@hominis/fireforge 0.34.2 → 0.36.0

package/dist/src/core/marionette-port.d.ts

@@ -48,6 +48,14 @@ export declare function probeMarionettePort(port?: number): Promise<MarionettePo
 export declare function assertMarionettePortAvailable(port?: number, options?: {
     binaryName?: string;
 }): Promise<void>;
+/**
+ * Ensures the Marionette port is usable, optionally terminating a stale
+ * Firefox-family browser holder first. Unrelated listeners still fail.
+ */
+export declare function ensureMarionettePortAvailable(port?: number, options?: {
+    binaryName?: string;
+    killStaleBrowser?: boolean;
+}): Promise<void>;
 /**
  * Extracts a `--marionette-port=N` (or `--marionette-port N`) argument from
  * a list of forwarded mach args, if present. Used so an operator passing the

package/dist/src/core/marionette-port.js

@@ -56,7 +56,7 @@ const BROWSER_BASENAMES = new Set([
  * so a fork that ships under a custom name (e.g.
  * `mybrowser-nightly`) is still recognised as a browser.
  */
-function isBrowserHolder(holder, binaryName) {
+function isBrowserMarionettePortHolder(holder, binaryName) {
     if (/\s-marionette(?:\s|$)/.test(holder.commandLine)) {
         return true;
     }
@@ -195,7 +195,7 @@ export async function assertMarionettePortAvailable(port = DEFAULT_MARIONETTE_PO
     if (!probe.inUse || !probe.holder)
         return;
     const holder = probe.holder;
-    if (isBrowserHolder(holder, options.binaryName)) {
+    if (isBrowserMarionettePortHolder(holder, options.binaryName)) {
         const killHint = process.platform === 'win32'
             ? `Stop-Process -Id ${holder.pid} -Force`
             : `kill ${holder.pid}  # or "kill -9 ${holder.pid}" if it doesn't exit`;
@@ -212,6 +212,38 @@ export async function assertMarionettePortAvailable(port = DEFAULT_MARIONETTE_PO
     throw new GeneralError(`Marionette port ${port} is already in use by ${holder.command} (PID ${holder.pid}). ` +
         `This is not a FireForge-launched browser; stop the holder process or free the port before rerunning.`);
 }
+/**
+ * Ensures the Marionette port is usable, optionally terminating a stale
+ * Firefox-family browser holder first. Unrelated listeners still fail.
+ */
+export async function ensureMarionettePortAvailable(port = DEFAULT_MARIONETTE_PORT, options = {}) {
+    const probe = await probeMarionettePort(port);
+    if (!probe.inUse || !probe.holder)
+        return;
+    const holder = probe.holder;
+    const isBrowser = isBrowserMarionettePortHolder(holder, options.binaryName);
+    if (!options.killStaleBrowser || !isBrowser) {
+        await assertMarionettePortAvailable(port, options);
+        return;
+    }
+    try {
+        if (process.platform === 'win32') {
+            await exec('powershell.exe', [
+                '-NoProfile',
+                '-NonInteractive',
+                '-Command',
+                `Stop-Process -Id ${holder.pid} -Force`,
+            ]);
+        }
+        else {
+            process.kill(holder.pid, 'SIGTERM');
+        }
+    }
+    catch (error) {
+        throw new GeneralError(`Marionette port ${port} is held by stale browser ${holder.command} (PID ${holder.pid}), ` +
+            `but FireForge could not terminate it: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 /**
  * Extracts a `--marionette-port=N` (or `--marionette-port N`) argument from
  * a list of forwarded mach args, if present. Used so an operator passing the
@@ -350,4 +382,3 @@ export function isMarionetteFlavor(testPaths, machArgs) {
     }
     return false;
 }
-//# sourceMappingURL=marionette-port.js.map

package/dist/src/core/marionette-preflight.js

@@ -307,4 +307,3 @@ export function formatMarionettePreflightLine(result) {
     const status = result.ok ? 'PASS' : 'FAIL';
     return `Marionette preflight: ${status} (${result.durationMs}ms) — ${result.detail}`;
 }
-//# sourceMappingURL=marionette-preflight.js.map

