@hominis/fireforge 0.31.0 → 0.32.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.32.0
+
+- Fixed `fireforge lint <files>` to evaluate the `large-patch-files` rule against each file's resolved owning patch instead of the ad-hoc file-list cardinality, so a cross-patch selection no longer synthesizes a phantom oversized patch (e.g. eight files across four patches no longer report `Patch affects 8 files` when no single owner exceeds the threshold). The size rules now run per owning patch — using its real `filesAffected` count, diff, and `tier` — and unowned files are evaluated together as one prospective new patch.
+- Taught the ad-hoc `lint <files>` path to honour each file's owning-patch `lintIgnore`, so a check waived via `fireforge patch lint-ignore` is suppressed consistently across `lint <files>`, `lint --per-patch`, and `re-export --dry-run` — the three invocation modes now agree on the same warning set for the same files.
+- Added `fireforge lint --per-patch --patches <name…>` to lint a named subset of the queue (matched by filename or manifest `name`) instead of forcing a full queue run to verify a few touched patches; queue-level policy and cross-patch findings are scoped to files the subset touches. The "`--per-patch` cannot be combined with explicit file paths" error now points at the flag.
+- Rebuilt the per-patch `checkJs` pass to construct the queue-wide TypeScript program **once per `lint --per-patch` run** (lazily, on first cache miss) and attribute each finding to its owning patch, instead of rebuilding the whole-queue program for every patch — a single queue-wide type regression now surfaces once against its owner rather than duplicated once per patch, and full runs no longer pay to recompile the same program ~N times.
+- Resolved cross-patch `resource:///` / `chrome://` imports during `export`/`re-export` lint by threading the whole-queue ownership context into the isolated patch's `checkJs` pass (the export/re-export half of the cross-patch resolution that 0.31.0 landed for the full-queue path), while scoping reported diagnostics to the patch under export. Re-exporting a widget-runtime patch whose module imports another patch's `resource:///` module now type-checks against the real owning sources **without** a hand-generated ambient `declare module` stub shim. `patchLint.checkJsCompilerOptions` additionally accepts a reviewed `paths` mapping (host-resolved against the engine directory, so no `baseUrl` is needed — TS5090-safe), and `extraShim` / `typecheck.extraShim` now inline triple-slash `/// <reference>` directives instead of silently dropping them at the synthetic shim path.
+- Fixed `furnace sync` to emit `./`-prefixed relative `compilerOptions.paths` values (e.g. `./components/custom/moz-widget/moz-widget.mjs`) so a synced jsconfig type-checks under TypeScript without `baseUrl` (no TS5090) and without `ignoreDeprecations` on TS6 (no TS5101); the sync reconciler now treats a leading `./` as insignificant, so neither a freshly-synced value nor a hand-written prefix churns as "stale" on the next run. Removes the downstream `baseUrl: "."` + `ignoreDeprecations: "6.0"` workaround.
+- Made `fireforge test` auto-dispatch a single-suite run to the suite-specific mach command (`mach xpcshell-test` / `mach mochitest`), which degrade a broken macOS mozlog resource monitor to a warning instead of crashing generic `mach test` at startup — so a sharded single-suite run reaches its tests instead of burning the whole `--harness-retries` budget on a startup traceback. Mixed runs are still rejected and a path-less "run all" stays on `mach test`; `--generic-mach-test` forces the generic command.
+- Extended the harness-crash classifier and `--harness-retries` budget to cover the pre-test `--build` step, so `fireforge test --build` retries a `mach build faster` that dies with the same resource-monitor startup crash instead of hard-failing with a bare "Pre-test build failed". Non-crash build failures are not retried.
+
 ## 0.31.0
 
 - Made `patch compact` range-aware: with `patchPolicy.ranges` configured, each category range compacts independently (anchored at its first occupied ordinal, treating reserved orders as non-gaps), so a mid-range gap under `allowGaps: false` can finally be closed without projecting patches across category boundaries. Reserved-range patches and out-of-range strays are left in place with a warning. Without ranges the historical whole-queue renumber from 1 is unchanged.

