@hominis/fireforge 0.19.5 → 0.20.0

package/dist/src/commands/furnace/rename.js

@@ -14,52 +14,12 @@ import { FurnaceError } from '../../errors/furnace.js';
 import { toError } from '../../utils/errors.js';
 import { copyFile, ensureDir, pathExists, readText, removeDir, removeFile, writeText, } from '../../utils/fs.js';
 import { info, intro, note, outro, warn } from '../../utils/logger.js';
+import { renameComponentFileName, updateConfigForCustomRename, updateConfigForOverrideRename, } from './rename-helpers.js';
 import { renameXpcshellTestFiles } from './rename-xpcshell.js';
 /** Escapes regex metacharacters so a user-supplied name is literal inside a RegExp. */
 function escapeRegex(input) {
     return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-/**
- * Applies the component rename to a filename. Only replaces the leading
- * component name when it is followed by `.` (extension) or equals the
- * filename exactly; every other filename is returned unchanged so stray
- * assets, editor backups, or files whose name coincidentally contains the
- * old component name in the middle or at the end are not accidentally
- * renamed.
- */
-function renameComponentFileName(fileName, oldName, newName) {
-    if (fileName === oldName)
-        return newName;
-    if (fileName.startsWith(oldName + '.')) {
-        return newName + fileName.slice(oldName.length);
-    }
-    return fileName;
-}
-function updateConfigForCustomRename(config, oldName, newName) {
-    const oldConfig = config.custom[oldName];
-    if (!oldConfig)
-        return;
-    config.custom[newName] = {
-        ...oldConfig,
-        targetPath: oldConfig.targetPath.replace(new RegExp(`(^|/)${oldName}$`), `$1${newName}`),
-    };
-    // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- idiomatic key removal from config record
-    delete config.custom[oldName];
-    // Update composes references in other components
-    for (const customConfig of Object.values(config.custom)) {
-        if (customConfig.composes) {
-            customConfig.composes = customConfig.composes.map((ref) => (ref === oldName ? newName : ref));
-        }
-    }
-}
-function updateConfigForOverrideRename(config, oldName, newName) {
-    const oldConfig = config.overrides[oldName];
-    if (!oldConfig)
-        return;
-    config.overrides[newName] = { ...oldConfig };
-    // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- idiomatic key removal from config record
-    delete config.overrides[oldName];
-}
 /**
  * Derives the test file name for a component, matching the convention used by
  * `furnace create --with-tests`.
@@ -215,18 +175,37 @@ async function renameMochikitTestFiles(engineDir, oldName, newName, journal) {
  * Performs the transactional rename mutation inside a furnace lock.
  */
 async function performRenameMutations(args) {
-    const { projectRoot, oldName, newName, oldDir, newDir, isCustom, componentType, config } = args;
+    const { projectRoot, oldName, newName } = args;
     const oldClassName = tagNameToClassName(oldName);
     const newClassName = tagNameToClassName(newName);
-    // Capture the pre-rename deployed target path so we know what to
-    // clean up in the engine tree. `updateConfigForCustomRename` rewrites
-    // `targetPath` in-place once the mutation enters phase 2, so we read
-    // it here while it still points at the old name's deployment.
-    const oldCustomTargetPath = isCustom ? config.custom[oldName]?.targetPath : undefined;
     await runFurnaceMutation(projectRoot, 'rename-rollback', async (ctx) => {
         const journal = createRollbackJournal();
         ctx.registerJournal(journal);
+        let newDir = args.newDir;
         try {
+            const config = await loadFurnaceConfig(projectRoot);
+            const isCustom = oldName in config.custom;
+            const isOverride = oldName in config.overrides;
+            if (!isCustom && !isOverride) {
+                throw new FurnaceError(`Component "${oldName}" not found in furnace.json. Only custom and override components can be renamed.`, oldName);
+            }
+            if (newName in config.custom ||
+                newName in config.overrides ||
+                config.stock.includes(newName)) {
+                throw new FurnaceError(`A component named "${newName}" already exists in furnace.json.`, newName);
+            }
+            const componentType = isCustom ? 'custom' : 'override';
+            const componentDirLabel = isCustom ? 'custom' : 'overrides';
+            const baseDir = isCustom ? args.furnacePaths.customDir : args.furnacePaths.overridesDir;
+            const oldDir = join(baseDir, oldName);
+            newDir = join(baseDir, newName);
+            const oldCustomTargetPath = isCustom ? config.custom[oldName]?.targetPath : undefined;
+            if (!(await pathExists(oldDir))) {
+                throw new FurnaceError(`Component directory not found: components/${componentDirLabel}/${oldName}`, oldName);
+            }
+            if (await pathExists(newDir)) {
+                throw new FurnaceError(`Target directory already exists: components/${componentDirLabel}/${newName}`, newName);
+            }
             await snapshotDir(journal, oldDir);
             await snapshotFile(journal, args.furnaceConfigPath);
             // 1. Create new directory with renamed files and updated content
@@ -472,6 +451,7 @@ export async function furnaceRenameCommand(projectRoot, oldName, newName) {
         componentType,
         config,
         furnaceConfigPath: furnacePaths.furnaceConfig,
+        furnacePaths,
         engineDir: paths.engine,
     });
     note(`Component renamed: ${oldName} → ${newName}\n\n` +

