@hominis/fireforge 0.35.0 → 0.37.0

package/dist/src/core/file-lock.js

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
-import { mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { toError } from '../utils/errors.js';
 import { ensureDir } from '../utils/fs.js';
@@ -7,6 +8,15 @@ import { verbose, warn } from '../utils/logger.js';
 const DEFAULT_LOCK_TIMEOUT_MS = 30_000;
 const DEFAULT_LOCK_POLL_MS = 50;
 const DEFAULT_STALE_LOCK_MS = 5 * 60_000;
+/**
+ * Minimum interval between stale-lock probes while a waiter polls. The probe
+ * used to run exactly once per waiter: if the holder died *after* that single
+ * probe, the waiter polled a permanently dead lock until `timeoutMs` — for
+ * the build lock that meant up to 24 hours (see `withBuildLock` in mach.ts).
+ * Re-probing on a small interval bounds that hang to seconds while keeping
+ * the per-poll cost negligible (one stat + one small read every ~5 s).
+ */
+const STALE_REPROBE_INTERVAL_MS = 5_000;
 function sleep(ms) {
     return new Promise((resolve) => {
         setTimeout(resolve, ms);
@@ -39,6 +49,100 @@ function isProcessAlive(pid) {
         return getNodeErrorCode(error) !== 'ESRCH';
     }
 }
+/**
+ * Reads the owner PID (line 1) and acquisition token (line 2) from a lock
+ * directory's PID file. Returns `{ present: false }` when the PID file is
+ * missing or the PID does not parse as a finite integer (caller falls back
+ * to the age-only staleness heuristic).
+ *
+ * File format note: external readers (`doctor-furnace.ts`, older FireForge
+ * releases) do `parseInt(content.trim(), 10)`, which parses the leading
+ * digits of a multi-line file — so adding the token line stays compatible.
+ */
+async function readLockOwner(lockPath) {
+    try {
+        const pidContent = await readFile(join(lockPath, LOCK_PID_FILE), 'utf-8');
+        const [pidLine, tokenLine] = pidContent.split('\n');
+        const pid = parseInt((pidLine ?? '').trim(), 10);
+        if (Number.isFinite(pid)) {
+            const token = tokenLine?.trim();
+            if (token !== undefined && token.length > 0) {
+                return { present: true, pid, token };
+            }
+            return { present: true, pid };
+        }
+    }
+    catch {
+        // PID file missing or unreadable — treat as absent.
+    }
+    return { present: false };
+}
+/**
+ * Reaps a lock directory believed to be stale, safely against concurrent
+ * reapers and a concurrent legitimate re-acquisition.
+ *
+ * The naive stat → read-PID → `rm` sequence had a TOCTOU hole: two waiters
+ * could both observe the dead owner, one would remove the stale dir and
+ * `mkdir` its own lock, and the other's already-decided `rm` then deleted
+ * the *fresh* lock — two processes inside the critical section at once.
+ *
+ * Rename-aside closes it: `rename()` is atomic, so exactly one reaper wins
+ * ownership of the directory (the loser gets ENOENT and simply re-polls),
+ * and nothing ever deletes the live path directly. After winning the rename
+ * we re-read the owner from the renamed dir — if it is now a *live* process
+ * (the lock was released and re-acquired between our staleness read and the
+ * rename), we rename it back instead of reaping.
+ *
+ * @returns true when the caller should immediately retry `mkdir` (the lock
+ *   path is now free or was freed by someone else), false when the lock is
+ *   legitimately held and the caller should keep waiting.
+ */
+async function reapStaleLock(lockPath, ageMs, onStaleLockMessage) {
+    const reapPath = `${lockPath}.reaping-${String(process.pid)}-${randomUUID()}`;
+    try {
+        await rename(lockPath, reapPath);
+    }
+    catch (error) {
+        if (getNodeErrorCode(error) === 'ENOENT') {
+            // Another reaper won, or the owner released — either way, retry mkdir.
+            verbose(`Stale lock disappeared before reaping completed: ${lockPath}`);
+            return true;
+        }
+        verbose(`Could not rename stale lock aside (${lockPath}): ${toError(error).message}`);
+        return false;
+    }
+    // We exclusively own reapPath now. Re-verify: the owner may have changed
+    // between the staleness probe and the rename (release + fresh acquire).
+    const owner = await readLockOwner(reapPath);
+    if (owner.present && isProcessAlive(owner.pid)) {
+        try {
+            await rename(reapPath, lockPath);
+            verbose(`Aborted stale-lock reap of ${lockPath}: owner PID ${String(owner.pid)} is alive (lock was re-acquired mid-probe)`);
+        }
+        catch (restoreError) {
+            // Rename-back can only fail if a third process mkdir'd the lock path
