@hominis/fireforge 0.37.0 → 0.38.0

package/dist/src/core/firefox.d.ts

@@ -13,16 +13,18 @@ export { formatBytes, getFirefoxVersion } from './firefox-extract.js';
  * Gets the download URL for a Firefox source tarball.
  * @param version - Firefox version (e.g., "140.9.0esr")
  * @param product - Firefox product type
+ * @param candidate - Optional release-candidate build directory (e.g. "build2")
  * @returns Full URL to the source tarball
  */
-export declare function getDownloadUrl(version: string, product?: FirefoxProduct): string;
+export declare function getDownloadUrl(version: string, product?: FirefoxProduct, candidate?: string): string;
 /**
  * Gets the filename for a Firefox source tarball.
  * @param version - Firefox version
  * @param product - Firefox product type
+ * @param candidate - Optional release-candidate build directory (e.g. "build2")
  * @returns Tarball filename
  */
-export declare function getTarballFilename(version: string, product?: FirefoxProduct): string;
+export declare function getTarballFilename(version: string, product?: FirefoxProduct, candidate?: string): string;
 /**
  * Lifecycle phase reported by {@link downloadFirefoxSource}. The download
  * CLI command uses this to swap spinners between the bytes-on-the-wire
@@ -57,5 +59,8 @@ export declare function sweepOrphanedEngineWorkDirs(destDir: string): Promise<st
  * @param onPhase - Optional callback fired when the function transitions
  *   between phases (`'download'` → `'extract'`). Fires exactly once per
  *   phase even if the cached archive path skips the wire entirely.
+ * @param candidate - Optional release-candidate build directory (e.g.
+ *   "build2") resolving the archive under `candidates/` instead of
+ *   `releases/`.
  */
-export declare function downloadFirefoxSource(version: string, product: FirefoxProduct, destDir: string, cacheDir: string, onProgress?: ProgressCallback, onPhase?: FirefoxSourcePhaseCallback, expectedSha256?: string, onPhaseProgress?: FirefoxSourceProgressCallback): Promise<void>;
+export declare function downloadFirefoxSource(version: string, product: FirefoxProduct, destDir: string, cacheDir: string, onProgress?: ProgressCallback, onPhase?: FirefoxSourcePhaseCallback, expectedSha256?: string, onPhaseProgress?: FirefoxSourceProgressCallback, candidate?: string): Promise<void>;

package/dist/src/core/firefox.js

@@ -19,19 +19,21 @@ export { formatBytes, getFirefoxVersion } from './firefox-extract.js';
  * Gets the download URL for a Firefox source tarball.
  * @param version - Firefox version (e.g., "140.9.0esr")
  * @param product - Firefox product type
+ * @param candidate - Optional release-candidate build directory (e.g. "build2")
  * @returns Full URL to the source tarball
  */
-export function getDownloadUrl(version, product = 'firefox') {
-    return resolveArchive(version, product).url;
+export function getDownloadUrl(version, product = 'firefox', candidate) {
+    return resolveArchive(version, product, candidate).url;
 }
 /**
  * Gets the filename for a Firefox source tarball.
  * @param version - Firefox version
  * @param product - Firefox product type
+ * @param candidate - Optional release-candidate build directory (e.g. "build2")
  * @returns Tarball filename
  */
-export function getTarballFilename(version, product = 'firefox') {
-    return resolveArchive(version, product).filename;
+export function getTarballFilename(version, product = 'firefox', candidate) {
+    return resolveArchive(version, product, candidate).filename;
 }
 /**
  * Classifies an extraction failure as archive corruption (invalidate the
@@ -100,9 +102,12 @@ export async function sweepOrphanedEngineWorkDirs(destDir) {
  * @param onPhase - Optional callback fired when the function transitions
  *   between phases (`'download'` → `'extract'`). Fires exactly once per
  *   phase even if the cached archive path skips the wire entirely.
+ * @param candidate - Optional release-candidate build directory (e.g.
+ *   "build2") resolving the archive under `candidates/` instead of
+ *   `releases/`.
  */
-export async function downloadFirefoxSource(version, product, destDir, cacheDir, onProgress, onPhase, expectedSha256, onPhaseProgress) {
-    const archive = resolveArchive(version, product);
+export async function downloadFirefoxSource(version, product, destDir, cacheDir, onProgress, onPhase, expectedSha256, onPhaseProgress, candidate) {
+    const archive = resolveArchive(version, product, candidate);
     const tarballPath = join(cacheDir, archive.filename);
     // Ensure cache directory exists
     await ensureDir(cacheDir);

