@hominis/fireforge 0.35.0 → 0.36.0

package/dist/src/utils/process.d.ts

@@ -8,6 +8,16 @@ export interface ExecResult {
     stderr: string;
     /** Process exit code */
     exitCode: number;
+    /**
+     * True when `stdout` was cut off at the 50 MB collector cap. Optional so
+     * existing mocks stay valid; absent means "not truncated". Callers that
+     * feed the output into safety decisions (e.g. archive-listing scans) must
+     * treat `true` as a hard failure — a truncated listing looks exactly like
+     * a complete one otherwise.
+     */
+    stdoutTruncated?: boolean;
+    /** True when `stderr` was cut off at the 50 MB collector cap. See {@link ExecResult.stdoutTruncated}. */
+    stderrTruncated?: boolean;
 }
 /**
  * Options for command execution.
@@ -49,6 +59,13 @@ export interface StreamOptions extends ExecOptions {
  * @returns Exit code of the process
  */
 export declare function execStream(command: string, args: string[], options?: StreamOptions): Promise<number>;
+/**
+ * Waits (bounded) for every tracked child process to close. Called by the
+ * bin signal handler after forwarding SIGINT/SIGTERM, so the parent stays
+ * alive long enough for the grace-then-SIGKILL escalation to actually run.
+ * Resolves immediately when no children are active.
+ */
+export declare function waitForActiveChildShutdown(timeoutMs: number): Promise<void>;
 /**
  * Executes a command and inherits stdio (shows output directly).
  *
@@ -81,8 +98,16 @@ export declare function execInheritCapture(command: string, args: string[], opti
 }): Promise<ExecResult>;
 /** Per-line callback for smoke-run stream dispatch. */
 export type SmokeLineCallback = (line: string) => void;
-/** Options for {@link execSmokeRun}. */
-export interface SmokeRunOptions extends ExecOptions {
+/**
+ * Options for {@link execSmokeRun}.
+ *
+ * Deliberately omits `ExecOptions.timeout`: the smoke run's only deadline is
+ * {@link SmokeRunOptions.smokeTimeoutMs}, which signals the whole process
+ * group. Inheriting `timeout` used to be a leaky trap — it was accepted by
+ * the type but silently ignored, so a caller setting it got no deadline at
+ * all.
+ */
+export interface SmokeRunOptions extends Omit<ExecOptions, 'timeout'> {
     /**
      * Hard deadline in milliseconds. When it elapses the child process
      * group is sent SIGTERM and, after `killGraceMs`, SIGKILL. The returned
@@ -138,8 +163,12 @@ export interface SmokeRunResult extends ExecResult {
  * that inherited the group.
  *
  * Windows fallback: `detached: true` does not create an equivalent group
- * there, so we degrade to `child.kill()` and log a best-effort warning
- * via the `onStderrLine` callback if the caller wired one.
+ * there, so we kill the descendant tree with `taskkill /pid <pid> /T /F`
+ * instead. taskkill has no graceful-signal equivalent — both the deadline
+ * and the grace re-invocation are forced kills, so Windows children get
+ * no shutdown window (best-effort; Windows is untested, see README).
+ * `child.kill()` is still sent as a direct-child fallback in case
+ * taskkill itself is unavailable.
  */
 export declare function execSmokeRun(command: string, args: string[], options: SmokeRunOptions): Promise<SmokeRunResult>;
 /**

package/dist/src/utils/process.js

@@ -1,16 +1,29 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { spawn } from 'node:child_process';
 import { constants as osConstants } from 'node:os';
+import { StringDecoder } from 'node:string_decoder';
+import { ExecTimeoutError } from '../errors/base.js';
 // 50 MB cap per stream to prevent OOM — large toolchain builds (e.g. Firefox, Chromium)
 // can easily blow past this, so we truncate rather than let the buffer grow unbounded.