package/dist/src/commands/export-all.js

@@ -248,7 +248,10 @@ export async function exportAllCommand(projectRoot, options = {}) {
     try {
         // Extract affected files from diff
         const filesAffected = extractAffectedFiles(diff);
-        await runPatchLint(paths.engine, filesAffected, diff, config, options.skipLint);
+        const patchQueueCtx = (await pathExists(paths.patches))
+            ? await buildPatchQueueContext(paths.patches)
+            : undefined;
+        await runPatchLint(paths.engine, filesAffected, diff, config, options.skipLint, patchQueueCtx);
         // Dry-run: enumerate filename, metadata, and supersede coverage without
         // writing. Mirrors `fireforge export --dry-run` so the same preview
         // surface is available for both targeted and aggregate exports. Runs

package/dist/src/commands/export-shared.js

@@ -4,6 +4,7 @@ import { confirm, select, text } from '@clack/prompts';
 import { addLicenseHeaderToFile, getLicenseHeader } from '../core/license-headers.js';
 import { findAllPatchesForFiles } from '../core/patch-export.js';
 import { commentStyleForFile, detectNewFilesInDiff, lintExportedPatch, resolvePatchSizeTier, } from '../core/patch-lint.js';
+import { resolvePatchOwnedSysMjs } from '../core/patch-lint-ownership.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { getPatchPolicyCategories, isCategoryAllowedByConfig } from '../core/patch-policy.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
@@ -45,7 +46,15 @@ export async function runPatchLint(engineDir, filesAffected, diffContent, config
             ? 'Lint: branding threshold tier applied via patches.json `tier: "branding"` opt-in.'
             : 'Lint: branding threshold tier applied (patch is all under browser/branding/ plus registration siblings).');
     }
-    const issues = await lintExportedPatch(engineDir, filesAffected, diffContent, config, patchQueueCtx, ignoreChecks, patchTier);
+    // When a whole-queue context is supplied, checkJs resolves cross-patch
+    // `resource:///`/`chrome://` imports against every patch-owned module, but
+    // only this patch's own new modules should report diagnostics. Scope the
+    // report to the files this diff creates so re-exporting one patch does not
+    // surface another patch's findings (and no ambient stub shim is needed).
+    const checkJsReportScope = patchQueueCtx
+        ? resolvePatchOwnedSysMjs(detectNewFilesInDiff(diffContent))
+        : undefined;
+    const issues = await lintExportedPatch(engineDir, filesAffected, diffContent, config, patchQueueCtx, ignoreChecks, patchTier, checkJsReportScope ? { checkJsReportScope } : undefined);
     if (issues.length === 0)
         return;
     const errors = issues.filter((i) => i.severity === 'error');

package/dist/src/commands/export.js

@@ -11,6 +11,7 @@ import { isBinaryFile } from '../core/git-file-ops.js';
 import { getModifiedFilesInDir, getUntrackedFiles, getUntrackedFilesInDir, } from '../core/git-status.js';
 import { extractAffectedFiles } from '../core/patch-apply.js';
 import { commitExportedPatch } from '../core/patch-export.js';
+import { buildPatchQueueContext } from '../core/patch-lint.js';
 import { buildPatchSourceMetadata } from '../core/patch-source-metadata.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { toError } from '../utils/errors.js';
@@ -192,7 +193,10 @@ export async function exportCommand(projectRoot, files, options) {
         const exportIgnoreChecks = options.lintIgnore && options.lintIgnore.length > 0
             ? new Set(options.lintIgnore)
             : undefined;
-        await runPatchLint(paths.engine, filesAffected, diff, config, options.skipLint, undefined, exportIgnoreChecks, options.tier);
+        const patchQueueCtx = (await pathExists(paths.patches))
+            ? await buildPatchQueueContext(paths.patches)
+            : undefined;
+        await runPatchLint(paths.engine, filesAffected, diff, config, options.skipLint, patchQueueCtx, exportIgnoreChecks, options.tier);
         // Resolve placement (if any flag was given). Placement is mutually
         // exclusive with supersede — the semantics overlap confusingly.
         let placementPlan = null;

package/dist/src/commands/lint-per-patch.d.ts

@@ -4,5 +4,7 @@ import type { LintCommandOptions } from '../types/commands/index.js';
  * Lints each patch in the queue as its own isolated diff, honouring
  * per-patch `lintIgnore` entries. Cross-patch rules still run once over
  * the whole queue so queue-level findings are not lost by the rescoping.
+ * With `options.patches` set, only the named subset is linted (and the
+ * queue-level findings are scoped to files those patches touch).
  */
 export declare function lintPerPatch(projectRoot: string, paths: ReturnType<typeof getProjectPaths>, options?: LintCommandOptions): Promise<void>;

