@hominis/fireforge 0.40.0 → 0.42.0

package/dist/src/core/patch-lint-reexports.d.ts

@@ -4,3 +4,4 @@
  */
 export { buildPatchQueueContext, collectForwardImportEdges, collectNewFileCreatorsByPath, extractImportSpecifiers, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, FORWARD_IMPORT_IGNORE_MARKER, isForwardImportableFile, lintPatchQueue, lintPatchQueueDuplicateCreations, lintPatchQueueForwardImports, type PatchQueueContext, type PatchQueueEntry, } from './patch-lint-cross.js';
 export { buildModifiedFileAdditionsFromDiff, detectNewFilesInDiff } from './patch-lint-diff.js';
+export { lintPatchQueueModuleRegistrations } from './patch-lint-module-registration.js';

package/dist/src/core/patch-lint-reexports.js

@@ -5,3 +5,4 @@
  */
 export { buildPatchQueueContext, collectForwardImportEdges, collectNewFileCreatorsByPath, extractImportSpecifiers, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, FORWARD_IMPORT_IGNORE_MARKER, isForwardImportableFile, lintPatchQueue, lintPatchQueueDuplicateCreations, lintPatchQueueForwardImports, } from './patch-lint-cross.js';
 export { buildModifiedFileAdditionsFromDiff, detectNewFilesInDiff } from './patch-lint-diff.js';
+export { lintPatchQueueModuleRegistrations } from './patch-lint-module-registration.js';

package/dist/src/core/patch-lint.d.ts

@@ -4,6 +4,12 @@ import { type CommentStyle } from './license-headers.js';
 import { lintPatchedCss } from './patch-lint-css.js';
 export * from './patch-lint-reexports.js';
 export { lintPatchedCss };
+/**
+ * Canonical `[check] file: message` rendering of a patch-lint issue — the
+ * one string shape every reporter and refusal message uses, so operators
+ * can grep one format across lint output and refusal details.
+ */
+export declare function formatPatchLintIssue(issue: Pick<PatchLintIssue, 'check' | 'file' | 'message'>): string;
 /**
  * Counts the total lines in a unified diff and the number of non-binary
  * text lines, so binary hunks do not inflate patch size checks.
@@ -24,6 +30,8 @@ export declare function countNonBinaryDiffLines(diffContent: string): {
  * `browser_`, `test_`, or `xpcshell_` (all `.js`).
  */
 export declare function isTestFile(file: string): boolean;
+/** True when `strippedContent` contains at least one assertion call. */
+export declare function hasBrowserChromeAssertion(strippedContent: string): boolean;
 /**
  * Detects comment style from file extension for license header checks.
  */