+            // in this instant. The displaced live owner keeps running without its
+            // lock — surface it loudly instead of hiding the lost exclusion.
+            warn(`Could not restore live lock for PID ${String(owner.pid)} at ${lockPath} ` +
+                `(${toError(restoreError).message}). Displaced lock kept at ${reapPath} for inspection.`);
+        }
+        return false;
+    }
+    const staleMessage = onStaleLockMessage?.(ageMs);
+    if (staleMessage) {
+        warn(staleMessage);
+    }
+    else {
+        verbose(`Removing stale lock ${lockPath} (age: ${Math.round(ageMs / 1000)}s)`);
+    }
+    await rm(reapPath, { recursive: true, force: true });
+    return true;
+}
+/**
+ * Probes a contended lock for staleness and reaps it when the owner is gone.
+ *
+ * @returns true when the caller should immediately retry `mkdir`.
+ */
 async function removeIfStaleLock(lockPath, staleMs, onStaleLockMessage) {
     try {
         const lockStat = await stat(lockPath);
@@ -48,27 +152,19 @@ async function removeIfStaleLock(lockPath, staleMs, onStaleLockMessage) {
         // 5 minutes) was never removed even when its PID file pointed at a
         // process that had already exited. That's the exact situation an
         // operator lands in after SIGINT'ing `furnace preview` — the signal
-        // handler calls `process.exit`, `withFileLock`'s `finally { rm }`
-        // never runs, and the next command has to either wait 5 minutes for
-        // the staleness gate or manually remove the lock directory. With the
-        // PID-first check, an explicitly-dead owner unblocks immediately.
-        const pidCheck = await readLockOwnerPid(lockPath);
-        if (pidCheck.present) {
-            if (!isProcessAlive(pidCheck.pid)) {
-                const staleMessage = onStaleLockMessage?.(ageMs);
-                if (staleMessage) {
-                    warn(staleMessage);
-                }
-                else {
-                    verbose(`Lock at ${lockPath} owner PID ${pidCheck.pid} is no longer running — removing (age: ${Math.round(ageMs / 1000)}s)`);
-                }
-                await rm(lockPath, { recursive: true, force: true });
-                return true;
+        // handler calls `process.exit`, `withFileLock`'s release never runs,
+        // and the next command has to either wait 5 minutes for the staleness
+        // gate or manually remove the lock directory. With the PID-first check,
+        // an explicitly-dead owner unblocks immediately.
+        const owner = await readLockOwner(lockPath);
+        if (owner.present) {
+            if (!isProcessAlive(owner.pid)) {
+                return await reapStaleLock(lockPath, ageMs, onStaleLockMessage);
             }
             // PID is alive — respect it regardless of age. A slow `mach build`
             // legitimately holds the lock past the stale threshold and we don't
             // want to race-remove it.
-            verbose(`Lock at ${lockPath} is ${Math.round(ageMs / 1000)}s old but PID ${pidCheck.pid} is still running — not removing`);
+            verbose(`Lock at ${lockPath} is ${Math.round(ageMs / 1000)}s old but PID ${String(owner.pid)} is still running — not removing`);
             return false;
         }
         // No readable PID file. Fall back to the age-only heuristic so locks
@@ -77,12 +173,7 @@ async function removeIfStaleLock(lockPath, staleMs, onStaleLockMessage) {
         if (ageMs <= staleMs) {
             return false;
         }
-        const staleMessage = onStaleLockMessage?.(ageMs);
-        if (staleMessage) {
-            warn(staleMessage);
-        }
-        await rm(lockPath, { recursive: true, force: true });
-        return true;
+        return await reapStaleLock(lockPath, ageMs, onStaleLockMessage);
     }
     catch (error) {
         const code = getNodeErrorCode(error);
@@ -95,30 +186,38 @@ async function removeIfStaleLock(lockPath, staleMs, onStaleLockMessage) {
     }
 }
 /**
- * Reads the owner PID from a lock directory's PID file. Returns `{ present:
- * false }` when the PID file is missing or the content does not parse as a
- * finite integer (caller falls back to the age-only staleness heuristic).
+ * Releases a lock previously acquired by this process, verifying ownership
+ * first. The unconditional `finally { rm }` this replaces would remove
+ * *whichever* lock directory was present — if a stale-lock reaper had (in a
+ * pathological race) replaced our lock, we deleted the new owner's lock and
+ * compounded the double-acquisition. When the PID file no longer names us,
