@hominis/fireforge 0.43.1 → 0.44.1

package/dist/src/core/{lint-cache.js → patch-lint-cache.js}

@@ -7,24 +7,23 @@ import { getPackageVersion } from '../utils/package-root.js';
 import { getFurnacePaths } from './furnace-config.js';
 import { git } from './git-base.js';
 import { collectNewFileCreatorsByPath } from './patch-lint.js';
-// Schema 2: entries additionally carry the lintIgnore-suppressed
-// issues and the measured non-binary line count, so a warm run can report
-// waived size measurements identically to a cold one (the F5-class hazard:
-// a cache hit must never surface LESS than a fresh lint).
+// Schema 2: entries additionally carry the lintIgnore-suppressed issues and
+// the measured non-binary line count, so a warm run can report waived size
+// measurements identically to a cold one — a cache hit must never surface
+// LESS than a fresh lint.
 // Schema 3: the key additionally content-hashes the
 // `patchLint.checkJsTestShim` file exactly as `checkJsExtraShim`'s already
-// was — before this, editing the test shim in place replayed every cached
-// verdict (the same warm-run-reports-less-than-cold hazard class).
-// Schema 4: each entry RECORDS the lint-ignore waiver set that
-// produced it, and a lookup whose effective waiver set differs is refused
-// even when the key matches. The key already hashes `patch.lintIgnore`, so
-// this is belt-and-braces on purpose: a waiver change is the one mutation
-// that makes a replayed verdict actively WRONG (an operator writes a
-// waiver, re-runs, and is shown the finding they just waived — or worse,
-// a pre-waiver verdict replayed under a post-waiver key), and the class
-// must not depend on every future key input staying complete. Bumping the
-// schema also discards every pre-4 entry, which is itself the cure for a
-// cache that already holds a mismatched verdict.
+// was; without it, editing the test shim in place replays every cached
+// verdict.
+// Schema 4: each entry RECORDS the lint-ignore waiver set that produced it,
+// and a lookup whose effective waiver set differs is refused even when the
+// key matches. The key already hashes `patch.lintIgnore`, so this is
+// belt-and-braces on purpose: a waiver change is the one mutation that makes
+// a replayed verdict actively WRONG (an operator writes a waiver, re-runs,
+// and is shown the finding they just waived), and the class must not depend
+// on every future key input staying complete. Bumping the schema also
+// discards every pre-4 entry, which is itself the cure for a cache that
+// already holds a mismatched verdict.
 export const LINT_CACHE_SCHEMA_VERSION = 4;
 const LINT_IMPLEMENTATION_VERSION = 1;
 const LINT_CACHE_DIRNAME = 'lint-cache';
@@ -102,8 +101,7 @@ export async function buildPerPatchLintCacheKey(input) {
     // Hash in parallel, then insert in sorted order. The sort is load-bearing:
     // `stableHash` below serialises this record, so insertion order is part of
     // the cache key — assigning as results land would make the key
-    // nondeterministic. Hashing was strictly sequential until 0.41.0, in the hot
-    // path of the cache whose entire purpose is making lint faster.
+    // nondeterministic.
     const sortedFiles = [...input.existingFiles].sort((a, b) => a.localeCompare(b));
     const hashes = await Promise.all(sortedFiles.map((file) => fileHash(join(input.engineDir, file))));
     const engineFiles = {};
@@ -127,8 +125,8 @@ export async function buildPerPatchLintCacheKey(input) {
         cacheSchemaVersion: LINT_CACHE_SCHEMA_VERSION,
         engineHeadSha: input.engineHeadSha ?? null,
         lintImplementationVersion: LINT_IMPLEMENTATION_VERSION,
-        // Deliberately the PLAIN semver, not the +g<sha> build identity
-        //: identity churns every commit at the same version and
+        // Deliberately the PLAIN semver, not the +g<sha> build identity:
+        // identity churns every commit at the same version and
         // would invalidate the cache for no correctness gain.
         packageVersion: input.packageVersion ?? getPackageVersion(),
         patchFile: await fileHash(join(input.patchesDir, input.patch.filename)),
@@ -205,9 +203,9 @@ function normalizeLintIgnoreSet(lintIgnore) {
 }
 /**
  * Returns the cached lint payload for a patch when the stored key still
- * matches AND the entry was computed under the same lint-ignore waiver set
- *. A waiver change makes a replayed verdict actively wrong, so
- * the waiver set is compared explicitly rather than trusted to the key.
+ * matches AND the entry was computed under the same lint-ignore waiver set.
+ * A waiver change makes a replayed verdict actively wrong, so the waiver set
+ * is compared explicitly rather than trusted to the key.
  */
 export function getCachedPerPatchLintIssues(cache, patchFilename, key, lintIgnore) {
     const entry = cache.entries[patchFilename];