package/dist/src/core/patch-lint.js

@@ -49,6 +49,14 @@ function countContentLines(content) {
         lines.pop();
     return lines.length;
 }
+/**
+ * Canonical `[check] file: message` rendering of a patch-lint issue — the
+ * one string shape every reporter and refusal message uses, so operators
+ * can grep one format across lint output and refusal details.
+ */
+export function formatPatchLintIssue(issue) {
+    return `[${issue.check}] ${issue.file}: ${issue.message}`;
+}
 /**
  * Counts the total lines in a unified diff and the number of non-binary
  * text lines, so binary hunks do not inflate patch size checks.
@@ -136,6 +144,16 @@ const PATCH_FILES_THRESHOLDS = {
     test: 5,
     branding: 60,
 };
+/**
+ * Shared remedy sentence for the over-budget findings (FORGE H4): the two
+ * places an operator stands when a patch outgrows its budget must name the
+ * sanctioned one-transaction way out, or they reach for the wrong tools
+ * first (the field report tried two before finding it). One constant, four
+ * emission sites — the wording cannot drift.
+ */
+const SPLIT_HINT = 'Consider splitting into smaller, focused patches — ' +
+    '"fireforge patch move-files <from> <to> --file <path> --create --order <n>" ' +
+    'moves files into a new patch in one transaction.';
 /**
  * Fixed allowlist of non-branding sibling paths that real-world Firefox
  * branding patches legitimately need to touch to register the new
@@ -214,6 +232,67 @@ function isBrowserChromeTestFile(file) {
         return false;
     return basename.startsWith('browser_');
 }
+/**
+ * Bare assertion-call detection for the `test-needs-assertion` floor.
+ *
+ * Each alternative must sit at a call boundary: preceded by something that is
+ * not an identifier character, `.`, `#`, or `-`. Until 0.41.0 this was a plain
+ * `strippedContent.includes(tok)` over the tokens `Assert.`, `ok(`, `is(`,
+ * `isnot(`, `isDeeply(`, so any identifier merely *ending* in one satisfied
+ * the gate — `this.axis(3)` contains `is(`, `book(` contains `ok(`,
+ * `promiseIsDeeply(` contains `isDeeply(`. An assertion-free smoke test using
+ * any such call passed the floor, which is exactly what the rule exists to
+ * catch.
+ *
+ * The namespaced arm must name a member and a call. Matching the namespace and
+ * its dot alone — as `(?:Assert|SimpleTest)\.` did — re-opened the same hole
+ * from the other side: `SimpleTest` is mostly *harness* API, so
+ * `SimpleTest.finish()`, `SimpleTest.waitForExplicitFinish()` and
+ * `SimpleTest.requestCompleteLog()` each cleared the floor on their own. Those
+ * are the exact calls an assertion-free smoke test contains. The enumeration
+ * below is the mochitest/xpcshell assertion surface both namespaces share, and
+ * it is what the user-facing message already names.
+ *
+ * Two qualified spellings of the bare four still count: `window.ok(...)` (the
+ * globals ARE window properties) and an optional-chained `win?.ok(...)`.
+ * Blocking those flagged tests whose only assertions are real as
+ * assertion-free. `SpecialPowers.ok(` stays excluded — that is API surface,
+ * not an assertion.
+ *
+ * Deliberately still textual, not AST-based: this runs over patch bodies
+ * rather than resolvable sources, and the surrounding rule is a floor, not a
+ * proof.
+ */
+const ASSERTION_MEMBERS = [
+    'ok',
+    'is',
+    'isnot',
+    'isDeeply',
+    'equal',
+    'notEqual',
+    'deepEqual',
+    'notDeepEqual',
+    'strictEqual',
+    'notStrictEqual',
+    'greater',
+    'greaterOrEqual',
+    'less',
+    'lessOrEqual',
+    'stringMatches',
+    'stringContains',
+    'throws',
+    'rejects',
+    // `todo`, `todo_is`, `todo_isnot`, `info`-free — todo* record an expected
+    // failure, which is still a recorded assertion outcome.
+    'todo',
+    'todo_is',
+    'todo_isnot',
+].join('|');
+const BROWSER_CHROME_ASSERTION = new RegExp(`(?<![\\w.#$-])(?:(?:Assert|SimpleTest)\\.(?:${ASSERTION_MEMBERS})\\s*\\(|(?:window\\.|[\\w$]+\\?\\.)?(?:ok|is|isnot|isDeeply)\\s*\\()`);
+/** True when `strippedContent` contains at least one assertion call. */
+export function hasBrowserChromeAssertion(strippedContent) {
+    return BROWSER_CHROME_ASSERTION.test(strippedContent);
+}
 /**
  * Detects comment style from file extension for license header checks.
  */
@@ -406,8 +485,7 @@ export async function lintPatchedJs(repoDir, affectedFiles, newFiles, config, pa
         // browser_*.js silently passed under the old `isNew` gate).
         const assertionFloor = config.patchLint?.testAssertionFloor;
         if (assertionFloor && assertionFloor !== 'off' && isBrowserChromeTestFile(file)) {
-            const ASSERTION_TOKENS = ['Assert.', 'ok(', 'is(', 'isnot(', 'isDeeply('];
-            const hasAssertion = ASSERTION_TOKENS.some((tok) => strippedContent.includes(tok));
+            const hasAssertion = hasBrowserChromeAssertion(strippedContent);
             if (!hasAssertion) {
                 issues.push({
                     file,
@@ -535,7 +613,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-files',
-            message: `Patch affects ${filesAffected.length} files (recommended: ≤${fileThreshold}). Consider splitting into smaller, focused patches.`,
+            message: `Patch affects ${filesAffected.length} files (recommended: ≤${fileThreshold}). ${SPLIT_HINT}`,
             severity: 'warning',
         });
     }
@@ -543,7 +621,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
-            message: `Patch is ${lineCount} lines (hard limit: ${lineThresholds.error}). Consider splitting into smaller, focused patches.`,
+            message: `Patch is ${lineCount} lines (hard limit: ${lineThresholds.error}). ${SPLIT_HINT}`,
             severity: 'error',
         });
     }
@@ -551,7 +629,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
-            message: `Patch is ${lineCount} lines (soft limit: ${lineThresholds.warning}, hard limit: ${lineThresholds.error}). Consider splitting into smaller, focused patches.`,
+            message: `Patch is ${lineCount} lines (soft limit: ${lineThresholds.warning}, hard limit: ${lineThresholds.error}). ${SPLIT_HINT}`,
             severity: 'warning',
         });
     }
@@ -559,7 +637,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
-            message: `Patch is ${lineCount} lines (soft limit: ${lineThresholds.warning}, hard limit: ${lineThresholds.error}). Consider splitting into smaller, focused patches.`,
+            message: `Patch is ${lineCount} lines (soft limit: ${lineThresholds.warning}, hard limit: ${lineThresholds.error}). ${SPLIT_HINT}`,
             severity: 'notice',
         });
     }