package/dist/src/core/markdown-table.js

@@ -263,4 +263,3 @@ export function updateCellByKey(table, keyColumn, keyValue, targetColumn, newVal
     }
     return false;
 }
-//# sourceMappingURL=markdown-table.js.map

package/dist/src/core/ownership-table.js

@@ -1,4 +1,5 @@
 import { info } from '../utils/logger.js';
+import { buildPatchClaims } from './status-classify.js';
 /**
  * Builds the flat ownership table from the manifest, worktree status, and
  * the duplicate-new-file-creation map produced by cross-patch lint.
@@ -29,14 +30,7 @@ import { info } from '../utils/logger.js';
  *   paths with a `.length > 1` owner list become duplicate-create conflicts
  */
 export function buildOwnershipTable(manifestPatches, worktreeFiles, newFileCreatorsByPath, classifications = new Map()) {
-    const ownersByPath = new Map();
-    for (const patch of manifestPatches) {
-        for (const file of patch.filesAffected) {
-            const existing = ownersByPath.get(file) ?? [];
-            existing.push(patch.filename);
-            ownersByPath.set(file, existing);
-        }
-    }
+    const ownersByPath = buildPatchClaims(manifestPatches);
     // Merge duplicate-new-file-creation findings. The structured helper
     // returns all new-file paths, so we filter to the ones with more
     // than one creator. Paths are added to the table even when no patch
@@ -165,4 +159,3 @@ export function renderOwnershipTable(rows) {
         info(`| ${pad(row.path, pathWidth)} | ${pad(ownerCell, ownerWidth)} | ${pad(stateCell, stateWidth)} |`);
     }
 }
-//# sourceMappingURL=ownership-table.js.map

package/dist/src/core/parser-fallback.js

@@ -40,4 +40,3 @@ export function withParserFallback(primary, fallback, context, rethrowIf) {
         return { value: fallback(), usedFallback: true, fallbackReason: reason };
     }
 }
-//# sourceMappingURL=parser-fallback.js.map

package/dist/src/core/patch-apply-fuzz.d.ts

@@ -1,14 +1,27 @@
 /**
- * Fuzzy patch application with escalating fuzz factors.
+ * Fuzz-like patch application with escalating context reduction.
  *
- * Tries an exact `git apply` first, then retries with increasing `--fuzz=N`
- * values.  If all fuzz levels fail, falls through to `git apply --reject`
- * so the user gets `.rej` files for manual resolution.
+ * Tries an exact `git apply` first, then retries with git's real
+ * drift-tolerance knob: `-C<n>` (reduced context matching). `git apply`
+ * has NO `--fuzz` option — that flag belongs to GNU `patch(1)`. The
+ * original implementation passed `--fuzz=N`, which git rejects with a
+ * usage error (exit 129) that the escalation loop swallowed, so every
+ * "fuzzy" attempt silently failed and patches that would have applied
+ * with context drift were reported as hard conflicts (2026-07-05 review,
+ * finding H1; verified against git 2.50). If all context-reduction levels
+ * fail, falls through to `git apply --reject` so the user gets `.rej`
+ * files for manual resolution.
+ *
+ * Semantics note: GNU fuzz *fuzzily matches* context; `-C<n>` *ignores*
+ * outer context lines instead. Step k maps to `-C(3-k)` (git's default
+ * context width is 3), so the final step `-C0` matches on line positions
+ * and -/+ content alone — the rough analogue of GNU `--fuzz=3` on a
+ * 3-context patch.
  */
 export interface FuzzyApplyResult {
     /** Whether the patch was applied successfully. */
     success: boolean;
-    /** Fuzz factor that succeeded (0 = exact match). */
+    /** Context-reduction steps taken (0 = exact match, k = applied with `-C(3-k)`). */
     fuzzFactor: number;
     /** Error description when `success` is false. */
     error?: string;
@@ -16,14 +29,19 @@ export interface FuzzyApplyResult {
     rejectFiles?: string[];
 }
 /**
- * Attempts to apply a patch with escalating fuzz factors.
+ * Attempts to apply a patch with escalating context reduction.
  *
- * 1. `git apply --check` at fuzz 0 … maxFuzz
- * 2. `git apply --fuzz=N` at the first passing level
+ * 1. `git apply --check` exact, then with `-C2`, `-C1`, `-C0`
+ * 2. `git apply` (same flags) at the first passing level
  * 3. Fall through to `git apply --reject` if nothing succeeds
  *
  * @param patchPath - Absolute path to the `.patch` file
  * @param engineDir - Working directory (engine/)
- * @param maxFuzz   - Maximum fuzz factor to try (default 3)
+ * @param maxFuzz   - Maximum context-reduction steps to try (default 3,
+ *   0 = exact only). Values above 3 are capped: git cannot reduce below
+ *   `-C0`.
+ * @throws InvalidArgumentError when `maxFuzz` is not a non-negative integer —
+ *   a NaN or negative value would silently skip every apply attempt
+ *   (including the exact-match one) and fall straight through to `--reject`
  */
 export declare function applyPatchWithFuzz(patchPath: string, engineDir: string, maxFuzz?: number): Promise<FuzzyApplyResult>;