+ * warn and leave the directory alone.
+ *
+ * `ownerFileWritten` is false when our own owner-file write failed at
+ * acquisition (non-fatal there); ownership then cannot be verified and we
+ * fall back to unconditional removal — identical to the historical behavior
+ * and strictly better than leaking the lock.
  */
-async function readLockOwnerPid(lockPath) {
-    try {
-        const pidContent = await readFile(join(lockPath, LOCK_PID_FILE), 'utf-8');
-        const pid = parseInt(pidContent.trim(), 10);
-        if (Number.isFinite(pid)) {
-            return { present: true, pid };
+async function releaseLock(lockPath, ownerToken, ownerFileWritten) {
+    if (ownerFileWritten) {
+        const owner = await readLockOwner(lockPath);
+        if (owner.present &&
+            (owner.pid !== process.pid || (owner.token !== undefined && owner.token !== ownerToken))) {
+            warn(`Not removing lock ${lockPath}: it is now owned by PID ${String(owner.pid)} — ` +
+                'this process no longer holds it.');
+            return;
         }
     }
-    catch {
-        // PID file missing or unreadable — treat as absent.
-    }
-    return { present: false };
+    await rm(lockPath, { recursive: true, force: true });
 }
 /** Runs an async operation while holding a directory lock, with stale-lock recovery. */
 export async function withFileLock(lockPath, operation, options = {}) {
     const timeoutMs = options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
     const pollMs = options.pollMs ?? DEFAULT_LOCK_POLL_MS;
     const staleMs = options.staleMs ?? DEFAULT_STALE_LOCK_MS;
+    const staleReprobeMs = options.staleReprobeMs ?? STALE_REPROBE_INTERVAL_MS;
     const deadline = Date.now() + timeoutMs;
-    let attemptedStaleRecovery = false;
+    let lastStaleProbeAt;
     await ensureDir(dirname(lockPath));
     for (;;) {
         try {
@@ -134,32 +233,42 @@ export async function withFileLock(lockPath, operation, options = {}) {
             if (!isAlreadyLocked) {
                 throw error;
             }
-            if (!attemptedStaleRecovery) {
-                attemptedStaleRecovery = true;
+            if (lastStaleProbeAt === undefined || Date.now() - lastStaleProbeAt >= staleReprobeMs) {
+                lastStaleProbeAt = Date.now();
                 if (await removeIfStaleLock(lockPath, staleMs, options.onStaleLockMessage)) {
                     continue;
                 }
             }
             if (Date.now() >= deadline) {
-                throw new Error(options.onTimeoutMessage ??
-                    `Timed out waiting for file lock ${lockPath}. Remove the lock directory if it is stale.`, { cause: error });
+                const owner = await readLockOwner(lockPath);
+                const holderHint = owner.present && isProcessAlive(owner.pid)
+                    ? ` It is held by running process ${String(owner.pid)} — wait for it to finish, or stop it and retry.`
+                    : ' If no other FireForge process is running, remove the lock directory and retry.';
+                throw new Error(options.onTimeoutMessage ?? `Timed out waiting for file lock ${lockPath}.${holderHint}`, { cause: error });
             }
             await sleep(pollMs);
         }
     }
-    // Write PID into the lock directory so stale-lock recovery can check
-    // whether the owning process is still alive before removing.
+    // Stamp ownership (PID + per-acquisition token) into the lock directory so
+    // stale-lock recovery can check liveness and release can verify the lock
+    // is still ours before removing it.
+    const ownerToken = randomUUID();
+    let ownerFileWritten = false;
     try {
-        await writeFile(join(lockPath, LOCK_PID_FILE), String(process.pid), 'utf-8');
+        const metadata = options.ownerMetadata
+            ?.map((line) => line.replace(/\r?\n/g, ' ').trim())
+            .filter((line) => line.length > 0) ?? [];
+        await writeFile(join(lockPath, LOCK_PID_FILE), `${String(process.pid)}\n${ownerToken}\n${metadata.length > 0 ? `${metadata.join('\n')}\n` : ''}`, 'utf-8');
+        ownerFileWritten = true;
     }
     catch {
-        // Non-fatal: stale recovery falls back to age-only heuristic
+        // Non-fatal: stale recovery falls back to age-only heuristic and release
+        // falls back to unconditional removal.
     }
     try {
         return await operation();
     }
     finally {
-        await rm(lockPath, { recursive: true, force: true });
+        await releaseLock(lockPath, ownerToken, ownerFileWritten);
     }
 }
-//# sourceMappingURL=file-lock.js.map