package/dist/src/commands/lint-per-patch.js

@@ -4,6 +4,8 @@ import { loadConfig } from '../core/config.js';
 import { getDiffForFilesAgainstHead } from '../core/git-diff.js';
 import { buildPerPatchLintCacheKey, getCachedPerPatchLintIssues, getPerPatchLintCacheHeadSha, loadPerPatchLintCache, savePerPatchLintCache, setCachedPerPatchLintIssues, } from '../core/lint-cache.js';
 import { buildPatchQueueContext, lintExportedPatch, lintPatchQueue, resolvePatchSizeTier, } from '../core/patch-lint.js';
+import { invokePatchLintCheckJsGrouped, } from '../core/patch-lint-checkjs.js';
+import { resolvePatchOwnedSysMjs } from '../core/patch-lint-ownership.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { evaluatePatchPolicy } from '../core/patch-policy.js';
 import { GeneralError } from '../errors/base.js';
@@ -22,21 +24,22 @@ function emitTierNotice(filename, files, tier) {
         : `${filename}: branding threshold tier applied (all files under browser/branding/ plus registration siblings).`);
 }
 /**
- * Lints one queued patch against its own isolated diff, reusing the cache
- * entry when the cache key matches. Pushes the patch's issues (prefixed
- * with its filename) onto `ctx.issues`. Returns whether the patch was
- * skipped (no files present / empty diff), served from cache, or linted
- * fresh — and whether a fresh result was written to the cache.
+ * Lints one queued patch against its own isolated diff, reusing the cache entry
+ * when the cache key matches. Returns the outcome and the patch's (unprefixed)
+ * issues without touching shared state — the orchestrator applies the tier
+ * notice, issue prefixing, and cache write in patch order after the pool
+ * drains, so the bounded concurrency cannot reorder output. Returns `skipped`
+ * (no files present / empty diff), `cached`, or `linted`.
  */
 async function lintQueuedPatch(patch, lintCtx) {
-    const { projectRoot, paths, config, ctx, cache, engineHeadSha, issues } = lintCtx;
+    const { projectRoot, paths, config, ctx, cache, engineHeadSha } = lintCtx;
     const existing = [];
     for (const f of patch.filesAffected) {
         if (await pathExists(join(paths.engine, f)))
             existing.push(f);
     }
     if (existing.length === 0) {
-        return { status: 'skipped', wroteCache: false };
+        return { status: 'skipped', existingFiles: [], rawIssues: [], usedCheckJs: false };
     }
     const ignore = patch.lintIgnore?.length ? new Set(patch.lintIgnore) : undefined;
     let cacheKey;
@@ -53,28 +56,111 @@ async function lintQueuedPatch(patch, lintCtx) {
         });
         const cached = getCachedPerPatchLintIssues(cache, patch.filename, cacheKey);
         if (cached) {
-            emitTierNotice(patch.filename, existing, patch.tier);
-            for (const issue of cached) {
-                issues.push({ ...issue, file: `${patch.filename} :: ${issue.file}` });
-            }
-            return { status: 'cached', wroteCache: false };
+            return { status: 'cached', existingFiles: existing, rawIssues: cached, usedCheckJs: false };
         }
     }
     const diff = await getDiffForFilesAgainstHead(paths.engine, existing);
     if (!diff.trim()) {
-        return { status: 'skipped', wroteCache: false };
+        return { status: 'skipped', existingFiles: [], rawIssues: [], usedCheckJs: false };
+    }
+    // checkJs: instead of rebuilding the program per patch, slice this patch's
+    // findings out of the one queue-wide program (built lazily on first miss).
+    let lintOptions;
+    let usedCheckJs = false;
+    if (lintCtx.checkJs) {
+        const grouped = await lintCtx.checkJs.getGrouped();
+        usedCheckJs = true;
+        const owned = lintCtx.checkJs.ownedByPatch.get(patch.filename);
+        const precomputedCheckJs = [];
+        if (owned) {
+            for (const rel of owned)
+                precomputedCheckJs.push(...(grouped.byFile.get(rel) ?? []));
+        }
+        lintOptions = { precomputedCheckJs };
     }
-    emitTierNotice(patch.filename, existing, patch.tier);
-    const patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, ctx, ignore, patch.tier);
-    let wroteCache = false;
+    const patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, ctx, ignore, patch.tier, lintOptions);
+    const result = {
+        status: 'linted',
+        existingFiles: existing,
+        rawIssues: patchIssues,
+        usedCheckJs,
+    };
     if (cache && cacheKey) {
-        setCachedPerPatchLintIssues(cache, patch.filename, cacheKey, patchIssues);
-        wroteCache = true;
+        result.cacheWrite = { key: cacheKey, issues: patchIssues };
     }
-    for (const issue of patchIssues) {
-        issues.push({ ...issue, file: `${patch.filename} :: ${issue.file}` });
+    return result;
+}
+/**