package/dist/src/core/config-paths.d.ts

@@ -19,7 +19,7 @@ export declare const SRC_DIR = "src";
 /** Supported top-level fireforge.json keys backed by the current schema. */
 export declare const SUPPORTED_CONFIG_ROOT_KEYS: readonly ["name", "vendor", "appId", "binaryName", "firefox", "build", "license", "wire", "patchLint", "typecheck", "markerComment"];
 /** Supported config paths that can be read or set without --force. */
-export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "build", "build.jobs", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
+export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "build", "build.jobs", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
 /**
  * Gets all project paths based on a root directory.
  * @param root - Root directory of the project

package/dist/src/core/config-paths.js

@@ -41,6 +41,7 @@ export const SUPPORTED_CONFIG_PATHS = [
     'firefox',
     'firefox.version',
     'firefox.product',
+    'firefox.sha256',
     'build',
     'build.jobs',
     'wire',

package/dist/src/core/config-validate.js

@@ -75,6 +75,10 @@ export function validateConfig(data) {
     if (compatError) {
         throw new ConfigError(compatError);
     }
+    const firefoxSha256 = optionalConfigString(firefoxRec, 'sha256', 'firefox.sha256');
+    if (firefoxSha256 !== undefined && !/^[a-f0-9]{64}$/i.test(firefoxSha256)) {
+        throw new ConfigError('Config field "firefox.sha256" must be a 64-character SHA-256 hex digest');
+    }
     // Optional configs
     const config = {
         name,
@@ -84,6 +88,7 @@ export function validateConfig(data) {
         firefox: {
             version: firefoxVersion,
             product: firefoxProduct,
+            ...(firefoxSha256 !== undefined ? { sha256: firefoxSha256.toLowerCase() } : {}),
         },
     };
     // Build