package/dist/src/core/furnace-validate-helpers.js

@@ -27,10 +27,33 @@ export function hasPositiveTabindex(content) {
         return value !== undefined && parseInt(value, 10) > 0;
     });
 }
+/**
+ * Collects `[start, end)` spans of `<label>…</label>` elements whose content
+ * includes actual label text. Labels cannot nest per HTML, so the non-greedy
+ * inner match is sound. A span qualifies only when the inner content minus
+ * tags still contains non-whitespace — an empty or tag-only wrapper provides
+ * no accessible name. A `${…}` Lit binding counts as label text: dynamic
+ * (usually localized) text is a legitimate accessible name.
+ */
+function collectLabelledSpans(content) {
+    const spans = [];
+    const labelPattern = /<label\b[^>]*>([\s\S]*?)<\/label>/gi;
+    let labelMatch;
+    while ((labelMatch = labelPattern.exec(content)) !== null) {
+        const inner = labelMatch[1] ?? '';
+        if (/\S/.test(inner.replace(/<[^>]*>/g, ' '))) {
+            spans.push({ start: labelMatch.index, end: labelMatch.index + labelMatch[0].length });
+        }
+    }
+    return spans;
+}
 /** Detects form inputs without associated labels. */
 export function hasUnlabelledFormInput(content) {
     // Look for <input> or <select> or <textarea> without aria-label, aria-labelledby, or id
-    // (id implies an external <label for="..."> could exist)
+    // (id implies an external <label for="..."> could exist). A control wrapped
+    // in a <label> that carries actual text is implicitly associated and is
+    // exempt as well.
+    const labelledSpans = collectLabelledSpans(content);
     const inputPattern = /<(input|select|textarea)\b([^>]*)>/gi;
     let inputMatch;
     while ((inputMatch = inputPattern.exec(content)) !== null) {
@@ -41,6 +64,10 @@ export function hasUnlabelledFormInput(content) {
             /type\s*=\s*["']hidden["']/i.test(attrs)) {
             continue;
         }
+        const index = inputMatch.index;
+        if (labelledSpans.some((span) => index >= span.start && index < span.end)) {
+            continue;
+        }
         return true;
     }
     return false;

package/dist/src/core/license-headers.d.ts

@@ -34,6 +34,11 @@ export declare function getLicenseHeader(license: ProjectLicense, style: Comment
  * on lines 1–2 with the MPL header on lines 3+, which the raw
  * `startsWith` check would otherwise miss.
  *
+ * The MPL-2.0 header is additionally matched on normalized whitespace
+ * (see {@link normalizeCommentHead}) so upstream files using the older
+ * Mozilla wrap — breaking after "file," instead of "with this" — are
+ * accepted too; only the wrap position differs, never the wording.
+ *
  * @param content - File content to check
  * @param style   - Comment syntax of the file
  */
@@ -51,6 +56,13 @@ export declare function hasAnyLicenseHeader(content: string, style: CommentStyle
  * patch-lint, making it dead code for every other project license and
  * forcing repo-side audit workarounds.
  *
+ * Matching is wrap-agnostic: after the exact `startsWith` fast path, the
+ * leading block comment is compared on normalized whitespace (see
+ * {@link normalizeCommentHead}) so the older upstream wrap — breaking
+ * after "file," instead of "with this", as `ext-browser.js` ships —
+ * passes too. Only the line-break position may differ; altered wording
+ * still rejects.
+ *
  * @param content - File content to check
  */
 export declare function hasUpstreamMplBlockHeader(content: string): boolean;

