@hominis/fireforge 0.30.1 → 0.32.0

package/dist/src/commands/import.js

@@ -200,6 +200,108 @@ function buildUntilFilenameSet(patches, until) {
     }
     return set;
 }
+/**
+ * Runs the manifest consistency check, scoped to the `--until` subset:
+ * global (manifest-level) issues always block, per-patch issues only
+ * block when the patch is in scope. Throws GeneralError with the repair
+ * hint when anything in scope is broken.
+ */
+async function assertScopedManifestConsistency(patchesDir, untilFilenameSet, until) {
+    const manifestConsistencyIssues = await validatePatchesManifestConsistency(patchesDir);
+    const scopedManifestIssues = until !== undefined
+        ? manifestConsistencyIssues.filter((issue) => 
+        // Global (manifest-level) issues have no specific filename to scope
+        // against — a missing or unparseable patches.json blocks any
+        // import. Per-patch issues only block when the patch is in scope.
+        issue.code === 'manifest-missing' ||
+            issue.code === 'manifest-invalid' ||
+            untilFilenameSet.has(issue.filename))
+        : manifestConsistencyIssues;
+    if (scopedManifestIssues.length > 0) {
+        const issueSummary = scopedManifestIssues.map((issue) => issue.message).join('\n  ');
+        throw new GeneralError('Patch manifest consistency check failed. Repair patches/patches.json before importing.\n' +
+            `  ${issueSummary}\n\n` +
+            'Run "fireforge doctor --repair-patches-manifest" to rebuild the manifest from on-disk patch files.');
+    }
+}
+/**
+ * Prints advisory version-compatibility warnings for every in-scope patch
+ * whose recorded source version differs meaningfully from the configured
+ * Firefox version. Advisory only — never blocks the import.
+ */
+async function warnVersionCompatibility(projectRoot, manifest, untilFilenameSet, until) {
+    if (!manifest)
+        return;
+    const config = await loadConfig(projectRoot);
+    const currentVersion = config.firefox.version;
+    for (const patch of manifest.patches) {
+        // Scope the advisory warnings too: an operator running with --until
+        // doesn't need to see version warnings for patches outside the range.
+        if (until !== undefined && !untilFilenameSet.has(patch.filename))
+            continue;
+        const warning = checkVersionCompatibility(getPatchSourceVersion(patch), currentVersion);
+        if (warning) {
+            warn(`${patch.filename}: ${warning}`);
+        }
+    }
+}
+/**
+ * Patch-integrity gate: surfaces orphaned-modification issues scoped to
+ * the `--until` range and decides whether the import may proceed —
+ * `--force` continues with a warning, non-TTY refuses loudly, and an
+ * interactive operator is prompted. Returns false when the import should
+ * stop (the cancel outro has been printed).
+ */
+async function gateImportIntegrity(paths, untilFilenameSet, until, forceImport) {
+    const allIntegrityIssues = await validatePatchIntegrity(paths.patches, paths.engine);
+    const integrityIssues = until !== undefined
+        ? allIntegrityIssues.filter((issue) => untilFilenameSet.has(issue.filename))
+        : allIntegrityIssues;
+    if (integrityIssues.length > 0) {
+        warn('\nPatch integrity issues detected:');
+        for (const issue of integrityIssues) {
+            warn(`  ${issue.filename}: ${issue.message}`);
+        }
+        info('Run "fireforge doctor" for more details.');
+        if (forceImport) {
+            warn('Continuing because --force was provided. Integrity issues were not resolved.\n');
+        }
+        else if (!process.stdin.isTTY) {
+            throw new GeneralError(`Refusing to import while ${integrityIssues.length} patch integrity issue(s) are unresolved. ` +
+                `Fix the issues reported above (see "fireforge doctor") or re-run with --force to continue anyway.`);
+        }
+        else {
+            const shouldContinue = await confirm({
+                message: 'Patch integrity issues detected. Continuing may fail with cascading errors during patch application. Continue anyway?',
+                initialValue: false,
+            });
+            if (isCancel(shouldContinue) || !shouldContinue) {
+                outro('Import cancelled — fix the integrity issues and re-run');
+                return false;
+            }
+        }
+    }
+    return true;
+}
+/**
+ * Dry-run rendering: lists the in-scope patches (or the bare count when no
+ * manifest exists) and prints the dry-run outro.