package/dist/src/core/patch-lint-checkjs.d.ts

@@ -49,10 +49,10 @@ export interface GroupedCheckJsResult {
 /**
  * Builds the checkJs program **once** over `resolutionOwned` and returns its
  * diagnostics grouped by originating file. Callers slice the result by their
- * own report scope — per-patch lint attributes each file to its owning
- * patch, export/re-export keeps only the patch under export. Resolution
- * always spans every file in `resolutionOwned`, so cross-patch
- * `resource:///`/`chrome://` imports resolve to real sources.
+ * own report scope — per-patch lint attributes each file to its owning patch,
+ * export/re-export keeps only the patch under export. Resolution always spans
+ * every file in `resolutionOwned`, so cross-patch `resource:///`/`chrome://`
+ * imports resolve to real sources.
  *
  * @param repoDir - Absolute engine (repository) directory
  * @param resolutionOwned - Patch-owned `.sys.mjs` paths (relative to repoDir)
@@ -61,14 +61,14 @@ export interface GroupedCheckJsResult {
  *   the built-in Firefox-globals shim (from `patchLint.checkJsExtraShim`)
  * @param projectRoot - Absolute project root for resolving `extraShimPath`
  * @param mode - Strictness preset plus allowlisted compiler-option overrides
- * @param builtinShimSuffix - Optional shim text appended AFTER the consumer shim
+ * @param builtinShimSuffix - Optional shim text appended AFTER the consumer
+ *   shim
  * @param rootScope - When set, only these repo-relative files become program
  *   ROOTS; resolution (and the host allowlist) still spans all of
  *   `resolutionOwned`, so a subset root's cross-patch imports type-check
  *   against the real owning sources while unrelated owned files are never
  *   parsed. `.mjs` files are module-scoped, so a root's diagnostics are
- *   identical whether other owned files are roots or mere resolution
- * targets (pinned by the rootScope parity test).
+ *   identical whether other owned files are roots or mere resolution targets.
  * @returns Diagnostics grouped per owning file plus run-level errors
  */
 export declare function runCheckJsGrouped(repoDir: string, resolutionOwned: Set<string>, extraShimPath?: string, projectRoot?: string, mode?: CheckJsMode, builtinShimSuffix?: string, rootScope?: ReadonlySet<string>): Promise<GroupedCheckJsResult>;
@@ -135,14 +135,14 @@ export declare function runCheckJsTestFilesGrouped(repoDir: string, testFiles: S
  */
 export declare function invokePatchLintCheckJsGrouped(repoDir: string, patchOwnedFiles: Set<string>, patchLint: PatchLintConfig, projectRoot: string, rootScope?: ReadonlySet<string>): Promise<GroupedCheckJsResult>;
 /**
- * Cheap probe reproducing the only run-level ("global") checkJs findings
- * the build path can produce — a missing `typescript` package and an
- * unreadable consumer shim (`checkJsExtraShim`, and `checkJsTestShim`
- * when `checkJsTestFiles` is on). The built program itself never
- * contributes globals (see {@link runCheckJsGrouped}), so a warm
- * all-cache-hit run can satisfy the "warm never reports less than cold"
- * invariant with this probe instead of building the whole
- * TypeScript program. Issue objects are byte-identical to the build
- * path's, deduplicated by message like {@link runCheckJsTestFilesGrouped}.
+ * Cheap probe reproducing the only run-level ("global") checkJs findings the
+ * build path can produce — a missing `typescript` package and an unreadable
+ * consumer shim (`checkJsExtraShim`, and `checkJsTestShim` when
+ * `checkJsTestFiles` is on). The built program itself never contributes
+ * globals (see {@link runCheckJsGrouped}), so a warm all-cache-hit run can
+ * satisfy the "warm never reports less than cold" invariant with this probe
+ * instead of building the whole TypeScript program. Issue objects are
+ * byte-identical to the build path's, deduplicated by message like
+ * {@link runCheckJsTestFilesGrouped}.
  */
 export declare function probeCheckJsGlobalIssues(patchLint: PatchLintConfig, projectRoot: string): Promise<PatchLintIssue[]>;