package/dist/src/core/license-headers.js

@@ -86,6 +86,59 @@ function stripLeadingEditorDirectives(content) {
     } while (result !== prev);
     return result;
 }
+/**
+ * Collapses all whitespace runs to single spaces and trims, so header
+ * comparisons ignore the exact line-break/wrap positions.
+ */
+function normalizeText(text) {
+    return text.replace(/\s+/g, ' ').trim();
+}
+/**
+ * The canonical upstream MPL-2.0 notice as a single normalized sentence
+ * (including the `http://mozilla.org/MPL/2.0/.` URL). Wrap-agnostic
+ * header checks match against this instead of an exact rendering.
+ */
+const MPL_HEADER_NORMALIZED = normalizeText(HEADER_LINES['MPL-2.0'].join(' '));
+/**
+ * Extracts ONLY the leading comment span of `content` for the given
+ * comment style and returns it whitespace-normalized:
+ *
+ * - `js`:   a leading run of `//` lines (markers stripped), or — when the
+ *           file opens with a block comment instead — the first
+ *           `/* … *\/` block;
+ * - `css`:  the first `/* … *\/` block, with the ` * ` continuation-line
+ *           prefixes stripped (same collapsing
+ *           {@link normalizeLicenseHeadForScan} does);
+ * - `hash`: a leading run of `#` lines (markers stripped).
+ *
+ * A non-comment first line yields `''`. This lets callers accept a known
+ * header text regardless of where upstream wrapped its lines (e.g. the
+ * older Mozilla wrap that breaks after "file,"), without ever matching
+ * text beyond the leading comment.
+ */
+function normalizeCommentHead(content, style) {
+    const src = content.replace(/\r\n?/g, '\n');
+    const collectLineRun = (marker) => {
+        const parts = [];
+        for (const line of src.split('\n')) {
+            const m = marker.exec(line);
+            if (!m)
+                break;
+            parts.push(m[1] ?? '');
+        }
+        return normalizeText(parts.join(' '));
+    };
+    if (style === 'hash') {
+        return collectLineRun(/^[ \t]*#[ \t]?(.*)$/);
+    }
+    if (style === 'js' && /^[ \t]*\/\//.test(src)) {
+        return collectLineRun(/^[ \t]*\/\/[ \t]?(.*)$/);
+    }
+    const block = /^[ \t]*\/\*([\s\S]*?)\*\//.exec(src);
+    if (!block)
+        return '';
+    return normalizeText((block[1] ?? '').replace(/\n[ \t]*\*[ \t]*/g, ' '));
+}
 /**
  * Returns true if `content` starts with any known license header for the
  * given comment style.
@@ -103,6 +156,11 @@ function stripLeadingEditorDirectives(content) {
  * on lines 1–2 with the MPL header on lines 3+, which the raw
  * `startsWith` check would otherwise miss.
  *
+ * The MPL-2.0 header is additionally matched on normalized whitespace
+ * (see {@link normalizeCommentHead}) so upstream files using the older
+ * Mozilla wrap — breaking after "file," instead of "with this" — are
+ * accepted too; only the wrap position differs, never the wording.
+ *
  * @param content - File content to check
  * @param style   - Comment syntax of the file
  */
@@ -116,6 +174,9 @@ export function hasAnyLicenseHeader(content, style) {
         if (style === 'js' && candidate.startsWith(getLicenseHeader('MPL-2.0', 'css'))) {
             return true;
         }
+        if (normalizeCommentHead(candidate, style).startsWith(MPL_HEADER_NORMALIZED)) {
+            return true;
+        }
     }
     return false;
 }
@@ -132,11 +193,25 @@ export function hasAnyLicenseHeader(content, style) {
  * patch-lint, making it dead code for every other project license and
  * forcing repo-side audit workarounds.
  *
+ * Matching is wrap-agnostic: after the exact `startsWith` fast path, the
+ * leading block comment is compared on normalized whitespace (see
+ * {@link normalizeCommentHead}) so the older upstream wrap — breaking
+ * after "file," instead of "with this", as `ext-browser.js` ships —
+ * passes too. Only the line-break position may differ; altered wording
+ * still rejects.
+ *
  * @param content - File content to check
  */
 export function hasUpstreamMplBlockHeader(content) {
     const blockHeader = getLicenseHeader('MPL-2.0', 'css');
-    return (content.startsWith(blockHeader) || stripLeadingEditorDirectives(content).startsWith(blockHeader));
+    const candidates = [content, stripLeadingEditorDirectives(content)];
+    for (const candidate of candidates) {
+        if (candidate.startsWith(blockHeader))
+            return true;
+        if (normalizeCommentHead(candidate, 'css').startsWith(MPL_HEADER_NORMALIZED))
+            return true;
+    }
+    return false;
 }
 /**
  * Returns true if `content` starts with any known license header in any