package/dist/src/core/firefox-archive.d.ts

@@ -12,6 +12,10 @@ export interface ResolvedArchive {
     url: string;
     filename: string;
     metadataFilename: string;
+    /** URL of Mozilla's published SHA256SUMS file for the release. */
+    checksumsUrl: string;
+    /** The archive's path as listed inside SHA256SUMS (relative to the release dir). */
+    pathInChecksums: string;
 }
 /**
  * Sidecar metadata stored alongside a cached archive.

package/dist/src/core/firefox-archive.js

@@ -62,6 +62,11 @@ export function resolveArchive(version, product = 'firefox') {
         url: `${getArchiveBaseUrl(product)}/${archiveVersion}/source/firefox-${archiveVersion}.source.tar.xz`,
         filename: `firefox-${safeProduct}-${archiveVersion}.source.tar.xz`,
         metadataFilename: `firefox-${safeProduct}-${archiveVersion}.source.tar.xz.json`,
+        // Mozilla publishes one SHA256SUMS per release directory listing every
+        // artifact by its release-relative path. Downloads verify against it by
+        // default (fail closed on mismatch), so a compromised CDN response
+        // cannot silently become the trusted git baseline.
+        checksumsUrl: `${getArchiveBaseUrl(product)}/${archiveVersion}/SHA256SUMS`,
+        pathInChecksums: `source/firefox-${archiveVersion}.source.tar.xz`,
     };
 }
-//# sourceMappingURL=firefox-archive.js.map