package/dist/src/core/patch-lock.d.ts

@@ -1,8 +1,19 @@
 /**
  * Filesystem-based lock for serializing patch directory mutations.
  */
+export interface PatchDirectoryLockOptions {
+    /**
+     * Wait up to this many seconds for the patch directory lock instead of the
+     * default ~30 s budget. Enables exponential poll backoff (100 ms → 2 s)
+     * and a holder-identified progress line roughly every 5 s. `undefined`
+     * preserves the historical behavior exactly.
+     */
+    waitLockSeconds?: number | undefined;
+    /** Command name recorded in the lock's owner metadata for holder diagnostics. */
+    command?: string | undefined;
+}
 /**
  * Runs a patch directory mutation while holding an exclusive filesystem lock.
  * This serializes filename allocation and manifest writes across parallel exports.
  */
-export declare function withPatchDirectoryLock<T>(patchesDir: string, operation: () => Promise<T>): Promise<T>;
+export declare function withPatchDirectoryLock<T>(patchesDir: string, operation: () => Promise<T>, options?: PatchDirectoryLockOptions): Promise<T>;

package/dist/src/core/patch-lock.js

@@ -6,18 +6,54 @@ import { join } from 'node:path';
 import { FireForgeError } from '../errors/base.js';
 import { PatchError } from '../errors/patch.js';
 import { toError } from '../utils/errors.js';
+import { info } from '../utils/logger.js';
 import { withFileLock } from './file-lock.js';
 const PATCH_DIRECTORY_LOCK = '.fireforge-patches.lock';
+/**
+ * Formats the periodic operator-facing waiting line printed while
+ * `--wait-lock` polls a contended patch directory lock. Mirrors the engine
+ * session lock's progress line so operators read one shape for both locks.
+ */
+function formatWaitProgressLine(waitedMs, timeoutMs, holder) {
+    const progress = `${String(Math.round(waitedMs / 1000))}s of up to ${String(Math.round(timeoutMs / 1000))}s`;
+    if (holder === undefined) {
+        return `Waiting for the FireForge patch directory lock — ${progress}.`;
+    }
+    const details = holder.metadata.length > 0 ? ` (${holder.metadata.join(', ')})` : '';
+    return `Waiting for the FireForge patch directory lock held by PID ${String(holder.pid)}${details} — ${progress}.`;
+}
 /**
  * Runs a patch directory mutation while holding an exclusive filesystem lock.
  * This serializes filename allocation and manifest writes across parallel exports.
  */
-export async function withPatchDirectoryLock(patchesDir, operation) {
+export async function withPatchDirectoryLock(patchesDir, operation, options = {}) {
     const lockDir = join(patchesDir, PATCH_DIRECTORY_LOCK);
+    const { waitLockSeconds, command } = options;
     return withFileLock(lockDir, operation, {
-        onTimeoutMessage: `Timed out waiting for another patch export to finish in ${patchesDir}.\n` +
-            `If no other fireforge process is running, the lock may be stale. ` +
-            `Remove it manually:\n  rm -rf "${lockDir}"`,
+        ...(waitLockSeconds !== undefined
+            ? {
+                timeoutMs: waitLockSeconds * 1000,
+                pollMs: 100,
+                pollMaxMs: 2000,
+                waitProgressMs: 5000,
+                onWaitProgress: ({ waitedMs, timeoutMs, holder }) => {
+                    info(formatWaitProgressLine(waitedMs, timeoutMs, holder));
+                },
+            }
+            : {}),
+        ...(command !== undefined
+            ? { ownerMetadata: [`command=${command}`, `started=${new Date().toISOString()}`] }
+            : {}),
+        // Reason first, remedy second (FORGE H5). The remedy is waiting, not
+        // deleting: bulk exports/re-exports legitimately hold this lock for
+        // minutes, FireForge reaps genuinely stale locks on its own, and the
+        // old advice ("rm -rf" while a holder was alive) destroyed a live
+        // lock. The leading sentence is a message contract; extend, don't
+        // reword. withFileLock appends the holder identification.
+        onTimeoutMessage: `Timed out waiting for another FireForge command mutating ${patchesDir}.\n` +
+            `Pass --wait-lock [seconds] to wait longer (bare --wait-lock waits up to 60 seconds). ` +
+            `FireForge removes genuinely stale locks automatically; only if no other fireforge ` +
+            `process is running and the timeout persists, remove the lock manually:\n  rm -rf "${lockDir}"`,
         onStaleLockMessage: (ageMs) => `Removing stale patch lock (age: ${Math.round(ageMs / 1000)}s). ` +
             'A previous fireforge process may have crashed.',
     }).catch((error) => {

package/dist/src/core/patch-manifest-consistency.js

@@ -112,10 +112,22 @@ async function rebuildPatchesManifestUnderLock(patchesDir, fallbackSourceEsrVers
         return Number.isFinite(patch.order) ? Math.max(highest, patch.order) : highest;
     }, 0);
     let nextRecoveredOrder = highestFiniteOrder + 1;
-    for (const patch of patches) {
+    // Prefetch the two independent per-patch reads concurrently. This runs
+    // while the patch-directory lock is held, and it was two serialised awaits
+    // per patch across the whole queue — 58 round-trips on a 29-patch queue.
+    // The fold below stays sequential because `nextRecoveredOrder` is
+    // loop-carried: parallelising the assignment would scramble the recovered
+    // ordinals.
+    const prefetched = await Promise.all(patches.map(async (patch) => ({
+        filesAffected: normalizeFiles(await getAllTargetFilesFromPatch(patch.path)),
+        patchStats: await stat(patch.path),
+    })));
+    for (const [index, patch] of patches.entries()) {
         const existing = existingEntries.get(patch.filename);
-        const filesAffected = normalizeFiles(await getAllTargetFilesFromPatch(patch.path));
-        const patchStats = await stat(patch.path);
+        const prefetch = prefetched[index];
+        if (!prefetch)
+            continue;
+        const { filesAffected, patchStats } = prefetch;
         const inferred = inferPatchMetadataFromFilename(patch.filename);
         const recoveredOrder = Number.isFinite(patch.order) ? patch.order : nextRecoveredOrder++;
         if (!existing) {

package/dist/src/core/patch-parse.d.ts

@@ -60,6 +60,14 @@ export interface DiffSection {
      * refuse them rather than treat base85 lines starting with `+` as content.
      */
     isBinary: boolean;
+    /**
+     * Old-side blob hash from the section's `index <old>..<new>` line
+     * (possibly abbreviated). Undefined when the metadata zone carries no
+     * parseable index line (hand-written diffs, `Binary files … differ`).
+     */
+    indexOldHash?: string;
+    /** New-side blob hash from the `index` line; see {@link indexOldHash}. */
+    indexNewHash?: string;
     /** Parsed hunks, in file order. Empty for binary or metadata-only sections. */
     hunks: ParsedHunk[];
 }

