@hominis/fireforge 0.43.0 → 0.44.0

package/dist/src/commands/furnace/validate.js

@@ -2,7 +2,8 @@
 import { readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { getProjectPaths } from '../../core/config.js';
-import { furnaceConfigExists, getFurnacePaths, loadFurnaceConfig, } from '../../core/furnace-config.js';
+import { getFurnacePaths, loadFurnaceConfig } from '../../core/furnace-config.js';
+import { assertFurnaceReady } from '../../core/furnace-precondition.js';
 import { addCustomElementRegistration, addJarMnEntries, pruneStaleJarMnEntries, } from '../../core/furnace-registration.js';
 import { validateAllComponents, validateComponent } from '../../core/furnace-validate.js';
 import { FurnaceError } from '../../errors/furnace.js';
@@ -43,9 +44,9 @@ async function autoFixIssues(projectRoot, issues) {
             jarMnFixesByComponent.set(issue.component, existing);
         }
     }
-    // Prune stale jar.mn registrations (lines pointing at removed/renamed
-    // component files — 0.34.0 field report: these broke packaging while
-    // validate --fix reported success without touching them).
+    // Prune stale jar.mn registrations (lines pointing at removed or renamed
+    // component files). These break packaging, and validate --fix must not
+    // report success without touching them.
     if (issues.some((issue) => issue.check === 'stale-jar-registration')) {
         try {
             const pruned = await pruneStaleJarMnEntries(engineDir, furnacePaths.customDir, Object.keys(config.custom));
@@ -84,12 +85,11 @@ async function autoFixIssues(projectRoot, issues) {
     // Repair components missing from customElements.js entirely (reported by
     // validate as `missing-custom-element-registration`).
     //
-    // Scoped to the components named in `issues`. Until 0.41.0 this iterated
-    // every entry in `config.custom`, so `furnace validate <one-component> --fix`
-    // wrote customElements.js registrations for EVERY custom component — outside
-    // the issue list it was handed, and invisibly, since `fixed` was never
-    // incremented here. The block's own comment already claimed this scoping;
-    // the code did not implement it.
+    // Scoped to the components named in `issues`: iterating every entry in
+    // `config.custom` makes `furnace validate <one-component> --fix` write
+    // customElements.js registrations for EVERY custom component, outside the
+    // issue list it was handed and invisibly, since `fixed` is never
+    // incremented here.
     const componentsWithIssues = new Set(issues.map((issue) => issue.component));
     for (const componentName of componentsWithIssues) {
         const customConfig = config.custom[componentName];
@@ -123,10 +123,10 @@ async function autoFixIssues(projectRoot, issues) {
  */
 export async function furnaceValidateCommand(projectRoot, name, options = {}) {
     intro('Furnace Validate');
-    if (!(await furnaceConfigExists(projectRoot))) {
-        throw new FurnaceError('No furnace.json found. Run "fireforge furnace create" or "fireforge furnace override" to get started.');
-    }
-    const config = await loadFurnaceConfig(projectRoot);
+    // Gains the engine rung here: this was the one site in the family that
+    // checked furnace.json alone, so a validate against a missing engine
+    // produced downstream noise instead of the shared precondition refusal.
+    const { config } = await assertFurnaceReady(projectRoot);
     const furnacePaths = getFurnacePaths(projectRoot);
     let totalErrors = 0;
     let totalWarnings = 0;
@@ -193,12 +193,12 @@ export async function furnaceValidateCommand(projectRoot, name, options = {}) {
             }
         }
     }
-    // Auto-fix fixable issues when --fix is passed. The auto-fix counter
-    // returned by `autoFixIssues` only counts function calls that did not
-    // throw — a write that succeeded but did not actually resolve the issue
-    // (e.g. addJarMnEntries appended to a file mach later ignores) would
-    // still bump the count. Re-validate the affected components and compute
-    // the *actual* drop in fixable issues so the reported number is honest.
+    // Auto-fix fixable issues when --fix is passed. The counter returned by
+    // `autoFixIssues` only counts function calls that did not throw — a write
+    // that succeeded but did not actually resolve the issue (addJarMnEntries
+    // appending to a file mach later ignores) would still bump it. Re-validate
+    // the affected components and compute the *actual* drop in fixable issues
+    // so the reported number is honest.
     if (options.fix && allIssues.length > 0) {
         const fixableIssues = allIssues.filter((issue) => FIXABLE_CHECKS.has(issue.check));
         if (fixableIssues.length > 0) {