package/dist/src/core/firefox-cache.js

@@ -10,7 +10,7 @@ import { pipeline } from 'node:stream/promises';
 import { ChecksumMismatchError } from '../errors/download.js';
 import { toError } from '../utils/errors.js';
 import { pathExistsStrict, readJson, removeFile, writeJson } from '../utils/fs.js';
-import { verbose } from '../utils/logger.js';
+import { verbose, warn } from '../utils/logger.js';
 import { createSiblingLockPath, withFileLock } from './file-lock.js';
 import { validateArchiveMetadata } from './firefox-archive.js';
 import { downloadFile } from './firefox-download.js';
@@ -24,6 +24,39 @@ async function sha256File(filePath) {
     await pipeline(stream, hash);
     return hash.digest('hex');
 }
+/**
+ * Fetches Mozilla's published SHA256SUMS for the release and extracts the
+ * digest for this archive. Returns null when the checksum file cannot be
+ * fetched or does not list the archive — the caller warns loudly and
+ * continues (offline mirrors and staging hosts legitimately lack it), while
+ * a FETCHED-but-mismatching digest always fails closed.
+ *
+ * Line format (both variants appear in the wild):
+ *   `<64-hex-digest>  <release-relative-path>`
+ *   `<64-hex-digest> *<release-relative-path>`
+ */
+async function fetchPublishedSha256(archive) {
+    try {
+        const response = await fetch(archive.checksumsUrl);
+        if (!response.ok) {
+            verbose(`SHA256SUMS fetch returned HTTP ${String(response.status)} for ${archive.checksumsUrl}`);
+            return null;
+        }
+        const body = await response.text();
+        for (const line of body.split('\n')) {
+            const match = /^([0-9a-f]{64})\s+\*?(.+)$/.exec(line.trim());
+            if (match?.[1] && match[2] === archive.pathInChecksums) {
+                return match[1];
+            }
+        }
+        verbose(`SHA256SUMS at ${archive.checksumsUrl} does not list ${archive.pathInChecksums}`);
+        return null;
+    }
+    catch (error) {
+        verbose(`SHA256SUMS fetch failed for ${archive.checksumsUrl}: ${toError(error).message}`);
+        return null;
+    }
+}
 /**
  * Ensures a valid cached archive exists, downloading it if needed.
  * @param archive - Resolved archive descriptor
@@ -117,8 +150,32 @@ async function downloadToCache(archive, cacheDir, onProgress, expectedSha256, on
         promotedTarball = true;
         onCacheProgress?.(`Calculating source archive SHA-256 for ${archive.filename}...`);
         const sha256 = await sha256File(tarballPath);
-        if (expectedSha256 && sha256 !== expectedSha256) {
-            throw new ChecksumMismatchError(archive.product, expectedSha256, sha256, archive.url);
+        if (expectedSha256) {
+            // Operator-pinned digest (firefox.sha256 config): takes precedence
+            // and always fails closed.
+            if (sha256 !== expectedSha256) {
+                throw new ChecksumMismatchError(archive.product, expectedSha256, sha256, archive.url);
+            }
+        }
+        else {
+            // Default integrity check: verify against Mozilla's published
+            // SHA256SUMS. TLS alone is thin trust for the artifact that becomes
+            // the git baseline every patch is built on — a compromised CDN
+            // response would otherwise be trusted with no signal. Mismatch fails
+            // closed (the catch below deletes the artifact); an unfetchable
+            // SHA256SUMS degrades to a loud warning so offline/mirror workflows
+            // keep working (pin firefox.sha256 in fireforge.json to fail closed
+            // even then).
+            onCacheProgress?.(`Verifying archive against published SHA256SUMS...`);
+            const publishedSha256 = await fetchPublishedSha256(archive);
+            if (publishedSha256 === null) {
+                warn(`Could not verify ${archive.filename} against Mozilla's published SHA256SUMS ` +
+                    `(${archive.checksumsUrl} unavailable). The download is trusted on TLS alone — ` +
+                    'set firefox.sha256 in fireforge.json to require checksum verification.');
+            }
+            else if (sha256 !== publishedSha256) {
+                throw new ChecksumMismatchError(archive.product, publishedSha256, sha256, archive.url);
+            }
         }
         onCacheProgress?.(`Writing source archive cache metadata for ${archive.metadataFilename}...`);
         await writeJson(metadataPath, {
@@ -167,4 +224,3 @@ async function removeArchivePartFiles(archive, cacheDir) {
         // Cache dir may not exist yet — that's fine.
     }
 }
-//# sourceMappingURL=firefox-cache.js.map

package/dist/src/core/firefox-download.js

@@ -134,4 +134,3 @@ export async function downloadFile(url, destPath, onProgress) {
     }
     return totalSize > 0 ? totalSize : undefined;
 }
-//# sourceMappingURL=firefox-download.js.map