package/dist/src/core/patch-apply-fuzz.js

@@ -1,70 +1,107 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
- * Fuzzy patch application with escalating fuzz factors.
+ * Fuzz-like patch application with escalating context reduction.
  *
- * Tries an exact `git apply` first, then retries with increasing `--fuzz=N`
- * values.  If all fuzz levels fail, falls through to `git apply --reject`
- * so the user gets `.rej` files for manual resolution.
+ * Tries an exact `git apply` first, then retries with git's real
+ * drift-tolerance knob: `-C<n>` (reduced context matching). `git apply`
+ * has NO `--fuzz` option — that flag belongs to GNU `patch(1)`. The
+ * original implementation passed `--fuzz=N`, which git rejects with a
+ * usage error (exit 129) that the escalation loop swallowed, so every
+ * "fuzzy" attempt silently failed and patches that would have applied
+ * with context drift were reported as hard conflicts (2026-07-05 review,
+ * finding H1; verified against git 2.50). If all context-reduction levels
+ * fail, falls through to `git apply --reject` so the user gets `.rej`
+ * files for manual resolution.
+ *
+ * Semantics note: GNU fuzz *fuzzily matches* context; `-C<n>` *ignores*
+ * outer context lines instead. Step k maps to `-C(3-k)` (git's default
+ * context width is 3), so the final step `-C0` matches on line positions
+ * and -/+ content alone — the rough analogue of GNU `--fuzz=3` on a
+ * 3-context patch.
  */
+import { InvalidArgumentError } from '../errors/base.js';
 import { verbose } from '../utils/logger.js';
 import { exec } from '../utils/process.js';
 import { ensureGit } from './git-base.js';
+/** Git's default diff context width — the ceiling for reduction steps. */
+const GIT_DEFAULT_CONTEXT = 3;
 // ── Implementation ──
 /**
- * Attempts to apply a patch with escalating fuzz factors.
+ * Attempts to apply a patch with escalating context reduction.
  *
- * 1. `git apply --check` at fuzz 0 … maxFuzz
- * 2. `git apply --fuzz=N` at the first passing level
+ * 1. `git apply --check` exact, then with `-C2`, `-C1`, `-C0`
+ * 2. `git apply` (same flags) at the first passing level
  * 3. Fall through to `git apply --reject` if nothing succeeds
  *
  * @param patchPath - Absolute path to the `.patch` file
  * @param engineDir - Working directory (engine/)
- * @param maxFuzz   - Maximum fuzz factor to try (default 3)
+ * @param maxFuzz   - Maximum context-reduction steps to try (default 3,
+ *   0 = exact only). Values above 3 are capped: git cannot reduce below
+ *   `-C0`.
+ * @throws InvalidArgumentError when `maxFuzz` is not a non-negative integer —
+ *   a NaN or negative value would silently skip every apply attempt
+ *   (including the exact-match one) and fall straight through to `--reject`
  */
 export async function applyPatchWithFuzz(patchPath, engineDir, maxFuzz = 3) {
+    if (!Number.isInteger(maxFuzz) || maxFuzz < 0) {
+        throw new InvalidArgumentError(`maxFuzz must be a non-negative integer, got ${String(maxFuzz)}.`, 'maxFuzz');
+    }
     await ensureGit();
-    // Try exact match first, then escalate
-    for (let fuzz = 0; fuzz <= maxFuzz; fuzz++) {
-        const fuzzArgs = fuzz > 0 ? [`--fuzz=${fuzz}`] : [];
-        const check = await exec('git', ['apply', '--check', ...fuzzArgs, '--', patchPath], {
+    // Try exact match first, then escalate context reduction.
+    const maxSteps = Math.min(maxFuzz, GIT_DEFAULT_CONTEXT);