package/dist/src/commands/import.js

@@ -3,6 +3,8 @@ import { join } from 'node:path';
 import { confirm } from '@clack/prompts';
 import { Command } from 'commander';
 import { getProjectPaths, loadConfig, loadState, updateState } from '../core/config.js';
+import { stdioIsInteractive } from '../core/destructive.js';
+import { assertEngineExists } from '../core/engine-precondition.js';
 import { getHead } from '../core/git.js';
 import { getDirtyFiles } from '../core/git-status.js';
 import { applyPatchesWithContinue, countPatches, createPatchedContentContext, discoverPatches, extractAffectedFiles, matchesUntilFilename, PatchError, } from '../core/patch-apply.js';
@@ -84,14 +86,13 @@ async function checkUncommittedPatchFiles(engineDir, patchesDir, forceImport) {
         if (dirtyFiles.length > 0) {
             const unmanagedDirtyFiles = await getUnmanagedDirtyFiles(engineDir, patchesDir, dirtyFiles);
             if (unmanagedDirtyFiles.length === 0) {
-                // Common path here: operator just ran `fireforge resolve` to
+                // Common path here: the operator just ran `fireforge resolve` to
                 // regenerate a patch from manual conflict edits, so the engine
-                // already carries the patch's effects. The import below will
-                // still re-apply each patch (a no-op for files whose contents
-                // already match), so phrase the line as "no resync needed"
-                // rather than "patches already applied" — the latter contradicts
-                // the "Applied N patch(es)" summary `applyPatchesWithContinue`
-                // prints next, which the 2026-04-25 eval flagged as ambiguous.
+                // already carries the patch's effects. The import below still
+                // re-applies each patch (a no-op for files whose contents already
+                // match), so phrase the line as "no resync needed" rather than
+                // "patches already applied" — the latter contradicts the "Applied N
+                // patch(es)" summary `applyPatchesWithContinue` prints next.
                 info('Patch-touched files already match the stored patch stack — no engine resync needed before re-applying.');
             }
             else if (!forceImport) {
@@ -110,12 +111,12 @@ async function checkUncommittedPatchFiles(engineDir, patchesDir, forceImport) {
 async function handlePatchFailures(summary, projectRoot) {
     const firstFailed = summary.failed[0];
     if (firstFailed) {
-        // Transactional update rather than `loadState` + mutate + `saveState`. The
-        // caller captures `state` at the start of the import run, and the run can
-        // span a long window (drift-check prompt, patch apply loop). A concurrent
-        // command (`fireforge download`, `rebase`, another state mutation) writing
-        // unrelated fields during that window would be silently clobbered when the
-        // stale state object was written back.
+        // Transactional update rather than `loadState` + mutate + `saveState`.
+        // The caller captures `state` at the start of the import run, and the run
+        // can span a long window (drift-check prompt, patch apply loop). A
+        // concurrent command (`fireforge download`, `rebase`, another state
+        // mutation) writing unrelated fields during that window would be silently
+        // clobbered when the stale state object was written back.
         await updateState(projectRoot, (current) => ({
             ...current,
             pendingResolution: {
@@ -155,19 +156,22 @@ async function handlePatchFailures(summary, projectRoot) {
     info('  2. Run "fireforge resolve" to update the patch file with your manual fixes and continue.');
     throw new PatchError(`Failed to apply ${summary.failed.length} patch(es)`, firstFailed?.patch.filename);
 }
-async function checkEngineDrift(engineDir, baseCommit, forceImport) {
+async function checkEngineDrift(engineDir, baseCommit, forceImport, acceptPrompts) {
     const currentHead = await getHead(engineDir);
     if (currentHead === baseCommit)
         return true;
-    if (!(process.stdin.isTTY && process.stdout.isTTY)) {
-        if (!forceImport) {
-            throw new GeneralError('Engine HEAD has drifted from base commit. Re-run with --force to bypass drift check.');
+    // `--yes` and `--force` both answer this prompt; only `--force` also
+    // waives the patch-integrity gate further down.
+    const promptAnswered = forceImport || acceptPrompts;
+    if (!stdioIsInteractive()) {
+        if (!promptAnswered) {
+            throw new GeneralError('Engine HEAD has drifted from base commit. Re-run with --yes to accept the drift, or --force to also bypass the patch-integrity gate.');
         }
-        warn('Engine HEAD has drifted from base commit. Continuing because --force was provided in non-interactive mode.');
+        warn(`Engine HEAD has drifted from base commit. Continuing because ${forceImport ? '--force' : '--yes'} was provided in non-interactive mode.`);
     }
     else {
-        if (forceImport) {
-            warn('Engine HEAD has drifted from base commit. Continuing because --force was provided.');
+        if (promptAnswered) {