package/dist/src/core/config.js

@@ -11,7 +11,7 @@
 import { basename } from 'node:path';
 import { ConfigError, ConfigNotFoundError } from '../errors/config.js';
 import { toError } from '../utils/errors.js';
-import { pathExists, readJson, writeJson } from '../utils/fs.js';
+import * as fsUtils from '../utils/fs.js';
 import { getProjectPaths } from './config-paths.js';
 import { validateConfig } from './config-validate.js';
 import { createSiblingLockPath, withFileLock } from './file-lock.js';
@@ -21,6 +21,10 @@ export { CONFIG_FILENAME, FIREFORGE_DIR, getProjectPaths, STATE_FILENAME, SUPPOR
 export { loadState, saveState, updateState } from './config-state.js';
 export { validateConfig } from './config-validate.js';
 // ---- config I/O (stays here because it bridges paths + validation) ----
+async function configPathExists(path) {
+    const fs = fsUtils;
+    return (fs.pathExistsStrict ?? fsUtils.pathExists)(path);
+}
 /**
  * Checks if a fireforge.json exists in the given directory.
  * @param root - Root directory to check
@@ -28,7 +32,7 @@ export { validateConfig } from './config-validate.js';
  */
 export async function configExists(root) {
     const paths = getProjectPaths(root);
-    return pathExists(paths.config);
+    return configPathExists(paths.config);
 }
 /**
  * Loads and validates the fireforge.json configuration.
@@ -38,11 +42,11 @@ export async function configExists(root) {
  */
 export async function loadConfig(root) {
     const paths = getProjectPaths(root);
-    if (!(await pathExists(paths.config))) {
+    if (!(await configPathExists(paths.config))) {
         throw new ConfigNotFoundError(paths.config);
     }
     try {
-        const data = await readJson(paths.config);
+        const data = await fsUtils.readJson(paths.config);
         return validateConfig(data);
     }
     catch (error) {
@@ -70,11 +74,11 @@ export async function loadConfig(root) {
  */
 export async function loadRawConfigDocument(root) {
     const paths = getProjectPaths(root);
-    if (!(await pathExists(paths.config))) {
+    if (!(await configPathExists(paths.config))) {
         throw new ConfigNotFoundError(paths.config);
     }
     try {
-        const data = await readJson(paths.config);
+        const data = await fsUtils.readJson(paths.config);
         if (data === null || typeof data !== 'object' || Array.isArray(data)) {
             throw new ConfigError(`Invalid fireforge.json at ${paths.config}: expected an object`);
         }
@@ -110,7 +114,7 @@ export async function writeConfig(root, config) {
  */
 export async function writeConfigDocument(root, config) {
     const paths = getProjectPaths(root);
-    await writeJson(paths.config, config);
+    await fsUtils.writeJson(paths.config, config);
 }
 /**
  * Runs an operation while holding a sidecar lock on `fireforge.json`.

package/dist/src/core/file-lock.js

@@ -35,8 +35,8 @@ function isProcessAlive(pid) {
         process.kill(pid, 0);
         return true;
     }
-    catch {
-        return false;
+    catch (error) {
+        return getNodeErrorCode(error) !== 'ESRCH';
     }
 }
 async function removeIfStaleLock(lockPath, staleMs, onStaleLockMessage) {

package/dist/src/core/firefox-cache.d.ts

@@ -14,7 +14,7 @@ export declare function sha256File(filePath: string): Promise<string>;
  * @param cacheDir - Cache directory
  * @param onProgress - Optional progress callback
  */
-export declare function ensureCachedArchive(archive: ResolvedArchive, cacheDir: string, onProgress?: ProgressCallback): Promise<void>;
+export declare function ensureCachedArchive(archive: ResolvedArchive, cacheDir: string, onProgress?: ProgressCallback, expectedSha256?: string): Promise<void>;
 /**
  * Removes cached tarball, metadata, and partial download files for an archive.
  * @param archive - Resolved archive descriptor