package/dist/src/core/firefox-extract.js

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 import { ExtractionError } from '../errors/download.js';
 import { elapsedSince } from '../utils/elapsed.js';
 import { ensureDir, pathExists } from '../utils/fs.js';
-import { exec, executableExists } from '../utils/process.js';
+import { exec, execStream, executableExists } from '../utils/process.js';
 /**
  * Returns true when an archive member path could land outside the
  * extraction root: absolute (POSIX or Windows drive/backslash rooted) or
@@ -88,26 +88,86 @@ export function findUnsafeArchiveLink(verboseLines) {
  * (~38%) to this one-time extraction step, versus ~44 s if run
  * sequentially.
  */
-async function preflightArchiveEntries(archivePath) {
+/**
+ * Incremental line splitter for streamed listings. Keeps only the current
+ * partial line in memory, so a 350k-entry Firefox listing costs O(longest
+ * line), not O(listing).
+ */
+function createLineScanner(onLine) {
+    let buffer = '';
+    return {
+        push(chunk) {
+            buffer += chunk;
+            let idx;
+            while ((idx = buffer.indexOf('\n')) !== -1) {
+                onLine(buffer.slice(0, idx));
+                buffer = buffer.slice(idx + 1);
+            }
+        },
+        flush() {
+            if (buffer.length > 0) {
+                onLine(buffer);
+                buffer = '';
+            }
+        },
+    };
+}
+/**
+ * Runs one tar listing pass, streaming lines through `checkLine` and
+ * returning the first unsafe finding (or null) plus the exit code.
+ *
+ * Streaming matters for safety, not just memory: the buffered `exec`
+ * collector silently truncates at 50 MB, and a full Firefox `-tvf` listing
+ * already sits in the 40–50 MB range — so the buffered implementation could
+ * scan only the head of the listing while reporting the archive safe. A
+ * crafted archive could exploit exactly that by padding benign entries
+ * first and hiding a traversal name or absolute link target past the cap.
+ * With per-line streaming EVERY entry is scanned, with bounded memory.
+ */
+async function runListingScan(archivePath, tarFlag, checkLine) {
     // LC_ALL=C keeps the -tvf column format stable for the link parse.
     const listEnv = { LC_ALL: 'C', LANG: 'C' };
-    const [nameListing, verboseListing] = await Promise.all([
-        exec('tar', ['-tf', archivePath], { env: listEnv }),
-        exec('tar', ['-tvf', archivePath], { env: listEnv }),
+    let unsafe = null;
+    let stderrTail = '';
+    const scanner = createLineScanner((line) => {
+        if (unsafe === null) {
+            unsafe = checkLine(line);
+        }
+    });
+    const exitCode = await execStream('tar', [tarFlag, archivePath], {
+        env: listEnv,
+        onStdout: (chunk) => {
+            scanner.push(chunk);
+        },
+        onStderr: (chunk) => {
+            // Keep a small diagnostic tail; the listing itself is the big stream.
+            stderrTail = (stderrTail + chunk).slice(-4096);
+        },
+    });
+    scanner.flush();
+    return { unsafe, exitCode, stderrTail };
+}
+async function preflightArchiveEntries(archivePath) {
+    const [nameScan, linkScan] = await Promise.all([
+        runListingScan(archivePath, '-tf', (line) => {
+            const name = line.trim();
+            if (name.length === 0)
+                return null;
+            return isUnsafeArchivePath(name) ? name : null;
+        }),
+        runListingScan(archivePath, '-tvf', (line) => findUnsafeArchiveLink([line])),
     ]);
-    if (nameListing.exitCode !== 0) {
-        throw new ExtractionError(archivePath, new Error(`tar -tf preflight exited with code ${nameListing.exitCode}:\n${nameListing.stderr}`));
+    if (nameScan.exitCode !== 0) {
+        throw new ExtractionError(archivePath, new Error(`tar -tf preflight exited with code ${nameScan.exitCode}:\n${nameScan.stderrTail}`));
     }
-    const unsafeName = findUnsafeArchiveEntryName(nameListing.stdout.split('\n'));
-    if (unsafeName !== null) {
-        throw new ExtractionError(archivePath, new Error(`Archive rejected: member name could escape the extraction root: ${unsafeName}`));
+    if (nameScan.unsafe !== null) {
+        throw new ExtractionError(archivePath, new Error(`Archive rejected: member name could escape the extraction root: ${nameScan.unsafe}`));
     }
-    if (verboseListing.exitCode !== 0) {
-        throw new ExtractionError(archivePath, new Error(`tar -tvf preflight exited with code ${verboseListing.exitCode}:\n${verboseListing.stderr}`));
+    if (linkScan.exitCode !== 0) {
+        throw new ExtractionError(archivePath, new Error(`tar -tvf preflight exited with code ${linkScan.exitCode}:\n${linkScan.stderrTail}`));
     }
-    const unsafeLink = findUnsafeArchiveLink(verboseListing.stdout.split('\n'));
-    if (unsafeLink !== null) {
-        throw new ExtractionError(archivePath, new Error(`Archive rejected: link could escape the extraction root (${unsafeLink})`));
+    if (linkScan.unsafe !== null) {
+        throw new ExtractionError(archivePath, new Error(`Archive rejected: link could escape the extraction root (${linkScan.unsafe})`));
     }
 }
 /**
@@ -172,4 +232,3 @@ export function formatBytes(bytes) {
     }
     return `${size.toFixed(1)} ${units[unitIndex]}`;
 }
-//# sourceMappingURL=firefox-extract.js.map