+ */
+function renderImportDryRun(manifest, untilFilenameSet, until, patchCount) {
+    if (manifest) {
+        const patches = until !== undefined
+            ? manifest.patches.filter((p) => untilFilenameSet.has(p.filename))
+            : manifest.patches;
+        info(`\n[dry-run] Would apply ${patches.length} patch(es) in order:`);
+        for (const patch of patches) {
+            info(`  ${patch.filename} (${patch.filesAffected.length} file${patch.filesAffected.length === 1 ? '' : 's'})`);
+        }
+    }
+    else {
+        info(`\n[dry-run] Would apply ${patchCount} patch(es)`);
+    }
+    outro('Dry run complete — no changes made');
+}
 /**
  * Runs the import command to apply patches.
  * @param projectRoot - Root directory of the project
@@ -245,37 +347,8 @@ export async function importCommand(projectRoot, options = {}) {
     const untilFilenameSet = buildUntilFilenameSet(manifest?.patches ?? [], options.until);
     const scopedPatchCount = options.until !== undefined ? untilFilenameSet.size : patchCount;
     info(`Found ${scopedPatchCount} patch${scopedPatchCount === 1 ? '' : 'es'} to apply${options.until !== undefined ? ` (up to ${options.until})` : ''}`);
-    const manifestConsistencyIssues = await validatePatchesManifestConsistency(paths.patches);
-    const scopedManifestIssues = options.until !== undefined
-        ? manifestConsistencyIssues.filter((issue) => 
-        // Global (manifest-level) issues have no specific filename to scope
-        // against — a missing or unparseable patches.json blocks any
-        // import. Per-patch issues only block when the patch is in scope.
-        issue.code === 'manifest-missing' ||
-            issue.code === 'manifest-invalid' ||
-            untilFilenameSet.has(issue.filename))
-        : manifestConsistencyIssues;
-    if (scopedManifestIssues.length > 0) {
-        const issueSummary = scopedManifestIssues.map((issue) => issue.message).join('\n  ');
-        throw new GeneralError('Patch manifest consistency check failed. Repair patches/patches.json before importing.\n' +
-            `  ${issueSummary}\n\n` +
-            'Run "fireforge doctor --repair-patches-manifest" to rebuild the manifest from on-disk patch files.');
-    }
-    // Version compatibility warnings (advisory only)
-    if (manifest) {
-        const config = await loadConfig(projectRoot);
-        const currentVersion = config.firefox.version;
-        for (const patch of manifest.patches) {
-            // Scope the advisory warnings too: an operator running with --until
-            // doesn't need to see version warnings for patches outside the range.
-            if (options.until !== undefined && !untilFilenameSet.has(patch.filename))
-                continue;
-            const warning = checkVersionCompatibility(getPatchSourceVersion(patch), currentVersion);
-            if (warning) {
-                warn(`${patch.filename}: ${warning}`);
-            }
-        }
-    }
+    await assertScopedManifestConsistency(paths.patches, untilFilenameSet, options.until);
+    await warnVersionCompatibility(projectRoot, manifest, untilFilenameSet, options.until);
     // Validate patch integrity (detect orphaned modification patches). Warn
     // and prompt the operator to confirm before proceeding — the legacy
     // warn-and-continue behaviour hid the real root cause because import
@@ -286,49 +359,11 @@ export async function importCommand(projectRoot, options = {}) {
     // integrity problems should not block importing an earlier good subset,
     // which is exactly what operators reach for when the tail of the queue
     // is broken and they want to keep working against an earlier checkpoint.