package/dist/src/core/patch-lint-checkjs.js

@@ -29,10 +29,25 @@ import { basename, resolve } from 'node:path';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { composeShimSource, SHIM_FILENAME, SUPPRESSED_DIAGNOSTIC_CODES, TEST_HARNESS_SHIM, UNDEFINED_IDENTIFIER_CODES, UNDEFINED_IDENTIFIER_HINT, } from './typecheck-shim.js';
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
+/**
+ * Converts a native path into the form TypeScript uses for `fileName`.
+ *
+ * TypeScript normalizes every path it hands a `CompilerHost` to forward
+ * slashes on ALL platforms, while `resolve()` here yields the platform
+ * separator. On Windows that mismatch made every `ownedAbsolute.has(fileName)`
+ * and `relByAbsolute.get(fileName)` lookup miss, so the host served an empty
+ * source file for each owned file and the whole pass reported zero findings —
+ * silently, because "no diagnostics" is indistinguishable from "clean code".
+ * Every path that crosses the TS boundary goes through here.
+ */
+function toTsPath(path) {
+    return normalizePathSlashes(path);
+}
 /**
  * Builds the host-side module resolver for the checkJs pass: maps an import
  * specifier to a patch-owned absolute path when the specifier's final
@@ -117,8 +132,14 @@ function createPathsResolver(ts, paths, baseDir, fileExists, onResolved) {
                 captured = specifier.slice(prefix.length, specifier.length - suffix.length);
             }
             for (const target of targets) {
-                const rel = target.includes('*') ? target.replace('*', captured) : target;
-                const abs = resolve(baseDir, rel);
+                // A `paths` target carries at most one `*`, and TypeScript substitutes
+                // that one wildcard — spelled as index arithmetic (mirroring the
+                // prefix/suffix split on the pattern side above) rather than
+                // `replace('*', …)`, whose first-occurrence-only behaviour reads as an
+                // incomplete rewrite (CodeQL `js/incomplete-sanitization`).
+                const star = target.indexOf('*');
+                const rel = star === -1 ? target : target.slice(0, star) + captured + target.slice(star + 1);
+                const abs = toTsPath(resolve(baseDir, rel));
                 if (!fileExists(abs))
                     continue;
                 onResolved(abs);
@@ -135,10 +156,10 @@ function createPathsResolver(ts, paths, baseDir, fileExists, onResolved) {
 /**
  * Builds the checkJs program **once** over `resolutionOwned` and returns its
  * diagnostics grouped by originating file. Callers slice the result by their
- * own report scope — per-patch lint attributes each file to its owning
- * patch, export/re-export keeps only the patch under export. Resolution
- * always spans every file in `resolutionOwned`, so cross-patch
- * `resource:///`/`chrome://` imports resolve to real sources.
+ * own report scope — per-patch lint attributes each file to its owning patch,
+ * export/re-export keeps only the patch under export. Resolution always spans
+ * every file in `resolutionOwned`, so cross-patch `resource:///`/`chrome://`
+ * imports resolve to real sources.
  *
  * @param repoDir - Absolute engine (repository) directory
  * @param resolutionOwned - Patch-owned `.sys.mjs` paths (relative to repoDir)
@@ -147,14 +168,14 @@ function createPathsResolver(ts, paths, baseDir, fileExists, onResolved) {
  *   the built-in Firefox-globals shim (from `patchLint.checkJsExtraShim`)
  * @param projectRoot - Absolute project root for resolving `extraShimPath`
  * @param mode - Strictness preset plus allowlisted compiler-option overrides
- * @param builtinShimSuffix - Optional shim text appended AFTER the consumer shim
+ * @param builtinShimSuffix - Optional shim text appended AFTER the consumer
+ *   shim
  * @param rootScope - When set, only these repo-relative files become program
  *   ROOTS; resolution (and the host allowlist) still spans all of
  *   `resolutionOwned`, so a subset root's cross-patch imports type-check
  *   against the real owning sources while unrelated owned files are never
  *   parsed. `.mjs` files are module-scoped, so a root's diagnostics are
- *   identical whether other owned files are roots or mere resolution
- * targets (pinned by the rootScope parity test).
+ *   identical whether other owned files are roots or mere resolution targets.
  * @returns Diagnostics grouped per owning file plus run-level errors
  */
 export async function runCheckJsGrouped(repoDir, resolutionOwned, extraShimPath, projectRoot, mode, builtinShimSuffix, rootScope) {
@@ -188,7 +209,7 @@ export async function runCheckJsGrouped(repoDir, resolutionOwned, extraShimPath,
     const ownedAbsolute = new Set();
     const relByAbsolute = new Map();
     for (const rel of resolutionOwned) {
-        const abs = resolve(repoDir, rel);
+        const abs = toTsPath(resolve(repoDir, rel));
         if (await pathExists(abs)) {
             if (rootScope === undefined || rootScope.has(rel))
                 rootFiles.push(abs);
@@ -228,7 +249,7 @@ export async function runCheckJsGrouped(repoDir, resolutionOwned, extraShimPath,
             ],
         };
     }
-    const shimPath = resolve(repoDir, SHIM_FILENAME);
+    const shimPath = toTsPath(resolve(repoDir, SHIM_FILENAME));
     rootFiles.push(shimPath);
     const strict = mode?.strict === true;
     const strictness = strict
@@ -504,15 +525,15 @@ export async function invokePatchLintCheckJsGrouped(repoDir, patchOwnedFiles, pa
     return runCheckJsGrouped(repoDir, patchOwnedFiles, patchLint.checkJsExtraShim, projectRoot, modeFromPatchLintConfig(patchLint), undefined, rootScope);
 }
 /**
- * Cheap probe reproducing the only run-level ("global") checkJs findings
- * the build path can produce — a missing `typescript` package and an
- * unreadable consumer shim (`checkJsExtraShim`, and `checkJsTestShim`
- * when `checkJsTestFiles` is on). The built program itself never
- * contributes globals (see {@link runCheckJsGrouped}), so a warm
- * all-cache-hit run can satisfy the "warm never reports less than cold"
- * invariant with this probe instead of building the whole
- * TypeScript program. Issue objects are byte-identical to the build
- * path's, deduplicated by message like {@link runCheckJsTestFilesGrouped}.
+ * Cheap probe reproducing the only run-level ("global") checkJs findings the
+ * build path can produce — a missing `typescript` package and an unreadable
+ * consumer shim (`checkJsExtraShim`, and `checkJsTestShim` when
+ * `checkJsTestFiles` is on). The built program itself never contributes
+ * globals (see {@link runCheckJsGrouped}), so a warm all-cache-hit run can
+ * satisfy the "warm never reports less than cold" invariant with this probe
+ * instead of building the whole TypeScript program. Issue objects are
+ * byte-identical to the build path's, deduplicated by message like
+ * {@link runCheckJsTestFilesGrouped}.
  */
 export async function probeCheckJsGlobalIssues(patchLint, projectRoot) {
     try {