package/dist/src/core/firefox-ignorefile.js

@@ -28,4 +28,3 @@ export async function ensureFirefoxIgnorefileCompatibility(engineDir) {
     await writeText(hgignorePath, await readText(gitignorePath));
     return 'created';
 }
-//# sourceMappingURL=firefox-ignorefile.js.map

package/dist/src/core/firefox.d.ts

@@ -35,6 +35,18 @@ export type FirefoxSourcePhase = 'download' | 'extract';
 /** Callback fired at phase transitions during {@link downloadFirefoxSource}. */
 export type FirefoxSourcePhaseCallback = (phase: FirefoxSourcePhase) => void;
 export type FirefoxSourceProgressCallback = (message: string) => void;
+/**
+ * Sweeps orphaned working directories left behind by interrupted downloads
+ * (`<engine>.tmp-*` from extraction, `<engine>.replacement-*` from --force
+ * replacement). Both hold multi-GB partial trees, are worthless after the
+ * owning process died, and nothing else ever reclaimed them. Deliberately
+ * does NOT touch `<engine>.backup-*`: a backup may hold the operator's
+ * previous engine after a failed forced replacement and is their recovery
+ * copy — callers should surface its existence instead.
+ *
+ * @returns names of the directories that were removed
+ */
+export declare function sweepOrphanedEngineWorkDirs(destDir: string): Promise<string[]>;
 /**
  * Downloads and extracts Firefox source.
  * @param version - Firefox version to download

