@hominis/fireforge 0.43.1 → 0.44.0

package/dist/src/commands/export-all.js

@@ -2,8 +2,10 @@
 import { Command } from 'commander';
 import { isBrandingManagedPath } from '../core/branding.js';
 import { getProjectPaths, loadConfig } from '../core/config.js';
+import { stdioIsInteractive } from '../core/destructive.js';
+import { assertEngineGitReady } from '../core/engine-precondition.js';
 import { collectFurnaceManagedPrefixes, furnaceConfigExists, loadFurnaceConfig, } from '../core/furnace-config.js';
-import { hasChanges, isGitRepository } from '../core/git.js';
+import { hasChanges } from '../core/git.js';
 import { getAllDiff, getDiffForFilesAgainstHead } from '../core/git-diff.js';
 import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from '../core/git-status.js';
 import { extractAffectedFiles } from '../core/patch-apply.js';
@@ -14,7 +16,7 @@ import { buildPatchSourceMetadata } from '../core/patch-source-metadata.js';
 import { GeneralError } from '../errors/base.js';
 import { ensureDir, pathExists } from '../utils/fs.js';
 import { info, intro, outro, spinner } from '../utils/logger.js';
-import { pickDefined } from '../utils/options.js';
+import { addWaitLockOption, pickDefined, resolveWaitLockSeconds } from '../utils/options.js';
 import { renderDryRunPreview } from './export-flow.js';
 import { autoFixLicenseHeaders, promptExportPatchMetadata, runPatchLint, runSupersedeAndOverlapGates, } from './export-shared.js';
 async function checkBrandingManagedFiles(paths, config) {
@@ -46,9 +48,7 @@ async function resolveFurnaceExclusionPolicy(paths, projectRoot, excludeFurnace)
     // Expand collapsed `?? dir/` entries before matching against Furnace
     // prefixes — otherwise a Furnace-introduced directory slips past the
     // filter and later lands in the non-Furnace path list that feeds the
-    // aggregate diff, where `getDiffForFilesAgainstHead` crashes with
-    // EISDIR (eval finding: export-all unusable on a fresh project with
-    // Furnace scaffolding).
+    // aggregate diff, where `getDiffForFilesAgainstHead` crashes with EISDIR.
     const rawStatus = await getWorkingTreeStatus(paths.engine);
     const changedFiles = await expandUntrackedDirectoryEntries(paths.engine, rawStatus);
     const furnaceManagedFiles = changedFiles
@@ -66,20 +66,19 @@ async function resolveFurnaceExclusionPolicy(paths, projectRoot, excludeFurnace)
 }
 /**
  * Refuses the export when the resulting patch would register furnace
- * component source files it does not itself carry. 2026-04-24 eval
- * Finding 1: operators running `export-all --exclude-furnace` after
- * `furnace create --localized --with-tests` ended up with patches that
- * added `toolkit/content/widgets/moz-qa-panel/*` via jar.mn /
- * customElements.js / locale jar.mn but excluded the component source
- * files themselves. The resulting patch queue was structurally broken
- * and `fireforge verify` stayed silent. We now detect the condition
- * pre-write and ask the operator to either include the component
- * sources (skip `--exclude-furnace`) or revert the furnace changes
- * before exporting.
+ * component source files it does not itself carry.
+ *
+ * `export-all --exclude-furnace` after `furnace create --localized
+ * --with-tests` otherwise produces a patch that adds
+ * `toolkit/content/widgets/<tag>/*` via jar.mn / customElements.js / locale
+ * jar.mn while excluding the component source files themselves — a
+ * structurally broken queue that `fireforge verify` stays silent about. The
+ * operator is asked to either include the component sources (skip
+ * `--exclude-furnace`) or revert the furnace changes before exporting.
  *
  * The check runs against the synthesised patch body before
- * `commitExportedPatch` writes anything, so no broken patch is left on
- * disk when the refusal fires.
+ * `commitExportedPatch` writes anything, so no broken patch is left on disk
+ * when the refusal fires.