+// Callers for whom truncation is unacceptable (e.g. the archive-safety preflight
+// scanning a full `tar -tvf` listing) must check `wasTruncated` and fail hard.
 const MAX_OUTPUT_SIZE = 50 * 1024 * 1024;
 function createStreamCollector(mirror) {
     const chunks = [];
     let totalLength = 0;
     let truncated = false;
+    // A per-stream StringDecoder keeps multibyte UTF-8 characters split across
+    // pipe chunk boundaries intact. Per-chunk `Buffer.toString()` turned a
+    // straddling character into two U+FFFD replacement chars, which silently
+    // broke regex matching over captured output (smoke-run allowlists, mach
+    // error hints) whenever a non-ASCII path or localized message landed on a
+    // 64 KB chunk boundary.
+    const decoder = new StringDecoder('utf8');
     return {
         onData: (data) => {
-            const chunk = data.toString();
+            const chunk = decoder.write(data);
+            if (chunk.length === 0)
+                return;
             mirror?.write(chunk);
             if (truncated)
                 return;
@@ -27,6 +40,7 @@ function createStreamCollector(mirror) {
             }
         },
         getText: () => chunks.join(''),
+        wasTruncated: () => truncated,
     };
 }
 function buildSignalFromTimeout(timeout) {
@@ -34,6 +48,19 @@ function buildSignalFromTimeout(timeout) {
         return undefined;
     return AbortSignal.timeout(timeout);
 }
+/**
+ * Maps a child-process `error` event to the rejection the caller sees.
+ * When the caller set a `timeout` and the error is the AbortError produced
+ * by `AbortSignal.timeout` firing, rejects with a typed
+ * {@link ExecTimeoutError} naming the command and budget instead of Node's
+ * opaque `AbortError: The operation was aborted`.
+ */
+function toExecRejection(error, command, args, timeout) {
+    if (timeout !== undefined && error.name === 'AbortError') {
+        return new ExecTimeoutError(command, args, timeout, error);
+    }
+    return error;
+}
 function exitCodeFromClose(code, signal) {
     if (code !== null) {
         return code;
@@ -66,13 +93,15 @@ export async function exec(command, args, options = {}) {
         child.stdout.on('data', out.onData);
         child.stderr.on('data', err.onData);
         child.on('error', (error) => {
-            reject(error);
+            reject(toExecRejection(error, command, args, options.timeout));
         });
         child.on('close', (code, signal) => {
             resolve({
                 stdout: out.getText(),
                 stderr: err.getText(),
                 exitCode: exitCodeFromClose(code, signal),
+                stdoutTruncated: out.wasTruncated(),
+                stderrTruncated: err.wasTruncated(),
             });
         });
     });
@@ -92,20 +121,66 @@ export async function execStream(command, args, options = {}) {
             stdio: ['ignore', 'pipe', 'pipe'],
             signal: buildSignalFromTimeout(options.timeout),
         });
+        const stdoutDecoder = new StringDecoder('utf8');
+        const stderrDecoder = new StringDecoder('utf8');
         child.stdout.on('data', (data) => {
-            options.onStdout?.(data.toString());
+            const chunk = stdoutDecoder.write(data);
+            if (chunk.length > 0)
+                options.onStdout?.(chunk);
         });
         child.stderr.on('data', (data) => {
-            options.onStderr?.(data.toString());
+            const chunk = stderrDecoder.write(data);
+            if (chunk.length > 0)
+                options.onStderr?.(chunk);
         });
         child.on('error', (error) => {
-            reject(error);
+            reject(toExecRejection(error, command, args, options.timeout));
         });
         child.on('close', (code, signal) => {
             resolve(exitCodeFromClose(code, signal));
         });
     });
 }
+/**
+ * Close-promises of children whose shutdown the CLI must wait for when a
+ * termination signal arrives. The bin signal handler used to `process.exit`
+ * within a microtask of the first Ctrl+C, which made `execInherit`'s
+ * documented SIGTERM → grace → SIGKILL escalation unreachable: the parent
+ * was gone before the 1500 ms grace timer could fire, so a hung Firefox
+ * was orphaned forever instead of being SIGKILLed and a healthy one lost
+ * its AsyncShutdown flush window.