package/dist/src/core/firefox-cache.js

@@ -7,9 +7,11 @@ import { createReadStream } from 'node:fs';
 import { rename } from 'node:fs/promises';
 import { join } from 'node:path';
 import { pipeline } from 'node:stream/promises';
+import { DownloadError } from '../errors/download.js';
 import { toError } from '../utils/errors.js';
 import { pathExists, readJson, removeFile, writeJson } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
+import { createSiblingLockPath, withFileLock } from './file-lock.js';
 import { validateArchiveMetadata } from './firefox-archive.js';
 import { downloadFile } from './firefox-download.js';
 /**
@@ -28,12 +30,24 @@ export async function sha256File(filePath) {
  * @param cacheDir - Cache directory
  * @param onProgress - Optional progress callback
  */
-export async function ensureCachedArchive(archive, cacheDir, onProgress) {
-    if (await validateCachedArchive(archive, cacheDir)) {
-        return;
-    }
-    await invalidateArchiveCache(archive, cacheDir);
-    await downloadToCache(archive, cacheDir, onProgress);
+export async function ensureCachedArchive(archive, cacheDir, onProgress, expectedSha256) {
+    const lockPath = createSiblingLockPath(join(cacheDir, archive.filename), '.fireforge-cache.lock');
+    await withFileLock(lockPath, async () => {
+        if (await validateCachedArchive(archive, cacheDir, expectedSha256)) {
+            return;
+        }
+        if (await cacheEntryExists(archive, cacheDir)) {
+            await invalidateArchiveCache(archive, cacheDir);
+        }
+        else {
+            await removeArchivePartFiles(archive, cacheDir);
+        }
+        await downloadToCache(archive, cacheDir, onProgress, expectedSha256);
+    });
+}
+async function cacheEntryExists(archive, cacheDir) {
+    return ((await pathExists(join(cacheDir, archive.filename))) ||
+        (await pathExists(join(cacheDir, archive.metadataFilename))));
 }
 /**
  * Validates a cached archive using sidecar metadata and SHA-256 checksum.
@@ -41,7 +55,7 @@ export async function ensureCachedArchive(archive, cacheDir, onProgress) {
  * @param cacheDir - Cache directory
  * @returns True if the cache entry is valid
  */
-async function validateCachedArchive(archive, cacheDir) {
+async function validateCachedArchive(archive, cacheDir, expectedSha256) {
     const tarballPath = join(cacheDir, archive.filename);
     const metadataPath = join(cacheDir, archive.metadataFilename);
     if (!(await pathExists(tarballPath)) || !(await pathExists(metadataPath))) {
@@ -61,9 +75,12 @@ async function validateCachedArchive(archive, cacheDir) {
                 return false;
             }
         }
-        if (metadata.sha256) {
+        if (expectedSha256 || metadata.sha256) {
             const actualHash = await sha256File(tarballPath);
-            if (actualHash !== metadata.sha256) {
+            if (expectedSha256 && actualHash !== expectedSha256) {
+                return false;
+            }
+            if (metadata.sha256 && actualHash !== metadata.sha256) {
                 return false;
             }
         }
@@ -80,16 +97,21 @@ async function validateCachedArchive(archive, cacheDir) {
  * @param cacheDir - Cache directory
  * @param onProgress - Optional progress callback
  */
-async function downloadToCache(archive, cacheDir, onProgress) {
+async function downloadToCache(archive, cacheDir, onProgress, expectedSha256) {
     const tarballPath = join(cacheDir, archive.filename);
     // Use a unique .part path so concurrent downloads for the same archive
     // do not clobber each other's partial files.
     const partPath = `${tarballPath}.part-${randomUUID()}`;
     const metadataPath = join(cacheDir, archive.metadataFilename);
+    let promotedTarball = false;
     try {
         const contentLength = await downloadFile(archive.url, partPath, onProgress);
         await rename(partPath, tarballPath);
+        promotedTarball = true;
         const sha256 = await sha256File(tarballPath);
+        if (expectedSha256 && sha256 !== expectedSha256) {
+            throw new DownloadError(`Downloaded archive SHA-256 mismatch: expected ${expectedSha256}, got ${sha256}`, archive.url);
+        }
         await writeJson(metadataPath, {
             requestedVersion: archive.requestedVersion,
             product: archive.product,
@@ -102,8 +124,10 @@ async function downloadToCache(archive, cacheDir, onProgress) {
     }
     catch (error) {
         await removeFile(partPath);
-        await removeFile(tarballPath);
-        await removeFile(metadataPath);
+        if (promotedTarball) {
+            await removeFile(tarballPath);
+            await removeFile(metadataPath);
+        }
         throw error;
     }
 }
@@ -115,8 +139,11 @@ async function downloadToCache(archive, cacheDir, onProgress) {
 export async function invalidateArchiveCache(archive, cacheDir) {
     const tarballPath = join(cacheDir, archive.filename);
     const metadataPath = join(cacheDir, archive.metadataFilename);
-    // Clean up any partial download files (may have unique suffixes from
-    // concurrent download attempts).
+    await removeArchivePartFiles(archive, cacheDir);
+    await removeFile(tarballPath);
+    await removeFile(metadataPath);
+}
+async function removeArchivePartFiles(archive, cacheDir) {
     const partPrefix = `${archive.filename}.part`;
     try {
         const { readdir } = await import('node:fs/promises');
@@ -125,10 +152,9 @@ export async function invalidateArchiveCache(archive, cacheDir) {
             .filter((name) => name.startsWith(partPrefix))
             .map((name) => removeFile(join(cacheDir, name))));
     }
-    catch {
+    catch (error) {
+        void error;
         // Cache dir may not exist yet — that's fine.
     }
-    await removeFile(tarballPath);
-    await removeFile(metadataPath);
 }
 //# sourceMappingURL=firefox-cache.js.map

