@hominis/fireforge 0.44.0 → 0.44.1

package/dist/src/core/patch-manifest-files-affected.js

@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Narrow repair for `filesAffected` — the one manifest field a `.patch` body
+ * can actually yield.
+ *
+ * A `files-affected-mismatch` is pure derived-value drift: the manifest's list
+ * disagrees with the diff it describes, and the diff is right by definition.
+ * Rebuilding the whole manifest to fix it is a much larger operation than the
+ * failure calls for, so this repair recomputes one field on the drifted rows
+ * and leaves every other row byte-identical.
+ */
+import { GeneralError } from '../errors/base.js';
+import { discoverPatches, getAllTargetFilesFromPatch } from './patch-files.js';
+import { withPatchDirectoryLock } from './patch-lock.js';
+import { normalizeAffectedFiles } from './patch-manifest-consistency.js';
+import { loadPatchesManifestForWrite, mutatePatchRowsInManifest, PATCHES_MANIFEST, } from './patch-manifest-io.js';
+/**
+ * Recomputes `filesAffected` from the patch body for the named patches.
+ *
+ * @param patchesDir - Path to the patches directory
+ * @param filenames - Patch filenames to repair
+ * @param options - Lock options plus `dryRun`
+ * @returns The corrections applied (or projected) and the filenames skipped
+ */
+export async function repairPatchesFilesAffected(patchesDir, filenames, options = {}) {
+    // Same lock contract as the full rebuild (invariant 2,
+    // docs/lifecycle-invariants.md): a manifest write serializes on the
+    // patch-directory lock, and a dry run reads under it so its projection
+    // cannot be computed against a queue being rewritten underneath.
+    return withPatchDirectoryLock(patchesDir, () => repairPatchesFilesAffectedUnderLock(patchesDir, filenames, options), options);
+}
+async function repairPatchesFilesAffectedUnderLock(patchesDir, filenames, options) {
+    // ForWrite: a corrupt manifest must abort here rather than be treated as
+    // empty. This repair exists precisely so that a one-field drift never
+    // reaches a whole-manifest rewrite, and silently writing over unparseable
+    // metadata would be a larger version of what it avoids.
+    const manifest = await loadPatchesManifestForWrite(patchesDir);
+    if (!manifest) {
+        throw new GeneralError(`Cannot repair filesAffected: ${PATCHES_MANIFEST} does not exist in ${patchesDir}.`);
+    }
+    const patchPathByFilename = new Map((await discoverPatches(patchesDir)).map((patch) => [patch.filename, patch.path]));
+    const rowByFilename = new Map(manifest.patches.map((entry) => [entry.filename, entry]));
+    const repairs = [];
+    const skippedFilenames = [];
+    for (const filename of new Set(filenames)) {
+        const patchPath = patchPathByFilename.get(filename);
+        const row = rowByFilename.get(filename);
+        if (patchPath === undefined || !row) {
+            // A missing patch file or a missing row is a different consistency
+            // issue with a different remedy; this repair reports it rather than
+            // inventing a row or deleting one.
+            skippedFilenames.push(filename);
+            continue;
+        }
+        const before = normalizeAffectedFiles(row.filesAffected);
+        const after = normalizeAffectedFiles(await getAllTargetFilesFromPatch(patchPath));
+        if (sameFiles(before, after))
+            continue;
+        repairs.push({ filename, before, after });
+    }
+    skippedFilenames.sort((left, right) => left.localeCompare(right));
+    if (repairs.length === 0 || options.dryRun === true) {
+        return { repairs, skippedFilenames, written: false };
+    }
+    const correctedByFilename = new Map(repairs.map((repair) => [repair.filename, repair.after]));
+    // Row-scoped mutation, so every untouched entry keeps its exact JSON shape —
+    // no re-sorted `filesAffected` lists and no reader-only fallback fields
+    // serialized into rows this repair has no business touching.
+    await mutatePatchRowsInManifest(patchesDir, [...correctedByFilename.keys()], (existing) => {
+        const corrected = correctedByFilename.get(existing.filename);
+        return corrected ? { set: { filesAffected: corrected } } : null;
+    });
+    return { repairs, skippedFilenames, written: true };
+}
+function sameFiles(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}