  */
 async function checkDanglingFurnaceRegistrations(projectRoot, diff, furnaceExcluded) {
     if (furnaceExcluded.size === 0)
@@ -171,14 +170,7 @@ export async function exportAllCommand(projectRoot, options = {}) {
     const isDryRun = options.dryRun === true;
     intro(isDryRun ? 'FireForge Export All (dry run)' : 'FireForge Export All');
     const paths = getProjectPaths(projectRoot);
-    // Check if engine exists
-    if (!(await pathExists(paths.engine))) {
-        throw new GeneralError('Firefox source not found. Run "fireforge download" first.');
-    }
-    // Check if it's a git repository
-    if (!(await isGitRepository(paths.engine))) {
-        throw new GeneralError('Engine directory is not a git repository. Run "fireforge download" to initialize.');
-    }
+    await assertEngineGitReady(paths.engine);
     // Check for changes
     if (!(await hasChanges(paths.engine))) {
         info('No changes to export');
@@ -228,13 +220,13 @@ export async function exportAllCommand(projectRoot, options = {}) {
     // the aggregate would newly create, so it runs here instead of alongside
     // the branding / furnace guards that operate on the raw status list.
     await checkDuplicateNewFileCreations(paths, diff);
-    // Dangling-furnace-registration preflight (Finding 1). Runs after the
-    // diff is assembled so we can inspect the exact hunks the operator is
-    // about to land; runs BEFORE any write so a refusal leaves the
-    // patches directory untouched.
+    // Dangling-furnace-registration preflight. Runs after the diff is
+    // assembled so it can inspect the exact hunks the operator is about to
+    // land, and BEFORE any write so a refusal leaves the patches directory
+    // untouched.
     await checkDanglingFurnaceRegistrations(projectRoot, diff, furnaceExcluded);
     // Check for non-interactive mode
-    const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
+    const isInteractive = stdioIsInteractive();
     // Auto-fix missing license headers on new files (interactive only;
     // report-only under --dry-run so the preview never mutates engine/)
     const headersAdded = await autoFixLicenseHeaders(paths.engine, diff, config, isInteractive, isDryRun);
@@ -308,6 +300,10 @@ export async function exportAllCommand(projectRoot, options = {}) {
             config,
             policyCommand: 'export-all',
             forceUnsafe: options.forceUnsafe === true,
+            lockOptions: {
+                waitLockSeconds: resolveWaitLockSeconds(options.waitLock),
+                command: 'export-all',
+            },
         });
         for (const oldPatch of superseded) {
             info(`Superseded: ${oldPatch.filename}`);
@@ -326,7 +322,7 @@ export async function exportAllCommand(projectRoot, options = {}) {
 }
 /** Registers the export-all command on the CLI program. */
 export function registerExportAll(program, { getProjectRoot, withErrorHandling }) {
-    program
+    const command = program
         .command('export-all')
         .description('Export all changes as a patch')
         .option('--name <name>', 'Name for the patch')
@@ -337,8 +333,8 @@ export function registerExportAll(program, { getProjectRoot, withErrorHandling }
         .option('--exclude-furnace', 'Export the non-Furnace subset of the aggregate diff instead of refusing when Furnace-managed files are modified. Furnace-managed files are still deployed by "fireforge furnace apply"; this flag only changes whether export-all aborts or filters in their presence.')
         .option('--allow-overlap', 'Acknowledge cross-patch ownership overlap with non-superseded patches (the resulting queue fails verify). Does not bypass the new-file creation guard — two patches creating the same path is structurally unrecoverable, so that case still refuses regardless of this flag.')
         .option('--dry-run', 'Print the export-all plan (filename, metadata, files affected, supersede preview) without writing anything to patches/. Lint still runs so the operator sees the same lint output a real run would produce.')
-        .option('--force-unsafe', 'Bypass force-mode patchPolicy refusals')
-        .action(withErrorHandling(async (options) => {
+        .option('--force-unsafe', 'Bypass force-mode patchPolicy refusals');
+    addWaitLockOption(command).action(withErrorHandling(async (options) => {
         const { category, ...rest } = options;
         await exportAllCommand(getProjectRoot(), {
             ...pickDefined(rest),

package/dist/src/commands/export-flow.js

@@ -195,12 +195,12 @@ export async function projectPlacementForLint(patchesDir, plan, diff, config) {
             return entry;
         return { ...entry, filename: rename.newFilename, order: rename.newOrder };
     });
-    // Synthetic entry for the pending patch, populated with both its
-    // new-file content AND its added-line content for files it modifies
-    // so the forward-import rule can inspect imports the patch *itself*
-    // authors — whether they live in a brand-new file or are added to an
-    // existing file. Leaving either map empty lets a patch land before
-    // one of its own dependencies and still pass the gate.