package/dist/src/core/patch-lint-chrome-jsdoc.d.ts

@@ -34,14 +34,11 @@ import type { JsDocIssue, ValidateExportJsDocOptions } from './patch-lint-jsdoc.
  */
 export declare function validateChromeScriptJsDoc(source: string, options?: ValidateExportJsDocOptions): JsDocIssue[];
 /**
- * Per-file dispatch: applies the chrome-subscript JSDoc rule to one file
- * if it qualifies, mapping {@link JsDocIssue} into {@link PatchLintIssue}.
- * Extracted so the orchestrator in `patch-lint.ts` stays under the
- * project's per-file line budget — `patch-lint.ts` invokes this helper
- * inline once per affected JS/MJS file. Returns an empty array when the
- * file does not qualify (not a chrome subscript, not patch-owned, or the
- * mode is `'off'` / unset). The orchestrator pre-computes `isChromeOwned`
- * (true iff the file is a patch-owned `.js` non-`.sys.mjs`) so the call
- * site fits on a single line.
+ * Per-file dispatch: applies the chrome-subscript JSDoc rule to one file if
+ * it qualifies, mapping {@link JsDocIssue} into {@link PatchLintIssue}.
+ * Returns an empty array when the file does not qualify (not a chrome
+ * subscript, not patch-owned, or the mode is `'off'` / unset). The
+ * orchestrator pre-computes `isChromeOwned` (true iff the file is a
+ * patch-owned `.js` non-`.sys.mjs`) so the call site fits on a single line.
  */
 export declare function lintChromeScriptJsDocForFile(file: string, content: string, isChromeOwned: boolean, mode: PatchLintSeverityGate | undefined): PatchLintIssue[];