package/dist/src/core/firefox-download.js

@@ -73,20 +73,28 @@ export async function fetchWithRetry(url) {
  */
 function createStallDetector(url, timeoutMs = DOWNLOAD_STALL_TIMEOUT_MS) {
     let timer;
+    const clearTimer = () => {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+    };
     const detector = new Transform({
         transform(chunk, _encoding, callback) {
-            if (timer !== undefined)
-                clearTimeout(timer);
+            clearTimer();
             timer = setTimeout(() => {
                 detector.destroy(new DownloadError(`Download stalled: no data received for ${Math.round(timeoutMs / 1000)} seconds`, url));
             }, timeoutMs);
             callback(null, chunk);
         },
         flush(callback) {
-            if (timer !== undefined)
-                clearTimeout(timer);
+            clearTimer();
             callback();
         },
+        destroy(error, callback) {
+            clearTimer();
+            callback(error);
+        },
     });
     // Start the initial timer (covers the case where the first chunk never arrives).
     timer = setTimeout(() => {

package/dist/src/core/firefox.d.ts

@@ -45,4 +45,4 @@ export type FirefoxSourcePhaseCallback = (phase: FirefoxSourcePhase) => void;
  *   between phases (`'download'` → `'extract'`). Fires exactly once per
  *   phase even if the cached archive path skips the wire entirely.
  */
-export declare function downloadFirefoxSource(version: string, product: FirefoxProduct, destDir: string, cacheDir: string, onProgress?: ProgressCallback, onPhase?: FirefoxSourcePhaseCallback): Promise<void>;
+export declare function downloadFirefoxSource(version: string, product: FirefoxProduct, destDir: string, cacheDir: string, onProgress?: ProgressCallback, onPhase?: FirefoxSourcePhaseCallback, expectedSha256?: string): Promise<void>;

package/dist/src/core/firefox.js

@@ -44,13 +44,13 @@ export function getTarballFilename(version, product = 'firefox') {
  *   between phases (`'download'` → `'extract'`). Fires exactly once per
  *   phase even if the cached archive path skips the wire entirely.
  */
-export async function downloadFirefoxSource(version, product, destDir, cacheDir, onProgress, onPhase) {
+export async function downloadFirefoxSource(version, product, destDir, cacheDir, onProgress, onPhase, expectedSha256) {
     const archive = resolveArchive(version, product);
     const tarballPath = join(cacheDir, archive.filename);
     // Ensure cache directory exists
     await ensureDir(cacheDir);
     onPhase?.('download');
-    await ensureCachedArchive(archive, cacheDir, onProgress);
+    await ensureCachedArchive(archive, cacheDir, onProgress, expectedSha256);
     // Extract to a unique temporary directory so concurrent downloads for
     // the same destination do not clobber each other.
     onPhase?.('extract');