+    // Synthetic entry for the pending patch, populated with both its new-file
+    // content AND its added-line content for files it modifies, so the
+    // forward-import rule can inspect imports the patch *itself* authors —
+    // whether they live in a brand-new file or are added to an existing one.
+    // Leaving either map empty lets a patch land before one of its own
+    // dependencies and still pass the gate.
     projectedEntries.push({
         filename: plan.newFilename,
         order: plan.insertionOrder,

package/dist/src/commands/export-placement-conflicts.js

@@ -1,16 +1,17 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
  * Attribution of projected placement lint errors, split out of
- * export-flow.ts for the line budget. A placement projection lints one
- * merged queue — the renumbered existing patches plus a synthetic entry
- * for the pending patch — so its errors used to render as one flat list
- * that read as though the NEW patch caused every one of them. A
- * renumbering that re-evaluates pre-existing staged relationships (455
- * importing a module created by 456, legal only at their current
- * ordinals) then sent the operator auditing a perfectly fine export.
+ * export-flow.ts for the line budget.
  *
- * Consumed by export-flow.ts; no top-level registrar is exported and none
- * is wanted.
+ * A placement projection lints one merged queue — the renumbered existing
+ * patches plus a synthetic entry for the pending patch — so a flat error
+ * list reads as though the NEW patch caused every one of them. A renumbering
+ * that re-evaluates pre-existing staged relationships (patch 455 importing a
+ * module created by 456, legal only at their current ordinals) then sends
+ * the operator auditing a perfectly fine export.
+ *
+ * Consumed by export-flow.ts; no top-level registrar is exported and none is
+ * wanted.
  */
 import { formatPatchLintIssue } from '../core/patch-lint.js';
 /**

package/dist/src/commands/export-placement-gate.js

@@ -70,10 +70,10 @@ export async function gatePlacementPlan(args) {
     const summary = placementSummary(placementPlan);
     const renameCount = placementPlan.renameMap.size;
     // Route through confirmDestructive when the operation is destructive
-    // enough to warrant a prompt (more than one rename) OR when the user
-    // asked for a dry-run. The dry-run branch must always print the
-    // placement summary — previously, single-rename/no-rename dry-runs
-    // exited silently with no filename or projected layout.
+    // enough to warrant a prompt (more than one rename) OR when the user asked
+    // for a dry-run. The dry-run branch must always print the placement
+    // summary; otherwise single-rename and no-rename dry-runs exit silently
+    // with no filename or projected layout.
     if (renameCount > 1 || isDryRun) {
         s.stop();
         const decision = await confirmDestructive({
@@ -89,7 +89,7 @@ export async function gatePlacementPlan(args) {
             outro('Dry run complete — no changes made');
             return 'stop';
         }
-        if (decision === 'cancelled') {
+        if (decision === 'declined') {
             outro('Export cancelled');
             return 'stop';
         }

package/dist/src/commands/export-shared.d.ts

@@ -3,26 +3,26 @@ import type { ExportOptions, PatchCategory } from '../types/commands/index.js';
 import type { FireForgeConfig } from '../types/config.js';
 import type { SpinnerHandle } from '../utils/logger.js';
 /**
- * Runs the full patch lint pipeline and reports results.
- * Warnings are always displayed. Errors block the export unless skipLint is true.
+ * Runs the full patch lint pipeline and reports results. Warnings are always
+ * displayed. Errors block the export unless skipLint is true.
  *
  * @param engineDir - Engine root directory
  * @param filesAffected - Files touched by the patch
  * @param diffContent - Raw unified diff string
  * @param config - Project configuration
  * @param skipLint - If true, downgrade errors to warnings
- * @param patchQueueCtx - Optional cross-patch context for ownership resolution
+ * @param patchQueueCtx - Optional cross-patch context for ownership
+ *   resolution
  * @param ignoreChecks - Optional per-patch set of `check` IDs to suppress
  *   (threaded from `PatchMetadata.lintIgnore`). Surgical alternative to
  *   `--skip-lint` when exactly one advisory rule does not apply to a
- *   specific patch — e.g. `large-patch-lines` on a cohesive branding
- *   bundle that genuinely cannot be split.