+ */
+const activeChildClosures = new Set();
+function trackChildClosure() {
+    let resolveClosed;
+    const closed = new Promise((resolve) => {
+        resolveClosed = resolve;
+    });
+    activeChildClosures.add(closed);
+    return {
+        settle: () => {
+            resolveClosed?.();
+            activeChildClosures.delete(closed);
+        },
+    };
+}
+/**
+ * Waits (bounded) for every tracked child process to close. Called by the
+ * bin signal handler after forwarding SIGINT/SIGTERM, so the parent stays
+ * alive long enough for the grace-then-SIGKILL escalation to actually run.
+ * Resolves immediately when no children are active.
+ */
+export async function waitForActiveChildShutdown(timeoutMs) {
+    if (activeChildClosures.size === 0)
+        return;
+    await Promise.race([
+        Promise.allSettled([...activeChildClosures]),
+        new Promise((resolve) => {
+            const timer = setTimeout(resolve, timeoutMs);
+            timer.unref();
+        }),
+    ]);
+}
 /**
  * Executes a command and inherits stdio (shows output directly).
  *
@@ -132,12 +207,15 @@ export async function execInherit(command, args, options = {}) {
         });
         const graceMs = options.shutdownGraceMs ?? 1500;
         const { dispose } = installGracefulShutdownForwarder(child, graceMs);
+        const closure = trackChildClosure();
         child.on('error', (error) => {
             dispose();
-            reject(error);
+            closure.settle();
+            reject(toExecRejection(error, command, args, options.timeout));
         });
         child.on('close', (code, signal) => {
             dispose();
+            closure.settle();
             resolve(exitCodeFromClose(code, signal));
         });
     });
@@ -220,16 +298,21 @@ export async function execInheritCapture(command, args, options = {}) {
         child.stderr.on('data', err.onData);
         const graceMs = options.shutdownGraceMs ?? 1500;
         const { dispose } = installGracefulShutdownForwarder(child, graceMs);
+        const closure = trackChildClosure();
         child.on('error', (error) => {
             dispose();
-            reject(error);
+            closure.settle();
+            reject(toExecRejection(error, command, args, options.timeout));
         });
         child.on('close', (code, signal) => {
             dispose();
+            closure.settle();
             resolve({
                 stdout: out.getText(),
                 stderr: err.getText(),
                 exitCode: exitCodeFromClose(code, signal),
+                stdoutTruncated: out.wasTruncated(),
+                stderrTruncated: err.wasTruncated(),
             });
         });
     });
@@ -248,8 +331,12 @@ export async function execInheritCapture(command, args, options = {}) {
  * that inherited the group.
  *
  * Windows fallback: `detached: true` does not create an equivalent group
- * there, so we degrade to `child.kill()` and log a best-effort warning
- * via the `onStderrLine` callback if the caller wired one.
+ * there, so we kill the descendant tree with `taskkill /pid <pid> /T /F`
+ * instead. taskkill has no graceful-signal equivalent — both the deadline
+ * and the grace re-invocation are forced kills, so Windows children get
+ * no shutdown window (best-effort; Windows is untested, see README).
+ * `child.kill()` is still sent as a direct-child fallback in case
+ * taskkill itself is unavailable.
  */
 export async function execSmokeRun(command, args, options) {
     return new Promise((resolve, reject) => {
@@ -261,25 +348,28 @@ export async function execSmokeRun(command, args, options) {
             // A new process group on POSIX lets us signal the whole descendant
             // tree at once, which is essential for mach → python → firefox →
             // content-process chains. On Windows spawn ignores this for our
-            // purposes and we fall back to child.kill below.