+            warn(`Engine HEAD has drifted from base commit. Continuing because ${forceImport ? '--force' : '--yes'} was provided.`);
         }
         else {
             warn('Warning: Engine is not at the baseline commit.');
@@ -200,10 +204,10 @@ function buildUntilFilenameSet(patches, until) {
         return set;
     // Resolve the identifier with the SAME matcher the apply loop uses
     // (`matchesUntilFilename` accepts filenames, extension-less names, AND
-    // bare ordinals). The previous filename-only match meant
-    // `import --until 5` produced an EMPTY scope set — the UI previewed
-    // "0 patches", the integrity gates filtered every in-range issue away —
-    // and then the apply loop happily applied patches 1..5 anyway.
+    // bare ordinals). A filename-only match makes `import --until 5` produce
+    // an EMPTY scope set — the UI previews "0 patches", the integrity gates
+    // filter every in-range issue away — and the apply loop then applies
+    // patches 1..5 anyway.
     const target = patches.find((p) => matchesUntilFilename(p.filename, until));
     if (!target)
         return set;
@@ -280,7 +284,7 @@ async function gateImportIntegrity(paths, untilFilenameSet, until, forceImport)
         if (forceImport) {
             warn('Continuing because --force was provided. Integrity issues were not resolved.\n');
         }
-        else if (!(process.stdin.isTTY && process.stdout.isTTY)) {
+        else if (!stdioIsInteractive()) {
             throw new GeneralError(`Refusing to import while ${integrityIssues.length} patch integrity issue(s) are unresolved. ` +
                 `Fix the issues reported above (see "fireforge doctor") or re-run with --force to continue anyway.`);
         }
@@ -326,15 +330,14 @@ export async function importCommand(projectRoot, options = {}) {
     intro(isDryRun ? 'FireForge Import (dry run)' : 'FireForge Import');
     const continueOnFailure = options.continue ?? false;
     const forceImport = options.force ?? false;
+    const acceptPrompts = options.yes ?? false;
     const paths = getProjectPaths(projectRoot);
     // Check if engine exists
-    if (!(await pathExists(paths.engine))) {
-        throw new GeneralError('Firefox source not found. Run "fireforge download" first.');
-    }
+    await assertEngineExists(paths.engine);
     // Engine consistency check before applying patches
     const state = await loadState(projectRoot);
     if (state.baseCommit && !isDryRun) {
-        const shouldContinue = await checkEngineDrift(paths.engine, state.baseCommit, forceImport);
+        const shouldContinue = await checkEngineDrift(paths.engine, state.baseCommit, forceImport, acceptPrompts);
         if (!shouldContinue)
             return;
     }
@@ -364,15 +367,14 @@ export async function importCommand(projectRoot, options = {}) {
     await assertScopedManifestConsistency(paths.patches, untilFilenameSet, options.until);
     await warnVersionCompatibility(projectRoot, manifest, untilFilenameSet, options.until);
     // Validate patch integrity (detect orphaned modification patches). Warn
-    // and prompt the operator to confirm before proceeding — the legacy
-    // warn-and-continue behaviour hid the real root cause because import
-    // would later fail during patch application with a secondary, unrelated
-    // error that made diagnosis harder.
+    // and prompt the operator to confirm before proceeding: warn-and-continue
+    // hides the real root cause, because import then fails during patch
+    // application with a secondary, unrelated error.
     //
     // Scope the surfaced issues to the `--until` range: a later patch with
     // integrity problems should not block importing an earlier good subset,
-    // which is exactly what operators reach for when the tail of the queue
-    // is broken and they want to keep working against an earlier checkpoint.
+    // which is exactly what operators reach for when the tail of the queue is
+    // broken and they want to keep working against an earlier checkpoint.
     const integrityOk = await gateImportIntegrity(paths, untilFilenameSet, options.until, forceImport);
     if (!integrityOk)
         return;
@@ -426,6 +428,11 @@ export function registerImport(program, { getProjectRoot, withErrorHandling }) {
         .description('Apply patches from the patches directory')
         .option('--continue', 'Continue applying patches even if one fails')
         .option('-f, --force', 'Proceed despite engine drift and overwrite unmanaged changes in patch-touched files')
+        // NOT an alias of --force. `--force` waives two orthogonal things: the
+        // drift prompt AND the patch-integrity gate. `--yes` waives only the
+        // prompt, so a scripted import can run unattended while the integrity
+        // refusal stays armed — which is the guard you actually want in CI.
+        .option('-y, --yes', 'Answer the drift prompt non-interactively. Unlike --force, this does NOT waive the patch-integrity gate.')
         .option('--until <patch>', 'Apply patches only up to and including this patch (alias: --stop-at)')
         .option('--stop-at <patch>', 'Alias for --until')
         .option('--dry-run', 'Preview which patches would be applied without modifying the engine')