+ *   specific patch — e.g. `large-patch-lines` on a cohesive branding bundle
+ *   that genuinely cannot be split.
  * @param patchTier - Optional explicit tier override (threaded from
- *   `PatchMetadata.tier`). Forces the branding-tier thresholds when
- *   set, independent of the auto-detect allowlist. When the branding
- *   tier is applied (either via this opt-in or the auto-detect), a
- *   single `info()` line surfaces the choice so the tier decision is
- *   visible rather than silent.
+ *   `PatchMetadata.tier`). Forces the branding-tier thresholds when set,
+ *   independent of the auto-detect allowlist. When the branding tier is
+ *   applied, a single `info()` line surfaces the choice so the tier decision
+ *   is visible rather than silent.
  */
 export declare function runPatchLint(engineDir: string, filesAffected: string[], diffContent: string, config: FireForgeConfig, skipLint?: boolean, patchQueueCtx?: import('../core/patch-lint-cross.js').PatchQueueContext, ignoreChecks?: ReadonlySet<string>, patchTier?: 'branding'): Promise<void>;
 /**
@@ -55,18 +55,18 @@ export declare function confirmSupersedePatches(patchesDir: string, filesAffecte
 /**
  * Detects new files missing license headers and offers to add them.
  *
- * In interactive mode the user is prompted before any files are modified.
- * In non-interactive mode the function is a no-op — the existing lint error
- * will block the export instead.
+ * In interactive mode the user is prompted before any files are modified. In
+ * non-interactive mode the function is a no-op — the existing lint error
+ * blocks the export instead.
  *
  * @param engineDir - Absolute path to engine directory
  * @param diffContent - Current unified diff
  * @param config - Project configuration
  * @param isInteractive - Whether interactive prompts are available
  * @param dryRun - When true, only REPORT missing headers, never prompt or
- *   write. Dry-run must stay read-only: before this flag existed, an
- *   interactive `export --dry-run` prompted (default Yes) and wrote license
- *   headers into engine/ files, then closed with "no changes made".
+ *   write. Dry-run must stay read-only: without this flag an interactive
+ *   `export --dry-run` prompts (default Yes), writes license headers into
+ *   engine/ files, and then closes with "no changes made".
  * @returns true if files were modified on disk (caller must regenerate diff)
  */
 export declare function autoFixLicenseHeaders(engineDir: string, diffContent: string, config: FireForgeConfig, isInteractive: boolean, dryRun?: boolean): Promise<boolean>;
@@ -83,19 +83,17 @@ export declare function autoFixLicenseHeaders(engineDir: string, diffContent: st
 export declare function findPartialOwnershipOverlap(manifest: PatchesManifest, filesAffected: string[], excludeFilenames: ReadonlySet<string>): Map<string, string[]>;
 /**
  * Gate that refuses the default export path when the new patch would
- * silently claim files that are already tracked by other non-superseded
- * patches. `findAllPatchesForFiles` already catches the full-coverage
- * supersede case — this helper fills the gap for partial overlap, which
- * was the eval finding #12 scenario (two patches both claiming
- * `browser/themes/shared/jar.inc.mn` after a second export with
- * `--before`).
+ * silently claim files already tracked by other non-superseded patches.
+ * `findAllPatchesForFiles` catches the full-coverage supersede case; this
+ * fills the gap for PARTIAL overlap — two patches both claiming e.g.
+ * `browser/themes/shared/jar.inc.mn` after a second export with `--before`.
  *
  * Proceeds silently when there is no overlap, or when the caller passed
  * `--allow-overlap`. In interactive mode the caller is prompted to
  * acknowledge the overlap (the proper fix path is `re-export --files` to
  * repartition ownership, so the prompt surfaces that pointer). In
- * non-interactive mode the function throws — better to fail fast than
- * let the queue fall out of sync with verify.
+ * non-interactive mode it throws — better to fail fast than let the queue
+ * fall out of sync with verify.