-    const allIntegrityIssues = await validatePatchIntegrity(paths.patches, paths.engine);
-    const integrityIssues = options.until !== undefined
-        ? allIntegrityIssues.filter((issue) => untilFilenameSet.has(issue.filename))
-        : allIntegrityIssues;
-    if (integrityIssues.length > 0) {
-        warn('\nPatch integrity issues detected:');
-        for (const issue of integrityIssues) {
-            warn(`  ${issue.filename}: ${issue.message}`);
-        }
-        info('Run "fireforge doctor" for more details.');
-        if (forceImport) {
-            warn('Continuing because --force was provided. Integrity issues were not resolved.\n');
-        }
-        else if (!process.stdin.isTTY) {
-            throw new GeneralError(`Refusing to import while ${integrityIssues.length} patch integrity issue(s) are unresolved. ` +
-                `Fix the issues reported above (see "fireforge doctor") or re-run with --force to continue anyway.`);
-        }
-        else {
-            const shouldContinue = await confirm({
-                message: 'Patch integrity issues detected. Continuing may fail with cascading errors during patch application. Continue anyway?',
-                initialValue: false,
-            });
-            if (isCancel(shouldContinue) || !shouldContinue) {
-                outro('Import cancelled — fix the integrity issues and re-run');
-                return;
-            }
-        }
-    }
-    // Dry-run: list patches that would be applied and exit
+    const integrityOk = await gateImportIntegrity(paths, untilFilenameSet, options.until, forceImport);
+    if (!integrityOk)
+        return;
     if (isDryRun) {
-        if (manifest) {
-            const patches = options.until !== undefined
-                ? manifest.patches.filter((p) => untilFilenameSet.has(p.filename))
-                : manifest.patches;
-            info(`\n[dry-run] Would apply ${patches.length} patch(es) in order:`);
-            for (const patch of patches) {
-                info(`  ${patch.filename} (${patch.filesAffected.length} file${patch.filesAffected.length === 1 ? '' : 's'})`);
-            }
-        }
-        else {
-            info(`\n[dry-run] Would apply ${patchCount} patch(es)`);
-        }
-        outro('Dry run complete — no changes made');
+        renderImportDryRun(manifest, untilFilenameSet, options.until, patchCount);
         return;
     }
     await checkUncommittedPatchFiles(paths.engine, paths.patches, forceImport);

package/dist/src/commands/lint-per-patch.d.ts

@@ -1,8 +1,10 @@
 import { getProjectPaths } from '../core/config.js';
-import type { LintCommandOptions } from './lint.js';
+import type { LintCommandOptions } from '../types/commands/index.js';
 /**
  * Lints each patch in the queue as its own isolated diff, honouring
  * per-patch `lintIgnore` entries. Cross-patch rules still run once over
  * the whole queue so queue-level findings are not lost by the rescoping.
+ * With `options.patches` set, only the named subset is linted (and the
+ * queue-level findings are scoped to files those patches touch).
  */
 export declare function lintPerPatch(projectRoot: string, paths: ReturnType<typeof getProjectPaths>, options?: LintCommandOptions): Promise<void>;

package/dist/src/commands/lint-per-patch.js

@@ -4,6 +4,8 @@ import { loadConfig } from '../core/config.js';
 import { getDiffForFilesAgainstHead } from '../core/git-diff.js';
 import { buildPerPatchLintCacheKey, getCachedPerPatchLintIssues, getPerPatchLintCacheHeadSha, loadPerPatchLintCache, savePerPatchLintCache, setCachedPerPatchLintIssues, } from '../core/lint-cache.js';
 import { buildPatchQueueContext, lintExportedPatch, lintPatchQueue, resolvePatchSizeTier, } from '../core/patch-lint.js';
+import { invokePatchLintCheckJsGrouped, } from '../core/patch-lint-checkjs.js';
+import { resolvePatchOwnedSysMjs } from '../core/patch-lint-ownership.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { evaluatePatchPolicy } from '../core/patch-policy.js';
 import { GeneralError } from '../errors/base.js';
@@ -22,94 +24,150 @@ function emitTierNotice(filename, files, tier) {
         : `${filename}: branding threshold tier applied (all files under browser/branding/ plus registration siblings).`);
 }
 /**
- * Lints each patch in the queue as its own isolated diff, honouring
- * per-patch `lintIgnore` entries. Cross-patch rules still run once over
- * the whole queue so queue-level findings are not lost by the rescoping.
+ * Lints one queued patch against its own isolated diff, reusing the cache entry
+ * when the cache key matches. Returns the outcome and the patch's (unprefixed)
+ * issues without touching shared state — the orchestrator applies the tier
+ * notice, issue prefixing, and cache write in patch order after the pool
+ * drains, so the bounded concurrency cannot reorder output. Returns `skipped`
+ * (no files present / empty diff), `cached`, or `linted`.