package/dist/src/core/patch-manifest.d.ts

@@ -4,7 +4,8 @@
  * Callers should continue to import from this module; the internal split
  * is an implementation detail.
  */
-export { rebuildPatchesManifest, validatePatchesManifestConsistency, } from './patch-manifest-consistency.js';
+export { type PatchManifestConsistencyIssue, rebuildPatchesManifest, recommendManifestRepair, validatePatchesManifestConsistency, } from './patch-manifest-consistency.js';
+export { type FilesAffectedRepair, repairPatchesFilesAffected, } from './patch-manifest-files-affected.js';
 export { addPatchToManifest, loadPatchesManifest, loadPatchesManifestForWrite, mutatePatchRowsInManifest, PATCHES_MANIFEST, type PatchRenameEntry, removePatchFileAndManifest, renumberPatchesInManifest, rewriteStagedDependencyOwners, savePatchesManifest, } from './patch-manifest-io.js';
 export { checkVersionCompatibility, findPatchesAffectingFile, getClaimedFiles, stampPatchVersions, validatePatchIntegrity, } from './patch-manifest-query.js';
 export { resolvePatchIdentifier } from './patch-manifest-resolve.js';

package/dist/src/core/patch-manifest.js

@@ -5,7 +5,8 @@
  * Callers should continue to import from this module; the internal split
  * is an implementation detail.
  */
-export { rebuildPatchesManifest, validatePatchesManifestConsistency, } from './patch-manifest-consistency.js';
+export { rebuildPatchesManifest, recommendManifestRepair, validatePatchesManifestConsistency, } from './patch-manifest-consistency.js';
+export { repairPatchesFilesAffected, } from './patch-manifest-files-affected.js';
 export { addPatchToManifest, loadPatchesManifest, loadPatchesManifestForWrite, mutatePatchRowsInManifest, PATCHES_MANIFEST, removePatchFileAndManifest, renumberPatchesInManifest, rewriteStagedDependencyOwners, savePatchesManifest, } from './patch-manifest-io.js';
 export { checkVersionCompatibility, findPatchesAffectingFile, getClaimedFiles, stampPatchVersions, validatePatchIntegrity, } from './patch-manifest-query.js';
 export { resolvePatchIdentifier } from './patch-manifest-resolve.js';

package/dist/src/core/token-category.js

@@ -19,6 +19,63 @@ function singleLineBannerPattern(category) {
 function multiLineBlockNameMatches(blockLine, category) {
     return blockLine.replace(/^\s*\*\s*/, '').trim() === category;
 }
+/**
+ * Body of the first `/* … *\/` comment on `line`, or `null` when the line
+ * carries no closed block comment.
+ *
+ * Deliberately index arithmetic rather than a regex: every regex spelling of
+ * "banner comment" this module used to carry was super-linear on a line that
+ * repeats the opening shape (CodeQL `js/polynomial-redos`), and `tokens.css`
+ * is a file FireForge reads out of a consumer's engine tree, so a
+ * pathological line needs no attacker to arrive.
+ */
+function blockCommentBody(line) {
+    const open = line.indexOf('/*');
+    if (open === -1)
+        return null;
+    const close = line.indexOf('*/', open + 2);
+    if (close === -1)
+        return null;
+    return line.slice(open + 2, close);
+}
+/**
+ * True when `line` carries a single-line banner comment — a closed block
+ * comment whose body both opens and closes with `=`. Recognises the decorative
+ * all-`=` rule as well as a named `= Foo =` banner, which is what the section
+ * scan wants: either shape ends the preceding section.
+ */
+function isSingleLineBannerLine(line) {
+    const body = blockCommentBody(line)?.trim();
+    return body !== undefined && body.length >= 2 && body.startsWith('=') && body.endsWith('=');
+}
+/**
+ * Name declared by a single-line banner (`/* = Foo = *\/` → `Foo`), or `null`
+ * when the line is not a named banner. The `=` runs on both sides are
+ * required; a decorative all-`=` rule carries no name and yields `null`.
+ */
+function singleLineBannerName(line) {
+    const body = blockCommentBody(line);
+    if (body === null)
+        return null;
+    let start = 0;
+    let end = body.length;
+    while (start < end && /\s/.test(body[start] ?? ''))
+        start++;
+    const leadingEqStart = start;
+    while (start < end && body[start] === '=')
+        start++;
+    if (start === leadingEqStart)
+        return null;
+    while (end > start && /\s/.test(body[end - 1] ?? ''))
+        end--;
+    const trailingEqEnd = end;
+    while (end > start && body[end - 1] === '=')
+        end--;
+    if (end === trailingEqEnd)
+        return null;
+    const name = body.slice(start, end).trim();
+    return name.length > 0 ? name : null;
+}
 /**
  * True when `lines` contain a category header (single-line or multi-line
  * banner shape) whose name EQUALS `category`. Shared by the pre-add
@@ -60,14 +117,11 @@ export function categoryHeaderExists(lines, category) {
  */
 function discoverCategoryHeaders(lines) {
     const categories = new Set();
-    const singleLinePattern = /\/\*\s*=+\s*(.+?)\s*=+\s*\*\//;
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i] ?? '';
-        const singleMatch = singleLinePattern.exec(line);
-        if (singleMatch?.[1]) {
-            const extracted = singleMatch[1].trim();
-            if (extracted.length > 0)
-                categories.add(extracted);
+        const extracted = singleLineBannerName(line);
+        if (extracted !== null) {
+            categories.add(extracted);
             continue;
         }
         if (/^\s*\/\*\s*=+/.test(line) && !/\*\//.test(line)) {
@@ -181,7 +235,7 @@ export function findCategorySection(lines, category, tokensCssPath) {
     let sectionEnd = lines.length;
     for (let i = scanStart; i < lines.length; i++) {
         const line = lines[i] ?? '';
-        if (/\/\*\s*=.*=\s*\*\//.test(line) ||
+        if (isSingleLineBannerLine(line) ||
             (/^\s*\/\*\s*=+/.test(line) && !/\*\//.test(line)) ||
             /^\s*\}/.test(line)) {
             sectionEnd = i;