package/dist/src/core/firefox.js

@@ -33,6 +33,63 @@ export function getDownloadUrl(version, product = 'firefox') {
 export function getTarballFilename(version, product = 'firefox') {
     return resolveArchive(version, product).filename;
 }
+/**
+ * Classifies an extraction failure as archive corruption (invalidate the
+ * cache and re-download) versus an environmental problem (keep the cached
+ * archive; the retry can reuse it). Environmental signatures are the
+ * conservative list — anything unrecognized is treated as corruption so a
+ * genuinely bad archive can never survive in the cache.
+ */
+function isLikelyArchiveCorruptionError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const code = error instanceof Error ? error.code : undefined;
+    if (code === 'ENOSPC' || code === 'EACCES' || code === 'EPERM' || code === 'EDQUOT') {
+        return false;
+    }
+    if (/No space left on device|Permission denied|Disk quota exceeded/i.test(message)) {
+        return false;
+    }
+    // Missing tar binary / preflight refusing an unsafe archive both carry
+    // ExtractionError text that names the condition; a missing tar is
+    // environmental, an unsafe-entry rejection indicts the archive.
+    if (/"tar" command was not found/i.test(message)) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Sweeps orphaned working directories left behind by interrupted downloads
+ * (`<engine>.tmp-*` from extraction, `<engine>.replacement-*` from --force
+ * replacement). Both hold multi-GB partial trees, are worthless after the
+ * owning process died, and nothing else ever reclaimed them. Deliberately
+ * does NOT touch `<engine>.backup-*`: a backup may hold the operator's
+ * previous engine after a failed forced replacement and is their recovery
+ * copy — callers should surface its existence instead.
+ *
+ * @returns names of the directories that were removed
+ */
+export async function sweepOrphanedEngineWorkDirs(destDir) {
+    const { readdir } = await import('node:fs/promises');
+    const { basename, dirname } = await import('node:path');
+    const parent = dirname(destDir);
+    const enginePrefixTmp = `${basename(destDir)}.tmp-`;
+    const enginePrefixReplacement = `${basename(destDir)}.replacement-`;
+    let entries;
+    try {
+        entries = await readdir(parent);
+    }
+    catch {
+        return [];
+    }
+    const removed = [];
+    for (const name of entries) {
+        if (name.startsWith(enginePrefixTmp) || name.startsWith(enginePrefixReplacement)) {
+            await removeDir(join(parent, name));
+            removed.push(name);
+        }
+    }
+    return removed;
+}
 /**
  * Downloads and extracts Firefox source.
  * @param version - Firefox version to download
@@ -60,7 +117,13 @@ export async function downloadFirefoxSource(version, product, destDir, cacheDir,
     }
     catch (error) {
         await removeDir(tempDir);
-        await invalidateArchiveCache(archive, cacheDir);
+        // Only throw away the ~600 MB cached archive when the failure indicts
+        // the ARCHIVE, not the environment. ENOSPC, a permission problem in
+        // destDir, or tar disappearing mid-run used to invalidate a perfectly
+        // good download and force a full re-fetch on retry.
+        if (isLikelyArchiveCorruptionError(error)) {
+            await invalidateArchiveCache(archive, cacheDir);
+        }
         throw error;
     }
     // Firefox source extracts to a subdirectory (e.g., firefox-140.0/)
@@ -80,4 +143,3 @@ export async function downloadFirefoxSource(version, product, destDir, cacheDir,
         await rename(tempDir, destDir);
     }
 }
-//# sourceMappingURL=firefox.js.map

package/dist/src/core/furnace-apply-dry-run.js

@@ -102,4 +102,3 @@ export async function buildCustomDryRunActions(name, componentDir, engineDir, co
     }
     return { actions, stepErrors };
 }
-//# sourceMappingURL=furnace-apply-dry-run.js.map

package/dist/src/core/furnace-apply-ftl.d.ts

@@ -4,9 +4,13 @@
  * per-file LOC budget.
  *
  * Every helper here degrades gracefully: if the locale jar.mn is missing or
- * the FTL tree is non-standard, apply logs a `stepError` rather than
- * aborting the whole command. Missing jar.mn on a fork without a locale
- * package should not block a working `.mjs`/`.css` from shipping.
+ * the FTL tree is non-standard, apply logs an ADVISORY `stepError`
+ * (`advisory: true`) rather than aborting the whole command. Advisory step
+ * errors are reported as warnings and never trigger rollback — missing
+ * jar.mn on a fork without a locale package should not block a working
+ * `.mjs`/`.css` from shipping (the blocking/advisory split exists because
+ * this contract used to be contradicted: any FTL step error rolled back
+ * the whole apply).
  */
 import type { CustomComponentConfig, DryRunAction, StepError } from '../types/furnace.js';
 import { type RollbackJournal } from './furnace-rollback.js';