+            // purposes and we fall back to a taskkill /T tree kill below.
             detached: usesProcessGroup,
         });
         const out = createStreamCollector(options.mirror?.stdout);
         const err = createStreamCollector(options.mirror?.stderr);
+        const stdoutLineDecoder = new StringDecoder('utf8');
+        const stderrLineDecoder = new StringDecoder('utf8');
         let stdoutBuffer = '';
         let stderrBuffer = '';
         child.stdout.on('data', (data) => {
             out.onData(data);
-            stdoutBuffer += data.toString();
+            stdoutBuffer += stdoutLineDecoder.write(data);
             stdoutBuffer = dispatchCompleteLines(stdoutBuffer, options.onStdoutLine);
         });
         child.stderr.on('data', (data) => {
             err.onData(data);
-            stderrBuffer += data.toString();
+            stderrBuffer += stderrLineDecoder.write(data);
             stderrBuffer = dispatchCompleteLines(stderrBuffer, options.onStderrLine);
         });
         let timedOut = false;
         let graceTimer;
+        let signalGraceTimer;
         const signalChildGroup = (signal) => {
             if (child.exitCode !== null || child.signalCode !== null)
                 return;
@@ -294,6 +384,15 @@ export async function execSmokeRun(command, args, options) {
                     process.kill(-targetPid, signal);
                 }
                 else {
+                    // No process group on Windows — taskkill /T walks the descendant
+                    // tree instead. Always forced (/F): there is no SIGTERM analogue,
+                    // so the grace window only exists on POSIX.
+                    spawn('taskkill', ['/pid', String(targetPid), '/T', '/F'], {
+                        stdio: 'ignore',
+                    }).on('error', () => {
+                        // taskkill unavailable — nothing more we can do beyond the
+                        // direct-child kill below.
+                    });
                     child.kill(signal);
                 }
             }
@@ -310,16 +409,52 @@ export async function execSmokeRun(command, args, options) {
             graceTimer.unref();
         }, options.smokeTimeoutMs);
         deadlineTimer.unref();
+        // Forward parent SIGINT/SIGTERM to the whole child process group. The
+        // smoke child is a group leader (detached), so it does NOT receive the
+        // terminal's Ctrl+C SIGINT — without this forwarder, the parent exits
+        // and the entire mach → firefox tree is orphaned. Second signal (or
+        // grace expiry) escalates to a group SIGKILL.
+        const forwardedSignals = new Set();
+        const onParentSignal = (signal) => {
+            if (forwardedSignals.has(signal)) {
+                signalChildGroup('SIGKILL');
+                return;
+            }
+            forwardedSignals.add(signal);
+            signalChildGroup('SIGTERM');
+            signalGraceTimer = setTimeout(() => {
+                signalChildGroup('SIGKILL');
+            }, options.killGraceMs ?? 10000);
+            signalGraceTimer.unref();
+        };
+        const onSigint = () => {
+            onParentSignal('SIGINT');
+        };
+        const onSigterm = () => {
+            onParentSignal('SIGTERM');
+        };
+        process.on('SIGINT', onSigint);
+        process.on('SIGTERM', onSigterm);
+        const closure = trackChildClosure();
+        const cleanupSignalForwarding = () => {
+            process.off('SIGINT', onSigint);
+            process.off('SIGTERM', onSigterm);
+            if (signalGraceTimer)
+                clearTimeout(signalGraceTimer);
+            closure.settle();
+        };
         child.on('error', (error) => {
             clearTimeout(deadlineTimer);
             if (graceTimer)
                 clearTimeout(graceTimer);
+            cleanupSignalForwarding();
             reject(error);
         });
         child.on('close', (code, signal) => {
             clearTimeout(deadlineTimer);
             if (graceTimer)
                 clearTimeout(graceTimer);
+            cleanupSignalForwarding();
             // Flush any remaining partial line (child ended without a trailing newline).
             if (stdoutBuffer.length > 0)
                 options.onStdoutLine?.(stdoutBuffer);
@@ -335,24 +470,45 @@ export async function execSmokeRun(command, args, options) {
     });
 }
 /**
- * Drains complete newline-terminated lines from `buffer`, dispatching each
- * trimmed-of-newline line to `cb`. Returns the remaining partial line that
- * has not yet been terminated — callers should keep accumulating into it.