package/dist/src/core/patch-lint.d.ts

@@ -8,6 +8,9 @@ export { lintPatchedCss };
  * Counts the total lines in a unified diff and the number of non-binary
  * text lines, so binary hunks do not inflate patch size checks.
  *
+ * Line counting agrees with `wc -l`: a trailing newline does not add a
+ * phantom empty line to either `total` or the binary-hunk accounting.
+ *
  * @param diffContent - Raw unified diff string
  * @returns Object with `total` line count and `textLines` (total minus binary hunk lines)
  */

package/dist/src/core/patch-lint.js

@@ -35,15 +35,33 @@ const FILE_SIZE_THRESHOLDS = {
     general: { notice: 500, warning: 750, error: 900 },
     test: { notice: 1200, warning: 1400, error: 1600 },
 };
+/**
+ * Counts the lines of `content` the way `wc -l` reports them: a trailing
+ * newline terminates the last line rather than starting an empty extra
+ * one. A naive `split('\n').length` over-counts by one for any content
+ * ending in `\n` (the common case), which made the size rules fire one
+ * line early against the operator's own `wc -l` measurement.
+ */
+function countContentLines(content) {
+    const lines = content.split('\n');
+    if (lines[lines.length - 1] === '')
+        lines.pop();
+    return lines.length;
+}
 /**
  * Counts the total lines in a unified diff and the number of non-binary
  * text lines, so binary hunks do not inflate patch size checks.
  *
+ * Line counting agrees with `wc -l`: a trailing newline does not add a
+ * phantom empty line to either `total` or the binary-hunk accounting.
+ *
  * @param diffContent - Raw unified diff string
  * @returns Object with `total` line count and `textLines` (total minus binary hunk lines)
  */
 export function countNonBinaryDiffLines(diffContent) {
     const lines = diffContent.split('\n');
+    if (lines[lines.length - 1] === '')
+        lines.pop();
     const total = lines.length;
     let binaryLines = 0;
     let inBinaryHunk = false;
@@ -329,12 +347,12 @@ export async function lintPatchedJs(repoDir, affectedFiles, newFiles, config, pa
         }
         // 2. File size check (new files only)
         if (isNew) {
-            const lineCount = content.split('\n').length;
+            const lineCount = countContentLines(content);
             const isTest = isTestFile(file);
             const thresholds = isTest ? FILE_SIZE_THRESHOLDS.test : FILE_SIZE_THRESHOLDS.general;
             const label = isTest ? 'Test file' : 'New file';
             const verb = isTest ? 'splitting' : 'decomposing';
-            if (lineCount >= thresholds.error) {
+            if (lineCount > thresholds.error) {
                 issues.push({
                     file,
                     check: 'file-too-large',
@@ -342,7 +360,7 @@ export async function lintPatchedJs(repoDir, affectedFiles, newFiles, config, pa
                     severity: 'error',
                 });
             }
-            else if (lineCount >= thresholds.warning) {
+            else if (lineCount > thresholds.warning) {
                 issues.push({
                     file,
                     check: 'file-too-large',
@@ -350,7 +368,7 @@ export async function lintPatchedJs(repoDir, affectedFiles, newFiles, config, pa
                     severity: 'warning',
                 });
             }
-            else if (lineCount >= thresholds.notice) {
+            else if (lineCount > thresholds.notice) {
                 issues.push({
                     file,
                     check: 'file-too-large',
@@ -507,7 +525,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
             severity: 'warning',
         });
     }
-    if (lineCount >= lineThresholds.error) {
+    if (lineCount > lineThresholds.error) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
@@ -515,7 +533,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
             severity: 'error',
         });
     }
-    else if (lineCount >= lineThresholds.warning) {
+    else if (lineCount > lineThresholds.warning) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
@@ -523,7 +541,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
             severity: 'warning',
         });
     }
-    else if (lineCount >= lineThresholds.notice) {
+    else if (lineCount > lineThresholds.notice) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',

