueForwardImports, } from './patch-lint-cross.js';
-export { buildModifiedFileAdditionsFromDiff, detectNewFilesInDiff } from './patch-lint-diff.js';
-export { validateExportJsDoc } from './patch-lint-jsdoc.js';
-export { resolvePatchOwnedChromeScripts, resolvePatchOwnedSysMjs } from './patch-lint-ownership.js';
+// public surface from `patch-lint-reexports.ts` so callers continue to
+// import from a single module.
+export * from './patch-lint-reexports.js';
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -737,12 +734,8 @@ export async function lintExportedPatch(repoDir, affectedFiles, diffContent, con
         ...jsIssues,
         ...modCommentIssues,
     ];
-    // Optional checkJs pass — only when explicitly enabled in config.
-    // `checkJsExtraShim` is project-relative; resolve against the
-    // project root (dirname(engine) by getProjectPaths convention).
     if (config.patchLint?.checkJs) {
-        const extraShim = config.patchLint.checkJsExtraShim;
-        issues.push(...(await runCheckJs(repoDir, patchOwnedFiles, extraShim, dirname(repoDir))));
+        issues.push(...(await invokePatchLintCheckJs(repoDir, patchOwnedFiles, config.patchLint, dirname(repoDir))));
     }
     // Filter out ignored checks last so every rule still runs (keeps the
     // implementation uniform) but suppressed rules do not surface. We do not

package/dist/src/types/config.d.ts

@@ -89,12 +89,40 @@ export interface WireConfig {
  * `'warning'` and `'error'` emit issues at the matching severity.
  */
 export type PatchLintSeverityGate = 'off' | 'warning' | 'error';
+/**
+ * Allowlisted TypeScript `compilerOptions` overrides for the patch
+ * `checkJs` pass when {@link PatchLintConfig.checkJsStrict} is true.
+ * Merged after the strict preset; only boolean flags — no `paths`,
+ * `rootDir`, or other options that would fight the synthetic program.
+ */
+export interface PatchLintCheckJsCompilerOptions {
+    strictNullChecks?: boolean;
+    strictFunctionTypes?: boolean;
+    strictBindCallApply?: boolean;
+    noImplicitThis?: boolean;
+    useUnknownInCatchVariables?: boolean;
+    strictPropertyInitialization?: boolean;
+    noUnusedLocals?: boolean;
+    noUnusedParameters?: boolean;
+}
 /**
  * Configuration for patch lint rules.
  */
 export interface PatchLintConfig {
     /** Enable TypeScript checkJs pass on patch-owned .sys.mjs files */
     checkJs?: boolean;
+    /**
+     * When true with `checkJs: true`, run checkJs with `strict` and
+     * `noImplicitAny` enabled (CI-style). Default false preserves the
+     * historical loose preset. Optional {@link checkJsCompilerOptions}
+     * can relax individual strict flags (e.g. `strictNullChecks: false`).
+     */
+    checkJsStrict?: boolean;
+    /**
+     * Boolean overrides merged after the strict preset; only valid when
+     * `checkJsStrict` is true. Requires `checkJs: true`.
+     */
+    checkJsCompilerOptions?: PatchLintCheckJsCompilerOptions;
     /**
      * Project-relative path to an additional `.d.ts` file whose contents
      * are concatenated to the built-in `FIREFOX_GLOBALS_SHIM` for the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hominis/fireforge",
-  "version": "0.18.11",
+  "version": "0.19.1",
   "description": "FireForge — a build tool for customizing Firefox",
   "type": "module",
   "main": "./dist/src/index.js",