+    for (let step = 0; step <= maxSteps; step++) {
+        const contextArgs = step > 0 ? [`-C${String(GIT_DEFAULT_CONTEXT - step)}`] : [];
+        const check = await exec('git', ['apply', '--check', ...contextArgs, '--', patchPath], {
             cwd: engineDir,
         });
         if (check.exitCode === 0) {
             // --check passed: apply for real
-            const apply = await exec('git', ['apply', ...fuzzArgs, '--', patchPath], {
+            const apply = await exec('git', ['apply', ...contextArgs, '--', patchPath], {
                 cwd: engineDir,
             });
             if (apply.exitCode === 0) {
-                if (fuzz > 0) {
-                    verbose(`Patch applied with fuzz=${fuzz}: ${patchPath}`);
+                if (step > 0) {
+                    verbose(`Patch applied with reduced context (-C${String(GIT_DEFAULT_CONTEXT - step)}): ${patchPath}`);
                 }
-                return { success: true, fuzzFactor: fuzz };
+                return { success: true, fuzzFactor: step };
             }
-            // Unlikely: --check passed but apply failed; fall through to next fuzz
-            verbose(`git apply fuzz=${fuzz} --check passed but apply failed: ${apply.stderr.trim()}`);
+            // Unlikely: --check passed but apply failed; fall through to next step
+            verbose(`git apply -C${String(GIT_DEFAULT_CONTEXT - step)} --check passed but apply failed: ${apply.stderr.trim()}`);
         }
     }
-    // All fuzz levels failed → generate .rej files for manual resolution
+    // All context-reduction levels failed → generate .rej files for manual resolution
     const rejectResult = await exec('git', ['apply', '--reject', '--', patchPath], {
         cwd: engineDir,
     });
-    const errorMessage = rejectResult.stderr.trim() || 'All fuzz levels failed';
-    // Extract .rej file paths from stderr
-    const rejectFiles = [];
-    for (const line of rejectResult.stderr.split('\n')) {
-        const match = line.match(/Applying patch .* with (\d+) reject/);
-        if (match)
-            continue;
-        const rejMatch = line.match(/Rejected hunk.*to (.+\.rej)/);
-        if (rejMatch?.[1]) {
-            rejectFiles.push(rejMatch[1]);
-        }
-    }
+    const errorMessage = rejectResult.stderr.trim() || 'All context-reduction levels failed';
     return {
         success: false,
-        fuzzFactor: maxFuzz,
+        fuzzFactor: maxSteps,
         error: errorMessage,
-        rejectFiles,
+        rejectFiles: extractRejectFiles(rejectResult.stderr),
     };
 }
-//# sourceMappingURL=patch-apply-fuzz.js.map
+/**
+ * Extracts `.rej` file paths from `git apply --reject` stderr.
+ *
+ * Git's actual output shape (verified against git 2.50):
+ *
+ *   Applying patch f.txt with 1 reject...
+ *   Rejected hunk #1.
+ *
+ * The reject file is `<file>.rej` next to the target. The previous regex
+ * (`Rejected hunk.*to (.+\.rej)`) targeted GNU `patch(1)`'s "saving
+ * rejects to file X.rej" phrasing, which git never prints — so
+ * `rejectFiles` was always empty and the conflict-summary ".rej files
+ * created" hint never fired.
+ */
+function extractRejectFiles(stderr) {
+    const rejectFiles = [];
+    for (const line of stderr.split('\n')) {
+        const match = /^Applying patch (.+) with \d+ rejects?\.\.\./.exec(line);
+        if (match?.[1]) {
+            rejectFiles.push(`${match[1]}.rej`);
+        }
+    }
+    return rejectFiles;
+}

