@hominis/fireforge 0.43.1 → 0.44.1

package/dist/src/commands/doctor.js

@@ -6,17 +6,20 @@ import { getCurrentBranch, getHead, isGitRepository, isMissingHeadError } from '
 import { ensureGit } from '../core/git-base.js';
 import { ensureMach, ensurePython } from '../core/mach.js';
 import { countPatches } from '../core/patch-apply.js';
-import { rebuildPatchesManifest, validatePatchesManifestConsistency, validatePatchIntegrity, } from '../core/patch-manifest.js';
+import { validatePatchIntegrity } from '../core/patch-manifest.js';
+import { InvalidArgumentError } from '../errors/base.js';
 import { ExitCode } from '../errors/codes.js';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { error, info, intro, outro, success, warn } from '../utils/logger.js';
+import { addWaitLockOption } from '../utils/options.js';
 import { findExecutable } from '../utils/process.js';
-import { POST_REBASE_AUDIT_CHECK } from './doctor/post-rebase-audit.js';
 import { failure, ok, resolveDoctorSeverity, warning } from './doctor-check-core.js';
 import { EXTERNAL_TOOLCHAIN_DOCTOR_CHECK } from './doctor-external-toolchains.js';
 import { FURNACE_DOCTOR_CHECKS } from './doctor-furnace.js';
 import { ORPHANED_HARNESS_DOCTOR_CHECK } from './doctor-orphaned-harness.js';
+import { PATCH_MANIFEST_CONSISTENCY_CHECK } from './doctor-patch-manifest.js';
+import { POST_REBASE_AUDIT_CHECK } from './doctor-post-rebase-audit.js';
 import { inspectEngineWorkingTree } from './doctor-working-tree.js';
 import { collectPatchQueueHealth } from './verify.js';
 /**
@@ -236,31 +239,21 @@ const DOCTOR_CHECKS = [
         fix: 'Firefox source may be corrupted. Re-download with "fireforge download --force"',
     },
     {
-        // `fireforge watch` has an undeclared hard dependency on watchman —
-        // neither `bootstrap` nor `doctor` used to surface it, so operators
-        // got through setup → download → build → and only discovered the gap
-        // when they tried to start watch mode. A warning-severity doctor row
-        // is the right shape: most projects never run watch, so a missing
-        // watchman should not fail `doctor` outright, but the information
-        // needs to be visible ahead of time rather than at the watch-mode
-        // failure site.
+        // `fireforge watch` has an undeclared hard dependency on watchman, and
+        // without a doctor row operators only discover the gap when they try to
+        // start watch mode. Warning severity is the right shape: most projects
+        // never run watch, so a missing watchman should not fail `doctor`
+        // outright, but the information needs to be visible ahead of time.
         name: 'Watchman available',
         run: async () => {
             // Resolve the absolute path so the OK row names what doctor actually
-            // found. The 2026-04-25 eval flagged a confusing case where the
-            // operator's interactive shell returned no result for `which
-            // watchman` but doctor still printed "OK" — the cause was a
-            // PATH-export discrepancy between the shell and the spawned
-            // subprocess, and surfacing the resolved path makes the discrepancy
-            // visible without users having to re-run with a verbose flag.
+            // found. A PATH-export discrepancy between the operator's interactive
+            // shell and the spawned subprocess otherwise reads as doctor printing
+            // "OK" for a binary `which watchman` cannot find; surfacing the
+            // resolved path makes the discrepancy visible without a verbose flag.