package/dist/src/core/token-dark-mode.js

@@ -12,6 +12,24 @@
  * fallback helper returns the outer `@media` block's close so the caller can
  * materialise a fresh `:root` wrapper rather than dropping the dark value.
  */
+/**
+ * True when `line` carries a `:root` selector whose opening brace is on the
+ * same line, with no intervening brace of either kind.
+ *
+ * Index arithmetic rather than `/:root[^{}]*\{/`: that pattern restarts at
+ * every `:root` in the line, which is quadratic on a line repeating the
+ * selector (CodeQL `js/polynomial-redos`). `tokens.css` comes from a
+ * consumer's engine tree, so such a line needs no attacker to arrive.
+ */
+function rootOpensBraceOnLine(line) {
+    const brace = line.indexOf('{');
+    if (brace === -1)
+        return false;
+    const root = line.lastIndexOf(':root', brace - ':root'.length);
+    if (root === -1 || root + ':root'.length > brace)
+        return false;
+    return !line.slice(root + ':root'.length, brace).includes('}');
+}
 /**
  * Strips the content of `/* ... *\/` block comments from an array of
  * CSS source lines while preserving each line's length. Indexed scans
@@ -85,9 +103,9 @@ export function findDarkRootInsertionIndex(lines) {
     let rootOpenLine = -1;
     for (let i = darkMediaLine; i < stripped.length; i++) {
         const line = stripped[i] ?? '';
-        if (/(^|[\s,{])\s*:root\b/.test(line)) {
+        if (/(?:^|[\s,{]):root\b/.test(line)) {
             // Brace on the same line?
-            if (/:root[^{}]*\{/.test(line)) {
+            if (rootOpensBraceOnLine(line)) {
                 rootOpenLine = i;
                 break;
             }

package/dist/src/core/token-docs.js

@@ -44,7 +44,7 @@ export async function addTokenToDocs(engineDir, options, annotation) {
     let unmappedAdded = false;
     let countUpdated = false;
     const isLiteral = !options.value.startsWith('var(');
-    const mapsTo = isLiteral ? '—' : options.value.replace(/var\(([^)]+)\)/, '$1');
+    const mapsTo = isLiteral ? '—' : options.value.replace(/^var\(([^)]+)\)/, '$1');
     const tokenCell = `\`${options.tokenName}\``;
     const valueCell = `\`${options.value}\``;
     // --- Main token table: Category | Token | Value | Maps to | Mode ---

package/dist/src/core/token-variant.js

@@ -52,6 +52,28 @@ export function validateVariantSelector(raw) {
 function canonicalSelector(selector) {
     return selector.replace(/\s+/g, '').replace(/["']/g, '');
 }
+/**
+ * The `:root[…]` selector fragment on `line`, spanning to the LAST `]` that
+ * precedes the block's opening brace, or `null` when the line carries none.
+ *
+ * Index arithmetic rather than `/:root\[[^{]*\]/`: `[^{]` also matches `]`,
+ * so that pattern backtracks quadratically on a line repeating `:root[`
+ * (CodeQL `js/polynomial-redos`). Taking the last `]` — not the first —
+ * preserves the greedy regex's reach, so a multi-attribute selector still
+ * compares as the whole fragment and does not collide with a single-attribute
+ * variant that happens to be its prefix.
+ */
+function rootAttributeSelector(line) {
+    const start = line.indexOf(':root[');
+    if (start === -1)
+        return null;
+    const brace = line.indexOf('{', start);
+    const limit = brace === -1 ? line.length : brace;
+    const close = line.lastIndexOf(']', limit - 1);
+    if (close <= start + ':root['.length - 1)
+        return null;
+    return line.slice(start, close + 1);
+}
 /**
  * Finds the top-level `:root<variant>` block whose attribute selector
  * matches `variant` (compared canonically). Returns the opening-brace and
@@ -66,8 +88,8 @@ function findVariantBlock(lines, variant) {
     const want = canonicalSelector(`:root${variant}`);
     for (let i = 0; i < stripped.length; i++) {
         const line = stripped[i] ?? '';
-        const match = /:root\[[^{]*\]/.exec(line);
-        if (!match || canonicalSelector(match[0]) !== want)
+        const selector = rootAttributeSelector(line);
+        if (selector === null || canonicalSelector(selector) !== want)
             continue;
         let openLine = /\{/.test(line) ? i : -1;
         if (openLine === -1) {