package/dist/src/core/patch-apply.d.ts

@@ -40,6 +40,28 @@ export interface ApplyPatchesOptions {
      */
     untilFilename?: string | undefined;
 }
+/**
+ * Decides whether a patch filename matches an `--until` identifier.
+ *
+ * The identifier is one of three shapes and the three shapes must stay
+ * disjoint so the operator can reason about which patch they picked:
+ *
+ *   1. **Exact filename** — `005-foo.patch`. Matches only that filename.
+ *   2. **Filename without extension** — `005-foo`. Matches `005-foo.patch`.
+ *   3. **Bare numeric ordinal** — `5` or `005`. Matches the patch whose
+ *      order prefix parses to the same integer (so `5` and `005` both
+ *      match `005-foo.patch`, and `05` matches too because parseInt
+ *      normalizes leading zeros).
+ *
+ * A purely-numeric identifier is treated **only** as an ordinal: it does
+ * not also match a filename that happens to literally equal the digits.
+ * That would require a patch literally named `5` or `005` — which would
+ * collide with the filename prefix anyway — and we prefer the explicit
+ * ordinal interpretation. The earlier form's `patchFilename === needle`
+ * short-circuit was kept behind the numeric gate so the match stays
+ * single-meaning per identifier.
+ */
+export declare function matchesUntilFilename(patchFilename: string, needle: string): boolean;
 /**
  * Enhanced patch application with continue mode.
  * When continueOnFailure is false, rolls back all previously applied patches
@@ -58,3 +80,11 @@ export declare function applyPatchesWithContinue(patchesDir: string, engineDir:
  * @returns Content after all patches applied, or null if file doesn't exist
  */
 export declare function computePatchedContent(patchesDir: string, engineDir: string, filePath: string): Promise<string | null>;
+/**
+ * Builds a batched variant of {@link computePatchedContent} that loads the
+ * manifest and discovers patch files ONCE for many lookups. The per-call
+ * function re-runs `loadPatchesManifest` + `discoverPatches` for every
+ * file — O(dirtyFiles × patches) redundant IO when classifying a broad
+ * engine edit session during `import`.
+ */
+export declare function createPatchedContentComputer(patchesDir: string, engineDir: string): Promise<(filePath: string) => Promise<string | null>>;