             const path = await findExecutable('watchman');
             if (path) {
-                return {
-                    name: 'Watchman available',
-                    passed: true,
-                    severity: 'ok',
-                    message: `OK (${path})`,
-                };
+                return ok('Watchman available', `OK (${path})`);
             }
             return warning('Watchman available', 'watchman is not installed or not on PATH. "fireforge watch" requires it.', 'Install watchman (brew install watchman / dnf install watchman / https://facebook.github.io/watchman/), then re-run doctor.');
         },
@@ -270,12 +263,7 @@ const DOCTOR_CHECKS = [
         name: 'Patches directory exists',
         run: async (ctx) => {
             const patchesExist = await pathExists(ctx.paths.patches);
-            return {
-                name: 'Patches directory exists',
-                passed: true,
-                severity: 'ok',
-                message: patchesExist ? 'OK' : 'No patches/ directory (optional)',
-            };
+            return ok('Patches directory exists', patchesExist ? 'OK' : 'No patches/ directory (optional)');
         },
     },
     {
@@ -285,70 +273,10 @@ const DOCTOR_CHECKS = [
                 return [];
             }
             const patchCount = await countPatches(ctx.paths.patches);
-            return {
-                name: 'Patches found',
-                passed: true,
-                severity: 'ok',
-                message: `${patchCount} patch${patchCount === 1 ? '' : 'es'} found`,
-            };
-        },
-    },
-    {
-        name: 'Patch manifest consistency',
-        dependsOn: ['fireforge.json is valid'],
-        run: async (ctx) => {
-            if (!(await pathExists(ctx.paths.patches))) {
-                return [];
-            }
-            const manifestConsistencyIssues = await validatePatchesManifestConsistency(ctx.paths.patches);
-            if (manifestConsistencyIssues.length === 0) {
-                return ok('Patch manifest consistency');
-            }
-            if (!ctx.options.repairPatchesManifest) {
-                return failure('Patch manifest consistency', manifestConsistencyIssues.map((issue) => issue.message).join(' '), 'Run "fireforge doctor --repair-patches-manifest" to rebuild patches.json from patch files.');
-            }
-            // Repair stamps sourceEsrVersion into every recovered entry. If the
-            // earlier "fireforge.json is valid" check failed, ctx.config is
-            // undefined and we must refuse rather than fabricate a fallback —
-            // persisting 'unknown' into manifest metadata is hard to reverse
-            // and would mislead every later command that reads it.
-            if (!ctx.config) {
-                return failure('Patch manifest consistency', 'Cannot repair patches.json: fireforge.json could not be loaded, so the Firefox version to stamp into recovered manifest entries is unknown.', 'Fix the fireforge.json errors reported above and re-run "fireforge doctor --repair-patches-manifest".');
-            }
-            try {
-                const repaired = await rebuildPatchesManifest(ctx.paths.patches, ctx.config.firefox.version);
-                // 2026-04-21 eval (Finding #17): the repair path silently
-                // overwrote useful human-written descriptions on recovered
-                // entries, leaving the queue less trustworthy as an audit
-                // trail. The rebuilder now returns the list of filenames
-                // whose metadata was entirely invented, and we name them
-                // explicitly here so the operator knows exactly which
-                // patches to review. Names that DID have a preserved entry
-                // (only `filesAffected` / ordering drifted) are not flagged.
-                if (repaired.recoveredFilenames.length > 0) {
-                    for (const filename of repaired.recoveredFilenames) {
-                        // 2026-04-24 eval Finding 6: the repair path used to tell the
-                        // operator to hand-edit patches.json, which contradicts the
-                        // README + downstream docs that treat the manifest as
-                        // FireForge-owned. Point at the existing `re-export` /
-                        // `export` workflow instead so the fix stays inside the tool:
-                        // re-exporting the same files with an explicit `--description`
-                        // overwrites the recovered entry with operator-supplied
-                        // metadata and supersedes the mtime-based createdAt stamp.