package/dist/src/core/patch-lint-chrome-jsdoc.js

@@ -47,20 +47,19 @@ export function validateChromeScriptJsDoc(source, options) {
         // would emit a pseudo-issue for every rule here. The orchestrator already
         // runs the export walker on `.sys.mjs` separately, so silently declining
         // to lint an unparseable script is the correct degradation for this file
-        // and only this file. Pinned by "returns no issues when the source uses
-        // module-only syntax" in patch-lint-chrome-jsdoc.test.ts.
+        // and only this file.
         return [];
     }
     const issues = [];
     const body = ast.body;
     for (const node of body) {
         if (node.type === 'FunctionDeclaration') {
-            validateFunctionDecl(node, comments, source, issues);
+            issues.push(...validateFunctionDecl(node, comments, source));
         }
         else if (node.type === 'ClassDeclaration') {
-            validateClassDecl(node, comments, source, issues);
+            issues.push(...validateClassDecl(node, comments, source));
             if (classMethodMode !== 'off') {
-                validateClassMethods(node, comments, source, issues, classMethodMode);
+                issues.push(...validateClassMethods(node, comments, source, classMethodMode));
             }
         }
         // Top-level `var Foo = class {...}` / `let Foo = function() {...}`
@@ -72,15 +71,12 @@ export function validateChromeScriptJsDoc(source, options) {
     return issues;
 }
 /**
- * Per-file dispatch: applies the chrome-subscript JSDoc rule to one file
- * if it qualifies, mapping {@link JsDocIssue} into {@link PatchLintIssue}.
- * Extracted so the orchestrator in `patch-lint.ts` stays under the
- * project's per-file line budget — `patch-lint.ts` invokes this helper
- * inline once per affected JS/MJS file. Returns an empty array when the
- * file does not qualify (not a chrome subscript, not patch-owned, or the
- * mode is `'off'` / unset). The orchestrator pre-computes `isChromeOwned`
- * (true iff the file is a patch-owned `.js` non-`.sys.mjs`) so the call
- * site fits on a single line.
+ * Per-file dispatch: applies the chrome-subscript JSDoc rule to one file if
+ * it qualifies, mapping {@link JsDocIssue} into {@link PatchLintIssue}.
+ * Returns an empty array when the file does not qualify (not a chrome
+ * subscript, not patch-owned, or the mode is `'off'` / unset). The
+ * orchestrator pre-computes `isChromeOwned` (true iff the file is a
+ * patch-owned `.js` non-`.sys.mjs`) so the call site fits on a single line.
  */
 export function lintChromeScriptJsDocForFile(file, content, isChromeOwned, mode) {
     if (!isChromeOwned || !mode || mode === 'off')

package/dist/src/core/patch-lint-creators.d.ts

@@ -1,14 +1,14 @@
 /**
  * New-file creators map for the patch queue, split out of
- * `patch-lint-cross.ts` (at the per-file line budget). Re-exported from
- * there so callers keep importing from `patch-lint.ts` unchanged.
+ * `patch-lint-cross.ts` to stay under the per-file line budget.
+ * Re-exported from there so callers keep importing from `patch-lint.ts`
+ * unchanged.
  *
- * Memoised per context object: ownership resolution and
- * cache-key fingerprints call this 2-3× per linted patch, and each call
- * used to re-run `detectNewFilesInDiff` over EVERY queue entry's diff.
- * Keyed weakly so a discarded context frees its map; a caller that
- * mutates a context entry in place must call
- * {@link invalidateNewFileCreatorsCache}.
+ * Memoised per context object: ownership resolution and cache-key
+ * fingerprints call this 2-3× per linted patch, and each call otherwise
+ * re-runs `detectNewFilesInDiff` over EVERY queue entry's diff. Keyed weakly
+ * so a discarded context frees its map; a caller that mutates a context
+ * entry in place must call {@link invalidateNewFileCreatorsCache}.
  */
 /** The slice of a queue context the creators map is derived from. */
 interface CreatorsContext {