  */
-export async function lintPerPatch(projectRoot, paths, options = {}) {
-    const manifest = await loadPatchesManifest(paths.patches);
-    if (!manifest || manifest.patches.length === 0) {
-        info('No patches in manifest — nothing to lint per-patch.');
-        outro('Nothing to lint');
-        return;
+async function lintQueuedPatch(patch, lintCtx) {
+    const { projectRoot, paths, config, ctx, cache, engineHeadSha } = lintCtx;
+    const existing = [];
+    for (const f of patch.filesAffected) {
+        if (await pathExists(join(paths.engine, f)))
+            existing.push(f);
     }
-    const config = await loadConfig(projectRoot);
-    const ctx = await buildPatchQueueContext(paths.patches);
-    const cache = options.noCache === true ? undefined : await loadPerPatchLintCache(projectRoot);
-    const engineHeadSha = cache ? await getPerPatchLintCacheHeadSha(paths.engine) : undefined;
-    let cacheDirty = false;
-    let reusedCacheEntries = 0;
-    const issues = [];
-    for (const issue of evaluatePatchPolicy(config, manifest)) {
-        issues.push({
-            file: issue.filename,
-            check: `patch-policy/${issue.code}`,
-            message: issue.message,
-            severity: issue.severity,
+    if (existing.length === 0) {
+        return { status: 'skipped', existingFiles: [], rawIssues: [], usedCheckJs: false };
+    }
+    const ignore = patch.lintIgnore?.length ? new Set(patch.lintIgnore) : undefined;
+    let cacheKey;
+    if (cache) {
+        cacheKey = await buildPerPatchLintCacheKey({
+            projectRoot,
+            engineDir: paths.engine,
+            patchesDir: paths.patches,
+            patch,
+            existingFiles: existing,
+            config,
+            queueContext: ctx,
+            ...(engineHeadSha === undefined ? {} : { engineHeadSha }),
         });
+        const cached = getCachedPerPatchLintIssues(cache, patch.filename, cacheKey);
+        if (cached) {
+            return { status: 'cached', existingFiles: existing, rawIssues: cached, usedCheckJs: false };
+        }
+    }
+    const diff = await getDiffForFilesAgainstHead(paths.engine, existing);
+    if (!diff.trim()) {
+        return { status: 'skipped', existingFiles: [], rawIssues: [], usedCheckJs: false };
     }
-    let linted = 0;
-    let skipped = 0;
-    for (const patch of manifest.patches) {
-        const existing = [];
-        for (const f of patch.filesAffected) {
-            if (await pathExists(join(paths.engine, f)))
-                existing.push(f);
+    // checkJs: instead of rebuilding the program per patch, slice this patch's
+    // findings out of the one queue-wide program (built lazily on first miss).
+    let lintOptions;
+    let usedCheckJs = false;
+    if (lintCtx.checkJs) {
+        const grouped = await lintCtx.checkJs.getGrouped();
+        usedCheckJs = true;
+        const owned = lintCtx.checkJs.ownedByPatch.get(patch.filename);
+        const precomputedCheckJs = [];
+        if (owned) {
+            for (const rel of owned)
+                precomputedCheckJs.push(...(grouped.byFile.get(rel) ?? []));
         }
-        if (existing.length === 0) {
-            skipped++;
+        lintOptions = { precomputedCheckJs };
+    }
+    const patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, ctx, ignore, patch.tier, lintOptions);
+    const result = {
+        status: 'linted',
+        existingFiles: existing,
+        rawIssues: patchIssues,
+        usedCheckJs,
+    };
+    if (cache && cacheKey) {
+        result.cacheWrite = { key: cacheKey, issues: patchIssues };
+    }
+    return result;
+}
+/**
+ * Applies the per-patch results in patch order so the bounded concurrency
+ * cannot reorder output: emits each tier notice, the once-only run-level
+ * checkJs errors (before the first freshly linted patch's issues), the
+ * filename-prefixed issue rows, and the cache writes — all in the same sequence
+ * a serial run produced. Returns the run tallies.