package/dist/src/core/patch-parse.js

@@ -169,6 +169,16 @@ export function parseDiffSections(diffContent) {
                 current.isBinary = true;
                 continue;
             }
+            // `git diff --binary` always records full blob hashes here (git
+            // apply requires them); text sections carry abbreviated ones. The
+            // hashes let binary sections be compared by identity when their
+            // payload cannot be applied as text (FORGE J3).
+            const indexMatch = /^index ([0-9a-f]{7,64})\.\.([0-9a-f]{7,64})(?: \d{6})?$/.exec(line);
+            if (indexMatch?.[1] !== undefined && indexMatch[2] !== undefined) {
+                current.indexOldHash = indexMatch[1];
+                current.indexNewHash = indexMatch[2];
+                continue;
+            }
         }
         if (current.isBinary)
             continue;

package/dist/src/core/patch-policy.d.ts

@@ -23,6 +23,13 @@ export interface PatchPolicyEnforcementInput {
     manifest: PatchesManifest;
     command: string;
     forceUnsafe?: boolean;
+    /**
+     * Per-issue-code remediation lines appended to matching details, so a
+     * refusal can name the exact flag or command that fixes it on the
+     * command it was raised from (e.g. `--description` on
+     * `patch move-files --create`).
+     */
+    hints?: Partial<Record<PatchPolicyIssueCode, string>>;
 }
 /** Returns valid categories for prompts and CLI validation under the config. */
 export declare function getPatchPolicyCategories(config: FireForgeConfig): string[];

package/dist/src/core/patch-policy.js

@@ -341,7 +341,10 @@ export function enforcePatchPolicy(input) {
     if (issues.length === 0)
         return;
     const mode = mutationMode(input.config);
-    const details = issues.map((issue) => `  [${issue.code}] ${issue.message}`);
+    const details = issues.map((issue) => {
+        const hint = input.hints?.[issue.code];
+        return `  [${issue.code}] ${issue.message}${hint ? `\n      → ${hint}` : ''}`;
+    });
     if (mode === 'warn') {
         warn(`${input.command}: patch policy warning(s):`);
         for (const detail of details)

package/dist/src/core/patch-transform.d.ts

@@ -35,3 +35,13 @@ export declare function extractNewFileContent(patchPath: string, targetFile?: st
  * @returns Modified content
  */
 export declare function applyPatchToContent(content: string | null, patchPath: string, targetFile: string): Promise<string>;
+/**
+ * Applies an already-read patch body to content. Batched callers that hold
+ * many (patch, file) pairs use this to read each patch body once instead of
+ * once per pair.
+ * @param content - Original content (null for new files)
+ * @param patchContent - Full text of the patch body
+ * @param targetFile - The file path within the patch
+ * @returns Modified content
+ */
+export declare function applyPatchTextToContent(content: string | null, patchContent: string, targetFile: string): string;

package/dist/src/core/patch-transform.js

@@ -71,11 +71,22 @@ export async function extractNewFileContent(patchPath, targetFile) {
  * @returns Modified content
  */
 export async function applyPatchToContent(content, patchPath, targetFile) {
-    const patchContent = await readText(patchPath);
+    return applyPatchTextToContent(content, await readText(patchPath), targetFile);
+}
+/**
+ * Applies an already-read patch body to content. Batched callers that hold
+ * many (patch, file) pairs use this to read each patch body once instead of
+ * once per pair.
+ * @param content - Original content (null for new files)
+ * @param patchContent - Full text of the patch body
+ * @param targetFile - The file path within the patch
+ * @returns Modified content
+ */
+export function applyPatchTextToContent(content, patchContent, targetFile) {
     // Check if this is a new file patch for the target file specifically
     if (content === null) {
         if (isNewFileInPatch(patchContent, targetFile)) {
-            return await extractNewFileContent(patchPath, targetFile);
+            return extractNewFileContentFromDiff(patchContent, targetFile);
         }
         // If not a new file patch but content is null, return empty
         return '';