package/dist/src/core/tree-store.js

@@ -443,7 +443,11 @@ async function inspectTreeLock(lockPath) {
  */
 export async function removeTree(primaryRoot, name, options = {}) {
     assertValidTreeName(name);
-    const treesDir = getTreesDir(primaryRoot);
+    // Both sides resolved: the containment prefix has to be in the same form as
+    // the path it guards. `getTreesDir` is a `join`, so on Windows it yields a
+    // drive-less path while `resolve` below adds the drive letter — the prefix
+    // test then failed for EVERY tree and refused each removal as an escape.
+    const treesDir = resolve(getTreesDir(primaryRoot));
     const treeRoot = resolve(treesDir, name);
     if (!treeRoot.startsWith(treesDir + sep) || basename(treeRoot) !== name) {
         throw new GeneralError(`Refusing to remove "${name}": resolved path escapes the trees directory.`);

package/dist/src/core/typecheck.js

@@ -22,6 +22,7 @@ import { dirname, isAbsolute, relative, resolve } from 'node:path';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
+import { normalizePathSlashes } from '../utils/paths.js';
 import { composeShimSource, SHIM_FILENAME, SUPPRESSED_DIAGNOSTIC_CODES, UNDEFINED_IDENTIFIER_CODES, UNDEFINED_IDENTIFIER_HINT, } from './typecheck-shim.js';
 /**
  * Sentinel string surfaced as a `TypecheckIssue.message` when the
@@ -239,7 +240,12 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
     // file — and never write it to disk. The CompilerHost below serves
     // it from `shimSource` for `fileExists`/`readFile`/`getSourceFile`.
     const projectDir = dirname(absConfig);
-    const shimPath = resolve(projectDir, `.fireforge-${SHIM_FILENAME}`);
+    // Forward slashes deliberately: TypeScript normalizes every `fileName` it
+    // hands a CompilerHost, on every platform. A shim path carrying Windows
+    // separators never matches those callbacks, so the shim is not served (its
+    // globals report as undefined identifiers) and its own diagnostics are not
+    // filtered out below — the pass reports failures that do not exist.
+    const shimPath = normalizePathSlashes(resolve(projectDir, `.fireforge-${SHIM_FILENAME}`));
     const rootFiles = [...parsed.fileNames, shimPath];
     const defaultHost = ts.createCompilerHost(options);
     const host = {

package/dist/src/types/commands/options.d.ts

@@ -987,7 +987,30 @@ export interface DoctorOptions {
      * the patch manifest under that lock.
      */
     waitLock?: number | boolean;
+    /**
+     * Rebuild patches.json from the on-disk patch files, preserving every
+     * field the patch bodies cannot express. Refused when patches.json exists
+     * but cannot be parsed, unless `allowMetadataLoss` is also set.
+     */
     repairPatchesManifest?: boolean;
+    /**
+     * Repair only the `filesAffected` lists that disagree with their patch
+     * body. Narrower than `repairPatchesManifest`: it rewrites one field on the
+     * drifted rows and leaves every other row byte-identical, and it needs no
+     * project config, so it works on a project whose fireforge.json is broken.
+     */
+    repairFilesAffected?: boolean;
+    /**
+     * Accept the whole-manifest metadata reinvention that rebuilding an
+     * unparseable patches.json implies. Only meaningful with
+     * `repairPatchesManifest`.
+     */
+    allowMetadataLoss?: boolean;
+    /**
+     * Project what a requested repair would change and write nothing. Refused
+     * without a repair flag rather than accepted as a silent no-op.
+     */
+    dryRun?: boolean;
     /**
      * Clear a stale `pendingResolution` marker, but only after the same
      * read-only queue health checks used by `fireforge verify` report no

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hominis/fireforge",
-  "version": "0.44.0",
+  "version": "0.44.1",
   "description": "FireForge — a build tool for customizing Firefox",
   "type": "module",
   "main": "./dist/src/index.js",
@@ -83,7 +83,7 @@
     "vitest": "^4.0.18"
   },
   "engines": {
-    "node": ">=22.22.1"
+    "node": ">=22.22.2"
   },
   "packageManager": "npm@11.12.1",
   "license": "EUPL-1.2",