package/dist/src/core/patch-lint-creators.js

@@ -1,15 +1,15 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
  * New-file creators map for the patch queue, split out of
- * `patch-lint-cross.ts` (at the per-file line budget). Re-exported from
- * there so callers keep importing from `patch-lint.ts` unchanged.
+ * `patch-lint-cross.ts` to stay under the per-file line budget.
+ * Re-exported from there so callers keep importing from `patch-lint.ts`
+ * unchanged.
  *
- * Memoised per context object: ownership resolution and
- * cache-key fingerprints call this 2-3× per linted patch, and each call
- * used to re-run `detectNewFilesInDiff` over EVERY queue entry's diff.
- * Keyed weakly so a discarded context frees its map; a caller that
- * mutates a context entry in place must call
- * {@link invalidateNewFileCreatorsCache}.
+ * Memoised per context object: ownership resolution and cache-key
+ * fingerprints call this 2-3× per linted patch, and each call otherwise
+ * re-runs `detectNewFilesInDiff` over EVERY queue entry's diff. Keyed weakly
+ * so a discarded context frees its map; a caller that mutates a context
+ * entry in place must call {@link invalidateNewFileCreatorsCache}.
  */
 import { detectNewFilesInDiff } from './patch-lint-diff.js';
 const newFileCreatorsMemo = new WeakMap();

package/dist/src/core/patch-lint-cross.d.ts

@@ -1,13 +1,13 @@
 /**
  * Cross-patch lint infrastructure: the queue context builder, the
- * duplicate-new-file-creation and forward-import rules, the
- * forward-import ignore-marker, and the per-specifier extractor that
- * powers the forward-import rule.
+ * duplicate-new-file-creation and forward-import rules, the forward-import
+ * ignore-marker, and the per-specifier extractor that powers the
+ * forward-import rule.
  *
  * Separated from `patch-lint.ts` so the per-patch and cross-patch rule
- * bodies stay within the project's per-file line budget. `patch-lint.ts`
- * re-exports the public surface so callers continue to import from a
- * single module.
+ * bodies each stay within the per-file line budget. `patch-lint.ts`
+ * re-exports the public surface so callers continue to import from a single
+ * module.
  */
 import type { PatchLintIssue, PatchMetadata } from '../types/commands/index.js';
 import type { FireForgeConfig, PatchPolicyConfig } from '../types/config.js';
@@ -61,8 +61,8 @@ export interface PatchQueueContext {
     /**
      * Optional patchPolicy config. When present, the forward-import rule
      * validates its "Closest legal ordinal" suggestion against the importing
-     * patch's category range and suppresses it when no legal ordinal exists
-     *. Absent = current behavior (hint always printed).
+     * patch's category range and suppresses it when no legal ordinal exists.
+     * Absent = current behavior (hint always printed).
      */
     patchPolicy?: PatchPolicyConfig;
 }
@@ -82,10 +82,8 @@ export declare function buildPatchQueueContext(patchesDir: string, config?: Fire
 export { collectNewFileCreatorsByPath, invalidateNewFileCreatorsCache, } from './patch-lint-creators.js';
 /**
  * Cross-patch lint rule: the same path is newly created (`--- /dev/null →
- * +++ b/path`) by more than one patch. This is the failure mode that
- * motivated the rule — a fork landed three patches each trying to create
- * the same file, and the error surfaced only when import rolled back
- * mid-apply.
+ * +++ b/path`) by more than one patch. Without it the collision surfaces
+ * only when import rolls back mid-apply.
  *
  * Reports one error per conflicting path, naming every patch that creates
  * the path so the operator can pick the correct fix (`patch delete` or
@@ -156,14 +154,13 @@ export declare function findForwardImportIgnoreLines(source: string): Set<number
  * Cross-patch lint rule: a patch imports a module that a later patch is
  * responsible for creating.
  *
- * Approach is deliberately conservative — we do not resolve `resource://`
- * URLs to engine file paths. Instead we build a cross-queue index of
- * newly-created files keyed by their basename, and flag imports whose leaf
- * matches an entry owned by a later-ordered patch. False positives from
- * unrelated basename collisions (two different directories happening to
- * create files named `Helper.sys.mjs`) are possible; the README documents
- * the limitation and the inline ignore marker above provides an escape
- * hatch.
+ * Deliberately conservative — `resource://` URLs are not resolved to engine
+ * file paths. Instead a cross-queue index of newly-created files is built,
+ * keyed by basename, and imports whose leaf matches an entry owned by a
+ * later-ordered patch are flagged. False positives from unrelated basename
+ * collisions (two directories both creating `Helper.sys.mjs`) are possible;
+ * the README documents the limitation and the inline ignore marker above is
+ * the escape hatch.
  *
  * Rules out:
  * - Imports whose leaf matches a newly-created file in the *same* or an