+ * Cap on the partial-line tail kept between chunks. A child emitting one
+ * enormous line with no terminator (minified JS dumped to stderr, a raw
+ * binary blob) previously grew the buffer without bound — the 50 MB cap
+ * only guarded the collector, not these line buffers. When the tail
+ * exceeds the cap it is dispatched as a synthetic (oversized) line so the
+ * matchers still get to see its content, then the buffer resets.
+ */
+const MAX_PARTIAL_LINE_SIZE = 1024 * 1024;
+/**
+ * Drains complete lines from `buffer`, dispatching each to `cb`. Treats
+ * `\n`, `\r\n`, and lone `\r` as line terminators — the lone-`\r` case
+ * matters for progress-bar style output (mach, cargo) that repaints a line
+ * with carriage returns and never sends a newline; before `\r` counted as a
+ * terminator those updates accumulated indefinitely. A single trailing `\r`
+ * is held back since it may be the first half of a `\r\n` pair split across
+ * chunks. Returns the remaining partial line — callers keep accumulating
+ * into it.
  */
 function dispatchCompleteLines(buffer, cb) {
-    if (!cb) {
-        // No listener — still need to collapse accumulated newlines so the
-        // buffer does not grow forever. Keep only the partial-line tail.
-        const lastNewline = buffer.lastIndexOf('\n');
-        if (lastNewline === -1)
-            return buffer;
-        return buffer.slice(lastNewline + 1);
+    let searchFrom = 0;
+    for (;;) {
+        const nl = buffer.indexOf('\n', searchFrom);
+        const cr = buffer.indexOf('\r', searchFrom);
+        const idx = nl === -1 ? cr : cr === -1 ? nl : Math.min(nl, cr);
+        if (idx === -1)
+            break;
+        if (buffer[idx] === '\r' && idx === buffer.length - 1) {
+            // Possible first half of a chunk-split \r\n — wait for the next chunk.
+            break;
+        }
+        const line = buffer.slice(0, idx);
+        const terminatorLength = buffer[idx] === '\r' && buffer[idx + 1] === '\n' ? 2 : 1;
+        buffer = buffer.slice(idx + terminatorLength);
+        searchFrom = 0;
+        cb?.(line);
     }
-    let idx;
-    while ((idx = buffer.indexOf('\n')) !== -1) {
-        const line = buffer.slice(0, idx).replace(/\r$/, '');
-        buffer = buffer.slice(idx + 1);
-        cb(line);
+    if (buffer.length > MAX_PARTIAL_LINE_SIZE) {
+        cb?.(buffer);
+        return '';
     }
     return buffer;
 }
@@ -388,4 +544,3 @@ export async function executableExists(name) {
     const path = await findExecutable(name);
     return path !== undefined;
 }
-//# sourceMappingURL=process.js.map

package/dist/src/utils/regex.d.ts

@@ -7,9 +7,19 @@ export declare function escapeRegex(str: string): string;
  */
 export declare function hasRawCssColors(content: string): boolean;
 /**
- * Strips JS single-line and multi-line comments from source code, replacing them
- * with spaces of equal length to preserve character offsets. String literals
- * (single-quoted, double-quoted, and template) are preserved intact.
+ * Strips JS single-line and multi-line comments from source code, replacing
+ * comment bytes with spaces (newlines inside block comments are kept) so
+ * both character offsets AND line numbers are preserved. String literals
+ * are preserved intact.
+ *
+ * Uses acorn's tokenizer, which understands regex literals — the previous
+ * pure-regex implementation did not model them, so two adjacent slashes
+ * inside a regex (e.g. the tail of `/https?:\/\//`) were treated as a `//`
+ * line comment and the rest of the line was blanked, corrupting whatever
+ * lint pass consumed the stripped text. Firefox chrome sources contain
+ * preprocessor directives (`#ifdef`) and other constructs acorn cannot
+ * tokenize; those fall back to the legacy regex strip, which handles
+ * strings but NOT regex literals (documented limitation of the fallback).