+ * Applies the per-patch results in patch order so the bounded concurrency
+ * cannot reorder output: emits each tier notice, the once-only run-level
+ * checkJs errors (before the first freshly linted patch's issues), the
+ * filename-prefixed issue rows, and the cache writes — all in the same sequence
+ * a serial run produced. Returns the run tallies.
+ */
+async function applyPerPatchResults(subset, results, issues, checkJs, cache) {
+    const totals = {
+        linted: 0,
+        skipped: 0,
+        cacheDirty: false,
+        reusedCacheEntries: 0,
+    };
+    let globalCheckJsEmitted = false;
+    for (let i = 0; i < subset.length; i++) {
+        const patch = subset[i];
+        const result = results[i];
+        if (!patch || !result)
+            continue;
+        if (result.status === 'skipped') {
+            totals.skipped++;
+            continue;
+        }
+        emitTierNotice(patch.filename, result.existingFiles, patch.tier);
+        // Run-level checkJs errors are emitted once, before the first freshly
+        // linted patch's own issues — matching the serial emit point.
+        if (result.usedCheckJs && checkJs && !globalCheckJsEmitted) {
+            globalCheckJsEmitted = true;
+            issues.push(...(await checkJs.getGlobal()));
+        }
+        if (result.cacheWrite && cache) {
+            setCachedPerPatchLintIssues(cache, patch.filename, result.cacheWrite.key, result.cacheWrite.issues);
+            totals.cacheDirty = true;
+        }
+        for (const issue of result.rawIssues) {
+            issues.push({ ...issue, file: `${patch.filename} :: ${issue.file}` });
+        }
+        if (result.status === 'cached')
+            totals.reusedCacheEntries++;
+        totals.linted++;
+    }
+    return totals;
+}
+/**
+ * Maximum patches linted concurrently. After the per-file→batched git change,
+ * each patch is only a handful of git spawns, so a small pool overlaps their
+ * I/O without oversubscribing git on the shared repository.
+ */
+const PER_PATCH_LINT_CONCURRENCY = 8;
+/**
+ * Lints every patch in `subset` with bounded concurrency, returning results in
+ * patch order (each slot index matches `subset`). Mirrors the worker-pool idiom
+ * used by the rollback restore path. Side effects are deferred to the caller so
+ * issue ordering and cache writes stay deterministic.
+ */
+async function lintSubsetConcurrently(subset, lintCtx) {
+    const results = new Array(subset.length);
+    let index = 0;
+    async function worker() {
+        while (index < subset.length) {
+            const current = index++;
+            const patch = subset[current];
+            if (!patch)
+                break;
+            results[current] = await lintQueuedPatch(patch, lintCtx);
+        }
     }
-    return { status: 'linted', wroteCache };
+    const workers = Array.from({ length: Math.min(PER_PATCH_LINT_CONCURRENCY, subset.length) }, () => worker());
+    await Promise.all(workers);
+    return results;
 }
 /**
  * Reporting + exit phase of per-patch lint: renders every issue row,
@@ -121,10 +207,71 @@ function reportPerPatchOutcome(issues, linted, skipped, options) {
         outro('Lint passed');
     }
 }
+/**
+ * Resolves the `--patches <name…>` subset filter against the manifest,
+ * matching each requested name tolerantly (exact filename, filename ±
+ * `.patch`, or the manifest `name` field). Throws listing the available
+ * patches when a requested name matches none, so a typo fails loud rather
+ * than silently linting nothing.
+ */
+function selectPatchSubset(manifest, requested) {
+    const matches = (p, name) => p.filename === name ||
+        p.filename === `${name}.patch` ||
+        p.filename.replace(/\.patch$/, '') === name.replace(/\.patch$/, '') ||
+        p.name === name;
+    const selected = [];
+    const seen = new Set();
+    for (const name of requested) {
+        const found = manifest.patches.filter((p) => matches(p, name));
+        if (found.length === 0) {
+            const available = manifest.patches.map((p) => p.filename).join(', ');
+            throw new GeneralError(`--patches: no patch in the queue matches "${name}". Available patches: ${available}`);
+        }
+        for (const p of found) {
+            if (!seen.has(p.filename)) {
+                seen.add(p.filename);
+                selected.push(p);
+            }
+        }
+    }
+    return selected;
+}
+/**
+ * Builds the per-run checkJs program controller when `patchLint.checkJs` is
+ * enabled, or returns undefined. The program is built lazily on the first
+ * cache miss (so an all-warm run never pays for it) and reused for every
+ * subsequent patch in the run.
+ */
+function buildPerRunCheckJs(projectRoot, paths, config, ctx) {
+    const patchLint = config.patchLint;