package/dist/src/commands/lint-per-patch.js

@@ -3,8 +3,8 @@ import { join } from 'node:path';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { getDiffForFilesAgainstHead } from '../core/git-diff.js';
 import { withPrivateGitIndex } from '../core/git-readonly-index.js';
-import { buildPerPatchLintCacheKey, getCachedPerPatchLintIssues, getPerPatchLintCacheHeadSha, loadPerPatchLintCache, savePerPatchLintCache, setCachedPerPatchLintIssues, } from '../core/lint-cache.js';
 import { buildPatchQueueContext, countNonBinaryDiffLines, formatPatchLintIssue, lintExportedPatch, lintPatchQueue, resolvePatchSizeTier, } from '../core/patch-lint.js';
+import { buildPerPatchLintCacheKey, getCachedPerPatchLintIssues, getPerPatchLintCacheHeadSha, loadPerPatchLintCache, savePerPatchLintCache, setCachedPerPatchLintIssues, } from '../core/patch-lint-cache.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { evaluatePatchPolicy } from '../core/patch-policy.js';
 import { GeneralError } from '../errors/base.js';
@@ -106,7 +106,12 @@ async function lintQueuedPatch(patch, lintCtx) {
         }
         lintOptions.precomputedCheckJs = precomputedCheckJs;
     }
-    const patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, ctx, ignore, patch.tier, lintOptions);
+    const patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, {
+        ...lintOptions,
+        patchQueueCtx: ctx,
+        ...(ignore ? { ignoreChecks: ignore } : {}),
+        ...(patch.tier ? { patchTier: patch.tier } : {}),
+    });
     const result = {
         status: 'linted',
         existingFiles: existing,
@@ -155,10 +160,10 @@ async function applyPerPatchResults(subset, results, issues, checkJs, cache) {
         // Run-level checkJs errors are emitted once, before the first
         // non-skipped patch's own issues — matching the serial emit point.
         // Deliberately NOT gated on `result.usedCheckJs`: global findings are
-        // run-level, never cached, and an all-cache-hit run previously dropped
-        // them entirely, letting a warm run report fewer errors than a cold
-        // one (hardening). PerRunCheckJs builds its program lazily,
-        // so the cost only materialises when checkJs is configured.
+        // run-level and never cached, so gating drops them entirely on an
+        // all-cache-hit run and lets a warm run report fewer errors than a cold
+        // one. PerRunCheckJs builds its program lazily, so the cost only
+        // materialises when checkJs is configured.
         if (checkJs && !globalCheckJsEmitted) {
             globalCheckJsEmitted = true;
             issues.push(...(await checkJs.getGlobal()));
@@ -170,10 +175,10 @@ async function applyPerPatchResults(subset, results, issues, checkJs, cache) {
         for (const issue of result.rawIssues) {
             issues.push({ ...issue, file: `${patch.filename} :: ${issue.file}` });
         }
-        // A waived size finding still reports its MEASUREMENT:
-        // the finding stays suppressed (no exit-code / --max-warnings effect)
-        // but the current count is readable from the tool that enforces it,
-        // so a waiver's cited size can be calibrated without hand-measuring.
+        // A waived size finding still reports its MEASUREMENT: the finding stays
+        // suppressed (no exit-code / --max-warnings effect) but the current count
+        // is readable from the tool that enforces it, so a waiver's cited size
+        // can be calibrated without hand-measuring.
         for (const suppressedIssue of result.suppressedIssues) {
             if (!SUPPRESSED_SIZE_CHECKS.has(suppressedIssue.check))
                 continue;