  */
 export declare function stripJsComments(source: string): string;
 /**

package/dist/src/utils/regex.js

@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: EUPL-1.2
+import { tokenizer as acornTokenizer, tokTypes as acornTokTypes } from 'acorn';
 /**
  * Escapes special regex characters in a string.
  */
@@ -22,11 +23,60 @@ export function hasRawCssColors(content) {
     return CSS_HEX_COLOR.test(content) || CSS_RGB_COLOR.test(content) || CSS_HSL_COLOR.test(content);
 }
 /**
- * Strips JS single-line and multi-line comments from source code, replacing them
- * with spaces of equal length to preserve character offsets. String literals
- * (single-quoted, double-quoted, and template) are preserved intact.
+ * Strips JS single-line and multi-line comments from source code, replacing
+ * comment bytes with spaces (newlines inside block comments are kept) so
+ * both character offsets AND line numbers are preserved. String literals
+ * are preserved intact.
+ *
+ * Uses acorn's tokenizer, which understands regex literals — the previous
+ * pure-regex implementation did not model them, so two adjacent slashes
+ * inside a regex (e.g. the tail of `/https?:\/\//`) were treated as a `//`
+ * line comment and the rest of the line was blanked, corrupting whatever
+ * lint pass consumed the stripped text. Firefox chrome sources contain
+ * preprocessor directives (`#ifdef`) and other constructs acorn cannot
+ * tokenize; those fall back to the legacy regex strip, which handles
+ * strings but NOT regex literals (documented limitation of the fallback).
  */
 export function stripJsComments(source) {
+    const comments = [];
+    try {
+        const t = acornTokenizer(source, {
+            ecmaVersion: 'latest',
+            sourceType: 'module',
+            allowHashBang: true,
+            onComment: (_isBlock, _text, start, end) => {
+                comments.push({ start, end });
+            },
+        });
+        // Drive the tokenizer to EOF; we only care about onComment callbacks.
+        for (;;) {
+            const token = t.getToken();
+            if (token.type === acornTokTypes.eof)
+                break;
+        }
+    }
+    catch {
+        return stripJsCommentsLegacy(source);
+    }
+    if (comments.length === 0)
+        return source;
+    const chars = source.split('');
+    for (const { start, end } of comments) {
+        for (let i = start; i < end; i++) {
+            if (chars[i] !== '\n' && chars[i] !== '\r') {
+                chars[i] = ' ';
+            }
+        }
+    }
+    return chars.join('');
+}
+/**
+ * Legacy pure-regex comment strip, used only when acorn cannot tokenize
+ * the source (preprocessor directives, syntax errors). Strings survive;
+ * regex literals are NOT modeled, so `//` inside a regex blanks the rest
+ * of the line.
+ */
+function stripJsCommentsLegacy(source) {
     return source.replace(/\/\/.*$|\/\*[\s\S]*?\*\/|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|`(?:\\.|[^`\\])*`/gm, (match) => (match.startsWith('/') ? ' '.repeat(match.length) : match));
 }
 /**
@@ -37,4 +87,3 @@ export function countRawCssColors(content) {
         (content.match(CSS_RGB_COLOR_G)?.length ?? 0) +
         (content.match(CSS_HSL_COLOR_G)?.length ?? 0));
 }
-//# sourceMappingURL=regex.js.map

package/dist/src/utils/validation.d.ts

@@ -52,18 +52,6 @@ export declare function isObject(value: unknown): value is Record<string, unknow
  * @returns True if value is an array
  */
 export declare function isArray(value: unknown): value is unknown[];
-/**
- * Asserts that a value is a string or throws.