package/dist/src/core/patch-apply.js

@@ -3,8 +3,8 @@
  * Patch orchestration — coordinates patch discovery, application, and validation.
  * Pure parsing, content transformation, and lock management are in separate modules.
  */
-import { lstat } from 'node:fs/promises';
-import { join, resolve } from 'node:path';
+import { lstat, readlink, realpath } from 'node:fs/promises';
+import { basename, dirname, join, resolve, sep } from 'node:path';
 import { PatchError } from '../errors/patch.js';
 import { toError } from '../utils/errors.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
@@ -14,7 +14,7 @@ import { exec } from '../utils/process.js';
 import { applyPatchIdempotent, reversePatch } from './git.js';
 import { getFileContentFromHead } from './git-file-ops.js';
 import { discoverPatches } from './patch-files.js';
-import { findPatchesAffectingFile } from './patch-manifest.js';
+import { findPatchesAffectingFile, loadPatchesManifest } from './patch-manifest.js';
 import { extractAffectedFiles, extractConflictingFiles, isNewFileInPatch } from './patch-parse.js';
 import { applyPatchToContent, extractNewFileContent } from './patch-transform.js';
 // Re-export from split modules so existing import sites continue working
@@ -27,16 +27,23 @@ export { applyPatchToContent, extractNewFileContent } from './patch-transform.js
  * Applies a single patch.
  * @param patch - Patch info
  * @param engineDir - Path to the engine directory
+ * @param protectedFiles - Files touched by patches already applied in the
+ *   current run; the idempotent-recovery reset must not wipe them (see
+ *   applyPatchIdempotent). Overlapping queues (`--allow-overlap`) share
+ *   files between patches, and a later patch's recovery used to reset the
+ *   shared file to HEAD — silently discarding the earlier patch's changes.
  * @returns Patch result
  */
-async function applySinglePatch(patch, engineDir) {
+async function applySinglePatch(patch, engineDir, protectedFiles) {
     let patchContent = '';
     let affectedFiles = [];
     try {
         patchContent = await readText(patch.path);
         affectedFiles = extractAffectedFiles(patchContent);
         await validatePatchTargets(patch, affectedFiles, engineDir);
-        await applyPatchIdempotent(patch.path, engineDir);
+        await applyPatchIdempotent(patch.path, engineDir, {
+            ...(protectedFiles ? { protectedFiles } : {}),
+        });
         return { patch, success: true };
     }
     catch (error) {
@@ -48,21 +55,39 @@ async function applySinglePatch(patch, engineDir) {
         let resolvedNewFiles = false;
         // Save original content for files we might overwrite, so we can restore on failure
         const savedContents = new Map();
-        for (const file of affectedFiles) {
-            if (isNewFileInPatch(patchContent, file)) {
-                const targetPath = join(engineDir, file);
-                if (await pathExists(targetPath)) {
-                    savedContents.set(file, await readText(targetPath));
-                    const content = await extractNewFileContent(patch.path, file);
-                    await writeText(targetPath, content);
-                    resolvedNewFiles = true;
+        try {
+            for (const file of affectedFiles) {
+                if (isNewFileInPatch(patchContent, file)) {
+                    const targetPath = join(engineDir, file);
+                    if (await pathExists(targetPath)) {
+                        savedContents.set(file, await readText(targetPath));
+                        const content = await extractNewFileContent(patch.path, file);
+                        await writeText(targetPath, content);
+                        resolvedNewFiles = true;
+                    }
                 }
             }
         }
+        catch (extractError) {
+            // extractNewFileContent threw for a LATER target (e.g. a binary
+            // section) after earlier targets were already overwritten — restore
+            // them before reporting failure, instead of letting the exception
+            // skip the restore loop entirely and crash the whole import.
+            for (const [file, originalContent] of savedContents) {
+                await writeText(join(engineDir, file), originalContent);
+            }
+            return { patch, success: false, error: toError(extractError).message };
+        }
         if (resolvedNewFiles) {
             try {
-                await applyPatchIdempotent(patch.path, engineDir);
-                return { patch, success: true, autoResolved: true };
+                await applyPatchIdempotent(patch.path, engineDir, {
+                    ...(protectedFiles ? { protectedFiles } : {}),
+                });
+                // Keep the originals: rollbackPatches needs them if a LATER patch
+                // fails, since reverse-applying this new-file patch deletes the