  */
 export declare function guardOwnershipOverlap(args: {
     patchesDir: string;
@@ -107,13 +105,12 @@ export declare function guardOwnershipOverlap(args: {
 }): Promise<boolean>;
 /**
  * Runs the two pre-commit gates shared by `export` and `export-all` in
- * order: the supersede confirmation, then the cross-patch ownership
- * overlap guard. The overlap guard receives the filenames of the patches
- * the export would fully supersede so it does not flag a file claimed by
- * a patch that is about to be removed (pre-0.16.0 `export` only caught
- * FULL-coverage supersedes, so a second export targeting a shared file
- * like `browser/themes/shared/jar.inc.mn` created a queue where two
- * patches both claimed the file and `verify` failed immediately).
+ * order: the supersede confirmation, then the cross-patch ownership overlap
+ * guard. The overlap guard receives the filenames of the patches the export
+ * would fully supersede so it does not flag a file claimed by a patch that
+ * is about to be removed. Catching only FULL-coverage supersedes leaves a
+ * second export targeting a shared file creating a queue where two patches
+ * both claim it and `verify` fails immediately.
  *
  * @param args - Gate inputs shared by both export commands
  * @param args.patchesDir - Absolute path of the patches directory
@@ -122,8 +119,8 @@ export declare function guardOwnershipOverlap(args: {
  * @param args.allowOverlap - The command's `--allow-overlap` flag
  * @param args.isInteractive - Whether prompting the operator is possible
  * @param args.s - Active spinner, stopped before any prompt
- * @returns `true` when both gates passed; `false` when the operator
- *   declined (the caller returns without committing)
+ * @returns `true` when both gates passed; `false` when the operator declined
+ *   (the caller returns without committing)
  */
 export declare function runSupersedeAndOverlapGates(args: {
     patchesDir: string;

package/dist/src/commands/export-shared.js

@@ -10,36 +10,36 @@ import { getPatchPolicyCategories, isCategoryAllowedByConfig } from '../core/pat
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { pathExists, readText } from '../utils/fs.js';
 import { cancel, info, isCancel, warn } from '../utils/logger.js';
-import { normalizePatchDisplayName, PATCH_CATEGORIES, validatePatchName, } from '../utils/validation.js';
+import { describePatchNameProblem, normalizePatchDisplayName, PATCH_CATEGORIES, } from '../utils/validation.js';
 /**
- * Runs the full patch lint pipeline and reports results.
- * Warnings are always displayed. Errors block the export unless skipLint is true.
+ * Runs the full patch lint pipeline and reports results. Warnings are always
+ * displayed. Errors block the export unless skipLint is true.
  *
  * @param engineDir - Engine root directory
  * @param filesAffected - Files touched by the patch
  * @param diffContent - Raw unified diff string
  * @param config - Project configuration
  * @param skipLint - If true, downgrade errors to warnings
- * @param patchQueueCtx - Optional cross-patch context for ownership resolution
+ * @param patchQueueCtx - Optional cross-patch context for ownership
+ *   resolution
  * @param ignoreChecks - Optional per-patch set of `check` IDs to suppress
  *   (threaded from `PatchMetadata.lintIgnore`). Surgical alternative to
  *   `--skip-lint` when exactly one advisory rule does not apply to a
- *   specific patch — e.g. `large-patch-lines` on a cohesive branding
- *   bundle that genuinely cannot be split.
+ *   specific patch — e.g. `large-patch-lines` on a cohesive branding bundle
+ *   that genuinely cannot be split.
  * @param patchTier - Optional explicit tier override (threaded from
- *   `PatchMetadata.tier`). Forces the branding-tier thresholds when
- *   set, independent of the auto-detect allowlist. When the branding
- *   tier is applied (either via this opt-in or the auto-detect), a
- *   single `info()` line surfaces the choice so the tier decision is
- *   visible rather than silent.
+ *   `PatchMetadata.tier`). Forces the branding-tier thresholds when set,
+ *   independent of the auto-detect allowlist. When the branding tier is
+ *   applied, a single `info()` line surfaces the choice so the tier decision
+ *   is visible rather than silent.
