@hominis/fireforge 0.43.0 → 0.43.1

package/CHANGELOG.md

@@ -36,6 +36,7 @@
 
 - `build-prepare` warns — naming every file — before overwriting engine content that matches neither a patch body nor the pristine baseline, and `fireforge build --refuse-unexported-drift` makes it a hard stop. On a multi-session checkout the silent overwrite is what let an unexported edit be reverted and a later re-export capture a half-reverted hybrid that every gate then passed.
 - **A furnace mutation that fails now rolls back the engine, not just one that is interrupted.** `runFurnaceMutation` previously restored its rollback journal on SIGINT/SIGTERM only; on a thrown error its `finally` merely deregistered the operation — and because it also marked it completed, the operation vanished from the signal handler's view too. Bodies that catch and restore on their own were unaffected, but `applyAllComponents` rolls back on _collected_ component errors, so anything thrown from its pre- or post-loop work (patch-claim loading, the post-apply consistency checks, the state write) escaped with the engine torn and no `pendingRepair` breadcrumb — reachable from `furnace apply`, `sync`, `deploy`, `build-prepare`, and `doctor --repair-furnace`. The wrapper now runs cleanup callbacks, restores the journal, and rethrows the **original** error; a rollback that itself fails becomes a `pendingRepair` marker plus a warning rather than replacing the error you needed to read. A pre-flight refusal that never registered a journal deliberately writes no marker, so a validation failure cannot block later mutations behind a repair with nothing to reconcile.
+- **The unexported-drift guard false-positived on collapsed untracked directories, and `fireforge build --refuse-unexported-drift` was therefore unusable on any consumer whose build-prepare-owned tree contains a wholly-untracked directory — every scripted build hard-failed on a false alarm.** Git reports a directory in which _every_ file is untracked as a single `?? dir/` entry instead of listing the files under it. `findUnexportedDriftAtRisk` passed raw `git status` entries to the classifier; a directory has no content to compare, so it matched neither a patch body nor the pristine baseline and classified `unmanaged` — an at-risk bucket — before the guard's branding exclusion could apply. The guard now expands collapsed untracked directories through the same `expandUntrackedDirectoryEntries` helper `status`, `reset`, `discard`, `verify`, `lint`, and `export-all` use, so it and `fireforge status --unmanaged` answer the question about the same tree identically by construction. Two subsystems disagreeing was the defect; the agreement is what the regression test asserts. A genuinely unmanaged file inside such a directory is still reported, and a collapsed directory that merely _contains_ a build-prepare-owned prefix is walked only within that prefix, so the expansion never enumerates an unrelated subtree.
 
 ### Release hygiene
 

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "version": "0.43.0",
-  "commit": "8229f32cf3e1fee429a82966440480de7618bf39",
-  "shortCommit": "8229f32cf3e1",
+  "version": "0.43.1",
+  "commit": "b6b4729474ae50675c5ebcaf25db388b6a6c2352",
+  "shortCommit": "b6b4729474ae",
   "dirty": false,
   "dirtyHash": null,
-  "buildTime": "2026-08-20T14:49:17.057Z"
+  "buildTime": "2026-08-20T16:28:46.617Z"
 }