+    if (!patchLint?.checkJs)
+        return undefined;
+    const ownedByPatch = new Map();
+    for (const entry of ctx.entries) {
+        const owned = new Set();
+        for (const f of entry.newFiles.keys()) {
+            if (f.endsWith('.sys.mjs'))
+                owned.add(f);
+        }
+        if (owned.size > 0)
+            ownedByPatch.set(entry.filename, owned);
+    }
+    // Memoise the *promise*, not the resolved value: under the bounded pool
+    // several patches can reach `getGrouped` before the first build resolves, and
+    // `??=` on the promise (a synchronous expression) guarantees a single build.
+    let groupedPromise;
+    return {
+        ownedByPatch,
+        getGrouped: () => (groupedPromise ??= invokePatchLintCheckJsGrouped(paths.engine, resolvePatchOwnedSysMjs(new Set(), ctx), patchLint, projectRoot)),
+        getGlobal: async () => (groupedPromise ? (await groupedPromise).global : []),
+    };
+}
 /**
  * Lints each patch in the queue as its own isolated diff, honouring
  * per-patch `lintIgnore` entries. Cross-patch rules still run once over
  * the whole queue so queue-level findings are not lost by the rescoping.
+ * With `options.patches` set, only the named subset is linted (and the
+ * queue-level findings are scoped to files those patches touch).
  */
 export async function lintPerPatch(projectRoot, paths, options = {}) {
     const manifest = await loadPatchesManifest(paths.patches);
@@ -133,12 +280,33 @@ export async function lintPerPatch(projectRoot, paths, options = {}) {
         outro('Nothing to lint');
         return;
     }
+    const subset = options.patches && options.patches.length > 0
+        ? selectPatchSubset(manifest, options.patches)
+        : manifest.patches;
+    const subsetNames = new Set(subset.map((p) => p.filename));
+    const isSubset = subset.length !== manifest.patches.length;
     const config = await loadConfig(projectRoot);
     const ctx = await buildPatchQueueContext(paths.patches);
+    // Queue-level findings (policy, cross-patch) are scoped to the requested
+    // subset: a 5-patch slice should not fail on a policy or forward-import
+    // problem owned entirely by patches the operator did not target.
+    const subsetTouchedFiles = new Set();
+    if (isSubset) {
+        for (const entry of ctx.entries) {
+            if (!subsetNames.has(entry.filename))
+                continue;
+            for (const f of entry.newFiles.keys())
+                subsetTouchedFiles.add(f);
+            for (const f of entry.modifiedFileAdditions.keys())
+                subsetTouchedFiles.add(f);
+        }
+    }
     const cache = options.noCache === true ? undefined : await loadPerPatchLintCache(projectRoot);
     const engineHeadSha = cache ? await getPerPatchLintCacheHeadSha(paths.engine) : undefined;
     const issues = [];
     for (const issue of evaluatePatchPolicy(config, manifest)) {
+        if (isSubset && !subsetNames.has(issue.filename))
+            continue;
         issues.push({
             file: issue.filename,
             check: `patch-policy/${issue.code}`,
@@ -146,31 +314,25 @@ export async function lintPerPatch(projectRoot, paths, options = {}) {
             severity: issue.severity,
         });
     }
-    let linted = 0;
-    let skipped = 0;
-    let cacheDirty = false;
-    let reusedCacheEntries = 0;
-    for (const patch of manifest.patches) {
-        const result = await lintQueuedPatch(patch, {
-            projectRoot,
-            paths,
-            config,
-            ctx,
-            cache,
-            engineHeadSha,
-            issues,
-        });
-        if (result.status === 'skipped') {
-            skipped++;
+    const checkJs = buildPerRunCheckJs(projectRoot, paths, config, ctx);
+    // Lint patches concurrently, then apply every side effect in patch order so
+    // the issue rows, the run-level checkJs errors, and the saved cache are
+    // identical to a serial run.
+    const results = await lintSubsetConcurrently(subset, {
+        projectRoot,
+        paths,
+        config,
+        ctx,
+        cache,
+        engineHeadSha,
+        checkJs,
+    });
+    const { linted, skipped, cacheDirty, reusedCacheEntries } = await applyPerPatchResults(subset, results, issues, checkJs, cache);
+    for (const issue of lintPatchQueue(ctx)) {
+        if (isSubset && !subsetTouchedFiles.has(issue.file))
             continue;
-        }
-        if (result.status === 'cached')
-            reusedCacheEntries++;
-        if (result.wroteCache)
-            cacheDirty = true;
-        linted++;
+        issues.push(issue);
     }
-    issues.push(...lintPatchQueue(ctx));
     if (cache && cacheDirty)
         await savePerPatchLintCache(projectRoot, cache);
     if (reusedCacheEntries > 0) {