package/dist/src/core/rebase-session.d.ts

@@ -35,7 +35,47 @@ export interface RebaseSession {
     currentIndex: number;
 }
 /**
- * Loads an existing rebase session, or returns `null` if none exists.
+ * Outcome of reading the session file, following the {@link LockOwner}
+ * discriminated-union form rather than collapsing three states into `null`.
+ *
+ * Distinguishing `present: false` from `present: true, valid: false` is
+ * load-bearing. Before 0.41.0 both returned `null` while
+ * {@link hasActiveRebaseSession} reported liveness from `pathExists` alone, so
+ * an invalid session file wedged the operator in a closed cycle: `rebase` said
+ * "already in progress — use --continue or --abort", and both of those said
+ * "no rebase session in progress". No CLI path deleted the file and no message
+ * named it, so the only escape was knowing to `rm` it by hand.
+ */
+export type RebaseSessionRead = {
+    present: false;
+} | {
+    present: true;
+    valid: true;
+    session: RebaseSession;
+} | {
+    present: true;
+    valid: false;
+    reason: string;
+};
+/** Absolute path of the session file, for messages that must name it. */
+export declare function getRebaseSessionPath(projectRoot: string): string;
+/**
+ * Reads the session file, reporting absent, valid, and corrupt as three
+ * distinct outcomes. Never throws for a malformed file: `readJson` calls
+ * `JSON.parse` with no guard of its own, so an interrupted write surfaced a
+ * raw `SyntaxError` out of `--continue`/`--abort` before 0.41.0.
+ *
+ * A single read determines liveness and validity: only ENOENT/ENOTDIR from
+ * that read mean `absent`. A pathExists pre-probe both raced deletion (a file
+ * removed between probe and read misreported an absent session as corrupt)
+ * and swallowed EACCES (an unreadable `.fireforge/` misreported a session as
+ * absent) — the same failure `readTreeMarkerState` fixed for tree markers.
+ */
+export declare function readRebaseSession(projectRoot: string): Promise<RebaseSessionRead>;
+/**
+ * Loads an existing rebase session, or returns `null` when none exists or the
+ * file on disk is unusable. Callers that must tell those two apart — every
+ * command that reports to an operator — should use {@link readRebaseSession}.
  */
 export declare function loadRebaseSession(projectRoot: string): Promise<RebaseSession | null>;
 /**
@@ -47,6 +87,8 @@ export declare function saveRebaseSession(projectRoot: string, session: RebaseSe
  */
 export declare function clearRebaseSession(projectRoot: string): Promise<void>;
 /**
- * Returns `true` when an active rebase session exists on disk.
+ * Returns `true` when a rebase session file exists on disk, valid or not.
+ * Test-facing convenience — production code reads `readRebaseSession` once
+ * instead, so liveness and validity come from the same read.
  */
 export declare function hasActiveRebaseSession(projectRoot: string): Promise<boolean>;