  */
 export async function runPatchLint(engineDir, filesAffected, diffContent, config, skipLint, patchQueueCtx, ignoreChecks, patchTier) {
-    // Compute the tier decision independently of the lint pipeline so the
-    // decision can be surfaced even when the rule body emitted no issues
-    // (e.g. a branding patch under the soft threshold still benefits from
-    // operators knowing which tier governed the run). The same helper is
-    // reused inside `lintPatchSize`, so the surfaced tier and the tier
-    // that actually drove the thresholds never drift.
+    // Compute the tier decision independently of the lint pipeline so it can
+    // be surfaced even when the rule body emitted no issues — a branding patch
+    // under the soft threshold still benefits from operators knowing which
+    // tier governed the run. The same helper is reused inside `lintPatchSize`,
+    // so the surfaced tier and the tier that actually drove the thresholds
+    // never drift.
     const tierDecision = resolvePatchSizeTier(filesAffected, patchTier);
     if (tierDecision.tier === 'branding') {
         info(tierDecision.source === 'explicit'
@@ -54,7 +54,12 @@ export async function runPatchLint(engineDir, filesAffected, diffContent, config
     const checkJsReportScope = patchQueueCtx
         ? resolvePatchOwnedSysMjs(detectNewFilesInDiff(diffContent))
         : undefined;
-    const issues = await lintExportedPatch(engineDir, filesAffected, diffContent, config, patchQueueCtx, ignoreChecks, patchTier, checkJsReportScope ? { checkJsReportScope } : undefined);
+    const issues = await lintExportedPatch(engineDir, filesAffected, diffContent, config, {
+        ...(patchQueueCtx ? { patchQueueCtx } : {}),
+        ...(ignoreChecks ? { ignoreChecks } : {}),
+        ...(patchTier ? { patchTier } : {}),
+        ...(checkJsReportScope ? { checkJsReportScope } : {}),
+    });
     reportPatchLintOutcome(issues, skipLint);
 }
 /**
@@ -115,7 +120,7 @@ export async function promptExportPatchMetadata(options, isInteractive, commandN
     // both name shapes.
     let patchName = options.name?.trim().replace(/\.patch$/i, '');
     if (patchName) {
-        const validationError = validatePatchName(patchName);
+        const validationError = describePatchNameProblem(patchName);
         if (validationError) {
             throw new InvalidArgumentError(validationError, '--name');
         }
@@ -127,7 +132,7 @@ export async function promptExportPatchMetadata(options, isInteractive, commandN
         const nameResult = await text({
             message: 'Enter a name for this patch:',
             placeholder: commandName === 'export' ? 'my-change' : 'my-changes',
-            validate: (value) => validatePatchName((value ?? '').trim()),
+            validate: (value) => describePatchNameProblem((value ?? '').trim()),
         });
         if (isCancel(nameResult)) {
             cancel('Export cancelled');
@@ -217,18 +222,18 @@ export async function confirmSupersedePatches(patchesDir, filesAffected, superse
 /**
  * Detects new files missing license headers and offers to add them.
  *
- * In interactive mode the user is prompted before any files are modified.
- * In non-interactive mode the function is a no-op — the existing lint error
- * will block the export instead.
+ * In interactive mode the user is prompted before any files are modified. In
+ * non-interactive mode the function is a no-op — the existing lint error
+ * blocks the export instead.
  *
  * @param engineDir - Absolute path to engine directory
  * @param diffContent - Current unified diff
  * @param config - Project configuration
  * @param isInteractive - Whether interactive prompts are available
  * @param dryRun - When true, only REPORT missing headers, never prompt or
- *   write. Dry-run must stay read-only: before this flag existed, an
- *   interactive `export --dry-run` prompted (default Yes) and wrote license
- *   headers into engine/ files, then closed with "no changes made".
+ *   write. Dry-run must stay read-only: without this flag an interactive
+ *   `export --dry-run` prompts (default Yes), writes license headers into
+ *   engine/ files, and then closes with "no changes made".
  * @returns true if files were modified on disk (caller must regenerate diff)
  */
 export async function autoFixLicenseHeaders(engineDir, diffContent, config, isInteractive, dryRun = false) {
@@ -324,19 +329,17 @@ export function findPartialOwnershipOverlap(manifest, filesAffected, excludeFile
 }
 /**
  * Gate that refuses the default export path when the new patch would
- * silently claim files that are already tracked by other non-superseded
- * patches. `findAllPatchesForFiles` already catches the full-coverage
- * supersede case — this helper fills the gap for partial overlap, which
- * was the eval finding #12 scenario (two patches both claiming
- * `browser/themes/shared/jar.inc.mn` after a second export with
- * `--before`).