- * @param value - Value to check
- * @param name - Name of the field for error messages
- */
-export declare function assertString(value: unknown, name: string): asserts value is string;
-/**
- * Asserts that a value is a non-null object or throws.
- * @param value - Value to check
- * @param name - Name of the field for error messages
- */
-export declare function assertObject(value: unknown, name: string): asserts value is Record<string, unknown>;
 /**
  * Validates a Firefox version string.
  * Accepts formats like "140.9.0", "140.9.1", "140.9.0esr", "147.0b1"

package/dist/src/utils/validation.js

@@ -18,7 +18,10 @@ export function isString(value) {
  * @returns True if value is a finite number
  */
 export function isNumber(value) {
-    return typeof value === 'number' && !Number.isNaN(value);
+    // Number.isFinite matches the documented contract: NaN AND ±Infinity are
+    // excluded (a JSON config field of 1e999 parses to Infinity and used to
+    // validate as a legal number).
+    return typeof value === 'number' && Number.isFinite(value);
 }
 /**
  * Checks whether a value is a positive integer (greater than zero).
@@ -75,26 +78,6 @@ export function isObject(value) {
 export function isArray(value) {
     return Array.isArray(value);
 }
-/**
- * Asserts that a value is a string or throws.
- * @param value - Value to check
- * @param name - Name of the field for error messages
- */
-export function assertString(value, name) {
-    if (!isString(value)) {
-        throw new InvalidArgumentError(`Expected ${name} to be a string, got ${typeof value}`, name);
-    }
-}
-/**
- * Asserts that a value is a non-null object or throws.
- * @param value - Value to check
- * @param name - Name of the field for error messages
- */
-export function assertObject(value, name) {
-    if (!isObject(value)) {
-        throw new InvalidArgumentError(`Expected ${name} to be an object, got ${typeof value}`, name);
-    }
-}
 /**
  * Validates a Firefox version string.
  * Accepts formats like "140.9.0", "140.9.1", "140.9.0esr", "147.0b1"
@@ -232,11 +215,16 @@ export function validateTokenName(name) {
     if (/[\x00-\x1f\x7f]/.test(ident)) {
         return `Token name must not contain control characters: "${name}"`;
     }
-    if (ident.includes('*/')) {
-        return `Token name must not contain "*/" (would break CSS comments): "${name}"`;
+    if (ident.includes('*/') || ident.includes('/*')) {
+        // `/*` is the worse of the two by this function's own standard: an
+        // ident containing it opens an UNTERMINATED comment in tokens.css
+        // that swallows every following declaration.
+        return `Token name must not contain "/*" or "*/" (would break CSS comments): "${name}"`;
     }
-    // Reject characters that would break CSS declaration syntax
-    if (/[{}();!]/.test(ident)) {
+    // Reject characters that would break CSS declaration syntax. Quotes are
+    // included: a quote character in an ident opens a CSS string that eats
+    // the rest of the declaration block.