package/dist/src/core/patch-lint-cross.js

@@ -1,14 +1,14 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
  * Cross-patch lint infrastructure: the queue context builder, the
- * duplicate-new-file-creation and forward-import rules, the
- * forward-import ignore-marker, and the per-specifier extractor that
- * powers the forward-import rule.
+ * duplicate-new-file-creation and forward-import rules, the forward-import
+ * ignore-marker, and the per-specifier extractor that powers the
+ * forward-import rule.
  *
  * Separated from `patch-lint.ts` so the per-patch and cross-patch rule
- * bodies stay within the project's per-file line budget. `patch-lint.ts`
- * re-exports the public surface so callers continue to import from a
- * single module.
+ * bodies each stay within the per-file line budget. `patch-lint.ts`
+ * re-exports the public surface so callers continue to import from a single
+ * module.
  */
 import { basename } from 'node:path';
 import { toError } from '../utils/errors.js';
@@ -16,6 +16,7 @@ import { readText } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
 import { stripJsComments } from '../utils/regex.js';
 import { discoverPatches } from './patch-files.js';
+import { lintPatchQueueBinaryBodies } from './patch-lint-binary.js';
 import { collectNewFileCreatorsByPath } from './patch-lint-creators.js';
 import { detectNewFilesInDiff, extractAddedLinesPerFile } from './patch-lint-diff.js';
 import { lintPatchQueueModuleRegistrations } from './patch-lint-module-registration.js';
@@ -90,10 +91,8 @@ export async function buildPatchQueueContext(patchesDir, config) {
 export { collectNewFileCreatorsByPath, invalidateNewFileCreatorsCache, } from './patch-lint-creators.js';
 /**
  * Cross-patch lint rule: the same path is newly created (`--- /dev/null →
- * +++ b/path`) by more than one patch. This is the failure mode that
- * motivated the rule — a fork landed three patches each trying to create
- * the same file, and the error surfaced only when import rolled back
- * mid-apply.
+ * +++ b/path`) by more than one patch. Without it the collision surfaces
+ * only when import rolls back mid-apply.
  *
  * Reports one error per conflicting path, naming every patch that creates
  * the path so the operator can pick the correct fix (`patch delete` or
@@ -523,13 +522,13 @@ export function lintPatchQueueForwardImports(ctx) {
                 severity: 'warning',
             });
         }
-        // Registration-kind declarations (0.37.0 item 5): a jar.mn packaging
-        // line, customElements registration, or actor registration referencing
-        // a later-created file. There is no import specifier to match — the
+        // Registration-kind declarations: a jar.mn packaging line,
+        // customElements registration, or actor registration referencing a
+        // later-created file. There is no import specifier to match — the
         // declaration is "used" when the declared line (whitespace-trimmed)
-        // appears among the lines this patch adds to the declaring file AND
-        // its `creates` resolves to a file a later-ordered patch actually
-        // creates (with `owner`, when set, naming that patch) — mirroring
+        // appears among the lines this patch adds to the declaring file AND its
+        // `creates` resolves to a file a later-ordered patch actually creates
+        // (with `owner`, when set, naming that patch) — mirroring
         // findMatchingStagedDependency for the import kind.
         for (const registration of entry.metadata?.stagedDependencies?.registrations ?? []) {
             const failure = findStagedRegistrationFailure(entry, registration, newFileIndex);
@@ -615,5 +614,6 @@ export function lintPatchQueue(ctx) {
         ...lintPatchQueueDuplicateCreations(ctx),
         ...lintPatchQueueForwardImports(ctx),
         ...lintPatchQueueModuleRegistrations(ctx),
+        ...lintPatchQueueBinaryBodies(ctx),
     ];
 }