+ * silently claim files already tracked by other non-superseded patches.
+ * `findAllPatchesForFiles` catches the full-coverage supersede case; this
+ * fills the gap for PARTIAL overlap — two patches both claiming e.g.
+ * `browser/themes/shared/jar.inc.mn` after a second export with `--before`.
  *
  * Proceeds silently when there is no overlap, or when the caller passed
  * `--allow-overlap`. In interactive mode the caller is prompted to
  * acknowledge the overlap (the proper fix path is `re-export --files` to
  * repartition ownership, so the prompt surfaces that pointer). In
- * non-interactive mode the function throws — better to fail fast than
- * let the queue fall out of sync with verify.
+ * non-interactive mode it throws — better to fail fast than let the queue
+ * fall out of sync with verify.
  */
 export async function guardOwnershipOverlap(args) {
     const { patchesDir, filesAffected, supersedingFilenames, allowOverlap, isInteractive, s } = args;
@@ -373,13 +376,12 @@ export async function guardOwnershipOverlap(args) {
 }
 /**
  * Runs the two pre-commit gates shared by `export` and `export-all` in
- * order: the supersede confirmation, then the cross-patch ownership
- * overlap guard. The overlap guard receives the filenames of the patches
- * the export would fully supersede so it does not flag a file claimed by
- * a patch that is about to be removed (pre-0.16.0 `export` only caught
- * FULL-coverage supersedes, so a second export targeting a shared file
- * like `browser/themes/shared/jar.inc.mn` created a queue where two
- * patches both claimed the file and `verify` failed immediately).
+ * order: the supersede confirmation, then the cross-patch ownership overlap
+ * guard. The overlap guard receives the filenames of the patches the export
+ * would fully supersede so it does not flag a file claimed by a patch that
+ * is about to be removed. Catching only FULL-coverage supersedes leaves a
+ * second export targeting a shared file creating a queue where two patches
+ * both claim it and `verify` fails immediately.
  *
  * @param args - Gate inputs shared by both export commands
  * @param args.patchesDir - Absolute path of the patches directory
@@ -388,8 +390,8 @@ export async function guardOwnershipOverlap(args) {
  * @param args.allowOverlap - The command's `--allow-overlap` flag
  * @param args.isInteractive - Whether prompting the operator is possible
  * @param args.s - Active spinner, stopped before any prompt
- * @returns `true` when both gates passed; `false` when the operator
- *   declined (the caller returns without committing)
+ * @returns `true` when both gates passed; `false` when the operator declined
+ *   (the caller returns without committing)
  */
 export async function runSupersedeAndOverlapGates(args) {
     const { patchesDir, filesAffected, supersede, allowOverlap, isInteractive, s } = args;

package/dist/src/commands/export.js

@@ -3,11 +3,12 @@ import { stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { Command, Option } from 'commander';
 import { getProjectPaths, loadConfig } from '../core/config.js';
-import { appendHistory } from '../core/destructive.js';
+import { appendHistory, stdioIsInteractive } from '../core/destructive.js';
+import { assertEngineGitReady } from '../core/engine-precondition.js';
 import { withEngineSessionLock } from '../core/engine-session-lock.js';
 import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { enforceFreshFurnaceSources } from '../core/furnace-stale-export.js';
-import { getStatusWithCodes, isGitRepository } from '../core/git.js';
+import { getStatusWithCodes } from '../core/git.js';
 import { generateBinaryFilePatch, generateFullFilePatch } from '../core/git-diff.js';
 import { isBinaryFile } from '../core/git-file-ops.js';
 import { getModifiedFilesInDir, getUntrackedFiles, getUntrackedFilesInDir, } from '../core/git-status.js';
@@ -33,11 +34,10 @@ async function collectExportFiles(paths, files) {
     let untrackedFiles;
     // Accept both repo-root-relative (`engine/browser/...`) and engine-relative
     // (`browser/...`) paths for every input, matching `register`/`test`/`lint`.