package/dist/src/core/rebase-session.js

@@ -6,8 +6,9 @@
  * resume with `fireforge rebase --continue`.
  */
 import { join } from 'node:path';
+import { getNodeErrorCode, toError } from '../utils/errors.js';
 import { pathExists, readJson, removeFile, writeJson } from '../utils/fs.js';
-import { isArray, isObject, isString } from '../utils/validation.js';
+import { isArray, isNumber, isObject, isString, isValidFirefoxProduct, isValidFirefoxVersion, } from '../utils/validation.js';
 import { getProjectPaths } from './config-paths.js';
 import { createSiblingLockPath, withFileLock } from './file-lock.js';
 // ── Helpers ──
@@ -15,28 +16,122 @@ const SESSION_FILENAME = 'rebase-session.json';
 function sessionPath(projectRoot) {
     return join(getProjectPaths(projectRoot).fireforgeDir, SESSION_FILENAME);
 }
+const REBASE_PATCH_STATUSES = [
+    'pending',
+    'applied-clean',
+    'applied-fuzz',
+    'failed',
+    'resolved',
+    'skipped',
+];
+/** Validates one `patches[]` element to its declared shape. */
+function isValidPatchEntry(value) {
+    if (!isObject(value))
+        return false;
+    if (!isString(value['filename']) || value['filename'].length === 0)
+        return false;
+    if (!REBASE_PATCH_STATUSES.includes(value['status']))
+        return false;
+    if (value['fuzzFactor'] !== undefined && !isNumber(value['fuzzFactor']))
+        return false;
+    if (value['error'] !== undefined && !isString(value['error']))
+        return false;
+    const conflicting = value['conflictingFiles'];
+    if (conflicting !== undefined && (!isArray(conflicting) || !conflicting.every(isString))) {
+        return false;
+    }
+    return true;
+}
+/** Optional product field: absent is legal, present must be a real product. */
+function isValidOptionalProduct(value) {
+    return value === undefined || (isString(value) && isValidFirefoxProduct(value));
+}
+/**
+ * Validates a session file against the shape the rebase commands actually
+ * consume — not merely against broad field types.
+ *
+ * The looser predicate this replaces checked six `typeof`s and nothing else,
+ * which admitted sessions the resume path then acted on. `patches: [null]`
+ * reached `patch-loop.ts`, which reads `.filename` off each entry and hands it
+ * to `stampPatchVersions`. A `currentIndex` of `NaN` (legal for
+ * `typeof === 'number'`) made the resume loop run zero iterations and report
+ * success; a negative one indexed out of range in `continue.ts`. `toVersion:
+ * ""` passed `isString` and was stamped verbatim onto every Furnace override's
+ * `baseVersion`. `fromProduct`/`toProduct` were not checked at all despite
+ * being typed `FirefoxProduct`.
+ *
+ * The session file is written only by `rebase/index.ts` from validated CLI and
+ * config values, so every one of these is a corrupt-file or hand-edit case —
+ * which is exactly the case this predicate exists to catch.
+ */
 function isValidSession(data) {
     if (!isObject(data))
         return false;
-    return (isString(data['startedAt']) &&
-        isString(data['fromVersion']) &&
-        isString(data['toVersion']) &&
-        isString(data['preRebaseCommit']) &&
-        isArray(data['patches']) &&
-        typeof data['currentIndex'] === 'number');
+    if (!isString(data['startedAt']) || Number.isNaN(Date.parse(data['startedAt'])))
+        return false;
+    // 4 is git's own minimum abbreviation length; 40/64 are full SHA-1/SHA-256.
+    if (!isString(data['preRebaseCommit']) || !/^[0-9a-f]{4,64}$/i.test(data['preRebaseCommit'])) {
+        return false;
+    }