+ */
+async function applyPerPatchResults(subset, results, issues, checkJs, cache) {
+    const totals = {
+        linted: 0,
+        skipped: 0,
+        cacheDirty: false,
+        reusedCacheEntries: 0,
+    };
+    let globalCheckJsEmitted = false;
+    for (let i = 0; i < subset.length; i++) {
+        const patch = subset[i];
+        const result = results[i];
+        if (!patch || !result)
             continue;
-        }
-        const ignore = patch.lintIgnore?.length ? new Set(patch.lintIgnore) : undefined;
-        let patchIssues;
-        let cacheKey;
-        if (cache) {
-            cacheKey = await buildPerPatchLintCacheKey({
-                projectRoot,
-                engineDir: paths.engine,
-                patchesDir: paths.patches,
-                patch,
-                existingFiles: existing,
-                config,
-                queueContext: ctx,
-                ...(engineHeadSha === undefined ? {} : { engineHeadSha }),
-            });
-            patchIssues = getCachedPerPatchLintIssues(cache, patch.filename, cacheKey);
-            if (patchIssues) {
-                reusedCacheEntries++;
-                emitTierNotice(patch.filename, existing, patch.tier);
-                for (const issue of patchIssues) {
-                    issues.push({ ...issue, file: `${patch.filename} :: ${issue.file}` });
-                }
-                linted++;
-                continue;
-            }
-        }
-        const diff = await getDiffForFilesAgainstHead(paths.engine, existing);
-        if (!diff.trim()) {
-            skipped++;
+        if (result.status === 'skipped') {
+            totals.skipped++;
             continue;
         }
-        emitTierNotice(patch.filename, existing, patch.tier);
-        if (cache && cacheKey) {
-            patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, ctx, ignore, patch.tier);
-            setCachedPerPatchLintIssues(cache, patch.filename, cacheKey, patchIssues);
-            cacheDirty = true;
+        emitTierNotice(patch.filename, result.existingFiles, patch.tier);
+        // Run-level checkJs errors are emitted once, before the first freshly
+        // linted patch's own issues — matching the serial emit point.
+        if (result.usedCheckJs && checkJs && !globalCheckJsEmitted) {
+            globalCheckJsEmitted = true;
+            issues.push(...(await checkJs.getGlobal()));
         }
-        else {
-            patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, ctx, ignore, patch.tier);
+        if (result.cacheWrite && cache) {
+            setCachedPerPatchLintIssues(cache, patch.filename, result.cacheWrite.key, result.cacheWrite.issues);
+            totals.cacheDirty = true;
         }
-        for (const issue of patchIssues) {
+        for (const issue of result.rawIssues) {
             issues.push({ ...issue, file: `${patch.filename} :: ${issue.file}` });
         }
-        linted++;
+        if (result.status === 'cached')
+            totals.reusedCacheEntries++;
+        totals.linted++;
     }
-    issues.push(...lintPatchQueue(ctx));
-    if (cache && cacheDirty)
-        await savePerPatchLintCache(projectRoot, cache);
-    if (reusedCacheEntries > 0) {
-        info(`Reused lint cache for ${reusedCacheEntries} patch${reusedCacheEntries === 1 ? '' : 'es'}.`);
+    return totals;
+}
+/**
+ * Maximum patches linted concurrently. After the per-file→batched git change,
+ * each patch is only a handful of git spawns, so a small pool overlaps their
+ * I/O without oversubscribing git on the shared repository.
+ */
+const PER_PATCH_LINT_CONCURRENCY = 8;
+/**
+ * Lints every patch in `subset` with bounded concurrency, returning results in
+ * patch order (each slot index matches `subset`). Mirrors the worker-pool idiom
+ * used by the rollback restore path. Side effects are deferred to the caller so
+ * issue ordering and cache writes stay deterministic.
+ */
+async function lintSubsetConcurrently(subset, lintCtx) {
+    const results = new Array(subset.length);
+    let index = 0;
+    async function worker() {
+        while (index < subset.length) {
+            const current = index++;
+            const patch = subset[current];
+            if (!patch)
+                break;
+            results[current] = await lintQueuedPatch(patch, lintCtx);
+        }
     }
+    const workers = Array.from({ length: Math.min(PER_PATCH_LINT_CONCURRENCY, subset.length) }, () => worker());
+    await Promise.all(workers);
+    return results;
+}
+/**
+ * Reporting + exit phase of per-patch lint: renders every issue row,
+ * prints the per-patch summary, and applies the failure criteria
+ * (errors, `--max-warnings`) by throwing GeneralError.
+ */
+function reportPerPatchOutcome(issues, linted, skipped, options) {
     if (issues.length === 0) {
         if (linted === 0 && skipped > 0) {
             info(`No patches in the queue have been applied to engine/. Run "fireforge import" first if you want lint findings against the staged hunks; otherwise this is expected.`);
@@ -149,4 +207,137 @@ export async function lintPerPatch(projectRoot, paths, options = {}) {
         outro('Lint passed');
     }
 }
+/**
+ * Resolves the `--patches <name…>` subset filter against the manifest,
+ * matching each requested name tolerantly (exact filename, filename ±
+ * `.patch`, or the manifest `name` field). Throws listing the available
+ * patches when a requested name matches none, so a typo fails loud rather
+ * than silently linting nothing.