package/dist/src/core/furnace-refresh.js

@@ -17,6 +17,19 @@ import { readText, writeText } from '../utils/fs.js';
 import { exec } from '../utils/process.js';
 import { ensureGit } from './git-base.js';
 import { getFileContentAtRef } from './git-file-ops.js';
+function isFatalMergeStderr(stderr) {
+    return /(?:^|\n)\s*(?:fatal|error):/i.test(stderr);
+}
+function classifyMergeFileResult(result) {
+    if (result.exitCode === 0 && !isFatalMergeStderr(result.stderr)) {
+        return 0;
+    }
+    if (result.exitCode >= 1 && result.exitCode <= 127 && !isFatalMergeStderr(result.stderr)) {
+        return result.exitCode;
+    }
+    const detail = result.stderr.trim() || `exit code ${result.exitCode}`;
+    throw new FurnaceError(`git merge-file failed: ${detail}`);
+}
 /**
  * Performs a three-way merge on a single file.
  *
@@ -40,7 +53,8 @@ async function threeWayMergeFile(base, ours, theirs, label, strategy) {
         await writeText(tempOurs, ours);
         await writeText(tempTheirs, theirs);
         // git merge-file writes the result to the first file (ours) in-place.
-        // Exit code 0 = clean merge, >0 = number of conflicts, <0 = error.
+        // Exit code 0 = clean merge, 1..127 = conflict count, shell-exposed
+        // fatal errors typically arrive as >=128 (for example, 255).
         const mergeArgs = [
             'merge-file',
             ...(strategy ? [`--${strategy}`] : []),
@@ -55,11 +69,8 @@ async function threeWayMergeFile(base, ours, theirs, label, strategy) {
             tempTheirs,
         ];
         const result = await exec('git', mergeArgs);
+        const conflicts = classifyMergeFileResult(result);
         const merged = await readText(tempOurs);
-        const conflicts = result.exitCode > 0 ? result.exitCode : 0;
-        if (result.exitCode < 0) {
-            throw new FurnaceError(`git merge-file failed: ${result.stderr}`);
-        }
         return { merged, conflicts };
     }
     finally {

package/dist/src/core/patch-lint-imports.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Detects relative JS imports while avoiding comment/template false positives.
+ * Falls back to stripped-text matching for legacy chrome scripts Acorn cannot parse.
+ */
+export declare function hasRelativeImport(content: string): boolean;

package/dist/src/core/patch-lint-imports.js

@@ -0,0 +1,68 @@
+import { stripJsComments } from '../utils/regex.js';
+import { parseModule, parseScript, walkAST } from './ast-utils.js';
+const RELATIVE_IMPORT_FALLBACK_PATTERN = /(?:\bimport\s*(?:\(\s*)?(?:[\s\S]*?\bfrom\s*)?|\bexport\s+(?:[\s\S]*?\bfrom\s*)?|(?:ChromeUtils\.import(?:ESModule)?|Cu\.import)\s*\(\s*)["'](?:\.\.?\/)/m;
+function literalString(node) {
+    if (!node || node.type !== 'Literal')
+        return undefined;
+    return typeof node.value === 'string' ? node.value : undefined;
+}
+function isRelativeSpecifier(value) {
+    return value !== undefined && (value.startsWith('./') || value.startsWith('../'));
+}
+function isChromeImportCall(node) {
+    const callee = node.callee;
+    if (callee.type !== 'MemberExpression' || callee.computed)
+        return false;
+    if (callee.object.type !== 'Identifier' || callee.property.type !== 'Identifier')
+        return false;
+    if (callee.object.name === 'Cu') {
+        return callee.property.name === 'import';
+    }
+    return (callee.object.name === 'ChromeUtils' &&
+        (callee.property.name === 'import' || callee.property.name === 'importESModule'));
+}
+function astHasRelativeImport(content, sourceType) {
+    const ast = sourceType === 'module' ? parseModule(content) : parseScript(content);
+    let found = false;
+    walkAST(ast, {
+        enter(node) {
+            if (found) {
+                this.skip();
+                return;
+            }
+            if (node.type === 'ImportDeclaration') {
+                found = isRelativeSpecifier(literalString(node.source));
+            }
+            else if (node.type === 'ImportExpression') {
+                found = isRelativeSpecifier(literalString(node.source));
+            }
+            else if (node.type === 'ExportNamedDeclaration' || node.type === 'ExportAllDeclaration') {
+                found = isRelativeSpecifier(literalString(node.source));
+            }
+            else if (node.type === 'CallExpression' && isChromeImportCall(node)) {
+                found = isRelativeSpecifier(literalString(node.arguments[0]));
+            }
+        },
+    });
+    return found;
+}
+/**
+ * Detects relative JS imports while avoiding comment/template false positives.
+ * Falls back to stripped-text matching for legacy chrome scripts Acorn cannot parse.
+ */
+export function hasRelativeImport(content) {
+    try {
+        return astHasRelativeImport(content, 'module');
+    }
+    catch (moduleError) {
+        void moduleError;
+    }
+    try {
+        return astHasRelativeImport(content, 'script');
+    }
+    catch (scriptError) {
+        void scriptError;
+    }
+    return RELATIVE_IMPORT_FALLBACK_PATTERN.test(stripJsComments(content));
+}
+//# sourceMappingURL=patch-lint-imports.js.map