package/dist/src/core/status-classify.d.ts

@@ -11,12 +11,21 @@
  *   normal after `fireforge import`.
  * - `patch-owned-drift`: the file is claimed by exactly one patch, but
  *   the live engine content no longer matches that patch's expected
- *   post-apply content.
+ *   post-apply content. This includes furnace-prefixed paths: a path
+ *   can be both Furnace-managed and patch-claimed (export a deployed
+ *   component, then edit the workspace source and `furnace deploy`
+ *   again — the deployed copy now has content the patch body lacks).
+ *   Before 0.38.0 the furnace prefix check ran first and silently
+ *   bucketed such files as `furnace`, so `status` reported the stale
+ *   patch as owned.
  * - `unmanaged`: edits not explained by any patch or tool — local
  *   drift to export or discard.
  * - `branding`: files under tool-managed branding paths, written by
  *   FireForge's branding pipeline.
- * - `furnace`: files under Furnace-managed component prefixes.
+ * - `furnace`: files under Furnace-managed component prefixes. When
+ *   exactly one patch also claims the path, this bucket asserts the
+ *   live content matches that patch's expected post-apply content —
+ *   a mismatch is reported as `patch-owned-drift` instead (see above).
  * - `conflict`: the file is claimed by two or more patches in
  *   `patches.json`. The human `--ownership` mode already surfaces
  *   this bucket as `CONFLICT`; the classification is carried through