package/dist/src/core/build-overwrite-guard.js

@@ -27,7 +27,7 @@ import { toError } from '../utils/errors.js';
 import { verbose } from '../utils/logger.js';
 import { getProjectPaths } from './config.js';
 import { collectFurnaceManagedPrefixes } from './furnace-config.js';
-import { getWorkingTreeStatus } from './git-status.js';
+import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from './git-status.js';
 import { classifyFiles } from './status-classify.js';
 /**
  * Classifications whose on-disk content is explained by NEITHER a patch
@@ -39,6 +39,14 @@ import { classifyFiles } from './status-classify.js';
  * preserves unmanaged lines rather than overwriting them.
  */
 const AT_RISK_CLASSIFICATIONS = new Set(['unmanaged', 'patch-owned-drift', 'conflict']);
+/**
+ * Every path prefix build-prepare rewrites from a FireForge-owned source:
+ * the branding tree plus every Furnace-managed prefix. (`mozconfig` is a
+ * single file, not a prefix, and is tested separately.)
+ */
+function buildPrepareOwnedPrefixes(binaryName, furnacePrefixes) {
+    return [`browser/branding/${binaryName}/`, ...furnacePrefixes];
+}
 /**
  * True when `file` sits under a path build-prepare rewrites from a
  * FireForge-owned source: the branding tree, a Furnace-managed prefix, or
@@ -47,14 +55,59 @@ const AT_RISK_CLASSIFICATIONS = new Set(['unmanaged', 'patch-owned-drift', 'conf
 function isOverwrittenByBuildPrepare(file, binaryName, furnacePrefixes) {
     if (file === 'mozconfig')
         return true;
-    if (file.startsWith(`browser/branding/${binaryName}/`))
-        return true;
-    for (const prefix of furnacePrefixes) {
+    for (const prefix of buildPrepareOwnedPrefixes(binaryName, furnacePrefixes)) {
         if (file === prefix || file.startsWith(prefix))
             return true;
     }
     return false;
 }
+/**
+ * Narrows the status entries to the ones build-prepare can overwrite,
+ * expanding collapsed untracked directories on the way.
+ *
+ * Git reports a WHOLLY untracked directory as a single `?? dir/` entry
+ * rather than listing the files under it. A directory entry has no
+ * content to compare, so `classifyFiles` matched it against neither a
+ * patch body nor the pristine baseline and bucketed it `unmanaged` — an
+ * at-risk classification. 0.43.0 shipped the guard on the raw status and
+ * so warned about every untracked branding subdirectory on every build,
+ * while `status --unmanaged` (which expands) reported the same tree
+ * clean. Expanding here is what makes the two agree by construction.
+ *
+ * Expansion is scoped to build-prepare-owned prefixes on both sides of
+ * the walk: a collapsed directory that merely CONTAINS an owned prefix
+ * (`components/` when `components/custom/` is Furnace-managed) is
+ * rewritten to the owned prefixes beneath it, so the enumeration never
+ * walks an unrelated subtree — and never trips the per-directory
+ * expansion cap on a tree whose owned prefixes are small.
+ */
+async function collectOverwrittenEntries(engineDir, status, binaryName, furnacePrefixes) {
+    const ownedPrefixes = buildPrepareOwnedPrefixes(binaryName, furnacePrefixes);
+    const candidates = [];
+    for (const entry of status) {
+        if (isOverwrittenByBuildPrepare(entry.file, binaryName, furnacePrefixes)) {
+            candidates.push(entry);
+            continue;
+        }
+        if (!entry.isUntracked || !entry.file.endsWith('/'))
+            continue;
+        // A collapsed untracked ancestor of an owned prefix: walk only the
+        // owned subtrees under it, never the whole directory.
+        for (const prefix of ownedPrefixes) {
+            if (prefix.startsWith(entry.file)) {
+                candidates.push({ ...entry, file: prefix });
+            }
+        }
+    }
+    if (candidates.length === 0)
+        return [];
+    const expanded = await expandUntrackedDirectoryEntries(engineDir, candidates);
+    // Re-test after expansion: an ancestor rewrite can only widen, and a
+    // directory that survived expansion (nothing untracked under it any
+    // more) carries no content to classify.
+    return expanded.filter((entry) => !entry.file.endsWith('/') &&
+        isOverwrittenByBuildPrepare(entry.file, binaryName, furnacePrefixes));
+}
 /**
  * Finds engine files that build-prepare is about to overwrite and whose
  * current content is recorded nowhere.
@@ -73,7 +126,7 @@ export async function findUnexportedDriftAtRisk(projectRoot, config) {
         if (status.length === 0)
             return [];
         const furnacePrefixes = await collectFurnaceManagedPrefixes(projectRoot);
-        const candidates = status.filter((entry) => isOverwrittenByBuildPrepare(entry.file, config.binaryName, furnacePrefixes));
+        const candidates = await collectOverwrittenEntries(paths.engine, status, config.binaryName, furnacePrefixes);
         if (candidates.length === 0)
             return [];
         const classified = await classifyFiles(candidates, paths.engine, paths.patches, config.binaryName, furnacePrefixes);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hominis/fireforge",
-  "version": "0.43.0",
+  "version": "0.43.1",
   "description": "FireForge — a build tool for customizing Firefox",
   "type": "module",
   "main": "./dist/src/index.js",