+                // target and would otherwise permanently discard the pre-existing
+                // content (recoverable from git only if it was tracked at HEAD).
+                return { patch, success: true, autoResolved: true, autoResolvedOriginals: savedContents };
             }
             catch (retryError) {
                 verbose(`Auto-resolved new-file retry failed for ${patch.filename}: ${toError(retryError).message}`);
@@ -76,7 +101,10 @@ async function applySinglePatch(patch, engineDir) {
         let errorMessage = applyError.message;
         try {
             // Use --reject to apply what we can and create .rej files for what we can't
-            await applyPatchIdempotent(patch.path, engineDir, { reject: true });
+            await applyPatchIdempotent(patch.path, engineDir, {
+                reject: true,
+                ...(protectedFiles ? { protectedFiles } : {}),
+            });
             // If this somehow succeeds with --reject but failed without, it still shouldn't
             // happen because applyPatch first runs --check which would fail.
             // But if it did succeed, we should still return failure because manual fix is needed
@@ -105,6 +133,19 @@ async function rollbackPatches(results, engineDir) {
         catch (rollbackError) {
             verbose(`Failed to roll back ${result.patch.filename}: ${toError(rollbackError).message}`);
         }
+        // Reversing an auto-resolved new-file patch deletes the target; put
+        // back the pre-existing content the auto-resolve overwrote.
+        if (result.autoResolvedOriginals) {
+            for (const [file, originalContent] of result.autoResolvedOriginals) {
+                try {
+                    await writeText(join(engineDir, file), originalContent);
+                    verbose(`Restored pre-existing content of ${file} after rollback`);
+                }
+                catch (restoreError) {
+                    verbose(`Could not restore ${file}: ${toError(restoreError).message}`);
+                }
+            }
+        }
     }
 }
 /**
@@ -117,9 +158,15 @@ async function rollbackPatches(results, engineDir) {
 export async function applyPatches(patchesDir, engineDir) {
     const patches = await discoverPatches(patchesDir);
     const results = [];
+    const appliedFiles = new Set();
     for (const patch of patches) {
-        const result = await applySinglePatch(patch, engineDir);
+        const result = await applySinglePatch(patch, engineDir, appliedFiles);
         results.push(result);
+        if (result.success) {
+            for (const file of extractAffectedFiles(await readText(patch.path))) {
+                appliedFiles.add(file);
+            }
+        }
         // Stop on first failure and roll back all previously applied patches
         if (!result.success) {
             const succeeded = results.filter((r) => r.success);
@@ -159,33 +206,63 @@ export async function validatePatches(patchesDir, engineDir) {
     return { valid: errors.length === 0, errors };
 }
 async function validatePatchTargets(patch, affectedFiles, engineDir) {
+    // realpath the engine root once so containment is checked against the
+    // physical tree (the root itself may sit behind a symlink, e.g. /tmp on
+    // macOS). An unresolvable engine dir skips the symlink checks — a missing
+    // engine surfaces through `git apply --check` with a better message.
+    const engineRoot = engineDir ? await realpath(engineDir).catch(() => null) : null;
     for (const file of affectedFiles) {
         if (!isContainedRelativePath(file)) {
             throw new PatchError(`Patch targets a path outside engine/: ${file}`, patch.filename);
         }
-        // When the engine directory is known, verify that existing target paths
-        // are not symlinks pointing outside the engine tree. A crafted patch
-        // could otherwise write through a symlink to an arbitrary location.
-        if (engineDir) {
-            const targetPath = join(engineDir, file);
-            try {
-                const stats = await lstat(targetPath);
-                if (stats.isSymbolicLink()) {
-                    const realPath = resolve(engineDir, file);
-                    const resolvedEngine = resolve(engineDir);
-                    if (!realPath.startsWith(resolvedEngine + '/') && realPath !== resolvedEngine) {
-                        throw new PatchError(`Patch targets a symlink that resolves outside engine/: ${file}`, patch.filename);
-                    }
-                }
-            }
-            catch (error) {
-                // File doesn't exist yet (new file) or stat fails — skip check
-                if (error instanceof PatchError)
-                    throw error;
+        // Verify that a write to the target would physically land inside the
+        // engine tree. A crafted patch could otherwise write through a symlink
+        // (the target itself, a dangling link, or a symlinked parent directory)