package/dist/src/core/patch-lint.js

@@ -10,6 +10,7 @@ import { invokePatchLintCheckJs } from './patch-lint-checkjs.js';
 import { lintChromeScriptJsDocForFile } from './patch-lint-chrome-jsdoc.js';
 import { detectNewFilesInDiff, extractAddedLinesPerFile } from './patch-lint-diff.js';
 import { AGGREGATE_PATCH_FILE } from './patch-lint-diff-tag.js';
+import { hasRelativeImport } from './patch-lint-imports.js';
 import { validateExportJsDoc } from './patch-lint-jsdoc.js';
 import { resolvePatchOwnedChromeScripts, resolvePatchOwnedSysMjs } from './patch-lint-ownership.js';
 // ---------------------------------------------------------------------------
@@ -423,9 +424,7 @@ export async function lintPatchedJs(repoDir, affectedFiles, newFiles, config, pa
         const isSysMjs = file.endsWith('.sys.mjs');
         // 1. Relative import check
         const strippedContent = stripJsComments(content);
-        const relativeImportPattern = /(?:ChromeUtils\.import(?:ESModule)?|Cu\.import)\s*\(\s*["'](?:\.\.?\/)/gm;
-        const esRelativePattern = /\bimport\s+.*?\s+from\s+["'](?:\.\.?\/)/gm;
-        if (relativeImportPattern.test(strippedContent) || esRelativePattern.test(strippedContent)) {
+        if (hasRelativeImport(content)) {
             issues.push({
                 file,
                 check: 'relative-import',

package/dist/src/types/commands/options.d.ts

@@ -426,15 +426,15 @@ export interface FurnaceCreateOptions {
     /**
      * Test harness style to scaffold when `--with-tests` is set.
      *
-     * - `mochikit` (default when `--with-tests` is set alone) — a MochiKit
-     *   test at `engine/toolkit/content/tests/widgets/test_<tag>.html` that
-     *   loads the component module directly via `chrome://global/` and
-     *   asserts against `customElements`. Runs today on forks whose
-     *   top-level chrome document (e.g. `mybrowser.xhtml`) lacks a
-     *   `tabbrowser`, because it doesn't go through `URILoadingHelper`.
-     * - `browser-chrome` — today's browser-mochitest scaffold, requires a
-     *   working tabbrowser. Use for components that talk to the browser
-     *   window or open URLs.
+     * - `browser-chrome` (default when `--with-tests` is set without
+     *   `--test-style`) — browser mochitest scaffold; requires a working
+     *   `tabbrowser`. Prefer this for interactive chrome/widget coverage
+     *   (including on macOS).
+     * - `mochikit` — opt-in MochiKit test at
+     *   `engine/toolkit/content/tests/widgets/test_<tag>.html` that loads
+     *   the component via `chrome://global/`. Use when the top-level chrome
+     *   document lacks a `tabbrowser`; on macOS the toolkit mochitest-chrome
+     *   flavor can be unreliable (long idle timeout).
      * - `xpcshell` — equivalent to setting `--xpcshell`; headless, storage-only.
      */
     testStyle?: 'mochikit' | 'browser-chrome' | 'xpcshell';

package/dist/src/types/config.d.ts

@@ -10,6 +10,8 @@ export interface FirefoxConfig {
     version: string;
     /** Firefox product type */
     product: FirefoxProduct;
+    /** Optional pinned SHA-256 for the resolved source archive */
+    sha256?: string;
 }
 /**
  * Supported project license SPDX identifiers.

package/dist/src/utils/fs.d.ts

@@ -3,6 +3,11 @@
  * @param path - Path to check
  */
 export declare function pathExists(path: string): Promise<boolean>;
+/**
+ * Checks if a path exists while surfacing permission errors.
+ * @param path - Path to check
+ */
+export declare function pathExistsStrict(path: string): Promise<boolean>;
 /**
  * Ensures a directory exists, creating it recursively if needed.
  * @param path - Directory path to ensure