package/dist/src/commands/lint-per-run-checkjs.d.ts

@@ -3,22 +3,22 @@
  * `re-export`.
  *
  * The dominant fixed cost of patch lint is one `ts.createProgram` over the
- * queue's patch-owned `.sys.mjs` files (~37 s on a 290-patch consumer
- * queue). This controller builds that program at most ONCE per command
- * invocation (lazily, promise-memoised) and lets callers slice per-patch
- * findings out of the grouped result. Three levers keep the cost paid only
- * when it buys something:
+ * queue's patch-owned `.sys.mjs` files — tens of seconds on a large queue.
+ * This controller builds that program at most ONCE per command invocation
+ * (lazily, promise-memoised) and lets callers slice per-patch findings out of
+ * the grouped result. Three levers keep the cost paid only when it buys
+ * something:
  *
  * - **Lazy build**: nothing is built until the first cache miss asks.
  * - **Root scoping** (`rootScopePatches`): with `--patches <subset>` the
- *   program's roots are only the subset's owned files; the full queue
- *   stays resolvable, so cross-patch imports type-check identically while
- * unrelated files are never parsed.
- * - **Warm-run probe**: run-level ("global") checkJs findings come only
- *   from a missing `typescript` package or an unreadable shim — never
- *   from the built program — so an all-cache-hit run satisfies "warm
- * never reports less than cold" via
- *   `probeCheckJsGlobalIssues` instead of building anything.
+ *   program's roots are only the subset's owned files; the full queue stays
+ *   resolvable, so cross-patch imports type-check identically while
+ *   unrelated files are never parsed.
+ * - **Warm-run probe**: run-level ("global") checkJs findings come only from
+ *   a missing `typescript` package or an unreadable shim — never from the
+ *   built program — so an all-cache-hit run satisfies "warm never reports
+ *   less than cold" via `probeCheckJsGlobalIssues` instead of building
+ *   anything.
  */
 import type { getProjectPaths, loadConfig } from '../core/config.js';
 import { type GroupedCheckJsResult } from '../core/patch-lint-checkjs.js';

package/dist/src/commands/lint-per-run-checkjs.js

@@ -4,22 +4,22 @@
  * `re-export`.
  *
  * The dominant fixed cost of patch lint is one `ts.createProgram` over the
- * queue's patch-owned `.sys.mjs` files (~37 s on a 290-patch consumer
- * queue). This controller builds that program at most ONCE per command
- * invocation (lazily, promise-memoised) and lets callers slice per-patch
- * findings out of the grouped result. Three levers keep the cost paid only
- * when it buys something:
+ * queue's patch-owned `.sys.mjs` files — tens of seconds on a large queue.
+ * This controller builds that program at most ONCE per command invocation
+ * (lazily, promise-memoised) and lets callers slice per-patch findings out of
+ * the grouped result. Three levers keep the cost paid only when it buys
+ * something:
  *
  * - **Lazy build**: nothing is built until the first cache miss asks.
  * - **Root scoping** (`rootScopePatches`): with `--patches <subset>` the
- *   program's roots are only the subset's owned files; the full queue
- *   stays resolvable, so cross-patch imports type-check identically while
- * unrelated files are never parsed.
- * - **Warm-run probe**: run-level ("global") checkJs findings come only
- *   from a missing `typescript` package or an unreadable shim — never
- *   from the built program — so an all-cache-hit run satisfies "warm
- * never reports less than cold" via
- *   `probeCheckJsGlobalIssues` instead of building anything.
+ *   program's roots are only the subset's owned files; the full queue stays
+ *   resolvable, so cross-patch imports type-check identically while
+ *   unrelated files are never parsed.
+ * - **Warm-run probe**: run-level ("global") checkJs findings come only from
+ *   a missing `typescript` package or an unreadable shim — never from the
+ *   built program — so an all-cache-hit run satisfies "warm never reports
+ *   less than cold" via `probeCheckJsGlobalIssues` instead of building
+ *   anything.
  */
 import { invokePatchLintCheckJsGrouped, probeCheckJsGlobalIssues, runCheckJsTestFilesGrouped, } from '../core/patch-lint-checkjs.js';
 import { isTestScriptFile, resolvePatchOwnedSysMjs, resolvePatchOwnedTestScripts, } from '../core/patch-lint-ownership.js';