+ */
+function selectPatchSubset(manifest, requested) {
+    const matches = (p, name) => p.filename === name ||
+        p.filename === `${name}.patch` ||
+        p.filename.replace(/\.patch$/, '') === name.replace(/\.patch$/, '') ||
+        p.name === name;
+    const selected = [];
+    const seen = new Set();
+    for (const name of requested) {
+        const found = manifest.patches.filter((p) => matches(p, name));
+        if (found.length === 0) {
+            const available = manifest.patches.map((p) => p.filename).join(', ');
+            throw new GeneralError(`--patches: no patch in the queue matches "${name}". Available patches: ${available}`);
+        }
+        for (const p of found) {
+            if (!seen.has(p.filename)) {
+                seen.add(p.filename);
+                selected.push(p);
+            }
+        }
+    }
+    return selected;
+}
+/**
+ * Builds the per-run checkJs program controller when `patchLint.checkJs` is
+ * enabled, or returns undefined. The program is built lazily on the first
+ * cache miss (so an all-warm run never pays for it) and reused for every
+ * subsequent patch in the run.
+ */
+function buildPerRunCheckJs(projectRoot, paths, config, ctx) {
+    const patchLint = config.patchLint;
+    if (!patchLint?.checkJs)
+        return undefined;
+    const ownedByPatch = new Map();
+    for (const entry of ctx.entries) {
+        const owned = new Set();
+        for (const f of entry.newFiles.keys()) {
+            if (f.endsWith('.sys.mjs'))
+                owned.add(f);
+        }
+        if (owned.size > 0)
+            ownedByPatch.set(entry.filename, owned);
+    }
+    // Memoise the *promise*, not the resolved value: under the bounded pool
+    // several patches can reach `getGrouped` before the first build resolves, and
+    // `??=` on the promise (a synchronous expression) guarantees a single build.
+    let groupedPromise;
+    return {
+        ownedByPatch,
+        getGrouped: () => (groupedPromise ??= invokePatchLintCheckJsGrouped(paths.engine, resolvePatchOwnedSysMjs(new Set(), ctx), patchLint, projectRoot)),
+        getGlobal: async () => (groupedPromise ? (await groupedPromise).global : []),
+    };
+}
+/**
+ * Lints each patch in the queue as its own isolated diff, honouring
+ * per-patch `lintIgnore` entries. Cross-patch rules still run once over
+ * the whole queue so queue-level findings are not lost by the rescoping.
+ * With `options.patches` set, only the named subset is linted (and the
+ * queue-level findings are scoped to files those patches touch).
+ */
+export async function lintPerPatch(projectRoot, paths, options = {}) {
+    const manifest = await loadPatchesManifest(paths.patches);
+    if (!manifest || manifest.patches.length === 0) {
+        info('No patches in manifest — nothing to lint per-patch.');
+        outro('Nothing to lint');
+        return;
+    }
+    const subset = options.patches && options.patches.length > 0
+        ? selectPatchSubset(manifest, options.patches)
+        : manifest.patches;
+    const subsetNames = new Set(subset.map((p) => p.filename));
+    const isSubset = subset.length !== manifest.patches.length;
+    const config = await loadConfig(projectRoot);
+    const ctx = await buildPatchQueueContext(paths.patches);
+    // Queue-level findings (policy, cross-patch) are scoped to the requested
+    // subset: a 5-patch slice should not fail on a policy or forward-import
+    // problem owned entirely by patches the operator did not target.
+    const subsetTouchedFiles = new Set();
+    if (isSubset) {
+        for (const entry of ctx.entries) {
+            if (!subsetNames.has(entry.filename))
+                continue;
+            for (const f of entry.newFiles.keys())
+                subsetTouchedFiles.add(f);
+            for (const f of entry.modifiedFileAdditions.keys())
+                subsetTouchedFiles.add(f);
+        }
+    }
+    const cache = options.noCache === true ? undefined : await loadPerPatchLintCache(projectRoot);
+    const engineHeadSha = cache ? await getPerPatchLintCacheHeadSha(paths.engine) : undefined;
+    const issues = [];
+    for (const issue of evaluatePatchPolicy(config, manifest)) {
+        if (isSubset && !subsetNames.has(issue.filename))
+            continue;
+        issues.push({
+            file: issue.filename,
+            check: `patch-policy/${issue.code}`,
+            message: issue.message,
+            severity: issue.severity,
+        });
+    }
+    const checkJs = buildPerRunCheckJs(projectRoot, paths, config, ctx);
+    // Lint patches concurrently, then apply every side effect in patch order so
+    // the issue rows, the run-level checkJs errors, and the saved cache are
+    // identical to a serial run.