package/dist/src/core/status-classify.js

@@ -55,6 +55,40 @@ function isGeneratedBrandingPath(file, binaryName) {
         normalized === `${brandingRoot}/locales/en-US/brand.properties` ||
         normalized === `${brandingRoot}/locales/en-US/brand.ftl`);
 }
+/**
+ * Compares a single-owner file's live engine content against its owning
+ * patch's expected post-apply content. `matchClassification` is what a
+ * clean match reports — `patch-backed` for ordinary patch-claimed paths,
+ * `furnace` for furnace-prefixed paths so healthy deployed components
+ * keep landing in the pinned furnace bucket. Any mismatch (including a
+ * deletion the patch does not expect, or a failed comparison) reports
+ * `patch-owned-drift`.
+ */
+async function classifySingleOwnerFile(entry, engineDir, patchesDir, matchClassification) {
+    if (getPrimaryStatusCode(entry.status) === 'D') {
+        // Deleted file: content matches only if the patch expects deletion
+        const expected = await computePatchedContent(patchesDir, engineDir, entry.file);
+        return {
+            ...entry,
+            classification: expected === null ? matchClassification : 'patch-owned-drift',
+        };
+    }
+    // File exists on disk — compare actual vs expected
+    try {
+        const [expected, actual] = await Promise.all([
+            computePatchedContent(patchesDir, engineDir, entry.file),
+            readText(join(engineDir, entry.file)),
+        ]);
+        return {
+            ...entry,
+            classification: actual === expected ? matchClassification : 'patch-owned-drift',
+        };
+    }
+    catch (error) {
+        verbose(`Treating ${entry.file} as patch-owned drift because patch-backed classification failed: ${toError(error).message}`);
+        return { ...entry, classification: 'patch-owned-drift' };
+    }
+}
 /**
  * Classifies files into patch-backed, unmanaged, branding, furnace, or
  * conflict buckets.
@@ -104,7 +138,20 @@ export async function classifyFiles(files, engineDir, patchesDir, binaryName, fu
                 }
             }
             if (isFurnace) {
-                results.push({ ...entry, classification: 'furnace' });
+                // A furnace path claimed by exactly one patch gets the same
+                // expected-vs-actual comparison as any other single-owner path:
+                // after a `furnace deploy` of an edited component the deployed
+                // copy has content the owning patch's body lacks, and the old
+                // unconditional short-circuit silently bucketed that drift as
+                // `furnace`. Multi-owner and unowned furnace paths keep the
+                // short-circuit — the ownership table independently flags
+                // filesAffected conflicts.
+                if (owners && owners.length === 1) {
+                    results.push(await classifySingleOwnerFile(entry, engineDir, patchesDir, 'furnace'));
+                }
+                else {
+                    results.push({ ...entry, classification: 'furnace' });
+                }
                 continue;
             }
         }
@@ -127,30 +174,7 @@ export async function classifyFiles(files, engineDir, patchesDir, binaryName, fu
             continue;
         }
         // File is claimed by exactly one patch — compare content.
-        if (primaryCode === 'D') {
-            // Deleted file: patch-backed only if patch expects deletion
-            const expected = await computePatchedContent(patchesDir, engineDir, entry.file);
-            results.push({
-                ...entry,
-                classification: expected === null ? 'patch-backed' : 'patch-owned-drift',
-            });
-            continue;
-        }
-        // File exists on disk — compare actual vs expected
-        try {
-            const [expected, actual] = await Promise.all([
-                computePatchedContent(patchesDir, engineDir, entry.file),
-                readText(join(engineDir, entry.file)),
-            ]);
-            results.push({
-                ...entry,
-                classification: actual === expected ? 'patch-backed' : 'patch-owned-drift',
-            });
-        }
-        catch (error) {
-            verbose(`Treating ${entry.file} as patch-owned drift because patch-backed classification failed: ${toError(error).message}`);
-            results.push({ ...entry, classification: 'patch-owned-drift' });
-        }
+        results.push(await classifySingleOwnerFile(entry, engineDir, patchesDir, 'patch-backed'));
     }
     return results;
 }