+    if (/[{}();!'"]/.test(ident)) {
         return `Token name contains characters that would corrupt CSS syntax: "${name}"`;
     }
     return undefined;
@@ -270,4 +258,3 @@ export function validatePatchName(name) {
         return 'Name can only contain letters, numbers, hyphens, underscores, and spaces';
     return undefined;
 }
-//# sourceMappingURL=validation.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hominis/fireforge",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "FireForge — a build tool for customizing Firefox",
   "type": "module",
   "main": "./dist/src/index.js",
@@ -20,9 +20,9 @@
     "fireforge": "tsx bin/fireforge.ts",
     "build": "npm run clean && tsc -p tsconfig.build.json",
     "clean": "node ./scripts/clean.mjs",
-    "lint": "eslint src/ bin/ scripts/ eslint.config.js vitest.config.ts",
-    "lint:ci": "eslint src/ bin/ scripts/ eslint.config.js vitest.config.ts --max-warnings 0",
-    "lint:fix": "eslint src/ bin/ scripts/ eslint.config.js vitest.config.ts --fix",
+    "lint": "eslint src/ bin/ scripts/ eslint.config.js vitest.config.ts vitest.pack.config.ts",
+    "lint:ci": "eslint src/ bin/ scripts/ eslint.config.js vitest.config.ts vitest.pack.config.ts --max-warnings 0",
+    "lint:fix": "eslint src/ bin/ scripts/ eslint.config.js vitest.config.ts vitest.pack.config.ts --fix",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "deadcode:check": "knip",
     "cycles:check": "dpdm --no-output --no-tree --no-warning --exit-code circular:1 src/index.ts bin/fireforge.ts",
@@ -32,10 +32,10 @@
     "test:coverage": "vitest run --coverage && node ./scripts/check-coverage-thresholds.mjs",
     "test:firefox-full": "node ./scripts/run-full-firefox-integration.mjs",
     "whitespace:check": "node ./scripts/check-worktree-whitespace.mjs",
-    "pack:verify": "vitest run src/__tests__/wrapper-smoke.test.ts",
+    "pack:verify": "vitest run --config vitest.pack.config.ts",
     "pack:dry-run": "npm pack --dry-run --json --silent",
-    "format": "prettier --write --ignore-unknown \"src/**/*.ts\" \"bin/**/*.ts\" \"scripts/**/*.mjs\" \"package.json\" \"eslint.config.js\" \"vitest.config.ts\" \"tsconfig.json\" \"tsconfig.build.json\" \".lintstagedrc.json\" \".prettierignore\" \".prettierrc\" \".gitignore\" \"README.md\" \"CHANGELOG.md\"",
-    "format:check": "prettier --check --ignore-unknown \"src/**/*.ts\" \"bin/**/*.ts\" \"scripts/**/*.mjs\" \"package.json\" \"eslint.config.js\" \"vitest.config.ts\" \"tsconfig.json\" \"tsconfig.build.json\" \".lintstagedrc.json\" \".prettierignore\" \".prettierrc\" \".gitignore\" \"README.md\" \"CHANGELOG.md\"",
+    "format": "prettier --write --ignore-unknown \"src/**/*.ts\" \"bin/**/*.ts\" \"scripts/**/*.mjs\" \"package.json\" \"eslint.config.js\" \"vitest.config.ts\" \"vitest.pack.config.ts\" \"tsconfig.json\" \"tsconfig.build.json\" \".lintstagedrc.json\" \".prettierignore\" \".prettierrc\" \".gitignore\" \"README.md\" \"CHANGELOG.md\" \"docs/**/*.md\" \"knip.json\" \"docs/**/*.md\" \"knip.json\"",
+    "format:check": "prettier --check --ignore-unknown \"src/**/*.ts\" \"bin/**/*.ts\" \"scripts/**/*.mjs\" \"package.json\" \"eslint.config.js\" \"vitest.config.ts\" \"vitest.pack.config.ts\" \"tsconfig.json\" \"tsconfig.build.json\" \".lintstagedrc.json\" \".prettierignore\" \".prettierrc\" \".gitignore\" \"README.md\" \"CHANGELOG.md\" \"docs/**/*.md\" \"knip.json\" \"docs/**/*.md\" \"knip.json\"",
     "prepare": "node -e \"import('./scripts/prepare.mjs').catch((error) => { if (error && typeof error === 'object' && 'code' in error && error.code === 'ERR_MODULE_NOT_FOUND') process.exit(0); throw error; })\"",
     "prepack": "npm run build",
     "release:check": "npm run format:check && npm run whitespace:check && npm run lint:ci && npm run typecheck && npm run deadcode:check && npm run cycles:check && npm run test:coverage && npm run pack:verify && npm run pack:dry-run",
@@ -57,6 +57,7 @@
     "acorn": "^8.14.0",
     "commander": "^15.0.0",
     "estree-walker": "^3.0.3",
+    "jsonc-parser": "^3.3.1",
     "magic-string": "^0.30.17",
     "picocolors": "^1.1.0"
   },