package/dist/src/commands/lint-report.js

@@ -1,14 +1,13 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
  * Machine-readable per-patch lint report (`lint --per-patch --report
- * <path>`, + G10). One mechanism serves both observability
- * gaps: consumers get each patch's size metrics against the SAME
- * thresholds the size rules fire on (no more mirroring
- * `countNonBinaryDiffLines`), and lintIgnore-suppressed issues stay
- * visible with their measurements instead of vanishing.
+ * <path>`). One mechanism serves two observability gaps: consumers get each
+ * patch's size metrics against the SAME thresholds the size rules fire on,
+ * instead of mirroring `countNonBinaryDiffLines`, and lintIgnore-suppressed
+ * issues stay visible with their measurements rather than vanishing.
  *
- * Helper module consumed by lint-per-patch.ts; no registrar is exported
- * and none is wanted.
+ * Helper module consumed by lint-per-patch.ts; no registrar is exported and
+ * none is wanted.
  */
 import { getPatchSizeThresholds, resolvePatchSizeTier, } from '../core/patch-lint.js';
 import { writeJson } from '../utils/fs.js';

package/dist/src/commands/lint.d.ts

@@ -11,25 +11,24 @@ export interface AggregateLintIgnoreResult {
     dropped: number;
 }
 /**
- * Filters aggregate-mode lint issues against per-patch `lintIgnore`
- * lists drawn from the manifest. An issue is dropped when at least one
- * patch whose `filesAffected` covers `issue.file` lists `issue.check`
- * in its `lintIgnore`.
+ * Filters aggregate-mode lint issues against per-patch `lintIgnore` lists
+ * drawn from the manifest. An issue is dropped when at least one patch whose
+ * `filesAffected` covers `issue.file` lists `issue.check` in its
+ * `lintIgnore`.
  *
- * Mirrors the per-patch contract: `--per-patch` mode threads each
- * patch's `lintIgnore` directly into `lintExportedPatch`, so a check
- * the operator explicitly waived in `patches.json` does not surface.
- * Aggregate `--since` mode previously rediscovered the suppressed
- * warning every CI run because the diff was treated as a single unit
- * with no patch-level scope. Attributing each issue's file to its
+ * Mirrors the per-patch contract: `--per-patch` mode threads each patch's
+ * `lintIgnore` directly into `lintExportedPatch`, so a check the operator
+ * explicitly waived in `patches.json` does not surface. Aggregate `--since`
+ * mode has no patch-level scope of its own and would otherwise rediscover
+ * the suppressed warning every CI run. Attributing each issue's file to its
  * owning patch via `filesAffected` re-establishes the same suppression
- * semantics. Cross-patch findings (forward-import, duplicate-creation)
- * still attribute via `issue.file` because the `file` field is the
- * offending site, which is owned by some patch.
+ * semantics. Cross-patch findings (forward-import, duplicate-creation) also
+ * attribute via `issue.file`, which is the offending site and is owned by
+ * some patch.
  *
- * Multiple owners: an issue is dropped if **any** owning patch waived
- * the rule. Conservative — never adds new findings, only drops
- * already-explicitly-waived ones.
+ * Multiple owners: an issue is dropped if **any** owning patch waived the
+ * rule. Conservative — never adds new findings, only drops already-waived
+ * ones.
  *
  * @param issues - Issues collected from the aggregate lint run.
  * @param ctx - Patch queue context used to attribute file → patch.