package/dist/src/core/test-stale-check.d.ts

@@ -1,4 +1,6 @@
+import { isXpcomManifestPath } from './build-audit.js';
 import type { BuildBaseline, TestPackagingCoverage } from './build-baseline-types.js';
+export { isXpcomManifestPath };
 /** Result of the stale-build preflight probe. */
 export interface StaleBuildResult {
     /** True when at least one packageable engine file changed since the baseline. */
@@ -53,7 +55,10 @@ export declare const FULL_SUITE_REQUEST = "(entire suite)";
  *
  * Coverage semantics: `undefined` (pre-0.37.0 baseline) and `'full'` cover
  * everything. A scoped list covers a request path when the request equals a
- * covered entry or sits beneath a covered directory entry. Both sides are
+ * covered entry, sits beneath a covered directory entry, or shares a
+ * manifest granule with a covered entry ({@link toManifestGranule} — a
+ * scoped `test --build` packages the whole manifest directory, so a
+ * same-manifest sibling of a covered file is packaged too). Both sides are
  * normalized to forward slashes so Windows-style CLI input cannot defeat
  * the prefix rule (baseline paths are POSIX by convention). A request with
  * no paths is a full-suite run and is never covered by a scoped list — the
@@ -68,3 +73,38 @@ export declare function findUncoveredRequestPaths(coverage: TestPackagingCoverag
  * independently (same split as {@link formatStaleBuildWarning}).
  */
 export declare function formatTestCoverageRefusal(uncovered: string[], coverage: string[]): string;
+/** Result of the compiled-StaticComponents staleness probe. */
+export interface StaticComponentsStaleResult {
+    /** True when at least one `components.conf` genuinely diverged from the anchor. */
+    stale: boolean;
+    /**
+     * Engine-relative `components.conf` paths changed since the last FULL
+     * build. Sorted; NOT capped — {@link formatStaticComponentsRefusal}
+     * applies the render cap.
+     */
+    changedManifests: string[];
+}
+/**
+ * Probes whether any `components.conf` changed since the last FULL
+ * `fireforge build` — i.e. since the compiled StaticComponents table was
+ * last regenerated. `components.conf` entries bake into compiled code; a
+ * scoped `test --build` packages the file but the child process resolves
+ * the OLD table and fails with `NS_ERROR_MALFORMED_URI` that reads as a
+ * test bug.
+ *
+ * The diff anchors to the baseline's `staticComponentsBaseline` (the last
+ * full build's engine HEAD SHA), NOT the baseline's own `engineHeadSha`
+ * which a scoped `test --build` advances. Dirty candidates are hash-checked
+ * against the anchor's fingerprints so only genuine content divergence
+ * counts. No baseline / no anchor (pre-0.38.0 marker) → fresh. Never
+ * throws — the probes it composes degrade to verbose lines and empty
+ * results on git failure, matching {@link checkStaleBuildForTest}.
+ */
+export declare function checkStaticComponentsStale(engineDir: string, baseline: BuildBaseline | undefined): Promise<StaticComponentsStaleResult>;
+/**
+ * Formats the refusal shown when a run would dispatch against a stale
+ * compiled StaticComponents table. Same probe/copy split as
+ * {@link formatStaleBuildWarning} so tests can pin structure and wording
+ * independently.
+ */
+export declare function formatStaticComponentsRefusal(changedManifests: string[]): string;