-                        warn(`Recovered manifest entry for ${filename} with generic description and mtime-based createdAt. ` +
-                            'Re-export the affected files with `fireforge re-export <filename> --description "<your description>"` ' +
-                            '(or `fireforge export <paths...> --name <name> --category <category> --description "<your description>"`) ' +
-                            'to overwrite the reconstructed metadata, or accept the generic description if the original text is not recoverable. ' +
-                            'Avoid hand-editing patches.json — FireForge owns that file and will regenerate it on the next manifest consistency pass.');
-                    }
-                }
-                return warning('Patch manifest consistency', `Rebuilt patches.json from ${repaired.manifest.patches.length} patch${repaired.manifest.patches.length === 1 ? '' : 'es'}${repaired.recoveredFilenames.length > 0 ? ` (${repaired.recoveredFilenames.length} with reconstructed metadata — see warnings above)` : ''}. Review recovered metadata before release.`);
-            }
-            catch (err) {
-                return failure('Patch manifest consistency', toError(err).message, 'Repair failed. Fix the underlying patch metadata issue and retry the doctor command.');
-            }
+            return ok('Patches found', `${patchCount} patch${patchCount === 1 ? '' : 'es'} found`);
         },
     },
+    PATCH_MANIFEST_CONSISTENCY_CHECK,
     {
         name: 'Patch integrity',
         skipIf: (ctx) => !ctx.engineExists,
@@ -400,7 +328,7 @@ export const DOCTOR_CHECK_ORDER = DOCTOR_CHECKS.map((check) => check.name);
  * @param checks - The check results to display
  * @returns The exit code reflecting the overall result
  */
-export function reportDoctorResults(checks) {
+export function reportDoctorResults(checks, mutations = []) {
     info('');
     let passedCount = 0;
     let warningCount = 0;
@@ -427,6 +355,16 @@ export function reportDoctorResults(checks) {
         }
     }
     info('');
+    // Printed in every branch, including the failing one: a repair that wrote
+    // and then met an unrelated failing check must not be reported as a run
+    // where nothing happened.
+    if (mutations.length > 0) {
+        warn('Repairs applied this run:');
+        for (const mutation of mutations) {
+            warn(`  ${mutation}`);
+        }
+        info('');
+    }
     if (failedCount === 0 && warningCount === 0) {
         outro(`All ${passedCount} checks passed!`);
     }
@@ -439,12 +377,38 @@ export function reportDoctorResults(checks) {
     }
     return ExitCode.SUCCESS;
 }
+/**
+ * Rejects repair-flag combinations that cannot mean what they say.
+ *
+ * The two manifest repairs are different operations on the same file, and
+ * `--dry-run` with nothing to project is a flag that silently does nothing —
+ * the shape most likely to be mistaken for a preview that reported "no
+ * changes".
+ */
+function assertRepairOptions(options) {
+    if (options.repairPatchesManifest === true && options.repairFilesAffected === true) {
+        throw new InvalidArgumentError('--repair-patches-manifest and --repair-files-affected are mutually exclusive. ' +
+            'Use --repair-files-affected for filesAffected drift; use --repair-patches-manifest ' +
+            'when rows are missing, untracked or duplicated.', '--repair-files-affected');
+    }
+    if (options.allowMetadataLoss === true && options.repairPatchesManifest !== true) {
+        throw new InvalidArgumentError('--allow-metadata-loss only applies to --repair-patches-manifest.', '--allow-metadata-loss');
+    }
+    if (options.dryRun === true &&
+        options.repairPatchesManifest !== true &&
+        options.repairFilesAffected !== true) {
+        throw new InvalidArgumentError('--dry-run needs a manifest repair to project. Pass it with ' +
+            '--repair-patches-manifest or --repair-files-affected. ' +
+            '(--repair-furnace has no dry-run: it reconciles engine state, not a manifest.)', '--dry-run');
+    }
+}
 /**
  * Runs the doctor command to diagnose issues.