-    // Previously, an `engine/`-prefixed path fell through to
-    // `File "engine/..." has no changes to export.` because the status lookup
-    // sees paths relative to `paths.engine` and the explicit prefix double-
-    // rooted the candidate. `stripEnginePrefix` makes that user-facing form
-    // a no-op for the lookup pipeline.
+    // Without the strip, an `engine/`-prefixed path falls through to
+    // `File "engine/..." has no changes to export.`: the status lookup sees
+    // paths relative to `paths.engine`, so the explicit prefix double-roots the
+    // candidate.
     for (const rawInputPath of files) {
         const inputPath = stripEnginePrefix(rawInputPath);
         const fullInputPath = join(paths.engine, inputPath);
@@ -88,13 +88,14 @@ async function collectExportFiles(paths, files) {
     return { files: [...collectedFiles].sort(), fromDirectory };
 }
 /**
- * Auto-excludes directory-derived files already owned by OTHER patches
- * (0.34.0 field report): a directory export used to plan files owned by
- * earlier patches into the new patch, and the duplicate-new-file-creation
- * refusal surfaced only at placement lint, suggesting --force-unsafe —
- * the wrong tool for "leave that file with its owner". Explicitly named
- * files are never excluded (the overlap gates still confront the operator
- * with those). Prints one notice per exclusion.
+ * Auto-excludes directory-derived files already owned by OTHER patches.
+ *
+ * A directory export otherwise plans files owned by earlier patches into the
+ * new patch, and the duplicate-new-file-creation refusal surfaces only at
+ * placement lint, suggesting `--force-unsafe` — the wrong tool for "leave
+ * that file with its owner". Explicitly named files are never excluded (the
+ * overlap gates still confront the operator with those). Prints one notice
+ * per exclusion.
  */
 async function excludeFilesOwnedByOtherPatches(patchesDir, collected) {
     if (collected.fromDirectory.size === 0)
@@ -169,14 +170,7 @@ async function prepareExport(projectRoot, files, options) {
         throw new InvalidArgumentError('--order, --before, and --after are mutually exclusive.', 'export placement');
     }
     const paths = getProjectPaths(projectRoot);
-    // Check if engine exists
-    if (!(await pathExists(paths.engine))) {
-        throw new GeneralError('Firefox source not found. Run "fireforge download" first.');
-    }
-    // Check if it's a git repository
-    if (!(await isGitRepository(paths.engine))) {
-        throw new GeneralError('Engine directory is not a git repository. Run "fireforge download" to initialize.');
-    }
+    await assertEngineGitReady(paths.engine);
     const collected = await collectExportFiles(paths, files);
     let allFiles = await excludeFilesOwnedByOtherPatches(paths.patches, collected);
     const ownershipExclusions = collected.files.length - allFiles.length;
@@ -202,10 +196,10 @@ async function prepareExport(projectRoot, files, options) {
         throw new GeneralError(`Paths "${pathList}" have no changes to export.\n\n` +
             'Run "fireforge status" to see modified files.');
     }
-    // Stale-furnace-source gate (0.37.0 item 4): the export captures deployed
-    // engine copies; refuse (or warn under --allow-stale-furnace) when a
-    // covered component's source changed since the last furnace apply. Runs
-    // after --exclude-furnace so excluded furnace files never trigger it.
+    // Stale-furnace-source gate: the export captures deployed engine copies,
+    // so refuse (or warn under --allow-stale-furnace) when a covered
+    // component's source changed since the last furnace apply. Runs after
+    // --exclude-furnace so excluded furnace files never trigger it.
     await enforceFreshFurnaceSources(projectRoot, allFiles, options.allowStaleFurnace === true, 'export');
     let diff = await generatePatchDiff(paths.engine, allFiles);
     if (!diff.trim()) {
@@ -222,7 +216,7 @@ async function prepareExport(projectRoot, files, options) {
         await ensureDir(paths.patches);
     }
     const config = await loadConfig(projectRoot);
-    const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
+    const isInteractive = stdioIsInteractive();
     // Auto-fix missing license headers on new files (interactive only;
     // report-only under --dry-run so the preview never mutates engine/)
     const headersAdded = await autoFixLicenseHeaders(paths.engine, diff, config, isInteractive, options.dryRun ?? false);