package/dist/src/core/test-stale-check.js

@@ -28,9 +28,10 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { toError } from '../utils/errors.js';
 import { verbose } from '../utils/logger.js';
-import { isPackageablePath } from './build-audit.js';
+import { isPackageablePath, isXpcomManifestPath } from './build-audit.js';
 import { readBuildBaseline } from './build-baseline.js';
 import { collectChangedEnginePaths } from './engine-changes.js';
+export { isXpcomManifestPath };
 /** Cap on the number of changed paths rendered inline. */
 const STALE_PATHS_LIMIT = 10;
 /**
@@ -125,7 +126,10 @@ export const FULL_SUITE_REQUEST = '(entire suite)';
  *
  * Coverage semantics: `undefined` (pre-0.37.0 baseline) and `'full'` cover
  * everything. A scoped list covers a request path when the request equals a
- * covered entry or sits beneath a covered directory entry. Both sides are
+ * covered entry, sits beneath a covered directory entry, or shares a
+ * manifest granule with a covered entry ({@link toManifestGranule} — a
+ * scoped `test --build` packages the whole manifest directory, so a
+ * same-manifest sibling of a covered file is packaged too). Both sides are
  * normalized to forward slashes so Windows-style CLI input cannot defeat
  * the prefix rule (baseline paths are POSIX by convention). A request with
  * no paths is a full-suite run and is never covered by a scoped list — the
@@ -141,9 +145,29 @@ export function findUncoveredRequestPaths(coverage, requestedPaths) {
     }
     return requestedPaths.filter((requested) => {
         const path = normalizeCoveragePath(requested);
-        return !covered.some((c) => path === c || path.startsWith(`${c}/`));
+        const granule = toManifestGranule(path);
+        return !covered.some((c) => path === c || path.startsWith(`${c}/`) || granule === toManifestGranule(c));
     });
 }
+/**
+ * Maps a normalized request/coverage path to the "manifest granule" the
+ * packaged runtime actually staged: an extension-bearing basename (a test
+ * FILE) maps to its containing directory, a directory (no dot in the
+ * basename) maps to itself. Purely lexical — the directory-as-manifest
+ * approximation holds because xpcshell/mochitest manifests live next to
+ * their test files and a scoped `test --build` stages the whole manifest
+ * directory into `obj-*`/`_tests/`, not single files. Caveat: a DIRECTORY
+ * whose basename contains a dot is misread as a file and mapped to its
+ * parent, which widens (never narrows) the covered granule.
+ */
+function toManifestGranule(path) {
+    const slash = path.lastIndexOf('/');
+    const base = slash === -1 ? path : path.slice(slash + 1);
+    if (!base.includes('.')) {
+        return path;
+    }
+    return slash === -1 ? '' : path.slice(0, slash);
+}
 /** Normalizes a path for coverage comparison: forward slashes, no trailing slash. */
 function normalizeCoveragePath(path) {
     return path.trim().replace(/\\/g, '/').replace(/\/+$/, '');
@@ -171,3 +195,53 @@ export function formatTestCoverageRefusal(uncovered, coverage) {
         `rather than fail. ${rebuildHint} ` +
         '(--allow-stale-build does not bypass this check — it accepts stale content, not missing coverage.)');
 }
+/**
+ * Probes whether any `components.conf` changed since the last FULL
+ * `fireforge build` — i.e. since the compiled StaticComponents table was
+ * last regenerated. `components.conf` entries bake into compiled code; a
+ * scoped `test --build` packages the file but the child process resolves
+ * the OLD table and fails with `NS_ERROR_MALFORMED_URI` that reads as a
+ * test bug.
+ *
+ * The diff anchors to the baseline's `staticComponentsBaseline` (the last
+ * full build's engine HEAD SHA), NOT the baseline's own `engineHeadSha`
+ * which a scoped `test --build` advances. Dirty candidates are hash-checked
+ * against the anchor's fingerprints so only genuine content divergence
+ * counts. No baseline / no anchor (pre-0.38.0 marker) → fresh. Never
+ * throws — the probes it composes degrade to verbose lines and empty
+ * results on git failure, matching {@link checkStaleBuildForTest}.
+ */
+export async function checkStaticComponentsStale(engineDir, baseline) {
+    const anchor = baseline?.staticComponentsBaseline;
+    if (baseline === undefined || anchor === undefined) {
+        return { stale: false, changedManifests: [] };
+    }
+    const changed = await collectChangedEnginePaths(engineDir, { ...baseline, engineHeadSha: anchor.engineHeadSha }, 'Static-components preflight');
+    const changedManifests = [];
+    for (const path of changed.filter((p) => isXpcomManifestPath(p))) {
+        const recorded = anchor.fingerprints[path];
+        const live = await hashEngineFile(engineDir, path);
+        if (recorded === undefined || live === undefined || recorded !== live) {
+            changedManifests.push(path);
+        }
+    }
+    return { stale: changedManifests.length > 0, changedManifests };
+}
+/**
+ * Formats the refusal shown when a run would dispatch against a stale
+ * compiled StaticComponents table. Same probe/copy split as
+ * {@link formatStaleBuildWarning} so tests can pin structure and wording
+ * independently.
+ */
+export function formatStaticComponentsRefusal(changedManifests) {
+    const head = changedManifests.slice(0, STALE_PATHS_LIMIT);
+    const truncated = changedManifests.length - head.length;
+    const list = head.join(', ') + (truncated > 0 ? `, … (+${truncated} more)` : '');
+    return (`The compiled StaticComponents table is stale: ${list} changed since the last full "fireforge build".\n` +
+        'components.conf registrations are baked into compiled code that only a FULL build ' +
+        'regenerates — a scoped "fireforge test --build" repackages files but the child process ' +
+        'resolves the old component table and fails with NS_ERROR_MALFORMED_URI that reads as a ' +
+        'test bug. Run "fireforge build" first. (--allow-stale-build does not bypass this check — ' +
+        'it accepts stale packaged content, not a stale compiled registration. Pass ' +
+        '--allow-stale-components only if you rebuilt out-of-band and accept the risk.)');
+}