+    if (!isString(data['fromVersion']) || !isValidFirefoxVersion(data['fromVersion']))
+        return false;
+    if (!isString(data['toVersion']) || !isValidFirefoxVersion(data['toVersion']))
+        return false;
+    if (!isValidOptionalProduct(data['fromProduct']))
+        return false;
+    if (!isValidOptionalProduct(data['toProduct']))
+        return false;
+    const patches = data['patches'];
+    if (!isArray(patches) || !patches.every(isValidPatchEntry))
+        return false;
+    // `<= patches.length` because the resume point legally sits one past the
+    // last entry once every patch has been processed.
+    const currentIndex = data['currentIndex'];
+    if (!isNumber(currentIndex) || !Number.isInteger(currentIndex))
+        return false;
+    return currentIndex >= 0 && currentIndex <= patches.length;
+}
+/** Absolute path of the session file, for messages that must name it. */
+export function getRebaseSessionPath(projectRoot) {
+    return sessionPath(projectRoot);
 }
-// ── Public API ──
 /**
- * Loads an existing rebase session, or returns `null` if none exists.
+ * Reads the session file, reporting absent, valid, and corrupt as three
+ * distinct outcomes. Never throws for a malformed file: `readJson` calls
+ * `JSON.parse` with no guard of its own, so an interrupted write surfaced a
+ * raw `SyntaxError` out of `--continue`/`--abort` before 0.41.0.
+ *
+ * A single read determines liveness and validity: only ENOENT/ENOTDIR from
+ * that read mean `absent`. A pathExists pre-probe both raced deletion (a file
+ * removed between probe and read misreported an absent session as corrupt)
+ * and swallowed EACCES (an unreadable `.fireforge/` misreported a session as
+ * absent) — the same failure `readTreeMarkerState` fixed for tree markers.
  */
-export async function loadRebaseSession(projectRoot) {
+export async function readRebaseSession(projectRoot) {
     const path = sessionPath(projectRoot);
-    if (!(await pathExists(path)))
-        return null;
-    const data = await readJson(path);
-    if (!isValidSession(data))
-        return null;
-    return data;
+    let data;
+    try {
+        data = await readJson(path);
+    }
+    catch (error) {
+        const code = getNodeErrorCode(error);
+        if (code === 'ENOENT' || code === 'ENOTDIR')
+            return { present: false };
+        return { present: true, valid: false, reason: toError(error).message };
+    }
+    if (!isValidSession(data)) {
+        return { present: true, valid: false, reason: 'the file is not a valid rebase session' };
+    }
+    return { present: true, valid: true, session: data };
+}
+/**
+ * Loads an existing rebase session, or returns `null` when none exists or the
+ * file on disk is unusable. Callers that must tell those two apart — every
+ * command that reports to an operator — should use {@link readRebaseSession}.
+ */
+export async function loadRebaseSession(projectRoot) {
+    const result = await readRebaseSession(projectRoot);
+    return result.present && result.valid ? result.session : null;
 }
 /**
  * Persists a rebase session atomically.
@@ -57,7 +152,9 @@ export async function clearRebaseSession(projectRoot) {
     }
 }
 /**
- * Returns `true` when an active rebase session exists on disk.
+ * Returns `true` when a rebase session file exists on disk, valid or not.
+ * Test-facing convenience — production code reads `readRebaseSession` once
+ * instead, so liveness and validity come from the same read.
  */
 export async function hasActiveRebaseSession(projectRoot) {
     return pathExists(sessionPath(projectRoot));