package/dist/src/commands/lint.js

@@ -9,7 +9,7 @@ import { getAllDiff, getDiffForFilesAgainstHead } from '../core/git-diff.js';
 import { expandUntrackedDirectoryEntries, getModifiedFilesInDir, getUntrackedFiles, getUntrackedFilesInDir, getWorkingTreeStatus, } from '../core/git-status.js';
 import { clearPerPatchLintCache } from '../core/lint-cache.js';
 import { extractAffectedFiles } from '../core/patch-apply.js';
-import { buildPatchQueueContext, lintExportedPatch, lintPatchQueue } from '../core/patch-lint.js';
+import { buildPatchQueueContext, countNonBinaryDiffLines, lintExportedPatch, lintPatchQueue, lintPatchSize, } from '../core/patch-lint.js';
 import { collectDiffFilePaths, tagLintIssues } from '../core/patch-lint-diff-tag.js';
 import { GeneralError } from '../errors/base.js';
 import { pathExists } from '../utils/fs.js';
@@ -234,12 +234,20 @@ function validateLintFlags(options, files) {
         throw new GeneralError('--max-warnings must be a non-negative integer.');
     }
     // `--per-patch` rescopes the diff from "aggregate engine state" to "each
-    // patch's own filesAffected". Mixing in explicit file paths would produce
-    // an ambiguous set — is the file list an additional filter, or does it
-    // replace the per-patch scope? Reject up-front so the operator gets a
-    // clear error rather than a silently-narrowed result.
+    // patch's own filesAffected". Mixing in explicit engine file paths would
+    // produce an ambiguous set — is the file list an additional filter, or
+    // does it replace the per-patch scope? Reject up-front, but point at the
+    // first-class subset filter so an operator who wanted to target patches
+    // (not engine files) knows the supported syntax.
     if (options.perPatch && files.length > 0) {
-        throw new GeneralError('--per-patch cannot be combined with explicit file paths. Pass either --per-patch or a file list, not both.');
+        throw new GeneralError('--per-patch cannot be combined with explicit engine file paths. ' +
+            'To lint a subset of patches, use `--per-patch --patches <name…>`; ' +
+            'to lint specific engine files, drop --per-patch.');
+    }
+    // `--patches` only means something in per-patch mode (it filters the
+    // queue); in aggregate/file-list mode there is no patch loop to narrow.
+    if (options.patches !== undefined && !options.perPatch) {
+        throw new GeneralError('--patches requires --per-patch.');
     }
 }
 /**
@@ -263,6 +271,79 @@ function downgradeAggregateSizeRules(issues, files, ctx) {
         }
     }
 }
+/**
+ * Evaluates the patch-size rules (`large-patch-files` / `large-patch-lines`)
+ * for an ad-hoc explicit-file-list lint, scoped to each file's **owning
+ * patch** rather than the combined file list.
+ *
+ * The default file-list path used to feed every passed file to
+ * `lintExportedPatch` as one synthetic patch, so a cross-patch selection of
+ * eight files belonging to four patches reported `Patch affects 8 files`
+ * even though no single owning patch was oversized. This helper instead
+ * groups the affected files by their owning patch (via the manifest's
+ * `filesAffected`), then runs `lintPatchSize` against each owner's real file
+ * count + diff, honouring that owner's `tier` and `lintIgnore` — so
+ * `lint <files>`, `lint --per-patch`, and `re-export --dry-run` agree on the
+ * same size findings for the same files. Files no patch claims are evaluated
+ * together as one prospective new patch, preserving the pre-export
+ * oversized-change warning.
+ *
+ * @param engineDir - Absolute engine directory
+ * @param filesAffected - Engine-relative files touched by the ad-hoc diff
+ * @param ctx - Patch queue context used to attribute file → owning patch
+ * @returns Size issues, each attributed to its owning patch by message prefix
+ */
+async function lintOwningPatchSizes(engineDir, filesAffected, ctx) {
+    const listed = new Set(filesAffected);
+    const owners = new Map();
+    const ownedListed = new Set();
+    for (const entry of ctx.entries) {
+        const md = entry.metadata;
+        if (!md)
+            continue;
+        let ownsAny = false;
+        for (const f of md.filesAffected) {
+            if (listed.has(f)) {
+                ownedListed.add(f);
+                ownsAny = true;
+            }
+        }
+        if (ownsAny)
+            owners.set(entry.filename, entry);