  * @param projectRoot - Root directory of the project
  */
 export async function doctorCommand(projectRoot, options = {}) {
     intro('FireForge Doctor');
+    assertRepairOptions(options);
     const paths = getProjectPaths(projectRoot);
     const state = await loadState(projectRoot);
     const engineExists = await pathExists(paths.engine);
@@ -458,24 +422,28 @@ export async function doctorCommand(projectRoot, options = {}) {
         config: undefined,
         furnaceConfigExists: furnaceConfigExistsFlag,
         furnaceConfig: undefined,
+        mutations: [],
     };
     const checks = [];
     for (const definition of DOCTOR_CHECKS) {
         checks.push(...(await executeCheck(definition, ctx)));
     }
-    const exitCode = reportDoctorResults(checks);
+    const exitCode = reportDoctorResults(checks, ctx.mutations);
     return { checks, exitCode };
 }
 /** Registers the doctor command on the CLI program. */
 export function registerDoctor(program, { getProjectRoot, withErrorHandling }) {
-    program
+    const command = program
         .command('doctor')
         .description('Diagnose project issues')
-        .option('--repair-patches-manifest', 'Rebuild patches/patches.json from the current patch files before reporting results')
+        .option('--repair-patches-manifest', 'Rebuild patches/patches.json from the current patch files before reporting results. Only filesAffected and order are recomputed; every other field on an existing entry is preserved')
+        .option('--repair-files-affected', 'Repair only the filesAffected lists that disagree with their patch body, leaving every other manifest field untouched')
+        .option('--allow-metadata-loss', 'With --repair-patches-manifest, rebuild even when patches.json cannot be parsed — every descriptive field on every entry is then reinvented')
+        .option('--dry-run', 'Show what a requested repair would change without writing anything')
         .option('--repair-furnace', 'Reconcile furnace state: clear stale furnace-state.json entries, re-run furnace apply to fix engine drift, and clear the pending-repair marker set by a failed preview teardown')
         .option('--clear-resolution', 'Clear stale pendingResolution state after the patch queue health check reports no errors')
-        .option('--post-rebase-audit', 'Check common registration surfaces after a Firefox source rebase')
-        .action(withErrorHandling(async (options) => {
+        .option('--post-rebase-audit', 'Check common registration surfaces after a Firefox source rebase');
+    addWaitLockOption(command).action(withErrorHandling(async (options) => {
         const result = await doctorCommand(getProjectRoot(), options);
         if (result.exitCode !== 0) {
             process.exitCode = result.exitCode;

package/dist/src/commands/download.js

@@ -76,13 +76,12 @@ async function cleanPatchTouchedFiles(engineDir, patchesDir, preExistingDirty) {
 }
 /**
  * Prints a one-line nudge pointing at `fireforge import` when the project
- * carries a non-empty patch queue but the just-downloaded engine has not
- * yet had any patches applied. The post-download spinner closes with
+ * carries a non-empty patch queue but the just-downloaded engine has not yet
+ * had any patches applied. The post-download spinner closes with
  * "Patch-touched files already match baseline" because a fresh tree IS at
- * baseline, but the 2026-04-25 eval saw operators read that as "patches
- * are restored" and skip the import step. The note is suppressed when
- * patches/ is missing or the manifest is empty so unconfigured projects
- * stay quiet.
+ * baseline, which reads as "patches are restored" and invites skipping the
+ * import step. Suppressed when patches/ is missing or the manifest is empty
+ * so unconfigured projects stay quiet.
  */
 async function noteUnappliedPatches(patchesDir) {
     if (!(await pathExists(patchesDir)))
@@ -97,12 +96,8 @@ async function noteUnappliedPatches(patchesDir) {
  * Stops `restoreSpinner` with a message that reflects what actually
  * happened. Three branches: empty queue → explicit no-op; queue present but
  * nothing dirty → "already clean"; queue with dirty files → the usual
- * "Patch-touched files restored" success line.
- *
- * Before 0.16.0 the spinner always closed with "Patch-touched files
- * restored", so a fresh project with zero patches saw a claim of restore
- * work that had not happened — misleading and easy to mistake for a
- * silent retry.
+ * "Patch-touched files restored" success line. Always closing with the third
+ * claims restore work that did not happen on a project with zero patches.
  */
 function closeRestoreSpinner(restoreSpinner, result) {
     if (!result.hadQueue) {
@@ -192,12 +187,11 @@ async function downloadAndExtractFirefox(args) {
     }
 }
 /**
- * Prints the major-version-hop toolchain nudge when this download moved
- * the engine across a Firefox MAJOR version (152.0b7 → 153.0b8 drill:
- * the first post-hop build died in `mach configure` on a moved cbindgen
- * minimum, and nothing in the download output suggested re-running
- * `fireforge bootstrap`). Quiet on first downloads and same-major
- * re-downloads.
+ * Prints the major-version-hop toolchain nudge when this download moved the
+ * engine across a Firefox MAJOR version — the first post-hop build otherwise
+ * dies in `mach configure` on a moved cbindgen minimum with nothing in the
+ * download output suggesting `fireforge bootstrap`. Quiet on first downloads
+ * and same-major re-downloads.