+        // to an arbitrary location.
+        if (engineDir && engineRoot) {
+            const destination = await resolvePatchWriteDestination(join(engineDir, file));
+            if (destination !== engineRoot && !destination.startsWith(engineRoot + sep)) {
+                throw new PatchError(`Patch targets a path that resolves outside engine/ (symlink escape): ${file}`, patch.filename);
             }
         }
     }
 }
+/**
+ * Resolves where a write to `targetPath` would physically land, following
+ * symlinks on every path component that already exists.
+ *
+ * - Existing target: `realpath` resolves it fully.
+ * - Dangling symlink: `realpath` rejects it, but a write through the link
+ *   would still be created at the link target, so the target is resolved
+ *   against the link's (real) parent directory. The link target is taken
+ *   textually — a loop or nested dangling link fails at apply time anyway.
+ * - Not-yet-existing file: resolved against the nearest existing ancestor's
+ *   real path. Components below that ancestor do not exist, so they cannot
+ *   be symlinks and are appended verbatim.
+ */
+async function resolvePatchWriteDestination(targetPath) {
+    try {
+        return await realpath(targetPath);
+    }
+    catch {
+        // Fall through: the path (or its symlink target) does not exist.
+    }
+    try {
+        const stats = await lstat(targetPath);
+        if (stats.isSymbolicLink()) {
+            const linkTarget = await readlink(targetPath);
+            return resolve(await resolvePatchWriteDestination(dirname(targetPath)), linkTarget);
+        }
+    }
+    catch {
+        // The path component itself does not exist.
+    }
+    const parent = dirname(targetPath);
+    if (parent === targetPath) {
+        return targetPath;
+    }
+    return join(await resolvePatchWriteDestination(parent), basename(targetPath));
+}
 /**
  * Decides whether a patch filename matches an `--until` identifier.
  *
@@ -207,7 +284,7 @@ async function validatePatchTargets(patch, affectedFiles, engineDir) {
  * short-circuit was kept behind the numeric gate so the match stays
  * single-meaning per identifier.
  */
-function matchesUntilFilename(patchFilename, needle) {
+export function matchesUntilFilename(patchFilename, needle) {
     const isNumeric = /^\d+$/.test(needle);
     if (isNumeric) {
         const order = parseInt(needle, 10);
@@ -268,6 +345,7 @@ export async function applyPatchesWithContinue(patchesDir, engineDir, optionsOrC
     const succeeded = [];
     const failed = [];
     const skipped = [];
+    const appliedFiles = new Set();
     for (let i = 0; i < patches.length; i++) {
         const patch = patches[i];
         if (!patch)
@@ -279,9 +357,12 @@ export async function applyPatchesWithContinue(patchesDir, engineDir, optionsOrC
             skipped.push(patch);
             continue;
         }
-        const result = await applySinglePatch(patch, engineDir);
+        const result = await applySinglePatch(patch, engineDir, appliedFiles);
         if (result.success) {
             succeeded.push(result);
+            for (const file of extractAffectedFiles(await readText(patch.path))) {
+                appliedFiles.add(file);
+            }
         }
         else {
             // Try to extract conflicting files from error message
@@ -332,4 +413,36 @@ export async function computePatchedContent(patchesDir, engineDir, filePath) {
     }
     return content;
 }
-//# sourceMappingURL=patch-apply.js.map
+/**
+ * Builds a batched variant of {@link computePatchedContent} that loads the
+ * manifest and discovers patch files ONCE for many lookups. The per-call
+ * function re-runs `loadPatchesManifest` + `discoverPatches` for every
+ * file — O(dirtyFiles × patches) redundant IO when classifying a broad
+ * engine edit session during `import`.
+ */
+export async function createPatchedContentComputer(patchesDir, engineDir) {
+    const manifest = await loadPatchesManifest(patchesDir);
+    const patches = await discoverPatches(patchesDir);
+    const patchByFilename = new Map(patches.map((p) => [p.filename, p]));
+    const affectingByFile = new Map();
+    for (const metadata of manifest?.patches ?? []) {
+        const patch = patchByFilename.get(metadata.filename);
+        if (!patch)
+            continue;
+        for (const file of metadata.filesAffected) {
+            const list = affectingByFile.get(file) ?? [];
+            list.push(patch);
+            affectingByFile.set(file, list);
+        }
+    }
+    for (const list of affectingByFile.values()) {
+        list.sort((a, b) => a.order - b.order);
+    }
+    return async (filePath) => {
+        let content = await getFileContentFromHead(engineDir, filePath);
+        for (const patch of affectingByFile.get(filePath) ?? []) {
+            content = await applyPatchToContent(content, patch.path, filePath);
+        }
+        return content;
+    };
+}