+    }
+    const issues = [];
+    const lineCountForFiles = async (relPaths) => {
+        const existing = [];
+        for (const f of relPaths) {
+            if (await pathExists(join(engineDir, f)))
+                existing.push(f);
+        }
+        if (existing.length === 0)
+            return 0;
+        const diff = await getDiffForFilesAgainstHead(engineDir, existing);
+        return countNonBinaryDiffLines(diff).textLines;
+    };
+    for (const entry of owners.values()) {
+        const md = entry.metadata;
+        if (!md)
+            continue;
+        const lineCount = await lineCountForFiles(md.filesAffected);
+        const ignore = md.lintIgnore?.length ? new Set(md.lintIgnore) : undefined;
+        for (const issue of lintPatchSize(md.filesAffected, lineCount, md.tier)) {
+            if (ignore?.has(issue.check))
+                continue;
+            issues.push({ ...issue, message: `${entry.filename}: ${issue.message}` });
+        }
+    }
+    // Files no patch claims are a prospective new patch: evaluate them as one
+    // unit so a genuinely oversized fresh change still surfaces.
+    const unowned = filesAffected.filter((f) => !ownedListed.has(f));
+    if (unowned.length > 0) {
+        const lineCount = await lineCountForFiles(unowned);
+        issues.push(...lintPatchSize(unowned, lineCount));
+    }
+    return issues;
+}
 /**
  * Reporting + exit phase of `lintCommand`: tags issues against `--since`,
  * renders every notice/warning/error row, prints the summary, and applies
@@ -381,9 +462,17 @@ export async function lintCommand(projectRoot, files, options = {}) {
     if (await pathExists(paths.patches)) {
         ctx = await buildPatchQueueContext(paths.patches);
     }
+    // Ad-hoc explicit-file-list mode evaluates the patch-size rules per
+    // owning patch (see `lintOwningPatchSizes`), so suppress the synthetic
+    // combined-list size check in the shared pass — otherwise a cross-patch
+    // selection synthesises a phantom oversized patch from the file count.
+    const fileListMode = files.length > 0 && ctx !== undefined;
     let issues = [
-        ...(await lintExportedPatch(paths.engine, filesAffected, diff, config, ctx)),
+        ...(await lintExportedPatch(paths.engine, filesAffected, diff, config, ctx, undefined, undefined, fileListMode ? { skipPatchSize: true } : undefined)),
     ];
+    if (files.length > 0 && ctx) {
+        issues.push(...(await lintOwningPatchSizes(paths.engine, filesAffected, ctx)));
+    }
     // Cross-patch rules operate over the whole queue, so run them whenever a
     // patches directory exists — they surface duplicate /dev/null creations
     // and forward-import chains that the per-patch orchestrator cannot see.
@@ -421,6 +510,7 @@ export function registerLint(program, { getProjectRoot, withErrorHandling }) {
         .option('--since <git-rev>', 'Tag issues as [introduced] or [cumulative] based on whether the file changed since <git-rev> (e.g. HEAD, a branch, a SHA)')
         .option('--only-introduced', 'Fail only on issues tagged [introduced] (requires --since). Cumulative errors still print but do not set a non-zero exit.')
         .option('--per-patch', "Lint each patch in the queue as its own isolated diff. Rescopes patch-size rules so they fire against individual patches rather than the aggregate. Honours each patch's `lintIgnore` entries.")
+        .option('--patches <names...>', 'With --per-patch, lint only the named patches (by filename or manifest name) instead of the whole queue. Queue-level findings are scoped to files those patches touch.')
         .option('--max-warnings <n>', 'Fail when lint reports more than <n> warning(s); use 0 for warning-clean release gates.')
         .option('--no-cache', 'Bypass per-patch lint result cache reads and writes.')
         .action(withErrorHandling(async (paths, options) => {
@@ -434,6 +524,9 @@ export function registerLint(program, { getProjectRoot, withErrorHandling }) {
         if (options.perPatch !== undefined) {
             lintOptions.perPatch = options.perPatch;
         }
+        if (options.patches !== undefined) {
+            lintOptions.patches = options.patches;
+        }
         if (options.maxWarnings !== undefined) {
             const maxWarnings = Number(options.maxWarnings);
             if (!Number.isInteger(maxWarnings) || maxWarnings < 0) {