package/dist/src/core/register-browser-content.js

@@ -5,6 +5,7 @@
 import { join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { escapeRegex } from '../utils/regex.js';
 import { findAlphabeticalPosition, findAlphabeticalTokenPosition } from './manifest-helpers.js';
 import { tokenizeJarMn } from './manifest-tokenizers.js';
 import { withParserFallback } from './parser-fallback.js';
@@ -18,7 +19,7 @@ function registerBrowserContentTokenized(content, fileName, entry, after) {
     let insertIndex;
     let previousEntry;
     if (after) {
-        const afterPattern = new RegExp(`(?:^|/)${after.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:\\s|\\)|$)`);
+        const afterPattern = new RegExp(`(?:^|/)${escapeRegex(after)}(?:\\s|\\)|$)`);
         const afterToken = tokens.find((t) => afterPattern.test(t.raw));
         if (afterToken) {
             insertIndex = afterToken.lineIndex + 1;

package/dist/src/core/register-shared-css.js

@@ -5,6 +5,7 @@
 import { basename, join } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText, writeText } from '../utils/fs.js';
+import { escapeRegex } from '../utils/regex.js';
 import { findAlphabeticalPosition, findAlphabeticalTokenPosition } from './manifest-helpers.js';
 import { tokenizeJarMn } from './manifest-tokenizers.js';
 import { withParserFallback } from './parser-fallback.js';
@@ -18,7 +19,7 @@ function registerSharedCSSTokenized(content, name, entry, after) {
     let insertIndex;
     let previousEntry;
     if (after) {
-        const afterPattern = new RegExp(`(?:^|/)${after.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:\\s|\\)|$)`);
+        const afterPattern = new RegExp(`(?:^|/)${escapeRegex(after)}(?:\\s|\\)|$)`);
         const afterToken = tokens.find((t) => afterPattern.test(t.raw));
         if (afterToken) {
             insertIndex = afterToken.lineIndex + 1;