  */
 function noteMajorVersionHop(previousVersion, version) {
     const hopNotice = formatMajorVersionHopNotice(previousVersion, version);
@@ -207,9 +201,9 @@ function noteMajorVersionHop(previousVersion, version) {
 }
 async function initializeDownloadedEngine(args) {
     const { projectRoot, patchesDir, version, previousVersion, engineDir, replacementActivated, backupEngineDir, } = args;
-    // Finding #17: the git indexing phase of `download` can block for
-    // minutes on a ~600 MB Firefox tree. Emit a one-line heads-up banner
-    // before the spinner starts so CI logs show the expected duration.
+    // The git indexing phase of `download` can block for minutes on a ~600 MB
+    // Firefox tree. Emit a one-line heads-up banner before the spinner starts
+    // so CI logs show the expected duration.
     try {
         info('Indexing downloaded source into git (one-time; typically 3–5 minutes on a ~600 MB Firefox tree)...');
         info('Git phase: initializing/resetting source repository metadata.');
@@ -280,11 +274,11 @@ export async function downloadCommand(projectRoot, options) {
     info(`Firefox version: ${version}`);
     await checkDiskSpace(projectRoot, 5 * 1024 * 1024 * 1024, warn);
     // A legitimate holder of this lock runs for 10+ minutes (download +
-    // extract + git indexing). The previous default 30 s timeout failed the
-    // second invocation with "remove the lock directory if it is stale" advice
-    // while the lock was actively held — dangerous guidance mid-extraction.
-    // Wait generously instead: a dead holder is reaped within seconds by the
-    // PID-based stale probe, so a long timeout only ever waits on real work.
+    // extract + git indexing). A 30 s timeout fails the second invocation with
+    // "remove the lock directory if it is stale" advice while the lock is
+    // actively held — dangerous guidance mid-extraction. Wait generously
+    // instead: a dead holder is reaped within seconds by the PID-based stale
+    // probe, so a long timeout only ever waits on real work.
     const downloadLockOptions = {
         timeoutMs: 30 * 60_000,
         onTimeoutMessage: 'Timed out waiting for another FireForge download to finish. ' +
@@ -329,11 +323,9 @@ export async function downloadCommand(projectRoot, options) {
                                     // The non-TTY spinner fallback in `src/utils/logger.ts`
                                     // already calls `p.log.step(msg)` from `message()`, so
                                     // forwarding the progress message is the single authority
-                                    // in both TTY and non-TTY modes. Before 0.16.0 this
-                                    // callback also invoked `step(message)` explicitly when
-                                    // stdio was not a TTY, which printed the same step line
-                                    // twice in CI logs (once from the fallback, once from
-                                    // the explicit call).
+                                    // in both TTY and non-TTY modes. Calling `step(message)`
+                                    // explicitly here as well prints the same line twice in
+                                    // CI logs.
                                     onProgress: (message) => {
                                         resumeSpinner.message(message);
                                     },
@@ -359,17 +351,14 @@ export async function downloadCommand(projectRoot, options) {
                             }
                             catch (error) {
                                 resumeSpinner.error('Resume failed');
-                                // Preserve the underlying cause so the user sees *why* the
-                                // resume failed (timeout, permission denied, corrupted object,
-                                // disk full, …) instead of only the generic "partial engine
-                                // exists" story. Verbose mode prints the stack for deeper
-                                // triage.
-                                const cause = toError(error);
-                                verbose(`Resume failure detail: ${cause.message}`);
-                                if (cause.stack) {
-                                    verbose(cause.stack);
-                                }
-                                throw new PartialEngineExistsError(paths.engine, cause);
+                                // Preserve the underlying cause so the operator sees *why*
+                                // the resume failed (timeout, permission denied, corrupted
+                                // object, disk full) instead of only the generic "partial
+                                // engine exists" story. The cause reaches them through the
+                                // CLI boundary's chain walk under --verbose (src/cli.ts),
+                                // which is what makes PartialEngineExistsError's "re-run
+                                // with --verbose" promise true.