+    const results = await lintSubsetConcurrently(subset, {
+        projectRoot,
+        paths,
+        config,
+        ctx,
+        cache,
+        engineHeadSha,
+        checkJs,
+    });
+    const { linted, skipped, cacheDirty, reusedCacheEntries } = await applyPerPatchResults(subset, results, issues, checkJs, cache);
+    for (const issue of lintPatchQueue(ctx)) {
+        if (isSubset && !subsetTouchedFiles.has(issue.file))
+            continue;
+        issues.push(issue);
+    }
+    if (cache && cacheDirty)
+        await savePerPatchLintCache(projectRoot, cache);
+    if (reusedCacheEntries > 0) {
+        info(`Reused lint cache for ${reusedCacheEntries} patch${reusedCacheEntries === 1 ? '' : 'es'}.`);
+    }
+    reportPerPatchOutcome(issues, linted, skipped, options);
+}
 //# sourceMappingURL=lint-per-patch.js.map

package/dist/src/commands/lint.d.ts

@@ -1,63 +1,6 @@
 import { Command } from 'commander';
 import type { CommandContext } from '../types/cli.js';
-import type { PatchLintIssue } from '../types/commands/index.js';
-/** Options controlling how the lint command filters and tags its output. */
-export interface LintCommandOptions {
-    /**
-     * When set, tag each issue as `introduced` or `cumulative` based on
-     * whether its file changed since this git revision (e.g. `HEAD`, a
-     * branch name, or a SHA). Issues are not filtered — the full set still
-     * prints — but a diff-scoped summary makes it trivial to see which
-     * errors the current task introduced.
-     */
-    since?: string;
-    /**
-     * When set together with {@link since}, scope the exit code to issues
-     * tagged `introduced`. Cumulative pre-existing errors still print (so
-     * the operator can still see the full queue state) but do not fail
-     * lint. Motivating case: a branch whose diff is clean but whose repo
-     * already carries unrelated `raw-color` / license-header errors from
-     * older patches. Without this flag, CI treats the clean branch as
-     * failing; with it, a branch "breaks the build" only when its own diff
-     * introduced a new error.
-     *
-     * Requires {@link since}: without a revision to diff against there is
-     * no distinction between introduced and cumulative, so the flag is
-     * rejected up-front rather than silently ignored.
-     */
-    onlyIntroduced?: boolean;
-    /**
-     * Lint each patch in the queue as its own isolated diff, rather than
-     * the aggregate `git diff HEAD` across all applied patches.
-     *
-     * Motivating case: running `fireforge lint` (no args) on a repo where
-     * `fireforge import` or `fireforge rebase` has just applied the full
-     * patch queue produces an aggregate diff (every patch's changes
-     * summed). The patch-size advisory rules (`large-patch-lines`,
-     * `large-patch-files`) then fire against the sum — e.g. "Patch is
-     * 37529 lines" on a queue of 22 individually-fine patches — which
-     * reads as a task-specific regression when it is really an artefact
-     * of the aggregation. `--per-patch` rescopes the diff to each patch's
-     * own `filesAffected`, honours the patch's own `lintIgnore`, and runs
-     * the cross-patch rules once over the whole queue so queue-level
-     * findings (duplicate creations, forward imports) still surface.
-     *
-     * Mutually exclusive with passing explicit file paths — the two
-     * scope contracts are different.
-     */
-    perPatch?: boolean;
-    /**
-     * Maximum warning count tolerated before lint exits non-zero. Mirrors
-     * ESLint's `--max-warnings` shape for release gates that want advisory
-     * findings to become blocking without changing default CLI behavior.
-     */
-    maxWarnings?: number;
-    /**
-     * Bypass per-patch lint cache reads and writes. Accepted in aggregate mode
-     * for CLI consistency, but only `--per-patch` currently uses the cache.
-     */
-    noCache?: boolean;
-}
+import type { LintCommandOptions, PatchLintIssue } from '../types/commands/index.js';
 /**
  * Result of {@link applyAggregateLintIgnoreSuppression}.
  */