package/dist/src/core/patch-lint-css.d.ts

@@ -2,11 +2,9 @@
  * CSS patch-lint rules: introduced raw color values and non-tokenized
  * custom-property references.
  *
- * Split out of `patch-lint.ts` so the per-patch and CSS rule bodies each
- * stay within the project's per-file line budget — the same separation
- * already applied to the JSDoc, observer, import, ownership, checkJs, and
- * cross-patch rule families. `patch-lint.ts` re-exports `lintPatchedCss`
- * so existing callers keep importing from the single module.
+ * Split out of `patch-lint.ts` so each rule family stays within the
+ * per-file line budget; `patch-lint.ts` re-exports `lintPatchedCss` so
+ * existing callers keep importing from the single module.
  */
 import type { PatchLintIssue } from '../types/commands/index.js';
 import type { FireForgeConfig } from '../types/config.js';

package/dist/src/core/patch-lint-css.js

@@ -3,11 +3,9 @@
  * CSS patch-lint rules: introduced raw color values and non-tokenized
  * custom-property references.
  *
- * Split out of `patch-lint.ts` so the per-patch and CSS rule bodies each
- * stay within the project's per-file line budget — the same separation
- * already applied to the JSDoc, observer, import, ownership, checkJs, and
- * cross-patch rule families. `patch-lint.ts` re-exports `lintPatchedCss`
- * so existing callers keep importing from the single module.
+ * Split out of `patch-lint.ts` so each rule family stays within the
+ * per-file line budget; `patch-lint.ts` re-exports `lintPatchedCss` so
+ * existing callers keep importing from the single module.
  */
 import { join } from 'node:path';
 import { toError } from '../utils/errors.js';
@@ -83,12 +81,12 @@ function checkRawColorValues(file, rawCss, addedLinesByFile, addedLineNumbersByF
     // Check only introduced raw color values when diff context is available.
     // Skip files on the raw-color allowlist (exact path or basename match) and
     // auto-exempt files under `browser/branding/` — those are the fork's
-    // visual identity assets (app-about dialogs, installer pages, branded
-    // CSS copied from Firefox's `unofficial` template) and belong to the
-    // design-decision layer the design-token system does not govern.
-    // Without this auto-exemption, every first-time setup's copied CSS
-    // failed `raw-color-value` with no actionable fix other than manually
-    // listing each path in `rawColorAllowlist`.
+    // visual identity assets (app-about dialogs, installer pages, branded CSS
+    // copied from Firefox's `unofficial` template) and belong to the
+    // design-decision layer the design-token system does not govern. Without
+    // the auto-exemption, every first-time setup's copied CSS fails
+    // `raw-color-value` with no actionable fix short of listing each path in
+    // `rawColorAllowlist`.
     const allowlist = config?.patchLint?.rawColorAllowlist;
     const isAllowlisted = allowlist?.some((entry) => file === entry || file.endsWith('/' + entry));
     const isBranding = file.startsWith('browser/branding/');
@@ -128,19 +126,16 @@ function checkRawColorValues(file, rawCss, addedLinesByFile, addedLineNumbersByF
  */
 function checkTokenPrefixViolations(file, cssContent, addedLinesByFile, tokenContext, issues) {
     // Check for non-tokenized custom properties. A variable that is both
-    // declared and consumed inside the same file is auto-exempted as a
-    // runtime state channel (see furnace.json → runtimeVariables).
+    // declared and consumed inside the same file is auto-exempted as a runtime
+    // state channel (see furnace.json → runtimeVariables).
     //
     // When diff context is available, scope the `var(...)` scan to
-    // added/modified lines only. `cssContent` (full-file) is still the
-    // source of `localDeclarations` so vars declared anywhere in the file
-    // are recognised as same-file refs regardless of where the consuming
-    // `var(...)` appears. Before this scoping change, a small edit to a
-    // Furnace override of a stock component (e.g. moz-card) produced a
-    // `token-prefix-violation` for every stock `var(--moz-card-*)` the
-    // upstream file already carried, because the scanner saw the full
-    // applied file and flagged each inherited reference as if the fork
-    // had introduced it.
+    // added/modified lines only. `cssContent` (full-file) is still the source
+    // of `localDeclarations` so vars declared anywhere in the file are
+    // recognised as same-file refs regardless of where the consuming `var(...)`
+    // appears. Without the scoping, a small edit to a Furnace override of a
+    // stock component (e.g. moz-card) produces a `token-prefix-violation` for
+    // every stock `var(--moz-card-*)` the upstream file already carried.
     if (tokenContext) {
         const declarationPattern = /(?:^|[{;,\s])(--[\w-]+)\s*:/g;
         const localDeclarations = new Set();