+                                throw new PartialEngineExistsError(paths.engine, toError(error));
                             }
                         }
                         // Re-throw unexpected git errors (corrupted objects, permission
@@ -377,12 +366,7 @@ export async function downloadCommand(projectRoot, options) {
                         // both narratives: "we detected a partial engine and attempted
                         // resume" AND the underlying git failure. Without the wrap the
                         // raw git error loses the context that resume was in flight.
-                        const cause = toError(error);
-                        verbose(`Partial-engine probe failed with unexpected error: ${cause.message}`);
-                        if (cause.stack) {
-                            verbose(cause.stack);
-                        }
-                        throw new PartialEngineExistsError(paths.engine, cause);
+                        throw new PartialEngineExistsError(paths.engine, toError(error));
                     }
                 }
                 throw new EngineExistsError(paths.engine);

package/dist/src/commands/export-all.js

@@ -2,8 +2,10 @@
 import { Command } from 'commander';
 import { isBrandingManagedPath } from '../core/branding.js';
 import { getProjectPaths, loadConfig } from '../core/config.js';
+import { stdioIsInteractive } from '../core/destructive.js';
+import { assertEngineGitReady } from '../core/engine-precondition.js';
 import { collectFurnaceManagedPrefixes, furnaceConfigExists, loadFurnaceConfig, } from '../core/furnace-config.js';
-import { hasChanges, isGitRepository } from '../core/git.js';
+import { hasChanges } from '../core/git.js';
 import { getAllDiff, getDiffForFilesAgainstHead } from '../core/git-diff.js';
 import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from '../core/git-status.js';
 import { extractAffectedFiles } from '../core/patch-apply.js';
@@ -14,7 +16,7 @@ import { buildPatchSourceMetadata } from '../core/patch-source-metadata.js';
 import { GeneralError } from '../errors/base.js';
 import { ensureDir, pathExists } from '../utils/fs.js';
 import { info, intro, outro, spinner } from '../utils/logger.js';
-import { pickDefined } from '../utils/options.js';
+import { addWaitLockOption, pickDefined, resolveWaitLockSeconds } from '../utils/options.js';
 import { renderDryRunPreview } from './export-flow.js';
 import { autoFixLicenseHeaders, promptExportPatchMetadata, runPatchLint, runSupersedeAndOverlapGates, } from './export-shared.js';
 async function checkBrandingManagedFiles(paths, config) {
@@ -46,9 +48,7 @@ async function resolveFurnaceExclusionPolicy(paths, projectRoot, excludeFurnace)
     // Expand collapsed `?? dir/` entries before matching against Furnace
     // prefixes — otherwise a Furnace-introduced directory slips past the
     // filter and later lands in the non-Furnace path list that feeds the
-    // aggregate diff, where `getDiffForFilesAgainstHead` crashes with
-    // EISDIR (eval finding: export-all unusable on a fresh project with
-    // Furnace scaffolding).
+    // aggregate diff, where `getDiffForFilesAgainstHead` crashes with EISDIR.
     const rawStatus = await getWorkingTreeStatus(paths.engine);
     const changedFiles = await expandUntrackedDirectoryEntries(paths.engine, rawStatus);
     const furnaceManagedFiles = changedFiles
@@ -66,20 +66,19 @@ async function resolveFurnaceExclusionPolicy(paths, projectRoot, excludeFurnace)
 }
 /**
  * Refuses the export when the resulting patch would register furnace
- * component source files it does not itself carry. 2026-04-24 eval
- * Finding 1: operators running `export-all --exclude-furnace` after
- * `furnace create --localized --with-tests` ended up with patches that
- * added `toolkit/content/widgets/moz-qa-panel/*` via jar.mn /
- * customElements.js / locale jar.mn but excluded the component source
- * files themselves. The resulting patch queue was structurally broken
- * and `fireforge verify` stayed silent. We now detect the condition
- * pre-write and ask the operator to either include the component
- * sources (skip `--exclude-furnace`) or revert the furnace changes
- * before exporting.
+ * component source files it does not itself carry.