package/dist/src/commands/re-export-files.js

@@ -198,7 +198,10 @@ export async function reExportFilesInPlace(paths, selectedPatches, options, conf
     // standard re-export path).
     const { effectiveTier, effectiveLintIgnore, flagIgnoreSet } = resolveEffectiveTierAndLintIgnore(target, options);
     const ignoreChecks = effectiveLintIgnore ? new Set(effectiveLintIgnore) : undefined;
-    await runPatchLint(paths.engine, actualProjectedFiles, projectedDiff, config, options.skipLint, undefined, ignoreChecks, effectiveTier);
+    const patchQueueCtx = (await pathExists(paths.patches))
+        ? await buildPatchQueueContext(paths.patches)
+        : undefined;
+    await runPatchLint(paths.engine, actualProjectedFiles, projectedDiff, config, options.skipLint, patchQueueCtx, ignoreChecks, effectiveTier);
     const conflicts = await runProjectedCrossPatchLint(paths.patches, target.filename, projectedDiff);
     const filesUpdates = buildFilesModeMetadataUpdates(actualProjectedFiles, options, effectiveLintIgnore, flagIgnoreSet);
     const manifest = await loadPatchesManifest(paths.patches);

package/dist/src/commands/re-export.js

@@ -7,6 +7,7 @@ import { isGitRepository } from '../core/git.js';
 import { getDiffForFilesAgainstHead } from '../core/git-diff.js';
 import { getModifiedFilesInDir, getUntrackedFilesInDir } from '../core/git-status.js';
 import { updatePatchAndMetadata } from '../core/patch-export.js';
+import { buildPatchQueueContext } from '../core/patch-lint.js';
 import { getClaimedFiles, loadPatchesManifest, resolvePatchIdentifier, stampPatchVersions, } from '../core/patch-manifest.js';
 import { buildProjectedManifest, enforcePatchPolicy } from '../core/patch-policy.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
@@ -185,7 +186,13 @@ async function reExportSinglePatch(patch, paths, manifest, options, isDryRun, co
         command: 're-export',
         forceUnsafe: options.forceUnsafe === true,
     });
-    await runPatchLint(paths.engine, existingFiles, diffContent, config, options.skipLint, undefined, ignoreChecks, effectiveTier);
+    // Pass the whole-queue context so checkJs resolves cross-patch
+    // `resource:///` imports against the real owning sources (report scope
+    // stays this patch — see runPatchLint).
+    const patchQueueCtx = (await pathExists(paths.patches))
+        ? await buildPatchQueueContext(paths.patches)
+        : undefined;
+    await runPatchLint(paths.engine, existingFiles, diffContent, config, options.skipLint, patchQueueCtx, ignoreChecks, effectiveTier);
     if (isDryRun) {
         info(`[dry-run] ${patch.filename}: ${existingFiles.length} file(s)`);
         if (effectiveTier !== undefined && effectiveTier !== patch.tier) {

package/dist/src/commands/test-run.d.ts

@@ -14,6 +14,14 @@ import { type MachCommandResult } from '../core/mach.js';
 import { type HarnessRunVerdict } from '../core/test-harness-crash.js';
 /** Default bounded retry budget for recognized harness crashes. */
 export declare const DEFAULT_HARNESS_RETRIES = 2;
+/**
+ * Which mach command a run dispatches to. Single-suite runs use the
+ * suite-specific command (`mach xpcshell-test` / `mach mochitest`), which
+ * skips the mozlog resource monitor that crashes generic `mach test` on a
+ * broken host (field report E1). `generic` is the historical `mach test`
+ * path (mixed/all-tests runs, or the `--generic-mach-test` opt-out).
+ */
+export type TestSuite = 'xpcshell' | 'mochitest' | 'generic';
 /** Inputs shared by every harness invocation in one `fireforge test` run. */
 export interface TestRunContext {
     engineDir: string;
@@ -22,6 +30,8 @@ export interface TestRunContext {
         xpcshell: string[];
         nonXpcshell: string[];
     };
+    /** Suite-specific dispatch target for this run (E1). */
+    suite: TestSuite;
     /** Extra mach args before per-shard appdir injection. */
     baseExtraArgs: readonly string[];
     /** Bounded harness-crash retry budget (0 disables retries). */