+ *
+ * `export-all --exclude-furnace` after `furnace create --localized
+ * --with-tests` otherwise produces a patch that adds
+ * `toolkit/content/widgets/<tag>/*` via jar.mn / customElements.js / locale
+ * jar.mn while excluding the component source files themselves — a
+ * structurally broken queue that `fireforge verify` stays silent about. The
+ * operator is asked to either include the component sources (skip
+ * `--exclude-furnace`) or revert the furnace changes before exporting.
  *
  * The check runs against the synthesised patch body before
- * `commitExportedPatch` writes anything, so no broken patch is left on
- * disk when the refusal fires.
+ * `commitExportedPatch` writes anything, so no broken patch is left on disk
+ * when the refusal fires.
  */
 async function checkDanglingFurnaceRegistrations(projectRoot, diff, furnaceExcluded) {
     if (furnaceExcluded.size === 0)
@@ -171,14 +170,7 @@ export async function exportAllCommand(projectRoot, options = {}) {
     const isDryRun = options.dryRun === true;
     intro(isDryRun ? 'FireForge Export All (dry run)' : 'FireForge Export All');
     const paths = getProjectPaths(projectRoot);
-    // Check if engine exists
-    if (!(await pathExists(paths.engine))) {
-        throw new GeneralError('Firefox source not found. Run "fireforge download" first.');
-    }
-    // Check if it's a git repository
-    if (!(await isGitRepository(paths.engine))) {
-        throw new GeneralError('Engine directory is not a git repository. Run "fireforge download" to initialize.');
-    }
+    await assertEngineGitReady(paths.engine);
     // Check for changes
     if (!(await hasChanges(paths.engine))) {
         info('No changes to export');
@@ -228,13 +220,13 @@ export async function exportAllCommand(projectRoot, options = {}) {
     // the aggregate would newly create, so it runs here instead of alongside
     // the branding / furnace guards that operate on the raw status list.
     await checkDuplicateNewFileCreations(paths, diff);
-    // Dangling-furnace-registration preflight (Finding 1). Runs after the
-    // diff is assembled so we can inspect the exact hunks the operator is
-    // about to land; runs BEFORE any write so a refusal leaves the
-    // patches directory untouched.
+    // Dangling-furnace-registration preflight. Runs after the diff is
+    // assembled so it can inspect the exact hunks the operator is about to
+    // land, and BEFORE any write so a refusal leaves the patches directory
+    // untouched.
     await checkDanglingFurnaceRegistrations(projectRoot, diff, furnaceExcluded);
     // Check for non-interactive mode
-    const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
+    const isInteractive = stdioIsInteractive();
     // Auto-fix missing license headers on new files (interactive only;
     // report-only under --dry-run so the preview never mutates engine/)
     const headersAdded = await autoFixLicenseHeaders(paths.engine, diff, config, isInteractive, isDryRun);
@@ -308,6 +300,10 @@ export async function exportAllCommand(projectRoot, options = {}) {
             config,
             policyCommand: 'export-all',
             forceUnsafe: options.forceUnsafe === true,
+            lockOptions: {
+                waitLockSeconds: resolveWaitLockSeconds(options.waitLock),
+                command: 'export-all',
+            },
         });
         for (const oldPatch of superseded) {
             info(`Superseded: ${oldPatch.filename}`);
@@ -326,7 +322,7 @@ export async function exportAllCommand(projectRoot, options = {}) {
 }
 /** Registers the export-all command on the CLI program. */
 export function registerExportAll(program, { getProjectRoot, withErrorHandling }) {
-    program
+    const command = program
         .command('export-all')
         .description('Export all changes as a patch')
         .option('--name <name>', 'Name for the patch')
@@ -337,8 +333,8 @@ export function registerExportAll(program, { getProjectRoot, withErrorHandling }
         .option('--exclude-furnace', 'Export the non-Furnace subset of the aggregate diff instead of refusing when Furnace-managed files are modified. Furnace-managed files are still deployed by "fireforge furnace apply"; this flag only changes whether export-all aborts or filters in their presence.')
         .option('--allow-overlap', 'Acknowledge cross-patch ownership overlap with non-superseded patches (the resulting queue fails verify). Does not bypass the new-file creation guard — two patches creating the same path is structurally unrecoverable, so that case still refuses regardless of this flag.')
         .option('--dry-run', 'Print the export-all plan (filename, metadata, files affected, supersede preview) without writing anything to patches/. Lint still runs so the operator sees the same lint output a real run would produce.')
-        .option('--force-unsafe', 'Bypass force-mode patchPolicy refusals')
-        .action(withErrorHandling(async (options) => {
+        .option('--force-unsafe', 'Bypass force-mode patchPolicy refusals');
+    addWaitLockOption(command).action(withErrorHandling(async (options) => {
         const { category, ...rest } = options;
         await exportAllCommand(getProjectRoot(), {
             ...pickDefined(rest),

package/dist/src/commands/export-flow.js

@@ -195,12 +195,12 @@ export async function projectPlacementForLint(patchesDir, plan, diff, config) {
             return entry;
         return { ...entry, filename: rename.newFilename, order: rename.newOrder };
     });
-    // Synthetic entry for the pending patch, populated with both its
-    // new-file content AND its added-line content for files it modifies
-    // so the forward-import rule can inspect imports the patch *itself*
-    // authors — whether they live in a brand-new file or are added to an
-    // existing file. Leaving either map empty lets a patch land before
-    // one of its own dependencies and still pass the gate.
+    // Synthetic entry for the pending patch, populated with both its new-file
+    // content AND its added-line content for files it modifies, so the
+    // forward-import rule can inspect imports the patch *itself* authors —
+    // whether they live in a brand-new file or are added to an existing one.
+    // Leaving either map empty lets a patch land before one of its own
+    // dependencies and still pass the gate.
     projectedEntries.push({
         filename: plan.newFilename,
         order: plan.insertionOrder,

package/dist/src/commands/export-placement-conflicts.js

@@ -1,16 +1,17 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
  * Attribution of projected placement lint errors, split out of
- * export-flow.ts for the line budget. A placement projection lints one
- * merged queue — the renumbered existing patches plus a synthetic entry
- * for the pending patch — so its errors used to render as one flat list
- * that read as though the NEW patch caused every one of them. A
- * renumbering that re-evaluates pre-existing staged relationships (455
- * importing a module created by 456, legal only at their current
- * ordinals) then sent the operator auditing a perfectly fine export.
+ * export-flow.ts for the line budget.
  *
- * Consumed by export-flow.ts; no top-level registrar is exported and none
- * is wanted.
+ * A placement projection lints one merged queue — the renumbered existing
+ * patches plus a synthetic entry for the pending patch — so a flat error
+ * list reads as though the NEW patch caused every one of them. A renumbering
+ * that re-evaluates pre-existing staged relationships (patch 455 importing a
+ * module created by 456, legal only at their current ordinals) then sends
+ * the operator auditing a perfectly fine export.
+ *
+ * Consumed by export-flow.ts; no top-level registrar is exported and none is
+ * wanted.
  */
 import { formatPatchLintIssue } from '../core/patch-lint.js';
 /**

package/dist/src/commands/export-placement-gate.js

@@ -70,10 +70,10 @@ export async function gatePlacementPlan(args) {
     const summary = placementSummary(placementPlan);
     const renameCount = placementPlan.renameMap.size;
     // Route through confirmDestructive when the operation is destructive
-    // enough to warrant a prompt (more than one rename) OR when the user
-    // asked for a dry-run. The dry-run branch must always print the
-    // placement summary — previously, single-rename/no-rename dry-runs
-    // exited silently with no filename or projected layout.
+    // enough to warrant a prompt (more than one rename) OR when the user asked
+    // for a dry-run. The dry-run branch must always print the placement
+    // summary; otherwise single-rename and no-rename dry-runs exit silently
+    // with no filename or projected layout.
     if (renameCount > 1 || isDryRun) {
         s.stop();
         const decision = await confirmDestructive({
@@ -89,7 +89,7 @@ export async function gatePlacementPlan(args) {
             outro('Dry run complete — no changes made');
             return 'stop';
         }
-        if (decision === 'cancelled') {
+        if (decision === 'declined') {
             outro('Export cancelled');
             return 'stop';
         }